djvu | bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470

Analysis

max time kernel
147s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-06-2024 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
Size

747KB
MD5

7e733e8d4e854936c90dafe90d7589ab
SHA1

a17a005e1cd67c6f427565b91d7ad3c80f42df72
SHA256

bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470
SHA512

a8a0d2cf0cf19eb3a1ada32571c07217f4c990b038a7631c8913f89e3113e7625a5f6a0d3c4cb7f2773b56391ecd71af4854f0a01924030d07c76aac38fc8ef4
SSDEEP

12288:+04J5Ek55//i7xrbqsK9KirLVUZ5A6dRfrr0M2VDxMkDi4nadXmghE8J/ChtP2jh:74Jd/i7x3qsuKehUzAEzr0M2Vvi4nI2S

Score

10^/10

djvu discovery persistence ransomware upx

Malware Config

Extracted

Family

djvu

http://fuyt.org/test1/get.php

Attributes

extension
.bbbw
offline_id
jYeuANkMCJOEtaXsN8JcBUuEjwSP20EGT4t2Nct1
payload_url
http://lencu.top/dl/build2.exe
http://fuyt.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-qqj8MrDVtG Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0382UIhfSd

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 16 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1340-8-0x0000000001EA0000-0x0000000001FBB000-memory.dmp	family_djvu
behavioral1/memory/2984-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2984-9-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2984-10-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2984-31-0x0000000003860000-0x000000000395E000-memory.dmp	family_djvu
behavioral1/memory/2984-34-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2456-45-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2456-46-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2456-61-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2456-62-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2456-63-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2456-67-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2456-76-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2456-79-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2456-78-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2456-80-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2664 icacls.exe

pid	process
2664	icacls.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1340-0-0x0000000000400000-0x00000000004FE000-memory.dmp	upx
behavioral1/memory/1340-6-0x0000000000400000-0x00000000004FE000-memory.dmp	upx
C:\Users\Admin\AppData\Local\b9de2c75-6b9b-4d18-9264-3eaff0f48fed\bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	upx
behavioral1/memory/1340-41-0x0000000000400000-0x00000000004FE000-memory.dmp	upx
behavioral1/memory/2704-37-0x00000000020D0000-0x00000000021CE000-memory.dmp	upx
behavioral1/memory/2704-36-0x0000000000400000-0x00000000004FE000-memory.dmp	upx
behavioral1/memory/2704-43-0x0000000000400000-0x00000000004FE000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\b9de2c75-6b9b-4d18-9264-3eaff0f48fed\\bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe\" --AutoStart"	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.2ip.ua
4 api.2ip.ua
9 api.2ip.ua

flow	ioc
3	api.2ip.ua
4	api.2ip.ua
9	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

Processes:

bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exebbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe

description	pid	process	target process
PID 1340 set thread context of 2984	1340	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 2704 set thread context of 2456	2704	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exebbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe

pid	process
2984	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
2456	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
2456	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exebbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exebbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe

C:\Users\Admin\AppData\Local\Temp\bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
"C:\Users\Admin\AppData\Local\Temp\bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1340

C:\Users\Admin\AppData\Local\Temp\bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
"C:\Users\Admin\AppData\Local\Temp\bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\b9de2c75-6b9b-4d18-9264-3eaff0f48fed" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:2664

C:\Users\Admin\AppData\Local\Temp\bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
"C:\Users\Admin\AppData\Local\Temp\bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2704

C:\Users\Admin\AppData\Local\Temp\bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
"C:\Users\Admin\AppData\Local\Temp\bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2456

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
6920a0cafb08332f73014f451b77f9e6

SHA1
55b68d4ae2ab2090b01a5b53d13ece07593aea87

SHA256
88822c91402870e5fa196bc3cb0289dbc0feedd30eebd38820549b11424a3c84

SHA512
c839fad10dc726553d7dba296547afe68eacc95cb63bf4dfdbc064e16ca3d908fb1cd589e7bd8f6b0007c1c3b34e889a7a1f3eafb9bd9f80763a5801b3c7525f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
da6f1711b395e6cda7509fec1b8a7b4d

SHA1
f80ab453aa3b89d708b116484a8060a7a45256ce

SHA256
76f696959522d3d851a4493f7b12e2b1e1cfadcf61e31b5be36357c26cdff4a7

SHA512
e747a00f612a8f71e2bd78fd789decb5dd3c3f3a7c0a5d0037650bc1fc2eee009996a8970983b19bfea53a2edf5313433ed5f3d9e337db96918f616dbb35da76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
139783e9839de2c579a14f24d8ff802b

SHA1
563eaf8a554492aa64c572ac375f418f0d02259a

SHA256
c01e58172f1411a28f26e66f22e6949afa35f0aa861b28c76ffd2ee733f51d90

SHA512
5674c20afca9e4af50fd84cae6cac2b7e0de2a11a9c750dce93cbaefda6d5066399071eb3d71750cdfe00ebf06a07a44fbedcaa1c6b732e6f8a3862ddd644c75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
64ff0c9d84ae50cd2478e6b2b1415356

SHA1
14647b89640743897bd20a70c05921596b02cdad

SHA256
5045328829c4eb3312eb8181b20ed84c563d83f62b02f9e485fa9e298822dbb6

SHA512
3263fa953e236987bda111debd44c74eb6ae5b994427dc960c78d35dad0a2be347f7010fb889a878b4e55fe7b5cbf42d93fecc8fb95cbd9303db612c3c65a6c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabABE9.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\b9de2c75-6b9b-4d18-9264-3eaff0f48fed\bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
Filesize
747KB

MD5
7e733e8d4e854936c90dafe90d7589ab

SHA1
a17a005e1cd67c6f427565b91d7ad3c80f42df72

SHA256
bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470

SHA512
a8a0d2cf0cf19eb3a1ada32571c07217f4c990b038a7631c8913f89e3113e7625a5f6a0d3c4cb7f2773b56391ecd71af4854f0a01924030d07c76aac38fc8ef4

Download Submit
memory/1340-8-0x0000000001EA0000-0x0000000001FBB000-memory.dmp

Filesize
1.1MB

Download
memory/1340-6-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/1340-41-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/1340-2-0x0000000000500000-0x0000000000592000-memory.dmp

Filesize
584KB

Download
memory/1340-1-0x0000000000500000-0x0000000000592000-memory.dmp

Filesize
584KB

Download
memory/1340-0-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/2456-46-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2456-61-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2456-45-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2456-80-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2456-78-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2456-79-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2456-76-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2456-67-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2456-63-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2456-62-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2704-43-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/2704-35-0x0000000001C90000-0x0000000001D22000-memory.dmp

Filesize
584KB

Download
memory/2704-36-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/2704-37-0x00000000020D0000-0x00000000021CE000-memory.dmp

Filesize
1016KB

Download
memory/2984-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2984-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2984-9-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2984-10-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2984-30-0x0000000003860000-0x000000000395E000-memory.dmp

Filesize
1016KB

Download
memory/2984-31-0x0000000003860000-0x000000000395E000-memory.dmp

Filesize
1016KB

Download
memory/2984-34-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download

description	pid	process	target process
PID 1340 wrote to memory of 2984	1340	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 1340 wrote to memory of 2984	1340	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 1340 wrote to memory of 2984	1340	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 1340 wrote to memory of 2984	1340	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 1340 wrote to memory of 2984	1340	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 1340 wrote to memory of 2984	1340	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 1340 wrote to memory of 2984	1340	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 1340 wrote to memory of 2984	1340	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 1340 wrote to memory of 2984	1340	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 1340 wrote to memory of 2984	1340	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 1340 wrote to memory of 2984	1340	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 2984 wrote to memory of 2664	2984	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	icacls.exe
PID 2984 wrote to memory of 2664	2984	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	icacls.exe
PID 2984 wrote to memory of 2664	2984	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	icacls.exe
PID 2984 wrote to memory of 2664	2984	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	icacls.exe
PID 2984 wrote to memory of 2704	2984	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 2984 wrote to memory of 2704	2984	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 2984 wrote to memory of 2704	2984	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 2984 wrote to memory of 2704	2984	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 2704 wrote to memory of 2456	2704	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 2704 wrote to memory of 2456	2704	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 2704 wrote to memory of 2456	2704	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 2704 wrote to memory of 2456	2704	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 2704 wrote to memory of 2456	2704	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 2704 wrote to memory of 2456	2704	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 2704 wrote to memory of 2456	2704	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 2704 wrote to memory of 2456	2704	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 2704 wrote to memory of 2456	2704	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 2704 wrote to memory of 2456	2704	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe
PID 2704 wrote to memory of 2456	2704	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe	bbca183e72964dedca9d5421c33e2bc24e54c1326eeaea7ee6fd3823f3a45470.exe