Loading ...

Play interactive tourEdit tour

Analysis Report G9xXUq625O

Overview

General Information

Sample Name:G9xXUq625O (renamed file extension from none to exe)
Analysis ID:432748
MD5:9a188a4b5ab76f5d53892f7bcd5dfbeb
SHA1:b61e66760f0959fbb3f66daa0840eb40121827c7
SHA256:12b582ab21f7f9cd0f7475461d4f3e12ea5b8ce8ea86010e062d6dc7b5d83473
Tags:AgentTeslaexetrojan
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Modifies the hosts file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Antivirus or Machine Learning detection for unpacked file
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • G9xXUq625O.exe (PID: 6320 cmdline: 'C:\Users\user\Desktop\G9xXUq625O.exe' MD5: 9A188A4B5AB76F5D53892F7BCD5DFBEB)
    • G9xXUq625O.exe (PID: 7144 cmdline: {path} MD5: 9A188A4B5AB76F5D53892F7BCD5DFBEB)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "macslog@lontor.cf7213575aceACE@#$lontor.cfmacs@lontor.cf"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000009.00000000.425863712.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000009.00000000.425863712.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000000.00000002.431520750.000000000426A000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000000.00000002.431520750.000000000426A000.00000004.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
          00000000.00000002.429711902.0000000003263000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
            Click to see the 8 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            9.2.G9xXUq625O.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              9.2.G9xXUq625O.exe.400000.0.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                9.0.G9xXUq625O.exe.400000.1.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  9.0.G9xXUq625O.exe.400000.1.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    0.2.G9xXUq625O.exe.432b7f8.3.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 3 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 00000009.00000002.601783516.0000000003141000.00000004.00000001.sdmpMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "macslog@lontor.cf7213575aceACE@#$lontor.cfmacs@lontor.cf"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: G9xXUq625O.exeVirustotal: Detection: 31%Perma Link
                      Source: G9xXUq625O.exeReversingLabs: Detection: 39%
                      Source: 9.0.G9xXUq625O.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8
                      Source: 0.2.G9xXUq625O.exe.e50000.0.unpackAvira: Label: TR/Crypt.XPACK.Gen2
                      Source: 9.2.G9xXUq625O.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8

                      Compliance:

