Malware Analysis Report

2024-07-28 05:21

Sample ID 240603-a8f6gsee67
Target goggle.com trojan.exe
SHA256 361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28
Tags
adware discovery evasion persistence spyware stealer trojan upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28

Threat Level: Shows suspicious behavior

The file goggle.com trojan.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

adware discovery evasion persistence spyware stealer trojan upx

Drops startup file

UPX packed file

Checks computer location settings

Reads user/profile data of web browsers

Checks BIOS information in registry

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Adds Run key to start application

Installs/modifies Browser Helper Object

Checks whether UAC is enabled

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Program crash

Enumerates physical storage devices

NSIS installer

Suspicious use of SendNotifyMessage

Checks processor information in registry

Modifies Internet Explorer start page

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Modifies registry class

Modifies system certificate store

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Browser Extensions
T1176
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Subvert Trust Controls
T1553
Install Root Certificate
T1553.004
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-03 00:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 00:52

Reported

2024-06-03 00:55

Platform

win7-20240508-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\goggle.com trojan.exe"

Signatures

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (149).exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\The Ultimate Guide To Joomla Step By Step Joomla Videos.LNK C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (101).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (108).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (109).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (110).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (111).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (112).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (114).exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (113).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (117).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (119).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (120).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (122).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (124).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (126).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (128).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (13).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (115).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (116).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (118).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (12).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (121).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (123).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (125).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (127).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (129).exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\updchecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\fun (114).exe" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (114).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adstartup = "C:\\Windows\\system32\\automove.exe" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (129).exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\KeywordSearchUpdater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\fun (144).exe" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (144).exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows installer = "C:\\winstall.exe" C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\ad405cn\iePlayer.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{AA58ED58-01DD-4D91-8333-CF10577473F7}\ = "Google Toolbar Helper" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE} C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE}\ C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\ = "FlashGetBHO" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\NoExplorer = "1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{AA58ED58-01DD-4D91-8333-CF10577473F7} C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification \??\c:\windows\SysWOW64\dwdsregt.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File created C:\Windows\SysWOW64\msnav32.ax C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File created C:\Windows\SysWOW64\adupdmanager.xml C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (129).exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_03_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\The Ultimate Guide To Joomla Step By Step Joomla Videos\Icon05112011023531.ico C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
File opened for modification C:\Program Files (x86)\HBCheckPermission.txt C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe N/A
File opened for modification C:\Program Files (x86)\MyEmoticons\UMEP.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (137).exe N/A
File created C:\Program Files (x86)\Google\googletoolbar1.dll C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (14).exe N/A
File opened for modification C:\Program Files (x86)\The Ultimate Guide To Joomla Step By Step Joomla Videos C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
File opened for modification C:\Program Files (x86)\The Ultimate Guide To Joomla Step By Step Joomla Videos\Icon05112011023531.ico C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
File created C:\Program Files (x86)\The Ultimate Guide To Joomla Step By Step Joomla Videos\The Ultimate Guide To Joomla Step By Step Joomla Videos.LNK C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
File opened for modification C:\Program Files (x86)\The Ultimate Guide To Joomla Step By Step Joomla Videos\The Ultimate Guide To Joomla Step By Step Joomla Videos.LNK C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
File created C:\Program Files (x86)\HBCheckPermission.txt C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\PPlayer.2.1.58130.251.(508).dll C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (140).exe N/A
File created C:\Windows\ad405cn\ATLcom.dll C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (139).exe N/A
File created C:\Windows\ad405cn\Update.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (139).exe N/A
File created C:\Windows\ad405cn\info2asp.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (139).exe N/A
File created C:\Windows\ad405cn\iePlayer.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (139).exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (12).exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\regsvr32.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (140).exe

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (149).exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (149).exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b98d6150b5da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.k887.com/?631" C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE}\TypeLib C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\ProgID C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009\CurVer\ = "FlashGetBHO.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\1.0\FLAGS\ = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\HELPDIR\ = "C:\\Windows" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Googletoolbar.Google C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA58ED58-01DD-4D91-8333-CF10577473F7}\ProgID\ = "Googletoolbar.Google.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4752D0B-C6E1-4EB2-9D56-DBBBB2346B0F}\ = "IEEula" C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0 C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0\0 C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4319F0D3-2E1A-427B-8A90-35B5244E42AE} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AmiBs.Boot.1\CLSID\ = "{F04A2CA1-9140-4553-B6C4-03E4139ECA93}" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ATLcom.DLL C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4319F0D3-2E1A-427B-8A90-35B5244E42AE}\TypeLib\ = "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE}\VERSION\ = "2.0" C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\0 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\InprocServer32\ = "C:\\Windows\\PPLAYE~1.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\FLAGS\ = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\0\win32\ = "C:\\Windows\\PPLAYE~1.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5ECBAEED-ED5E-4D69-B137-37ED7F5279A6}\2.0\FLAGS C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\TypeLib C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\Version C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\TypeLib\ = "{4ECB13A5-757F-472B-8E54-EE529A450220}" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE}\ = "IEEulas.IEEula" C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\fun (150).exe" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5ECBAEED-ED5E-4D69-B137-37ED7F5279A6}\2.0 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE}\TypeLib\ = "{5ECBAEED-ED5E-4D69-B137-37ED7F5279A6}" C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE}\VERSION C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93} C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009.1\ = "FlashGetBHO" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\ = "FlashGetBHO 1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\HELPDIR C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5ECBAEED-ED5E-4D69-B137-37ED7F5279A6}\2.0\FLAGS\ = "0" C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4752D0B-C6E1-4EB2-9D56-DBBBB2346B0F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220} C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0\ = "BootStrapperLib" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA58ED58-01DD-4D91-8333-CF10577473F7}\ = "&Google" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA58ED58-01DD-4D91-8333-CF10577473F7}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\googletoolbar1.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C80684-8B59-459F-BFCA-356E28D79688} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\googletoolbar1.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4319F0D3-2E1A-427B-8A90-35B5244E42AE}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5ECBAEED-ED5E-4D69-B137-37ED7F5279A6}\2.0\HELPDIR C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4752D0B-C6E1-4EB2-9D56-DBBBB2346B0F}\TypeLib C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Googletoolbar.Google.1 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA58ED58-01DD-4D91-8333-CF10577473F7}\TypeLib\ = "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5ECBAEED-ED5E-4D69-B137-37ED7F5279A6}\2.0\0\win32 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEEulas.IEEula\Clsid C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE}\Programmable C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\TypeLib\ = "{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688} C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 C:\Users\Admin\AppData\Local\Temp\nsyACE4.tmp\downloadmr.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 C:\Users\Admin\AppData\Local\Temp\nsyADCE.tmp\downloadmr.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Users\Admin\AppData\Local\Temp\nsyADCE.tmp\downloadmr.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 C:\Users\Admin\AppData\Local\Temp\nsjADBF.tmp\downloadmr.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Users\Admin\AppData\Local\Temp\nsjADBF.tmp\downloadmr.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Users\Admin\AppData\Local\Temp\nsyACE4.tmp\downloadmr.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (121).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (121).exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (148).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (110).exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (148).exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (148).exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (148).exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (140).exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (148).exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (148).exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (114).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (128).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (115).exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (115).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (115).exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsjADBF.tmp\downloadmr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsjADBF.tmp\downloadmr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsyACE4.tmp\downloadmr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsyACE4.tmp\downloadmr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsyADCE.tmp\downloadmr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsyADCE.tmp\downloadmr.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2460 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\goggle.com trojan.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\goggle.com trojan.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\goggle.com trojan.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\goggle.com trojan.exe C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 1876 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe
PID 1392 wrote to memory of 1876 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe
PID 1392 wrote to memory of 1876 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe
PID 1392 wrote to memory of 1876 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe
PID 1392 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe
PID 1392 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe
PID 1392 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe
PID 1392 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe
PID 1392 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe
PID 1392 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe
PID 1392 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe
PID 1392 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe
PID 1392 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (101).exe
PID 1392 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (101).exe
PID 1392 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (101).exe
PID 1392 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (101).exe
PID 1608 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe C:\Windows\SysWOW64\WerFault.exe
PID 1608 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe C:\Windows\SysWOW64\WerFault.exe
PID 1608 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe C:\Windows\SysWOW64\WerFault.exe
PID 1608 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe C:\Windows\SysWOW64\WerFault.exe
PID 1392 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe
PID 1392 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe
PID 1392 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe
PID 1392 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe
PID 1392 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe
PID 1392 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe
PID 1392 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe
PID 1392 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe
PID 1392 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe
PID 1392 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe
PID 1392 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe
PID 1392 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe
PID 1392 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe
PID 1392 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe
PID 1392 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe
PID 1392 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe
PID 1392 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe
PID 1392 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe
PID 1392 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe
PID 1392 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe
PID 1392 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe
PID 1392 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe
PID 1392 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe
PID 1392 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe
PID 1392 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe
PID 1392 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe
PID 1392 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe
PID 1392 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe
PID 1392 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe
PID 1392 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe
PID 1392 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (108).exe
PID 1392 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (108).exe
PID 1392 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (108).exe
PID 1392 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (108).exe
PID 1392 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (109).exe
PID 1392 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (109).exe
PID 1392 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (109).exe
PID 1392 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (109).exe
PID 2740 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2740 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\goggle.com trojan.exe

"C:\Users\Admin\AppData\Local\Temp\goggle.com trojan.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Blaster.bat" "

C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe

"anr0129.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe

"fun (10).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe

"fun (100).exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 116

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (101).exe

"fun (101).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe

"fun (102).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe

"fun (103).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe

"fun (104).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe

"fun (105).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe

"fun (106).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe

"fun (107).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (108).exe

"fun (108).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (109).exe

"fun (109).exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.chrisqueen.com/cb/JOOMLA12/program

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe" /asService

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Windows\SysWOW64\cscript.exe

cscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 3

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 3

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (110).exe

"fun (110).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (111).exe

"fun (111).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (112).exe

"fun (112).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (113).exe

"fun (113).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (114).exe

"fun (114).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (115).exe

"fun (115).exe"

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (116).exe

"fun (116).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (117).exe

"fun (117).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (118).exe

"fun (118).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (119).exe

"fun (119).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (12).exe

"fun (12).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (120).exe

"fun (120).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (121).exe

"fun (121).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (122).exe

"fun (122).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (123).exe

"fun (123).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (124).exe

"fun (124).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (125).exe

"fun (125).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (126).exe

"fun (126).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (127).exe

"fun (127).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (128).exe

"fun (128).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (129).exe

"fun (129).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (13).exe

"fun (13).exe"

C:\Users\Admin\AppData\Local\Temp\nsyACE4.tmp\downloadmr.exe

C:\Users\Admin\AppData\Local\Temp\nsyACE4.tmp\downloadmr.exe /es126548

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\RarSFX0\

C:\Users\Admin\AppData\Local\Temp\nsjADBF.tmp\downloadmr.exe

C:\Users\Admin\AppData\Local\Temp\nsjADBF.tmp\downloadmr.exe /u4dc90cd0-7328-42b2-8f65-20295bc06f26 /e2296882

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe

"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\RarSFX0\

C:\Users\Admin\AppData\Local\Temp\nsyADCE.tmp\downloadmr.exe

C:\Users\Admin\AppData\Local\Temp\nsyADCE.tmp\downloadmr.exe /u4dc9054e-38b0-4614-bdd5-20605bc06f26 /e2504568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 712

C:\program files\Internet explorer\iexplore.exe

"C:\\program files\Internet explorer\iexplore" http://en.sergiwa.com/modules/mydownloads/singlefile.php?cid=2&lid=6

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Windows\SysWOW64\regini.exe

"C:\Windows\system32\regini.exe" C:\Users\Admin\AppData\Local\Temp\$~LOGU.TMP

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:1586179 /prefetch:2

C:\Windows\SysWOW64\regini.exe

"C:\Windows\system32\regini.exe" C:\Users\Admin\AppData\Local\Temp\$~LOGI.TMP

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 456

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (131).exe

"fun (131).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (132).exe

"fun (132).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (133).exe

"fun (133).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (134).exe

"fun (134).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (135).exe

"fun (135).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (136).exe

"fun (136).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (137).exe

"fun (137).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (138).exe

"fun (138).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (139).exe

"fun (139).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (14).exe

"fun (14).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (140).exe

"fun (140).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (141).exe

"fun (141).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (142).exe

"fun (142).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (143).exe

"fun (143).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (144).exe

"fun (144).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (145).exe

"fun (145).exe"

C:\Windows\SysWOW64\rundll32.exe

rundll32 C:\Windows\PPLAYE~1.DLL,DllDelete C:\Users\Admin\AppData\Local\Temp\RarSFX0\FUC866~1.EXE

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (146).exe

"fun (146).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (147).exe

"fun (147).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (148).exe

"fun (148).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (149).exe

"fun (149).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (15).exe

"fun (15).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe

"fun (150).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (16).exe

"fun (16).exe"

C:\Windows\ad405cn\Update.exe

C:\Windows\ad405cn\Update.exe 11C454014FFDA493E62DBFFAE914C42A578E3EFDE155E8D180AFAE28B8137F369681EE45A169D55C59871473

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe

"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\RarSFX0\

C:\Windows\ad405cn\info2asp.exe

C:\Windows\ad405cn\info2asp.exe 11C454014FFDA493E62DBFFAE914C42A578E3EFDE155E8D180AFAE28B8137F369681EE45A169D55C59871473

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s C:\Windows\PPLAYE~1.DLL

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:209977 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Windows\ad405cn\iePlayer.exe

C:\Windows\ad405cn\iePlayer.exe 11C454014FFDA493E62DBFFAE914C42A578E3EFDE155E8D180AFAE28B8137F369681EE45A169D55C59871473

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s /c "C:\Program Files (x86)\Google\googletoolbar1.dll"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 324

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:3552261 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:1061992 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:734439 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:2372618 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:2765833 /prefetch:2

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:603242 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:2176009 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:2700301 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:406539 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:2438157 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:1258641 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:3617804 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:4011034 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275514 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:865311 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:1848345 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:4076558 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:996561 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:3945487 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:2503717 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:3224620 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:2241563 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:3027997 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:3355674 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:1586291 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:3814420 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:1913870 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:1520841 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:1127635 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:668717 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:1979411 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:1389671 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:3880010 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:2569228 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:2896908 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:3421208 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:2962452 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:2634769 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:1324214 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:1782799 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:1192998 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:3748873 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:2110475 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:1455312 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:537843 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:472073 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:2831390 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:3290158 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:1717271 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:930976 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:2044970 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:4142108 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:3093531 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:2307102 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:799880 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:3159057 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:3486728 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:3683338 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:4600841 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:4207630 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:4535307 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:4469772 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:4404236 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:4273164 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:4666376 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:4994059 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:4862988 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:4338707 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:4731922 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:5059606 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:5125133 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:5190677 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:4797463 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:4928543 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:5977095 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:5846027 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:5714955 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:5780496 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:5256211 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:5911569 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:6108165 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:5452819 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:6042649 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:5583884 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:5387281 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:5518348 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:6239236 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:5321754 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:6173706 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:6960134 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:5649432 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:6304777 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:6370316 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:6501386 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:7025674 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:6632460 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:6697998 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:6829066 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:6894602 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:7091228 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:6566939 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:7222285 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:7156767 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:6763542 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:7287820 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:7615493 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:6435858 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:7549958 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:7812103 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:7418902 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:7484435 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:7943180 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:7746570 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:7877653 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:7353367 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:8074247 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:8336396 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:8270859 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:8205319 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:8664068 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:8008723 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:8795137 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:8139796 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:7681053 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:8860679 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:9057283 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:9253899 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:9319432 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:8926219 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:9188360 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:8729614 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:9581570 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:8991766 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:8533010 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:8467471 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:9384976 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:9122835 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:8598561 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:8401958 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:10105863 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:10236941 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:9909260 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:10040333 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:9778185 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:10171417 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:9843727 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:9974803 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:9450522 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:10302472 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:10433549 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:9647126 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:10368020 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:9712666 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:9516071 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:11351045 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:11416579 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:10761220 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:10499082 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:11285511 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:11154438 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:11219975 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:11482117 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:10892305 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:10957842 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:10564632 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:10695703 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:11088921 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:10630176 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:11023383 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:10826786 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:11875332 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:11613193 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:11744265 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:11940878 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:12071944 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:12530691 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:12465158 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:12006413 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:12268549 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:11809809 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:12399631 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:11547670 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:12203028 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:12334100 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:12137489 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:11678753 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:12858374 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:13186053 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:12989451 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:13317124 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:13251600 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:12727313 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:12661773 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:12792850 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:13120529 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:13382670 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:13448213 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:12923936 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:13513737 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:12596253 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:13579273 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:13055007 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:14038019 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:13775883 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:13644808 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:13710350 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:14103558 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:14169096 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:14431235 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:14365700 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:14562308 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:14496775 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:13906964 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:13972506 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:14300178 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:14234648 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:14627856 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:13841450 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:15545348 /prefetch:2

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 368

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:15152133 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:15217671 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:15479817 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:15086598 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:14824455 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:15414277 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:15283214 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:15348746 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:14955531 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:15610924 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:14758930 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:14890005 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:15021073 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:14693417 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:15676450 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:16659458 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:16528389 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:16593928 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:16397324 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:16069639 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:16135176 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:16004108 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:16266249 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:15741965 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:15873036 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:15938576 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:15807500 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:16331795 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:16462882 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:16725004 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:17052675 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:16200734 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:16856070 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:17445896 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:16921609 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:16790535 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:17576962 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:17380367 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:17708036 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:17511429 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:17642511 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:17249299 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:16987164 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:17839107 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:17183772 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:17314842 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:17773598 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:17118235 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:18363394 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:18297868 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:18494466 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:17904653 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:18035729 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:18560004 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:17970192 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:18756622 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:18232347 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:18101272 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:18625547 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:18822156 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:18166824 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:18428946 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:18691095 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:19018764 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:19608580 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:19215363 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:19805187 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:19411975 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:19543055 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:18953235 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:19674121 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:19149847 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:18887715 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:19739666 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:19084313 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:19870732 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:19477529 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:19280912 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:19346468 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:20198411 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:20263947 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:20853764 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:20526086 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:20460551 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:20067340 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:20919303 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:20788235 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:20657158 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:20001817 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:20591632 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:20329490 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:20395030 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:20722713 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:19936286 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:21312514 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:20132897 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:21836805 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:21705740 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:20984843 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:21181451 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:21902351 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:21640205 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:21378063 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:21574661 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:21050392 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:21246998 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:21771287 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:21509134 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:21115934 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:21967889 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:21443621 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:22295557 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:22492164 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:22230029 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:22950918 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:22033424 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:22098961 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:23016453 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:22623243 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:22754322 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:22885393 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:22557720 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:22688784 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:22164501 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:22361118 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:22819872 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:22426650 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:23081990 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:23147526 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:23409674 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:23606281 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:23540746 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:23213071 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:23278606 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:24458241 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:24065029 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:23737356 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:23999492 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:23933956 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:23344146 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:23671829 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:23475230 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:23868429 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:23802899 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:24523787 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:24392715 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:25113603 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:24327179 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:24917010 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:24851473 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:24130568 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:24720403 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:25048083 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:24196108 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:24654874 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:24589337 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:24982561 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:24785952 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:25375754 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:24261665 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:25179147 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:26096643 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:26162181 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:25441297 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:25965582 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:25834508 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:25506831 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:25768987 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:26031125 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:25703446 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:25244716 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:25900054 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:25572373 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:25310239 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:25637918 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:26555402 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:26620943 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:26817538 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:26358794 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:26883075 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:26424336 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:26948613 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:26227728 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:26489874 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:26293268 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:26752006 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:27014153 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:27079686 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:27210761 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:26686489 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:27669511 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:27145239 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:27407376 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:27341830 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:27866118 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:28062722 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:27931652 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:27800594 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:28193796 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:28259334 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:27735066 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:28128261 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:27472911 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:27538458 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:27276313 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:27603997 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:27997210 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:28849159 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:28324869 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:28718089 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:28390420 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:29307908 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:29176838 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:28587018 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:28455943 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:29045771 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:28652559 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:28521492 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:28980236 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:29111313 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:28914715 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:28783650 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:29242401 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:29832196 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:30028813 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:29963275 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:30159885 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:30290948 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:29701131 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:29635603 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:29504547 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:29373455 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:29766673 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:29897741 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:29438991 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:29570064 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:30225425 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:30356506 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:30749702 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:30094361 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:30815237 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:30946311 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:30618639 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:31077394 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:30487561 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:31339527 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:30553101 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:30684175 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:30880783 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:31011860 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:31405061 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:31208460 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:30422044 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:31142946 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:31274007 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:31929349 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:31470599 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:31994884 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:31863830 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:31732749 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:31798289 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:31601691 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:31536151 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:32322567 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:32388102 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:32125965 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:32060442 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:32257035 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:32191504 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:32453647 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:32781325 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:31667243 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:32715791 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:32519181 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:32912390 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:33043466 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:32846874 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:33502211 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:32977932 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:33174533 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:33240068 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:33436681 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:33109002 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:33371151 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:33305616 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:32584749 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:32650285 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:34092041 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:34157572 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:33764364 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:33633291 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:34354180 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:34419723 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:34026518 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:34288659 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:34550787 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:33567756 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:33829917 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:34223127 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:33960978 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:33698855 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:34485273 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:35009542 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:34812941 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:35533827 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:35599365 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:34616326 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:34681866 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:35140616 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:35402765 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:35337222 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:35206151 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:34747418 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:34878495 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:34944027 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:35468311 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:35271698 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:35075108 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:35927048 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:36058123 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:36385798 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:36320266 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:35861519 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:36189198 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:36451335 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:36254746 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:35664909 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:36516880 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:36647939 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:35992607 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:36123684 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:35730447 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:35795991 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:36582418 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:36844549 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:37041160 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:36975624 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:36779011 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:37172232 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:37237766 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:36910098 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:37499908 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:37303301 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:37106709 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:37434374 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:37565450 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:37368843 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:37696524 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:37630988 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:36713501 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:38614019 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:38548484 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:38089742 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:38024209 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:38220814 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:37762058 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:38745100 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:37827595 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:38155292 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:38286350 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:37893138 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:37958679 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:38482977 /prefetch:2

Network

Country Destination Domain Proto
CA 69.50.175.180:80 tcp
US 8.8.8.8:53 www.whitesmoke.com udp
US 35.161.225.9:80 www.whitesmoke.com tcp
US 8.8.8.8:53 www.chrisqueen.com udp
US 34.174.54.80:80 www.chrisqueen.com tcp
US 34.174.54.80:80 www.chrisqueen.com tcp
US 8.8.8.8:53 stat.zvu.com udp
US 8.8.8.8:53 zvu.com udp
RU 178.218.223.39:80 zvu.com tcp
RU 178.218.223.39:80 zvu.com tcp
US 8.8.8.8:53 log.iobit-team.ru udp
US 8.8.8.8:53 log.iobit-team.ru udp
RU 178.218.223.39:80 zvu.com tcp
US 8.8.8.8:53 dl.zvu.com udp
RU 178.218.223.39:80 dl.zvu.com tcp
US 8.8.8.8:53 www.888.com udp
FR 18.155.129.39:80 www.888.com tcp
US 8.8.8.8:53 www.entercasino.com udp
US 8.8.8.8:53 www.entercasino.com udp
GB 217.72.240.204:80 www.entercasino.com tcp
GB 62.73.185.77:80 www.entercasino.com tcp
US 8.8.8.8:53 www.888promos.com udp
NL 217.147.127.160:80 www.888promos.com tcp
US 8.8.8.8:53 en.sergiwa.com udp
US 8.8.8.8:53 savegglss.com udp
US 8.8.8.8:53 xmlinstcp.tlbvit.com udp
US 8.8.8.8:53 satysservs.com udp
US 173.214.252.173:80 savegglss.com tcp
US 64.91.249.20:80 en.sergiwa.com tcp
US 64.91.249.20:80 en.sergiwa.com tcp
US 8.8.8.8:53 csc3-2010-crl.verisign.com udp
US 8.8.8.8:53 csc3-2010-crl.verisign.com udp
US 8.8.8.8:53 csc3-2010-crl.verisign.com udp
SE 192.229.221.95:80 csc3-2010-crl.verisign.com tcp
SE 192.229.221.95:80 csc3-2010-crl.verisign.com tcp
SE 192.229.221.95:80 csc3-2010-crl.verisign.com tcp
US 8.8.8.8:53 ww1.sergiwa.com udp
US 8.8.8.8:53 api.downloadmr.com udp
DE 64.190.63.136:80 ww1.sergiwa.com tcp
DE 64.190.63.136:80 ww1.sergiwa.com tcp
US 8.8.8.8:53 api.downloadmr.com udp
US 8.8.8.8:53 www.solimba.com udp
US 8.8.8.8:53 parking.parklogic.com udp
US 67.225.218.50:80 parking.parklogic.com tcp
US 67.225.218.50:80 parking.parklogic.com tcp
US 8.8.8.8:53 img.sedoparking.com udp
US 205.234.175.175:80 img.sedoparking.com tcp
US 205.234.175.175:80 img.sedoparking.com tcp
US 67.225.218.50:80 parking.parklogic.com tcp
US 67.225.218.50:80 parking.parklogic.com tcp
US 67.225.218.50:80 parking.parklogic.com tcp
US 67.225.218.50:80 parking.parklogic.com tcp
RU 178.218.223.39:80 dl.zvu.com tcp
RU 178.218.223.39:80 dl.zvu.com tcp
US 8.8.8.8:53 www.ddnswzplus.com udp
US 8.8.8.8:53 www.wizeniapp.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
RU 178.218.223.39:80 dl.zvu.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.daum.net udp
RU 178.218.223.39:80 dl.zvu.com tcp
US 8.8.8.8:53 service.srvmd2.com udp
KR 121.53.105.193:80 www.daum.net tcp
US 8.8.8.8:53 service.srvmd4.com udp
US 8.8.8.8:53 torangcomz.com udp
US 8.8.8.8:53 playmp3z.biz udp
US 8.8.8.8:53 ad.405.cn udp
US 8.8.8.8:53 config.poweredbysave.com udp
US 8.8.8.8:53 www.amonetizeinstaller.com udp
US 8.8.8.8:53 dw.supportbar.co.kr udp
US 8.8.8.8:53 ykgn.itplayshop.com udp
US 8.8.8.8:53 www.haole3.com udp
DE 3.64.163.50:80 www.haole3.com tcp
US 8.8.8.8:53 how2ofwealth.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 m.networkadex.com udp
US 147.135.45.118:80 m.networkadex.com tcp
US 8.8.8.8:53 u.skywo.com udp
US 8.8.8.8:53 gg.skywo.com udp
CN 60.174.238.200:80 gg.skywo.com tcp
US 8.8.8.8:53 www.sidemax.net udp
CN 60.174.238.200:80 gg.skywo.com tcp
US 8.8.8.8:53 www.k887.com udp
RU 178.218.223.39:80 dl.zvu.com tcp
RU 178.218.223.39:80 dl.zvu.com tcp
US 8.8.8.8:53 ww.cndydy.com udp
RU 178.218.223.39:80 dl.zvu.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Blaster.bat

MD5 6a83b03054f53cb002fdca262b76b102
SHA1 1bbafe19ae5bcdd4f3710f13d06332128a5d54f7
SHA256 7952248cb4ec97bc0d2ab3b51c126c7b0704a7f9d42bddf6adcb04b5657c7a4e
SHA512 fa8d907bb187f32de1cfbe1b092982072632456fd429e4dd92f62e482f2ad23e602cf845a2fd655d0e4b8314c1d7a086dc9545d4d82996afbccb364ddc1e9eae

\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe

MD5 eb790be93afb8481cfc43515b00976ab
SHA1 3e2a4c1393f7c09e5c1ae989aea0eb1d3b8c1e6d
SHA256 f6dec10d8bc56fc09673e544007654553c99848c8a211c64dbee0758ec9ddbd2
SHA512 6604a81c584bba8fcd4b96b895f29d43b311c99bcfb5065300d1f3f423b1857ce9faacea6d54e0e7b624c3c5aed1b4037ddae130e8b3499e9aca5ae4b8dcd99a

memory/1876-332-0x0000000000400000-0x000000000040D000-memory.dmp

memory/1392-330-0x0000000000400000-0x000000000040D000-memory.dmp

memory/1392-329-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (1).exe

MD5 8a84d8b3c4044c3f4eca7127d1cad349
SHA1 e3c9335b805c858bae6d64d176fcc259fa4f12ee
SHA256 7f27eac0d3e5ce33ba5dea3a0dcd07e33e7ba9b9f5783abe99d20eba9f783bd3
SHA512 fc019f613c9167ca3832e5ab4a798f8d441930f1bba246d5901a12ad36e410bab2be1b467b82aaacb57250b0eb887dc6d26265f6f4b783c937f951a3548f8879

\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe

MD5 59b6701af709b715c6dd3d5ae6f17788
SHA1 518a86ed19ac6c958a85f59afee3c5e33eedf130
SHA256 fe870fd003d28f78ebc40dc9dc7e1161fa06082b6e00d701e2a9b79a6534cc38
SHA512 ba2b36bb297d29c77d83f3d0515b458bfd93fcb12863e92664d0b6fa8abde1fb3bf0e5e944a516e7a7e63c0f04f63589bd3128bb77d85e8fbfadfd1acab08434

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (101).exe

MD5 a81757d5762a81325e322103b48fbd86
SHA1 5380155e987eca6e19cee1cebb57c7fc4951c1e1
SHA256 48dd21d65ad3f1468e7631fcd16e56e5b30165e2b5b89e27746d7630f6000576
SHA512 7f99f55dbd1a56251367f5268daf46f45f34814f8e4b66e8237041144b1fa507b48eb03714933b8ae60a63d8bfb6228521e9e39f449a7476decca9681ebe9728

memory/2796-392-0x0000000000400000-0x0000000000419000-memory.dmp

\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe

MD5 ac666aaaf78dadd6dd2d7680de65e388
SHA1 981355f87c8f7b70dd0c287470967d5cf4a53475
SHA256 bab2d07fd943a1875b6df3c7dca13b4ddf45dbc2c65bd1323746e50d1d67a724
SHA512 798a710141514f534083b43e5cd64c091eb312267dcd3b9bbbac4ece2a6bd03d326be7325f6ded9bf0fa6515adf57cd4c2f2a3820e5485e25125a66db048ac09

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe

MD5 0ec9fe4d7a6c6be6c3f5d4407cad9884
SHA1 c715cba42721a1fdb715fd802c74e6f9d3f8c87e
SHA256 dcdab4ca18760faa7d4fc04fb8add45087859644a34b91b1518a9ec2c8d4f32b
SHA512 87f57f9b1108a3c01337aedf6e9f88a1dadd4efdcaf8b5e3fd3acb43107c37ab0c099003f4792dd253903f47186a3a03dbcc8ce643437dd998e95f09c9db1812

memory/1392-401-0x00000000026E0000-0x0000000002716000-memory.dmp

memory/2716-407-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1392-406-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe

MD5 03e89666101e0d093b6140e35a1fcb1d
SHA1 b15263e5b8bbabc712ab38e50f0f270b63de2f78
SHA256 77446f95051319662e788057c6a9b1d6e82177734c4661fef3ba6eec55a0a47e
SHA512 ff0fd2e23cf566960e6f2a0c7db5fe92919225f56523a8c53d55495f44aa1822fbdacfe0908e55ba2d634f5927a03d37f71422a4970ea900b6f7fa9c45e7d7d8

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe

MD5 33aa65e837b3ee6edb71c7544d7b3b06
SHA1 03a0df0c2587b92afb12213b8103868ca6b61b78
SHA256 991bba588b19b36c03473c035ff1618395d75954c123e6fad9d7c3253381b2b8
SHA512 a34d40804ceb9a6b4c214d42f4eec9f9cc14e42de338760b403b1ab5bc3959f5d5676630f8269cca047efa5239242d4a7893449b7e88792509b82896625a0253

\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe

MD5 0794bee2d48d8aa856323d5d98c34b12
SHA1 51f035f9b2e4674816564416434bfcb355be0222
SHA256 d1c59be472c7f1ad7ca81f67959d6a7f5971a7fd22e6fdc51eb812bf4aec7042
SHA512 eb0dfea22ba6c6a61260d4efd78115f0a6f3ea976411dd5db91ab583e38a788b52fc16dd441dbd4030225a6b13135f8fc600569210a7b1bf39e22f0b3cf3ef54

