Loading ...

Analysis Report

Overview

General Information

Analysis ID:49353
Start time:13:24:19
Start date:13/11/2014
Overall analysis duration:0h 7m 25s
Report type:full
Sample file name:50c0b224.exe (renamed file extension from exe to )
Cookbook file name:default.jbs
Analysis system description:XP SP3 (Office 2003 SP2, Java 1.6.0, Acrobat Reader 9.3.4, Internet Explorer 8)
Number of analysed new started processes analysed:34
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:3
HCA enabled:true
HCA success:
  • true, ratio: 82%
  • Number of executed functions: 282
  • Number of non-executed functions: 3763
Warnings:
  • Report size exceeded maximum capacity and may have missing disassembly code or behavior information.
  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
  • Report size getting too big, too many NtDeviceIoControlFile calls found.
  • Report size getting too big, too many NtFsControlFile calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.
  • Report size getting too big, too many NtSetInformationProcess calls found.


Detection

StrategyReport FP/FN
Threshold malicious


Signature Overview


DDOS:

barindex
Too many similiar processes found (Sandbox DDOS)Show sources
Source: cmd.exeProcess created: 26

Networking:

barindex
Urls found in memory or binary dataShow sources
Source: iexplore.exeString found in binary or memory: http://%d.%d.%d.%d:%d/%x/%x/
Source: iexplore.exeString found in binary or memory: http://%s/%x/%x/
Source: explorer.exeString found in binary or memory: http://177.73.233.170:8080/98ec3c30/df9fba64/
Source: explorer.exeString found in binary or memory: http://178.210.167.213:8080/98ec3c30/df9fba64/
Source: 12.tmp.drString found in binary or memory: http://ns.adobe.com/xap/1.0/
Source: 12.tmp.drString found in binary or memory: http://ns.adobe.com/xap/1.0/mm/
Source: 12.tmp.drString found in binary or memory: http://ns.adobe.com/xap/1.0/stype/resourceref#
Source: explorer.exeString found in binary or memory: http://tejohjlxraqmamnx.eu/98ec3c30/df9fba64/
Source: iexplore.exeString found in binary or memory: http://w
Source: iexplore.exeString found in binary or memory: http://www.microsoft.com/
Source: 12.tmp.drString found in binary or memory: http://www.w3.org/1999/02/22-rdf-syntax-ns#
Contains functionality to download additional files from the internetShow sources
Source: C:\WINDOWS\explorer.exeCode function: 4_2_00CB5570 select,recv,4_2_00CB5570
Downloads filesShow sources
Source: C:\WINDOWS\explorer.exeFile created: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RC9GAWT2\microsoft_com[1].htm
Downloads files from webservers via HTTPShow sources
Source: global trafficHTTP traffic detected: GET / HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible;MSIE 7.0;Windows NT 6.0) Host: www.microsoft.com Connection: Keep-Alive Cache-Control: no-cache
Performs DNS lookupsShow sources
Source: unknownDNS traffic detected: queries for: www.microsoft.com
Posts data to webserverShow sources
Source: unknownHTTP traffic detected: POST /98ec3c30/df9fba64/ HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible;MSIE 7.0;Windows NT 6.0) Host: tejohjlxraqmamnx.eu Content-Length: 198 Connection: Keep-Alive Cache-Control: no-cache Data Raw: fa 93 e5 b0 d9 c1 87 c4 6b f9 db dd 44 09 6b 17 02 d4 ce 16 7f a9 73 a0 0b 3c 3c ab 3e 40 2f 85 87 d2 42 52 1c 93 0b c3 7b 28 85 49 f2 6c a9 f4 0c ca c2 fc 86 ba 7b e4 6e e4 4e ab 84 c4 88 30 d2 6c 43 0a 93 de 13 a5 55 40 46 13 92 66 63 00 10 39 dd 62 d5 88 1f 6a 96 55 5a 12 35 dc 43 06 cf f2 9d c3 0a e0 ab 05 58 03 04 db e2 e5 36 f5 b0 a5 6f 4f b7 c4 9a b1 d2 63 e6 1f 03 96 8d 6c 5a ea 5f ed d5 8f be 4c 9d 17 c0 38 46 a4 e0 7d 8d 28 1f 30 a6 b6 17 c6 3e c8 fa 74 00 88 6a 57 64 3f 3c 42 02 9e 71 d8 a2 0e ba 60 23 29 84 ae be e6 b7 ff e4 3f 89 e8 2b 64 b4 ee f5 8b 92 6e 2f 81 b2 d5 1f f9 Data Ascii: kDks<<>@/BR{(Il{nN0lCU@Ffc9bjUZ5CX6oOclZ_L8F}(0>tjWd?<Bq`#)?+dn/
Queries random domain names (often used to prevent blacklisting and sinkholes)Show sources
Source: unknownDNS traffic detected: English language letter occurancy does not match the domain names

Boot Survival:

barindex
Creates an autostart registry keyShow sources
Source: C:\WINDOWS\explorer.exeRegistry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run lmypypkq.exe
Source: C:\WINDOWS\explorer.exeRegistry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run lmypypkq.exe

Remote Access Functionality:

barindex
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpCode function: 8_2_00401B90 socket,htons,htonl,bind,8_2_00401B90
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpCode function: 13_2_00401B90 socket,htons,htonl,bind,13_2_00401B90
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpCode function: 18_2_00401B90 socket,htons,htonl,bind,18_2_00401B90
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpCode function: 23_2_00401B90 socket,htons,htonl,bind,23_2_00401B90
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpCode function: 23_1_00401B90 socket,htons,htonl,bind,23_1_00401B90
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpCode function: 28_2_00401B90 socket,htons,htonl,bind,28_2_00401B90
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpCode function: 33_2_00401B90 socket,htons,htonl,bind,33_2_00401B90
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpCode function: 33_1_00401B90 socket,htons,htonl,bind,33_1_00401B90

Persistence and Installation Behavior:

barindex
Drops PE filesShow sources
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmp
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmp
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmp
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmp
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E.tmp
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmp
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmp
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmp
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\B.tmp
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmp
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpFile created: C:\Documents and Settings\Administrator\Application Data\Identities\lmypypkq.exe
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmp
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\8.tmp
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\11.tmp
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\5.tmp
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmp
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmp
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmp

Data Obfuscation:

barindex
Contains functionality to dynamically determine API callsShow sources
Source: C:\50c0b224.exeCode function: 0_2_004042E8 GetModuleFileNameExW,LoadLibraryA,GetProcAddress,CreateFileW,GetFileSize,ReadFile,CloseHandle,0_2_004042E8

Spreading:

barindex
Contains functionality to enumerate / list files inside a directoryShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeCode function: 1_2_009437C0 _snprintf,FindFirstFileA,strlen,strlen,strlen,strlen,_snprintf,FindNextFileA,FindClose,1_2_009437C0

System Summary:

barindex
Binary contains paths to debug symbolsShow sources
Source: Binary string: D:\work\spam\export_email_outlook\cpp\x64\Release\64.pdb source: 11.tmp.dr
Source: Binary string: D:\work\spam\export_email_outlook\cpp\Release\32.pdb source: 1.tmp.dr
Contains functionality to adjust token privileges (e.g. debug / backup)Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exeCode function: 1_2_00944BC0 GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,1_2_00944BC0
Contains functionality to enum processes or threadsShow sources
Source: C:\50c0b224.exeCode function: 0_2_013E0018 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,IsWow64Process,CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,TerminateProcess,CreateToolhelp32Snapshot,Process32First,Process32Next,CreateToolhelp32Snapshot,Module32First,Module32Next,CloseHandle,CloseHandle,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,CreateFileW,VirtualAlloc,ReadFile,VirtualAlloc,0_2_013E0018
Creates files inside the user directoryShow sources
Source: C:\50c0b224.exeFile created: C:\Documents and Settings\Administrator\Application Data\Identities\lmypypkq.exe
Creates temporary filesShow sources
Source: C:\WINDOWS\explorer.exeFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmp
Executes batch filesShow sources
Source: C:\50c0b224.exeProcess created: C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\MS5655~1.BAT
PE file has an executable .text section and no other executable sectionShow sources
Source: initial sampleStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Reads ini filesShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpFile read: C:\WINDOWS\win.ini
Spawns processesShow sources
Source: unknownProcess created: C:\50c0b224.exe
Source: unknownProcess created: C:\Program Files\Internet Explorer\iexplore.exe
Source: unknownProcess created: C:\50c0b224.exe
Source: unknownProcess created: C:\WINDOWS\system32\cmd.exe
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmp
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmp
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmp
Source: unknownProcess created: C:\WINDOWS\system32\cmd.exe
Source: unknownProcess created: C:\WINDOWS\system32\cmd.exe
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmp
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmp
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmp
Source: unknownProcess created: C:\WINDOWS\system32\cmd.exe
Source: unknownProcess created: C:\WINDOWS\system32\cmd.exe
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmp
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmp
Source: unknownProcess created: C:\WINDOWS\system32\cmd.exe
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmp
Source: unknownProcess created: C:\WINDOWS\system32\cmd.exe
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmp
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmp
Source: unknownProcess created: C:\WINDOWS\system32\cmd.exe
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmp
Source: unknownProcess created: C:\WINDOWS\system32\cmd.exe
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmp
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmp
Source: unknownProcess created: C:\WINDOWS\system32\cmd.exe
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmp
Source: unknownProcess created: C:\WINDOWS\system32\cmd.exe
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmp
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmp
Source: unknownProcess created: C:\WINDOWS\system32\cmd.exe
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmp
Source: unknownProcess created: C:\WINDOWS\system32\cmd.exe
Source: C:\50c0b224.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
Source: C:\50c0b224.exeProcess created: C:\50c0b224.exe C:\50c0b224.exe
Source: C:\50c0b224.exeProcess created: C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\MS5655~1.BAT
Source: C:\WINDOWS\explorer.exeProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmp
Source: C:\WINDOWS\explorer.exeProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmp
Source: C:\WINDOWS\explorer.exeProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmp
Source: C:\WINDOWS\explorer.exeProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmp
Source: C:\WINDOWS\explorer.exeProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmp
Source: C:\WINDOWS\explorer.exeProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmp
Source: C:\WINDOWS\explorer.exeProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmp
Source: C:\WINDOWS\explorer.exeProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmp
Source: C:\WINDOWS\explorer.exeProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmp
Source: C:\WINDOWS\explorer.exeProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmp
Source: C:\WINDOWS\explorer.exeProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmp
Source: C:\WINDOWS\explorer.exeProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmp
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpProcess created: C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\_tmpxqr.bat
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmp
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess created: C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\ms67357.bat
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess created: C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\_tmpxqr.bat
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmp
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess created: C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\MS3561~1.BAT
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess created: C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\_tmpxqr.bat
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmp
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess created: C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\MS2003~1.BAT
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess created: C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\_tmpxqr.bat
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmp
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess created: C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\MS4245~1.BAT
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess created: C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\_tmpxqr.bat
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmp
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess created: C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\MS8537~1.BAT
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess created: C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\_tmpxqr.bat
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmp C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmp
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess created: C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\MS9522~1.BAT
Contains functionality to call native functionsShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeCode function: 1_2_00945E00 memcpy,memset,GetThreadContext,SetThreadContext,GetCurrentProcess,VirtualProtect,FlushInstructionCache,memset,GetProcessHeap,RtlFreeHeap,GetCurrentProcess,VirtualProtect,FlushInstructionCache,NtResumeThread,CloseHandle,GetProcessHeap,RtlFreeHeap,1_2_00945E00
Creates mutexesShow sources
Source: C:\WINDOWS\system32\wscntfy.exeMutant created: \BaseNamedObjects\ci704
Source: C:\WINDOWS\system32\cmd.exeMutant created: \BaseNamedObjects\cm8a8
Source: C:\WINDOWS\system32\cmd.exeMutant created: \BaseNamedObjects\ci65c
Source: C:\WINDOWS\system32\cmd.exeMutant created: \BaseNamedObjects\cmc3c
Source: C:\WINDOWS\system32\cmd.exeMutant created: \BaseNamedObjects\cm8f4
Source: C:\WINDOWS\system32\cmd.exeMutant created: \BaseNamedObjects\ci8f4
Source: C:\WINDOWS\system32\cmd.exeMutant created: \BaseNamedObjects\cic3c
Source: C:\WINDOWS\system32\cmd.exeMutant created: \BaseNamedObjects\ci4b4
Source: C:\WINDOWS\system32\cmd.exeMutant created: \BaseNamedObjects\ci8a8
Source: C:\WINDOWS\system32\cmd.exeMutant created: \BaseNamedObjects\ci760
Source: C:\WINDOWS\system32\wscntfy.exeMutant created: \BaseNamedObjects\cm704
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\rm98ec3c30
Source: C:\WINDOWS\system32\cmd.exeMutant created: \BaseNamedObjects\cmb74
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\zx98ec3c30
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\cm61c
Source: C:\WINDOWS\system32\cmd.exeMutant created: \BaseNamedObjects\cm65c
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\ci61c
Source: C:\WINDOWS\system32\ctfmon.exeMutant created: \BaseNamedObjects\cm6e8
Source: C:\WINDOWS\system32\cmd.exeMutant created: \BaseNamedObjects\cm760
Source: C:\WINDOWS\system32\ctfmon.exeMutant created: \BaseNamedObjects\ci6e8
Source: C:\WINDOWS\system32\cmd.exeMutant created: \BaseNamedObjects\cib74
Source: C:\WINDOWS\system32\cmd.exeMutant created: \BaseNamedObjects\cm4b4
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\zc98ec3c30
Source: C:\Program Files\Internet Explorer\iexplore.exeMutant created: \BaseNamedObjects\cmda4
Source: C:\Program Files\Internet Explorer\iexplore.exeMutant created: \BaseNamedObjects\cida4
PE file contains executable resources (Code or Archives)Show sources
Source: initial sampleStatic PE information: Resource name: RT_STRING type: ump; Hitachi SH big-endian COFF executable, stripped
Reads the hosts fileShow sources
Source: C:\WINDOWS\explorer.exeFile read: C:\WINDOWS\system32\drivers\etc\hosts
Uses Microsoft's Enhanced Cryptographic ProviderShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeCode function: 1_2_00930FE0 CryptEncrypt,1_2_00930FE0

HIPS / PFW / Operating System Protection Evasion:

barindex
May try to detect the Windows Explorer process (often used for injection)Show sources
Source: iexplore.exeBinary or memory string: Program Manager
Source: iexplore.exeBinary or memory string: Shell_TrayWnd
Allocates memory in foreign processesShow sources
Source: C:\50c0b224.exeMemory allocated: C:\Program Files\Internet Explorer\iexplore.exe base: 400000 protect: page execute and read and write
Source: C:\50c0b224.exeMemory allocated: C:\WINDOWS\explorer.exe base: 12A0000 protect: page execute and read and write
Source: C:\50c0b224.exeMemory allocated: C:\WINDOWS\explorer.exe base: 2920000 protect: page read and write
Source: C:\50c0b224.exeMemory allocated: C:\WINDOWS\explorer.exe base: 2A1E000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: B90000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: BB0000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: BE1000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: AE0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: B00000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: B31000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: 920000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: 940000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: 971000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: 650000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: 480000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: 4B1000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: BD0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: CB0000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: CE1000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: B20000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: C00000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: C31000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: 960000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: CB0000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: CE1000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\cmd.exe base: 340000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\cmd.exe base: 490000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\cmd.exe base: 4C1000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: C90000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: CB0000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: CE1000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: BE0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: C00000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: C31000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: BB0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: BD0000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: C01000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\cmd.exe base: 480000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\cmd.exe base: 4A0000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\cmd.exe base: 4D1000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: C70000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: CF0000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: D21000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: BC0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: C40000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: C71000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: AD0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: AF0000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: B21000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\cmd.exe base: 480000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\cmd.exe base: 4A0000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\cmd.exe base: 4D1000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: A30000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: D10000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: D41000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: C60000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: C80000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: CB1000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: B10000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: B30000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: B61000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\cmd.exe base: 650000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\cmd.exe base: 670000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\cmd.exe base: 6A1000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: D30000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: D50000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: D81000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: C40000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: CC0000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: CF1000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: B50000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: B70000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: BA1000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\cmd.exe base: 470000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\cmd.exe base: 4A0000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\cmd.exe base: 4D1000 protect: page read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: D10000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: CE0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: unknown base: B90000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory allocated: C:\WINDOWS\system32\cmd.exe base: 480000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpMemory allocated: unknown base: F40000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpMemory allocated: unknown base: 2960000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpMemory allocated: unknown base: 2A5E000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpMemory allocated: unknown base: CD0000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpMemory allocated: unknown base: 2920000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpMemory allocated: unknown base: 2A1E000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpMemory allocated: unknown base: 26A0000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpMemory allocated: unknown base: 2920000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpMemory allocated: unknown base: 2A1E000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpMemory allocated: unknown base: 2720000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpMemory allocated: unknown base: 2AE0000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpMemory allocated: unknown base: 2BDE000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpMemory allocated: unknown base: 2850000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpMemory allocated: unknown base: 2AA0000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpMemory allocated: unknown base: 2B9E000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpMemory allocated: unknown base: E80000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpMemory allocated: unknown base: 2AA0000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpMemory allocated: unknown base: 2B9E000 protect: page read and write
Benign windows process drops PE filesShow sources
Source: C:\WINDOWS\explorer.exeFile created: 1.tmp.dr
Changes memory attributes in foreign processes to executable or writableShow sources
Source: C:\50c0b224.exeMemory protected: C:\WINDOWS\explorer.exe base: 12A0000 protect: page execute and read and write
Source: C:\50c0b224.exeMemory protected: C:\WINDOWS\explorer.exe base: 12A0000 protect: page execute and read and write
Source: C:\50c0b224.exeMemory protected: C:\WINDOWS\explorer.exe base: 2A1E000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: B90000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: B90000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: BE1000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: AE0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: AE0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: B31000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: 920000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: 920000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: 971000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: 650000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: 650000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: 4B1000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: BD0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: BD0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: CE1000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: B20000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: B20000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: C31000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: 960000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: 960000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: CE1000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 340000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 340000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 4C1000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: C90000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: C90000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: BE0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: BE0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: BB0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: BB0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: C01000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 480000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 480000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 4D1000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: C70000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: C70000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: D21000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: BC0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: BC0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: C71000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: AD0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: AD0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: B21000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 480000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 480000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 4D1000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: A30000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: A30000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: D41000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: C60000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: C60000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: CB1000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: B10000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: B10000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: B61000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 650000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 650000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 6A1000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: D30000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: D30000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: D81000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: C40000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: C40000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: CF1000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: B50000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: B50000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: BA1000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 470000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 470000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 4D1000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: D10000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: D10000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: E61000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: CE0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: CE0000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: D31000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: B90000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: B90000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: unknown base: E01000 protect: page read and write and page guard
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 480000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 480000 protect: page execute and read and write
Source: C:\WINDOWS\explorer.exeMemory protected: C:\WINDOWS\system32\cmd.exe base: 4D1000 protect: page read and write and page guard
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpMemory protected: unknown base: F40000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpMemory protected: unknown base: F40000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpMemory protected: unknown base: 2A5E000 protect: page read and write and page guard
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpMemory protected: unknown base: CD0000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpMemory protected: unknown base: CD0000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpMemory protected: unknown base: 2A1E000 protect: page read and write and page guard
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpMemory protected: unknown base: 26A0000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpMemory protected: unknown base: 26A0000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpMemory protected: unknown base: 2A1E000 protect: page read and write and page guard
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpMemory protected: unknown base: 2720000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpMemory protected: unknown base: 2720000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpMemory protected: unknown base: 2BDE000 protect: page read and write and page guard
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpMemory protected: unknown base: 2850000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpMemory protected: unknown base: 2850000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpMemory protected: unknown base: 2B9E000 protect: page read and write and page guard
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpMemory protected: unknown base: E80000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpMemory protected: unknown base: E80000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpMemory protected: unknown base: 2B9E000 protect: page read and write and page guard
Contains functionality to inject code into remote processesShow sources
Source: C:\50c0b224.exeCode function: 0_2_013E0018 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,IsWow64Process,CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,TerminateProcess,CreateToolhelp32Snapshot,Process32First,Process32Next,CreateToolhelp32Snapshot,Module32First,Module32Next,CloseHandle,CloseHandle,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,CreateFileW,VirtualAlloc,ReadFile,VirtualAlloc,0_2_013E0018
Creates a thread in another existing process (thread injection)Show sources
Source: C:\50c0b224.exeThreat created: C:\WINDOWS\explorer.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\ctfmon.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\wscntfy.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: unknown EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: unknown EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\ctfmon.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\wscntfy.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: unknown EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\cmd.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\ctfmon.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\wscntfy.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: unknown EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\cmd.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\ctfmon.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\wscntfy.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: unknown EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\cmd.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\ctfmon.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\wscntfy.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: unknown EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\cmd.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\ctfmon.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\wscntfy.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: unknown EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\cmd.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\ctfmon.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\wscntfy.exe EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: unknown EIP: 7C8106F9
Source: C:\WINDOWS\explorer.exeThreat created: C:\WINDOWS\system32\cmd.exe EIP: 7C8106F9
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpThreat created: unknown EIP: 7C8106F9
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpThreat created: unknown EIP: 7C8106F9
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpThreat created: unknown EIP: 7C8106F9
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpThreat created: unknown EIP: 7C8106F9
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpThreat created: unknown EIP: 7C8106F9
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpThreat created: unknown EIP: 7C8106F9
Injects a PE file into a foreign processesShow sources
Source: C:\50c0b224.exeMemory written: C:\Program Files\Internet Explorer\iexplore.exe base: 400000 value starts with: 4D5A
Source: C:\50c0b224.exeMemory written: C:\50c0b224.exe base: 400000 value starts with: 4D5A
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpMemory written: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmp base: 400000 value starts with: 4D5A
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpMemory written: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmp base: 400000 value starts with: 4D5A
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpMemory written: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmp base: 400000 value starts with: 4D5A
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpMemory written: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmp base: 400000 value starts with: 4D5A
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpMemory written: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmp base: 400000 value starts with: 4D5A
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpMemory written: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmp base: 400000 value starts with: 4D5A
Injects code into the Windows Explorer (explorer.exe)Show sources
Source: C:\50c0b224.exeMemory written: PID: 1564 base: 12A0000 value: 03
Modifies the context of a thread in another process (thread injection)Show sources
Source: C:\50c0b224.exeThread register set: target process: 3492
Writes to foreign memory regionsShow sources
Source: C:\50c0b224.exeMemory written: C:\Program Files\Internet Explorer\iexplore.exe base: 400000
Source: C:\50c0b224.exeMemory written: C:\Program Files\Internet Explorer\iexplore.exe base: 40D000
Source: C:\50c0b224.exeMemory written: C:\Program Files\Internet Explorer\iexplore.exe base: 413000
Source: C:\50c0b224.exeMemory written: C:\Program Files\Internet Explorer\iexplore.exe base: 7FFDB008
Source: C:\50c0b224.exeMemory written: C:\WINDOWS\explorer.exe base: 12A0000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\ctfmon.exe base: B90000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\wscntfy.exe base: AE0000
Source: C:\WINDOWS\explorer.exeMemory written: unknown base: 920000
Source: C:\WINDOWS\explorer.exeMemory written: unknown base: 650000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\ctfmon.exe base: BD0000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\wscntfy.exe base: B20000
Source: C:\WINDOWS\explorer.exeMemory written: unknown base: 960000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\cmd.exe base: 340000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\ctfmon.exe base: C90000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\wscntfy.exe base: BE0000
Source: C:\WINDOWS\explorer.exeMemory written: unknown base: BB0000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\cmd.exe base: 480000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\ctfmon.exe base: C70000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\wscntfy.exe base: BC0000
Source: C:\WINDOWS\explorer.exeMemory written: unknown base: AD0000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\cmd.exe base: 480000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\ctfmon.exe base: A30000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\wscntfy.exe base: C60000
Source: C:\WINDOWS\explorer.exeMemory written: unknown base: B10000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\cmd.exe base: 650000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\ctfmon.exe base: D30000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\wscntfy.exe base: C40000
Source: C:\WINDOWS\explorer.exeMemory written: unknown base: B50000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\cmd.exe base: 470000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\ctfmon.exe base: D10000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\wscntfy.exe base: CE0000
Source: C:\WINDOWS\explorer.exeMemory written: unknown base: B90000
Source: C:\WINDOWS\explorer.exeMemory written: C:\WINDOWS\system32\cmd.exe base: 480000
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpMemory written: unknown base: F40000
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpMemory written: unknown base: CD0000
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpMemory written: unknown base: 26A0000
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpMemory written: unknown base: 2720000
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpMemory written: unknown base: 2850000
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpMemory written: unknown base: E80000

