Loading ...

Play interactive tourEdit tour

Analysis Report QRP-57843552.exe

Overview

General Information

Sample Name:QRP-57843552.exe
Analysis ID:339036
MD5:7da0fbd98ffd79125bc0373fe2e0c508
SHA1:97fbd05a865e216f1fba898602a15d9bb02b7e13
SHA256:c7ccb3ceba2173fcd6839e02a2e11abd7d32bd39b932ed74dcf389535be818f6
Tags:AgentTeslaexe

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
Yara detected AntiVM_3
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • QRP-57843552.exe (PID: 4628 cmdline: 'C:\Users\user\Desktop\QRP-57843552.exe' MD5: 7DA0FBD98FFD79125BC0373FE2E0C508)
    • schtasks.exe (PID: 4584 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 4536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • QRP-57843552.exe (PID: 5724 cmdline: {path} MD5: 7DA0FBD98FFD79125BC0373FE2E0C508)
    • QRP-57843552.exe (PID: 5640 cmdline: {path} MD5: 7DA0FBD98FFD79125BC0373FE2E0C508)
    • QRP-57843552.exe (PID: 2076 cmdline: {path} MD5: 7DA0FBD98FFD79125BC0373FE2E0C508)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.708065889.00000000034DC000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000000.00000002.366535440.00000000044BE000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000000.00000002.358136683.0000000002AE1000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
        00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
          00000005.00000002.704749590.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 4 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            5.2.QRP-57843552.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview

              System Summary:

              barindex
              Sigma detected: Scheduled temp file as task from temp locationShow sources
              Source: Process startedAuthor: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\QRP-57843552.exe' , ParentImage: C:\Users\user\Desktop\QRP-57843552.exe, ParentProcessId: 4628, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp', ProcessId: 4584

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Multi AV Scanner detection for dropped fileShow sources
              Source: C:\Users\user\AppData\Roaming\UWFDvz.exeReversingLabs: Detection: 42%
              Multi AV Scanner detection for submitted fileShow sources
              Source: QRP-57843552.exeVirustotal: Detection: 45%Perma Link
              Source: QRP-57843552.exeReversingLabs: Detection: 42%
              Machine Learning detection for dropped fileShow sources
              Source: C:\Users\user\AppData\Roaming\UWFDvz.exeJoe Sandbox ML: detected
              Machine Learning detection for sampleShow sources
              Source: QRP-57843552.exeJoe Sandbox ML: detected
              Source: 5.2.QRP-57843552.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
              Source: 0.2.QRP-57843552.exe.520000.0.unpackAvira: Label: TR/Crypt.XPACK.Gen2

              Compliance:

