trickbot | 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929

Analysis

max time kernel
1643s
max time network
1771s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

asdpogasdjabn.exe
Size

660KB
MD5

3ba7d3dbc17ce640e0bb3dd5f989169b
SHA1

84ee0b6e02339f1deb33d75693551db444923ba8
SHA256

52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929
SHA512

3a683b35dc6b6c17de5a21171625c3fb5259d60c73867aa81b89cedeef61f1b95cce099cc5bb4fdeb2ddf7f2f0236c6d877970768a7f91330ecfbbc38931a231

Score

10^/10

trickbot tar2 banker persistence spyware trojan

Malware Config

Extracted

Family

trickbot

Version

100001

Botnet

tar2

66.85.183.5:443

185.163.47.157:443

94.140.115.99:443

195.123.240.40:443

195.123.241.226:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Blacklisted process makes network request 1 IoCs

flow	pid	Process
17	1140	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ident.me
8	ident.me

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\cn\eikcxqfuoc.txt	wermgr.exe

Modifies service 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas	ipconfig.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs	ipconfig.exe

Discovers systems in the same network 1 TTPs 2 IoCs

discovery

Remote System Discovery

T1018

pid	Process
1560	net.exe
1012	net.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1664	ipconfig.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
784	cmd.exe
1140	cmd.exe
784	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	wermgr.exe
Token: SeDebugPrivilege	784	cmd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
744	asdpogasdjabn.exe
744	asdpogasdjabn.exe

Suspicious use of WriteProcessMemory 714 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1280	744	asdpogasdjabn.exe	30
PID 744 wrote to memory of 1280	744	asdpogasdjabn.exe	30
PID 744 wrote to memory of 1280	744	asdpogasdjabn.exe	30
PID 744 wrote to memory of 1280	744	asdpogasdjabn.exe	30
PID 744 wrote to memory of 1280	744	asdpogasdjabn.exe	30
PID 744 wrote to memory of 1280	744	asdpogasdjabn.exe	30
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1280 wrote to memory of 1140	1280	wermgr.exe	33
PID 1140 wrote to memory of 1664	1140	cmd.exe	36
PID 1140 wrote to memory of 1664	1140	cmd.exe	36
PID 1140 wrote to memory of 1664	1140	cmd.exe	36
PID 1140 wrote to memory of 848	1140	cmd.exe	38
PID 1140 wrote to memory of 848	1140	cmd.exe	38
PID 1140 wrote to memory of 848	1140	cmd.exe	38
PID 848 wrote to memory of 1792	848	net.exe	40
PID 848 wrote to memory of 1792	848	net.exe	40
PID 848 wrote to memory of 1792	848	net.exe	40
PID 1140 wrote to memory of 1560	1140	cmd.exe	41
PID 1140 wrote to memory of 1560	1140	cmd.exe	41
PID 1140 wrote to memory of 1560	1140	cmd.exe	41
PID 1140 wrote to memory of 1012	1140	cmd.exe	43
PID 1140 wrote to memory of 1012	1140	cmd.exe	43
PID 1140 wrote to memory of 1012	1140	cmd.exe	43
PID 1140 wrote to memory of 812	1140	cmd.exe	45
PID 1140 wrote to memory of 812	1140	cmd.exe	45
PID 1140 wrote to memory of 812	1140	cmd.exe	45
PID 1140 wrote to memory of 1096	1140	cmd.exe	47
PID 1140 wrote to memory of 1096	1140	cmd.exe	47
PID 1140 wrote to memory of 1096	1140	cmd.exe	47
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31
PID 1280 wrote to memory of 784	1280	wermgr.exe	31

C:\Users\Admin\AppData\Local\Temp\asdpogasdjabn.exe
"C:\Users\Admin\AppData\Local\Temp\asdpogasdjabn.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    - Blacklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:1140
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Modifies service
      Gathers network information
      PID:1664
  - - C:\Windows\system32\net.exe
      net config workstation
      4⤵
      PID:848
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 config workstation
        5⤵
        
        PID:1792
  - - C:\Windows\system32\net.exe
      net view /all
      4⤵
      Discovers systems in the same network
      PID:1560
  - - C:\Windows\system32\net.exe
      net view /all /domain
      4⤵
      Discovers systems in the same network
      PID:1012
  - - C:\Windows\system32\nltest.exe
      nltest /domain_trusts
      4⤵
      PID:812
  - - C:\Windows\system32\nltest.exe
      nltest /domain_trusts /all_trusts
      4⤵
      PID:1096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-0-0x00000000004B0000-0x00000000004EE000-memory.dmp

Filesize
248KB

Download
memory/744-1-0x0000000000540000-0x000000000057A000-memory.dmp

Filesize
232KB

Download
memory/784-96-0x0000000000130000-0x0000000000130017-memory.dmp

Filesize
23B

Download
memory/784-17-0x0000000000130000-0x0000000000130017-memory.dmp

Filesize
23B

Download
memory/784-16-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1140-82-0x0000000001B80000-0x0000000001B80188-memory.dmp

Filesize
392B

Download
memory/1140-50-0x0000000001B70000-0x0000000001B70400-memory.dmp

Filesize
1024B

Download
memory/1140-51-0x0000000001B60000-0x0000000001B6000D-memory.dmp

Filesize
13B

Download
memory/1140-46-0x0000000180000000-0x0000000180016000-memory.dmp

Filesize
88KB

Download
memory/1140-49-0x0000000001BB0000-0x0000000001BB0080-memory.dmp

Filesize
128B

Download
memory/1140-48-0x0000000180000000-0x0000000180016000-memory.dmp

Filesize
88KB

Download
memory/1140-93-0x0000000001B80000-0x0000000001B80188-memory.dmp

Filesize
392B

Download
memory/1140-95-0x0000000001B60000-0x0000000001B6000D-memory.dmp

Filesize
13B

Download