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (108).exe

MD5 1196fb2d8572245fbdfec4ddfbc1f715
SHA1 18851aa1baddc1767dd6ef96f0a6498e15ee20ad
SHA256 32e13ba82b7a2af020dc3c976bc034459997eb90b36822336eb7b796bfaca0a4
SHA512 1db722c2784711f862513112de27f5747bd4166fbc69f29c9c5b69c809a8266676f8f8e7caaa3eeb10916a800c4d3cbfaedd2efec24092619602507bac0ede8d

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (109).exe

MD5 02e6ed3f8db2b0ebf0cb80528974b685
SHA1 2de7fb70bcd3ef4f6b26472c4c0fb9fc4a164703
SHA256 4b5cfb4f1b1391620a506ae23c6726e2f1131a8360a5a3fb6f4291b857e17d7c
SHA512 77eef1ccb9e52f1a0333f4af8f30b7affd650c6c8559d70377540834148a651a3a369c606ca848b9218795b3b1aa71472e66455e22b67592be34bbda3cfa4967

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (11).exe

MD5 cf0bbc3f3161920736f549b8b08a1217
SHA1 0d0f893be7aa5bdf95eda21bc3b4cf9160b1fe0f
SHA256 6ec8b47a9499381beb5cbf1dd103257d948cbd377b51dfc8feddf2b649fb3c03
SHA512 00a70ba83e06d583a8da9acefd7d610627f213595fcac113890680ae8a747cfbefcb9d65ee4bf7de90584219c89a6e3fd14d7d790d5531b339cb4b0d7c1e4f52

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe

MD5 2ce16551fc977cffdfbcab7da39fcc39
SHA1 3e7b772b836b5fc1d643341e29a63c76c3332c46
SHA256 dd59293aca4a98d401b50bf9f6412f4f7e655017d38852098ca099ae8ebc6250
SHA512 99c9cae48ae410d06bdea12717586349df5d33f74ac5158f45cfc20da76434e708f2055f71b03d2f6a3af79b029a8e18139a187fef3f5275c7c7ec22dd24c2a7

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe

MD5 a63e1124a1c422e5860d7a65c9488b44
SHA1 a3b33bc534a760322460ec1430ba1ed609dfdb52
SHA256 1390c06f9e8c454aefc7a209e0c5d62e714de34cf69b386bcf514b37fbf519bb
SHA512 2e11df2bf5b78c0d9cbec3d3ef5abaec2609d935bb3dac3eb85bc1d0aa1876557a62adcebb1bde15ba72b411dfb777a5444ddbea20234d904b89b84ebc878dbc

memory/1392-389-0x00000000002A0000-0x00000000002B9000-memory.dmp

memory/1392-381-0x00000000026E0000-0x0000000002741000-memory.dmp

memory/1608-382-0x0000000000400000-0x0000000000461000-memory.dmp

memory/1392-377-0x00000000026E0000-0x0000000002741000-memory.dmp

C:\Program Files (x86)\The Ultimate Guide To Joomla Step By Step Joomla Videos\The Ultimate Guide To Joomla Step By Step Joomla Videos.LNK

MD5 3aa139251546ecbf99eb408df6e35969
SHA1 81c0b4bd2eda79a485bc8c07852bbdee7c2e9a88
SHA256 ed19b42703839d345b6457ea7a0cf62e900a1e3e7117a2276dab079a3802d92a
SHA512 77af90005bccb97adb93b5432c4e55fe0b24ac390012a9fe5fd53c0eb54fa362221fd1bbc11337469446c884d696d99239be2be3e862c77213d214fa3dfc6f8f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB5E2F83CE9B8330B0590B7CD2E5FF2E

MD5 d474de575c39b2d39c8583c5c065498a
SHA1 5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25
SHA256 7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf
SHA512 7b9cf079b9769dfa9eb2e28cf5a4da9922b0f80e415097d326bf20547505a6ab1b7ac6a83846d0b8253e9168b1f915b8974aec844a9b31c3adcab3aec89fcd07

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB5E2F83CE9B8330B0590B7CD2E5FF2E

MD5 9cdd968009afb2d7e24c7b8c1a9a1e20
SHA1 be1126f6433710b63bb813a9ca90e36789147b95
SHA256 5bb48e837a85252b112789335d79ee07e7a1b66e3bafbf71f8482ab2e845278c
SHA512 5fc4485267f977da1e703396482a27a39feb2079eb68f6c225ed93d99dca0b9af34f04ba6a9a7ae3e68ce7f4e3e39829c5a757716dea45fa03ce776cd7245434

C:\Users\Admin\AppData\Local\Temp\Cab34C6.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

memory/544-477-0x0000000003740000-0x00000000041FA000-memory.dmp

C:\Users\Admin\AppData\Roaming\Zvu\init.xml

MD5 02c391bd3a616bbaad57ce1ff97ccf09
SHA1 e1b25739327553411d8f4d77b90dad9236cd8b78
SHA256 35d4d966523bb12aa68378dda2931cad1912f541acc44ed020b7cc605264551a
SHA512 88ffc28fdb7ffec5e50bdf680fa7e2850c20d7603ab81ddaa2010a250636fb4de70ccf1b87f4afeff1a17f47b9998f5a2ecac0ff0c6cdf75c6ca609e286e6e3e

memory/2348-514-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1392-513-0x0000000000400000-0x000000000040D000-memory.dmp

\Windows\SysWOW64\dwdsregt.exe

MD5 4a2918dc736311e8254e219cdee4958d
SHA1 40875c9bcf1c47882ce144e7ea9bca36ec9da5ed
SHA256 c737e8d15c0a17289c390c867ac223b71cdc0f1c8354661f1009f7d11c072add
SHA512 235487b7fb963f399aad9363945417830b3799d6d2aab72b2ccf8f1e98cebd39323853902a3cbc2643dadea20c2e1177cef1972ba308cf83ff4e92a84ad9bc00

memory/2740-526-0x0000000000400000-0x0000000000420000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cb7ea2f07baf9cf50d1699fe042b6265
SHA1 434cc8a1413beee36fa6c0372c041cda3f70e6d0
SHA256 c670954c469796cf573d9bd648c48b08b0c7a17cab0860240fe22aad61318636
SHA512 8ab815a3d173b481332098c4b07507aac9fbd023b99763a44679a5896279e16f457ef345e8fe8c71b52203bcec7e774cdf3d716f3615be1e6f0a11e6dcab8558

C:\Users\Admin\AppData\Local\Temp\Tar3A76.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/1876-642-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Windows\SysWOW64\msnav32.ax

MD5 9b4ed1413c3358398385bc8a0611153a
SHA1 bdc488e82a8f134ed63daaf84e4b45960b8e4e18
SHA256 0dddb9a4486f874ff77933b0f6c375240806eb2dbefdce1fcbabddf90f7a47e3
SHA512 0307db06f0c30e6f164e5992c9bf8f22e682d1d71a3ddd345b06180493ab7010d60ced9801c3cee786eff5d1fe855fca3260bd877906c5802fe1483fdcd9bbdb

memory/2796-648-0x0000000000400000-0x0000000000419000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 106629cb93be63759046fd3040f5a3f2
SHA1 53a36c0f6f09d96c67c63a76e008723e30418fa1
SHA256 4d4707ca602366bc3557b743c05fcde9863f73381d9cfc2c2c96727bce462d77
SHA512 d5c9a6b17a857d9d810a0428b0e3ce643dcd43552afef4a98bf1cbd0b8e92120b02e9a822c31fa2c073911fc671000972287522771ebcb96b5f8357f8f78339b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk

MD5 4851f08bf904edb45b813dc4142e15ad
SHA1 48b738e1d132cb564bfea31209e3d167fb986903
SHA256 021ab8f48c3eec07a6f5ec70343cb75826adf90091a850b10ea1a24ed7d5720c
SHA512 63e1dccdd631eefeda04e703d9fa19e7457a50d297b4b9e2d0abc33e0b2939c4cb0157ba3d136024d94c5e7e699eb2cbc8f832565990564e2eb0fbbd91629d1e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cd31e4a92f6582cc240bc7a883080439
SHA1 1f32fd0308560103a32058340c41b7cb2b1de27c
SHA256 7d29f3d7619c0992663e689f6c4ceb8b711d3da102ce6009ce9dc82fdcdd6634
SHA512 7e817c45e710b0e9bb854fbdc2359b084094e921781f498f8dd025e49a1ce560dc2750ed4214a882d101fc163fa57a7066a8da3f6e964ed3dfac44e7a177cd73

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 25bc8b8af5d21b01e8ac74fd10d8b3dc
SHA1 ba16127b7021ad29c79aa77b55584398c4a21b7c
SHA256 5d84baae9f3af767de8764f186cc40d9b693f116fa68e1778def3affaed1bbda
SHA512 83f022228a6dafa4d7e70dae990d8fdde395f6d9cccd996ce5a4efd035abb88ab9f7f692393e52613a9b59ed84dfa397de487076d8df411cf7746ba623f293ad

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 10a774598fd29f4aa0cf294b9a6fda6f
SHA1 96e54be828387a1de665e0c8c184013d5c0c0429
SHA256 8483b9dfc40e93953418c10d5cfac01ac78a67ffdd9aff5ca8a02b8459164609
SHA512 16082d1c887826e5a2ec5674aab0acd35bfc14ce5048a2c56ba320d88a5151e26ef1d84ddb8c1b2fb24594f3399bce5cb93c8403422857476ace9ec6a732d3a9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 637a86da1d699e1bb63a90df7aa6da49
SHA1 94c449b314483ee8bbe1a817b4315dc2853bf18e
SHA256 062b0bd3565bfcab913b6526236f5ab8002fccb152162cf284afee3ce6c7cf74
SHA512 fb932a063cebf0fd1cbfd79b2a544a4c70537c06eaf1797f74fb745eb3bbd7e29ffcb9a0934a47293a506e52fe1c196cc7c89cd7f6ebfcabb539039d86122674

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3829f36331126615d57e9188c6a7e757
SHA1 0e680680009ac673577cf645d7aeeec3b4273d6f
SHA256 2971178d56524499a960aaec4f0d14219022267e68e7cff500381448f49585ea
SHA512 e235a6900c275226334a7e23db5b86a5050b6e95e6dfcc079b70cdf3667ab7f4dd9d95495dc7df92344021dd70b1c094e29ff1dff76d2ea5e7e8d1fd8b9df7a3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 84ea5b738ecc9fa1d86dd5e994717320
SHA1 3029b16d40cbb01b7ac90a5736a7be11aec6aed6
SHA256 71be6376a2ffa6181712e875de2d7f0f94b6ee06d69412a2c0febfb3da58fb7f
SHA512 b6b856b4d63f6bd76948d8477f595e27975e375f50317a9687cc7601ce09e38536a95ceb2dea2b53b2308b6f101bba01458b111d47fc006c6e888f6c6797b9a6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e980efa08dcb034478e6c3a5d4ed2dea
SHA1 94f61b9bb789012ceaae7bbc51311a32f9443e82
SHA256 9345f68cc6f19d4739aafb47b39653600aab75dc7d25caf6b4cb0c7223e84365
SHA512 20ea8994bab07edb5e09b63ed2da895bca2c24783f7ce87d6af87c94cb3a8d3a4f3f845bf4039a284b84be0202e80745645e3657367053f0df5e12dd5a25b863

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7f87d291c60eb5ce22d5b3cab0d5ae92
SHA1 30c05da4aa52db9df8a16fece092355339711977
SHA256 59ba4897385a42564987b993fd865223737f00f69b13820a0e49e234c9c97e44
SHA512 39a4dae239e491a4cba152d0a1dc0f9ad0e426d6af03533003badc467801144f8ff0aff8c31425aaf68f7cc90ff3a7e5f114d87c9b4d5c59396ce08f25851922

memory/2716-1087-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2348-1094-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2716-1115-0x0000000002A30000-0x0000000002A66000-memory.dmp

memory/2932-1201-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1392-1200-0x00000000006F0000-0x0000000000703000-memory.dmp

memory/1392-1199-0x00000000006F0000-0x0000000000703000-memory.dmp

memory/2716-1197-0x0000000000400000-0x0000000000436000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsyACE4.tmp\downloadmr.exe

MD5 c20412a0c9d47656f9f97aa5cb7812cb
SHA1 8b55384408e93184b098559084a7746e1ab77036
SHA256 ef757b82a1db0330051d6e16468ad1e906bff88e29d919f3939742a98da87c8d
SHA512 6630ecb5bec345ac08c989d5bfaa2d718ebf89adddae34dcd4e0353668f8aff0f3d068b7bad5117a631420c8a32ebccfe9f228dd8e4b2561cbe9e947e23fbef0

C:\Users\Admin\AppData\Local\Temp\nsjAD71.tmp\blowfish.dll

MD5 5afd4a9b7e69e7c6e312b2ce4040394a
SHA1 fbd07adb3f02f866dc3a327a86b0f319d4a94502
SHA256 053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
SHA512 f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

C:\Users\Admin\AppData\Local\Temp\nsjADBF.tmp\downloadmr.exe

MD5 0fd326c9da52b48bf2d93fe975af528e
SHA1 e9b60fb463447d8a92f3884b28c542a21b8e9371
SHA256 2d26d07df002716d99c8c8d851a28510967cc9f181ace4dd7a806e9cf97304e9
SHA512 452c78cb030b08083695281e35ffe437101370426fa9ab9699a5f91e474ce016c610075e96d05d1ddaf9e76820fde70b7bf719a6fde0ee5ecad21209d70e1f1b

C:\Users\Admin\AppData\Local\Temp\nsyADCE.tmp\downloadmr.exe

MD5 7901bead3f7a8a199eb7f3c0037c027e
SHA1 aac8278236ee105267e68a823d206c908760cd92
SHA256 16ab9cc63212022fa73ba56f1b16d3d9eed436caa7ee816eab88dbd0289ca7f0
SHA512 5665a49cfbf68cfa14bbc143a646e7d1fe5aec91abe2f2143de993b03381018e90b3684d7d5d0076f3c4b44ce017a584fc400e4a65cb07b6f06205c33355a1e7

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

MD5 7cc400af60e6be05dc25a6257ee44d50
SHA1 32e9ba2f2639ebde1f1d0897bae7240d524ae066
SHA256 5a3c0250c513d29f7fbfb3cb4369da274b95a8df8bec10dd1f45ad52bd0fb220
SHA512 be90ea85d596f97c90bafec1915be7c6719188f69c15fa4450a9ed2704f7f3efc7273efa9d2b91a5cd5fe207fcf5501cd0d31f9348fd6ed5a25a08c2d273a349

C:\Users\Admin\AppData\Local\Temp\nsdAD03.tmp\INetC.dll

MD5 92ec4dd8c0ddd8c4305ae1684ab65fb0
SHA1 d850013d582a62e502942f0dd282cc0c29c4310e
SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
SHA512 581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651

C:\Users\Admin\AppData\Local\Temp\nsyAD31.tmp\System.dll

MD5 bf01b2d04e8fad306ba2f364cfc4edfa
SHA1 58f42b45ca9fc1818c4498ecd8bac088d20f2b18
SHA256 d3f9c99e0c1c9acd81a1b33bc3dbd305140def90d10485c253cf1d455f0dc903
SHA512 30ca1663d659c5efac7fed3d1aaba81c47d5d5fda77f30f021124c882b858732e17f917bfd0aa3ee7b269fad86e75b1b9388d8f916e7a4e2c9961669f2c772e7

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe

MD5 0585b1e09e1f69c50ac22f69c99273af
SHA1 d2b20c442a4c4a2797e9d0b5563487fb5d89eb48
SHA256 b9c545e59008ed546a2b17a9090d293cc7b4c872707e44c382ecb77df1263b1e
SHA512 91f39eb5ca525a0f2527837821981a9cacdaa5f803bd6f0e7a63995bd72e246fc3b8a7cec197eb21a140bc9dd8f937b86e5c469970712df62f8b8d6c97a3a277

C:\Users\Admin\AppData\Local\Temp\nsjAD71.tmp\nsProcess.dll

MD5 faa7f034b38e729a983965c04cc70fc1
SHA1 df8bda55b498976ea47d25d8a77539b049dab55e
SHA256 579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf
SHA512 7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf

C:\Users\Admin\AppData\Local\Temp\nsyAE6A.tmp\Install.dll

MD5 f04972f869093e766a0313601b3239cf
SHA1 333e2e8385b3b3f898dbe6f327a2dc55694176aa
SHA256 4a8547edbbeb197baf780e668616f47ce48c72b99af2c24d49db600ca410583c
SHA512 7b2a531a042e30ff59355712fd96c280dc27375bf039ab90ea85710c2bb823d414e4e3a01b7c7eb4c010210262692e338aacd66212274212efe921773ddb2318

C:\Users\Admin\AppData\Local\Temp\nsjB02E.tmp\System.dll

MD5 810f3a0aefe36a9f63e29e604bea91a9
SHA1 2559d3d4adf51f8ecbe2d07e669e344eb7d0bd80
SHA256 f160eb7a1b4eb8d2e99e7424ae058acd81ba5019e43cbfa0ce81e3102b356779
SHA512 836b73c38ab60260e1bc81ebf8347e14d02453fc361b7d6f10f137287b8189f8bc43758ce2d9def8fd1c71112aab7ef1930af2d64ae69f6d4e58a6fe17b310bb

C:\Users\Admin\AppData\Local\Temp\nstABDA.tmp\inetc.dll

MD5 e541458cfe66ef95ffbea40eaaa07289
SHA1 caec1233f841ee72004231a3027b13cdeb13274c
SHA256 3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420
SHA512 0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

C:\Users\Admin\AppData\Local\Temp\nstABDA.tmp\nsDialogs.dll

MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F

MD5 9077e8118f061254df5a983a1dc0d8d2
SHA1 ed3e801d482761ef3ca8796e315c3ea86e339523
SHA256 cac332c1d934ba7dbdc3cb617b81e0c73a521cecf3ecab3d91ce297244604742
SHA512 bad47d1f0f1427e0e7f822ce54ca108223eade401a2437db7863232b33c02282bc4590cd289eb4f7f5810e67bd96876d3cfca882cda68e28ea3f27bd32b152a7

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\sedo_logo[1].png

MD5 def00c11b1596db4efee6a9fbe64fc27
SHA1 bd298981e6d8d7e4ffa18abcf687041f4246672d
SHA256 95c427fa3143b1896faf42a6406686ce7602cb39052081bb32d12b51c9e047e4
SHA512 c056e95dbfa1aab3a50dff18c6d577dbffea72c93316ffc53b6b7aa41dcc7707a810d563894589a7305de0b76610f88150b2034670de368773b2b356f14ad30f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk

MD5 0366f169e5bf4a0d7ab8b5b0145f64d5
SHA1 6d97faabfe8190728a1e9e14daef16cbd629aaba
SHA256 3d90cceef90052041ef404b970c9054afd1ef2b4a643d5bbfb9be2ae695595f7
SHA512 5cabefece79c35799f5452375eaae90ba8815bb4b6d7b0322cc3bc6b84d9cfe855c04d305d1a8ca2131906209520af96fca21201da2d7d262bd7c16fde8115fd

memory/2716-1644-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1776-1651-0x0000000000400000-0x0000000000417000-memory.dmp

memory/2932-1652-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1392-1694-0x00000000006F0000-0x0000000000703000-memory.dmp

memory/1392-1695-0x00000000006F0000-0x0000000000703000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms

MD5 06f69daf7f2ffe6d5a7db2c9a27ef271
SHA1 70102ce0f95dfd90c7700402c5db5c97bce1efe2
SHA256 6fe9a841c651e3ca3497fa1ee4224a91ea3ba2ce0ef4b389093db06d8fa5d074
SHA512 aca6d9370bb19c2bb9f1f044b18f74dff431c010d7a12bad119347b5806a2bb0e6de5307b2c400e663121e03f8b9f671b9f0cd30b4163794a60abd0c7f7e5428

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a6e4d5ab56d3734b2b0ebad51b03ac54
SHA1 22070d4ea70196f95c1094f33c0f71692f6dc9a6
SHA256 d4e701c8284b26ff69787404930914530b3480ea691a9209861d9757a5bb4d8b
SHA512 edd7eee5ee07a3aa4b74e2c346660cb70b9655d6b514ef668287254a7d30f4f4a77e7ca47cf62b1206a7e450c37d01179d0d74ca3c76806ac886160fb25515d7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b56f975f7b1a3cd6aab9cf928086a0ea
SHA1 878494846540105fbbae4d9fd252cb0aa6f98990
SHA256 f5e2100aa5217fbbb31dfcf5d438c844997afd647a7950cab0a410a89c7e19a2
SHA512 076e390e789a7a5fa9284d1b2e987b6af5a929809bf343be78f6af626dac3be7c833ded6b0ad8d6f2812783d8ddad59c2c9afee98438fd137f099719b7ded60f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ed6afca727ba64d78a05d36be5a6de09
SHA1 52cbf6975a6568cecf2d10c0486e339303a42ae0
SHA256 d93cfdc7abcc38fef840867a84959e45ad40f0f8383641207243b6af2f9c718f
SHA512 ad3aefe2d8a7be0d6d717fde205b1f2c4fe04c6091dd4ffb19e4826b3a2bfe29ec2a125a636e895ae0ab3a1b27358d217b4819722811b8484f539f92d5dfbb1b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7440f4cc48bbb2d5c39079984070e625
SHA1 33a04ffdc58c4e47564a01b5468a77796698147c
SHA256 00b285279ce59ff1232a2cf7127fbc52841c89052dd882679e46b4e8c1f28a17
SHA512 07089ed826448e6c954afe357e84a98c298f721ed03193aeecb198f24d66b365de7e8787209e014f587bf3e3b43c94a0a002cf1dfc88e5b6142b0c2d26c02cda

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 45e24be32a40a901e1784558d07b37cf
SHA1 d64e2e90f9b10bad6fc6e58cea70ffc39c527936
SHA256 73073dc21a557f1dcd9cd836e7105297e726c23269b84278b76b4bf3518fd830
SHA512 0640387e7a7bc00131c12414cb5e45bd9e14ad3168511ca6aa26d65d7b712870646d8a975c4ed07af431fefd7eaf4b6fd8def5f17f21be90b12c4de830a961ea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bcbc9c1641ea06221cfd12dfd81fe1c3
SHA1 d478645bf0044bb4595e65e48cb24885d4ca4ff6
SHA256 d690227ecf05a57097a108b3bd283bddddc08ac5e2ab4cf36cc46c7a9e65e4b7
SHA512 bc569887aef11443988411d330a29da3b19ad85bcb1b97708b58e7ae5dba7135925a996d63be585b75ca4185fc901a0c01d16d443cb0452a0a66e3e5a5864243

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1cd01c68273e814fa026b7e6c12d8421
SHA1 a7edfc9b22dacea19080f9f16c2de35e8e2ba32e
SHA256 65288a894fdb89df57a73c7cab02e8689fb3cd44a98e9c12a2e46a59a9dbb7ab
SHA512 339b512b502a1877ed0e7c4dad8b50825f87cf3c37d7557b5ad49cd43192cc5fb432a685beb5a28d7509e9eda2008720710df40261e7c89351f335db9c27b68c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d48f4a2f8903ad3c1658bdafccbcbd9b
SHA1 bc5681212d409a4e897b320500740b045341dea2
SHA256 daf841335a50bd5b3f365a485b0896cb32abff0b06d92f0c407c1263c00240b4
SHA512 a716f21791c9e254f959a703f080bf1ff801208f0821d8800a0131a36f1b8337fad334c045c6da7b20583609596e05c27b504b23c8a9b2b06861814e8f0c120f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 15de8c0effd45b9aa30ad639a3b00d34
SHA1 2045e47bd14afa2867ee316b987a273675c75fbf
SHA256 d2de33f3539e31bec3436ed07e8203b5bc0a8ae185c76700041e681e894cb941
SHA512 0a7afa8e27165e5ad2459550f41fe916b30ba4b1b7519b0392eb76cfa8e9f6c4940c622451a0529ed78a4e40325f9f2abe5199173151f5f54757a6aa03d326f9

memory/3812-2172-0x0000000000400000-0x000000000043E000-memory.dmp

memory/1392-2171-0x00000000026E0000-0x000000000271E000-memory.dmp

memory/1392-2179-0x00000000006F0000-0x0000000000707000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nst3AC1.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

memory/1392-2177-0x00000000006F0000-0x0000000000707000-memory.dmp

memory/3900-2211-0x0000000000400000-0x0000000000642000-memory.dmp

memory/3788-2213-0x0000000000240000-0x0000000000287000-memory.dmp

memory/3788-2216-0x0000000000240000-0x0000000000287000-memory.dmp

memory/4024-2220-0x0000000000400000-0x00000000004C4000-memory.dmp

memory/1392-2224-0x00000000006F0000-0x000000000071F000-memory.dmp

memory/4000-2223-0x0000000000400000-0x000000000042E8B0-memory.dmp

memory/3928-2222-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4028-2221-0x0000000000AB0000-0x0000000000B0C000-memory.dmp

memory/3964-2219-0x0000000000400000-0x0000000000417000-memory.dmp

memory/1392-2218-0x00000000026E0000-0x000000000273C000-memory.dmp

memory/1392-2217-0x00000000006F0000-0x000000000071F000-memory.dmp

memory/3788-2215-0x0000000000240000-0x0000000000287000-memory.dmp

memory/1392-2214-0x00000000026E0000-0x00000000027A4000-memory.dmp

memory/1392-2212-0x00000000026E0000-0x0000000002745000-memory.dmp

memory/1392-2176-0x0000000005220000-0x0000000005462000-memory.dmp

memory/3788-2170-0x0000000000400000-0x0000000000447000-memory.dmp

memory/3768-2169-0x0000000000400000-0x0000000000452000-memory.dmp

memory/1392-2168-0x00000000026E0000-0x0000000002732000-memory.dmp

memory/1392-2167-0x00000000026E0000-0x0000000002727000-memory.dmp

memory/3928-2231-0x0000000003360000-0x0000000003E1A000-memory.dmp

memory/2356-2233-0x0000000000400000-0x0000000000419000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe

MD5 1377f82f44ba8ace2e6509e38b18d4ba
SHA1 ac0dfbca2a6cfc35989d44693a1ea6f49a08b9d8
SHA256 52ebb9a200c8eb95e96e98c364e58561379f17dd376f7027c5ec3a6b1ecf9f1e
SHA512 2963aaddeaf55ed2f2d4f349e84e3abab183fa94ceb6e326cc7063f25c23babd90df0ae0219fe0dfa74b8775bb4eb78d76aa43fefc2142b6d4e0937ab89c2039

memory/2716-2258-0x0000000000400000-0x0000000000436000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nst3AC1.tmp\ioSpecial.ini

MD5 6de108686674dcda666631c16f75dc88
SHA1 dbf7bd51b2814fde716a754f7d6970413598cc2c
SHA256 8938e3c51bd011ba004bef0df0e3d182cd9911da052328bcf604ae6ed7f81823
SHA512 4c6069667af5f5898e6fc372268ff75b5822517435f424a8afa3e9bd1523d3e083734476046e0b55290f694349f8d2a6390595435b74a1032f2191998146fd21

memory/3768-2345-0x0000000000400000-0x0000000000452000-memory.dmp

memory/3964-2347-0x00000000038F0000-0x00000000043AA000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk

MD5 2156f7bff205d76469a6d0869f40efbe
SHA1 f2ae51df4abb1329bcae7f217349dac42441ab03
SHA256 8350809006aa660ca3af8068523c8f5dc1c20637dcb47ac08fd248b350e66846
SHA512 0f3f48783de3cf8c8d0de4592bc031fc576266155a1fa8a1049f3856a99cc51c88fcd19df796e4ec6ebf8f122d6971f4e46a1774e4787f39913330d184f861c2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IW68H88T\errorPageStrings[2]

MD5 e3e4a98353f119b80b323302f26b78fa
SHA1 20ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA256 9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512 d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IW68H88T\httpErrorPagesScripts[1]

MD5 3f57b781cb3ef114dd0b665151571b7b
SHA1 ce6a63f996df3a1cccb81720e21204b825e0238c
SHA256 46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA512 8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

memory/3788-2392-0x0000000000400000-0x0000000000447000-memory.dmp

memory/3812-2393-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\setting.ini

MD5 a7725df600369b0721697269ad827b17
SHA1 4d1debe8d6af5fd2a72bacf92e1dfeaad0211741
SHA256 b61c9ee8e2a8a78015d3020fd5da7d09a5979e78ed7304047a4ce0223b1e7978
SHA512 519584d9b156f16642ea7cf6f5aa20f714933d86a3e0f164e65787242f9a8602d85e6b4dc4e05f6c0665dd77ef0e9bc040c725937cf423c5595fdaf192557ff4

memory/4000-2602-0x0000000000400000-0x000000000042E8B0-memory.dmp

memory/1392-2611-0x00000000026E0000-0x0000000002732000-memory.dmp

memory/1392-2610-0x00000000026E0000-0x0000000002727000-memory.dmp

memory/3900-2620-0x0000000000400000-0x0000000000642000-memory.dmp

memory/2716-2619-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1392-2637-0x0000000005220000-0x0000000005462000-memory.dmp

memory/1392-2638-0x00000000006F0000-0x0000000000707000-memory.dmp

memory/1392-2639-0x00000000026E0000-0x00000000027A4000-memory.dmp

memory/1392-2640-0x00000000026E0000-0x000000000273C000-memory.dmp

memory/3964-2641-0x0000000000400000-0x0000000000417000-memory.dmp

memory/4024-2642-0x0000000000400000-0x00000000004C4000-memory.dmp

memory/4028-2643-0x0000000000AB0000-0x0000000000B0C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NVDR4C1U\dnserrordiagoff[1]

MD5 47f581b112d58eda23ea8b2e08cf0ff0
SHA1 6ec1df5eaec1439573aef0fb96dabfc953305e5b
SHA256 b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928
SHA512 187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 00:52

Reported

2024-06-03 00:55

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\goggle.com trojan.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\goggle.com trojan.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows installer = "C:\\winstall.exe" C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2872 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\goggle.com trojan.exe C:\Windows\SysWOW64\cmd.exe
PID 2872 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\goggle.com trojan.exe C:\Windows\SysWOW64\cmd.exe
PID 2872 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\goggle.com trojan.exe C:\Windows\SysWOW64\cmd.exe
PID 2684 wrote to memory of 3508 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe
PID 2684 wrote to memory of 3508 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe
PID 2684 wrote to memory of 3508 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe

Processes

C:\Users\Admin\AppData\Local\Temp\goggle.com trojan.exe

"C:\Users\Admin\AppData\Local\Temp\goggle.com trojan.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Blaster.bat" "

C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe

"anr0129.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
CA 69.50.175.180:80 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Blaster.bat

MD5 6a83b03054f53cb002fdca262b76b102
SHA1 1bbafe19ae5bcdd4f3710f13d06332128a5d54f7
SHA256 7952248cb4ec97bc0d2ab3b51c126c7b0704a7f9d42bddf6adcb04b5657c7a4e
SHA512 fa8d907bb187f32de1cfbe1b092982072632456fd429e4dd92f62e482f2ad23e602cf845a2fd655d0e4b8314c1d7a086dc9545d4d82996afbccb364ddc1e9eae

C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe

MD5 eb790be93afb8481cfc43515b00976ab
SHA1 3e2a4c1393f7c09e5c1ae989aea0eb1d3b8c1e6d
SHA256 f6dec10d8bc56fc09673e544007654553c99848c8a211c64dbee0758ec9ddbd2
SHA512 6604a81c584bba8fcd4b96b895f29d43b311c99bcfb5065300d1f3f423b1857ce9faacea6d54e0e7b624c3c5aed1b4037ddae130e8b3499e9aca5ae4b8dcd99a

memory/3508-318-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (1).exe

MD5 8a84d8b3c4044c3f4eca7127d1cad349
SHA1 e3c9335b805c858bae6d64d176fcc259fa4f12ee
SHA256 7f27eac0d3e5ce33ba5dea3a0dcd07e33e7ba9b9f5783abe99d20eba9f783bd3
SHA512 fc019f613c9167ca3832e5ab4a798f8d441930f1bba246d5901a12ad36e410bab2be1b467b82aaacb57250b0eb887dc6d26265f6f4b783c937f951a3548f8879

memory/3508-321-0x0000000000400000-0x000000000040D000-memory.dmp