77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7

Analysis

max time kernel
137s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
Size

862KB
MD5

a825e6d2fdc7fb2f4b094f66f14827a5
SHA1

030bf2d57e5b39e837d990f056775765e1e6646d
SHA256

77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7
SHA512

ac0410d411368ed60c76017396722061450fc5a34c5f73d458ab1e855fa8302de67ba4b53bacc4912c2eed1207216a418cf85f5ed3385d565038c891e699da38
SSDEEP

12288:njue1nWr9iA/JFv0c3Um3eLSJk9KqjC1u6MXCITIFI3NlAaiSQu8G:x9WrRum3WjqFU

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

Processes:

77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

pid	process
1748	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
1892	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
2044	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
1788	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
1780	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
1936	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Loads dropped DLL 6 IoCs

Processes:

77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

pid	process
1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\Sample.lnk"	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

pid	process
1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

description pid process

Token: SeDebugPrivilege 1416 77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

description	pid	process
Token: SeDebugPrivilege	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
"C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\SysWOW64\CMD.exe
"CMD"
2⤵
PID:1568

C:\Windows\SysWOW64\CMD.exe
"CMD"
2⤵
PID:1732

C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
"C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe"
2⤵
- Executes dropped EXE
PID:1748

C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
"C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe"
2⤵
- Executes dropped EXE
PID:1892

C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
"C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe"
2⤵
- Executes dropped EXE
PID:2044

C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
"C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe"
2⤵
- Executes dropped EXE
PID:1788

C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
"C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe"
2⤵
- Executes dropped EXE
PID:1780

C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
"C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe"
2⤵
- Executes dropped EXE
PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Filesize
862KB

MD5
a825e6d2fdc7fb2f4b094f66f14827a5

SHA1
030bf2d57e5b39e837d990f056775765e1e6646d

SHA256
77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7

SHA512
ac0410d411368ed60c76017396722061450fc5a34c5f73d458ab1e855fa8302de67ba4b53bacc4912c2eed1207216a418cf85f5ed3385d565038c891e699da38

Download Submit
C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Filesize
862KB

MD5
a825e6d2fdc7fb2f4b094f66f14827a5

SHA1
030bf2d57e5b39e837d990f056775765e1e6646d

SHA256
77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7

SHA512
ac0410d411368ed60c76017396722061450fc5a34c5f73d458ab1e855fa8302de67ba4b53bacc4912c2eed1207216a418cf85f5ed3385d565038c891e699da38

Download Submit
C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Filesize
862KB

MD5
a825e6d2fdc7fb2f4b094f66f14827a5

SHA1
030bf2d57e5b39e837d990f056775765e1e6646d

SHA256
77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7

SHA512
ac0410d411368ed60c76017396722061450fc5a34c5f73d458ab1e855fa8302de67ba4b53bacc4912c2eed1207216a418cf85f5ed3385d565038c891e699da38

Download Submit
C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Filesize
862KB

MD5
a825e6d2fdc7fb2f4b094f66f14827a5

SHA1
030bf2d57e5b39e837d990f056775765e1e6646d

SHA256
77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7

SHA512
ac0410d411368ed60c76017396722061450fc5a34c5f73d458ab1e855fa8302de67ba4b53bacc4912c2eed1207216a418cf85f5ed3385d565038c891e699da38

Download Submit
C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Filesize
862KB

MD5
a825e6d2fdc7fb2f4b094f66f14827a5

SHA1
030bf2d57e5b39e837d990f056775765e1e6646d

SHA256
77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7

SHA512
ac0410d411368ed60c76017396722061450fc5a34c5f73d458ab1e855fa8302de67ba4b53bacc4912c2eed1207216a418cf85f5ed3385d565038c891e699da38

Download Submit
C:\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Filesize
862KB

MD5
a825e6d2fdc7fb2f4b094f66f14827a5

SHA1
030bf2d57e5b39e837d990f056775765e1e6646d

SHA256
77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7

SHA512
ac0410d411368ed60c76017396722061450fc5a34c5f73d458ab1e855fa8302de67ba4b53bacc4912c2eed1207216a418cf85f5ed3385d565038c891e699da38

Download Submit
\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Filesize
862KB

MD5
a825e6d2fdc7fb2f4b094f66f14827a5

SHA1
030bf2d57e5b39e837d990f056775765e1e6646d

SHA256
77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7

SHA512
ac0410d411368ed60c76017396722061450fc5a34c5f73d458ab1e855fa8302de67ba4b53bacc4912c2eed1207216a418cf85f5ed3385d565038c891e699da38

Download Submit
\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Filesize
862KB

MD5
a825e6d2fdc7fb2f4b094f66f14827a5

SHA1
030bf2d57e5b39e837d990f056775765e1e6646d

SHA256
77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7

SHA512
ac0410d411368ed60c76017396722061450fc5a34c5f73d458ab1e855fa8302de67ba4b53bacc4912c2eed1207216a418cf85f5ed3385d565038c891e699da38

Download Submit
\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Filesize
862KB

MD5
a825e6d2fdc7fb2f4b094f66f14827a5

SHA1
030bf2d57e5b39e837d990f056775765e1e6646d

SHA256
77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7

SHA512
ac0410d411368ed60c76017396722061450fc5a34c5f73d458ab1e855fa8302de67ba4b53bacc4912c2eed1207216a418cf85f5ed3385d565038c891e699da38

Download Submit
\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Filesize
862KB

MD5
a825e6d2fdc7fb2f4b094f66f14827a5

SHA1
030bf2d57e5b39e837d990f056775765e1e6646d

SHA256
77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7

SHA512
ac0410d411368ed60c76017396722061450fc5a34c5f73d458ab1e855fa8302de67ba4b53bacc4912c2eed1207216a418cf85f5ed3385d565038c891e699da38

Download Submit
\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Filesize
862KB

MD5
a825e6d2fdc7fb2f4b094f66f14827a5

SHA1
030bf2d57e5b39e837d990f056775765e1e6646d

SHA256
77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7

SHA512
ac0410d411368ed60c76017396722061450fc5a34c5f73d458ab1e855fa8302de67ba4b53bacc4912c2eed1207216a418cf85f5ed3385d565038c891e699da38

Download Submit
\Users\Admin\AppData\Local\Temp\77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe

Filesize
862KB

MD5
a825e6d2fdc7fb2f4b094f66f14827a5

SHA1
030bf2d57e5b39e837d990f056775765e1e6646d

SHA256
77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7

SHA512
ac0410d411368ed60c76017396722061450fc5a34c5f73d458ab1e855fa8302de67ba4b53bacc4912c2eed1207216a418cf85f5ed3385d565038c891e699da38

Download Submit
memory/1416-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1416-56-0x00000000742C0000-0x000000007486B000-memory.dmp

Filesize
5.7MB

Download
memory/1416-55-0x00000000742C0000-0x000000007486B000-memory.dmp

Filesize
5.7MB

Download
memory/1416-71-0x00000000742C0000-0x000000007486B000-memory.dmp

Filesize
5.7MB

Download
memory/1568-57-0x0000000000000000-mapping.dmp

Download
memory/1732-58-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 1416 wrote to memory of 1568	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	CMD.exe
PID 1416 wrote to memory of 1568	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	CMD.exe
PID 1416 wrote to memory of 1568	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	CMD.exe
PID 1416 wrote to memory of 1568	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	CMD.exe
PID 1416 wrote to memory of 1732	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	CMD.exe
PID 1416 wrote to memory of 1732	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	CMD.exe
PID 1416 wrote to memory of 1732	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	CMD.exe
PID 1416 wrote to memory of 1732	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	CMD.exe
PID 1416 wrote to memory of 1748	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1748	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1748	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1748	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1892	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1892	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1892	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1892	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 2044	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 2044	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 2044	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 2044	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1788	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1788	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1788	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1788	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1780	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1780	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1780	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1780	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1936	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1936	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1936	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe
PID 1416 wrote to memory of 1936	1416	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe	77ff00bf84a5920c94046c55d630a28ff0f45d1ca607f6e42b23c6fe7779d9f7.exe