Added tests to check three gandcrab behaviour:

executed as administrator
executed as user
executed as administrator with a russian keyboard.
The three execution MUST be different

tests/profiles/windows_gandcrab_russian_keyboard.ql

@@ -0,0 +1,2 @@
+[REGISTRY]
+HKEY_CURRENT_USER\Keyboard Layout\Preload\1 = 00000419

tests/profiles/windows_gandcrab_user.ql

@@ -0,0 +1,2 @@
+[SYSTEM]
+permission = user

tests/test_pe.py

@@ -82,7 +82,7 @@ class PETest(unittest.TestCase):
                 raise QlErrorNotImplemented("[!] API not implemented")
 
         ql = Qiling(["../examples/rootfs/x86_windows/bin/GandCrab502.bin"], "../examples/rootfs/x86_windows",
-                    output="debug", profile="profiles/windows_gandcrab.ql")
+                    output="debug", profile="profiles/windows_gandcrab_admin.ql")
         default_user = ql.os.profile["USER"]["username"]
         default_computer = ql.os.profile["SYSTEM"]["computername"]
 
@@ -90,9 +90,27 @@ class PETest(unittest.TestCase):
         randomize_config_value(ql, "USER", "username")
         randomize_config_value(ql, "SYSTEM", "computername")
         randomize_config_value(ql, "VOLUME", "serial_number")
+        num_syscalls_admin = ql.os.syscalls_counter
         ql.run()
         del ql
 
+        # RUN AS USER
+        ql = Qiling(["../examples/rootfs/x86_windows/bin/GandCrab502.bin"], "../examples/rootfs/x86_windows",
+                    output="debug", profile="profiles/windows_gandcrab_user.ql")
+
+        ql.run()
+        num_syscalls_user = ql.os.syscalls_counter
+
+        del ql
+
+        ql = Qiling(["../examples/rootfs/x86_windows/bin/GandCrab502.bin"], "../examples/rootfs/x86_windows",
+                    output="debug", profile="profiles/windows_gandcrab_russian_keyboard.ql")
+        num_syscalls_russ = ql.os.syscalls_counter
+
+        ql.run()
+        del ql
+        # let's check that gandcrab behave takes a different path if a different environment is found
+        assert num_syscalls_admin != num_syscalls_user != num_syscalls_russ
 
     def test_pe_win_x86_multithread(self):
         def ThreadId_onEnter(ql, address, params):