Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
24-08-2020 22:33
Static task
static1
Behavioral task
behavioral1
Sample
127661.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
-
Target
127661.exe
-
Size
375KB
-
MD5
309c240336952e3a6afe08f91581aa76
-
SHA1
7cc257d1dc641c5fc312c7694a1a7be7ce31cb46
-
SHA256
621d7c1d19ccbaa8d56dbcb37e46f4437fa425ce92895acd87a6df9710f8b391
-
SHA512
a7e68157c9d9e6a317fa5a898cf1b96bd884132e4634fecd495af74d5e40b72f54a85446730a0a0ac8379039146f1840229e420c5b7dd64b1eca8be0b09fb104
Malware Config
Extracted
Family
trickbot
Version
1000098
Botnet
mac1
C2
79.106.41.9:449
94.250.252.146:443
62.109.18.206:443
62.109.26.193:443
78.24.223.50:443
94.250.252.162:443
92.53.78.209:443
92.53.66.115:443
62.109.16.70:443
62.109.23.229:443
62.109.17.100:443
82.146.47.221:443
195.133.144.43:443
194.87.92.217:443
95.213.194.234:443
195.133.147.44:443
194.87.238.149:443
78.155.206.154:443
185.80.130.195:443
94.250.252.168:443
82.202.236.5:443
185.80.129.158:443
94.250.255.156:443
185.158.114.106:443
94.250.248.173:443
Attributes
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
ecc_pubkey.base64
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
237772.exe237772.exe237772.exepid Process 504 237772.exe 3016 237772.exe 1768 237772.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 ipinfo.io -
Modifies data under HKEY_USERS 1 IoCs
Processes:
svchost.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid Process Token: SeTakeOwnershipPrivilege 1068 svchost.exe -
Suspicious use of WriteProcessMemory 1416 IoCs
Processes:
127661.exe237772.exedescription pid Process procid_target PID 904 wrote to memory of 504 904 127661.exe 66 PID 904 wrote to memory of 504 904 127661.exe 66 PID 904 wrote to memory of 504 904 127661.exe 66 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 504 wrote to memory of 1068 504 237772.exe 67 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 3016 wrote to memory of 756 3016 237772.exe 75 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77 PID 1768 wrote to memory of 3684 1768 237772.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\127661.exe"C:\Users\Admin\AppData\Local\Temp\127661.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Roaming\services\237772.exeC:\Users\Admin\AppData\Roaming\services\237772.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Windows\SYSTEM32\svchost.exesvchost.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
-
C:\Users\Admin\AppData\Roaming\services\237772.exeC:\Users\Admin\AppData\Roaming\services\237772.exe1⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\system32\svchost.exesvchost.exe2⤵
- Modifies data under HKEY_USERS
PID:756
-
-
C:\Users\Admin\AppData\Roaming\services\237772.exeC:\Users\Admin\AppData\Roaming\services\237772.exe1⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\system32\svchost.exesvchost.exe2⤵PID:3684
-