Loading ...

Play interactive tourEdit tour

Analysis Report p7YOuaDCGw.exe

Overview

General Information

Sample Name:p7YOuaDCGw.exe
MD5:0f6e9f11cf49c417a126027a36ca0ccf
SHA1:4126f3fdee1151ea45bee2f0cac98ae01b57348b
SHA256:56a4523b72aef34982a90a480c17386862d4788c0501b9982d798d43c860cc6c

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Yara detected AgentTesla
.NET source code contains potential unpacker
.NET source code contains very large strings
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal WLAN passwords
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses netsh to modify the Windows network and firewall settings
Antivirus or Machine Learning detection for unpacked file
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • p7YOuaDCGw.exe (PID: 2156 cmdline: 'C:\Users\user\Desktop\p7YOuaDCGw.exe' MD5: 0F6E9F11CF49C417A126027A36CA0CCF)
    • p7YOuaDCGw.exe (PID: 2748 cmdline: {path} MD5: 0F6E9F11CF49C417A126027A36CA0CCF)
    • p7YOuaDCGw.exe (PID: 620 cmdline: {path} MD5: 0F6E9F11CF49C417A126027A36CA0CCF)
      • netsh.exe (PID: 4944 cmdline: 'netsh' wlan show profile MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)
        • conhost.exe (PID: 2084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "FnJe3Gxkjqh", "URL: ": "http://WNJDqVQdJCO5LO.org", "To: ": "", "ByHost: ": "smtp.yandex.com:587", "Password: ": "feemgw", "From: ": ""}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000002.1187181132.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000000.00000002.784430263.0000000004190000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000003.00000002.1190788739.00000000033A0000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000003.00000002.1191348579.00000000034D0000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          Process Memory Space: p7YOuaDCGw.exe PID: 620JoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 2 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            3.2.p7YOuaDCGw.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview


              System Summary:

              barindex
              Sigma detected: Capture Wi-Fi passwordShow sources
              Source: Process startedAuthor: Joe Security: Data: Command: 'netsh' wlan show profile, CommandLine: 'netsh' wlan show profile, CommandLine|base64offset|contains: V, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: {path}, ParentImage: C:\Users\user\Desktop\p7YOuaDCGw.exe, ParentProcessId: 620, ProcessCommandLine: 'netsh' wlan show profile, ProcessId: 4944

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Found malware configurationShow sources
              Source: p7YOuaDCGw.exe.620.3.memstrMalware Configuration Extractor: Agenttesla {"Username: ": "FnJe3Gxkjqh", "URL: ": "http://WNJDqVQdJCO5LO.org", "To: ": "", "ByHost: ": "smtp.yandex.com:587", "Password: ": "feemgw", "From: ": ""}
              Multi AV Scanner detection for submitted fileShow sources
              Source: p7YOuaDCGw.exeVirustotal: Detection: 77%Perma Link
              Source: p7YOuaDCGw.exeReversingLabs: Detection: 67%
              Machine Learning detection for sampleShow sources
              Source: p7YOuaDCGw.exeJoe Sandbox ML: detected
              Source: 3.2.p7YOuaDCGw.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8

              Source: global trafficTCP traffic: 192.168.2.5:49748 -> 77.88.21.158:587
              Source: Joe Sandbox ViewIP Address: 77.88.21.158 77.88.21.158
              Source: global trafficTCP traffic: 192.168.2.5:49748 -> 77.88.21.158:587
              Source: unknownDNS traffic detected: queries for: smtp.yandex.com
              Source: p7YOuaDCGw.exe, 00000003.00000002.1191348579.00000000034D0000.00000004.00000001.sdmpString found in binary or memory: http://WNJDqVQdJCO5LO.org
              Source: p7YOuaDCGw.exe, 00000003.00000002.1191348579.00000000034D0000.00000004.00000001.sdmpString found in binary or memory: http://crl.certum.pl/ca.crl0h
              Source: p7YOuaDCGw.exe, 00000003.00000002.1191348579.00000000034D0000.00000004.00000001.sdmpString found in binary or memory: http://crl.certum.pl/ctnca.crl0k
              Source: p7YOuaDCGw.exe, 00000003.00000002.1191348579.00000000034D0000.00000004.00000001.sdmpString found in binary or memory: http://crls.yandex.net/certum/ycasha2.crl0-
              Source: p7YOuaDCGw.exe, 00000000.00000002.788238429.0000000006872000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
              Source: p7YOuaDCGw.exe, 00000003.00000002.1191348579.00000000034D0000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ca.cer09
              Source: p7YOuaDCGw.exe, 00000003.00000002.1191348579.00000000034D0000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ctnca.cer09
              Source: p7YOuaDCGw.exe, 00000003.00000002.1191348579.00000000034D0000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ycasha2.cer0
              Source: p7YOuaDCGw.exe, 00000003.00000002.1191348579.00000000034D0000.00000004.00000001.sdmpString found in binary or memory: http://subca.ocsp-certum.com0.
              Source: p7YOuaDCGw.exe, 00000003.00000002.1191348579.00000000034D0000.00000004.00000001.sdmpString found in binary or memory: http://subca.ocsp-certum.com01
              Source: p7YOuaDCGw.exe, 00000000.00000002.788238429.0000000006872000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
              Source: p7YOuaDCGw.exe, 00000000.00000003.776099083.000000000553A000.00000004.00000001.sdmpString found in binary or memory: http://www.ascendercorp.com/typec
              Source: p7YOuaDCGw.exe, 00000000.00000003.771073506.000000000554B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com
              Source: p7YOuaDCGw.exe, 00000000.00000003.771073506.000000000554B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comC
              Source: p7YOuaDCGw.exe, 00000000.00000003.771073506.000000000554B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comTCW-
              Source: p7YOuaDCGw.exe, 00000000.00000003.771073506.000000000554B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comU
              Source: p7YOuaDCGw.exe, 00000000.00000003.771073506.000000000554B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comc
              Source: p7YOuaDCGw.exe, 00000000.00000002.788238429.0000000006872000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
              Source: p7YOuaDCGw.exe, 00000003.00000002.1191348579.00000000034D0000.00000004.00000001.sdmpString found in binary or memory: http://www.certum.pl/CPS0
              Source: p7YOuaDCGw.exe, 00000000.00000002.788238429.0000000006872000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
              Source: p7YOuaDCGw.exe, 00000000.00000002.788238429.0000000006872000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
              Source: p7YOuaDCGw.exe, 00000000.00000002.788238429.0000000006872000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
              Source: p7YOuaDCGw.exe, 00000000.00000002.788238429.0000000006872000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
              Source: p7YOuaDCGw.exe, 00000000.00000002.788238429.0000000006872000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
              Source: p7YOuaDCGw.exe, 00000000.00000002.788238429.0000000006872000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
              Source: p7YOuaDCGw.exe, 00000000.00000003.767104783.000000000554B000.00000004.00000001.sdmp, p7YOuaDCGw.exe, 00000000.00000002.788238429.0000000006872000.00000004.00000001.sdmp, p7YOuaDCGw.exe, 00000000.00000003.763472857.000000000554B000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
              Source: p7YOuaDCGw.exe, 00000000.00000003.763472857.000000000554B000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comP
              Source: p7YOuaDCGw.exe, 00000000.00000003.763472857.000000000554B000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comn-u
              Source: p7YOuaDCGw.exe, 00000000.00000002.788238429.0000000006872000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
              Source: p7YOuaDCGw.exe, 00000000.00000002.788238429.0000000006872000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
              Source: p7YOuaDCGw.exe, 00000000.00000002.788238429.0000000006872000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
              Source: p7YOuaDCGw.exe, 00000000.00000003.765109710.00000000011DD000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.net
              Source: p7YOuaDCGw.exe, 00000000.00000003.765109710.00000000011DD000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.net)
              Source: p7YOuaDCGw.exe, 00000000.00000003.765109710.00000000011DD000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.net.
              Source: p7YOuaDCGw.exe, 00000000.00000002.788238429.0000000006872000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
              Source: p7YOuaDCGw.exe, 00000000.00000002.788238429.0000000006872000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
              Source: p7YOuaDCGw.exe, 00000003.00000002.1191348579.00000000034D0000.00000004.00000001.sdmpString found in binary or memory: http://yandex.crl.certum.pl/ycasha2.crl0q
              Source: p7YOuaDCGw.exe, 00000003.00000002.1191348579.00000000034D0000.00000004.00000001.sdmpString found in binary or memory: http://yandex.ocsp-responder.com03
              Source: p7YOuaDCGw.exe, 00000003.00000002.1191348579.00000000034D0000.00000004.00000001.sdmpString found in binary or memory: https://www.certum.pl/CPS0

