Malware Analysis Report

2024-07-28 05:19

Sample ID 240604-blnsgsgg67
Target 361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28.exe
SHA256 361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28
Tags
adware discovery evasion persistence spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28

Threat Level: Known bad

The file 361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28.exe was found to be: Known bad.

Malicious Activity Summary

adware discovery evasion persistence spyware stealer trojan upx

UPX dump on OEP (original entry point)

Detects executables packed with SmartAssembly

Detects executables packed with SmartAssembly

UPX dump on OEP (original entry point)

Detects executables packed with ASPack

Reads user/profile data of web browsers

Executes dropped EXE

UPX packed file

Drops startup file

Checks computer location settings

Checks BIOS information in registry

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Checks installed software on the system

Installs/modifies Browser Helper Object

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Program crash

Enumerates physical storage devices

Unsigned PE

NSIS installer

Modifies Internet Explorer settings

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer start page

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Modifies system certificate store

Checks processor information in registry

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Browser Extensions
T1176
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Subvert Trust Controls
T1553
Install Root Certificate
T1553.004
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-04 01:14

Signatures

Detects executables packed with SmartAssembly

Description Indicator Process Target
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-04 01:14

Reported

2024-06-04 01:16

Platform

win7-20240220-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28.exe"

Signatures

Detects executables packed with ASPack

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with SmartAssembly

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (149).exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk N/A N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk N/A N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\The Ultimate Guide To Joomla Step By Step Joomla Videos.LNK C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk \??\c:\windows\SysWOW64\dwdsregt.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (101).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (108).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (109).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (110).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (111).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (112).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (113).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (115).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (117).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (119).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (120).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (122).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (124).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (114).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (116).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (118).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (12).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (121).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (123).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (125).exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows installer = "C:\\winstall.exe" C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\updchecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\fun (114).exe" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (114).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adstartup = "C:\\Windows\\system32\\automove.exe" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (129).exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\KeywordSearchUpdater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\fun (144).exe" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (144).exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\ad405cn\iePlayer.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE} C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE}\ C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\ = "FlashGetBHO" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\NoExplorer = "1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{AA58ED58-01DD-4D91-8333-CF10577473F7} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{AA58ED58-01DD-4D91-8333-CF10577473F7}\ = "Google Toolbar Helper" C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax N/A N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log N/A N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log N/A N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File created C:\Windows\SysWOW64\SWin32.dll C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (129).exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File created C:\Windows\SysWOW64\sp32.xml C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (129).exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File created C:\Windows\SysWOW64\msnav32.ax C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe N/A
File created C:\Windows\SysWOW64\retpdat32.xml C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (129).exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\msnav32.ax \??\c:\windows\SysWOW64\dwdsregt.exe N/A
File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_24.log \??\c:\windows\SysWOW64\dwdsregt.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\The Ultimate Guide To Joomla Step By Step Joomla Videos C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
File opened for modification C:\Program Files (x86)\The Ultimate Guide To Joomla Step By Step Joomla Videos\Icon05112011023531.ico C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
File created C:\Program Files (x86)\The Ultimate Guide To Joomla Step By Step Joomla Videos\The Ultimate Guide To Joomla Step By Step Joomla Videos.LNK C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
File opened for modification C:\Program Files (x86)\The Ultimate Guide To Joomla Step By Step Joomla Videos\The Ultimate Guide To Joomla Step By Step Joomla Videos.LNK C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
File created C:\Program Files (x86)\HBCheckPermission.txt C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe N/A
File created C:\Program Files (x86)\The Ultimate Guide To Joomla Step By Step Joomla Videos\Icon05112011023531.ico C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe N/A
File opened for modification C:\Program Files (x86)\HBCheckPermission.txt C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe N/A
File opened for modification C:\Program Files (x86)\MyEmoticons\UMEP.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (137).exe N/A
File created C:\Program Files (x86)\Google\googletoolbar1.dll C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (14).exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\ad405cn\Update.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (139).exe N/A
File created C:\Windows\ad405cn\info2asp.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (139).exe N/A
File created C:\Windows\ad405cn\iePlayer.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (139).exe N/A
File created C:\Windows\ad405cn\ATLcom.dll C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (139).exe N/A
File created C:\Windows\PPlayer.2.1.58130.251.(508).dll C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (140).exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (12).exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (140).exe

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (149).exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (149).exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main N/A N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main N/A N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main N/A N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main N/A N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main N/A N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main N/A N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main N/A N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main N/A N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main N/A N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.k887.com/?631" C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE}\TypeLib\ = "{5ECBAEED-ED5E-4D69-B137-37ED7F5279A6}" C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009\CurVer\ = "FlashGetBHO.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA58ED58-01DD-4D91-8333-CF10577473F7}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4752D0B-C6E1-4EB2-9D56-DBBBB2346B0F}\TypeLib C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220} C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEEulas.IEEula\ = "IEEulas.IEEula" C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\0\win32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA58ED58-01DD-4D91-8333-CF10577473F7}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5ECBAEED-ED5E-4D69-B137-37ED7F5279A6}\2.0\0 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4752D0B-C6E1-4EB2-9D56-DBBBB2346B0F} C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE}\TypeLib C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\fun (150).exe" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\HELPDIR\ = "C:\\Windows" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA58ED58-01DD-4D91-8333-CF10577473F7}\ = "&Google" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\TypeLib\ = "{4ECB13A5-757F-472B-8E54-EE529A450220}" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009\CLSID\ = "{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\ = "FlashGetBHO" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\VersionIndependentProgID\ = "FlashGetBHO" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5ECBAEED-ED5E-4D69-B137-37ED7F5279A6}\2.0 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AmiBs.Boot\CurVer C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\Version\ = "1.0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\Programmable C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA58ED58-01DD-4D91-8333-CF10577473F7} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\ = "IBoot" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\TypeLib C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\ProgID\ = "FlashGetBHO.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\ = "FlashGetBHO 1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Googletoolbar.Google\ = "&Google" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\FLAGS C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4319F0D3-2E1A-427B-8A90-35B5244E42AE}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5ECBAEED-ED5E-4D69-B137-37ED7F5279A6}\2.0\0\win32\ = "C:\\Windows\\SysWow64\\IEEula.dll" C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5ECBAEED-ED5E-4D69-B137-37ED7F5279A6}\2.0\HELPDIR\ = "C:\\Windows\\system32" C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4752D0B-C6E1-4EB2-9D56-DBBBB2346B0F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\TypeLib\ = "{4ECB13A5-757F-472B-8E54-EE529A450220}" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4752D0B-C6E1-4EB2-9D56-DBBBB2346B0F}\ = "_IEEula" C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Googletoolbar.Google.1\ = "&Google" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA58ED58-01DD-4D91-8333-CF10577473F7}\ProgID\ = "Googletoolbar.Google.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4752D0B-C6E1-4EB2-9D56-DBBBB2346B0F}\TypeLib\Version = "2.0" C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE} C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\InprocServer32\ = "C:\\Windows\\PPLAYE~1.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4319F0D3-2E1A-427B-8A90-35B5244E42AE}\TypeLib\ = "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5ECBAEED-ED5E-4D69-B137-37ED7F5279A6}\2.0\HELPDIR C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B55AD4C1-9BB6-42A4-B5A0-E53FCFCCB2DE}\ProgID\ = "IEEulas.IEEula" C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4752D0B-C6E1-4EB2-9D56-DBBBB2346B0F}\ProxyStubClsid C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0\FLAGS\ = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2318C2B1-4965-11D4-9B18-009027A5CD4F} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4752D0B-C6E1-4EB2-9D56-DBBBB2346B0F}\TypeLib\Version = "2.0" C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Users\Admin\AppData\Local\Temp\nstB8F5.tmp\downloadmr.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 C:\Users\Admin\AppData\Local\Temp\nsyB8C8.tmp\downloadmr.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Users\Admin\AppData\Local\Temp\nsyB8C8.tmp\downloadmr.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 C:\Users\Admin\AppData\Local\Temp\nstB8F5.tmp\downloadmr.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (122).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (122).exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (148).exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (110).exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (148).exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (148).exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (148).exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (148).exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (148).exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (140).exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (114).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (115).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (128).exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (115).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (115).exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nstB8F5.tmp\downloadmr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nstB8F5.tmp\downloadmr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsyB8C8.tmp\downloadmr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsyB8C8.tmp\downloadmr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsyB8C6.tmp\downloadmr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsyB8C6.tmp\downloadmr.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A
N/A N/A \??\c:\windows\SysWOW64\dwdsregt.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2924 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28.exe C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28.exe C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28.exe C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe
PID 828 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe
PID 828 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe
PID 828 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe
PID 828 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe
PID 828 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe
PID 828 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe
PID 828 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe
PID 828 wrote to memory of 3024 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe
PID 828 wrote to memory of 3024 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe
PID 828 wrote to memory of 3024 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe
PID 828 wrote to memory of 3024 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe
PID 828 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (101).exe
PID 828 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (101).exe
PID 828 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (101).exe
PID 828 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (101).exe
PID 828 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe
PID 828 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe
PID 828 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe
PID 828 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe
PID 2632 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe C:\Windows\SysWOW64\WerFault.exe
PID 2632 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe C:\Windows\SysWOW64\WerFault.exe
PID 2632 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe C:\Windows\SysWOW64\WerFault.exe
PID 2632 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe C:\Windows\SysWOW64\WerFault.exe
PID 828 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe
PID 828 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe
PID 828 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe
PID 828 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe
PID 828 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe
PID 828 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe
PID 828 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe
PID 828 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe
PID 828 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe
PID 828 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe
PID 828 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe
PID 828 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe
PID 828 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe
PID 828 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe
PID 828 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe
PID 828 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe
PID 828 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe
PID 828 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe
PID 828 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe
PID 828 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe
PID 828 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe
PID 828 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe
PID 828 wrote to memory of 2672 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe
PID 828 wrote to memory of 2672 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe
PID 828 wrote to memory of 2672 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe
PID 828 wrote to memory of 2672 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe
PID 828 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (108).exe
PID 828 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (108).exe
PID 828 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (108).exe
PID 828 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (108).exe
PID 828 wrote to memory of 2436 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (109).exe
PID 828 wrote to memory of 2436 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (109).exe
PID 828 wrote to memory of 2436 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (109).exe
PID 828 wrote to memory of 2436 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (109).exe
PID 2536 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2536 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28.exe

"C:\Users\Admin\AppData\Local\Temp\361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Blaster.bat" "

C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe

"anr0129.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe

"fun (10).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe

"fun (100).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (101).exe

"fun (101).exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 116

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe

"fun (102).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe

"fun (103).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe

"fun (104).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe

"fun (105).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe

"fun (106).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe

"fun (107).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (108).exe

"fun (108).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (109).exe

"fun (109).exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.chrisqueen.com/cb/JOOMLA12/program

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe" /asService

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Windows\SysWOW64\cscript.exe

cscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 3

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 3

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (110).exe

"fun (110).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (111).exe

"fun (111).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (112).exe

"fun (112).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (113).exe

"fun (113).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (114).exe

"fun (114).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (115).exe

"fun (115).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (116).exe

"fun (116).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (117).exe

"fun (117).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (118).exe

"fun (118).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (119).exe

"fun (119).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (12).exe

"fun (12).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (120).exe

"fun (120).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (121).exe

"fun (121).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (122).exe

"fun (122).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (123).exe

"fun (123).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (124).exe

"fun (124).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (125).exe

"fun (125).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (126).exe

"fun (126).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (127).exe

"fun (127).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (128).exe

"fun (128).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (129).exe

"fun (129).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (13).exe

"fun (13).exe"

C:\Users\Admin\AppData\Local\Temp\nsyB8C8.tmp\downloadmr.exe

C:\Users\Admin\AppData\Local\Temp\nsyB8C8.tmp\downloadmr.exe /es126548

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\RarSFX0\

C:\Users\Admin\AppData\Local\Temp\nsyB8C6.tmp\downloadmr.exe

C:\Users\Admin\AppData\Local\Temp\nsyB8C6.tmp\downloadmr.exe /u4dc9054e-38b0-4614-bdd5-20605bc06f26 /e2504568

C:\Users\Admin\AppData\Local\Temp\nstB8F5.tmp\downloadmr.exe

C:\Users\Admin\AppData\Local\Temp\nstB8F5.tmp\downloadmr.exe /u4dc90cd0-7328-42b2-8f65-20295bc06f26 /e2296882

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe

"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\RarSFX0\

C:\program files\Internet explorer\iexplore.exe

"C:\\program files\Internet explorer\iexplore" http://en.sergiwa.com/modules/mydownloads/singlefile.php?cid=2&lid=6

C:\Windows\SysWOW64\regini.exe

"C:\Windows\system32\regini.exe" C:\Users\Admin\AppData\Local\Temp\$~LOGU.TMP

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275462 /prefetch:2

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 712

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Windows\SysWOW64\regini.exe

"C:\Windows\system32\regini.exe" C:\Users\Admin\AppData\Local\Temp\$~LOGI.TMP

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 456

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (131).exe

"fun (131).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (132).exe

"fun (132).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (133).exe

"fun (133).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (134).exe

"fun (134).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (135).exe

"fun (135).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (136).exe

"fun (136).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (137).exe

"fun (137).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (138).exe

"fun (138).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (139).exe

"fun (139).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (14).exe

"fun (14).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (140).exe

"fun (140).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (141).exe

"fun (141).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (142).exe

"fun (142).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (143).exe

"fun (143).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (144).exe

"fun (144).exe"

C:\Windows\SysWOW64\rundll32.exe

rundll32 C:\Windows\PPLAYE~1.DLL,DllDelete C:\Users\Admin\AppData\Local\Temp\RarSFX0\FUC866~1.EXE

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (145).exe

"fun (145).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (146).exe

"fun (146).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (147).exe

"fun (147).exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:3224591 /prefetch:2

C:\Windows\ad405cn\Update.exe

C:\Windows\ad405cn\Update.exe 11C454014FFDA493E62DBFFAE914C42A578E3EFDE155E8D180AFAE28B8137F369681EE45A169D55C59871473

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (148).exe

"fun (148).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (149).exe

"fun (149).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (15).exe

"fun (15).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (150).exe

"fun (150).exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (16).exe

"fun (16).exe"

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe

"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\RarSFX0\

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s C:\Windows\PPLAYE~1.DLL

C:\Windows\ad405cn\info2asp.exe

C:\Windows\ad405cn\info2asp.exe 11C454014FFDA493E62DBFFAE914C42A578E3EFDE155E8D180AFAE28B8137F369681EE45A169D55C59871473

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:3683342 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:3159057 /prefetch:2

C:\Windows\ad405cn\iePlayer.exe

C:\Windows\ad405cn\iePlayer.exe 11C454014FFDA493E62DBFFAE914C42A578E3EFDE155E8D180AFAE28B8137F369681EE45A169D55C59871473

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:3093530 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:2765838 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:2700300 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:2634764 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s /c "C:\Program Files (x86)\Google\googletoolbar1.dll"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:2896912 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:2962446 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:2831379 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:3027986 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:2569226 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:3879946 /prefetch:2

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:3814410 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:4011016 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:3748874 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:3290121 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:3945485 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:4142089 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:4076556 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:3355657 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:3421193 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:3486729 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:3552265 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:3617801 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:1717257 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:1782793 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:1848329 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:1913865 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:1979401 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:2044937 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:2110473 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:2241544 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:2176010 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:2307081 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:2372617 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:2438153 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:2503689 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:996361 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:1061897 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:1127433 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:1192969 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:1258505 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:1324041 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:1389577 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:1455113 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:1520649 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:1586185 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:1651721 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:406544 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275471 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:472077 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:603145 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:668681 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:734217 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:799753 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:865289 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:930825 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:4273160 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:5125128 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:5059592 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:4994056 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:4928520 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:4862984 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:4797448 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:4731912 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:537612 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:4666377 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:4600840 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:4535304 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:4207625 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:4338695 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:4404231 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:4469767 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:5190663 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:6108164 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:6042628 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:5977092 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:5911556 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:5846020 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:5780484 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:5714948 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:5649412 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:5583876 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:5387270 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:5321734 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:5256198 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:5518341 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:5452806 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:6173699 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:6239235 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:6304771 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:6370307 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:6435843 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:6501379 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:6566915 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:6632451 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:6697987 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:6763523 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:6829059 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:6894595 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:6960131 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:7025667 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:7091203 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:7156739 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:7222275 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:7287811 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:7353347 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:7418883 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:7484419 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:7549955 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:7615491 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:7681027 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:7746563 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:7812099 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:7877635 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:7943171 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:8008707 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:8074243 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:8139779 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:8205315 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:8270851 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:8336387 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:8401923 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:8467459 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:8532995 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:8598531 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:8664067 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:8729603 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:8795139 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:8860675 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:8926211 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:8991747 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:9057283 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:9122819 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:9188355 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:9253891 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:9319427 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:9384963 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:9450499 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:9516035 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:9581571 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:9647107 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:9712643 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:9778179 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:9843715 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:9909251 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:9974787 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:10040323 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:10105859 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:10171395 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:10236931 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:10302467 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:10368003 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:10433539 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:10499075 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:10564611 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:10630147 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:10695683 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:10761219 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:10826755 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:10892291 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:10957827 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:11023363 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:11088899 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:11154435 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:11219971 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:11285507 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:11351043 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:11416579 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:11482115 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:11547651 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:11613187 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:11678723 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:11744259 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:11809795 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:11875331 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:11940867 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:12006403 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:12071939 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:12203010 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:12268546 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:12137477 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:12334083 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:12399619 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:12465155 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:12530691 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:12596227 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:12661763 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:12727299 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:12792835 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:12858371 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:12923907 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:12989443 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:13054979 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:13120515 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:13186051 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:13251587 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:13317123 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:13382659 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:13448195 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:13513731 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:13579267 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:13644803 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:13710339 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:13775875 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:13841411 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:13906947 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:13972483 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:14038019 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:14103555 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:14169091 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:14234627 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:14300163 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:14365699 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:14431235 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:14496771 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:14562307 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:14627843 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:14693379 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:14758915 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:14824451 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:14889987 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:14955523 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:15021059 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:15086595 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:15152131 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:15217667 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:15283203 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:15348739 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:15414275 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:15479811 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:15545347 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:15610883 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:15676419 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:15741955 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:15807491 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:15873027 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:15938563 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:16004099 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:16069635 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:16135171 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:16200707 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:16266243 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:16331779 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:16397315 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:16462851 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:16528387 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:16593923 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:16659459 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:16724995 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:16790531 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:16856067 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:16921603 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:16987139 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17052675 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17118211 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17183747 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17249283 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17314819 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17380355 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17445891 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17511427 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17576963 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17642499 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17708035 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17773571 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17839107 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17904643 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17970179 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:18035715 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:18101251 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:18166787 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:18232323 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:18297859 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:18363395 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:18428931 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:18494467 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:18560003 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:18625539 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:18691075 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:18756611 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:18822147 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:18887683 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:18953219 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:19018755 /prefetch:2

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 368

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:19084291 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:19149827 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:19215363 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:19280899 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:19346435 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:19411971 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:19477507 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:19543043 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:19608579 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:19674115 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:19739651 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:19805187 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:19870723 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:19936259 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:20001795 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:20067331 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:20132867 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:20198403 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:20263939 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:20329475 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:20395011 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:20460547 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:20526083 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:20591619 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:20657155 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:20722691 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:20788227 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:20853763 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:20919299 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:20984835 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:21050371 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:21115907 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:21181443 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:21246979 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:21312515 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:21378051 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:21443587 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:21509123 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:21574659 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:21640195 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:21705731 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:21771267 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:21836803 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:21902339 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:21967875 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:22033411 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:22098947 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:22164483 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:22230019 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:22295555 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:22361091 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:22426627 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:22492163 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:22557699 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:22623235 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:22688771 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:22754307 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:22819843 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:22885379 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:22950915 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:23016451 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:23081987 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:23147523 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:23213059 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:23278595 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:23344131 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:23409667 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:23475203 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:23540739 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:23606275 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:23671811 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:23737347 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:23802883 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:23868419 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:23933955 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:23999491 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:24065027 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:24130563 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:24196099 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:24261635 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:24327171 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:24392707 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:24458243 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:24523779 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:24589315 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:24654851 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:24720387 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:24785923 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:24916994 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:24851460 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:24982531 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:25048067 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:25113603 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:25179139 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:25244675 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:25310211 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:25375747 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:25441283 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:25506819 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:25572355 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:25637891 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:25703427 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:25768963 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:25834499 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:25900035 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:25965571 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:26031107 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:26096643 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:26162179 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:26227715 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:26293251 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:26358787 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:26424323 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:26489859 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:26555395 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:26620931 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:26686467 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:26752003 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:26817539 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:26883075 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:26948611 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:27014147 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:27079683 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:27145219 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:27210755 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:27276291 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:27341827 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:27407363 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:27472899 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:27538435 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:27603971 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:27669507 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:27735043 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:27800579 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:27866115 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:27931651 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:27997187 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:28062723 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:28128259 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:28193795 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:28259331 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:28324867 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:28390403 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:28455939 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:28521475 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:28587011 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:28718082 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:28652548 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:28783619 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:28849155 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:28914691 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:28980227 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:29045763 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:29111299 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:29176835 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:29242371 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:29307907 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:29373443 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:29504514 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:29570050 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:29438981 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:29635587 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:29701123 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:29766659 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:29832195 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:29897731 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:29963267 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:30028803 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:30094339 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:30159875 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:30225411 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:30290947 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:30356483 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:30422019 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:30487555 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:30553091 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:30618627 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:30684163 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:30749699 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:30815235 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:30880771 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:30946307 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:31011843 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:31077379 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:31142915 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:31208451 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:31273987 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:31339523 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:31405059 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:31470595 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:31536131 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:31601667 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:31667203 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:31732739 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:31798275 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:31863811 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:31929347 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:31994883 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:32060419 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:32125955 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:32191491 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:32257027 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:32322563 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:32388099 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:32453635 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:32519171 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:32584707 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:32650243 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:32715779 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:32781315 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:32846851 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:32912387 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:32977923 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:33043459 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:33108995 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:33174531 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:33240067 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:33305603 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:33371139 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:33436675 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:33502211 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:33567747 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:33633283 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:33698819 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:33764355 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:33829891 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:33895427 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:33960963 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:34026499 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:34092035 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:34157571 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:34223107 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:34288643 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:34354179 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:34419715 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:34485251 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:34550787 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:34616323 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:34681859 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:34747395 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:34812931 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:34878467 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:34944003 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:35009539 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:35075075 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:35140611 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:35206147 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:35271683 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:35337219 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:35402755 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:35468291 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:35533827 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:35599363 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:35664899 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:35730435 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:35795971 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:35861507 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:35927043 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:35992579 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:36058115 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:36123651 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:36189187 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:36254723 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:36320259 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:36385795 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:36451331 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:36582402 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:36516868 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:36647939 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:36713475 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:36779011 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:36844547 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:36910083 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:36975619 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:37041155 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:37106691 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:37172227 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:37237763 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:37303299 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:37368835 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:37434371 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:37499907 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:37565443 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:37630979 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:37696515 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:37762051 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:37827587 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:37893123 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:37958659 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:38024195 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:38089731 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:38155267 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:38220803 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:38286339 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:38351875 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:38417411 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:38482947 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:38548483 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:38614019 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:38679555 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:38745091 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:38810627 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:38876163 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:38941699 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:39007235 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:39072771 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:39138307 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:39203843 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:39269379 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:39334915 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:39400451 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:39465987 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:39531523 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:39597059 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:39662595 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:39728131 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:39793667 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:39859203 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:39924739 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:39990275 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:40055811 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:40121347 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:40186883 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:40252419 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:40317955 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:40383491 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:40449027 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:40514563 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:40580099 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:40645635 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:40711171 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:40776707 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:40842243 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:40907779 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:40973315 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:41038851 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:41104387 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:41169923 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:41235459 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:41300995 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:41366531 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:41432067 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:41497603 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:41563139 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:41628675 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:41694211 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:41759747 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:41825283 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:41890819 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:41956355 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:42021891 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:42087427 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:42152963 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:42218499 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:42284035 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:42349571 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:42415107 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:42480643 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:42546179 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:42611715 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:42742786 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:42677252 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:42808323 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:42939401 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:43004931 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:43070467 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:43136003 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:43201539 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:43267075 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:43332611 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:43398147 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:43463683 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:43529219 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:43594755 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:43660291 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:43725827 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:43791363 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:43856899 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:43922435 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:43987971 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:44053507 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:44119043 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:44184579 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:44250115 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:44315651 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:44381187 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:44446723 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:44512259 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:44577795 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:44643331 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:44708867 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:44774403 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:44839939 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:44905475 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:44971011 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:45036547 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:45102083 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:45167619 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:45233155 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:45298691 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:45364227 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:45429763 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:45495299 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:45560835 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:45626371 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:45691907 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:45757443 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:45822979 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:45888515 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:45954051 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:46019587 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:46085123 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:46150659 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:46216195 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:46281731 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:46347267 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:46412803 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:46478339 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:46543875 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:46609411 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:46674947 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:46740483 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:46806019 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:46871555 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:46937091 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:47002627 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:47068163 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:47133699 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:47199235 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:47264771 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:47330307 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:47395843 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:47461379 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:47526915 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:47592451 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:47657987 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:47723523 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:47789059 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:47854595 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:47920131 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:47985667 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:48051203 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:48116739 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:48182275 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:48247811 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:48313347 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:48378883 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:48444419 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:48509955 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:48575491 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:48641027 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:48706563 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:48772099 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:48837635 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:48903171 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:48968707 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:49034243 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:49099779 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:49165315 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:49230851 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:49296387 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:49361923 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:49427459 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:49492995 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:49558531 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:49624067 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:49689603 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:49755139 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:49820675 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:49886211 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:49951747 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:50017283 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:50082819 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:50148355 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:50213891 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:50279427 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:50344963 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:50410499 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:50476035 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:50541571 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:50607107 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:50672643 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:50738179 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:50803715 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:50869251 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:50934787 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:51000323 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:51065859 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:51131395 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:51196931 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:51262467 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:51328003 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:51393539 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:51459075 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:51524611 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:51590147 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:51655683 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:51721219 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:51786755 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:51852291 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:51917827 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:51983363 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:52048899 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:52114435 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:52179971 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:52245507 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:52311043 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:52376579 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:52442115 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:52507651 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:52573187 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:52638723 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:52704259 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:52769795 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:52835331 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:52900867 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:52966403 /prefetch:2

\??\c:\windows\SysWOW64\dwdsregt.exe

c:\windows\system32\dwdsregt.exe FI002

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:53031939 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:53097475 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:53163011 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:53228547 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:53294083 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:53359619 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:53425155 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:53490691 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:53556227 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:53621763 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:53687299 /prefetch:2

Network

Country Destination Domain Proto
CA 69.50.175.180:80 tcp
US 8.8.8.8:53 www.whitesmoke.com udp
US 34.217.252.125:80 www.whitesmoke.com tcp
US 8.8.8.8:53 www.chrisqueen.com udp
US 34.174.54.80:80 www.chrisqueen.com tcp
US 34.174.54.80:80 www.chrisqueen.com tcp
US 8.8.8.8:53 stat.zvu.com udp
US 8.8.8.8:53 zvu.com udp
RU 178.218.223.39:80 zvu.com tcp
RU 178.218.223.39:80 zvu.com tcp
US 8.8.8.8:53 log.iobit-team.ru udp
US 8.8.8.8:53 log.iobit-team.ru udp
RU 178.218.223.39:80 zvu.com tcp
US 34.174.54.80:80 www.chrisqueen.com tcp
US 8.8.8.8:53 dl.zvu.com udp
RU 178.218.223.39:80 dl.zvu.com tcp
RU 178.218.223.39:80 dl.zvu.com tcp
RU 178.218.223.39:80 dl.zvu.com tcp
US 8.8.8.8:53 satysservs.com udp
US 8.8.8.8:53 www.888.com udp
US 8.8.8.8:53 www.888.com udp
US 8.8.8.8:53 xmlinstcp.tlbvit.com udp
US 8.8.8.8:53 savegglss.com udp
GB 18.154.84.62:80 www.888.com tcp
US 8.8.8.8:53 www.entercasino.com udp
US 8.8.8.8:53 www.entercasino.com udp
GB 62.73.185.77:80 www.entercasino.com tcp
GB 62.73.185.77:80 www.entercasino.com tcp
US 173.214.252.173:80 savegglss.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 en.sergiwa.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.888promos.com udp
NL 217.147.127.160:80 www.888promos.com tcp
US 64.91.249.20:80 en.sergiwa.com tcp
US 64.91.249.20:80 en.sergiwa.com tcp
US 8.8.8.8:53 ww1.sergiwa.com udp
DE 64.190.63.136:80 ww1.sergiwa.com tcp
DE 64.190.63.136:80 ww1.sergiwa.com tcp
US 8.8.8.8:53 csc3-2010-crl.verisign.com udp
US 8.8.8.8:53 csc3-2010-crl.verisign.com udp
US 8.8.8.8:53 csc3-2010-crl.verisign.com udp
US 8.8.8.8:53 fuhof.s3.amazonaws.com udp
SE 192.229.221.95:80 csc3-2010-crl.verisign.com tcp
SE 192.229.221.95:80 csc3-2010-crl.verisign.com tcp
SE 192.229.221.95:80 csc3-2010-crl.verisign.com tcp
US 52.216.59.121:80 fuhof.s3.amazonaws.com tcp
US 8.8.8.8:53 api.downloadmr.com udp
US 8.8.8.8:53 api.downloadmr.com udp
US 8.8.8.8:53 www.solimba.com udp
US 8.8.8.8:53 www.ddnswzplus.com udp
US 8.8.8.8:53 www.wizeniapp.com udp
US 8.8.8.8:53 www.daum.net udp
RU 178.218.223.39:80 dl.zvu.com tcp
RU 178.218.223.39:80 dl.zvu.com tcp
US 8.8.8.8:53 service.srvmd2.com udp
US 8.8.8.8:53 service.srvmd2.com udp
US 8.8.8.8:53 service.srvmd4.com udp
US 8.8.8.8:53 ad.405.cn udp
US 8.8.8.8:53 www.haole3.com udp
US 8.8.8.8:53 torangcomz.com udp
US 8.8.8.8:53 how2ofwealth.com udp
US 8.8.8.8:53 playmp3z.biz udp
KR 211.249.220.24:80 www.daum.net tcp
DE 3.64.163.50:80 www.haole3.com tcp
US 8.8.8.8:53 config.poweredbysave.com udp
US 8.8.8.8:53 www.amonetizeinstaller.com udp
US 8.8.8.8:53 egpqp.itplayshop.com udp
US 8.8.8.8:53 dw.supportbar.co.kr udp
US 8.8.8.8:53 u.skywo.com udp
US 8.8.8.8:53 gg.skywo.com udp
CN 60.174.238.200:80 gg.skywo.com tcp
CN 60.174.238.200:80 gg.skywo.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
SE 192.229.221.95:80 csc3-2010-crl.verisign.com tcp
US 8.8.8.8:53 www.microsoft.com udp
BE 23.55.97.181:80 www.microsoft.com tcp
BE 23.55.97.181:443 www.microsoft.com tcp
BE 23.55.97.181:80 www.microsoft.com tcp
BE 23.55.97.181:443 www.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 m.networkadex.com udp
US 147.135.45.118:80 m.networkadex.com tcp
US 8.8.8.8:53 www.sidemax.net udp
US 8.8.8.8:53 www.k887.com udp
RU 178.218.223.39:80 dl.zvu.com tcp
RU 178.218.223.39:80 dl.zvu.com tcp
US 8.8.8.8:53 update.torangcomz.com udp
US 8.8.8.8:53 ww.cndydy.com udp
RU 178.218.223.39:80 dl.zvu.com tcp
BE 23.55.97.181:80 www.microsoft.com tcp
BE 23.55.97.181:443 www.microsoft.com tcp
US 147.135.45.118:80 m.networkadex.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Blaster.bat

MD5 6a83b03054f53cb002fdca262b76b102
SHA1 1bbafe19ae5bcdd4f3710f13d06332128a5d54f7
SHA256 7952248cb4ec97bc0d2ab3b51c126c7b0704a7f9d42bddf6adcb04b5657c7a4e
SHA512 fa8d907bb187f32de1cfbe1b092982072632456fd429e4dd92f62e482f2ad23e602cf845a2fd655d0e4b8314c1d7a086dc9545d4d82996afbccb364ddc1e9eae

C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe

MD5 eb790be93afb8481cfc43515b00976ab
SHA1 3e2a4c1393f7c09e5c1ae989aea0eb1d3b8c1e6d
SHA256 f6dec10d8bc56fc09673e544007654553c99848c8a211c64dbee0758ec9ddbd2
SHA512 6604a81c584bba8fcd4b96b895f29d43b311c99bcfb5065300d1f3f423b1857ce9faacea6d54e0e7b624c3c5aed1b4037ddae130e8b3499e9aca5ae4b8dcd99a

memory/828-330-0x0000000000170000-0x000000000017D000-memory.dmp

memory/828-331-0x0000000000170000-0x000000000017D000-memory.dmp

memory/960-332-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (1).exe

MD5 8a84d8b3c4044c3f4eca7127d1cad349
SHA1 e3c9335b805c858bae6d64d176fcc259fa4f12ee
SHA256 7f27eac0d3e5ce33ba5dea3a0dcd07e33e7ba9b9f5783abe99d20eba9f783bd3
SHA512 fc019f613c9167ca3832e5ab4a798f8d441930f1bba246d5901a12ad36e410bab2be1b467b82aaacb57250b0eb887dc6d26265f6f4b783c937f951a3548f8879