Anti Debugging and Sandbox Evasion:

barindex
Contains functionality to register its own exception handlerShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpCode function: 7_2_00410670 SetUnhandledExceptionFilter,7_2_00410670
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpCode function: 7_2_00409E94 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_00409E94
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpCode function: 7_2_0040C17F SetUnhandledExceptionFilter,UnhandledExceptionFilter,TlsGetValue,TlsGetValue,TlsGetValue,RtlEncodePointer,7_2_0040C17F
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpCode function: 7_2_0040957D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_0040957D
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpCode function: 7_1_00410670 SetUnhandledExceptionFilter,7_1_00410670
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpCode function: 7_1_00409E94 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_1_00409E94
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpCode function: 7_1_0040C17F SetUnhandledExceptionFilter,UnhandledExceptionFilter,TlsGetValue,TlsGetValue,TlsGetValue,RtlEncodePointer,7_1_0040C17F
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpCode function: 7_1_0040957D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_1_0040957D
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpCode function: 12_1_00410670 SetUnhandledExceptionFilter,12_1_00410670
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpCode function: 12_1_00409E94 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,12_1_00409E94
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpCode function: 12_1_0040C17F SetUnhandledExceptionFilter,UnhandledExceptionFilter,TlsGetValue,TlsGetValue,TlsGetValue,RtlEncodePointer,12_1_0040C17F
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpCode function: 12_1_0040957D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,12_1_0040957D
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpCode function: 17_1_00410670 SetUnhandledExceptionFilter,17_1_00410670
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpCode function: 17_1_00409E94 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,17_1_00409E94
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpCode function: 17_1_0040C17F SetUnhandledExceptionFilter,UnhandledExceptionFilter,TlsGetValue,TlsGetValue,TlsGetValue,RtlEncodePointer,17_1_0040C17F
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpCode function: 17_1_0040957D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,17_1_0040957D
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpCode function: 27_1_00410670 SetUnhandledExceptionFilter,27_1_00410670
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpCode function: 27_1_00409E94 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,27_1_00409E94
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpCode function: 27_1_0040C17F SetUnhandledExceptionFilter,UnhandledExceptionFilter,TlsGetValue,TlsGetValue,TlsGetValue,RtlEncodePointer,27_1_0040C17F
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpCode function: 27_1_0040957D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,27_1_0040957D
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))Show sources
Source: C:\WINDOWS\explorer.exeSystem information queried: KernelDebuggerInformation
Checks the free space of harddrivesShow sources
Source: C:\WINDOWS\explorer.exeFile Volume queried: C:\ FullSizeInformation
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exeCode function: 1_2_00944660 RtlCreateUnicodeStringFromAsciiz,LdrGetDllHandle,RtlFreeAnsiString,RtlInitAnsiString,LdrGetProcedureAddress,1_2_00944660
Contains functionality to check if a debugger is running (IsDebuggerPresent)Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpCode function: 7_2_00409E94 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_00409E94
Contains functionality to dynamically determine API callsShow sources
Source: C:\50c0b224.exeCode function: 0_2_004042E8 GetModuleFileNameExW,LoadLibraryA,GetProcAddress,CreateFileW,GetFileSize,ReadFile,CloseHandle,0_2_004042E8
Contains functionality which may be used to detect a debugger (GetProcessHeap)Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exeCode function: 1_2_00944C50 RegQueryValueExW,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlReAllocateHeap,RegQueryValueExW,GetProcessHeap,RtlFreeHeap,1_2_00944C50
Creates guard pages, often used to prevent reverse engineering and debuggingShow sources
Source: C:\50c0b224.exeMemory protected: page read and write and page guard
Enables debug privilegesShow sources
Source: C:\50c0b224.exeProcess token adjusted: Debug
Found dropped PE file which has not been started or loadedShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpDropped PE file which has not been started: C:\Documents and Settings\Administrator\Application Data\Identities\lmypypkq.exe
May sleep (evasive loops) to hinder dynamic analysisShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exe TID: 3496Thread sleep time: -1800000ms >= -60000ms
Source: C:\WINDOWS\explorer.exe TID: 1588Thread sleep time: -60000ms >= -60000ms

Virtual Machine Detection:

barindex
Contains functionality to enumerate / list files inside a directoryShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeCode function: 1_2_009437C0 _snprintf,FindFirstFileA,strlen,strlen,strlen,strlen,_snprintf,FindNextFileA,FindClose,1_2_009437C0
Queries a list of all running processesShow sources
Source: C:\50c0b224.exeProcess information queried: ProcessInformation
Contains long sleeps (>= 3 min)Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exeThread delayed: delay time: -1800000

Hooking and other Techniques for Hiding and Protection:

barindex
Disables application error messsages (SetErrorMode)Show sources
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\50c0b224.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpProcess information set: FAILCRITICALERRORS and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: FAILCRITICALERRORS and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: FAILCRITICALERRORS and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: FAILCRITICALERRORS and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: FAILCRITICALERRORS and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: FAILCRITICALERRORS and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Extensive use of GetProcAddress (often used to hide API calls)Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exeCode function: 1_2_00941950 CreateEventW,_snprintf,TlsAlloc,CreateEventW,LoadLibraryA,InitializeCriticalSection,InitializeCriticalSection,InitializeCriticalSection,InitializeCriticalSection,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleW,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleW,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,1_2_00941950
Sores large binary data to the registryShow sources
Source: C:\WINDOWS\explorer.exeKey value created or modified: HKEY_USERS\Software\Netscape\5.0\98ec3c30\e98ec3c30 y
Deletes itself after installationShow sources
Source: C:\WINDOWS\system32\cmd.exeFile deleted: c:\50c0b224.exe
Modifies the prolog of user mode functions (user mode inline hooks)Show sources
Source: ctfmon.exeUser mode code has chanced: module: ntdll.dll function: NtResumeThread new code: 0xE9 0x98 0x8D 0xD0 0x06 0x64

Language, Device and Operating System Detection:

barindex
Contains functionality to query local / system timeShow sources
Source: C:\50c0b224.exeCode function: 0_2_0040230E fopen,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,GetLocalTime,fprintf,fclose,#825,#825,#825,#825,0_2_0040230E
Contains functionality to query windows versionShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeCode function: 1_2_00931430 GetVersionExW,GetNativeSystemInfo,1_2_00931430
Queries the cryptographic machine GUIDShow sources
Source: C:\WINDOWS\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Queries the volume information (name, serial number etc) of a deviceShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\explorer.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\explorer.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\explorer.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\explorer.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\explorer.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\explorer.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\explorer.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\explorer.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\explorer.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\explorer.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\explorer.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\ctfmon.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\ctfmon.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\ctfmon.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\ctfmon.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\ctfmon.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\ctfmon.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\ctfmon.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\ctfmon.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\ctfmon.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\ctfmon.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\ctfmon.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\ctfmon.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\ctfmon.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\ctfmon.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\wscntfy.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\wscntfy.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\wscntfy.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\wscntfy.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\wscntfy.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\wscntfy.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\wscntfy.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\wscntfy.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\wscntfy.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\wscntfy.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\wscntfy.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\wscntfy.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\wscntfy.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\wscntfy.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation

Yara Overview

No Yara matches

Startup

  • system is xp
  • 50c0b224.exe (PID: 2788 MD5: 177B75910AE8C0091BAFEF4950C0B224)
    • iexplore.exe (PID: 3492 MD5: B60DDDD2D63CE41CB8C487FCFBB6419E)
    • 50c0b224.exe (PID: 3660 MD5: 177B75910AE8C0091BAFEF4950C0B224)
      • cmd.exe (PID: 1628 cmdline: C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\MS5655~1.BAT MD5: 6D778E0F95447E6546553EEEA709D03C)
      • explorer.exe (PID: 1564 MD5: 12896823FB95BFB3DC9B46BCAEDC9923)
        • ctfmon.exe (PID: 1768 MD5: 5F1D5F88303D4A4DBC8E5F97BA967CC3)
        • wscntfy.exe (PID: 1796 MD5: F92E1076C42FCD6DB3D72D8CFE9816D5)
        • 1.tmp (PID: 4092 MD5: AAE4F6FF7E281A9600A11BCC5EB2B830)
          • cmd.exe (PID: 3368 cmdline: C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\_tmpxqr.bat MD5: 6D778E0F95447E6546553EEEA709D03C)
        • 3.tmp (PID: 1444 MD5: 69A462F5962E03C6DC1D34B3EC702EF7)
          • 3.tmp (PID: 3260 MD5: 69A462F5962E03C6DC1D34B3EC702EF7)
            • cmd.exe (PID: 2216 cmdline: C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\ms67357.bat MD5: 6D778E0F95447E6546553EEEA709D03C)
        • 4.tmp (PID: 2772 MD5: AAE4F6FF7E281A9600A11BCC5EB2B830)
          • cmd.exe (PID: 2960 cmdline: C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\_tmpxqr.bat MD5: 6D778E0F95447E6546553EEEA709D03C)
        • 6.tmp (PID: 2836 MD5: 69A462F5962E03C6DC1D34B3EC702EF7)
          • 6.tmp (PID: 2936 MD5: 69A462F5962E03C6DC1D34B3EC702EF7)
            • cmd.exe (PID: 1204 cmdline: C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\MS3561~1.BAT MD5: 6D778E0F95447E6546553EEEA709D03C)
        • 7.tmp (PID: 1020 MD5: AAE4F6FF7E281A9600A11BCC5EB2B830)
          • cmd.exe (PID: 2428 cmdline: C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\_tmpxqr.bat MD5: 6D778E0F95447E6546553EEEA709D03C)
        • 9.tmp (PID: 2468 MD5: 69A462F5962E03C6DC1D34B3EC702EF7)
          • 9.tmp (PID: 2648 MD5: 69A462F5962E03C6DC1D34B3EC702EF7)
            • cmd.exe (PID: 2292 cmdline: C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\MS2003~1.BAT MD5: 6D778E0F95447E6546553EEEA709D03C)
        • A.tmp (PID: 2760 MD5: AAE4F6FF7E281A9600A11BCC5EB2B830)
          • cmd.exe (PID: 3168 cmdline: C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\_tmpxqr.bat MD5: 6D778E0F95447E6546553EEEA709D03C)
        • C.tmp (PID: 2900 MD5: 69A462F5962E03C6DC1D34B3EC702EF7)
          • C.tmp (PID: 3388 MD5: 69A462F5962E03C6DC1D34B3EC702EF7)
            • cmd.exe (PID: 1888 cmdline: C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\MS4245~1.BAT MD5: 6D778E0F95447E6546553EEEA709D03C)
        • D.tmp (PID: 800 MD5: AAE4F6FF7E281A9600A11BCC5EB2B830)
          • cmd.exe (PID: 1640 cmdline: C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\_tmpxqr.bat MD5: 6D778E0F95447E6546553EEEA709D03C)
        • F.tmp (PID: 1472 MD5: 69A462F5962E03C6DC1D34B3EC702EF7)
          • F.tmp (PID: 2228 MD5: 69A462F5962E03C6DC1D34B3EC702EF7)
            • cmd.exe (PID: 3132 cmdline: C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\MS8537~1.BAT MD5: 6D778E0F95447E6546553EEEA709D03C)
        • 10.tmp (PID: 1344 MD5: AAE4F6FF7E281A9600A11BCC5EB2B830)
          • cmd.exe (PID: 3744 cmdline: C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\_tmpxqr.bat MD5: 6D778E0F95447E6546553EEEA709D03C)
        • 12.tmp (PID: 3656 MD5: 69A462F5962E03C6DC1D34B3EC702EF7)
          • 12.tmp (PID: 596 MD5: 69A462F5962E03C6DC1D34B3EC702EF7)
            • cmd.exe (PID: 2932 cmdline: C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\APPLIC~1\MS9522~1.BAT MD5: 6D778E0F95447E6546553EEEA709D03C)
  • cleanup

Created / dropped Files

File PathType and Hashes
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmp
  • Type: PE32 executable for MS Windows (console) Intel 80386 32-bit
  • MD5: AAE4F6FF7E281A9600A11BCC5EB2B830
  • SHA: 5807704409B557BF4FCC2C4D981BA1C642A13BA9
  • SHA-256: 73990239B738CCCF891F4009676D74E5DCBFB9391D24F24E3BBDD7B858C44CFF
  • SHA-512: FC4619DE675DDA78743AADC06C20740490F0BDFCB7A9F6A9B5662CA0512DC1E2E863DDE2D734F9A1B45B1F60F051BE48CB1D985A9EAB378DE03CB14A0E77BAA4
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\10.tmp
  • Type: PE32 executable for MS Windows (console) Intel 80386 32-bit
  • MD5: AAE4F6FF7E281A9600A11BCC5EB2B830
  • SHA: 5807704409B557BF4FCC2C4D981BA1C642A13BA9
  • SHA-256: 73990239B738CCCF891F4009676D74E5DCBFB9391D24F24E3BBDD7B858C44CFF
  • SHA-512: FC4619DE675DDA78743AADC06C20740490F0BDFCB7A9F6A9B5662CA0512DC1E2E863DDE2D734F9A1B45B1F60F051BE48CB1D985A9EAB378DE03CB14A0E77BAA4
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\11.tmp
  • Type: PE32+ executable for MS Windows (console) Mono/.Net assembly
  • MD5: 58DC1E1CF013FABF560E1C1BAFAC50A1
  • SHA: EB5D6756611A7A77A4EBB93CCD4CFAA65629BCE7
  • SHA-256: 95348C91DC905626F78F724EA63B8A6AC764FA36EA9425FF97C2BE15C7A7CAF5
  • SHA-512: 0FBBAEE19044EF4CC36634EFA49519140B85166FB10F08CA6C0332C9A4FEC9A01BA50E30FB5C37F8D7326CD8D835BAD641D63FAB4325B0599A267633614696F3
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmp
  • Type: PE32 executable for MS Windows (GUI) Intel 80386
  • MD5: 69A462F5962E03C6DC1D34B3EC702EF7
  • SHA: 42A898EB901252F9839B3376E91C80EB508ECF40
  • SHA-256: 7CAD924CAC4762E897AA2D5406CF63083E9D44D86F61CDDE86946E0419746A2C
  • SHA-512: 252F8BAABB0F160C2886B8D781A55AC747FC443029428929E52D42974EB8BBCC362181B8813C45A91D21DDE405859943DD59D148D5F4BB04A5E44E02CCA9260F
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp
  • Type: PE32+ executable for MS Windows (console) Mono/.Net assembly
  • MD5: 58DC1E1CF013FABF560E1C1BAFAC50A1
  • SHA: EB5D6756611A7A77A4EBB93CCD4CFAA65629BCE7
  • SHA-256: 95348C91DC905626F78F724EA63B8A6AC764FA36EA9425FF97C2BE15C7A7CAF5
  • SHA-512: 0FBBAEE19044EF4CC36634EFA49519140B85166FB10F08CA6C0332C9A4FEC9A01BA50E30FB5C37F8D7326CD8D835BAD641D63FAB4325B0599A267633614696F3
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmp
  • Type: PE32 executable for MS Windows (GUI) Intel 80386
  • MD5: 69A462F5962E03C6DC1D34B3EC702EF7
  • SHA: 42A898EB901252F9839B3376E91C80EB508ECF40
  • SHA-256: 7CAD924CAC4762E897AA2D5406CF63083E9D44D86F61CDDE86946E0419746A2C
  • SHA-512: 252F8BAABB0F160C2886B8D781A55AC747FC443029428929E52D42974EB8BBCC362181B8813C45A91D21DDE405859943DD59D148D5F4BB04A5E44E02CCA9260F
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\4.tmp
  • Type: PE32 executable for MS Windows (console) Intel 80386 32-bit
  • MD5: AAE4F6FF7E281A9600A11BCC5EB2B830
  • SHA: 5807704409B557BF4FCC2C4D981BA1C642A13BA9
  • SHA-256: 73990239B738CCCF891F4009676D74E5DCBFB9391D24F24E3BBDD7B858C44CFF
  • SHA-512: FC4619DE675DDA78743AADC06C20740490F0BDFCB7A9F6A9B5662CA0512DC1E2E863DDE2D734F9A1B45B1F60F051BE48CB1D985A9EAB378DE03CB14A0E77BAA4
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\5.tmp
  • Type: PE32+ executable for MS Windows (console) Mono/.Net assembly
  • MD5: 58DC1E1CF013FABF560E1C1BAFAC50A1
  • SHA: EB5D6756611A7A77A4EBB93CCD4CFAA65629BCE7
  • SHA-256: 95348C91DC905626F78F724EA63B8A6AC764FA36EA9425FF97C2BE15C7A7CAF5
  • SHA-512: 0FBBAEE19044EF4CC36634EFA49519140B85166FB10F08CA6C0332C9A4FEC9A01BA50E30FB5C37F8D7326CD8D835BAD641D63FAB4325B0599A267633614696F3
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\6.tmp
  • Type: PE32 executable for MS Windows (GUI) Intel 80386
  • MD5: 69A462F5962E03C6DC1D34B3EC702EF7
  • SHA: 42A898EB901252F9839B3376E91C80EB508ECF40
  • SHA-256: 7CAD924CAC4762E897AA2D5406CF63083E9D44D86F61CDDE86946E0419746A2C
  • SHA-512: 252F8BAABB0F160C2886B8D781A55AC747FC443029428929E52D42974EB8BBCC362181B8813C45A91D21DDE405859943DD59D148D5F4BB04A5E44E02CCA9260F
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7.tmp
  • Type: PE32 executable for MS Windows (console) Intel 80386 32-bit
  • MD5: AAE4F6FF7E281A9600A11BCC5EB2B830
  • SHA: 5807704409B557BF4FCC2C4D981BA1C642A13BA9
  • SHA-256: 73990239B738CCCF891F4009676D74E5DCBFB9391D24F24E3BBDD7B858C44CFF
  • SHA-512: FC4619DE675DDA78743AADC06C20740490F0BDFCB7A9F6A9B5662CA0512DC1E2E863DDE2D734F9A1B45B1F60F051BE48CB1D985A9EAB378DE03CB14A0E77BAA4
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\8.tmp
  • Type: PE32+ executable for MS Windows (console) Mono/.Net assembly
  • MD5: 58DC1E1CF013FABF560E1C1BAFAC50A1
  • SHA: EB5D6756611A7A77A4EBB93CCD4CFAA65629BCE7
  • SHA-256: 95348C91DC905626F78F724EA63B8A6AC764FA36EA9425FF97C2BE15C7A7CAF5
  • SHA-512: 0FBBAEE19044EF4CC36634EFA49519140B85166FB10F08CA6C0332C9A4FEC9A01BA50E30FB5C37F8D7326CD8D835BAD641D63FAB4325B0599A267633614696F3
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\9.tmp
  • Type: PE32 executable for MS Windows (GUI) Intel 80386
  • MD5: 69A462F5962E03C6DC1D34B3EC702EF7
  • SHA: 42A898EB901252F9839B3376E91C80EB508ECF40
  • SHA-256: 7CAD924CAC4762E897AA2D5406CF63083E9D44D86F61CDDE86946E0419746A2C
  • SHA-512: 252F8BAABB0F160C2886B8D781A55AC747FC443029428929E52D42974EB8BBCC362181B8813C45A91D21DDE405859943DD59D148D5F4BB04A5E44E02CCA9260F
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\A.tmp
  • Type: PE32 executable for MS Windows (console) Intel 80386 32-bit
  • MD5: AAE4F6FF7E281A9600A11BCC5EB2B830
  • SHA: 5807704409B557BF4FCC2C4D981BA1C642A13BA9
  • SHA-256: 73990239B738CCCF891F4009676D74E5DCBFB9391D24F24E3BBDD7B858C44CFF
  • SHA-512: FC4619DE675DDA78743AADC06C20740490F0BDFCB7A9F6A9B5662CA0512DC1E2E863DDE2D734F9A1B45B1F60F051BE48CB1D985A9EAB378DE03CB14A0E77BAA4
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\B.tmp
  • Type: PE32+ executable for MS Windows (console) Mono/.Net assembly
  • MD5: 58DC1E1CF013FABF560E1C1BAFAC50A1
  • SHA: EB5D6756611A7A77A4EBB93CCD4CFAA65629BCE7
  • SHA-256: 95348C91DC905626F78F724EA63B8A6AC764FA36EA9425FF97C2BE15C7A7CAF5
  • SHA-512: 0FBBAEE19044EF4CC36634EFA49519140B85166FB10F08CA6C0332C9A4FEC9A01BA50E30FB5C37F8D7326CD8D835BAD641D63FAB4325B0599A267633614696F3
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\C.tmp
  • Type: PE32 executable for MS Windows (GUI) Intel 80386
  • MD5: 69A462F5962E03C6DC1D34B3EC702EF7
  • SHA: 42A898EB901252F9839B3376E91C80EB508ECF40
  • SHA-256: 7CAD924CAC4762E897AA2D5406CF63083E9D44D86F61CDDE86946E0419746A2C
  • SHA-512: 252F8BAABB0F160C2886B8D781A55AC747FC443029428929E52D42974EB8BBCC362181B8813C45A91D21DDE405859943DD59D148D5F4BB04A5E44E02CCA9260F
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmp
  • Type: PE32 executable for MS Windows (console) Intel 80386 32-bit
  • MD5: AAE4F6FF7E281A9600A11BCC5EB2B830
  • SHA: 5807704409B557BF4FCC2C4D981BA1C642A13BA9
  • SHA-256: 73990239B738CCCF891F4009676D74E5DCBFB9391D24F24E3BBDD7B858C44CFF
  • SHA-512: FC4619DE675DDA78743AADC06C20740490F0BDFCB7A9F6A9B5662CA0512DC1E2E863DDE2D734F9A1B45B1F60F051BE48CB1D985A9EAB378DE03CB14A0E77BAA4
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E.tmp
  • Type: PE32+ executable for MS Windows (console) Mono/.Net assembly
  • MD5: 58DC1E1CF013FABF560E1C1BAFAC50A1
  • SHA: EB5D6756611A7A77A4EBB93CCD4CFAA65629BCE7
  • SHA-256: 95348C91DC905626F78F724EA63B8A6AC764FA36EA9425FF97C2BE15C7A7CAF5
  • SHA-512: 0FBBAEE19044EF4CC36634EFA49519140B85166FB10F08CA6C0332C9A4FEC9A01BA50E30FB5C37F8D7326CD8D835BAD641D63FAB4325B0599A267633614696F3
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmp
  • Type: PE32 executable for MS Windows (GUI) Intel 80386
  • MD5: 69A462F5962E03C6DC1D34B3EC702EF7
  • SHA: 42A898EB901252F9839B3376E91C80EB508ECF40
  • SHA-256: 7CAD924CAC4762E897AA2D5406CF63083E9D44D86F61CDDE86946E0419746A2C
  • SHA-512: 252F8BAABB0F160C2886B8D781A55AC747FC443029428929E52D42974EB8BBCC362181B8813C45A91D21DDE405859943DD59D148D5F4BB04A5E44E02CCA9260F
C:\Documents and Settings\Administrator\Application Data\Identities\lmypypkq.exe
  • Type: PE32 executable for MS Windows (GUI) Intel 80386
  • MD5: 69A462F5962E03C6DC1D34B3EC702EF7
  • SHA: 42A898EB901252F9839B3376E91C80EB508ECF40
  • SHA-256: 7CAD924CAC4762E897AA2D5406CF63083E9D44D86F61CDDE86946E0419746A2C
  • SHA-512: 252F8BAABB0F160C2886B8D781A55AC747FC443029428929E52D42974EB8BBCC362181B8813C45A91D21DDE405859943DD59D148D5F4BB04A5E44E02CCA9260F
C:\Documents and Settings\Administrator\Application Data\_tmpxqr.bat
  • Type: ASCII text, with CRLF line terminators
  • MD5: BE1D5CB9F36360C17FFE36C0CE3AFF63
  • SHA: 22C6C9575A7F1D53AA6464FB9CFC0F3351CB9B9E
  • SHA-256: 735911D2ADA16EEC68D8DFEF21DA2C485E36DBF0B165D805E271A6BE1ED914D3
  • SHA-512: 99F695DB070447A9B0285FBD31316F09216711AE1F258FDDF832D5F69AE7E6537A4987AB58D41CAEDE11107350F14D87C64E7595028480ABC5EA2A5885C9541A
C:\Documents and Settings\Administrator\Application Data\ms2003330.bat
  • Type: ASCII text, with CRLF line terminators
  • MD5: E6911AAB614885D51965E5DB4C41F35F
  • SHA: EF8812F2EFB888621B4903BA899830305E295EF4
  • SHA-256: 565C3C39AEC66D86AE68C358F212BE068122222DF895B88F5E01BD23F1C8CDA0
  • SHA-512: B00DB3D1AF5733CB3FC23896C2D032DC57BBCD210274E183CE29CE24C6187DD3EE121CEE583B818F82CD30C23CB9A93420C78D8B2E1612D08213CF5B5545A736
C:\Documents and Settings\Administrator\Application Data\ms3561945.bat
  • Type: ASCII text, with CRLF line terminators
  • MD5: EB27CF4230D44318E261DB7DD11530A5
  • SHA: FD70F10929D6E1DE43A6C8F32A9E17D856866BBA
  • SHA-256: AFF08D0300AFC3A121B5E20B9D76A7A2D197F04BCD6D020A5B6145586F5CCC4C
  • SHA-512: D06142FE15A39F3E069183D74EA4698E636CAF17D824DD3C0B0DD4C64946509ED60F948E241FF986914F901FC59025A8A002C09D81E7DFFF0B23878B24FC561D
C:\Documents and Settings\Administrator\Application Data\ms4245398.bat
  • Type: ASCII text, with CRLF line terminators
  • MD5: 53BB7307C88E4BE7145DD4129B29D124
  • SHA: E575DE609D31F84571B18BCABDCE2FAF39914204
  • SHA-256: BE1C272B2BD1807DE4963FBC10A89787104E104E937F08EFF5577E3F46E5B574
  • SHA-512: 3A972A62FBC402CB440166C1E1CC106D056B0F5FB872DB4AE3EB3F663F674F22500A6203B01B13BB15584CF077E91E3B244BE2C93ED98334A39C0BCC1052FFC2
C:\Documents and Settings\Administrator\Application Data\ms5655697.bat
  • Type: ASCII text, with CRLF line terminators
  • MD5: 45B02072ECDCA4D3AAB58D9C42230C03
  • SHA: B1BD35E0287CEDC0DAAB17936C644CEAD2A60C1B
  • SHA-256: F68E095F079F7721A438B65E528CDC584A27A6F9ABE8C2C65B69827BEE69C5D0
  • SHA-512: F7960C2BAB431EA33AFB7D9B3931C15C4B1463B400CFE39AE72BC1B3E3700FB1504E41EE1B0EA9C7E8FF0CBFDD382DE4BB5D9F8C0644892404AC3539AB7A56E7
C:\Documents and Settings\Administrator\Application Data\ms67357.bat
  • Type: ASCII text, with CRLF line terminators
  • MD5: F8F6A4B7173FB93E81CB0C5A1B1EC5F6
  • SHA: D6225603052453E479D341828C6EA360253B6CED
  • SHA-256: 6EB72DFC7A03070682977C1D23D1F21BA05DD36B0BC0B8EDA57532E515779F33
  • SHA-512: 2D694C278B150C1763AA64C0DE5044ABC841923090126F33F9C854332A547FE87CDCB7E44DD35C7CAE3BA2DE56A7D3A022651BB16381502A8656EA4F3D36E741
C:\Documents and Settings\Administrator\Application Data\ms8537768.bat
  • Type: ASCII text, with CRLF line terminators
  • MD5: 9C8D711D93057CA0DED71666E981130D
  • SHA: 328C02F5EF192636C3D53A39B7B042EEEBA40A7C
  • SHA-256: 1574ACBAB0C74E6B7977328A4677EA367273F41686C37B796BB747765D99A494
  • SHA-512: D5872E11B0A5626EF2517D3F68B7B5F4B9506A5D91F125F04554085C8E8C5D9E8A7458A371A595C39EC3DAA30652A26EF3E8044B08FC95B26FA2F4C998ED1BCD
C:\Documents and Settings\Administrator\Application Data\ms9522115.bat
  • Type: ASCII text, with CRLF line terminators
  • MD5: BFE0D8CFCAE9A09AF44C131A29F528E4
  • SHA: C062B00D3A3D7085E99F3A3B2529A5243640D92F
  • SHA-256: B777EA075FC508466397FB034F3C1F43D03ED2324F8606A59448CDE3DA01D7F5
  • SHA-512: 059EA931458B837D96DCF5675FD4ADA642EBA58B1EC0672E4E8976F3D9A57349FD2CD925F3282908CC709361DC7006284EA751B3CB50A4EEFC474C4159269AFB
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RC9GAWT2\df9fba64[1].htm
  • Type: data
  • MD5: 9605F1FD09590C8782330EA66A719887
  • SHA: CC976C66BD1A7FAB1DA242B46BE830A497C743C8
  • SHA-256: EF290027313D9DB83BE9601375F96051090877523C669C0EE9A4C5690AB756BD
  • SHA-512: 19679497BE2D45727310970FD2CB014502A21EE3B046EA4759D3E60865B45D96DBBEF62823FD34391AC8A8BF8EFF1FF0326B03EEFE5F09A573F799591B3BC178

Contacted Domains/Contacted IPs

Contacted Domains

NameIPName ServerActiveRegistrare-Mail
tejohjlxraqmamnx.eu46.183.219.78unknowntrueunknownunknown
ciomywfqliwtvjft.eu141.255.165.155unknowntrueunknownunknown
www.microsoft.com65.55.57.27unknowntrueunknownunknown
dlcuhbsrfdfdgxqr.eu4.4.4.4unknowntrueunknownunknown
mucqjgpwuwnbpjpt.eu4.4.4.4unknowntrueunknownunknown
mcimutcoslcqickt.eu4.4.4.4unknowntrueunknownunknown
xxgvgivxmukfmghj.eu4.4.4.4unknowntrueunknownunknown
sqfohcmawlcsajdb.eu4.4.4.4unknowntrueunknownunknown
xqnaiuvgctjdtnmj.eu173.193.106.11unknowntrueunknownunknown
vgekmcvfuiwrepmm.eu141.255.165.155unknowntrueunknownunknown
eaelgqsjqukhenaq.eu192.42.116.41unknowntrueunknownunknown
bgwpvfvrlctoexae.euunknownunknownunknownunknownunknown
xccvlgjktqtluckw.euunknownunknownunknownunknownunknown
qvfttsmongjjuvqr.euunknownunknownunknownunknownunknown
tmabrfmjsrvyqety.euunknownunknownunknownunknownunknown
sfegeqyvrbrwlhfn.euunknownunknownunknownunknownunknown
qgvlljylcnphxxpq.euunknownunknownunknownunknownunknown
pkbmogycghvntpyf.euunknownunknownunknownunknownunknown
dirlblgmokahvbms.euunknownunknownunknownunknownunknown
sxxwfpyehaqusokn.euunknownunknownunknownunknownunknown
aclectuwoehijkdr.euunknownunknownunknownunknownunknown
mgqymrpnmhlwqxah.euunknownunknownunknownunknownunknown
nxplrwcxorvwywnr.euunknownunknownunknownunknownunknown
ipqntirsifjacbli.euunknownunknownunknownunknownunknown
uemnjkyguctmmqhw.euunknownunknownunknownunknownunknown
ibhoqddojegpjaoo.euunknownunknownunknownunknownunknown
gnxwulfdcycoquem.euunknownunknownunknownunknownunknown
qkelqhmxvvlnghgr.euunknownunknownunknownunknownunknown
oediaaajvtivmfji.euunknownunknownunknownunknownunknown
dejyvasauoqnafjf.euunknownunknownunknownunknownunknown
ypsilniicsisufut.euunknownunknownunknownunknownunknown
ibfjkhfwaptidpvi.euunknownunknownunknownunknownunknown
sbvgyflwxfiqdlca.euunknownunknownunknownunknownunknown
bjhyciikpulkohrd.euunknownunknownunknownunknownunknown
wqkbgtixyegdhjsk.euunknownunknownunknownunknownunknown
ilkgitclxxyamcnn.euunknownunknownunknownunknownunknown
twdsvilghyckhtsx.euunknownunknownunknownunknownunknown
fgcpuwrpbixyxkpn.euunknownunknownunknownunknownunknown
mqtqeicxborutamg.euunknownunknownunknownunknownunknown
tirbmhywlvmsiiql.euunknownunknownunknownunknownunknown
tlckswxcporosruk.euunknownunknownunknownunknownunknown
wjrfusigodfboqxk.euunknownunknownunknownunknownunknown
ifnvcfsvtxpollyv.euunknownunknownunknownunknownunknown
evilbsfkwybbvewp.euunknownunknownunknownunknownunknown
hmdslrrrokbefaak.euunknownunknownunknownunknownunknown
qdlpftmgluklnolr.euunknownunknownunknownunknownunknown
vyxbbovnwtiplwrm.euunknownunknownunknownunknownunknown
paxhwpmfrappqnat.euunknownunknownunknownunknownunknown
ywlewbiaahwunxct.euunknownunknownunknownunknownunknown
rukckyydnfiyvnyc.euunknownunknownunknownunknownunknown
itbsfpdwlpraqhto.euunknownunknownunknownunknownunknown
vkmweajroeglaypa.euunknownunknownunknownunknownunknown
gqigoorisehkbrvl.euunknownunknownunknownunknownunknown
akcqycvipvmuapjs.euunknownunknownunknownunknownunknown
nfvhdxcpmgkmfdvr.euunknownunknownunknownunknownunknown
tsusqkxtadgeykpk.euunknownunknownunknownunknownunknown
cqfyvsgcmaptacyu.euunknownunknownunknownunknownunknown
xbefaliqqnpbwpli.euunknownunknownunknownunknownunknown
ehwteesbojyjwshd.euunknownunknownunknownunknownunknown
vrfspnvvyfhnseka.euunknownunknownunknownunknownunknown
fhagtfgwelcwjkoc.euunknownunknownunknownunknownunknown
imiwtodfboqxkoyo.euunknownunknownunknownunknownunknown
kksnnncvnybdnlpw.euunknownunknownunknownunknownunknown
pojygemoadfhpycg.euunknownunknownunknownunknownunknown
uwgrxjyownfktxmw.euunknownunknownunknownunknownunknown
kyefkccfjceuyjrj.euunknownunknownunknownunknownunknown
ljxvqgoknxasodxh.euunknownunknownunknownunknownunknown
iiakcedghshrcsvb.euunknownunknownunknownunknownunknown
obqtabpyimegjlmd.euunknownunknownunknownunknownunknown
xuvmasjsvcsjcwpw.euunknownunknownunknownunknownunknown
fkkcaisciehsttsb.euunknownunknownunknownunknownunknown
nqwpgjpgequugrgf.euunknownunknownunknownunknownunknown
tbyfbtyfbulqppvl.euunknownunknownunknownunknownunknown
psrllcabhybnxuft.euunknownunknownunknownunknownunknown
cmwyquspfegnrsih.euunknownunknownunknownunknownunknown
ierkwsctawxxgjsn.euunknownunknownunknownunknownunknown
mjbigucgqaqsburg.euunknownunknownunknownunknownunknown
mfsibwotjehmslos.euunknownunknownunknownunknownunknown
qomxifakdfihcqjf.euunknownunknownunknownunknownunknown
frdxxiftsfiummnb.euunknownunknownunknownunknownunknown
gknbcjgxxswfglan.euunknownunknownunknownunknownunknown
rysocwmphbrfrwcd.euunknownunknownunknownunknownunknown
aruywpiankbkgies.euunknownunknownunknownunknownunknown
ttsjpsyndgkowwby.euunknownunknownunknownunknownunknown
rnrgyxylpqtjdirp.euunknownunknownunknownunknownunknown
rxuxdolvexaugkqo.euunknownunknownunknownunknownunknown
siockglovtjsvqjm.euunknownunknownunknownunknownunknown
jeujytpcdyblgbaa.euunknownunknownunknownunknownunknown
vdtbgmjaedfjhgin.euunknownunknownunknownunknownunknown
rcqximyuxgjbcttc.euunknownunknownunknownunknownunknown
owutupomoqumncjp.euunknownunknownunknownunknownunknown
joxbqkcmrshjjdyl.euunknownunknownunknownunknownunknown
ekhdxtrgfceshpyc.euunknownunknownunknownunknownunknown
dpkhmysqylbjottf.euunknownunknownunknownunknownunknown
upnvmvywyyqunffk.euunknownunknownunknownunknownunknown
cphikxfijwxvocat.euunknownunknownunknownunknownunknown
ytbiqlvhvbrydoxh.euunknownunknownunknownunknownunknown
sctwknmqbvmboxnb.euunknownunknownunknownunknownunknown
ksjaxjdhoqtpeqvx.euunknownunknownunknownunknownunknown
nwrusobeyormbxcq.euunknownunknownunknownunknownunknown
jvqwoxoqchvlcvgl.euunknownunknownunknownunknownunknown
hbckigrbknqiqxoj.euunknownunknownunknownunknownunknown
bnplhgvjjquqwduq.euunknownunknownunknownunknownunknown
cxxhhtgtwbqvshgu.euunknownunknownunknownunknownunknown
xtxvbkiysybyqwqi.euunknownunknownunknownunknownunknown
bfyywwhxiyceglop.euunknownunknownunknownunknownunknown
oasdosbfsjavxlno.euunknownunknownunknownunknownunknown
hfkwaefnejacmhfk.euunknownunknownunknownunknownunknown
jlnfkuptnapnyghm.euunknownunknownunknownunknownunknown
fosorssbcaqycdjc.euunknownunknownunknownunknownunknown
vvnfuljigoqtbnnn.euunknownunknownunknownunknownunknown
krljybcnlnpfgekw.euunknownunknownunknownunknownunknown
cwaevlfahlmluuhg.euunknownunknownunknownunknownunknown
npyyhbombnqkifuq.euunknownunknownunknownunknownunknown
nthymyoluvmqqbxe.euunknownunknownunknownunknownunknown
fdrgohskkpsdbolo.euunknownunknownunknownunknownunknown
aokdenjujrvbvlmg.euunknownunknownunknownunknownunknown
yfpqtwvxalcurdvu.euunknownunknownunknownunknownunknown
mnjuxfpfkvmyjqut.euunknownunknownunknownunknownunknown
ewgcabteapsltqie.euunknownunknownunknownunknownunknown
wkpvgbwargjlmdwy.euunknownunknownunknownunknownunknown
hqlfqpfevgkknvpk.euunknownunknownunknownunknownunknown
yeraicirkixwgqwg.euunknownunknownunknownunknownunknown
dsudsofjdrgfydlr.euunknownunknownunknownunknownunknown
dwddxmsiwaplhmof.euunknownunknownunknownunknownunknown
ohnegpybmmnrwonh.euunknownunknownunknownunknownunknown
owwybymexfhttmoi.euunknownunknownunknownunknownunknown
prtumtltqiwpmitf.euunknownunknownunknownunknownunknown
rgyknkmhfpshkpwp.euunknownunknownunknownunknownunknown
ifpbvbqndapvrvec.euunknownunknownunknownunknownunknown
ulfjuxlxfquofjcw.euunknownunknownunknownunknownunknown
ctpucvshdshpkldh.euunknownunknownunknownunknownunknown
gcworafmkorscgty.euunknownunknownunknownunknownunknown
wrirrojrcuknfvey.euunknownunknownunknownunknownunknown
qrwtouyctkadmabr.euunknownunknownunknownunknownunknown
kobnslpuhukjvhsk.euunknownunknownunknownunknownunknown
lyhemdpnyqthlbyi.euunknownunknownunknownunknownunknown
jsgbviplloqpryoy.euunknownunknownunknownunknownunknown
elftjcgnifidscxq.euunknownunknownunknownunknownunknown
eemxxbgvkqtnmjde.euunknownunknownunknownunknownunknown
pvcurryskegjirws.euunknownunknownunknownunknownunknown
rfbhcplncmowypxb.euunknownunknownunknownunknownunknown
wghjodjbxkafehtl.euunknownunknownunknownunknownunknown
dtstewgdgukpwpws.euunknownunknownunknownunknownunknown
bxsdyjugxkbcnstp.euunknownunknownunknownunknownunknown
vhcblkwyklbppclb.euunknownunknownunknownunknownunknown
ldderbdagaqbhkcj.euunknownunknownunknownunknownunknown
voujjxjqiapriusn.euunknownunknownunknownunknownunknown
uhwjpalyluliwayv.euunknownunknownunknownunknownunknown
nmodolchkuloxidr.euunknownunknownunknownunknownunknown
agtqteijvaqorggf.euunknownunknownunknownunknownunknown
jamwtvcdjdffxrjy.euunknownunknownunknownunknownunknown
xjuewtvoefibbifw.euunknownunknownunknownunknownunknown
wybndpjjajypxbyl.euunknownunknownunknownunknownunknown
avdycbjmhgkqoehg.euunknownunknownunknownunknownunknown
eoppprfsykayplcd.euunknownunknownunknownunknownunknown
fyvgjjflqtjwffib.euunknownunknownunknownunknownunknown
vnwskpiwfwxtwuty.euunknownunknownunknownunknownunknown
xfmrrvipkjyhfyov.euunknownunknownunknownunknownunknown
lroibppvbpsfsiev.euunknownunknownunknownunknownunknown
hxebcqfvgulmgokk.euunknownunknownunknownunknownunknown
hcabhosuaqusoknx.euunknownunknownunknownunknownunknown
gyyflkstgvmwrjca.euunknownunknownunknownunknownunknown
gjpkdbfeidgiiyby.euunknownunknownunknownunknownunknown
ixhaersejwomssej.euunknownunknownunknownunknownunknown
edohmgfcunpdowep.euunknownunknownunknownunknownunknown
wnafaejsiybhwmbl.euunknownunknownunknownunknownunknown
bcodeuisrgkivowd.euunknownunknownunknownunknownunknown
dbyppkguqvlrpirs.euunknownunknownunknownunknownunknown
aynuiqirxlcmynlf.euunknownunknownunknownunknownunknown
imgrnsfnrmeeretv.euunknownunknownunknownunknownunknown
rjjttaymvukduybc.euunknownunknownunknownunknownunknown
osomjbmfewxalqlu.euunknownunknownunknownunknownunknown
oijplocqgbsicehd.euunknownunknownunknownunknownunknown
qnohwwldacewqqkq.euunknownunknownunknownunknownunknown
dabmepfbbguhrvse.euunknownunknownunknownunknownunknown
lkvmpopeqbrdadwv.euunknownunknownunknownunknownunknown
phqdiqmwcoqrjgug.euunknownunknownunknownunknownunknown
jhfsfwcuteghqkey.euunknownunknownunknownunknownunknown
htvbwfrjmycgxfhw.euunknownunknownunknownunknownunknown
quhdixlukdfyjjfq.euunknownunknownunknownunknownunknown
lgnaxqcfwfiwetgi.euunknownunknownunknownunknownunknown
iwjjfjrkgtkcugsu.euunknownunknownunknownunknownunknown
rqcpfbyetjyfnrvo.euunknownunknownunknownunknownunknown
ybhecmvygpsbjhsh.euunknownunknownunknownunknownunknown
uvibmoxutkbavlbv.euunknownunknownunknownunknownunknown
oauiuoyjoxycejgu.euunknownunknownunknownunknownunknown
iixriurbxqukvudi.euunknownunknownunknownunknownunknown
uopfbblqjjaxpsgv.euunknownunknownunknownunknownunknown
yxjuijjtpwnfykbi.euunknownunknownunknownunknownunknown
otkxoaphxxpqdsrd.euunknownunknownunknownunknownunknown
oltlreovwgkemnlc.euunknownunknownunknownunknownunknown
isdcthcdvmnpfuua.euunknownunknownunknownunknownunknown
luyehfcofixbdfvu.euunknownunknownunknownunknownunknown
byqtkrvabbsmlfse.euunknownunknownunknownunknownunknown
ipssarpkrtituxdb.euunknownunknownunknownunknownunknown
anmmffibtorqkynr.euunknownunknownunknownunknownunknown
ityaygffpbsgkwbv.euunknownunknownunknownunknownunknown
plypaoajjkalfpxt.euunknownunknownunknownunknownunknown
pdiqdsykishlbkrs.euunknownunknownunknownunknownunknown
lngvvecwhtjywynu.euunknownunknownunknownunknownunknown
guqsgmfumaqqjnyy.euunknownunknownunknownunknownunknown
yiaanavqeehqcanh.euunknownunknownunknownunknownunknown
bqaunvuoajaauamd.euunknownunknownunknownunknownunknown
wusnxevwsapjpfvx.euunknownunknownunknownunknownunknown
osmhdfonuulgfggc.euunknownunknownunknownunknownunknown
kdafpapedxabusuw.euunknownunknownunknownunknownunknown
cbvqnjsyntirdext.euunknownunknownunknownunknownunknown
cfeqshgluprxlabu.euunknownunknownunknownunknownunknown
usxrsllpdfjelcwj.euunknownunknownunknownunknownunknown
xmfndwihixawxejv.euunknownunknownunknownunknownunknown
kapvvwplyrurwvdx.euunknownunknownunknownunknownunknown
mxmmpvocypswmsts.euunknownunknownunknownunknownunknown
olvqxamngiwxfxqu.euunknownunknownunknownunknownunknown
opclwccieptkujop.euunknownunknownunknownunknownunknown
uaebrmlhbtkgeuej.euunknownunknownunknownunknownunknown
lcfnssospjydvkdu.euunknownunknownunknownunknownunknown
smwoceynppsyeaan.euunknownunknownunknownunknownunknown
ymimfxvpxmdwkvdu.euunknownunknownunknownunknownunknown
jwonngdxfkajnifa.euunknownunknownunknownunknownunknown
hjsjfcsmxrvuhdix.euunknownunknownunknownunknownunknown
mmlemkolhsiolejs.euunknownunknownunknownunknownunknown
sjmsvbmiywndhqib.euunknownunknownunknownunknownunknown
qyppavyteybffsie.euunknownunknownunknownunknownunknown
fnuxskrhyjybeqkn.euunknownunknownunknownunknownunknown
oebdtqoemfjctuqc.euunknownunknownunknownunknownunknown
fvlkdtssmbrbivqo.euunknownunknownunknownunknownunknown
nigqjnoudycipmae.euunknownunknownunknownunknownunknown
nbnuxmodskbgwtfe.euunknownunknownunknownunknownunknown
kvtvqycmfjyloank.euunknownunknownunknownunknownunknown
buihstibhfjgdjpq.euunknownunknownunknownunknownunknown
hutrinsdpctqvrsx.euunknownunknownunknownunknownunknown
aufiqsufedggqrir.euunknownunknownunknownunknownunknown
wcyjjfvoqoqlixdx.euunknownunknownunknownunknownunknown
esxcupsrsgjflufq.euunknownunknownunknownunknownunknown
khirhxpdwgjhdclx.euunknownunknownunknownunknownunknown
grgwawscvhluyqha.euunknownunknownunknownunknownunknown
jpvrcsdguvlthpka.euunknownunknownunknownunknownunknown
iwlolfpcpiwvnqxn.euunknownunknownunknownunknownunknown
ggfowxflekbmxcwm.euunknownunknownunknownunknownunknown
tpkwkulojkbiobll.euunknownunknownunknownunknownunknown
stpknrlfnehoksha.euunknownunknownunknownunknownunknown
adjunovqrhlshwos.euunknownunknownunknownunknownunknown

Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs
IPCountryPingableOpen Ports
46.183.219.78Latviaunknownunknown
178.210.167.213Turkeyunknownunknown
64.27.101.155United Statesunknownunknown
144.76.59.84Germanyunknownunknown
177.73.233.170Brazilunknownunknown
109.74.3.6Swedenunknownunknown
195.186.1.121Switzerlandunknownunknown
195.186.4.121Switzerlandunknownunknown
212.19.62.76Germanyunknownunknown
65.55.57.27United Statesunknownunknown

Static File Info

General

File type:PE32 executable for MS Windows (GUI) Intel 80386 32-bit
TrID:
  • Win32 Executable MS Visual C++ (generic) (31208/45) 78.55%
  • Win32 Executable (generic) (4510/7) 11.35%
  • Generic Win/DOS Executable (2004/3) 5.04%
  • DOS Executable Generic (2002/1) 5.04%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.02%
File name:50c0b224.exe
File size:163840
MD5:177b75910ae8c0091bafef4950c0b224
SHA1:d4dfb2d2b40224310fbd6d928bf7eded03d814bd
SHA256:3d5fda867fdfb3f414b8edcdda6cefd89118df4399043c35f8e901dae66f7b1b
SHA512:c315ba1d9255fc93ae42a20549645e4a2f2eddddc89b65422c3b8b78f951cba432eff66ab2fac6c1061cfd0738d0918b7730a0b0af4ccfc322a1f97c30e5dc47

Static PE Info

General

Entrypoint:0x4050e6
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x400000
Subsystem:windows gui
Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:0x5460FA75 [Mon Nov 10 17:48:37 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:4
OS Version Minor:0
File Version Major:4
File Version Minor:0
Subsystem Version Major:4
Subsystem Version Minor:0

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00406AE8h
push 00405272h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [004063D4h]
pop ecx
or dword ptr [00408B3Ch], FFFFFFFFh
or dword ptr [00408B40h], FFFFFFFFh
call dword ptr [004063D8h]
mov ecx, dword ptr [00408B30h]
mov dword ptr [eax], ecx
call dword ptr [004063DCh]
mov ecx, dword ptr [00408B2Ch]
mov dword ptr [eax], ecx
mov eax, dword ptr [004063E0h]
mov eax, dword ptr [eax]
mov dword ptr [00408B38h], eax
call 0E1084F1h
cmp dword ptr [00408200h], ebx
jne 0E1083DEh
push 0040526Eh
call dword ptr [004063E4h]
pop ecx
call 0E1084C3h
push 0040801Ch
push 00408018h
call 0E1084AEh
mov eax, dword ptr [00408B28h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [00408B24h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [004063ECh]
push 00408014h

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x6f080xa0.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE0x90000x1ee54.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x60000x460.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x20400x256.text
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeEntropyXored PEZLIB ComplexityFile TypeCharacteristics
.text0x10000x44ca0x50005.64849678057False0.486767578125ump; dataIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata0x60000x175e0x20003.96345440858False0.279907226562ump; dataIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data0x80000xb2a0x10000.990670512674False0.093505859375ump; dataIMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc0x90000x1ee540x1f0007.87655626021False0.91845703125ump; dataIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

NameRVASizeTypeLanguageCountryNbr Of FunctionsXored PE
SYS0x95700x1b42eump; GIF image data, version 89a, 468 x 600False
RT_CURSOR0x249a00x134ump; dataChineseChina0False
RT_ICON0x24efc0x25a8ump; data0False
RT_MENU0x274a40x1f4ump; dataChineseChina0False
RT_DIALOG0x276980xeeump; dataChineseChina0False
RT_STRING0x277880x96ump; dataChineseChina0False
RT_STRING0x278200x36ump; dataChineseChina0False
RT_STRING0x278580x3cump; dataChineseChina0False
RT_STRING0x278940x8eump; dataChineseChina0False
RT_STRING0x279240xc0ump; Hitachi SH big-endian COFF executable, strippedChineseChina0False
RT_STRING0x279e40x136ump; dataChineseChina0False
RT_STRING0x27b1c0x3cump; dataChineseChina0False
RT_STRING0x27b580x60ump; dataChineseChina0False
RT_STRING0x27bb80x54ump; dataChineseChina0False
RT_STRING0x27c0c0x5aump; DBase 3 data file (1410161749 records)ChineseChina0False
RT_STRING0x27c680x58ump; dataChineseChina0False
RT_STRING0x27cc00xa4ump; DBase 3 index fileChineseChina0False
RT_STRING0x27d640x3eump; dataChineseChina0False
RT_ACCELERATOR0x27da40x68ump; dataChineseChina0False
RT_GROUP_CURSOR0x27e0c0x14ump; Lotus 1-2-3ChineseChina0False
RT_GROUP_ICON0x27e200x14ump; MS Windows icon resource - 1 icon0False
None0x27e340x1eump; dataChineseChina0False

Imports

DLLImport
MFC42.DLL
MSVCRT.dll_except_handler3, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, _onexit, __dllonexit, ??1type_info@@UAE@XZ, strlen, __CxxFrameHandler, _controlfp, _setmbcp, sprintf, fopen, fprintf, fclose, fabs, _ftol, memcpy, abs, memset
KERNEL32.dllFindNextFileA, ReadFile, CreateFileW, GetProcAddress, FindClose, OpenProcess, GetCurrentProcessId, GetModuleHandleA, GetStartupInfoA, GetLocalTime, CreateFileA, WriteFile, UnmapViewOfFile, CloseHandle, GlobalUnlock, GlobalFree, LoadLibraryA, GetFileSize
USER32.dllUpdateWindow, EnableWindow
GDI32.dllDeleteObject, StretchDIBits, SelectPalette, CreatePen
SHELL32.dllSHBrowseForFolderA
PSAPI.DLLGetModuleFileNameExW

Possible Origin

Language of compilation systemCountry where language is spokenMap
ChineseChina

Network Behavior

TCP Packets

TimestampSource PortDest PortSource IPDest IP
Nov 13, 2014 13:24:40.853512049 MEZ5990253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.118190050 MEZ5359902195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.157015085 MEZ6392853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.157083988 MEZ5363928195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.165848970 MEZ103180192.168.1.1065.55.57.27
Nov 13, 2014 13:24:41.165864944 MEZ80103165.55.57.27192.168.1.10
Nov 13, 2014 13:24:41.165951967 MEZ103180192.168.1.1065.55.57.27
Nov 13, 2014 13:24:41.171370983 MEZ103180192.168.1.1065.55.57.27
Nov 13, 2014 13:24:41.171382904 MEZ80103165.55.57.27192.168.1.10
Nov 13, 2014 13:24:41.689332008 MEZ80103165.55.57.27192.168.1.10
Nov 13, 2014 13:24:41.692558050 MEZ103180192.168.1.1065.55.57.27
Nov 13, 2014 13:24:41.692636013 MEZ80103165.55.57.27192.168.1.10
Nov 13, 2014 13:24:41.692761898 MEZ103180192.168.1.1065.55.57.27
Nov 13, 2014 13:24:41.700335026 MEZ5583253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.704107046 MEZ6378953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.707951069 MEZ5830353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.711432934 MEZ5187753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.715250969 MEZ5661753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.715581894 MEZ6125253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.720247030 MEZ5324153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.721189022 MEZ6379053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.724976063 MEZ5966753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.728080034 MEZ5102953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.732897043 MEZ5118653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.735433102 MEZ5826453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.735569954 MEZ5734753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.737111092 MEZ5522253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.737261057 MEZ5464853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.737669945 MEZ5583053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.800652027 MEZ5353241195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.802920103 MEZ5331153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.825613022 MEZ5355832195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.827892065 MEZ5817553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.830266953 MEZ5351877195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.830327034 MEZ5358303195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.832550049 MEZ5361252195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.832612991 MEZ5356617195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.832670927 MEZ5359667195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.836457014 MEZ5363790195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.838140011 MEZ5899653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.839975119 MEZ5936453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.841630936 MEZ5529053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.843282938 MEZ4930753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.844237089 MEZ4968753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.845503092 MEZ5445453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.846626043 MEZ5363789195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.848908901 MEZ6125553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.872909069 MEZ5351186195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.875381947 MEZ6114653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.878220081 MEZ5355222195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.878289938 MEZ5357347195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.880587101 MEZ6412153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.883938074 MEZ5351029195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.884007931 MEZ5354648195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.884074926 MEZ5358264195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.893752098 MEZ5835353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.896970034 MEZ5663853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.898669004 MEZ5140353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.899975061 MEZ6159053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.906930923 MEZ5355830195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.909233093 MEZ6134853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.958017111 MEZ5353311195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.960470915 MEZ4939453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.986630917 MEZ5358996195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.988900900 MEZ5968453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:41.997279882 MEZ5358175195.186.1.121192.168.1.10
Nov 13, 2014 13:24:41.997342110 MEZ5355290195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.001140118 MEZ5495953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.001993895 MEZ5302353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.007515907 MEZ5359364195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.007577896 MEZ5349687195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.009304047 MEZ5354454195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.011661053 MEZ6379153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.013915062 MEZ6379253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.015527964 MEZ5235253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.034935951 MEZ5361255195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.037158012 MEZ6379353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.045452118 MEZ5361146195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.047624111 MEZ6379453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.056155920 MEZ5358353195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.058373928 MEZ4955953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.066792965 MEZ5364121195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.066854000 MEZ5356638195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.070023060 MEZ5482453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.071501970 MEZ6379553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.083514929 MEZ5361590195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.085810900 MEZ5170353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.099292040 MEZ5361348195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.102658987 MEZ6011053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.107770920 MEZ5351403195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.110970020 MEZ5722953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.123658895 MEZ5349394195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.125899076 MEZ6379653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.131767988 MEZ5359684195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.132155895 MEZ5354959195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.132216930 MEZ5353023195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.137113094 MEZ6134153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.138031006 MEZ5394553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.138849020 MEZ6011653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.140335083 MEZ5363791195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.142793894 MEZ5634853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.166821957 MEZ5363792195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.169456005 MEZ6379753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.206336975 MEZ5363793195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.208659887 MEZ5402953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.212367058 MEZ5349307195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.212436914 MEZ5363794195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.214808941 MEZ6051253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.216895103 MEZ5352352195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.216978073 MEZ5354824195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.217046022 MEZ5349559195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.221209049 MEZ6067053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.222580910 MEZ5097553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.224601984 MEZ5977553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.225476027 MEZ5717653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.247430086 MEZ5363795195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.249737978 MEZ5769053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.256957054 MEZ5351703195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.257019997 MEZ5360110195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.258218050 MEZ5357229195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.262255907 MEZ6379853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.263323069 MEZ5214553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.263915062 MEZ5466753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.266288042 MEZ5363796195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.268604994 MEZ6174453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.277048111 MEZ5361341195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.281076908 MEZ5522653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.285310030 MEZ5360116195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.287842035 MEZ5291753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.295466900 MEZ5353945195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.298001051 MEZ5233953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.336222887 MEZ5356348195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.338803053 MEZ5174953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.346832037 MEZ5354029195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.349225044 MEZ5322053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.358169079 MEZ5363797195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.360553980 MEZ6537853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.378407001 MEZ5360670195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.380769014 MEZ5013053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.386709929 MEZ5360512195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.386732101 MEZ5350975195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.389719009 MEZ6547753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.391350985 MEZ5981653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.394999027 MEZ5359775195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.398298979 MEZ4960453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.403183937 MEZ5357176195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.403215885 MEZ5363798195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.405689001 MEZ6034553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.407907009 MEZ6417853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.411752939 MEZ5357690195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.414237976 MEZ5973653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.420037985 MEZ5352145195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.422455072 MEZ5765053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.439882040 MEZ5361744195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.442358017 MEZ6379953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.481163979 MEZ5352917195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.483536005 MEZ5219353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.489356995 MEZ5355226195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.491714954 MEZ6129253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.498204947 MEZ5352339195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.498234987 MEZ5351749195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.502851009 MEZ5617253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.503742933 MEZ5752353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.520153999 MEZ5354667195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.522471905 MEZ5207253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.528884888 MEZ5353220195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.528914928 MEZ5350130195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.531716108 MEZ5180053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.533462048 MEZ6390853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.537343979 MEZ5365378195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.541683912 MEZ6523653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.545466900 MEZ5365477195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.547728062 MEZ6380053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.553622961 MEZ5359816195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.553673029 MEZ5360345195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.553704023 MEZ5349604195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.563527107 MEZ6488453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.564826012 MEZ5769853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.566304922 MEZ6099153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.584439993 MEZ5364178195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.587815046 MEZ6380153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.651702881 MEZ5357650195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.654042959 MEZ5521153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.662902117 MEZ5359736195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.662942886 MEZ5352193195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.665790081 MEZ5281653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.667433023 MEZ5672253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.671812057 MEZ5363799195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.671853065 MEZ5357523195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.674434900 MEZ5361292195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.674483061 MEZ5356172195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.675266981 MEZ6041053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.678580046 MEZ5849653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.680866003 MEZ4993453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.681018114 MEZ6474153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.683026075 MEZ5363908195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.685349941 MEZ6414153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.691446066 MEZ5352072195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.691487074 MEZ5351800195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.695389986 MEZ5095453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.697074890 MEZ5652753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.716141939 MEZ5363800195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.718456030 MEZ6413953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.724524975 MEZ5365236195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.724558115 MEZ5364884195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.727554083 MEZ5227253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.729101896 MEZ5669653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.732758045 MEZ5357698195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.735027075 MEZ6380253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.756716013 MEZ5363801195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.759176970 MEZ6380353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.799808979 MEZ5349934195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.808114052 MEZ5355211195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.808293104 MEZ5352816195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.816975117 MEZ5485453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.823263884 MEZ5275953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.824441910 MEZ6465253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.846069098 MEZ5364141195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.850570917 MEZ5356722195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.850697041 MEZ5358496195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.854315042 MEZ5360410195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.854404926 MEZ5364741195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.869734049 MEZ6380453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.873061895 MEZ6016053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.874022007 MEZ5507353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.874890089 MEZ5120453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.876385927 MEZ6407553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.884294987 MEZ5350954195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.887623072 MEZ6380553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.930027962 MEZ5356527195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.930202961 MEZ5352272195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.938602924 MEZ5356696195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.938771009 MEZ5363802195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.943449020 MEZ6404353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.946634054 MEZ5884953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.947572947 MEZ5598453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.949285984 MEZ5333353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.973980904 MEZ5363803195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.976502895 MEZ6507953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:42.985214949 MEZ5354854195.186.1.121192.168.1.10
Nov 13, 2014 13:24:42.991734982 MEZ5355053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.000237942 MEZ5352759195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.010452986 MEZ5120253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.019257069 MEZ5364652195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.026360035 MEZ5433053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.033385992 MEZ5363804195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.033426046 MEZ5351204195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.034674883 MEZ5355073195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.034714937 MEZ5360160195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.043201923 MEZ5510553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.045809031 MEZ5595853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.047741890 MEZ5912553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.050038099 MEZ5403553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.052719116 MEZ5364139195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.055054903 MEZ5189553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.094254971 MEZ5363805195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.110573053 MEZ5973453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.112754107 MEZ5364075195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.112812042 MEZ5364043195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.115171909 MEZ6045853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.117317915 MEZ5961353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.119158030 MEZ5355984195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.119199991 MEZ5353333195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.122807980 MEZ5053153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.123676062 MEZ5283853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.140232086 MEZ5358849195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.145908117 MEZ6380653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.150984049 MEZ5365079195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.153343916 MEZ6507453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.159544945 MEZ5353550195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.166182995 MEZ6111253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.167737007 MEZ5351202195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.167838097 MEZ5354330195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.175837994 MEZ5589953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.179603100 MEZ5104053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.181760073 MEZ5355958195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.187617064 MEZ6471453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.190192938 MEZ5355105195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.190294027 MEZ5351895195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.198555946 MEZ5359125195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.198669910 MEZ5354035195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.205729961 MEZ4957853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.208147049 MEZ5863353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.208301067 MEZ5685853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.209151030 MEZ5974153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.229053020 MEZ5360458195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.239273071 MEZ5059953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.279582024 MEZ5359734195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.282985926 MEZ5336953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.291697025 MEZ5359613195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.291722059 MEZ5352838195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.295351982 MEZ5999553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.296320915 MEZ5613853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.300723076 MEZ5350531195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.300764084 MEZ5363806195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.303982973 MEZ5351040195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.304023981 MEZ5361112195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.305350065 MEZ5719753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.308597088 MEZ5291353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.309868097 MEZ6105953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.310815096 MEZ6499453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.312589884 MEZ5365074195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.314883947 MEZ5476153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.323723078 MEZ5358633195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.325855017 MEZ5491853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.333178043 MEZ5364714195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.333230019 MEZ5349578195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.338294983 MEZ5547053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.338423014 MEZ6050653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.341705084 MEZ5355899195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.343806982 MEZ5546253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.375581026 MEZ5356858195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.377700090 MEZ6380753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.415585041 MEZ5359741195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.417687893 MEZ5187053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.425720930 MEZ5350599195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.427836895 MEZ6442353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.442455053 MEZ5356138195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.444632053 MEZ6156953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.453490019 MEZ5359995195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.455606937 MEZ5332953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.461971045 MEZ5352913195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.464332104 MEZ5676953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.464871883 MEZ5357197195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.467832088 MEZ5467553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.470304966 MEZ5361059195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.470340967 MEZ5354918195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.473279953 MEZ5875353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.474436045 MEZ5114953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.499167919 MEZ5364994195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.511204958 MEZ5989453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.546042919 MEZ5354761195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.548295975 MEZ5276053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.549591064 MEZ5355470195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.549633980 MEZ5355462195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.552320957 MEZ5874853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.554442883 MEZ5353369195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.554480076 MEZ5363807195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.554518938 MEZ5351870195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.559685946 MEZ6099153192.168.1.10195.186.4.121
