Edit tour

Windows Analysis Report
13.03.2025-13.03.2025 shtml.exe

Overview

General Information

Sample name:	13.03.2025-13.03.2025 shtml.exe
Analysis ID:	1638491
MD5:	9d230f555a48d165dab09a7fc8217e1d
SHA1:	b92e29329be4e01e571a7d63d2bf08632de7c796
SHA256:	6eaa8b8e5596f08328a7d53938eadc4617ea123d40c2b0c6e4876f5a6dd30d17
Tags:	exeuser-threatcat_ch
Infos:

Detection

MSIL Logger, MassLogger RAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected MSIL Logger

Yara detected MassLogger RAT

Yara detected Telegram RAT

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

13.03.2025-13.03.2025 shtml.exe (PID: 7468 cmdline: "C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe" MD5: 9D230F555A48D165DAB09A7FC8217E1D)

RegAsm.exe (PID: 7500 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Configuration

Threatname: MassLogger

{"EXfil Mode": "SMTP", "From": "darksender@mcnzxz.com", "Password": "Nigeria@2025", "Server": "cphost14.qhoster.net"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xefdf:$a1: get_encryptedPassword 0xf307:$a2: get_encryptedUsername 0xed7a:$a3: get_timePasswordChanged 0xee9b:$a4: get_passwordField 0xeff5:$a5: set_encryptedPassword 0x10951:$a7: get_logins 0x10602:$a8: GetOutlookPasswords 0x103f4:$a9: StartKeylogger 0x108a1:$a10: KeyLoggerEventArgs 0x10451:$a11: KeyLoggerEventArgsEventHandler
00000001.00000002.2393283628.0000000002636000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x16fa8f:$a1: get_encryptedPassword 0x1868bf:$a1: get_encryptedPassword 0x19d4df:$a1: get_encryptedPassword 0x16fdb7:$a2: get_encryptedUsername 0x186be7:$a2: get_encryptedUsername 0x19d807:$a2: get_encryptedUsername 0x16f82a:$a3: get_timePasswordChanged 0x18665a:$a3: get_timePasswordChanged 0x19d27a:$a3: get_timePasswordChanged 0x16f94b:$a4: get_passwordField 0x18677b:$a4: get_passwordField 0x19d39b:$a4: get_passwordField 0x16faa5:$a5: set_encryptedPassword 0x1868d5:$a5: set_encryptedPassword 0x19d4f5:$a5: set_encryptedPassword 0x171401:$a7: get_logins 0x188231:$a7: get_logins 0x19ee51:$a7: get_logins 0x1710b2:$a8: GetOutlookPasswords 0x187ee2:$a8: GetOutlookPasswords 0x19eb02:$a8: GetOutlookPasswords
Process Memory Space: 13.03.2025-13.03.2025 shtml.exe PID: 7468	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: 13.03.2025-13.03.2025 shtml.exe PID: 7468	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 13.03.2025-13.03.2025 shtml.exe PID: 7468	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 13.03.2025-13.03.2025 shtml.exe PID: 7468	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: 13.03.2025-13.03.2025 shtml.exe PID: 7468	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: 13.03.2025-13.03.2025 shtml.exe PID: 7468	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x250b0:$a1: get_encryptedPassword 0x25347:$a2: get_encryptedUsername 0x24e6c:$a3: get_timePasswordChanged 0x24f80:$a4: get_passwordField 0x250c6:$a5: set_encryptedPassword 0x2650a:$a7: get_logins 0x26238:$a8: GetOutlookPasswords 0x26080:$a9: StartKeylogger 0x2646f:$a10: KeyLoggerEventArgs 0x260dd:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegAsm.exe PID: 7500	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 7500	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7500	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: RegAsm.exe PID: 7500	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 7500	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1b53e:$a1: get_encryptedPassword 0x1b857:$a2: get_encryptedUsername 0x1b2ed:$a3: get_timePasswordChanged 0x1b40e:$a4: get_passwordField 0x1b554:$a5: set_encryptedPassword 0x1ce57:$a7: get_logins 0x1cb08:$a8: GetOutlookPasswords 0x1c8fa:$a9: StartKeylogger 0x1cda7:$a10: KeyLoggerEventArgs 0x1c957:$a11: KeyLoggerEventArgsEventHandler
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3df:$a1: get_encryptedPassword 0xd707:$a2: get_encryptedUsername 0xd17a:$a3: get_timePasswordChanged 0xd29b:$a4: get_passwordField 0xd3f5:$a5: set_encryptedPassword 0xed51:$a7: get_logins 0xea02:$a8: GetOutlookPasswords 0xe7f4:$a9: StartKeylogger 0xeca1:$a10: KeyLoggerEventArgs 0xe851:$a11: KeyLoggerEventArgsEventHandler
0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12397:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11895:$a3: \Google\Chrome\User Data\Default\Login Data 0x11ba3:$a4: \Orbitum\User Data\Default\Login Data 0x1299b:$a5: \Kometa\User Data\Default\Login Data
1.2.RegAsm.exe.1e0000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
1.2.RegAsm.exe.1e0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegAsm.exe.1e0000.0.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
1.2.RegAsm.exe.1e0000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.RegAsm.exe.1e0000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x105f4:$a9: StartKeylogger 0x10aa1:$a10: KeyLoggerEventArgs 0x10651:$a11: KeyLoggerEventArgsEventHandler
1.2.RegAsm.exe.1e0000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14197:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13695:$a3: \Google\Chrome\User Data\Default\Login Data 0x139a3:$a4: \Orbitum\User Data\Default\Login Data 0x1479b:$a5: \Kometa\User Data\Default\Login Data
0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3df:$a1: get_encryptedPassword 0xd707:$a2: get_encryptedUsername 0xd17a:$a3: get_timePasswordChanged 0xd29b:$a4: get_passwordField 0xd3f5:$a5: set_encryptedPassword 0xed51:$a7: get_logins 0xea02:$a8: GetOutlookPasswords 0xe7f4:$a9: StartKeylogger 0xeca1:$a10: KeyLoggerEventArgs 0xe851:$a11: KeyLoggerEventArgsEventHandler
0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12397:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11895:$a3: \Google\Chrome\User Data\Default\Login Data 0x11ba3:$a4: \Orbitum\User Data\Default\Login Data 0x1299b:$a5: \Kometa\User Data\Default\Login Data
0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0x25dff:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0x26127:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0x25b9a:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0x25cbb:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x25e15:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x27771:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x27422:$a8: GetOutlookPasswords 0x105f4:$a9: StartKeylogger 0x27214:$a9: StartKeylogger 0x10aa1:$a10: KeyLoggerEventArgs 0x276c1:$a10: KeyLoggerEventArgs 0x10651:$a11: KeyLoggerEventArgsEventHandler 0x27271:$a11: KeyLoggerEventArgsEventHandler
0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14197:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2adb7:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13695:$a3: \Google\Chrome\User Data\Default\Login Data 0x2a2b5:$a3: \Google\Chrome\User Data\Default\Login Data 0x139a3:$a4: \Orbitum\User Data\Default\Login Data 0x2a5c3:$a4: \Orbitum\User Data\Default\Login Data 0x1479b:$a5: \Kometa\User Data\Default\Login Data 0x2b3bb:$a5: \Kometa\User Data\Default\Login Data
0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0x2600f:$a1: get_encryptedPassword 0x3cc2f:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0x26337:$a2: get_encryptedUsername 0x3cf57:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0x25daa:$a3: get_timePasswordChanged 0x3c9ca:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0x25ecb:$a4: get_passwordField 0x3caeb:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x26025:$a5: set_encryptedPassword 0x3cc45:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x27981:$a7: get_logins 0x3e5a1:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x27632:$a8: GetOutlookPasswords 0x3e252:$a8: GetOutlookPasswords
0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14197:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2afc7:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x41be7:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13695:$a3: \Google\Chrome\User Data\Default\Login Data 0x2a4c5:$a3: \Google\Chrome\User Data\Default\Login Data 0x410e5:$a3: \Google\Chrome\User Data\Default\Login Data 0x139a3:$a4: \Orbitum\User Data\Default\Login Data 0x2a7d3:$a4: \Orbitum\User Data\Default\Login Data 0x413f3:$a4: \Orbitum\User Data\Default\Login Data 0x1479b:$a5: \Kometa\User Data\Default\Login Data 0x2b5cb:$a5: \Kometa\User Data\Default\Login Data 0x421eb:$a5: \Kometa\User Data\Default\Login Data
0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x5502f:$a1: get_encryptedPassword 0x6be5f:$a1: get_encryptedPassword 0x82a7f:$a1: get_encryptedPassword 0x55357:$a2: get_encryptedUsername 0x6c187:$a2: get_encryptedUsername 0x82da7:$a2: get_encryptedUsername 0x54dca:$a3: get_timePasswordChanged 0x6bbfa:$a3: get_timePasswordChanged 0x8281a:$a3: get_timePasswordChanged 0x54eeb:$a4: get_passwordField 0x6bd1b:$a4: get_passwordField 0x8293b:$a4: get_passwordField 0x55045:$a5: set_encryptedPassword 0x6be75:$a5: set_encryptedPassword 0x82a95:$a5: set_encryptedPassword 0x569a1:$a7: get_logins 0x6d7d1:$a7: get_logins 0x843f1:$a7: get_logins 0x56652:$a8: GetOutlookPasswords 0x6d482:$a8: GetOutlookPasswords 0x840a2:$a8: GetOutlookPasswords
0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x59fe7:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x70e17:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x87a37:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x594e5:$a3: \Google\Chrome\User Data\Default\Login Data 0x70315:$a3: \Google\Chrome\User Data\Default\Login Data 0x86f35:$a3: \Google\Chrome\User Data\Default\Login Data 0x597f3:$a4: \Orbitum\User Data\Default\Login Data 0x70623:$a4: \Orbitum\User Data\Default\Login Data 0x87243:$a4: \Orbitum\User Data\Default\Login Data 0x5a5eb:$a5: \Kometa\User Data\Default\Login Data 0x7141b:$a5: \Kometa\User Data\Default\Login Data 0x8803b:$a5: \Kometa\User Data\Default\Login Data
Click to see the 31 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T12:54:06.596543+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49713	158.101.44.242	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 13.03.2025-13.03.2025 shtml.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: MassLogger {"EXfil Mode": "SMTP", "From": "darksender@mcnzxz.com", "Password": "Nigeria@2025", "Server": "cphost14.qhoster.net"}

Multi AV Scanner detection for submitted file

Source: 13.03.2025-13.03.2025 shtml.exe	Virustotal: Detection: 56%			Perma Link
Source: 13.03.2025-13.03.2025 shtml.exe	ReversingLabs: Detection: 52%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: 13.03.2025-13.03.2025 shtml.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49714 version: TLS 1.0

Source: 13.03.2025-13.03.2025 shtml.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: G:\IMPORTANT SRC\GOOD Nova\Crypter\Stubs Fully\Public\Public Runpe\PR\PR\obj\Debug\Poses.pdb source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1164243380.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1164243380.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp, 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1165420462.0000000005150000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 00905782h	1_2_00905366
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 009051B9h	1_2_00904F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 00905782h	1_2_009056AF

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49713 -> 158.101.44.242:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49714 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: RegAsm.exe, 00000001.00000002.2393283628.000000000257E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegAsm.exe, 00000001.00000002.2393283628.0000000002511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: RegAsm.exe, 00000001.00000002.2393283628.00000000025AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegAsm.exe, 00000001.00000002.2393283628.00000000025AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: RegAsm.exe, 00000001.00000002.2393283628.0000000002511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l

Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.RegAsm.exe.1e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.RegAsm.exe.1e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: 13.03.2025-13.03.2025 shtml.exe PID: 7468, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegAsm.exe PID: 7500, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Code function: 0_2_0296CC24	0_2_0296CC24
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Code function: 0_2_050E9550	0_2_050E9550
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Code function: 0_2_050E1C00	0_2_050E1C00
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Code function: 0_2_050E0006	0_2_050E0006
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Code function: 0_2_050E0040	0_2_050E0040
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Code function: 0_2_050E1BF0	0_2_050E1BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0090C168	1_2_0090C168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0090CA58	1_2_0090CA58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00907E68	1_2_00907E68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00904F08	1_2_00904F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0090C386	1_2_0090C386
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0090B9DC	1_2_0090B9DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0090B9E0	1_2_0090B9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00902DD1	1_2_00902DD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00904EF8	1_2_00904EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00907E66	1_2_00907E66

Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000000.1150973078.0000000000822000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameoven.exe* vs 13.03.2025-13.03.2025 shtml.exe
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1165420462.000000000515C000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePoses.dll, vs 13.03.2025-13.03.2025 shtml.exe
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1162910289.0000000000CEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 13.03.2025-13.03.2025 shtml.exe
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAntiBossing.dll8 vs 13.03.2025-13.03.2025 shtml.exe
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs 13.03.2025-13.03.2025 shtml.exe
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1164243380.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePoses.dll, vs 13.03.2025-13.03.2025 shtml.exe
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1164243380.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs 13.03.2025-13.03.2025 shtml.exe
Source: 13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1165365654.0000000005120000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAntiBossing.dll8 vs 13.03.2025-13.03.2025 shtml.exe
Source: 13.03.2025-13.03.2025 shtml.exe	Binary or memory string: OriginalFilenameoven.exe* vs 13.03.2025-13.03.2025 shtml.exe

Source: 13.03.2025-13.03.2025 shtml.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.RegAsm.exe.1e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.RegAsm.exe.1e0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: 13.03.2025-13.03.2025 shtml.exe PID: 7468, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegAsm.exe PID: 7500, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 13.03.2025-13.03.2025 shtml.exe, Nation.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack, FuelfordChassis.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.5120000.5.raw.unpack, FuelfordChassis.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\13.03.2025-13.03.2025 shtml.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutant created: NULL

Source: 13.03.2025-13.03.2025 shtml.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 13.03.2025-13.03.2025 shtml.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000001.00000002.2393283628.0000000002600000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2393283628.000000000260F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2393283628.00000000025F1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 13.03.2025-13.03.2025 shtml.exe	Virustotal: Detection: 56%
Source: 13.03.2025-13.03.2025 shtml.exe	ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe "C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe"
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 13.03.2025-13.03.2025 shtml.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 13.03.2025-13.03.2025 shtml.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Source: 13.03.2025-13.03.2025 shtml.exe

Static PE information: 0xC6296E11 [Thu May 9 05:05:21 2075 UTC]

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe

Code function: 0_2_0296E6C8 push esp; retf

0_2_0296E6C9

Source: 13.03.2025-13.03.2025 shtml.exe

Static PE information: section name: .text entropy: 7.681530557158975

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 13.03.2025-13.03.2025 shtml.exe PID: 7468, type: MEMORYSTR

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Memory allocated: 2960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Memory allocated: 2B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Memory allocated: 4B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 8A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2350000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe TID: 7488

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: RegAsm.exe, 00000001.00000002.2392152981.00000000007A0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0090C168 LdrInitializeThunk,LdrInitializeThunk,

1_2_0090C168

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, UltraSpeed.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text9 + "\\mozglue.dll"))

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1E0000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1E0000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1E0000	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1E2000	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1FA000	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1FC000	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 3CD008	Jump to behavior

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MSIL Logger

Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 13.03.2025-13.03.2025 shtml.exe PID: 7468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7500, type: MEMORYSTR

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 13.03.2025-13.03.2025 shtml.exe PID: 7468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7500, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 13.03.2025-13.03.2025 shtml.exe PID: 7468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7500, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2393283628.0000000002636000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 13.03.2025-13.03.2025 shtml.exe PID: 7468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7500, type: MEMORYSTR

Remote Access Functionality

Yara detected MSIL Logger

Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 13.03.2025-13.03.2025 shtml.exe PID: 7468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7500, type: MEMORYSTR

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 13.03.2025-13.03.2025 shtml.exe PID: 7468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7500, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c906e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c798b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13.03.2025-13.03.2025 shtml.exe.3c33a60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 13.03.2025-13.03.2025 shtml.exe PID: 7468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7500, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Data from Local System	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
13.03.2025-13.03.2025 shtml.exe	57%	Virustotal		Browse
13.03.2025-13.03.2025 shtml.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
13.03.2025-13.03.2025 shtml.exe	100%	Avira	HEUR/AGEN.1308654

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.32.1	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false		high
http://checkip.dyndns.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.apache.org/licenses/LICENSE-2.0	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designersG	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/?	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/bThe	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers?	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.orgd	RegAsm.exe, 00000001.00000002.2393283628.00000000025AD000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.tiro.com	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	RegAsm.exe, 00000001.00000002.2393283628.000000000257E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.carterandcone.coml	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sajatypeworks.com	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.typography.netD	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/cabarga.htmlN	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/cThe	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/staff/dennis.htm	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/frere-user.html	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189l	RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.comd	RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp	false	high
http://www.jiyu-kobo.co.jp/	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189d	RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	RegAsm.exe, 00000001.00000002.2393283628.00000000025AD000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.orgd	RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/DPlease	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers8	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fonts.com	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.urwpp.deDPlease	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.zhongyicts.com.cn	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/d	RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000001.00000002.2393283628.0000000002511000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sakkal.com	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1166052994.0000000006E92000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot-/sendDocument?chat_id=	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	13.03.2025-13.03.2025 shtml.exe, 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2393283628.0000000002590000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.32.1	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false
158.101.44.242	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1638491
Start date and time:	2025-03-14 12:53:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	13.03.2025-13.03.2025 shtml.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 35 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.199.214.10, 4.175.87.197
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.32.1	SHIPPING DETAILS_PDF.exe	Get hash	malicious	FormBook	Browse	www.auto-total.info/3lc9/
	arGdXDmyGJ.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/a669/
	2rvyZc27tz.exe	Get hash	malicious	FormBook	Browse	www.kdrqcyusevx.info/k7wl/
	Final PayStub.exe	Get hash	malicious	FormBook	Browse	www.oddsideodylicoopod.cloud/g43m/?chops=VTj0v6ZXr6p4dp&Ezr8U8lh=iHr8ZanSEmppv2NUfEI3Sn+a6zMFeevffxq5V5At5Kf3VZBf0vxOCE6EQW7iEjpklZqKgy7LQg==
	JOB NO. AIQ8478.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	DHL AWB Receipt_pdf.bat.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	MmF9tcIj1J.exe	Get hash	malicious	FormBook	Browse	www.newanthoperso.shop/lqfq/
	Payment Invoice ref0306252.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/a669/
	DHL AWB Receipt_pdf.bat.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	RFQ - 1239- PERSIAN GULF BIDBOLAND PDH PROJECT-PDF.exe	Get hash	malicious	FormBook	Browse	www.kdrqcyusevx.info/k7wl/
158.101.44.242	DON.ps1	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	believe.ps1	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	INV000001203.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Purchase Order No.1364.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	justificante de transferencia09454545.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	QUOTATION_FEBQUOTE312025#U00faPDF.scr	Get hash	malicious	MSIL Logger	Browse	checkip.dyndns.org/
	category05 sc110-11#U3000_Z01G-00008D Siparis PO15804-25 - H64PO1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	8QeI7CboDY.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	uhg.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	SOA FEB 2025.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	DON.ps1	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.32.1
	believe.ps1	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	INV000001203.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	SecuriteInfo.com.Win32.SpywareX-gen.21876.23851.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	Payment slip.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	Statement FEB 2025pdf.com.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	Purchase Order No.1364.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	Mv Arkadiy ChernyshevCall for disch logs 8000cbms_pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
checkip.dyndns.com	SOA FEB 2025.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	DON.ps1	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	believe.ps1	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	INV000001203.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	SecuriteInfo.com.Win32.SpywareX-gen.21876.23851.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Payment slip.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Statement FEB 2025pdf.com.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Purchase Order No.1364.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Mv Arkadiy ChernyshevCall for disch logs 8000cbms_pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.8.169
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.130.0

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	DON.ps1	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	158.101.44.242
	believe.ps1	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	INV000001203.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	SecuriteInfo.com.Win32.SpywareX-gen.21876.23851.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Payment slip.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Purchase Order No.1364.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Notice Letter 2025 03 12 02930920.docs.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.6.168
	Bank Swift Payment.bat.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.130.0
CLOUDFLARENETUS	SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Get hash	malicious	ScreenConnect Tool	Browse	172.67.181.28
	https://https.docusign.click/Xckp3QUpZN3dxRHFodEMwRElEMjkzNi96OEZ0MzdvM05qN3hHeE9JNjdDMThoQVo0Ukl2UEhETTdTZEVjNCtzS0IzUFBQb3l5SnRmbWdnMHpCVzdkaTl6NjJEcS93cVduMkdvOHJLV3RlK0JkbmFKRS9oRTdDUXVhVlZXQUd0anJnaUNyTHBNL2xhaFNpd0xwVnFvdlg3dnNYNGlNczg5ZkhVdTZmVlBtd3FEK0RCMHh0THJOdGRYMmRKVUMzK0xKanduNzZ3PT0tLUJCU3Z2YVFGNUd0UHl1TWctLWZaZnlpcFIxMDRETkp4eEx1SVhuQVE9PQ==?cid=322110114	Get hash	malicious	KnowBe4	Browse	104.17.245.203
	SecuriteInfo.com.W32.Lolbas.A.tr.25597.31355.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.21.48.1
	SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.21.72.99
	http://www.windowsdnsservicereload.icu	Get hash	malicious	Unknown	Browse	104.21.80.1
	https://encryption-marinha.jkndfuzv.ru/PtM2i/$nadia.sofia.rijo@marinha.pt	Get hash	malicious	Unknown	Browse	104.17.25.14
	VM Orger Acknowledged.zip	Get hash	malicious	Unknown	Browse	104.16.4.189
	http://188.114.97.3	Get hash	malicious	Unknown	Browse	104.16.123.96
	http://188.114.96.3	Get hash	malicious	Unknown	Browse	104.16.123.96
	Xsysglobal Payment Receipt For Invoice 6c6172732e6b72616566744078737973676c6f62616c2e636f6d.pdf	Get hash	malicious	Unknown	Browse	172.67.149.15

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	SOA FEB 2025.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.32.1
	DON.ps1	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.32.1
	believe.ps1	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	QUOTATION#006565.exe	Get hash	malicious	RedLine	Browse	104.21.32.1
	SecuriteInfo.com.Win32.SpywareX-gen.21876.23851.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	Payment slip.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	Mv Arkadiy ChernyshevCall for disch logs 8000cbms_pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.32.1
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.32.1
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.32.1
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1

Process:	C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.656786420263492
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	13.03.2025-13.03.2025 shtml.exe
File size:	244'736 bytes
MD5:	9d230f555a48d165dab09a7fc8217e1d
SHA1:	b92e29329be4e01e571a7d63d2bf08632de7c796
SHA256:	6eaa8b8e5596f08328a7d53938eadc4617ea123d40c2b0c6e4876f5a6dd30d17
SHA512:	c91a62909edeb30b3b929a5b19d45215d59ab53d1e8bf35ca647d1b5c3fc2307f0c4713c78b1f3902e1084e4a141d1052f6ddc6dda20bbafb19124c31bee0a6b
SSDEEP:	3072:lAnTe+kqIHjFu7LVs6GK6a8dO0W706aycGU8n5VEJgxyGJUMbWa6xS5VlgTiGavN:okPCHRaycGUq5C2EWBgeGQmT50
TLSH:	8334E681B5D649D4FE7526799063081723B13C6EAA3EB9280F0012FED55FBC2F78479A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....n)...............0.............n.... ........@.. ....................... ............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x43d16e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC6296E11 [Thu May 9 05:05:21 2075 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3d114	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3e000	0x586	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x40000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3b174	0x3b200	3e9ae16f0778a387500215f67e00aa95	False	0.6558824986786469	data	7.681530557158975	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x3e000	0x586	0x600	0a26726623e42c8455fcef0eb1de2339	False	0.4140625	data	4.009219536512398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x40000	0xc	0x200	038d8005dc7d29eed6a48a56a78c02e2	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3e0a0	0x2fc	data			0.43586387434554974
RT_MANIFEST	0x3e39c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments
CompanyName
FileDescription	oven
FileVersion	1.0.0.0
InternalName	oven.exe
LegalCopyright	Copyright 2025
LegalTrademarks
OriginalFilename	oven.exe
ProductName	oven
ProductVersion	1.0.0.0
Assembly Version	1.0.0.0

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-14T12:54:06.596543+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49713	158.101.44.242	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2025 12:54:05.792124987 CET	49713	80	192.168.2.4	158.101.44.242
Mar 14, 2025 12:54:05.796895981 CET	80	49713	158.101.44.242	192.168.2.4
Mar 14, 2025 12:54:05.796967983 CET	49713	80	192.168.2.4	158.101.44.242
Mar 14, 2025 12:54:05.797172070 CET	49713	80	192.168.2.4	158.101.44.242
Mar 14, 2025 12:54:05.801739931 CET	80	49713	158.101.44.242	192.168.2.4
Mar 14, 2025 12:54:06.378534079 CET	80	49713	158.101.44.242	192.168.2.4
Mar 14, 2025 12:54:06.384552956 CET	49713	80	192.168.2.4	158.101.44.242
Mar 14, 2025 12:54:06.389261007 CET	80	49713	158.101.44.242	192.168.2.4
Mar 14, 2025 12:54:06.541883945 CET	80	49713	158.101.44.242	192.168.2.4
Mar 14, 2025 12:54:06.553623915 CET	49714	443	192.168.2.4	104.21.32.1
Mar 14, 2025 12:54:06.553683043 CET	443	49714	104.21.32.1	192.168.2.4
Mar 14, 2025 12:54:06.553745031 CET	49714	443	192.168.2.4	104.21.32.1
Mar 14, 2025 12:54:06.568520069 CET	49714	443	192.168.2.4	104.21.32.1
Mar 14, 2025 12:54:06.568555117 CET	443	49714	104.21.32.1	192.168.2.4
Mar 14, 2025 12:54:06.596543074 CET	49713	80	192.168.2.4	158.101.44.242
Mar 14, 2025 12:54:07.039164066 CET	443	49714	104.21.32.1	192.168.2.4
Mar 14, 2025 12:54:07.039254904 CET	49714	443	192.168.2.4	104.21.32.1
Mar 14, 2025 12:54:07.056663990 CET	49714	443	192.168.2.4	104.21.32.1
Mar 14, 2025 12:54:07.056715012 CET	443	49714	104.21.32.1	192.168.2.4
Mar 14, 2025 12:54:07.057068110 CET	443	49714	104.21.32.1	192.168.2.4
Mar 14, 2025 12:54:07.112198114 CET	49714	443	192.168.2.4	104.21.32.1
Mar 14, 2025 12:54:07.400643110 CET	49714	443	192.168.2.4	104.21.32.1
Mar 14, 2025 12:54:07.448335886 CET	443	49714	104.21.32.1	192.168.2.4
Mar 14, 2025 12:54:07.508330107 CET	443	49714	104.21.32.1	192.168.2.4
Mar 14, 2025 12:54:07.508394957 CET	443	49714	104.21.32.1	192.168.2.4
Mar 14, 2025 12:54:07.508562088 CET	49714	443	192.168.2.4	104.21.32.1
Mar 14, 2025 12:54:07.513834000 CET	49714	443	192.168.2.4	104.21.32.1
Mar 14, 2025 12:55:11.545433998 CET	80	49713	158.101.44.242	192.168.2.4
Mar 14, 2025 12:55:11.545564890 CET	49713	80	192.168.2.4	158.101.44.242
Mar 14, 2025 12:55:46.551012993 CET	49713	80	192.168.2.4	158.101.44.242
Mar 14, 2025 12:55:46.555798054 CET	80	49713	158.101.44.242	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2025 12:54:05.774713993 CET	57710	53	192.168.2.4	1.1.1.1
Mar 14, 2025 12:54:05.781335115 CET	53	57710	1.1.1.1	192.168.2.4
Mar 14, 2025 12:54:06.544769049 CET	58144	53	192.168.2.4	1.1.1.1
Mar 14, 2025 12:54:06.552545071 CET	53	58144	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 14, 2025 12:54:05.774713993 CET	192.168.2.4	1.1.1.1	0x8cdc	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:54:06.544769049 CET	192.168.2.4	1.1.1.1	0xacca	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 14, 2025 12:54:05.781335115 CET	1.1.1.1	192.168.2.4	0x8cdc	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 12:54:05.781335115 CET	1.1.1.1	192.168.2.4	0x8cdc	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:54:05.781335115 CET	1.1.1.1	192.168.2.4	0x8cdc	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:54:05.781335115 CET	1.1.1.1	192.168.2.4	0x8cdc	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:54:05.781335115 CET	1.1.1.1	192.168.2.4	0x8cdc	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:54:05.781335115 CET	1.1.1.1	192.168.2.4	0x8cdc	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:54:06.552545071 CET	1.1.1.1	192.168.2.4	0xacca	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:54:06.552545071 CET	1.1.1.1	192.168.2.4	0xacca	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:54:06.552545071 CET	1.1.1.1	192.168.2.4	0xacca	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:54:06.552545071 CET	1.1.1.1	192.168.2.4	0xacca	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:54:06.552545071 CET	1.1.1.1	192.168.2.4	0xacca	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:54:06.552545071 CET	1.1.1.1	192.168.2.4	0xacca	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:54:06.552545071 CET	1.1.1.1	192.168.2.4	0xacca	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49713	158.101.44.242	80	7500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Mar 14, 2025 12:54:05.797172070 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 14, 2025 12:54:06.378534079 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 11:54:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: dd1b6e5ea5628ce90150a2b764226b1f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Mar 14, 2025 12:54:06.384552956 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 14, 2025 12:54:06.541883945 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 11:54:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b427f1522908929198048b70bbfb1a65 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49714	104.21.32.1	443	7500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-14 11:54:07 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-14 11:54:07 UTC	854	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 11:54:07 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 103513 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Thu, 13 Mar 2025 07:08:53 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bQbt1Eq9ebs7Q2xMQ2HScW3f1DMKns1ZrspBxS7IgrJKFSJQkMtmc3LNBSDeFusEp6F8%2FkFIEkRq%2FwOoanw3kNFBMQA4MAmH3yLI90Vmk6P8DBwfXht1wOQc2eFmGJArkoe%2FrFI6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92039314891019cb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1788&min_rtt=1782&rtt_var=680&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1594756&cwnd=230&unsent_bytes=0&cid=069d3ae52c44449c&ts=481&x=0"
2025-03-14 11:54:07 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	07:54:04
Start date:	14/03/2025
Path:	C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\13.03.2025-13.03.2025 shtml.exe"
Imagebase:	0x820000
File size:	244'736 bytes
MD5 hash:	9D230F555A48D165DAB09A7FC8217E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSILLogger, Description: Yara detected MSIL Logger, Source: 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1164569253.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:54:04
Start date:	14/03/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x100000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSILLogger, Description: Yara detected MSIL Logger, Source: 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.2390940134.00000000001E2000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2393283628.0000000002636000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	19.1%
Total number of Nodes:	157
Total number of Limit Nodes:	8

Executed Functions

Function 050E9550 Relevance: 1.9, Strings: 1, Instructions: 650
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 050E9DB4