              barindex
              Detected unpacking (overwrites its own PE header)Show sources
              Source: C:\Users\user\Desktop\QRP-57843552.exeUnpacked PE file: 0.2.QRP-57843552.exe.520000.0.unpack
              Source: QRP-57843552.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
              Source: QRP-57843552.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
              Source: QRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
              Source: QRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
              Source: QRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpString found in binary or memory: http://LAucWZ.com
              Source: QRP-57843552.exe, 00000000.00000003.335080210.0000000007E2B000.00000004.00000001.sdmpString found in binary or memory: http://en.wikipO3
              Source: QRP-57843552.exe, 00000000.00000003.332794815.0000000007E55000.00000004.00000001.sdmp, QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmp, QRP-57843552.exe, 00000005.00000002.707936279.00000000034C2000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
              Source: QRP-57843552.exe, 00000000.00000003.335023621.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com
              Source: QRP-57843552.exe, 00000000.00000003.334948111.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com$V_h
              Source: QRP-57843552.exe, 00000000.00000003.334915296.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com.n
              Source: QRP-57843552.exe, 00000000.00000003.335023621.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comTCx
              Source: QRP-57843552.exe, 00000000.00000003.334777327.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comh
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
              Source: QRP-57843552.exe, 00000000.00000003.334777327.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.como.n
              Source: QRP-57843552.exe, 00000000.00000003.334948111.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comueb
              Source: QRP-57843552.exe, 00000000.00000003.334948111.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comx
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
              Source: QRP-57843552.exe, 00000000.00000003.355904269.0000000007E20000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comasom
              Source: QRP-57843552.exe, 00000000.00000003.338723745.0000000007E2A000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comd
              Source: QRP-57843552.exe, 00000000.00000003.332511872.0000000007E55000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
              Source: QRP-57843552.exe, 00000000.00000003.334185618.0000000007E2B000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
              Source: QRP-57843552.exe, 00000000.00000003.334622662.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/
              Source: QRP-57843552.exe, 00000000.00000003.334405269.0000000007E4E000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/$j
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
              Source: QRP-57843552.exe, 00000000.00000003.334275061.0000000007E4F000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnL
              Source: QRP-57843552.exe, 00000000.00000003.334185618.0000000007E2B000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnv-s
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
              Source: QRP-57843552.exe, 00000000.00000003.335299369.0000000007E23000.00000004.00000001.sdmp, QRP-57843552.exe, 00000000.00000003.335599789.0000000007E27000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
              Source: QRP-57843552.exe, 00000000.00000003.336005803.0000000007E28000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/(
              Source: QRP-57843552.exe, 00000000.00000003.335299369.0000000007E23000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/-ca
              Source: QRP-57843552.exe, 00000000.00000003.336005803.0000000007E28000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/3
              Source: QRP-57843552.exe, 00000000.00000003.335299369.0000000007E23000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/M
              Source: QRP-57843552.exe, 00000000.00000003.335820810.0000000007E2A000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/3
              Source: QRP-57843552.exe, 00000000.00000003.335599789.0000000007E27000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/e0
              Source: QRP-57843552.exe, 00000000.00000003.335599789.0000000007E27000.00000004.00000001.sdmp, QRP-57843552.exe, 00000000.00000003.336005803.0000000007E28000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
              Source: QRP-57843552.exe, 00000000.00000003.336005803.0000000007E28000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/M
              Source: QRP-57843552.exe, 00000000.00000003.336005803.0000000007E28000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/of(
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
              Source: QRP-57843552.exe, 00000000.00000003.334566180.0000000007E4E000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comi
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
              Source: QRP-57843552.exe, 00000000.00000003.334845139.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cno.
              Source: QRP-57843552.exe, 00000000.00000003.334845139.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cnx
              Source: QRP-57843552.exe, 00000005.00000002.707936279.00000000034C2000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org
              Source: QRP-57843552.exe, 00000005.00000002.707936279.00000000034C2000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org/
              Source: QRP-57843552.exe, 00000005.00000002.707936279.00000000034C2000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org4
              Source: QRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.orgGETMozilla/5.0
              Source: QRP-57843552.exe, 00000000.00000002.366535440.00000000044BE000.00000004.00000001.sdmp, QRP-57843552.exe, 00000005.00000002.704749590.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/
              Source: QRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
              Source: QRP-57843552.exe, 00000000.00000002.366535440.00000000044BE000.00000004.00000001.sdmp, QRP-57843552.exe, 00000005.00000002.704749590.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
              Source: QRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

              Key, Mouse, Clipboard, Microphone and Screen Capturing:

              barindex
              Installs a global keyboard hookShow sources
              Source: C:\Users\user\Desktop\QRP-57843552.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\QRP-57843552.exeJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior

              System Summary:

              barindex
              .NET source code contains very large array initializationsShow sources
              Source: 5.2.QRP-57843552.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bFD76F4A7u002dBD02u002d46B4u002d982Bu002d6679466F04DCu007d/u00369EA8EE0u002dDC3Bu002d4A0Fu002d8799u002d06D648F82B11.csLarge array initialization: .cctor: array initializer size 11825
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_09EE37E00_2_09EE37E0
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_09EE16C90_2_09EE16C9
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_09EE17B80_2_09EE17B8
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_09EE40000_2_09EE4000
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_032346A05_2_032346A0
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_032346725_2_03234672
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_032346525_2_03234652
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_032346905_2_03234690
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_05FE75405_2_05FE7540
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_05FE94F85_2_05FE94F8
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_05FE6C705_2_05FE6C70
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_05FE69285_2_05FE6928
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_0665CF185_2_0665CF18
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_066583545_2_06658354
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_05FE25315_2_05FE2531
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_05FE26805_2_05FE2680
              Source: QRP-57843552.exeBinary or memory string: OriginalFilename vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000000.00000000.328554084.0000000000522000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameF vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000000.00000002.370426593.00000000098B0000.00000002.00000001.sdmpBinary or memory string: originalfilename vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000000.00000002.370426593.00000000098B0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000000.00000002.366535440.00000000044BE000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameAssemblyReferenceEntry.exeD vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000000.00000002.366535440.00000000044BE000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameayFuqEWmvNAHmAlzKQKEIyhuEgCdlLwcgzfPvP.exe4 vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000000.00000002.370366227.0000000009860000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000000.00000002.371240106.0000000009EF0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000000.00000002.358136683.0000000002AE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameTypeLibImporterFlags.dll4 vs QRP-57843552.exe
              Source: QRP-57843552.exeBinary or memory string: OriginalFilename vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000003.00000000.352649188.00000000001C2000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameF vs QRP-57843552.exe
              Source: QRP-57843552.exeBinary or memory string: OriginalFilename vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000004.00000000.353964684.0000000000392000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameF vs QRP-57843552.exe
              Source: QRP-57843552.exeBinary or memory string: OriginalFilename vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000005.00000002.704847164.0000000000438000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameayFuqEWmvNAHmAlzKQKEIyhuEgCdlLwcgzfPvP.exe4 vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000005.00000002.712320384.0000000007490000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000005.00000002.705432399.00000000014F8000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000005.00000002.704879740.0000000000FD2000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameF vs QRP-57843552.exe
              Source: QRP-57843552.exeBinary or memory string: OriginalFilenameF vs QRP-57843552.exe
              Source: QRP-57843552.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
              Source: QRP-57843552.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: UWFDvz.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: 5.2.QRP-57843552.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: 5.2.QRP-57843552.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@10/3@0/0
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile created: C:\Users\user\AppData\Roaming\UWFDvz.exeJump to behavior
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4536:120:WilError_01
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile created: C:\Users\user\AppData\Local\Temp\tmp19EB.tmpJump to behavior
              Source: QRP-57843552.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\QRP-57843552.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: QRP-57843552.exeVirustotal: Detection: 45%
              Source: QRP-57843552.exeReversingLabs: Detection: 42%
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile read: C:\Users\user\Desktop\QRP-57843552.exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\QRP-57843552.exe 'C:\Users\user\Desktop\QRP-57843552.exe'
              Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp'
              Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: unknownProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}
              Source: unknownProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}
              Source: unknownProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp'Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: QRP-57843552.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: QRP-57843552.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
              Source: QRP-57843552.exeStatic file information: File size 1074688 > 1048576
              Source: QRP-57843552.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x105a00
              Source: QRP-57843552.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

              Data Obfuscation:

              barindex
              Detected unpacking (changes PE section rights)Show sources
              Source: C:\Users\user\Desktop\QRP-57843552.exeUnpacked PE file: 0.2.QRP-57843552.exe.520000.0.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;
              Detected unpacking (overwrites its own PE header)Show sources
              Source: C:\Users\user\Desktop\QRP-57843552.exeUnpacked PE file: 0.2.QRP-57843552.exe.520000.0.unpack
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_0052304E push es; retf 0_2_0052306F
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_00527331 push edx; retf 0_2_00527332
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_00526CCB push ebx; iretd 0_2_00526CD9
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_005221CF push eax; iretd 0_2_005221E1
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_00524D82 push es; retf 0_2_00524D93
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_09AA01BA push FFFFFFB4h; iretd 0_2_09AA01D3
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_09AA01FC pushad ; retf 0_2_09AA01FD
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_09AA2B67 pushad ; retf 0_2_09AA2B68
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_09AA3270 pushad ; retf 0_2_09AA3275
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 3_2_001C7331 push edx; retf 3_2_001C7332
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 3_2_001C304E push es; retf 3_2_001C306F
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 3_2_001C4D82 push es; retf 3_2_001C4D93
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 3_2_001C21CF push eax; iretd 3_2_001C21E1
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 3_2_001C6CCB push ebx; iretd 3_2_001C6CD9
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 4_2_00397331 push edx; retf 4_2_00397332
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 4_2_0039304E push es; retf 4_2_0039306F
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 4_2_00394D82 push es; retf 4_2_00394D93
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 4_2_00396CCB push ebx; iretd 4_2_00396CD9
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 4_2_003921CF push eax; iretd 4_2_003921E1
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_00FD21CF push eax; iretd 5_2_00FD21E1
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_00FD6CCB push ebx; iretd 5_2_00FD6CD9
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_00FD4D82 push es; retf 5_2_00FD4D93
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_00FD304E push es; retf 5_2_00FD306F
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_00FD7331 push edx; retf 5_2_00FD7332
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_05FED50A pushad ; retf 5_2_05FED531
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_066580C1 pushad ; retf 0006h5_2_066580C2
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_066580CB pushad ; retf 0006h5_2_066580EA
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_06658128 pushad ; retf 0006h5_2_0665812A
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_06656D71 push ebp; retf 0006h5_2_06656D72
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_06656A51 push edx; retf 0006h5_2_06656A52
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_06656A31 push ecx; retf 0006h5_2_06656A32
              Source: initial sampleStatic PE information: section name: .text entropy: 7.4437243106
              Source: initial sampleStatic PE information: section name: .text entropy: 7.4437243106
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile created: C:\Users\user\AppData\Roaming\UWFDvz.exeJump to dropped file

              Boot Survival:

              barindex
              Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
              Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp'
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Yara detected AntiVM_3Show sources
              Source: Yara matchFile source: 00000000.00000002.358136683.0000000002AE1000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: QRP-57843552.exe PID: 4628, type: MEMORY
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\QRP-57843552.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\QRP-57843552.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeWindow / User API: threadDelayed 2925Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeWindow / User API: threadDelayed 6923Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exe TID: 4652Thread sleep time: -31500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exe TID: 4692Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exe TID: 6640Thread sleep time: -15679732462653109s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exe TID: 6648Thread sleep count: 2925 > 30Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exe TID: 6648Thread sleep count: 6923 > 30Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: VMware
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: vmware
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: VMWARE
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: VMware
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: l"SOFTWARE\VMware, Inc.\VMware Tools
              Source: QRP-57843552.exe, 00000005.00000002.705805245.00000000015E1000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion:

              barindex
              Injects a PE file into a foreign processesShow sources
              Source: C:\Users\user\Desktop\QRP-57843552.exeMemory written: C:\Users\user\Desktop\QRP-57843552.exe base: 400000 value starts with: 4D5AJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp'Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}Jump to behavior
              Source: QRP-57843552.exe, 00000005.00000002.706711102.0000000001E10000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
              Source: QRP-57843552.exe, 00000005.00000002.706711102.0000000001E10000.00000002.00000001.sdmpBinary or memory string: Progman
              Source: QRP-57843552.exe, 00000005.00000002.706711102.0000000001E10000.00000002.00000001.sdmpBinary or memory string: &Program Manager
              Source: QRP-57843552.exe, 00000005.00000002.706711102.0000000001E10000.00000002.00000001.sdmpBinary or memory string: Progmanlock
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Users\user\Desktop\QRP-57843552.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior</