Loading ...

Play interactive tourEdit tour

Analysis Report E3rDVPhyAf

Overview

General Information

Sample Name:E3rDVPhyAf (renamed file extension from none to exe)
Analysis ID:359421
MD5:477e66eb6c969823890eaa56105a3801
SHA1:75647c701d04f64dbea02eead7a693ae8b7dcbc8
SHA256:ab67847cf268c5dba3796b0c022148da53a39b857061fe93a9d704c9844647d8
Tags:HiddenTear
Infos:

Most interesting Screenshot:

Detection

HiddenTear
Score:80
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Yara detected HiddenTear ransomware
.NET source code contains very large array initializations
Machine Learning detection for sample
Detected potential crypto function
Enables debug privileges
PE file contains strange resources
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Startup

  • System is w10x64
  • E3rDVPhyAf.exe (PID: 5492 cmdline: 'C:\Users\user\Desktop\E3rDVPhyAf.exe' MD5: 477E66EB6C969823890EAA56105A3801)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
E3rDVPhyAf.exeJoeSecurity_hidden_tearYara detected HiddenTear ransomwareJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000000.00000000.220308263.0000000000072000.00000002.00020000.sdmpJoeSecurity_hidden_tearYara detected HiddenTear ransomwareJoe Security
      00000000.00000002.485903265.0000000000072000.00000002.00020000.sdmpJoeSecurity_hidden_tearYara detected HiddenTear ransomwareJoe Security
        Process Memory Space: E3rDVPhyAf.exe PID: 5492JoeSecurity_hidden_tearYara detected HiddenTear ransomwareJoe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          0.0.E3rDVPhyAf.exe.70000.0.unpackJoeSecurity_hidden_tearYara detected HiddenTear ransomwareJoe Security
            0.0.E3rDVPhyAf.exe.de93c.3.unpackMAL_RANSOM_COVID19_Apr20_1Detects ransomware distributed in COVID-19 themeFlorian Roth
            • 0x4596b:$op2: 60 2E 2E 2E AF 34 34 34 B8 34 34 34 B8 34 34 34
            • 0x452e3:$op3: 1F 07 1A 37 85 05 05 36 83 05 05 36 83 05 05 34
            0.2.E3rDVPhyAf.exe.de93c.3.unpackMAL_RANSOM_COVID19_Apr20_1Detects ransomware distributed in COVID-19 themeFlorian Roth
            • 0x4596b:$op2: 60 2E 2E 2E AF 34 34 34 B8 34 34 34 B8 34 34 34
            • 0x452e3:$op3: 1F 07 1A 37 85 05 05 36 83 05 05 36 83 05 05 34
            0.2.E3rDVPhyAf.exe.de93c.3.raw.unpackMAL_RANSOM_COVID19_Apr20_1Detects ransomware distributed in COVID-19 themeFlorian Roth
            • 0x6756b:$op2: 60 2E 2E 2E AF 34 34 34 B8 34 34 34 B8 34 34 34
            • 0x66ee3:$op3: 1F 07 1A 37 85 05 05 36 83 05 05 36 83 05 05 34
            0.0.E3rDVPhyAf.exe.de93c.3.raw.unpackMAL_RANSOM_COVID19_Apr20_1Detects ransomware distributed in COVID-19 themeFlorian Roth
            • 0x6756b:$op2: 60 2E 2E 2E AF 34 34 34 B8 34 34 34 B8 34 34 34
            • 0x66ee3:$op3: 1F 07 1A 37 85 05 05 36 83 05 05 36 83 05 05 34
            Click to see the 1 entries

            Sigma Overview

            No Sigma rule has matched

            Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection:

            barindex
            Antivirus / Scanner detection for submitted sampleShow sources
            Source: E3rDVPhyAf.exeAvira: detected
            Multi AV Scanner detection for submitted fileShow sources
            Source: E3rDVPhyAf.exeVirustotal: Detection: 77%Perma Link
            Source: E3rDVPhyAf.exeReversingLabs: Detection: 86%
            Machine Learning detection for sampleShow sources
            Source: E3rDVPhyAf.exeJoe Sandbox ML: detected

            Compliance:

            barindex
            Contains modern PE file flags such as dynamic base (ASLR) or NXShow sources
            Source: E3rDVPhyAf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
            Binary contains paths to debug symbolsShow sources
            Source: Binary string: System.Windows.Forms.pdb source: E3rDVPhyAf.exe, 00000000.00000002.502555949.0000000008BC8000.00000004.00000001.sdmp
            Source: Binary string: \hidden-tear\hidden-tear\obj\Release\hidden-tear.pdb source: E3rDVPhyAf.exe
            Source: Binary string: \??\C:\Windows\System.Windows.Forms.pdbw source: E3rDVPhyAf.exe, 00000000.00000002.502555949.0000000008BC8000.00000004.00000001.sdmp
            Source: Binary string: D:\Sanghee Workspace\Project bakaware\bakaware\Touhou_ScoreOrEncrypt\Release\Touhou_ScoreOrEncrypt.pdb source: E3rDVPhyAf.exe
            Source: Binary string: \??\C:\Windows\symbols\dll\System.pdbV source: E3rDVPhyAf.exe, 00000000.00000002.502555949.0000000008BC8000.00000004.00000001.sdmp
            Source: Binary string: \hidden-tear-decrypter\hidden-tear-decrypter\obj\Release\hidden-tear-decrypter.pdb source: E3rDVPhyAf.exe
            Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: E3rDVPhyAf.exe
            Source: unknownDNS traffic detected: query: alex4386networks.mooo.com replaycode: Name error (3)
            Source: unknownDNS traffic detected: queries for: alex4386networks.mooo.com
            Source: E3rDVPhyAf.exe, 00000000.00000002.489235799.00000000025B3000.00000004.00000001.sdmpString found in binary or memory: http://alex4386networks.mooo.com
            Source: E3rDVPhyAf.exeString found in binary or memory: http://alex4386networks.mooo.com/bamboo-forest/write.php?
            Source: E3rDVPhyAf.exe, 00000000.00000002.489087124.0000000002597000.00000004.00000001.sdmpString found in binary or memory: http://alex4386networks.mooo.com/bamboo-forest/write.php?computername=226533&&information=user&&pa
            Source: E3rDVPhyAf.exe, 00000000.00000002.489235799.00000000025B3000.00000004.00000001.sdmpString found in binary or memory: http://alex4386networks.moooP
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
            Source: E3rDVPhyAf.exe, 00000000.00000002.489235799.00000000025B3000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
            Source: E3rDVPhyAf.exe, 00000000.00000002.488447681.0000000000D27000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.com
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
            Source: E3rDVPhyAf.exe, 00000000.00000002.488447681.0000000000D27000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.come.com
            Source: E3rDVPhyAf.exe, 00000000.00000002.488447681.0000000000D27000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comm
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
            Source: E3rDVPhyAf.exe, 00000000.00000002.493519577.00000000054E0000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
            Source: E3rDVPhyAf.exeString found in binary or memory: https://github.com/alforeplay/Touhou_ScoreOrEncrypthttps://youtu.be/5wFDWP5JwSMstart
            Source: E3rDVPhyAf.exeString found in binary or memory: https://youtu.be/5wFDWP5JwSM
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeCode function: 0_2_06AB72F8 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,0_2_06AB72F8

            Spam, unwanted Advertisements and Ransom Demands:

            barindex
            Yara detected HiddenTear ransomwareShow sources
            Source: Yara matchFile source: E3rDVPhyAf.exe, type: SAMPLE
            Source: Yara matchFile source: 00000000.00000000.220308263.0000000000072000.00000002.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.485903265.0000000000072000.00000002.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: E3rDVPhyAf.exe PID: 5492, type: MEMORY
            Source: Yara matchFile source: 0.0.E3rDVPhyAf.exe.70000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.E3rDVPhyAf.exe.70000.0.unpack, type: UNPACKEDPE

            System Summary:

            barindex
            .NET source code contains very large array initializationsShow sources
            Source: E3rDVPhyAf.exe, hidden_tear/Form1.csLarge array initialization: messageCreator: array initializer size 403347
            Source: 0.2.E3rDVPhyAf.exe.70000.0.unpack, hidden_tear/Form1.csLarge array initialization: messageCreator: array initializer size 403347
            Source: 0.0.E3rDVPhyAf.exe.70000.0.unpack, hidden_tear/Form1.csLarge array initialization: messageCreator: array initializer size 403347
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeCode function: 0_2_00A0C1540_2_00A0C154
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeCode function: 0_2_00A0E5890_2_00A0E589
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeCode function: 0_2_00A0E5980_2_00A0E598
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeCode function: 0_2_06AB53000_2_06AB5300
            Source: E3rDVPhyAf.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: E3rDVPhyAf.exeBinary or memory string: OriginalFilename vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exe, 00000000.00000000.220352752.00000000000D9000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamehidden-tear-decrypter.exeL vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exe, 00000000.00000000.220352752.00000000000D9000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamehidden-tear.exe8 vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exe, 00000000.00000002.502130922.0000000008210000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exe, 00000000.00000002.489397825.00000000025C7000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamemscorlib.dllT vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exe, 00000000.00000002.489397825.00000000025C7000.00000004.00000001.sdmpBinary or memory string: l,\\StringFileInfo\\040904B0\\OriginalFilename vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exe, 00000000.00000002.489397825.00000000025C7000.00000004.00000001.sdmpBinary or memory string: l,\\StringFileInfo\\000004B0\\OriginalFilename vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exe, 00000000.00000002.489397825.00000000025C7000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSystem.Windows.Forms.dllT vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exe, 00000000.00000002.489397825.00000000025C7000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSystem.dllT vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exe, 00000000.00000002.489397825.00000000025C7000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSystem.Drawing.dllT vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exe, 00000000.00000002.489397825.00000000025C7000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSystem.Configuration.dllT vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exe, 00000000.00000002.489397825.00000000025C7000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSystem.Core.dllT vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exe, 00000000.00000002.489397825.00000000025C7000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSystem.Xml.dllT vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exe, 00000000.00000002.489397825.00000000025C7000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exe, 00000000.00000002.494849605.0000000006A00000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dll.muij% vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exe, 00000000.00000002.494823590.00000000069F0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dllj% vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exeBinary or memory string: OriginalFilenamehidden-tear-decrypter.exeL vs E3rDVPhyAf.exe
            Source: E3rDVPhyAf.exeBinary or memory string: OriginalFilenamehidden-tear.exe8 vs E3rDVPhyAf.exe
            Source: 0.0.E3rDVPhyAf.exe.de93c.3.unpack, type: UNPACKEDPEMatched rule: MAL_RANSOM_COVID19_Apr20_1 date = 2020-04-15, hash1 = 2779863a173ff975148cb3156ee593cb5719a0ab238ea7c9e0b0ca3b5a4a9326, author = Florian Roth, description = Detects ransomware distributed in COVID-19 theme, reference = https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/
            Source: 0.2.E3rDVPhyAf.exe.de93c.3.unpack, type: UNPACKEDPEMatched rule: MAL_RANSOM_COVID19_Apr20_1 date = 2020-04-15, hash1 = 2779863a173ff975148cb3156ee593cb5719a0ab238ea7c9e0b0ca3b5a4a9326, author = Florian Roth, description = Detects ransomware distributed in COVID-19 theme, reference = https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/
            Source: 0.2.E3rDVPhyAf.exe.de93c.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_RANSOM_COVID19_Apr20_1 date = 2020-04-15, hash1 = 2779863a173ff975148cb3156ee593cb5719a0ab238ea7c9e0b0ca3b5a4a9326, author = Florian Roth, description = Detects ransomware distributed in COVID-19 theme, reference = https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/
            Source: 0.0.E3rDVPhyAf.exe.de93c.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_RANSOM_COVID19_Apr20_1 date = 2020-04-15, hash1 = 2779863a173ff975148cb3156ee593cb5719a0ab238ea7c9e0b0ca3b5a4a9326, author = Florian Roth, description = Detects ransomware distributed in COVID-19 theme, reference = https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/
            Source: 0.0.E3rDVPhyAf.exe.70000.0.unpack, hidden_tear/Form1.csSecurity API names: System.Security.AccessControl.DirectorySecurity System.IO.Directory::GetAccessControl(System.String)
            Source: 0.0.E3rDVPhyAf.exe.70000.0.unpack, hidden_tear/Form1.csSecurity API names: System.Security.AccessControl.AuthorizationRuleCollection System.Security.AccessControl.CommonObjectSecurity::GetAccessRules(System.Boolean,System.Boolean,System.Type)
            Source: 0.2.E3rDVPhyAf.exe.70000.0.unpack, hidden_tear/Form1.csSecurity API names: System.Security.AccessControl.DirectorySecurity System.IO.Directory::GetAccessControl(System.String)
            Source: 0.2.E3rDVPhyAf.exe.70000.0.unpack, hidden_tear/Form1.csSecurity API names: System.Security.AccessControl.AuthorizationRuleCollection System.Security.AccessControl.CommonObjectSecurity::GetAccessRules(System.Boolean,System.Boolean,System.Type)
            Source: E3rDVPhyAf.exe, hidden_tear/Form1.csSecurity API names: System.Security.AccessControl.DirectorySecurity System.IO.Directory::GetAccessControl(System.String)
            Source: E3rDVPhyAf.exe, hidden_tear/Form1.csSecurity API names: System.Security.AccessControl.AuthorizationRuleCollection System.Security.AccessControl.CommonObjectSecurity::GetAccessRules(System.Boolean,System.Boolean,System.Type)
            Source: E3rDVPhyAf.exeBinary or memory string: .pptx.odt.jpg.png.csv.sql.mdb.sln.php.asp
            Source: classification engineClassification label: mal80.rans.winEXE@1/0@1/0
            Source: E3rDVPhyAf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: E3rDVPhyAf.exeVirustotal: Detection: 77%
            Source: E3rDVPhyAf.exeReversingLabs: Detection: 86%
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeFile read: C:\Users\user\Desktop\E3rDVPhyAf.exeJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32Jump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeAutomated click: Continue
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeAutomated click: Continue
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
            Source: E3rDVPhyAf.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
            Source: E3rDVPhyAf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
            Source: E3rDVPhyAf.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: System.Windows.Forms.pdb source: E3rDVPhyAf.exe, 00000000.00000002.502555949.0000000008BC8000.00000004.00000001.sdmp
            Source: Binary string: \hidden-tear\hidden-tear\obj\Release\hidden-tear.pdb source: E3rDVPhyAf.exe
            Source: Binary string: \??\C:\Windows\System.Windows.Forms.pdbw source: E3rDVPhyAf.exe, 00000000.00000002.502555949.0000000008BC8000.00000004.00000001.sdmp
            Source: Binary string: D:\Sanghee Workspace\Project bakaware\bakaware\Touhou_ScoreOrEncrypt\Release\Touhou_ScoreOrEncrypt.pdb source: E3rDVPhyAf.exe
            Source: Binary string: \??\C:\Windows\symbols\dll\System.pdbV source: E3rDVPhyAf.exe, 00000000.00000002.502555949.0000000008BC8000.00000004.00000001.sdmp
            Source: Binary string: \hidden-tear-decrypter\hidden-tear-decrypter\obj\Release\hidden-tear-decrypter.pdb source: E3rDVPhyAf.exe
            Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: E3rDVPhyAf.exe
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeCode function: 0_2_000752C6 push cs; ret 0_2_000752C9

            Hooking and other Techniques for Hiding and Protection:

            barindex
            Icon mismatch, binary includes an icon from a different legit application in order to fool usersShow sources
            Source: initial sampleIcon embedded in binary file: icon matches a legit application icon: icon (5001).png
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: E3rDVPhyAf.exe, 00000000.00000002.502130922.0000000008210000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
            Source: E3rDVPhyAf.exe, 00000000.00000002.502130922.0000000008210000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
            Source: E3rDVPhyAf.exe, 00000000.00000002.502130922.0000000008210000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
            Source: E3rDVPhyAf.exe, 00000000.00000002.502130922.0000000008210000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeMemory allocated: page read and write | page guardJump to behavior
            Source: E3rDVPhyAf.exe, 00000000.00000002.488478361.0000000000F30000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
            Source: E3rDVPhyAf.exe, 00000000.00000002.488478361.0000000000F30000.00000002.00000001.sdmpBinary or memory string: Progman
            Source: E3rDVPhyAf.exe, 00000000.00000002.488478361.0000000000F30000.00000002.00000001.sdmpBinary or memory string: SProgram Managerl
            Source: E3rDVPhyAf.exe, 00000000.00000002.488478361.0000000000F30000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd,
            Source: E3rDVPhyAf.exe, 00000000.00000002.488478361.0000000000F30000.00000002.00000001.sdmpBinary or memory string: Progmanlock
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Users\user\Desktop\E3rDVPhyAf.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\E3rDVPhyAf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Masquerading1Input Capture1Security Software Discovery1Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemoryProcess Discovery1Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection1Security Account ManagerSystem Information Discovery12SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Obfuscated Files or Information1NTDSRemote System Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.