              Key, Mouse, Clipboard, Microphone and Screen Capturing:

              barindex
              Installs a global keyboard hookShow sources
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\p7YOuaDCGw.exeJump to behavior
              Source: p7YOuaDCGw.exe, 00000000.00000002.781883984.00000000011E0000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior

              System Summary:

              barindex
              .NET source code contains very large stringsShow sources
              Source: p7YOuaDCGw.exe, Elfie_city/OIADHUPDIHGOUYFVDOTFOFFGDAIUHDBOIPDHJIAPO.csLong String: Length: 13656
              Source: 0.2.p7YOuaDCGw.exe.b70000.0.unpack, Elfie_city/OIADHUPDIHGOUYFVDOTFOFFGDAIUHDBOIPDHJIAPO.csLong String: Length: 13656
              Source: 0.0.p7YOuaDCGw.exe.b70000.0.unpack, Elfie_city/OIADHUPDIHGOUYFVDOTFOFFGDAIUHDBOIPDHJIAPO.csLong String: Length: 13656
              Source: 2.2.p7YOuaDCGw.exe.10000.0.unpack, Elfie_city/OIADHUPDIHGOUYFVDOTFOFFGDAIUHDBOIPDHJIAPO.csLong String: Length: 13656
              Source: 2.0.p7YOuaDCGw.exe.10000.0.unpack, Elfie_city/OIADHUPDIHGOUYFVDOTFOFFGDAIUHDBOIPDHJIAPO.csLong String: Length: 13656
              Source: 3.0.p7YOuaDCGw.exe.c60000.0.unpack, Elfie_city/OIADHUPDIHGOUYFVDOTFOFFGDAIUHDBOIPDHJIAPO.csLong String: Length: 13656
              Source: 3.2.p7YOuaDCGw.exe.c60000.1.unpack, Elfie_city/OIADHUPDIHGOUYFVDOTFOFFGDAIUHDBOIPDHJIAPO.csLong String: Length: 13656
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 0_2_00B721E80_2_00B721E8
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 0_2_02E349F00_2_02E349F0
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 0_2_02E3388B0_2_02E3388B
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 0_2_02E34A980_2_02E34A98
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 2_2_000121E82_2_000121E8
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_00C621E83_2_00C621E8
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_0565E9403_2_0565E940
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_0565E1583_2_0565E158
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_0565DCE13_2_0565DCE1
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_0565EDAC3_2_0565EDAC
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_0565E9323_2_0565E932
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_0565E13A3_2_0565E13A
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_0565EE1E3_2_0565EE1E
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B6A383_2_063B6A38
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B06403_2_063B0640
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B62C83_2_063B62C8
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B834A3_2_063B834A
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B5B803_2_063B5B80
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063BD7F03_2_063BD7F0
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B6FE83_2_063B6FE8
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B7C263_2_063B7C26
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063BA8F83_2_063BA8F8
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B55083_2_063B5508
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063BDD683_2_063BDD68
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B75C03_2_063B75C0
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B32383_2_063B3238
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B1E163_2_063B1E16
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B62B83_2_063B62B8
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B328F3_2_063B328F
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B8AF83_2_063B8AF8
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063BD32F3_2_063BD32F
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063BCF133_2_063BCF13
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B47BF3_2_063B47BF
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B1B8D3_2_063B1B8D
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063BC02A3_2_063BC02A
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B06403_2_063B0640
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063BD4AB3_2_063BD4AB
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063BC4E93_2_063BC4E9
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B5D003_2_063B5D00
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B2DB93_2_063B2DB9
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_064CD6883_2_064CD688
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_064CC7483_2_064CC748
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_064C74983_2_064C7498
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_064CD1503_2_064CD150
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_064CB5F83_2_064CB5F8
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_064C00703_2_064C0070
              Source: p7YOuaDCGw.exeBinary or memory string: OriginalFilename vs p7YOuaDCGw.exe
              Source: p7YOuaDCGw.exe, 00000000.00000002.780955172.0000000000B72000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameqhEhr.exe6 vs p7YOuaDCGw.exe
              Source: p7YOuaDCGw.exe, 00000000.00000002.784430263.0000000004190000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameAbYeBkQgzYsVBZUKWnpIeclSzakXdTAFXJCKMK.exe4 vs p7YOuaDCGw.exe
              Source: p7YOuaDCGw.exe, 00000000.00000002.781883984.00000000011E0000.00000004.00000020.sdmpBinary or memory string: OriginalFilenamemscorwks.dllT vs p7YOuaDCGw.exe
              Source: p7YOuaDCGw.exe, 00000000.00000002.789434781.0000000008480000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs p7YOuaDCGw.exe
              Source: p7YOuaDCGw.exe, 00000000.00000002.786213192.00000000057A0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSnakeLib.dll2 vs p7YOuaDCGw.exe
              Source: p7YOuaDCGw.exeBinary or memory string: OriginalFilename vs p7YOuaDCGw.exe
              Source: p7YOuaDCGw.exe, 00000002.00000000.779096777.0000000000012000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameqhEhr.exe6 vs p7YOuaDCGw.exe
              Source: p7YOuaDCGw.exeBinary or memory string: OriginalFilename vs p7YOuaDCGw.exe
              Source: p7YOuaDCGw.exe, 00000003.00000002.1194043824.0000000006540000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx.mui vs p7YOuaDCGw.exe
              Source: p7YOuaDCGw.exe, 00000003.00000002.1193073034.0000000005760000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs p7YOuaDCGw.exe
              Source: p7YOuaDCGw.exe, 00000003.00000002.1187294054.000000000044C000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameAbYeBkQgzYsVBZUKWnpIeclSzakXdTAFXJCKMK.exe4 vs p7YOuaDCGw.exe
              Source: p7YOuaDCGw.exe, 00000003.00000002.1192588361.0000000005530000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewbemdisp.tlbj% vs p7YOuaDCGw.exe
              Source: p7YOuaDCGw.exe, 00000003.00000002.1187345884.0000000000C62000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameqhEhr.exe6 vs p7YOuaDCGw.exe
              Source: p7YOuaDCGw.exe, 00000003.00000002.1194012978.0000000006530000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx vs p7YOuaDCGw.exe
              Source: p7YOuaDCGw.exe, 00000003.00000002.1193828367.0000000006410000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs p7YOuaDCGw.exe
              Source: p7YOuaDCGw.exeBinary or memory string: OriginalFilenameqhEhr.exe6 vs p7YOuaDCGw.exe
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeSection loaded: security.dllJump to behavior
              Source: p7YOuaDCGw.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@8/1@1/1
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 0_2_05790C46 AdjustTokenPrivileges,0_2_05790C46
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 0_2_05790C0F AdjustTokenPrivileges,0_2_05790C0F
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\p7YOuaDCGw.exe.logJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeMutant created: \Sessions\1\BaseNamedObjects\DCBAxidQkHIEi
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2084:120:WilError_01
              Source: p7YOuaDCGw.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\497ab1dd171eeef956401f1aeb0b9fec\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\497ab1dd171eeef956401f1aeb0b9fec\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: p7YOuaDCGw.exeVirustotal: Detection: 77%
              Source: p7YOuaDCGw.exeReversingLabs: Detection: 67%
              Source: unknownProcess created: C:\Users\user\Desktop\p7YOuaDCGw.exe 'C:\Users\user\Desktop\p7YOuaDCGw.exe'
              Source: unknownProcess created: C:\Users\user\Desktop\p7YOuaDCGw.exe {path}
              Source: unknownProcess created: C:\Users\user\Desktop\p7YOuaDCGw.exe {path}
              Source: unknownProcess created: C:\Windows\SysWOW64\netsh.exe 'netsh' wlan show profile
              Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess created: C:\Users\user\Desktop\p7YOuaDCGw.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess created: C:\Users\user\Desktop\p7YOuaDCGw.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess created: C:\Windows\SysWOW64\netsh.exe 'netsh' wlan show profileJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dllJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: p7YOuaDCGw.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dllJump to behavior
              Source: p7YOuaDCGw.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
              Source: Binary string: C:\Users\Vendetta\Desktop\crypts\SnakeCsharp-master\Snake\obj\Debug\SnakeLib.pdb source: p7YOuaDCGw.exe, 00000000.00000002.786213192.00000000057A0000.00000004.00000001.sdmp
              Source: Binary string: mscorrc.pdb source: p7YOuaDCGw.exe, 00000000.00000002.789434781.0000000008480000.00000002.00000001.sdmp, p7YOuaDCGw.exe, 00000003.00000002.1193828367.0000000006410000.00000002.00000001.sdmp

              Data Obfuscation:

              barindex
              .NET source code contains potential unpackerShow sources
              Source: p7YOuaDCGw.exe, Elfie_city/OIADHUPDIHGOUYFVDOTFOFFGDAIUHDBOIPDHJIAPO.cs.Net Code: AHUHD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 0.2.p7YOuaDCGw.exe.b70000.0.unpack, Elfie_city/OIADHUPDIHGOUYFVDOTFOFFGDAIUHDBOIPDHJIAPO.cs.Net Code: AHUHD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 0.0.p7YOuaDCGw.exe.b70000.0.unpack, Elfie_city/OIADHUPDIHGOUYFVDOTFOFFGDAIUHDBOIPDHJIAPO.cs.Net Code: AHUHD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 2.2.p7YOuaDCGw.exe.10000.0.unpack, Elfie_city/OIADHUPDIHGOUYFVDOTFOFFGDAIUHDBOIPDHJIAPO.cs.Net Code: AHUHD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 2.0.p7YOuaDCGw.exe.10000.0.unpack, Elfie_city/OIADHUPDIHGOUYFVDOTFOFFGDAIUHDBOIPDHJIAPO.cs.Net Code: AHUHD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 3.0.p7YOuaDCGw.exe.c60000.0.unpack, Elfie_city/OIADHUPDIHGOUYFVDOTFOFFGDAIUHDBOIPDHJIAPO.cs.Net Code: AHUHD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 3.2.p7YOuaDCGw.exe.c60000.1.unpack, Elfie_city/OIADHUPDIHGOUYFVDOTFOFFGDAIUHDBOIPDHJIAPO.cs.Net Code: AHUHD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_0565FBD0 push ecx; retf 3_2_0565FBD5
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B163C push ss; retf 3_2_063B163F
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063BE700 push es; ret 3_2_063BE710
              Source: initial sampleStatic PE information: section name: .text entropy: 7.67554014241

              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exe TID: 1688Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exe TID: 5064Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exe TID: 4436Thread sleep count: 90 > 30Jump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exe TID: 4436Thread sleep time: -45000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeLast function: Thread delayed
              Source: p7YOuaDCGw.exe, 00000003.00000002.1193073034.0000000005760000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
              Source: p7YOuaDCGw.exe, 00000003.00000002.1193073034.0000000005760000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
              Source: p7YOuaDCGw.exe, 00000003.00000002.1193073034.0000000005760000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
              Source: p7YOuaDCGw.exe, 00000003.00000002.1193073034.0000000005760000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess information queried: ProcessInformationJump to behavior

              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeCode function: 3_2_063B2FD2 LdrInitializeThunk,3_2_063B2FD2
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion:

              barindex
              Injects a PE file into a foreign processesShow sources
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeMemory written: C:\Users\user\Desktop\p7YOuaDCGw.exe base: 400000 value starts with: 4D5AJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess created: C:\Users\user\Desktop\p7YOuaDCGw.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess created: C:\Users\user\Desktop\p7YOuaDCGw.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeProcess created: C:\Windows\SysWOW64\netsh.exe 'netsh' wlan show profileJump to behavior
              Source: p7YOuaDCGw.exe, 00000003.00000002.1188990729.0000000001A00000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
              Source: p7YOuaDCGw.exe, 00000003.00000002.1188990729.0000000001A00000.00000002.00000001.sdmpBinary or memory string: Progman
              Source: p7YOuaDCGw.exe, 00000003.00000002.1188990729.0000000001A00000.00000002.00000001.sdmpBinary or memory string: hProgram ManagerWE
              Source: p7YOuaDCGw.exe, 00000003.00000002.1188990729.0000000001A00000.00000002.00000001.sdmpBinary or memory string: Progmanlock

              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\p7YOuaDCGw.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation