Malware Analysis Report

2025-03-15 06:21

Sample ID 240930-qmzzga1gmf
Target 4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N
SHA256 4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2
Tags
njrat hacked discovery evasion persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2

Threat Level: Known bad

The file 4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N was found to be: Known bad.

Malicious Activity Summary

njrat hacked discovery evasion persistence privilege_escalation trojan

njRAT/Bladabindi

Disables Task Manager via registry modification

Drops file in Drivers directory

Modifies Windows Firewall

Drops startup file

Loads dropped DLL

Checks computer location settings

Uses the VBS compiler for execution

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Modifies registry key

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-30 13:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-30 13:23

Reported

2024-09-30 13:25

Platform

win7-20240903-en

Max time kernel

116s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Disables Task Manager via registry modification

evasion

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32ce84f74d25f1e71aac67667a2c8d24.exe C:\ProgramData\Dllhost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32ce84f74d25f1e71aac67667a2c8d24.exe C:\ProgramData\Dllhost.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Users\\Admin\\AppData\\Roaming\\rundll32 .exe" C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\%tmp%.exe = "C:\\Program Files (x86)\\%tmp%.exe" C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\32ce84f74d25f1e71aac67667a2c8d24 = "\"C:\\ProgramData\\Dllhost.exe\" .." C:\ProgramData\Dllhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\32ce84f74d25f1e71aac67667a2c8d24 = "\"C:\\ProgramData\\Dllhost.exe\" .." C:\ProgramData\Dllhost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2528 set thread context of 2872 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\%tmp%.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
File opened for modification C:\Program Files (x86)\%tmp%.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rEG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\18259.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Dllhost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rEG.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2992 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\cmd.exe
PID 2992 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\cmd.exe
PID 2992 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\cmd.exe
PID 2992 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\cmd.exe
PID 2144 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2144 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2144 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2144 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2992 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2992 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2992 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2992 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2992 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2992 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2992 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2992 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2992 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2992 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2992 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2992 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2992 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2992 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2992 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2992 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2992 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2992 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2992 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2992 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2992 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
PID 2992 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
PID 2992 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
PID 2992 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
PID 2992 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\REG.exe
PID 2992 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\REG.exe
PID 2992 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\REG.exe
PID 2992 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\REG.exe
PID 2992 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\rEG.exe
PID 2992 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\rEG.exe
PID 2992 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\rEG.exe
PID 2992 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\rEG.exe
PID 2764 wrote to memory of 1700 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2764 wrote to memory of 1700 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2764 wrote to memory of 1700 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2764 wrote to memory of 1700 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2528 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2528 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2528 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2528 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2512 wrote to memory of 576 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2512 wrote to memory of 576 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2512 wrote to memory of 576 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2512 wrote to memory of 576 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2528 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2528 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2528 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2528 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2528 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2528 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2528 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2528 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2528 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2872 wrote to memory of 704 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2872 wrote to memory of 704 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2872 wrote to memory of 704 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe

"C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\java.bat" "

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Roaming\invs.vbs" "C:\Users\Admin\AppData\Roaming\java2.bat

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Default.mp3"

C:\Users\Admin\AppData\Local\Temp\%tmp%.exe

"C:\Users\Admin\AppData\Local\Temp\%tmp%.exe"

C:\Windows\SysWOW64\REG.exe

REG add HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\rEG.exe

rEG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\java2.bat" "

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nov07iaa.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8CE5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8CE4.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 412

C:\Users\Admin\AppData\Roaming\18259.exe

"C:\Users\Admin\AppData\Roaming\18259.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 1124

C:\ProgramData\Dllhost.exe

"C:\ProgramData\Dllhost.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\ProgramData\Dllhost.exe" "Dllhost.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 22.ip.gl.ply.gg udp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp

Files

memory/2992-0-0x0000000074AF1000-0x0000000074AF2000-memory.dmp

memory/2992-1-0x0000000074AF0000-0x000000007509B000-memory.dmp

memory/2992-2-0x0000000074AF0000-0x000000007509B000-memory.dmp

memory/2992-4-0x0000000074AF0000-0x000000007509B000-memory.dmp

C:\Users\Admin\AppData\Roaming\java.bat

MD5 1896de26a454df8628034ca3e0649905
SHA1 76b98d95a85d043539706b89194c46cf14464abe
SHA256 d85e713743c7e622166fb0f79478de5eabd53d3fe92bd2011ab441bc85ef2208
SHA512 ef69dacd7e717dff05f8a70c5b9a94011f2df3201cc41d5f8cc030f350b069dc090c5b0d3d0bd19098a187977a82d570e1ee153849f609a65889ba789da953d2

\Windows\Temp\System.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

C:\Users\Admin\AppData\Roaming\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

\Users\Admin\AppData\Local\Temp\%tmp%.exe

MD5 6b97067ea717e5c72685a38a15109ecc
SHA1 0ec286ff24307650bcd1881106980d420c646610
SHA256 b62c4ffb4b0622b0dc2fcf684b86863a54636c3af773e71a036c3064075eaf17
SHA512 80613f0da03c01d5d35dedb4617e811a7b2e72032eeedc5ccdb2b8f6c6408ec9f66ad3f9a10f6e357e4ec85c9bb8374c3d64874a5d9699e6def23cdc9748fb7d

C:\Users\Admin\AppData\Roaming\java2.bat

MD5 e8170b6565dfb34d114cfa398ba77296
SHA1 9079335b0ec9a509b7344cb98713fc0b52afa36e
SHA256 76ff7c88cc815c8acd61f835033baf5b92eee085e7316c7230f7c363d1e1974b
SHA512 1b473fe0a68642ff1741f4619f819b040f8d54696d40e74dd9ad692b56729e455bbe54cb76b382bb1fce5e1eae97dd8c99aeb762915f7147bba59d0ba60d004d

\??\c:\Users\Admin\AppData\Local\Temp\nov07iaa.cmdline

MD5 0113999fad1392936cd6e9745327d504
SHA1 3cff201046d1e28846cd38d2641e7f4526a8622e
SHA256 75adbf0e20d352b643afe7ad32150646d92e8c00d73a660e99b9df18e31eed42
SHA512 b647e40f236f3d9dff50a58b4837fdfe93ce39c7695deb9812f6013495632716f1703264fcafd9a5b05624c512b56f1cedf70b8d16323418241cf3b48be45926

C:\Users\Admin\AppData\Local\Temp\Default.mp3

MD5 071720d5f39c31b27711d70b09ef9b3b
SHA1 1fe68bf69c8418454a0d91ad321b99fe9065a1db
SHA256 f8bc97b18db5452e5be748390037c16e606aaf0f61f0896531528d0d5fd08cc7
SHA512 7db5e2039e075916874b071f30aef7c29133182b9bdbc2e3cb9c2296db8a67f2cfd4e49701d85126b6b58d59bd6198f2ce6c5f4eec382209a6576c628d354014

\??\c:\Users\Admin\AppData\Local\Temp\nov07iaa.0.cs

MD5 b63430207638c1a36b9b27002e0da3da
SHA1 54356082f32c71498c4ac5f85f4588e0d1c57ad0
SHA256 fa125ed8e48d596788a8ad5589bc996b918de3fc27008bea888b9e1b5efa2193
SHA512 29ea956fb37628dac43693d5f234698510923d562ab22e53131b1919f788ed5fd3116ed501be79554e47113d795b06f5ad255c7dfee2bb9e021eb0ab14e9b737

C:\Users\Admin\AppData\Local\Temp\RES8CE5.tmp

MD5 f6aeb99ee943df49eb660db60fa753c3
SHA1 6bb279686e8abaf3b1229c96b43cb68637406dcd
SHA256 d21cd1023e6bb258a50547833f52edc071a728fb43852e47e7525097765f9e00
SHA512 73e344d73ddf85403a5f25b6c1d2fc973c0a1b972d4e94c9586f598b70ed040644f4eb76ed0e9ccee21cca1b5bf325f04f68395b11b4b5ceb5cf1c5d37a02f92

C:\Users\Admin\AppData\Local\Temp\nov07iaa.dll

MD5 47f44841fb376451e3977903be462907
SHA1 6829b01e6f5bae5a278738850108d7eca15c835f
SHA256 6e7466286541a41442b6cb1bf28e3749c770f8689a9d8570995b0b15055294b4
SHA512 c4602aa6af0936ebc997e1e7d62056f7d48f138255b0fe53bae76cfb1922d50471e014a43a78801e13523416291ab6ec6e67229daa44b79e225267d024a72728

memory/2872-72-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2872-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2872-74-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2872-69-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2872-68-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2872-65-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2872-63-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2872-73-0x0000000000400000-0x000000000040C000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC8CE4.tmp

MD5 10d8181be80ce82dd3205b1a0c57cc1c
SHA1 f6af10f213f69cf184345a6caa703f0cbe01b815
SHA256 7736c8471b9c60b476cbac76f5752e50663cc57c7dc37669144ab5f20274c9ed
SHA512 13c31fd0af3360aecd3565abf6accd9ace435ef05ad5cf0f6ce79087dcc7cb7fcb50da853aab6270ccf27c2240d568586fb17578a2563cd60cb8abf1c3418768

memory/2992-88-0x0000000074AF0000-0x000000007509B000-memory.dmp

memory/2588-96-0x000000013FE00000-0x000000013FEF8000-memory.dmp

memory/2588-97-0x000007FEFB540000-0x000007FEFB574000-memory.dmp

memory/2588-98-0x000007FEF7F60000-0x000007FEF8216000-memory.dmp

memory/2588-99-0x000007FEFB520000-0x000007FEFB538000-memory.dmp

memory/2588-100-0x000007FEFB500000-0x000007FEFB517000-memory.dmp

memory/2588-101-0x000007FEFB4E0000-0x000007FEFB4F1000-memory.dmp

memory/2588-102-0x000007FEFB4C0000-0x000007FEFB4D7000-memory.dmp

memory/2588-103-0x000007FEFB4A0000-0x000007FEFB4B1000-memory.dmp

memory/2588-104-0x000007FEFB480000-0x000007FEFB49D000-memory.dmp

memory/2588-105-0x000007FEFB460000-0x000007FEFB471000-memory.dmp

memory/2588-106-0x000007FEF5910000-0x000007FEF69C0000-memory.dmp

memory/2588-107-0x000007FEF5700000-0x000007FEF590B000-memory.dmp

memory/2588-108-0x000007FEF6F40000-0x000007FEF6F81000-memory.dmp

memory/2588-109-0x000007FEFB430000-0x000007FEFB451000-memory.dmp

memory/2588-110-0x000007FEF7F40000-0x000007FEF7F58000-memory.dmp

memory/2588-111-0x000007FEF6F20000-0x000007FEF6F31000-memory.dmp

memory/2588-112-0x000007FEF6E00000-0x000007FEF6E11000-memory.dmp

memory/2588-113-0x000007FEF56E0000-0x000007FEF56F1000-memory.dmp

memory/2588-114-0x000007FEF56C0000-0x000007FEF56DB000-memory.dmp

memory/2588-115-0x000007FEF56A0000-0x000007FEF56B1000-memory.dmp

memory/2588-116-0x000007FEF5680000-0x000007FEF5698000-memory.dmp

memory/2588-117-0x000007FEF5650000-0x000007FEF5680000-memory.dmp

memory/2588-118-0x000007FEF55E0000-0x000007FEF5647000-memory.dmp

memory/2588-119-0x000007FEF5560000-0x000007FEF55DC000-memory.dmp

memory/2588-120-0x000007FEF5540000-0x000007FEF5551000-memory.dmp

memory/2588-121-0x000007FEF5520000-0x000007FEF5538000-memory.dmp

memory/2588-122-0x000007FEF5500000-0x000007FEF5511000-memory.dmp

memory/2588-123-0x000007FEF54A0000-0x000007FEF54F7000-memory.dmp

memory/2588-124-0x000007FEF5470000-0x000007FEF549F000-memory.dmp

memory/2588-125-0x000007FEF5450000-0x000007FEF5463000-memory.dmp

memory/2588-126-0x000007FEF5430000-0x000007FEF5441000-memory.dmp

memory/2588-127-0x000007FEF5360000-0x000007FEF5425000-memory.dmp

memory/2588-128-0x000007FEF5340000-0x000007FEF5353000-memory.dmp

memory/2588-129-0x000007FEF5320000-0x000007FEF5331000-memory.dmp

memory/2588-130-0x000007FEF36E0000-0x000007FEF3737000-memory.dmp

memory/2588-131-0x000007FEF36B0000-0x000007FEF36D8000-memory.dmp

memory/2588-132-0x000007FEF3680000-0x000007FEF36A4000-memory.dmp

memory/2588-133-0x000007FEFB720000-0x000007FEFB730000-memory.dmp

memory/2588-134-0x000007FEF3660000-0x000007FEF3676000-memory.dmp

memory/2588-135-0x000007FEF3610000-0x000007FEF3652000-memory.dmp

memory/2588-136-0x000007FEF35A0000-0x000007FEF3602000-memory.dmp

memory/2588-137-0x000007FEF3530000-0x000007FEF359D000-memory.dmp

memory/2992-139-0x0000000074AF0000-0x000000007509B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-30 13:23

Reported

2024-09-30 13:25

Platform

win10v2004-20240910-en

Max time kernel

119s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Disables Task Manager via registry modification

evasion

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\77817.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32ce84f74d25f1e71aac67667a2c8d24.exe C:\ProgramData\Dllhost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32ce84f74d25f1e71aac67667a2c8d24.exe C:\ProgramData\Dllhost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\77817.exe N/A
N/A N/A C:\ProgramData\Dllhost.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Users\\Admin\\AppData\\Roaming\\rundll32 .exe" C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\%tmp%.exe = "C:\\Program Files (x86)\\%tmp%.exe" C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\32ce84f74d25f1e71aac67667a2c8d24 = "\"C:\\ProgramData\\Dllhost.exe\" .." C:\ProgramData\Dllhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\32ce84f74d25f1e71aac67667a2c8d24 = "\"C:\\ProgramData\\Dllhost.exe\" .." C:\ProgramData\Dllhost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2496 set thread context of 4612 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\%tmp%.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
File created C:\Program Files (x86)\%tmp%.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\77817.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Dllhost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rEG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rEG.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2296 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\cmd.exe
PID 2296 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\cmd.exe
PID 2296 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\cmd.exe
PID 2296 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2296 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2296 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2296 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2296 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2296 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2296 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2296 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2296 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2296 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2296 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 2296 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\Temp\System.exe
PID 5004 wrote to memory of 3660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 5004 wrote to memory of 3660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 5004 wrote to memory of 3660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2296 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2296 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2296 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
PID 2296 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
PID 2296 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
PID 2296 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\REG.exe
PID 2296 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\REG.exe
PID 2296 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\REG.exe
PID 2296 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\rEG.exe
PID 2296 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\rEG.exe
PID 2296 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe C:\Windows\SysWOW64\rEG.exe
PID 3660 wrote to memory of 852 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 3660 wrote to memory of 852 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 3660 wrote to memory of 852 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2496 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2496 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2496 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2240 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2240 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2240 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2496 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2496 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2496 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2496 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2496 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2496 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2496 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2496 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4612 wrote to memory of 3860 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 4612 wrote to memory of 3860 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 4612 wrote to memory of 3860 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2496 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Users\Admin\AppData\Roaming\77817.exe
PID 2496 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Users\Admin\AppData\Roaming\77817.exe
PID 2496 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Users\Admin\AppData\Roaming\77817.exe
PID 2496 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2496 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2496 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2904 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Roaming\77817.exe C:\ProgramData\Dllhost.exe
PID 2904 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Roaming\77817.exe C:\ProgramData\Dllhost.exe
PID 2904 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Roaming\77817.exe C:\ProgramData\Dllhost.exe
PID 4340 wrote to memory of 2336 N/A C:\ProgramData\Dllhost.exe C:\Windows\SysWOW64\netsh.exe
PID 4340 wrote to memory of 2336 N/A C:\ProgramData\Dllhost.exe C:\Windows\SysWOW64\netsh.exe
PID 4340 wrote to memory of 2336 N/A C:\ProgramData\Dllhost.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe

"C:\Users\Admin\AppData\Local\Temp\4b648c2427723431eab856e3d42467c714e27cf2affaa99dd932c428094a28d2N.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\java.bat" "

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Roaming\invs.vbs" "C:\Users\Admin\AppData\Roaming\java2.bat

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Default.mp3"

C:\Users\Admin\AppData\Local\Temp\%tmp%.exe

"C:\Users\Admin\AppData\Local\Temp\%tmp%.exe"

C:\Windows\SysWOW64\REG.exe

REG add HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\rEG.exe

rEG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\java2.bat" "

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qxijfxps.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE9B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCE9A.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 788

C:\Users\Admin\AppData\Roaming\77817.exe

"C:\Users\Admin\AppData\Roaming\77817.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 1856

C:\ProgramData\Dllhost.exe

"C:\ProgramData\Dllhost.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\ProgramData\Dllhost.exe" "Dllhost.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 22.ip.gl.ply.gg udp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 8.8.8.8:53 22.221.185.147.in-addr.arpa udp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp

Files

memory/2296-0-0x0000000075072000-0x0000000075073000-memory.dmp

memory/2296-1-0x0000000075070000-0x0000000075621000-memory.dmp

memory/2296-2-0x0000000075070000-0x0000000075621000-memory.dmp

memory/2296-3-0x0000000075070000-0x0000000075621000-memory.dmp

C:\Windows\Temp\System.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

C:\Users\Admin\AppData\Roaming\java.bat

MD5 1896de26a454df8628034ca3e0649905
SHA1 76b98d95a85d043539706b89194c46cf14464abe
SHA256 d85e713743c7e622166fb0f79478de5eabd53d3fe92bd2011ab441bc85ef2208
SHA512 ef69dacd7e717dff05f8a70c5b9a94011f2df3201cc41d5f8cc030f350b069dc090c5b0d3d0bd19098a187977a82d570e1ee153849f609a65889ba789da953d2

C:\Users\Admin\AppData\Roaming\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

C:\Users\Admin\AppData\Local\Temp\Default.mp3

MD5 071720d5f39c31b27711d70b09ef9b3b
SHA1 1fe68bf69c8418454a0d91ad321b99fe9065a1db
SHA256 f8bc97b18db5452e5be748390037c16e606aaf0f61f0896531528d0d5fd08cc7
SHA512 7db5e2039e075916874b071f30aef7c29133182b9bdbc2e3cb9c2296db8a67f2cfd4e49701d85126b6b58d59bd6198f2ce6c5f4eec382209a6576c628d354014

C:\Users\Admin\AppData\Local\Temp\%tmp%.exe

MD5 6b97067ea717e5c72685a38a15109ecc
SHA1 0ec286ff24307650bcd1881106980d420c646610
SHA256 b62c4ffb4b0622b0dc2fcf684b86863a54636c3af773e71a036c3064075eaf17
SHA512 80613f0da03c01d5d35dedb4617e811a7b2e72032eeedc5ccdb2b8f6c6408ec9f66ad3f9a10f6e357e4ec85c9bb8374c3d64874a5d9699e6def23cdc9748fb7d

C:\Users\Admin\AppData\Roaming\java2.bat

MD5 e8170b6565dfb34d114cfa398ba77296
SHA1 9079335b0ec9a509b7344cb98713fc0b52afa36e
SHA256 76ff7c88cc815c8acd61f835033baf5b92eee085e7316c7230f7c363d1e1974b
SHA512 1b473fe0a68642ff1741f4619f819b040f8d54696d40e74dd9ad692b56729e455bbe54cb76b382bb1fce5e1eae97dd8c99aeb762915f7147bba59d0ba60d004d

\??\c:\Users\Admin\AppData\Local\Temp\qxijfxps.cmdline

MD5 7289a4f1542bb638af6d944d9043a140
SHA1 5282d95a51c8b0799373ad2dd1e995ea2f7d0fd9
SHA256 7c39adfaa1928144c27084af87044dd9be861f342f4c191f7be192386a743a56
SHA512 363ed543347743ee7526abc1fecea775bb561a81809ba6c9aa91c2bca7da8d14ecb4a5d712c50f1dfec20aa7f80f06bc3f52c68def841cfef451a83aef663647

\??\c:\Users\Admin\AppData\Local\Temp\qxijfxps.0.cs

MD5 b63430207638c1a36b9b27002e0da3da
SHA1 54356082f32c71498c4ac5f85f4588e0d1c57ad0
SHA256 fa125ed8e48d596788a8ad5589bc996b918de3fc27008bea888b9e1b5efa2193
SHA512 29ea956fb37628dac43693d5f234698510923d562ab22e53131b1919f788ed5fd3116ed501be79554e47113d795b06f5ad255c7dfee2bb9e021eb0ab14e9b737

\??\c:\Users\Admin\AppData\Local\Temp\CSCCE9A.tmp

MD5 ecb27c8b39b4e0e254727e0031e46930
SHA1 0279eebb9ddbc64d9b720efcc28f97461e54779b
SHA256 b4bf07135044bebe78ace5a68ba1a0762e02c6dcb22f69ff8374a0dbc7415b00
SHA512 1831790dbf6cc41c4cc7eab50932aff4277f2e42e917ab5a3ccecf7450f6dd6e520d15c4c1466f3918101953a4d47310b56be3589b61937df4569568d9786ae1

C:\Users\Admin\AppData\Local\Temp\RESCE9B.tmp

MD5 e29b94ea23b64c7897c4542daaef2cab
SHA1 82bd20ef4c99181539350d2db332717f34765071
SHA256 1607cf4b9f4620f9150da5eb037f95cf87f3ad0f6de7e5dc1054ef9060d994e3
SHA512 0b4780666fd1ab7f9e62d5879245212d2325f37c023abbc243cfa1e3a57dfe12b262d5e1c3240e2d2389d3ebe5166fa865a0c5aed20557d7bf789f9881a62eb1

C:\Users\Admin\AppData\Local\Temp\qxijfxps.dll

MD5 2d343dca9cb1480f2d83f69579176190
SHA1 4e2d75ab6c12e3b5da4983799679f560b7e7c5b3
SHA256 126b30ef504a56a83da0487ef0fe8152a1d79977ecbf741e41863bb66f1d76c2
SHA512 5a6694d7ff12b91f846b0b330153b11482305f545444261cbebe346c43070e25df7100333ebbc86fb0619b3b15a1a10117eafb11700853c27616582dec1f55aa

memory/4612-52-0x0000000000400000-0x000000000040C000-memory.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD032.tmp.xml

MD5 a2bd41d1add1e2c5857968466a0caf18
SHA1 a94b8812436801a3e4d6f414c5c015912702a300
SHA256 738a7601726e048c163b385099c3df29b9b53d19ef71ad2c0c29e2c2dd96f178
SHA512 3388fbeb5b94bdc2f7fb0f225c3ba787ab5eb3f65094dfd34ce47014bf508ef13d3ce127c640ef6fa73da78924e94d47f1816c17746b1f3448fcda7b1fd3025b

memory/2296-80-0x0000000075072000-0x0000000075073000-memory.dmp

memory/2296-81-0x0000000075070000-0x0000000075621000-memory.dmp

memory/2596-92-0x00007FFE5E5B0000-0x00007FFE5E5E4000-memory.dmp

memory/2596-91-0x00007FF6A6050000-0x00007FF6A6148000-memory.dmp

memory/2596-100-0x00007FFE5A520000-0x00007FFE5A531000-memory.dmp

memory/2596-99-0x00007FFE5AD60000-0x00007FFE5AD7D000-memory.dmp

memory/2596-98-0x00007FFE5C260000-0x00007FFE5C271000-memory.dmp

memory/2596-97-0x00007FFE5D9D0000-0x00007FFE5D9E7000-memory.dmp

memory/2596-96-0x00007FFE5DB80000-0x00007FFE5DB91000-memory.dmp

memory/2596-95-0x00007FFE5E730000-0x00007FFE5E747000-memory.dmp

memory/2596-94-0x00007FFE5F580000-0x00007FFE5F598000-memory.dmp

memory/2596-93-0x00007FFE4F1E0000-0x00007FFE4F496000-memory.dmp

memory/2596-101-0x00007FFE4EDE0000-0x00007FFE4EFEB000-memory.dmp

memory/2596-108-0x00007FFE4FB80000-0x00007FFE4FB91000-memory.dmp

memory/2596-107-0x00007FFE54FE0000-0x00007FFE54FF1000-memory.dmp

memory/2596-106-0x00007FFE55690000-0x00007FFE556A1000-memory.dmp

memory/2596-105-0x00007FFE59DF0000-0x00007FFE59E08000-memory.dmp

memory/2596-104-0x00007FFE56910000-0x00007FFE56931000-memory.dmp

memory/2596-103-0x00007FFE556B0000-0x00007FFE556F1000-memory.dmp

memory/2596-102-0x00007FFE4DD30000-0x00007FFE4EDE0000-memory.dmp

memory/2296-111-0x0000000075070000-0x0000000075621000-memory.dmp

memory/2596-141-0x00007FFE4DD30000-0x00007FFE4EDE0000-memory.dmp