Loading ...

Play interactive tourEdit tour

Windows Analysis Report Pedido_73580523.exe

Overview

General Information

Sample Name:Pedido_73580523.exe
Analysis ID:452720
MD5:facf53403056e3d7529fc8a5ce8be77f
SHA1:384a0565e553ac374dd6d197b51a94bace517f36
SHA256:3bd0c04ee4c4ba078c54f4e7f5f956894204b2ccfbe84cdf934c40b28e30165e
Tags:AgentTeslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Yara detected AgentTesla
Yara detected AgentTesla
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • Pedido_73580523.exe (PID: 5300 cmdline: 'C:\Users\user\Desktop\Pedido_73580523.exe' MD5: FACF53403056E3D7529FC8A5CE8BE77F)
    • schtasks.exe (PID: 5572 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\AsJOyfF' /XML 'C:\Users\user\AppData\Local\Temp\tmpE123.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 5656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • Pedido_73580523.exe (PID: 5556 cmdline: C:\Users\user\Desktop\Pedido_73580523.exe MD5: FACF53403056E3D7529FC8A5CE8BE77F)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "comercial@fil-net.com", "Password": "Fil-2020net+", "Host": "smtp.fil-net.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000A.00000002.477029833.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    0000000A.00000002.477029833.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      0000000A.00000002.482206356.0000000002CF1000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        0000000A.00000002.482206356.0000000002CF1000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
          0000000A.00000002.483335897.0000000002D9E000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 2 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            10.2.Pedido_73580523.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              10.2.Pedido_73580523.exe.400000.0.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security

                Sigma Overview

                No Sigma rule has matched

                Jbx Signature Overview

                Click to jump to signature section

                Show All Signature Results

                AV Detection:

                barindex
                Found malware configurationShow sources
                Source: 10.2.Pedido_73580523.exe.400000.0.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "comercial@fil-net.com", "Password": "Fil-2020net+", "Host": "smtp.fil-net.com"}
                Machine Learning detection for dropped fileShow sources
                Source: C:\Users\user\AppData\Roaming\AsJOyfF.exeJoe Sandbox ML: detected
                Machine Learning detection for sampleShow sources
                Source: Pedido_73580523.exeJoe Sandbox ML: detected
                Source: 10.2.Pedido_73580523.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                Source: Pedido_73580523.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                Source: Pedido_73580523.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                Source: Pedido_73580523.exe, 0000000A.00000002.482206356.0000000002CF1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                Source: Pedido_73580523.exe, 0000000A.00000002.482206356.0000000002CF1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                Source: Pedido_73580523.exeString found in binary or memory: http://api.twitter.com/1/direct_messages.xml?since_id=
                Source: Pedido_73580523.exe, 00000000.00000003.210447083.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://en.w
                Source: Pedido_73580523.exe, 0000000A.00000002.482206356.0000000002CF1000.00000004.00000001.sdmpString found in binary or memory: http://mGfDbY.com
                Source: Pedido_73580523.exeString found in binary or memory: http://twitter.com/statuses/user_timeline.xml?screen_name=
                Source: Pedido_73580523.exe, 00000000.00000003.215049753.00000000061F5000.00000004.00000001.sdmp, Pedido_73580523.exe, 00000000.00000003.215200841.0000000006234000.00000004.00000001.sdmpString found in binary or memory: http://www.ascendercorp.com/typedesigners.html
                Source: Pedido_73580523.exe, 00000000.00000003.217980203.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                Source: Pedido_73580523.exe, 00000000.00000003.216583599.0000000006231000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/
                Source: Pedido_73580523.exe, 00000000.00000003.217489630.0000000006209000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html.
                Source: Pedido_73580523.exe, 00000000.00000003.218151297.00000000061F7000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comF
                Source: Pedido_73580523.exe, 00000000.00000003.217980203.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comcomd$
                Source: Pedido_73580523.exe, 00000000.00000003.218151297.00000000061F7000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comd
                Source: Pedido_73580523.exe, 00000000.00000003.218151297.00000000061F7000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comitud
                Source: Pedido_73580523.exe, 00000000.00000003.218151297.00000000061F7000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comlic
                Source: Pedido_73580523.exe, 00000000.00000003.217980203.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comoitu
                Source: Pedido_73580523.exe, 00000000.00000003.213128785.00000000061F6000.00000004.00000001.sdmp, Pedido_73580523.exe, 00000000.00000003.212415190.000000000160D000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                Source: Pedido_73580523.exe, 00000000.00000003.213128785.00000000061F6000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn-
                Source: Pedido_73580523.exe, 00000000.00000003.213128785.00000000061F6000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/
                Source: Pedido_73580523.exe, 00000000.00000003.212934206.00000000061F8000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/W
                Source: Pedido_73580523.exe, 00000000.00000003.212709588.00000000061F7000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnQ
                Source: Pedido_73580523.exe, 00000000.00000003.213128785.00000000061F6000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnS
                Source: Pedido_73580523.exe, 00000000.00000003.212339302.00000000061FD000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnhte
                Source: Pedido_73580523.exe, 00000000.00000003.218489742.0000000006203000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/
                Source: Pedido_73580523.exe, 00000000.00000003.220042751.0000000006202000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                Source: Pedido_73580523.exe, 00000000.00000003.215049753.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                Source: Pedido_73580523.exe, 00000000.00000003.214626858.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/T
                Source: Pedido_73580523.exe, 00000000.00000003.214626858.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
                Source: Pedido_73580523.exe, 00000000.00000003.215049753.00000000061F5000.00000004.00000001.sdmp, Pedido_73580523.exe, 00000000.00000003.214626858.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
                Source: Pedido_73580523.exe, 00000000.00000003.215049753.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/k
                Source: Pedido_73580523.exe, 00000000.00000003.214626858.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/o
                Source: Pedido_73580523.exe, 00000000.00000003.215049753.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/p
                Source: Pedido_73580523.exe, 00000000.00000003.215049753.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/s
                Source: Pedido_73580523.exe, 00000000.00000003.214626858.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/the
                Source: Pedido_73580523.exe, 00000000.00000003.215049753.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/y
                Source: Pedido_73580523.exe, 00000000.00000003.210192777.00000000061F3000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                Source: Pedido_73580523.exe, 00000000.00000003.215049753.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                Source: Pedido_73580523.exe, 00000000.00000003.211275545.000000000620B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
                Source: Pedido_73580523.exe, 00000000.00000003.217980203.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.de
                Source: Pedido_73580523.exe, 00000000.00000003.217980203.00000000061F5000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deiv
                Source: Pedido_73580523.exe, 0000000A.00000002.483185292.0000000002D96000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%
                Source: Pedido_73580523.exe, 0000000A.00000002.482206356.0000000002CF1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%GETMozilla/5.0
                Source: Pedido_73580523.exe, 0000000A.00000002.477029833.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                Source: Pedido_73580523.exe, 0000000A.00000002.482206356.0000000002CF1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                System Summary:

                barindex
                .NET source code contains very large array initializationsShow sources
                Source: 10.2.Pedido_73580523.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b10ED4C56u002d571Cu002d402Eu002dB4B1u002d87E9BCA3C5C4u007d/CBB7CA1Au002dED7Au002d47B8u002d88E9u002dF0C8884A2598.csLarge array initialization: .cctor: array initializer size 11976
                Source: C:\Users\user\Desktop\Pedido_73580523.exeCode function: 10_2_007B2F6510_2_007B2F65
                Source: C:\Users\user\Desktop\Pedido_73580523.exeCode function: 10_2_0105004010_2_01050040
                Source: C:\Users\user\Desktop\Pedido_73580523.exeCode function: 10_2_0105607810_2_01056078
                Source: C:\Users\user\Desktop\Pedido_73580523.exeCode function: 10_2_010571A810_2_010571A8
                Source: C:\Users\user\Desktop\Pedido_73580523.exeCode function: 10_2_011047A010_2_011047A0
                Source: C:\Users\user\Desktop\Pedido_73580523.exeCode function: 10_2_011046B010_2_011046B0
                Source: C:\Users\user\Desktop\Pedido_73580523.exeCode function: 10_2_011046D010_2_011046D0
                Source: Pedido_73580523.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                Source: AsJOyfF.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                Source: Pedido_73580523.exe, 00000000.00000000.207704573.0000000000D78000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameNullableMarshal.exe8 vs Pedido_73580523.exe
                Source: Pedido_73580523.exe, 0000000A.00000002.482059336.0000000002CC0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewbemdisp.tlbj% vs Pedido_73580523.exe
                Source: Pedido_73580523.exe, 0000000A.00000000.272608589.0000000000878000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameNullableMarshal.exe8 vs Pedido_73580523.exe
                Source: Pedido_73580523.exe, 0000000A.00000002.477029833.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamenDAdqEzYkDSGpDZYlPMgRyM.exe4 vs Pedido_73580523.exe
                Source: Pedido_73580523.exe, 0000000A.00000002.485962524.0000000005D60000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs Pedido_73580523.exe
                Source: Pedido_73580523.exeBinary or memory string: OriginalFilenameNullableMarshal.exe8 vs Pedido_73580523.exe
                Source: C:\Users\user\Desktop\Pedido_73580523.exeSection loaded: scrrun.dllJump to behavior
                Source: Pedido_73580523.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                Source: Pedido_73580523.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                Source: AsJOyfF.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                Source: Pedido_73580523.exe, RF8PXKLrFH3jwUt3cN/oBbAM0U5fbpRrmLh7v.csCryptographic APIs: 'CreateDecryptor'
                Source: AsJOyfF.exe.0.dr, RF8PXKLrFH3jwUt3cN/oBbAM0U5fbpRrmLh7v.csCryptographic APIs: 'CreateDecryptor'
                Source: 0.0.Pedido_73580523.exe.cb0000.0.unpack, RF8PXKLrFH3jwUt3cN/oBbAM0U5fbpRrmLh7v.csCryptographic APIs: 'CreateDecryptor'
                Source: 10.2.Pedido_73580523.exe.7b0000.1.unpack, RF8PXKLrFH3jwUt3cN/oBbAM0U5fbpRrmLh7v.csCryptographic APIs: 'CreateDecryptor'
                Source: 10.2.Pedido_73580523.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                Source: 10.2.Pedido_73580523.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                Source: 10.0.Pedido_73580523.exe.7b0000.0.unpack, RF8PXKLrFH3jwUt3cN/oBbAM0U5fbpRrmLh7v.csCryptographic APIs: 'CreateDecryptor'
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@6/4@0/0
                Source: C:\Users\user\Desktop\Pedido_73580523.exeFile created: C:\Users\user\AppData\Roaming\AsJOyfF.exeJump to behavior
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5656:120:WilError_01
                Source: C:\Users\user\Desktop\Pedido_73580523.exeFile created: C:\Users\user\AppData\Local\Temp\tmpE123.tmpJump to behavior
                Source: Pedido_73580523.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                Source: C:\Users\user\Desktop\Pedido_73580523.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                Source: C:\Users\user\Desktop\Pedido_73580523.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeFile read: C:\Users\user\Desktop\Pedido_73580523.exeJump to behavior
                Source: unknownProcess created: C:\Users\user\Desktop\Pedido_73580523.exe 'C:\Users\user\Desktop\Pedido_73580523.exe'
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\AsJOyfF' /XML 'C:\Users\user\AppData\Local\Temp\tmpE123.tmp'
                Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess created: C:\Users\user\Desktop\Pedido_73580523.exe C:\Users\user\Desktop\Pedido_73580523.exe
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\AsJOyfF' /XML 'C:\Users\user\AppData\Local\Temp\tmpE123.tmp'Jump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess created: C:\Users\user\Desktop\Pedido_73580523.exe C:\Users\user\Desktop\Pedido_73580523.exeJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32Jump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                Source: Pedido_73580523.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                Source: Pedido_73580523.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                Source: initial sampleStatic PE information: section name: .text entropy: 7.55884475799
                Source: initial sampleStatic PE information: section name: .text entropy: 7.55884475799
                Source: Pedido_73580523.exe, l3IX98V73sUCBF1DMc/gusKqNENHKelgRLO50.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'Nv2lUlWcJK', 'TAUuA6T5UP', 'QWGuQkf6CD', 'gWmugd7qSv', 'Es0utUWhtZ', 'bVlufrPVWL', 'ML3uhFIFgo', 'WD8uNUgw1p'
                Source: Pedido_73580523.exe, GbFWveBmWYUfQpE0t1/hiVkAR2J6uZHhOXYqv.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'oP3l40GEEn', 'EeMx3q0PqP', 'jLGxv98x6H', 'gbwxGHK5We', 'cGMxjNCQ9C', 'DR6xVXlwPG', 'V7yxkwJQGF', 'StsxAPY9Tx'
                Source: Pedido_73580523.exe, thKZU6uM8BnUXXSY2C/dLiD5cbbT9vCIHCY4a.csHigh entropy of concatenated method names: 'i0DTXd37Jr', 'hrPTYuVdQp', 'otBT85twNs', 'gPQTw8DNd4', 'gSLTk1e2K8', 'lsnTnE5AM7', 'pHjTJUyoHf', 'NiZTPuGyOE', 'wDoTsoxRPF', 'YNKTvCZgeL'
                Source: Pedido_73580523.exe, OQaLV83CLCcgFekSoO/FK1FvBMnLR2h3Ynjwt.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'EVaRyTGt7W', 'WqYl6JPuKm', 'KQdlreO1Hl', 'gWmugd7qSv', 'Es0utUWhtZ', 'bVlufrPVWL', 'ML3uhFIFgo', 'tVv999YmWM'
                Source: Pedido_73580523.exe, vbrstF6UNbiQbaC7Fk/oLpULScGds3ogJvbnx.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'iwyR4ysLB5', 'Q5dRFeBTWx', 'lIpRWWQbX1', 'eXMRxDB0aH', 'lDqRJEsWHg', 'gWmugd7qSv', 'Es0utUWhtZ', 'bVlufrPVWL'
                Source: Pedido_73580523.exe, bGjaFXK4AxoNuRDKdf/cCKFfNgbfW6LXdnuAW.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'BUUdZ4Pffv', 'Eqp9NV3PkW', 'JPi9z1a3jf', 'e8olLukTcP', 'r1FlKEHmgs', 'ggjl520xDU', 'N7UlwoAOcv', 'lLxlD3bJVS'
                Source: Pedido_73580523.exe, b2msoQPN7ewA6kYygC/KMbPfbnAvgFi7u0QLQ.csHigh entropy of concatenated method names: 'pmWIbYUfQp', 'M0tIu1CusK', 'fLOIq50H3I', 'q98I573sUC', 'OFfIpNbfW6', 'XXdItnuAWT', 'pjaIQFX4Ax', 'yNuIDRDKdf', 'k3oIOgJvbn', 'j9bI2rstFU'
                Source: Pedido_73580523.exe, uN58hUtKpKHESFnAWw/SOSVYwp5dV1e67DZTl.csHigh entropy of concatenated method names: 'L6jmNocZEF', 'ncvmOlGKs7', 'yHYmBETN97', 'siemE8ZuHC', 'GjFmgwB35f', 'RuTmKGcCBi', 'M95mcEHMTy', 'zZsm6Y3kRL', 'BdOm30u3KK', 'KuxmagolDg'
                Source: Pedido_73580523.exe, RF8PXKLrFH3jwUt3cN/oBbAM0U5fbpRrmLh7v.csHigh entropy of concatenated method names: 'xrECuAC1eC', 'iXsCpulKC2', 'BAyCt5axUV', '.ctor', '.ctor', 'VKgCjqQ6a9', 't8lCqJQdPp', 'aPgC5rOI0h', 'EhqCy3sUiS', 'OFDo377AD3Z5Et4Pcb6'