                      barindex
                      Detected unpacking (overwrites its own PE header)Show sources
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeUnpacked PE file: 0.2.G9xXUq625O.exe.e50000.0.unpack
                      Source: G9xXUq625O.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: G9xXUq625O.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 4x nop then push dword ptr [ebp-24h]0_2_07B24678
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh0_2_07B24678
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h0_2_07B241E8
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 4x nop then push dword ptr [ebp-20h]0_2_07B24358
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh0_2_07B24358
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 4x nop then push dword ptr [ebp-20h]0_2_07B2434D
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh0_2_07B2434D
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 4x nop then push dword ptr [ebp-24h]0_2_07B24619
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh0_2_07B24619
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 4x nop then push dword ptr [ebp-24h]0_2_07B2466C
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh0_2_07B2466C
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 4x nop then xor edx, edx0_2_07B245B0
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 4x nop then xor edx, edx0_2_07B245A4
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h0_2_07B241DC
                      Source: G9xXUq625O.exe, 00000009.00000002.601783516.0000000003141000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: G9xXUq625O.exe, 00000009.00000002.601783516.0000000003141000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: G9xXUq625O.exe, 00000000.00000003.335915924.00000000064DE000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: G9xXUq625O.exe, 00000000.00000003.336235565.00000000064FD000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com
                      Source: G9xXUq625O.exe, 00000000.00000003.336235565.00000000064FD000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coma
                      Source: G9xXUq625O.exe, 00000000.00000003.336235565.00000000064FD000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comac
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: G9xXUq625O.exe, 00000000.00000003.341188332.00000000064FB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: G9xXUq625O.exe, 00000000.00000003.342278557.00000000064FB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                      Source: G9xXUq625O.exe, 00000000.00000003.342278557.00000000064FB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmlX
                      Source: G9xXUq625O.exe, 00000000.00000003.341200323.00000000064DB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers6
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: G9xXUq625O.exe, 00000000.00000003.341477817.00000000064DB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers:
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: G9xXUq625O.exe, 00000000.00000003.342474385.00000000064DB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersK
                      Source: G9xXUq625O.exe, 00000000.00000003.341742819.00000000064DB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersQ
                      Source: G9xXUq625O.exe, 00000000.00000003.342518355.00000000064DB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersn
                      Source: G9xXUq625O.exe, 00000000.00000003.342266364.00000000064DB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersr
                      Source: G9xXUq625O.exe, 00000000.00000003.341742819.00000000064DB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designerst
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
                      Source: G9xXUq625O.exe, 00000000.00000003.335646579.00000000064F6000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.cj
                      Source: G9xXUq625O.exe, 00000000.00000003.335400304.00000000064DC000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: G9xXUq625O.exe, 00000000.00000003.335290383.00000000064FE000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn%
                      Source: G9xXUq625O.exe, 00000000.00000003.334737506.00000000064FC000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: G9xXUq625O.exe, 00000000.00000003.335618631.00000000064F6000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/o
                      Source: G9xXUq625O.exe, 00000000.00000003.335618631.00000000064F6000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnC
                      Source: G9xXUq625O.exe, 00000000.00000003.335349159.00000000064F6000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnG
                      Source: G9xXUq625O.exe, 00000000.00000003.335104036.00000000064FE000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnN
                      Source: G9xXUq625O.exe, 00000000.00000003.335481983.00000000064F8000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnO
                      Source: G9xXUq625O.exe, 00000000.00000003.335364432.00000000064FE000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cngsP/
                      Source: G9xXUq625O.exe, 00000000.00000003.345811790.00000000064FC000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/2
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: G9xXUq625O.exe, 00000000.00000003.345811790.00000000064FC000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/T
                      Source: G9xXUq625O.exe, 00000000.00000003.346317691.00000000064FC000.00000004.00000001.sdmp, G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: G9xXUq625O.exe, 00000000.00000003.334582934.00000000064FC000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: G9xXUq625O.exe, 00000000.00000003.337743291.00000000064FB000.00000004.00000001.sdmp, G9xXUq625O.exe, 00000000.00000003.337720985.000000000650C000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: G9xXUq625O.exe, 00000000.00000003.338034016.000000000650C000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.comgr
                      Source: G9xXUq625O.exe, 00000000.00000003.334582934.00000000064FC000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: G9xXUq625O.exe, 00000000.00000003.334512856.00000000064FB000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.krFd
                      Source: G9xXUq625O.exe, 00000000.00000003.334582934.00000000064FC000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.krY
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
                      Source: G9xXUq625O.exe, 00000000.00000003.336417842.00000000064FD000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comslnt
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
                      Source: G9xXUq625O.exe, 00000000.00000003.342595548.00000000064FC000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.de
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: G9xXUq625O.exe, 00000000.00000003.342595548.00000000064FC000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deeg
                      Source: G9xXUq625O.exe, 00000000.00000003.341188332.00000000064FB000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deoM
                      Source: G9xXUq625O.exe, 00000000.00000003.341109149.00000000064FB000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deoi
                      Source: G9xXUq625O.exe, 00000000.00000002.440400052.00000000065C0000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: G9xXUq625O.exe, 00000000.00000003.336038601.00000000064FD000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cno.q
                      Source: G9xXUq625O.exe, 00000009.00000002.601783516.0000000003141000.00000004.00000001.sdmpString found in binary or memory: http://xUCQUz.com
                      Source: G9xXUq625O.exe, 00000009.00000002.601783516.0000000003141000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%GETMozilla/5.0
                      Source: G9xXUq625O.exe, 00000000.00000002.431520750.000000000426A000.00000004.00000001.sdmp, G9xXUq625O.exe, 00000009.00000000.425863712.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: G9xXUq625O.exe, 00000009.00000002.601783516.0000000003141000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior

                      Spam, unwanted Advertisements and Ransom Demands:

                      barindex
                      Modifies the hosts fileShow sources
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

                      System Summary:

                      barindex
                      .NET source code contains very large array initializationsShow sources
                      Source: 9.0.G9xXUq625O.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007bC788BFD1u002d279Cu002d4938u002dAFC9u002d1DDB46B7D56Cu007d/u003774D2A61u002dB721u002d47D3u002dB82Fu002d601916BBAB74.csLarge array initialization: .cctor: array initializer size 11990
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_052500060_2_05250006
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_052500400_2_05250040
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B286E00_2_07B286E0
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B296100_2_07B29610
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B23A600_2_07B23A60
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2BD280_2_07B2BD28
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B265080_2_07B26508
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B221450_2_07B22145
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B27CB80_2_07B27CB8
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2DCA80_2_07B2DCA8
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B260900_2_07B26090
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B22C300_2_07B22C30
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B270600_2_07B27060
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B26FFE0_2_07B26FFE
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2BB600_2_07B2BB60
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2BB510_2_07B2BB51
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2B6B90_2_07B2B6B9
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2E6800_2_07B2E680
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B286D00_2_07B286D0
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2B6C80_2_07B2B6C8
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2CDB00_2_07B2CDB0
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2CD9A0_2_07B2CD9A
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B295E10_2_07B295E1
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2A5300_2_07B2A530
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2A5200_2_07B2A520
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2BD180_2_07B2BD18
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2B9000_2_07B2B900
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B251600_2_07B25160
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B251500_2_07B25150
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2E1580_2_07B2E158
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B27CA80_2_07B27CA8
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2B8F00_2_07B2B8F0
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B264F80_2_07B264F8
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2B0780_2_07B2B078
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2705A0_2_07B2705A
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 9_2_015247A09_2_015247A0
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 9_2_015247109_2_01524710
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 9_2_015246B09_2_015246B0
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 9_2_0152D8219_2_0152D821
                      Source: G9xXUq625O.exeBinary or memory string: OriginalFilename vs G9xXUq625O.exe
                      Source: G9xXUq625O.exe, 00000000.00000002.443019153.0000000007E70000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs G9xXUq625O.exe
                      Source: G9xXUq625O.exe, 00000000.00000000.330359127.0000000000F2E000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameAhdM.exe: vs G9xXUq625O.exe
                      Source: G9xXUq625O.exe, 00000000.00000002.429573999.0000000003255000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameWMOMMdfVSdGrTsqbxpwwFtKlBIjsvLnX.exe4 vs G9xXUq625O.exe
                      Source: G9xXUq625O.exe, 00000000.00000002.444427406.0000000009890000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMajorRevision.exe< vs G9xXUq625O.exe
                      Source: G9xXUq625O.exe, 00000000.00000002.429711902.0000000003263000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameWindowsNetwork.dll> vs G9xXUq625O.exe
                      Source: G9xXUq625O.exe, 00000009.00000000.425531019.0000000000DBE000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameAhdM.exe: vs G9xXUq625O.exe
                      Source: G9xXUq625O.exe, 00000009.00000002.604637244.0000000005670000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewbemdisp.tlbj% vs G9xXUq625O.exe
                      Source: G9xXUq625O.exe, 00000009.00000002.599032014.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameWMOMMdfVSdGrTsqbxpwwFtKlBIjsvLnX.exe4 vs G9xXUq625O.exe
                      Source: G9xXUq625O.exeBinary or memory string: OriginalFilenameAhdM.exe: vs G9xXUq625O.exe
                      Source: G9xXUq625O.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: 9.0.G9xXUq625O.exe.400000.1.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 9.0.G9xXUq625O.exe.400000.1.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: classification engineClassification label: mal100.troj.adwa.evad.winEXE@3/2@0/0
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\G9xXUq625O.exe.logJump to behavior
                      Source: G9xXUq625O.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: G9xXUq625O.exeVirustotal: Detection: 31%
                      Source: G9xXUq625O.exeReversingLabs: Detection: 39%
                      Source: unknownProcess created: C:\Users\user\Desktop\G9xXUq625O.exe 'C:\Users\user\Desktop\G9xXUq625O.exe'
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess created: C:\Users\user\Desktop\G9xXUq625O.exe {path}
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess created: C:\Users\user\Desktop\G9xXUq625O.exe {path}Jump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: G9xXUq625O.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: G9xXUq625O.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