\Users\Admin\AppData\Local\Temp\RarSFX0\fun (10).exe

MD5 59b6701af709b715c6dd3d5ae6f17788
SHA1 518a86ed19ac6c958a85f59afee3c5e33eedf130
SHA256 fe870fd003d28f78ebc40dc9dc7e1161fa06082b6e00d701e2a9b79a6534cc38
SHA512 ba2b36bb297d29c77d83f3d0515b458bfd93fcb12863e92664d0b6fa8abde1fb3bf0e5e944a516e7a7e63c0f04f63589bd3128bb77d85e8fbfadfd1acab08434

memory/828-375-0x0000000002CF0000-0x0000000002D51000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (101).exe

MD5 a81757d5762a81325e322103b48fbd86
SHA1 5380155e987eca6e19cee1cebb57c7fc4951c1e1
SHA256 48dd21d65ad3f1468e7631fcd16e56e5b30165e2b5b89e27746d7630f6000576
SHA512 7f99f55dbd1a56251367f5268daf46f45f34814f8e4b66e8237041144b1fa507b48eb03714933b8ae60a63d8bfb6228521e9e39f449a7476decca9681ebe9728

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (105).exe

MD5 0ec9fe4d7a6c6be6c3f5d4407cad9884
SHA1 c715cba42721a1fdb715fd802c74e6f9d3f8c87e
SHA256 dcdab4ca18760faa7d4fc04fb8add45087859644a34b91b1518a9ec2c8d4f32b
SHA512 87f57f9b1108a3c01337aedf6e9f88a1dadd4efdcaf8b5e3fd3acb43107c37ab0c099003f4792dd253903f47186a3a03dbcc8ce643437dd998e95f09c9db1812

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (104).exe

MD5 03e89666101e0d093b6140e35a1fcb1d
SHA1 b15263e5b8bbabc712ab38e50f0f270b63de2f78
SHA256 77446f95051319662e788057c6a9b1d6e82177734c4661fef3ba6eec55a0a47e
SHA512 ff0fd2e23cf566960e6f2a0c7db5fe92919225f56523a8c53d55495f44aa1822fbdacfe0908e55ba2d634f5927a03d37f71422a4970ea900b6f7fa9c45e7d7d8

\Users\Admin\AppData\Local\Temp\RarSFX0\fun (106).exe

MD5 33aa65e837b3ee6edb71c7544d7b3b06
SHA1 03a0df0c2587b92afb12213b8103868ca6b61b78
SHA256 991bba588b19b36c03473c035ff1618395d75954c123e6fad9d7c3253381b2b8
SHA512 a34d40804ceb9a6b4c214d42f4eec9f9cc14e42de338760b403b1ab5bc3959f5d5676630f8269cca047efa5239242d4a7893449b7e88792509b82896625a0253

\Users\Admin\AppData\Local\Temp\RarSFX0\fun (107).exe

MD5 0794bee2d48d8aa856323d5d98c34b12
SHA1 51f035f9b2e4674816564416434bfcb355be0222
SHA256 d1c59be472c7f1ad7ca81f67959d6a7f5971a7fd22e6fdc51eb812bf4aec7042
SHA512 eb0dfea22ba6c6a61260d4efd78115f0a6f3ea976411dd5db91ab583e38a788b52fc16dd441dbd4030225a6b13135f8fc600569210a7b1bf39e22f0b3cf3ef54

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (109).exe

MD5 02e6ed3f8db2b0ebf0cb80528974b685
SHA1 2de7fb70bcd3ef4f6b26472c4c0fb9fc4a164703
SHA256 4b5cfb4f1b1391620a506ae23c6726e2f1131a8360a5a3fb6f4291b857e17d7c
SHA512 77eef1ccb9e52f1a0333f4af8f30b7affd650c6c8559d70377540834148a651a3a369c606ca848b9218795b3b1aa71472e66455e22b67592be34bbda3cfa4967

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (108).exe

MD5 1196fb2d8572245fbdfec4ddfbc1f715
SHA1 18851aa1baddc1767dd6ef96f0a6498e15ee20ad
SHA256 32e13ba82b7a2af020dc3c976bc034459997eb90b36822336eb7b796bfaca0a4
SHA512 1db722c2784711f862513112de27f5747bd4166fbc69f29c9c5b69c809a8266676f8f8e7caaa3eeb10916a800c4d3cbfaedd2efec24092619602507bac0ede8d

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (11).exe

MD5 cf0bbc3f3161920736f549b8b08a1217
SHA1 0d0f893be7aa5bdf95eda21bc3b4cf9160b1fe0f
SHA256 6ec8b47a9499381beb5cbf1dd103257d948cbd377b51dfc8feddf2b649fb3c03
SHA512 00a70ba83e06d583a8da9acefd7d610627f213595fcac113890680ae8a747cfbefcb9d65ee4bf7de90584219c89a6e3fd14d7d790d5531b339cb4b0d7c1e4f52

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (103).exe

MD5 ac666aaaf78dadd6dd2d7680de65e388
SHA1 981355f87c8f7b70dd0c287470967d5cf4a53475
SHA256 bab2d07fd943a1875b6df3c7dca13b4ddf45dbc2c65bd1323746e50d1d67a724
SHA512 798a710141514f534083b43e5cd64c091eb312267dcd3b9bbbac4ece2a6bd03d326be7325f6ded9bf0fa6515adf57cd4c2f2a3820e5485e25125a66db048ac09

memory/2028-404-0x0000000000400000-0x0000000000436000-memory.dmp

memory/828-403-0x0000000000610000-0x0000000000646000-memory.dmp

memory/2608-402-0x0000000000400000-0x0000000000419000-memory.dmp

memory/828-386-0x0000000000230000-0x0000000000249000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (102).exe

MD5 a63e1124a1c422e5860d7a65c9488b44
SHA1 a3b33bc534a760322460ec1430ba1ed609dfdb52
SHA256 1390c06f9e8c454aefc7a209e0c5d62e714de34cf69b386bcf514b37fbf519bb
SHA512 2e11df2bf5b78c0d9cbec3d3ef5abaec2609d935bb3dac3eb85bc1d0aa1876557a62adcebb1bde15ba72b411dfb777a5444ddbea20234d904b89b84ebc878dbc

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (100).exe

MD5 2ce16551fc977cffdfbcab7da39fcc39
SHA1 3e7b772b836b5fc1d643341e29a63c76c3332c46
SHA256 dd59293aca4a98d401b50bf9f6412f4f7e655017d38852098ca099ae8ebc6250
SHA512 99c9cae48ae410d06bdea12717586349df5d33f74ac5158f45cfc20da76434e708f2055f71b03d2f6a3af79b029a8e18139a187fef3f5275c7c7ec22dd24c2a7

memory/2632-382-0x0000000000400000-0x0000000000461000-memory.dmp

memory/828-381-0x0000000002CF0000-0x0000000002D51000-memory.dmp

C:\Program Files (x86)\The Ultimate Guide To Joomla Step By Step Joomla Videos\The Ultimate Guide To Joomla Step By Step Joomla Videos.LNK

MD5 3aa139251546ecbf99eb408df6e35969
SHA1 81c0b4bd2eda79a485bc8c07852bbdee7c2e9a88
SHA256 ed19b42703839d345b6457ea7a0cf62e900a1e3e7117a2276dab079a3802d92a
SHA512 77af90005bccb97adb93b5432c4e55fe0b24ac390012a9fe5fd53c0eb54fa362221fd1bbc11337469446c884d696d99239be2be3e862c77213d214fa3dfc6f8f

memory/3024-477-0x0000000003900000-0x00000000043BA000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB5E2F83CE9B8330B0590B7CD2E5FF2E

MD5 d474de575c39b2d39c8583c5c065498a
SHA1 5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25
SHA256 7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf
SHA512 7b9cf079b9769dfa9eb2e28cf5a4da9922b0f80e415097d326bf20547505a6ab1b7ac6a83846d0b8253e9168b1f915b8974aec844a9b31c3adcab3aec89fcd07

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB5E2F83CE9B8330B0590B7CD2E5FF2E

MD5 2c3f21f68d4207ce87d7cff27dd1c3be
SHA1 fbe48ce566e5e6803cc51b6897c177299fa834d9
SHA256 0eea0f0db7f17b03ecbec17143750e879f15670a64dc0f4aa5267bbe6ee680f0
SHA512 58dc23fb47e50dc46c75b3e707aa2e9852e07582b8645c2720fae2dc71434951cde2c8d3e946f7659abab72418f20db52c1d1f15ac7b5b111252491e6b5cb4b2

C:\Users\Admin\AppData\Local\Temp\Cab27EB.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ab22eb7fe0db695c0a6db4808944f9ee
SHA1 5fb7cb29a6912e346a9ff71bc9a688b949062dcf
SHA256 7dbd2e5977a6110cbdc5b4ddec961616dbce46b1c0ddc2028ba903b1724d1211
SHA512 d036cbc04e5cb7784fb333577d1a19dc6593f5463196c69bb0537b3f717ee2dfa7f5cd5d1e9ce32050c6400ce024e1a09b3296e6bc648ed92311d2d842649a7c

C:\Users\Admin\AppData\Roaming\Zvu\init.xml

MD5 02c391bd3a616bbaad57ce1ff97ccf09
SHA1 e1b25739327553411d8f4d77b90dad9236cd8b78
SHA256 35d4d966523bb12aa68378dda2931cad1912f541acc44ed020b7cc605264551a
SHA512 88ffc28fdb7ffec5e50bdf680fa7e2850c20d7603ab81ddaa2010a250636fb4de70ccf1b87f4afeff1a17f47b9998f5a2ecac0ff0c6cdf75c6ca609e286e6e3e

memory/2028-552-0x00000000020D0000-0x0000000002106000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D

MD5 9cf11adbd2c7aff9a231b62b2aa08161
SHA1 a5b8e86cb2eb9f4da95ac89458ca6511b2bb7525
SHA256 3a50acfd39400e307a67cf9ba393ebb05901f49abcfc9562e21de4793d4c30f1
SHA512 3664b81c9ca915ffef37f1cabd5f53ac90473e6814f442f81d7f405ffb337b2d7c6c3d8ccc0190b4ca7206775dad796c483b95574400ab2ce75736091b569179

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D

MD5 b55c758557c6a61474541c99dec03912
SHA1 6b59f1f88c7f9829ac087fb537dbbacf7160e105
SHA256 14a4583967532cb0db1d6c4d09aaa322b69f19c1b153b987640f144cc32bc33d
SHA512 97657b462e50a4c18fab1ebd5afc2ca7bc2ddf5060be713a9cccacc9423f8e63c7d1ddf7c29a24690ae8dd54969b3c54782609e415363002b5f952d6c97100c6

memory/280-559-0x0000000000400000-0x0000000000436000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tar2A21.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Windows\SysWOW64\dwdsregt.exe

MD5 73592b11e2759371981471c9d0618c58
SHA1 74af454edc6ab6cfde2fb4c63a9c193fa67c86f9
SHA256 755e8430cd456a57265e6353c422af9c153d059b2dbb3efd3376fe1bf7e6afa5
SHA512 bf265bee6b25d541dfa06063ad4ec6539fd3a750a55b592ad802d02528921c76e24541d827991dec2c9d76cab321d58e537eea91d469cb1b2c45deb9411205c6

memory/2536-626-0x0000000000400000-0x0000000000420000-memory.dmp

memory/960-641-0x0000000000400000-0x000000000040D000-memory.dmp

memory/828-640-0x0000000000170000-0x000000000017D000-memory.dmp

memory/828-639-0x0000000000170000-0x000000000017D000-memory.dmp

C:\Windows\SysWOW64\msnav32.ax

MD5 9b4ed1413c3358398385bc8a0611153a
SHA1 bdc488e82a8f134ed63daaf84e4b45960b8e4e18
SHA256 0dddb9a4486f874ff77933b0f6c375240806eb2dbefdce1fcbabddf90f7a47e3
SHA512 0307db06f0c30e6f164e5992c9bf8f22e682d1d71a3ddd345b06180493ab7010d60ced9801c3cee786eff5d1fe855fca3260bd877906c5802fe1483fdcd9bbdb

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk

MD5 fdc67b15861ead9e7afd953a957d7caf
SHA1 95fb595c963c60be6f594c49519b4a47f1f20d7c
SHA256 52d1c7713e38d28571a3cfa18d4bdae662b2c27ef8fc7247fbd78bab4c2c9ef0
SHA512 1f94d63d9581d4502f44d796bdd2720d8bfdf7019494b0c382437aaba9372ec809a21f757ee704a5610c1877582d479787e5634d819bc2103ea8e52dec36e262

memory/2608-656-0x0000000000400000-0x0000000000419000-memory.dmp

memory/2028-657-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2608-662-0x0000000000400000-0x0000000000419000-memory.dmp

memory/280-663-0x0000000000400000-0x0000000000436000-memory.dmp

memory/828-669-0x0000000000230000-0x0000000000249000-memory.dmp

memory/2028-713-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2680-730-0x0000000000140000-0x000000000018E000-memory.dmp

memory/2680-734-0x0000000000140000-0x000000000018E000-memory.dmp

memory/2680-733-0x0000000000140000-0x000000000018E000-memory.dmp

memory/828-735-0x0000000000610000-0x0000000000623000-memory.dmp

memory/828-839-0x0000000000610000-0x0000000000623000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nstB80B.tmp\nsProcess.dll

MD5 faa7f034b38e729a983965c04cc70fc1
SHA1 df8bda55b498976ea47d25d8a77539b049dab55e
SHA256 579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf
SHA512 7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf

C:\Users\Admin\AppData\Local\Temp\nstB80B.tmp\blowfish.dll

MD5 5afd4a9b7e69e7c6e312b2ce4040394a
SHA1 fbd07adb3f02f866dc3a327a86b0f319d4a94502
SHA256 053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
SHA512 f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

C:\Users\Admin\AppData\Local\Temp\nsyB8C7.tmp\System.dll

MD5 bf01b2d04e8fad306ba2f364cfc4edfa
SHA1 58f42b45ca9fc1818c4498ecd8bac088d20f2b18
SHA256 d3f9c99e0c1c9acd81a1b33bc3dbd305140def90d10485c253cf1d455f0dc903
SHA512 30ca1663d659c5efac7fed3d1aaba81c47d5d5fda77f30f021124c882b858732e17f917bfd0aa3ee7b269fad86e75b1b9388d8f916e7a4e2c9961669f2c772e7

C:\Users\Admin\AppData\Local\Temp\nstB8F5.tmp\downloadmr.exe

MD5 0fd326c9da52b48bf2d93fe975af528e
SHA1 e9b60fb463447d8a92f3884b28c542a21b8e9371
SHA256 2d26d07df002716d99c8c8d851a28510967cc9f181ace4dd7a806e9cf97304e9
SHA512 452c78cb030b08083695281e35ffe437101370426fa9ab9699a5f91e474ce016c610075e96d05d1ddaf9e76820fde70b7bf719a6fde0ee5ecad21209d70e1f1b

C:\Users\Admin\AppData\Local\Temp\nsyB8C6.tmp\downloadmr.exe

MD5 7901bead3f7a8a199eb7f3c0037c027e
SHA1 aac8278236ee105267e68a823d206c908760cd92
SHA256 16ab9cc63212022fa73ba56f1b16d3d9eed436caa7ee816eab88dbd0289ca7f0
SHA512 5665a49cfbf68cfa14bbc143a646e7d1fe5aec91abe2f2143de993b03381018e90b3684d7d5d0076f3c4b44ce017a584fc400e4a65cb07b6f06205c33355a1e7

C:\Users\Admin\AppData\Local\Temp\nsyB8C8.tmp\downloadmr.exe

MD5 c20412a0c9d47656f9f97aa5cb7812cb
SHA1 8b55384408e93184b098559084a7746e1ab77036
SHA256 ef757b82a1db0330051d6e16468ad1e906bff88e29d919f3939742a98da87c8d
SHA512 6630ecb5bec345ac08c989d5bfaa2d718ebf89adddae34dcd4e0353668f8aff0f3d068b7bad5117a631420c8a32ebccfe9f228dd8e4b2561cbe9e947e23fbef0

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

MD5 7cc400af60e6be05dc25a6257ee44d50
SHA1 32e9ba2f2639ebde1f1d0897bae7240d524ae066
SHA256 5a3c0250c513d29f7fbfb3cb4369da274b95a8df8bec10dd1f45ad52bd0fb220
SHA512 be90ea85d596f97c90bafec1915be7c6719188f69c15fa4450a9ed2704f7f3efc7273efa9d2b91a5cd5fe207fcf5501cd0d31f9348fd6ed5a25a08c2d273a349

C:\Users\Admin\AppData\Local\Temp\nsoB8D6.tmp\INetC.dll

MD5 92ec4dd8c0ddd8c4305ae1684ab65fb0
SHA1 d850013d582a62e502942f0dd282cc0c29c4310e
SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
SHA512 581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe

MD5 0585b1e09e1f69c50ac22f69c99273af
SHA1 d2b20c442a4c4a2797e9d0b5563487fb5d89eb48
SHA256 b9c545e59008ed546a2b17a9090d293cc7b4c872707e44c382ecb77df1263b1e
SHA512 91f39eb5ca525a0f2527837821981a9cacdaa5f803bd6f0e7a63995bd72e246fc3b8a7cec197eb21a140bc9dd8f937b86e5c469970712df62f8b8d6c97a3a277

C:\Users\Admin\AppData\Local\Temp\nsoB924.tmp\Install.dll

MD5 f04972f869093e766a0313601b3239cf
SHA1 333e2e8385b3b3f898dbe6f327a2dc55694176aa
SHA256 4a8547edbbeb197baf780e668616f47ce48c72b99af2c24d49db600ca410583c
SHA512 7b2a531a042e30ff59355712fd96c280dc27375bf039ab90ea85710c2bb823d414e4e3a01b7c7eb4c010210262692e338aacd66212274212efe921773ddb2318

C:\Users\Admin\AppData\Local\Temp\nsjB81A.tmp\inetc.dll

MD5 e541458cfe66ef95ffbea40eaaa07289
SHA1 caec1233f841ee72004231a3027b13cdeb13274c
SHA256 3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420
SHA512 0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

C:\Users\Admin\AppData\Local\Temp\nsjB81A.tmp\nsDialogs.dll

MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

C:\Users\Admin\AppData\Local\Temp\nsdBAB8.tmp\System.dll

MD5 810f3a0aefe36a9f63e29e604bea91a9
SHA1 2559d3d4adf51f8ecbe2d07e669e344eb7d0bd80
SHA256 f160eb7a1b4eb8d2e99e7424ae058acd81ba5019e43cbfa0ce81e3102b356779
SHA512 836b73c38ab60260e1bc81ebf8347e14d02453fc361b7d6f10f137287b8189f8bc43758ce2d9def8fd1c71112aab7ef1930af2d64ae69f6d4e58a6fe17b310bb

memory/2812-996-0x00000000037D0000-0x000000000428A000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F

MD5 cb26ab35c8a4847a2c0bac779fb3bc2f
SHA1 139b5657a93f6f71638fc64269e48983f5efe18b
SHA256 b577f62621f8773047e447c62da54499b9f29c11b6d994d92c21f905eef328bc
SHA512 4ad4661eac857301e20792e7fb1fa2e9fefc227f5e637cea627fb29b1a4fa780754bfda3a2a00ce95830b4028fa5be4b1037e0e7eeaf3eddfd83a45e5fd463ef

memory/2680-1143-0x0000000000140000-0x000000000018E000-memory.dmp

memory/2680-1144-0x0000000000140000-0x000000000018E000-memory.dmp

memory/2680-1142-0x0000000000140000-0x000000000018E000-memory.dmp

memory/2680-1141-0x0000000000140000-0x000000000018E000-memory.dmp

memory/2680-1140-0x0000000000140000-0x000000000018E000-memory.dmp

memory/2680-1150-0x0000000000140000-0x000000000018E000-memory.dmp

memory/2680-1210-0x0000000000140000-0x000000000018E000-memory.dmp

memory/2680-1211-0x0000000000140000-0x000000000018E000-memory.dmp

memory/2680-1212-0x0000000000140000-0x000000000018E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk

MD5 b8735059d883ea943ccaff9cc87fce4f
SHA1 1ce2eab81c0f0cf6da19abd5ea9c146e3ae46cba
SHA256 0d6d24a93a7e2cd58823e6c5f70312770c6169b2a52f695f90a50743ddfab8b4
SHA512 5c2c4f6957261949a6133dd9051b441ec7639545da269d2323c72797071b1d4041bdbf961269b1778fa7bf1f4d8d5ca3fa81173605c874407e076ce918e6898a

memory/2368-1244-0x0000000000400000-0x0000000000417000-memory.dmp

memory/1608-1245-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2028-1289-0x0000000000400000-0x0000000000436000-memory.dmp

memory/828-1290-0x0000000000610000-0x0000000000623000-memory.dmp

memory/828-1309-0x0000000000610000-0x0000000000627000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe

MD5 1377f82f44ba8ace2e6509e38b18d4ba
SHA1 ac0dfbca2a6cfc35989d44693a1ea6f49a08b9d8
SHA256 52ebb9a200c8eb95e96e98c364e58561379f17dd376f7027c5ec3a6b1ecf9f1e
SHA512 2963aaddeaf55ed2f2d4f349e84e3abab183fa94ceb6e326cc7063f25c23babd90df0ae0219fe0dfa74b8775bb4eb78d76aa43fefc2142b6d4e0937ab89c2039

memory/3368-1321-0x0000000000E40000-0x0000000000E9C000-memory.dmp

memory/3308-1320-0x0000000000400000-0x00000000004C4000-memory.dmp

memory/828-1319-0x0000000002CF0000-0x0000000002D55000-memory.dmp

memory/3328-1442-0x0000000000400000-0x0000000000465000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsj15A5.tmp\ioSpecial.ini

MD5 c9b48fd95e673945d5c656196d2ac09a
SHA1 a7e7d51bff29dbe2ae45fb18bfa2449974a377a2
SHA256 ec2556a344e37af1973682cb59d16fc3cdb5956c2d3eecd0f9d31113d58c766c
SHA512 741e6259a7a02b7e73648effa8bc1fea97db1f70531a5ad8f666c7c99c069c471d4efc0777c1e32d43828b41df754c0ec8af3ad5a98461311698572786bf74c2

memory/3328-1450-0x0000000003200000-0x0000000003CBA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsj15A5.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

memory/3268-1455-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

memory/3268-1453-0x0000000004F60000-0x0000000004FBA000-memory.dmp

memory/3268-1359-0x00000000037F0000-0x00000000042AA000-memory.dmp

memory/3360-1443-0x0000000000400000-0x000000000042E8B0-memory.dmp

memory/1740-1441-0x0000000000240000-0x0000000000287000-memory.dmp

memory/1740-1440-0x0000000000240000-0x0000000000287000-memory.dmp

memory/1740-1439-0x0000000000240000-0x0000000000287000-memory.dmp

memory/828-1318-0x0000000000610000-0x0000000000627000-memory.dmp

memory/828-1317-0x0000000002CF0000-0x0000000002D4C000-memory.dmp

memory/828-1316-0x0000000000610000-0x000000000063F000-memory.dmp

memory/828-1315-0x0000000002CF0000-0x0000000002DB4000-memory.dmp

memory/828-1314-0x0000000002CF0000-0x0000000002D55000-memory.dmp

memory/3268-1313-0x0000000000400000-0x0000000000417000-memory.dmp

memory/1740-1312-0x0000000000400000-0x0000000000447000-memory.dmp

memory/3116-1311-0x0000000000400000-0x0000000000642000-memory.dmp

memory/3152-1304-0x0000000000400000-0x000000000043E000-memory.dmp

memory/828-1303-0x0000000000610000-0x000000000064E000-memory.dmp

memory/3140-1302-0x0000000000400000-0x0000000000452000-memory.dmp

memory/828-1301-0x0000000002CF0000-0x0000000002D42000-memory.dmp

memory/828-1300-0x0000000002CF0000-0x0000000002D37000-memory.dmp

memory/3144-1306-0x0000000000400000-0x0000000000419000-memory.dmp

memory/828-1305-0x0000000005340000-0x0000000005582000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\errorPageStrings[1]

MD5 e3e4a98353f119b80b323302f26b78fa
SHA1 20ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA256 9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512 d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\httpErrorPagesScripts[2]

MD5 3f57b781cb3ef114dd0b665151571b7b
SHA1 ce6a63f996df3a1cccb81720e21204b825e0238c
SHA256 46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA512 8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

memory/3140-1481-0x0000000000400000-0x0000000000452000-memory.dmp

memory/3328-1511-0x0000000006B70000-0x0000000006B80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\setting.ini

MD5 ea443817260b07dbe9385a12384e76f5
SHA1 b97e88e202e24a5f0668c60eb8f53fd82321fbd1
SHA256 9d9a94a5435ca8b726dbdbe5f89624544a8cdbaf9aea07357ff1f42508170254
SHA512 c290b19a1fbab2718848332646e1b95c5db2f011b3feea8ed965e1e0af08a29084aa4a52e5e1624af104d71ee3280acd6f79d584f8b97397e5de45c038740471

memory/3328-1510-0x0000000006B10000-0x0000000006B6A000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z_Start.lnk

MD5 f54e6d84b8baf2fb1cbdba7e42faad9c
SHA1 3b1622433f625afb78e7487447b994401c923fc2
SHA256 2021a243c539cecde3194848545a985e1235487ce12b7faabfe17901312fb933
SHA512 7ce3ce0cc427d9813920990c1f42bcf3406dc1ae20fff3a49c812ee6448814d4ed52c47577c09359a5081b7a3362749c07044bdaf733b5f1a8354bf11ca97b36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 730e1c9df1e38dd1a9bfd744b8ac9fda
SHA1 4166a464f06bfed85762a985c5d11690f5a4ebad
SHA256 8042fc592b666fd9369a772c5e2f4ca9f433e62e8b8dd3fe0926c1805632f148
SHA512 b560523db4241acec0a97444e113f0efb35f67f7993b7d352d21accf76718a3b5d0bca04bfee15aee754281b31945393d9ccb9cafa8be0f10a0f47b6bd3063fd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 29b9c85c6b43886950ed9889a2560889
SHA1 f505c421728fa95fcb4fd94acbf18d6413c7b3b7
SHA256 1a942cfd74cba2648ff37a0e3c61f112a7e663dbe9a88eba2123dfccee48faa4
SHA512 91664f3e8f2171cfe39307a2059795086ff7221dbfd944013f9cb6ff5e39032020737de73dbfea2354eb85c505be7ca8a61735b67d329f22ce133ae4d58252f7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5d320f6620c1a58bd0c7efdde44f8f27
SHA1 0be48e06e06d10a0a2970ea7ea6f0fe86498ed82
SHA256 edc9b4bdc2e57b18aade1d7072d370d377adca7e3655066b9424bcf19e1a6d87
SHA512 ee22fe67fa0cb093c485ef5bca240b71a1289ef4e00afcaefa544ec975bae26e4992a856cbdf712a998e15e0e4af61190165fc939ebf529a969b0788573c75f1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 10562ece93f081b665d72e9099d1e5e9
SHA1 54794181bf6ce6ff348e1a78248b195c65268e75
SHA256 48c796a3e87cb37714bc800000b7f51510e0be9a88728480464008c2b5a7d926
SHA512 159acedb490faa062d8ae24c855ebbb5cd47b33e0329eed70ac395522d1765ba02536409691df69ddcffcf5ca335e8e5af132e5da3e0fd30c40ad47062a553d9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b236600243b112d11b8cdc10238abefd
SHA1 19e5f8ec6672c9146192663bbd54391b485a85e9
SHA256 edd5150c203a45b7ec98aa40476939ecd29733d0448105d088fb85d829b228ff
SHA512 1427afae5ecd9b07285bd66e1c1a9dfa3aad9f813bd1c20827a91c1bd85c1239abf9327d735114a36d0d5ce22a8f8d6a4ac2d5b6502438b5025bd4cbd87e0fca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5c99ac59117a2b23446a1c407ad08b42
SHA1 d126ff3b894dd0128b824bf3cf666a5f6060fcee
SHA256 a50d5ffc5caa169db03ba6574243786c293f31fba0094b0e4dde914b6888509c
SHA512 16cf6703f64ea7a94e7cc9984005d1cd60b8a83315d3d2bf25c6226aee5bb6362e1e0b6b719199dd510549ca7e8b23488c3da31f8f33f52a7b7203efd87e6cf2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d82cf18fb98d7c50f8ab3b6a615dcb85
SHA1 9d9871a8b84b8e1af82adbc5196472e642cc84aa
SHA256 1d65401921d763c9d8305a15bb35259ca15a2ab367ce02dba0e3cf9a9b540996
SHA512 05da7d50b2b44be0087fcda164e1681071d165d68dae9f63bdf6ce65238340c99ce931f344f3c60a09c931edacd1e8ccfe54b03be55e0463fab86429a8f80df2

memory/1740-2159-0x0000000000400000-0x0000000000447000-memory.dmp

memory/828-2241-0x0000000005340000-0x0000000005582000-memory.dmp

memory/3116-2242-0x0000000000400000-0x0000000000642000-memory.dmp

memory/3360-2244-0x0000000000400000-0x000000000042E8B0-memory.dmp

memory/828-2254-0x0000000002CF0000-0x0000000002D37000-memory.dmp

memory/828-2255-0x0000000002CF0000-0x0000000002D42000-memory.dmp

memory/828-2259-0x0000000002CF0000-0x0000000002D4C000-memory.dmp

memory/828-2256-0x0000000000610000-0x000000000064E000-memory.dmp

memory/3268-2257-0x0000000000400000-0x0000000000417000-memory.dmp

memory/828-2258-0x0000000002CF0000-0x0000000002DB4000-memory.dmp

memory/3308-2267-0x0000000000400000-0x00000000004C4000-memory.dmp

memory/3368-2268-0x0000000000E40000-0x0000000000E9C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\dnserrordiagoff[1]

MD5 47f581b112d58eda23ea8b2e08cf0ff0
SHA1 6ec1df5eaec1439573aef0fb96dabfc953305e5b
SHA256 b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928
SHA512 187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY2G78MW\NewErrorPageTemplate[1]

MD5 cdf81e591d9cbfb47a7f97a2bcdb70b9
SHA1 8f12010dfaacdecad77b70a3e781c707cf328496
SHA256 204d95c6fb161368c795bb63e538fe0b11f9e406494bb5758b3b0d60c5f651bd
SHA512 977dcc2c6488acaf0e5970cef1a7a72c9f9dc6bb82da54f057e0853c8e939e4ab01b163eb7a5058e093a8bc44ecad9d06880fdc883e67e28ac67fee4d070a4cc

memory/1740-2284-0x0000000000240000-0x0000000000287000-memory.dmp

memory/1740-2286-0x0000000000240000-0x0000000000287000-memory.dmp

memory/1740-2285-0x0000000000240000-0x0000000000287000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-04 01:14

Reported

2024-06-04 01:16

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows installer = "C:\\winstall.exe" C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5088 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28.exe C:\Windows\SysWOW64\cmd.exe
PID 5088 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28.exe C:\Windows\SysWOW64\cmd.exe
PID 5088 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28.exe C:\Windows\SysWOW64\cmd.exe
PID 4080 wrote to memory of 1396 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe
PID 4080 wrote to memory of 1396 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe
PID 4080 wrote to memory of 1396 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe

Processes

C:\Users\Admin\AppData\Local\Temp\361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28.exe

"C:\Users\Admin\AppData\Local\Temp\361c5ca1db8ea24f3a773cddcddbcbaebd845432dcd12e180bfd975114366f28.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Blaster.bat" "

C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe

"anr0129.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
CA 69.50.175.180:80 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 28.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Blaster.bat

MD5 6a83b03054f53cb002fdca262b76b102
SHA1 1bbafe19ae5bcdd4f3710f13d06332128a5d54f7
SHA256 7952248cb4ec97bc0d2ab3b51c126c7b0704a7f9d42bddf6adcb04b5657c7a4e
SHA512 fa8d907bb187f32de1cfbe1b092982072632456fd429e4dd92f62e482f2ad23e602cf845a2fd655d0e4b8314c1d7a086dc9545d4d82996afbccb364ddc1e9eae

C:\Users\Admin\AppData\Local\Temp\RarSFX0\anr0129.exe

MD5 eb790be93afb8481cfc43515b00976ab
SHA1 3e2a4c1393f7c09e5c1ae989aea0eb1d3b8c1e6d
SHA256 f6dec10d8bc56fc09673e544007654553c99848c8a211c64dbee0758ec9ddbd2
SHA512 6604a81c584bba8fcd4b96b895f29d43b311c99bcfb5065300d1f3f423b1857ce9faacea6d54e0e7b624c3c5aed1b4037ddae130e8b3499e9aca5ae4b8dcd99a

memory/1396-318-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fun (1).exe

MD5 8a84d8b3c4044c3f4eca7127d1cad349
SHA1 e3c9335b805c858bae6d64d176fcc259fa4f12ee
SHA256 7f27eac0d3e5ce33ba5dea3a0dcd07e33e7ba9b9f5783abe99d20eba9f783bd3
SHA512 fc019f613c9167ca3832e5ab4a798f8d441930f1bba246d5901a12ad36e410bab2be1b467b82aaacb57250b0eb887dc6d26265f6f4b783c937f951a3548f8879

memory/1396-321-0x0000000000400000-0x000000000040D000-memory.dmp