                Source: Pedido_73580523.exe, bso0TjOMFiq0gqErD5/b95wlyN3pg0wI9HhYC.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'EshxqvQgy5', 'qAHxpRP1VS', 'mXKxSKksJf', 'MrhxXHuAQt', 'uxgxc4ka3x', 'p6hx2rYjMu', 'dU2xFA7Cfd', 'bMHxeEtmL3'
                Source: Pedido_73580523.exe, VHWJSn7IA2UoPAAISe/aNL8n8aSqN4K15x1JL.csHigh entropy of concatenated method names: '.ctor', 'yh0CIkSXto', 'AJxCTDdANe', 'qc8Cmb0xYQ', 'X3DClBADlW', 'rutCd3s73O', 'e0WCRbffml', 'j5Zrkw7QUcWaSA33HhC', 'nuGViT7iGlqsu4snG6Y', 'AZhXyG7o5P44f2QHEeh'
                Source: Pedido_73580523.exe, xSOS3t5IFyYYMiRg2f/E1BXjUq1EXP7kpVXGa.csHigh entropy of concatenated method names: 'NZemHNXHAj', 'HUbmfgeC7V', 'SP0m09M6oG', 'e79mGd91Hs', 'FApmXXOKC7', 'N0UmYXfeCq', 'xmLmrFJ834', 'xSXm8oOugB', 'YsamwuFL3C', 'e80m9nxNof'
                Source: Pedido_73580523.exe, wDooxRImPFlpULW3lDh/x6wypoIT0NyGHjUyoHf.csHigh entropy of concatenated method names: '.ctor', 'lekCacMHkr', 'ydjC7QDeJC', 'vSaCZgAX4N', 'XwnC1ZoEvW', 'SbgCUw9Aoc', 'w0MCLZCQy3', 'BeTCiLe7Ff', 'rgbChCknKY', 'WCICzKT1cm'
                Source: AsJOyfF.exe.0.dr, l3IX98V73sUCBF1DMc/gusKqNENHKelgRLO50.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'Nv2lUlWcJK', 'TAUuA6T5UP', 'QWGuQkf6CD', 'gWmugd7qSv', 'Es0utUWhtZ', 'bVlufrPVWL', 'ML3uhFIFgo', 'WD8uNUgw1p'
                Source: AsJOyfF.exe.0.dr, GbFWveBmWYUfQpE0t1/hiVkAR2J6uZHhOXYqv.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'oP3l40GEEn', 'EeMx3q0PqP', 'jLGxv98x6H', 'gbwxGHK5We', 'cGMxjNCQ9C', 'DR6xVXlwPG', 'V7yxkwJQGF', 'StsxAPY9Tx'
                Source: AsJOyfF.exe.0.dr, thKZU6uM8BnUXXSY2C/dLiD5cbbT9vCIHCY4a.csHigh entropy of concatenated method names: 'i0DTXd37Jr', 'hrPTYuVdQp', 'otBT85twNs', 'gPQTw8DNd4', 'gSLTk1e2K8', 'lsnTnE5AM7', 'pHjTJUyoHf', 'NiZTPuGyOE', 'wDoTsoxRPF', 'YNKTvCZgeL'
                Source: AsJOyfF.exe.0.dr, OQaLV83CLCcgFekSoO/FK1FvBMnLR2h3Ynjwt.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'EVaRyTGt7W', 'WqYl6JPuKm', 'KQdlreO1Hl', 'gWmugd7qSv', 'Es0utUWhtZ', 'bVlufrPVWL', 'ML3uhFIFgo', 'tVv999YmWM'
                Source: AsJOyfF.exe.0.dr, vbrstF6UNbiQbaC7Fk/oLpULScGds3ogJvbnx.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'iwyR4ysLB5', 'Q5dRFeBTWx', 'lIpRWWQbX1', 'eXMRxDB0aH', 'lDqRJEsWHg', 'gWmugd7qSv', 'Es0utUWhtZ', 'bVlufrPVWL'
                Source: AsJOyfF.exe.0.dr, bGjaFXK4AxoNuRDKdf/cCKFfNgbfW6LXdnuAW.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'BUUdZ4Pffv', 'Eqp9NV3PkW', 'JPi9z1a3jf', 'e8olLukTcP', 'r1FlKEHmgs', 'ggjl520xDU', 'N7UlwoAOcv', 'lLxlD3bJVS'
                Source: AsJOyfF.exe.0.dr, b2msoQPN7ewA6kYygC/KMbPfbnAvgFi7u0QLQ.csHigh entropy of concatenated method names: 'pmWIbYUfQp', 'M0tIu1CusK', 'fLOIq50H3I', 'q98I573sUC', 'OFfIpNbfW6', 'XXdItnuAWT', 'pjaIQFX4Ax', 'yNuIDRDKdf', 'k3oIOgJvbn', 'j9bI2rstFU'
                Source: AsJOyfF.exe.0.dr, RF8PXKLrFH3jwUt3cN/oBbAM0U5fbpRrmLh7v.csHigh entropy of concatenated method names: 'xrECuAC1eC', 'iXsCpulKC2', 'BAyCt5axUV', '.ctor', '.ctor', 'VKgCjqQ6a9', 't8lCqJQdPp', 'aPgC5rOI0h', 'EhqCy3sUiS', 'OFDo377AD3Z5Et4Pcb6'
                Source: AsJOyfF.exe.0.dr, uN58hUtKpKHESFnAWw/SOSVYwp5dV1e67DZTl.csHigh entropy of concatenated method names: 'L6jmNocZEF', 'ncvmOlGKs7', 'yHYmBETN97', 'siemE8ZuHC', 'GjFmgwB35f', 'RuTmKGcCBi', 'M95mcEHMTy', 'zZsm6Y3kRL', 'BdOm30u3KK', 'KuxmagolDg'
                Source: AsJOyfF.exe.0.dr, bso0TjOMFiq0gqErD5/b95wlyN3pg0wI9HhYC.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'EshxqvQgy5', 'qAHxpRP1VS', 'mXKxSKksJf', 'MrhxXHuAQt', 'uxgxc4ka3x', 'p6hx2rYjMu', 'dU2xFA7Cfd', 'bMHxeEtmL3'
                Source: AsJOyfF.exe.0.dr, xSOS3t5IFyYYMiRg2f/E1BXjUq1EXP7kpVXGa.csHigh entropy of concatenated method names: 'NZemHNXHAj', 'HUbmfgeC7V', 'SP0m09M6oG', 'e79mGd91Hs', 'FApmXXOKC7', 'N0UmYXfeCq', 'xmLmrFJ834', 'xSXm8oOugB', 'YsamwuFL3C', 'e80m9nxNof'
                Source: AsJOyfF.exe.0.dr, VHWJSn7IA2UoPAAISe/aNL8n8aSqN4K15x1JL.csHigh entropy of concatenated method names: '.ctor', 'yh0CIkSXto', 'AJxCTDdANe', 'qc8Cmb0xYQ', 'X3DClBADlW', 'rutCd3s73O', 'e0WCRbffml', 'j5Zrkw7QUcWaSA33HhC', 'nuGViT7iGlqsu4snG6Y', 'AZhXyG7o5P44f2QHEeh'
                Source: AsJOyfF.exe.0.dr, wDooxRImPFlpULW3lDh/x6wypoIT0NyGHjUyoHf.csHigh entropy of concatenated method names: '.ctor', 'lekCacMHkr', 'ydjC7QDeJC', 'vSaCZgAX4N', 'XwnC1ZoEvW', 'SbgCUw9Aoc', 'w0MCLZCQy3', 'BeTCiLe7Ff', 'rgbChCknKY', 'WCICzKT1cm'
                Source: 0.0.Pedido_73580523.exe.cb0000.0.unpack, l3IX98V73sUCBF1DMc/gusKqNENHKelgRLO50.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'Nv2lUlWcJK', 'TAUuA6T5UP', 'QWGuQkf6CD', 'gWmugd7qSv', 'Es0utUWhtZ', 'bVlufrPVWL', 'ML3uhFIFgo', 'WD8uNUgw1p'
                Source: 0.0.Pedido_73580523.exe.cb0000.0.unpack, GbFWveBmWYUfQpE0t1/hiVkAR2J6uZHhOXYqv.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'oP3l40GEEn', 'EeMx3q0PqP', 'jLGxv98x6H', 'gbwxGHK5We', 'cGMxjNCQ9C', 'DR6xVXlwPG', 'V7yxkwJQGF', 'StsxAPY9Tx'
                Source: 0.0.Pedido_73580523.exe.cb0000.0.unpack, OQaLV83CLCcgFekSoO/FK1FvBMnLR2h3Ynjwt.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'EVaRyTGt7W', 'WqYl6JPuKm', 'KQdlreO1Hl', 'gWmugd7qSv', 'Es0utUWhtZ', 'bVlufrPVWL', 'ML3uhFIFgo', 'tVv999YmWM'
                Source: 0.0.Pedido_73580523.exe.cb0000.0.unpack, thKZU6uM8BnUXXSY2C/dLiD5cbbT9vCIHCY4a.csHigh entropy of concatenated method names: 'i0DTXd37Jr', 'hrPTYuVdQp', 'otBT85twNs', 'gPQTw8DNd4', 'gSLTk1e2K8', 'lsnTnE5AM7', 'pHjTJUyoHf', 'NiZTPuGyOE', 'wDoTsoxRPF', 'YNKTvCZgeL'
                Source: 0.0.Pedido_73580523.exe.cb0000.0.unpack, vbrstF6UNbiQbaC7Fk/oLpULScGds3ogJvbnx.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'iwyR4ysLB5', 'Q5dRFeBTWx', 'lIpRWWQbX1', 'eXMRxDB0aH', 'lDqRJEsWHg', 'gWmugd7qSv', 'Es0utUWhtZ', 'bVlufrPVWL'
                Source: 0.0.Pedido_73580523.exe.cb0000.0.unpack, b2msoQPN7ewA6kYygC/KMbPfbnAvgFi7u0QLQ.csHigh entropy of concatenated method names: 'pmWIbYUfQp', 'M0tIu1CusK', 'fLOIq50H3I', 'q98I573sUC', 'OFfIpNbfW6', 'XXdItnuAWT', 'pjaIQFX4Ax', 'yNuIDRDKdf', 'k3oIOgJvbn', 'j9bI2rstFU'
                Source: 0.0.Pedido_73580523.exe.cb0000.0.unpack, bGjaFXK4AxoNuRDKdf/cCKFfNgbfW6LXdnuAW.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'BUUdZ4Pffv', 'Eqp9NV3PkW', 'JPi9z1a3jf', 'e8olLukTcP', 'r1FlKEHmgs', 'ggjl520xDU', 'N7UlwoAOcv', 'lLxlD3bJVS'
                Source: 0.0.Pedido_73580523.exe.cb0000.0.unpack, uN58hUtKpKHESFnAWw/SOSVYwp5dV1e67DZTl.csHigh entropy of concatenated method names: 'L6jmNocZEF', 'ncvmOlGKs7', 'yHYmBETN97', 'siemE8ZuHC', 'GjFmgwB35f', 'RuTmKGcCBi', 'M95mcEHMTy', 'zZsm6Y3kRL', 'BdOm30u3KK', 'KuxmagolDg'
                Source: 0.0.Pedido_73580523.exe.cb0000.0.unpack, bso0TjOMFiq0gqErD5/b95wlyN3pg0wI9HhYC.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'EshxqvQgy5', 'qAHxpRP1VS', 'mXKxSKksJf', 'MrhxXHuAQt', 'uxgxc4ka3x', 'p6hx2rYjMu', 'dU2xFA7Cfd', 'bMHxeEtmL3'
                Source: 0.0.Pedido_73580523.exe.cb0000.0.unpack, RF8PXKLrFH3jwUt3cN/oBbAM0U5fbpRrmLh7v.csHigh entropy of concatenated method names: 'xrECuAC1eC', 'iXsCpulKC2', 'BAyCt5axUV', '.ctor', '.ctor', 'VKgCjqQ6a9', 't8lCqJQdPp', 'aPgC5rOI0h', 'EhqCy3sUiS', 'OFDo377AD3Z5Et4Pcb6'
                Source: 0.0.Pedido_73580523.exe.cb0000.0.unpack, xSOS3t5IFyYYMiRg2f/E1BXjUq1EXP7kpVXGa.csHigh entropy of concatenated method names: 'NZemHNXHAj', 'HUbmfgeC7V', 'SP0m09M6oG', 'e79mGd91Hs', 'FApmXXOKC7', 'N0UmYXfeCq', 'xmLmrFJ834', 'xSXm8oOugB', 'YsamwuFL3C', 'e80m9nxNof'
                Source: 0.0.Pedido_73580523.exe.cb0000.0.unpack, VHWJSn7IA2UoPAAISe/aNL8n8aSqN4K15x1JL.csHigh entropy of concatenated method names: '.ctor', 'yh0CIkSXto', 'AJxCTDdANe', 'qc8Cmb0xYQ', 'X3DClBADlW', 'rutCd3s73O', 'e0WCRbffml', 'j5Zrkw7QUcWaSA33HhC', 'nuGViT7iGlqsu4snG6Y', 'AZhXyG7o5P44f2QHEeh'
                Source: 0.0.Pedido_73580523.exe.cb0000.0.unpack, wDooxRImPFlpULW3lDh/x6wypoIT0NyGHjUyoHf.csHigh entropy of concatenated method names: '.ctor', 'lekCacMHkr', 'ydjC7QDeJC', 'vSaCZgAX4N', 'XwnC1ZoEvW', 'SbgCUw9Aoc', 'w0MCLZCQy3', 'BeTCiLe7Ff', 'rgbChCknKY', 'WCICzKT1cm'
                Source: 10.2.Pedido_73580523.exe.7b0000.1.unpack, l3IX98V73sUCBF1DMc/gusKqNENHKelgRLO50.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'Nv2lUlWcJK', 'TAUuA6T5UP', 'QWGuQkf6CD', 'gWmugd7qSv', 'Es0utUWhtZ', 'bVlufrPVWL', 'ML3uhFIFgo', 'WD8uNUgw1p'
                Source: 10.2.Pedido_73580523.exe.7b0000.1.unpack, GbFWveBmWYUfQpE0t1/hiVkAR2J6uZHhOXYqv.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'oP3l40GEEn', 'EeMx3q0PqP', 'jLGxv98x6H', 'gbwxGHK5We', 'cGMxjNCQ9C', 'DR6xVXlwPG', 'V7yxkwJQGF', 'StsxAPY9Tx'
                Source: 10.2.Pedido_73580523.exe.7b0000.1.unpack, thKZU6uM8BnUXXSY2C/dLiD5cbbT9vCIHCY4a.csHigh entropy of concatenated method names: 'i0DTXd37Jr', 'hrPTYuVdQp', 'otBT85twNs', 'gPQTw8DNd4', 'gSLTk1e2K8', 'lsnTnE5AM7', 'pHjTJUyoHf', 'NiZTPuGyOE', 'wDoTsoxRPF', 'YNKTvCZgeL'
                Source: 10.2.Pedido_73580523.exe.7b0000.1.unpack, OQaLV83CLCcgFekSoO/FK1FvBMnLR2h3Ynjwt.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'EVaRyTGt7W', 'WqYl6JPuKm', 'KQdlreO1Hl', 'gWmugd7qSv', 'Es0utUWhtZ', 'bVlufrPVWL', 'ML3uhFIFgo', 'tVv999YmWM'
                Source: 10.2.Pedido_73580523.exe.7b0000.1.unpack, bGjaFXK4AxoNuRDKdf/cCKFfNgbfW6LXdnuAW.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'BUUdZ4Pffv', 'Eqp9NV3PkW', 'JPi9z1a3jf', 'e8olLukTcP', 'r1FlKEHmgs', 'ggjl520xDU', 'N7UlwoAOcv', 'lLxlD3bJVS'
                Source: 10.2.Pedido_73580523.exe.7b0000.1.unpack, vbrstF6UNbiQbaC7Fk/oLpULScGds3ogJvbnx.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'iwyR4ysLB5', 'Q5dRFeBTWx', 'lIpRWWQbX1', 'eXMRxDB0aH', 'lDqRJEsWHg', 'gWmugd7qSv', 'Es0utUWhtZ', 'bVlufrPVWL'
                Source: 10.2.Pedido_73580523.exe.7b0000.1.unpack, b2msoQPN7ewA6kYygC/KMbPfbnAvgFi7u0QLQ.csHigh entropy of concatenated method names: 'pmWIbYUfQp', 'M0tIu1CusK', 'fLOIq50H3I', 'q98I573sUC', 'OFfIpNbfW6', 'XXdItnuAWT', 'pjaIQFX4Ax', 'yNuIDRDKdf', 'k3oIOgJvbn', 'j9bI2rstFU'
                Source: 10.2.Pedido_73580523.exe.7b0000.1.unpack, bso0TjOMFiq0gqErD5/b95wlyN3pg0wI9HhYC.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'EshxqvQgy5', 'qAHxpRP1VS', 'mXKxSKksJf', 'MrhxXHuAQt', 'uxgxc4ka3x', 'p6hx2rYjMu', 'dU2xFA7Cfd', 'bMHxeEtmL3'
                Source: 10.2.Pedido_73580523.exe.7b0000.1.unpack, VHWJSn7IA2UoPAAISe/aNL8n8aSqN4K15x1JL.csHigh entropy of concatenated method names: '.ctor', 'yh0CIkSXto', 'AJxCTDdANe', 'qc8Cmb0xYQ', 'X3DClBADlW', 'rutCd3s73O', 'e0WCRbffml', 'j5Zrkw7QUcWaSA33HhC', 'nuGViT7iGlqsu4snG6Y', 'AZhXyG7o5P44f2QHEeh'
                Source: 10.2.Pedido_73580523.exe.7b0000.1.unpack, uN58hUtKpKHESFnAWw/SOSVYwp5dV1e67DZTl.csHigh entropy of concatenated method names: 'L6jmNocZEF', 'ncvmOlGKs7', 'yHYmBETN97', 'siemE8ZuHC', 'GjFmgwB35f', 'RuTmKGcCBi', 'M95mcEHMTy', 'zZsm6Y3kRL', 'BdOm30u3KK', 'KuxmagolDg'
                Source: 10.2.Pedido_73580523.exe.7b0000.1.unpack, RF8PXKLrFH3jwUt3cN/oBbAM0U5fbpRrmLh7v.csHigh entropy of concatenated method names: 'xrECuAC1eC', 'iXsCpulKC2', 'BAyCt5axUV', '.ctor', '.ctor', 'VKgCjqQ6a9', 't8lCqJQdPp', 'aPgC5rOI0h', 'EhqCy3sUiS', 'OFDo377AD3Z5Et4Pcb6'
                Source: 10.2.Pedido_73580523.exe.7b0000.1.unpack, xSOS3t5IFyYYMiRg2f/E1BXjUq1EXP7kpVXGa.csHigh entropy of concatenated method names: 'NZemHNXHAj', 'HUbmfgeC7V', 'SP0m09M6oG', 'e79mGd91Hs', 'FApmXXOKC7', 'N0UmYXfeCq', 'xmLmrFJ834', 'xSXm8oOugB', 'YsamwuFL3C', 'e80m9nxNof'
                Source: 10.2.Pedido_73580523.exe.7b0000.1.unpack, wDooxRImPFlpULW3lDh/x6wypoIT0NyGHjUyoHf.csHigh entropy of concatenated method names: '.ctor', 'lekCacMHkr', 'ydjC7QDeJC', 'vSaCZgAX4N', 'XwnC1ZoEvW', 'SbgCUw9Aoc', 'w0MCLZCQy3', 'BeTCiLe7Ff', 'rgbChCknKY', 'WCICzKT1cm'
                Source: 10.0.Pedido_73580523.exe.7b0000.0.unpack, l3IX98V73sUCBF1DMc/gusKqNENHKelgRLO50.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'Nv2lUlWcJK', 'TAUuA6T5UP', 'QWGuQkf6CD', 'gWmugd7qSv', 'Es0utUWhtZ', 'bVlufrPVWL', 'ML3uhFIFgo', 'WD8uNUgw1p'
                Source: 10.0.Pedido_73580523.exe.7b0000.0.unpack, GbFWveBmWYUfQpE0t1/hiVkAR2J6uZHhOXYqv.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'oP3l40GEEn', 'EeMx3q0PqP', 'jLGxv98x6H', 'gbwxGHK5We', 'cGMxjNCQ9C', 'DR6xVXlwPG', 'V7yxkwJQGF', 'StsxAPY9Tx'
                Source: 10.0.Pedido_73580523.exe.7b0000.0.unpack, wDooxRImPFlpULW3lDh/x6wypoIT0NyGHjUyoHf.csHigh entropy of concatenated method names: '.ctor', 'lekCacMHkr', 'ydjC7QDeJC', 'vSaCZgAX4N', 'XwnC1ZoEvW', 'SbgCUw9Aoc', 'w0MCLZCQy3', 'BeTCiLe7Ff', 'rgbChCknKY', 'WCICzKT1cm'
                Source: 10.0.Pedido_73580523.exe.7b0000.0.unpack, OQaLV83CLCcgFekSoO/FK1FvBMnLR2h3Ynjwt.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'EVaRyTGt7W', 'WqYl6JPuKm', 'KQdlreO1Hl', 'gWmugd7qSv', 'Es0utUWhtZ', 'bVlufrPVWL', 'ML3uhFIFgo', 'tVv999YmWM'
                Source: 10.0.Pedido_73580523.exe.7b0000.0.unpack, thKZU6uM8BnUXXSY2C/dLiD5cbbT9vCIHCY4a.csHigh entropy of concatenated method names: 'i0DTXd37Jr', 'hrPTYuVdQp', 'otBT85twNs', 'gPQTw8DNd4', 'gSLTk1e2K8', 'lsnTnE5AM7', 'pHjTJUyoHf', 'NiZTPuGyOE', 'wDoTsoxRPF', 'YNKTvCZgeL'
                Source: 10.0.Pedido_73580523.exe.7b0000.0.unpack, vbrstF6UNbiQbaC7Fk/oLpULScGds3ogJvbnx.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'iwyR4ysLB5', 'Q5dRFeBTWx', 'lIpRWWQbX1', 'eXMRxDB0aH', 'lDqRJEsWHg', 'gWmugd7qSv', 'Es0utUWhtZ', 'bVlufrPVWL'
                Source: 10.0.Pedido_73580523.exe.7b0000.0.unpack, b2msoQPN7ewA6kYygC/KMbPfbnAvgFi7u0QLQ.csHigh entropy of concatenated method names: 'pmWIbYUfQp', 'M0tIu1CusK', 'fLOIq50H3I', 'q98I573sUC', 'OFfIpNbfW6', 'XXdItnuAWT', 'pjaIQFX4Ax', 'yNuIDRDKdf', 'k3oIOgJvbn', 'j9bI2rstFU'
                Source: 10.0.Pedido_73580523.exe.7b0000.0.unpack, bGjaFXK4AxoNuRDKdf/cCKFfNgbfW6LXdnuAW.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'BUUdZ4Pffv', 'Eqp9NV3PkW', 'JPi9z1a3jf', 'e8olLukTcP', 'r1FlKEHmgs', 'ggjl520xDU', 'N7UlwoAOcv', 'lLxlD3bJVS'
                Source: 10.0.Pedido_73580523.exe.7b0000.0.unpack, uN58hUtKpKHESFnAWw/SOSVYwp5dV1e67DZTl.csHigh entropy of concatenated method names: 'L6jmNocZEF', 'ncvmOlGKs7', 'yHYmBETN97', 'siemE8ZuHC', 'GjFmgwB35f', 'RuTmKGcCBi', 'M95mcEHMTy', 'zZsm6Y3kRL', 'BdOm30u3KK', 'KuxmagolDg'
                Source: 10.0.Pedido_73580523.exe.7b0000.0.unpack, RF8PXKLrFH3jwUt3cN/oBbAM0U5fbpRrmLh7v.csHigh entropy of concatenated method names: 'xrECuAC1eC', 'iXsCpulKC2', 'BAyCt5axUV', '.ctor', '.ctor', 'VKgCjqQ6a9', 't8lCqJQdPp', 'aPgC5rOI0h', 'EhqCy3sUiS', 'OFDo377AD3Z5Et4Pcb6'
                Source: 10.0.Pedido_73580523.exe.7b0000.0.unpack, VHWJSn7IA2UoPAAISe/aNL8n8aSqN4K15x1JL.csHigh entropy of concatenated method names: '.ctor', 'yh0CIkSXto', 'AJxCTDdANe', 'qc8Cmb0xYQ', 'X3DClBADlW', 'rutCd3s73O', 'e0WCRbffml', 'j5Zrkw7QUcWaSA33HhC', 'nuGViT7iGlqsu4snG6Y', 'AZhXyG7o5P44f2QHEeh'
                Source: 10.0.Pedido_73580523.exe.7b0000.0.unpack, bso0TjOMFiq0gqErD5/b95wlyN3pg0wI9HhYC.csHigh entropy of concatenated method names: '.ctor', 'Dispose', 'EshxqvQgy5', 'qAHxpRP1VS', 'mXKxSKksJf', 'MrhxXHuAQt', 'uxgxc4ka3x', 'p6hx2rYjMu', 'dU2xFA7Cfd', 'bMHxeEtmL3'
                Source: 10.0.Pedido_73580523.exe.7b0000.0.unpack, xSOS3t5IFyYYMiRg2f/E1BXjUq1EXP7kpVXGa.csHigh entropy of concatenated method names: 'NZemHNXHAj', 'HUbmfgeC7V', 'SP0m09M6oG', 'e79mGd91Hs', 'FApmXXOKC7', 'N0UmYXfeCq', 'xmLmrFJ834', 'xSXm8oOugB', 'YsamwuFL3C', 'e80m9nxNof'
                Source: C:\Users\user\Desktop\Pedido_73580523.exeFile created: C:\Users\user\AppData\Roaming\AsJOyfF.exeJump to dropped file