Memory Dump Source

Source File: 00000000.00000002.1165297782.00000000050E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50e0000_13.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 3b2c35c0cd2403f723db13e10eebfcad8ca92dcd422ee266dcef8252bfcbd93f
Instruction ID: b2a9ddfff9f17d57985aeb080a525ddc79b08a23f4c9d1c536abb05509050d9d
Opcode Fuzzy Hash: 3b2c35c0cd2403f723db13e10eebfcad8ca92dcd422ee266dcef8252bfcbd93f
Instruction Fuzzy Hash: BD62D470E012288FDB64DF65D984BDDBBB2BF89304F2485EAD409A7294DB319E85CF40

Function 050E1C00 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1165297782.00000000050E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50e0000_13.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd02b8bdb3ccada91fe6812cd6be3270030243ecb340bd7aadd96b464be38538
Instruction ID: ce33770b7a59cb7439acd751f138129e896bcb0a038d9e75077794c015146ee7
Opcode Fuzzy Hash: bd02b8bdb3ccada91fe6812cd6be3270030243ecb340bd7aadd96b464be38538
Instruction Fuzzy Hash: 35A17035E103198FDB04DFA4D894AEDBBFAFF89300F658215E416AF2A4DB70A945CB50

Function 050E1BF0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1165297782.00000000050E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50e0000_13.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cfe7c51adfc04667c2631e6a2c846d1450f16b05264609ee74939103ad97628
Instruction ID: 55791e28ad3b7c20514fe2a9bc434cc983311218a49b745e5f573cafba33c1ec
Opcode Fuzzy Hash: 6cfe7c51adfc04667c2631e6a2c846d1450f16b05264609ee74939103ad97628
Instruction Fuzzy Hash: B9917135E103099FDB04DFA4D8849DDBBFAFF89300B658215F416AB2A8DB70E945CB50

Function 0296CCE9 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0296CD76
GetCurrentThread.KERNEL32 ref: 0296CDB3
GetCurrentProcess.KERNEL32 ref: 0296CDF0
GetCurrentThreadId.KERNEL32 ref: 0296CE49

Memory Dump Source

Source File: 00000000.00000002.1163602767.0000000002960000.00000040.00000800.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_13.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d29d1584502e0debc4fc884256b6a50e9d764fb3ffcc7dcfd59314bf33c6d59a
Instruction ID: ae0f662d8b4dec7be5c3a5ce24953f4fc21278d58e25235dda9cf44d089d38d7
Opcode Fuzzy Hash: d29d1584502e0debc4fc884256b6a50e9d764fb3ffcc7dcfd59314bf33c6d59a
Instruction Fuzzy Hash: 9E5124B0D003498FEB14CFA9D588BEEBFF1EF88314F24845AE049AB260DB345945CB65

Function 0296CCF8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0296CD76
GetCurrentThread.KERNEL32 ref: 0296CDB3
GetCurrentProcess.KERNEL32 ref: 0296CDF0
GetCurrentThreadId.KERNEL32 ref: 0296CE49

Memory Dump Source

Source File: 00000000.00000002.1163602767.0000000002960000.00000040.00000800.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_13.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d71806a21ac1ab4dba7da3f1ef8e1ebb9581d6e1a974f60f47026e416894c17b
Instruction ID: 4665f5c27f69b1e7bfa88725c97a603d4f71ffa219b160f3a73616c031866443
Opcode Fuzzy Hash: d71806a21ac1ab4dba7da3f1ef8e1ebb9581d6e1a974f60f47026e416894c17b
Instruction Fuzzy Hash: 7C5146B0D003498FEB14CFAAD588BAEBBF5EF48314F248059E049A7350DB345944CF65

Function 050E8DB4 Relevance: 1.7, APIs: 1, Instructions: 244
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 050E8FF6

Memory Dump Source

Source File: 00000000.00000002.1165297782.00000000050E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50e0000_13.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c950a274d3927b19ac7a6cd57d1b3694d976e5393d7221595707eaaf5009492c
Instruction ID: 751fc6ab8fdc9ad79f35323dc3ef39256f0e6c3e30ce5b7c2123f9f561d73dd9
Opcode Fuzzy Hash: c950a274d3927b19ac7a6cd57d1b3694d976e5393d7221595707eaaf5009492c
Instruction Fuzzy Hash: D7915A71D003199FEB24CFA8D845BEDBBF2BF48310F1485A9E819A7280DB759985CF91

Function 050E8DC0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 13.03.2025-13.03.2025 shtml.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\13.03.2025-13.03.2025 shtml.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
13.03.2025-13.03.2025 shtml.exe

Function 050E9550 Relevance: 1.9, Strings: 1, Instructions: 650
COMMON

Function 0296CCE9 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Function 0296CCF8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 050E8DB4 Relevance: 1.7, APIs: 1, Instructions: 244
processCOMMON

Function 050E8DC0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON