Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 21:00
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Crypt9.KSH.23004.12082.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Crypt9.KSH.23004.12082.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.Crypt9.KSH.23004.12082.exe
-
Size
500KB
-
MD5
4849ab316b3dcde68a2a23c22dee2d98
-
SHA1
48827786029e0575687ee5f0707f7ebfc4ca2515
-
SHA256
428558fcf4133715cf08d2fdf904b35f3c5e47dadbb5128b43785648688abfa1
-
SHA512
002c83033bb390c55e4b28d75eda1c4c0793d83ac8cd5af81b421ea688d4d55f3828ec37fd7c4bece762c78ac301891775dd7f8be2690ea88b7f6b62ad1ed888
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exeTfdurjtfIngo.com.Crypt9.KSH.23004.12082.exepid Process 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 16 myexternalip.com 18 myexternalip.com -
Modifies data under HKEY_USERS 2 IoCs
Processes:
svchost.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe -
Suspicious use of WriteProcessMemory 887 IoCs
Processes:
SecuriteInfo.com.Crypt9.KSH.23004.12082.exeTfdurjtfIngo.com.Crypt9.KSH.23004.12082.exedescription pid Process procid_target PID 640 wrote to memory of 2440 640 SecuriteInfo.com.Crypt9.KSH.23004.12082.exe 77 PID 640 wrote to memory of 2440 640 SecuriteInfo.com.Crypt9.KSH.23004.12082.exe 77 PID 640 wrote to memory of 2440 640 SecuriteInfo.com.Crypt9.KSH.23004.12082.exe 77 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 2440 wrote to memory of 184 2440 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 79 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81 PID 1996 wrote to memory of 2220 1996 TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Crypt9.KSH.23004.12082.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Crypt9.KSH.23004.12082.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Roaming\winapp\TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exeC:\Users\Admin\AppData\Roaming\winapp\TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SYSTEM32\svchost.exesvchost.exe3⤵PID:184
-
-
-
C:\Users\Admin\AppData\Roaming\winapp\TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exeC:\Users\Admin\AppData\Roaming\winapp\TfdurjtfIngo.com.Crypt9.KSH.23004.12082.exe1⤵
- Executes dropped EXE
PID:1996 -
C:\Windows\system32\svchost.exesvchost.exe2⤵
- Modifies data under HKEY_USERS
PID:2220
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
4849ab316b3dcde68a2a23c22dee2d98
SHA148827786029e0575687ee5f0707f7ebfc4ca2515
SHA256428558fcf4133715cf08d2fdf904b35f3c5e47dadbb5128b43785648688abfa1
SHA512002c83033bb390c55e4b28d75eda1c4c0793d83ac8cd5af81b421ea688d4d55f3828ec37fd7c4bece762c78ac301891775dd7f8be2690ea88b7f6b62ad1ed888
-
MD5
4849ab316b3dcde68a2a23c22dee2d98
SHA148827786029e0575687ee5f0707f7ebfc4ca2515
SHA256428558fcf4133715cf08d2fdf904b35f3c5e47dadbb5128b43785648688abfa1
SHA512002c83033bb390c55e4b28d75eda1c4c0793d83ac8cd5af81b421ea688d4d55f3828ec37fd7c4bece762c78ac301891775dd7f8be2690ea88b7f6b62ad1ed888
-
MD5
4849ab316b3dcde68a2a23c22dee2d98
SHA148827786029e0575687ee5f0707f7ebfc4ca2515
SHA256428558fcf4133715cf08d2fdf904b35f3c5e47dadbb5128b43785648688abfa1
SHA512002c83033bb390c55e4b28d75eda1c4c0793d83ac8cd5af81b421ea688d4d55f3828ec37fd7c4bece762c78ac301891775dd7f8be2690ea88b7f6b62ad1ed888