Analysis
-
max time kernel
138s -
max time network
139s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
24-08-2020 21:55
Static task
static1
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
-
Target
sample.exe
-
Size
375KB
-
MD5
309c240336952e3a6afe08f91581aa76
-
SHA1
7cc257d1dc641c5fc312c7694a1a7be7ce31cb46
-
SHA256
621d7c1d19ccbaa8d56dbcb37e46f4437fa425ce92895acd87a6df9710f8b391
-
SHA512
a7e68157c9d9e6a317fa5a898cf1b96bd884132e4634fecd495af74d5e40b72f54a85446730a0a0ac8379039146f1840229e420c5b7dd64b1eca8be0b09fb104
Malware Config
Extracted
Family
trickbot
Version
1000098
Botnet
mac1
C2
79.106.41.9:449
94.250.252.146:443
62.109.18.206:443
62.109.26.193:443
78.24.223.50:443
94.250.252.162:443
92.53.78.209:443
92.53.66.115:443
62.109.16.70:443
62.109.23.229:443
62.109.17.100:443
82.146.47.221:443
195.133.144.43:443
194.87.92.217:443
95.213.194.234:443
195.133.147.44:443
194.87.238.149:443
78.155.206.154:443
185.80.130.195:443
94.250.252.168:443
82.202.236.5:443
185.80.129.158:443
94.250.255.156:443
185.158.114.106:443
94.250.248.173:443
Attributes
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
ecc_pubkey.base64
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1436 sanpmf.exe 1828 sanpmf.exe 1744 sanpmf.exe -
Loads dropped DLL 1 IoCs
pid Process 1420 sample.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip.anysrc.net -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 288 svchost.exe -
Suspicious use of WriteProcessMemory 1431 IoCs
description pid Process procid_target PID 1420 wrote to memory of 1436 1420 sample.exe 24 PID 1420 wrote to memory of 1436 1420 sample.exe 24 PID 1420 wrote to memory of 1436 1420 sample.exe 24 PID 1420 wrote to memory of 1436 1420 sample.exe 24 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1436 wrote to memory of 288 1436 sanpmf.exe 25 PID 1384 wrote to memory of 1828 1384 taskeng.exe 29 PID 1384 wrote to memory of 1828 1384 taskeng.exe 29 PID 1384 wrote to memory of 1828 1384 taskeng.exe 29 PID 1384 wrote to memory of 1828 1384 taskeng.exe 29 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1828 wrote to memory of 1640 1828 sanpmf.exe 30 PID 1384 wrote to memory of 1744 1384 taskeng.exe 31 PID 1384 wrote to memory of 1744 1384 taskeng.exe 31 PID 1384 wrote to memory of 1744 1384 taskeng.exe 31 PID 1384 wrote to memory of 1744 1384 taskeng.exe 31 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32 PID 1744 wrote to memory of 1556 1744 sanpmf.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Roaming\services\sanpmf.exeC:\Users\Admin\AppData\Roaming\services\sanpmf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\system32\svchost.exesvchost.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:288
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {065F6C61-4F13-4D3F-9C14-9BF439BD90B2} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:1384
-
C:\Users\Admin\AppData\Roaming\services\sanpmf.exeC:\Users\Admin\AppData\Roaming\services\sanpmf.exe2⤵
- Executes dropped EXE
PID:1828 -
C:\Windows\system32\svchost.exesvchost.exe3⤵PID:1640
-
-
-
C:\Users\Admin\AppData\Roaming\services\sanpmf.exeC:\Users\Admin\AppData\Roaming\services\sanpmf.exe2⤵
- Executes dropped EXE
PID:1744 -
C:\Windows\system32\svchost.exesvchost.exe3⤵PID:1556
-
-