                Boot Survival:

                barindex
                Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\AsJOyfF' /XML 'C:\Users\user\AppData\Local\Temp\tmpE123.tmp'
                Source: C:\Users\user\Desktop\Pedido_73580523.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion:

                barindex
                Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                Source: C:\Users\user\Desktop\Pedido_73580523.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                Source: C:\Users\user\Desktop\Pedido_73580523.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                Source: C:\Users\user\Desktop\Pedido_73580523.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeWindow / User API: threadDelayed 1302Jump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeWindow / User API: threadDelayed 8530Jump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exe TID: 1380Thread sleep time: -44059s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exe TID: 5900Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exe TID: 5576Thread sleep time: -24903104499507879s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exe TID: 6032Thread sleep count: 1302 > 30Jump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exe TID: 6032Thread sleep count: 8530 > 30Jump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\Pedido_73580523.exeThread delayed: delay time: 44059Jump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: Pedido_73580523.exe, 0000000A.00000002.485962524.0000000005D60000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
                Source: Pedido_73580523.exeBinary or memory string: DdUXhZQ[fUE6Ws]YTSk6WLInYD73f[o5QsEYYq{nV]8XY[8XVpEzfoQZd5M[]WMZ][<IgogJD}4pfy]3[3Y5]DL[]}Y4[3Y5]D75esU[\moJezE[TiU[]qET]m8Z\3QqeMU[]K<IgogJD|YJg4E[eyQ3[3Y5]DL6e3Q5\xDjfoUZd5<pfTU6\osp\SQ[]mopg|Y5XlY5Y843[wEjfoUZd5<pfTU6\osp\SQ[e|<pU843[wEjfoQ[YDL[]nopgyMKX3QZ
                Source: Pedido_73580523.exe, 0000000A.00000002.485962524.0000000005D60000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
                Source: Pedido_73580523.exe, 0000000A.00000002.485962524.0000000005D60000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
                Source: Pedido_73580523.exe, 0000000A.00000002.485962524.0000000005D60000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeMemory allocated: page read and write | page guardJump to behavior

                HIPS / PFW / Operating System Protection Evasion:

                barindex
                Injects a PE file into a foreign processesShow sources
                Source: C:\Users\user\Desktop\Pedido_73580523.exeMemory written: C:\Users\user\Desktop\Pedido_73580523.exe base: 400000 value starts with: 4D5AJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\AsJOyfF' /XML 'C:\Users\user\AppData\Local\Temp\tmpE123.tmp'Jump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeProcess created: C:\Users\user\Desktop\Pedido_73580523.exe C:\Users\user\Desktop\Pedido_73580523.exeJump to behavior
                Source: Pedido_73580523.exe, 0000000A.00000002.480804673.0000000001650000.00000002.00000001.sdmpBinary or memory string: Program Manager
                Source: Pedido_73580523.exe, 0000000A.00000002.480804673.0000000001650000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                Source: Pedido_73580523.exe, 0000000A.00000002.480804673.0000000001650000.00000002.00000001.sdmpBinary or memory string: Progman
                Source: Pedido_73580523.exe, 0000000A.00000002.480804673.0000000001650000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Users\user\Desktop\Pedido_73580523.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Pedido_73580523.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Deskto