Malware Analysis Report

2024-10-19 07:03

Sample ID 240507-s8395ade6y
Target cfe49535d5614bead6b98f51a064bb90_NEAS
SHA256 d1d7b0e5a318fa830b20ba086db896bdd95b390329ab1781b8663c499b397e9e
Tags
upx modiloader persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d1d7b0e5a318fa830b20ba086db896bdd95b390329ab1781b8663c499b397e9e

Threat Level: Known bad

The file cfe49535d5614bead6b98f51a064bb90_NEAS was found to be: Known bad.

Malicious Activity Summary

upx modiloader persistence trojan

ModiLoader, DBatLoader

ModiLoader Second Stage

UPX packed file

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-07 15:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-07 15:48

Reported

2024-05-07 15:51

Platform

win7-20240221-en

Max time kernel

2s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2188 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 2188 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 2188 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 2188 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 2188 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 2188 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 2188 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 2188 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 2188 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 2188 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 2188 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe
PID 2188 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe
PID 2188 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe
PID 2188 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe
PID 2188 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe
PID 2188 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe
PID 2188 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe
PID 2188 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe

"C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe

"C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\XBYMY.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f

C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 billabong4102.no-ip.biz udp

Files

memory/2188-4-0x0000000000230000-0x0000000000231000-memory.dmp

memory/2188-8-0x00000000002F0000-0x00000000002F1000-memory.dmp

memory/2188-2-0x0000000000230000-0x0000000000231000-memory.dmp

memory/2188-14-0x0000000000310000-0x0000000000311000-memory.dmp

memory/2188-20-0x0000000000370000-0x0000000000371000-memory.dmp

memory/2188-38-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/2188-32-0x00000000003D0000-0x00000000003D1000-memory.dmp

memory/2188-28-0x00000000003B0000-0x00000000003B1000-memory.dmp

memory/2188-61-0x0000000000430000-0x0000000000432000-memory.dmp

memory/2188-63-0x0000000000440000-0x0000000000442000-memory.dmp

memory/2188-80-0x0000000000480000-0x0000000000481000-memory.dmp

memory/2188-88-0x00000000004A0000-0x00000000004A2000-memory.dmp

memory/1904-89-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2360-124-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1904-119-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2360-118-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1904-116-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2360-115-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2360-113-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2360-111-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2360-109-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2360-107-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1904-106-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XBYMY.bat

MD5 3a4614705555abb049c3298e61170b7f
SHA1 c8686410756f346d9551256a5b878b04770950ba
SHA256 cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA512 65ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007

\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

MD5 cae42607cee55c34b27b8069520ef9e5
SHA1 ea0f869ba8490d836d0756f6355253e15923d18a
SHA256 17ec7c908f50fb3f567572cdce27fce7ef12a893b3284d8e46cdf42ce5ed3d92
SHA512 5da6f58a9d81c693636134029cba977c468a96db19a92278852e69651a78154c3163ee049104ce5c4204c4819e47e0d104deffdb388f936b86ae2d07a41b0f77

memory/1984-277-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2360-281-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-07 15:48

Reported

2024-05-07 15:51

Platform

win10v2004-20240419-en

Max time kernel

114s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\svchost.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 224 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 224 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 224 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 224 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 224 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 224 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 224 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 224 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 224 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\svchost.exe
PID 224 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe
PID 224 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe
PID 224 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe
PID 224 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe
PID 224 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe
PID 224 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe
PID 224 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe
PID 224 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe
PID 1788 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\cmd.exe
PID 1788 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\cmd.exe
PID 1788 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Windows\SysWOW64\cmd.exe
PID 2636 wrote to memory of 4924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2636 wrote to memory of 4924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2636 wrote to memory of 4924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1788 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1788 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1788 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1384 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Windows\SysWOW64\svchost.exe
PID 1384 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Windows\SysWOW64\svchost.exe
PID 1384 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Windows\SysWOW64\svchost.exe
PID 1384 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Windows\SysWOW64\svchost.exe
PID 1384 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1384 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1384 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1384 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1384 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1384 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1384 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1384 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1384 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1384 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1384 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1384 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1384 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1384 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1384 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
PID 1384 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe

"C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe

"C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BDXTO.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f

C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1020 -ip 1020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 84

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
NL 23.62.61.160:443 www.bing.com tcp
US 8.8.8.8:53 160.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp
US 8.8.8.8:53 billabong4102.no-ip.biz udp

Files

memory/224-3-0x00000000029E0000-0x00000000029E2000-memory.dmp

memory/224-2-0x0000000002180000-0x0000000002182000-memory.dmp

memory/224-4-0x0000000002A00000-0x0000000002A02000-memory.dmp

memory/224-5-0x0000000002B30000-0x0000000002B32000-memory.dmp

memory/5092-6-0x0000000000400000-0x000000000040C000-memory.dmp

memory/5092-8-0x0000000000400000-0x000000000040C000-memory.dmp

memory/5092-14-0x0000000000400000-0x000000000040C000-memory.dmp

memory/1788-20-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1788-18-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1788-13-0x0000000000400000-0x000000000040B000-memory.dmp

memory/5092-12-0x0000000000400000-0x000000000040C000-memory.dmp

memory/224-11-0x0000000002BE0000-0x0000000002BE2000-memory.dmp

memory/224-10-0x0000000002B70000-0x0000000002B72000-memory.dmp

memory/224-9-0x0000000002B40000-0x0000000002B42000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BDXTO.txt

MD5 3a4614705555abb049c3298e61170b7f
SHA1 c8686410756f346d9551256a5b878b04770950ba
SHA256 cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA512 65ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007

C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

MD5 cae42607cee55c34b27b8069520ef9e5
SHA1 ea0f869ba8490d836d0756f6355253e15923d18a
SHA256 17ec7c908f50fb3f567572cdce27fce7ef12a893b3284d8e46cdf42ce5ed3d92
SHA512 5da6f58a9d81c693636134029cba977c468a96db19a92278852e69651a78154c3163ee049104ce5c4204c4819e47e0d104deffdb388f936b86ae2d07a41b0f77

memory/1384-46-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1384-47-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1384-48-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1384-49-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2976-56-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1384-57-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2976-64-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2976-63-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2976-61-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2976-62-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1788-65-0x0000000000400000-0x000000000040B000-memory.dmp

memory/5092-69-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2976-68-0x0000000000400000-0x0000000000414000-memory.dmp

memory/3348-67-0x0000000000400000-0x000000000040B000-memory.dmp