                      Data Obfuscation:

                      barindex
                      Detected unpacking (changes PE section rights)Show sources
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeUnpacked PE file: 0.2.G9xXUq625O.exe.e50000.0.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;
                      Detected unpacking (overwrites its own PE header)Show sources
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeUnpacked PE file: 0.2.G9xXUq625O.exe.e50000.0.unpack
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_00E54290 push ds; ret 0_2_00E54291
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_052505C2 push edi; retf 0_2_052505C3
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_05254F7D push dword ptr [edx+ebp*2-75h]; iretd 0_2_05254F87
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B2CD86 pushfd ; retf 0_2_07B2CD99
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 0_2_07B27CA8 push eax; ret 0_2_07B27CDD
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeCode function: 9_2_00CE4290 push ds; ret 9_2_00CE4291
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.02711438354
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: 00000000.00000002.429711902.0000000003263000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: G9xXUq625O.exe PID: 6320, type: MEMORY
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: G9xXUq625O.exe, 00000000.00000002.429711902.0000000003263000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                      Source: G9xXUq625O.exe, 00000000.00000002.429711902.0000000003263000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeWindow / User API: threadDelayed 1861Jump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeWindow / User API: threadDelayed 7983Jump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exe TID: 6432Thread sleep time: -58000s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exe TID: 6400Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exe TID: 7000Thread sleep count: 31 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exe TID: 7000Thread sleep time: -28592453314249787s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exe TID: 7004Thread sleep count: 1861 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exe TID: 7004Thread sleep count: 7983 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: G9xXUq625O.exe, 00000000.00000002.429711902.0000000003263000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
                      Source: G9xXUq625O.exe, 00000000.00000002.429711902.0000000003263000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: G9xXUq625O.exe, 00000000.00000002.429711902.0000000003263000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: G9xXUq625O.exe, 00000000.00000002.429711902.0000000003263000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                      Source: G9xXUq625O.exe, 00000000.00000002.429711902.0000000003263000.00000004.00000001.sdmpBinary or memory string: VMWARE
                      Source: G9xXUq625O.exe, 00000000.00000002.429711902.0000000003263000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: G9xXUq625O.exe, 00000000.00000002.429711902.0000000003263000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                      Source: G9xXUq625O.exe, 00000000.00000002.429711902.0000000003263000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                      Source: G9xXUq625O.exe, 00000000.00000002.429711902.0000000003263000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeMemory allocated: page read and write | page guardJump to behavior

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeMemory written: C:\Users\user\Desktop\G9xXUq625O.exe base: 400000 value starts with: 4D5AJump to behavior
                      Modifies the hosts fileShow sources
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeProcess created: C:\Users\user\Desktop\G9xXUq625O.exe {path}Jump to behavior
                      Source: G9xXUq625O.exe, 00000009.00000002.601552565.0000000001BD0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: G9xXUq625O.exe, 00000009.00000002.601552565.0000000001BD0000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: G9xXUq625O.exe, 00000009.00000002.601552565.0000000001BD0000.00000002.00000001.sdmpBinary or memory string: &Program Manager
                      Source: G9xXUq625O.exe, 00000009.00000002.601552565.0000000001BD0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Users\user\Desktop\G9xXUq625O.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\G9xXUq625O.exeQu