Nov 13, 2014 13:24:43.564054966 MEZ5677053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.566783905 MEZ6422053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.567697048 MEZ5161853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.568567991 MEZ5471153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.586101055 MEZ5353329195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.588243961 MEZ6380853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.655491114 MEZ5364423195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.657773972 MEZ5317753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.668668032 MEZ5356769195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.670762062 MEZ6380953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.679022074 MEZ5361569195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.679060936 MEZ5354675195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.682343960 MEZ5385453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.683304071 MEZ5719853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.684803009 MEZ5352760195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.684840918 MEZ5351149195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.687563896 MEZ5765953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.689143896 MEZ5981753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.690723896 MEZ5358753195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.690762997 MEZ5359894195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.695606947 MEZ5548953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.696423054 MEZ5020753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.698782921 MEZ5358748195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.700921059 MEZ6451553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.707092047 MEZ5360506195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.709258080 MEZ5422853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.716418028 MEZ5356770195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.718537092 MEZ5747153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.741991997 MEZ5351618195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.744108915 MEZ5689053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.752496958 MEZ5364220195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.754667044 MEZ6118253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.763672113 MEZ5360991195.186.4.121192.168.1.10
Nov 13, 2014 13:24:43.765818119 MEZ6381053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.771886110 MEZ5360991195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.791606903 MEZ5354711195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.793715954 MEZ5895253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.802124977 MEZ5353177195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.804291964 MEZ4918453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.812704086 MEZ5363808195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.812741995 MEZ5363809195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.816947937 MEZ6381153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.817816019 MEZ5933453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.825390100 MEZ5357198195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.825427055 MEZ5357659195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.828459024 MEZ5190853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.829659939 MEZ5651253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.841851950 MEZ5359817195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.843954086 MEZ5682553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.850281000 MEZ5353854195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.850311041 MEZ5355489195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.853176117 MEZ5364515195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.853203058 MEZ5350207195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.855119944 MEZ6066053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.856544018 MEZ6381253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.858192921 MEZ5188953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.859210968 MEZ5354228195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.859220028 MEZ5001153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.862270117 MEZ5147553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.875653982 MEZ5357471195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.877758026 MEZ5587453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.900444984 MEZ5361182195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.902573109 MEZ5257853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.912285089 MEZ5363810195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.914436102 MEZ6047253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.925451040 MEZ5356890195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.927561998 MEZ5599953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.939690113 MEZ5358952195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.941822052 MEZ6144253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.962976933 MEZ5349184195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.965074062 MEZ5583153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.972244978 MEZ5363811195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.972281933 MEZ5359334195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.974149942 MEZ5351908195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.974188089 MEZ5356512195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.974210024 MEZ5356825195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.977941990 MEZ5138653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.982213974 MEZ5188653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.982420921 MEZ5351889195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.982459068 MEZ5363812195.186.1.121192.168.1.10
Nov 13, 2014 13:24:43.987585068 MEZ5579853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.989372969 MEZ5824853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.989615917 MEZ5898253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.991777897 MEZ5892553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.991978884 MEZ5013653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:43.998039961 MEZ5360660195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.000178099 MEZ5148053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.011203051 MEZ5350011195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.013314009 MEZ5890153192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.029405117 MEZ5351475195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.029442072 MEZ5355874195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.032233000 MEZ5634753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.033901930 MEZ6381353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.037640095 MEZ5352578195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.037677050 MEZ5360472195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.041891098 MEZ5752853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.042927980 MEZ5049653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.077028990 MEZ5355999195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.079128981 MEZ6109553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.087470055 MEZ5361442195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.089562893 MEZ6125353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.110743046 MEZ5355831195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.112889051 MEZ6433253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.118911028 MEZ5351886195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.118948936 MEZ5355798195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.121619940 MEZ5198953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.123081923 MEZ6396353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.128314018 MEZ5358925195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.128350973 MEZ5351386195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.131133080 MEZ5106653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.132632017 MEZ6479253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.136493921 MEZ5358248195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.139436007 MEZ5503553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.144987106 MEZ5351480195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.147434950 MEZ5678653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.163789988 MEZ5350136195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.165930033 MEZ5272953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.207622051 MEZ5358982195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.216689110 MEZ5358901195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.216716051 MEZ5363813195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.220859051 MEZ5027453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.221597910 MEZ6381453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.222331047 MEZ5912253192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.229429007 MEZ5356347195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.231462955 MEZ5805453192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.248330116 MEZ5357528195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.249816895 MEZ5361095195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.249854088 MEZ5350496195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.253112078 MEZ6089053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.254940033 MEZ4917353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.256194115 MEZ6381553192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.256578922 MEZ5361253195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.258754969 MEZ5304953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.278085947 MEZ5364332195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.281212091 MEZ5861953192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.289653063 MEZ5351989195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.292063951 MEZ5888753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.307239056 MEZ5364792195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.309452057 MEZ5632853192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.318133116 MEZ5351066195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.320688009 MEZ5147753192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.334901094 MEZ5363963195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.337238073 MEZ6146353192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.345563889 MEZ5355035195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.373332024 MEZ5363814195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.373370886 MEZ5356786195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.381418943 MEZ5352729195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.381458044 MEZ5350274195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.415249109 MEZ5358054195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.415297031 MEZ5359122195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.419961929 MEZ5360890195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.420010090 MEZ5363815195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.420062065 MEZ5353049195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.423763990 MEZ5349173195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.423821926 MEZ5358619195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.431843996 MEZ5358887195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.477638960 MEZ5361463195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.525861979 MEZ5351477195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.525909901 MEZ5356328195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.573788881 MEZ5357053192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.573873043 MEZ5353570195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.595948935 MEZ5613653192.168.1.10195.186.1.121
Nov 13, 2014 13:24:44.596010923 MEZ5356136195.186.1.121192.168.1.10
Nov 13, 2014 13:24:44.598861933 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:44.598877907 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:44.598977089 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:44.599891901 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:44.599900961 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.682466984 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.691960096 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.691966057 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.692138910 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.692147017 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.692249060 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.697711945 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.697719097 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.697721958 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.697820902 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.700853109 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.700859070 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.700956106 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.700964928 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.701076031 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.707849979 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.707856894 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.707962990 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.815200090 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.823522091 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.823528051 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.823652029 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.823663950 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.823699951 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.832133055 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.832139015 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.832263947 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.832274914 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.832385063 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.844089985 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.853185892 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.853193045 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.853318930 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.853331089 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.853425026 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.854811907 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.862998962 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.863004923 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.863130093 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.863141060 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.863250971 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.872961044 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.881045103 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.881051064 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.881187916 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.881198883 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.881311893 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.886702061 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.886708975 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.886710882 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.886837959 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.887521029 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.887526989 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.887644053 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.887653112 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.887739897 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.890177011 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.919784069 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.919790030 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.919795036 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.919912100 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.919923067 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.919954062 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.929510117 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.929517031 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.929641962 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.929653883 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.929763079 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.954859018 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.963515997 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.963522911 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.963646889 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.963658094 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.963768005 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.965274096 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.965280056 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.965282917 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.965370893 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.970418930 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.970424891 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.970453978 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.970550060 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.970561981 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.970592022 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.972333908 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.972349882 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.972459078 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.972466946 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.972645998 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.980938911 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.989569902 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.989576101 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.989695072 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.989706039 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.989801884 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.993156910 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.998123884 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.998131037 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.998212099 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:45.998220921 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:45.998313904 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.016185045 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.019696951 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.019804955 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.019817114 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.022542953 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.022650003 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.022661924 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.025825977 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.025934935 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.025945902 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.032753944 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.032761097 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.032862902 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.032874107 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.032970905 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.034318924 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.034326077 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.034327984 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.034466982 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.194274902 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.194292068 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.412826061 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.683753967 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.683763027 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.683765888 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.683908939 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.683965921 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.683974981 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684021950 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684099913 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.684108973 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684128046 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684132099 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684160948 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.684247971 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.684253931 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684299946 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684303999 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684307098 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684351921 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.684359074 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684442997 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684448004 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684451103 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.684490919 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.684497118 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684571028 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684576035 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684607029 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.684626102 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684699059 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.684705973 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684740067 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.684762955 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684767008 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684844017 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.684850931 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684936047 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.684962034 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684966087 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684968948 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.684971094 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.685055017 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.685085058 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.685087919 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.685087919 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.685091019 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.685095072 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.685578108 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.685739040 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.685765982 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.686067104 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.686086893 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.686100960 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.686110973 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.686486006 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.686521053 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.686664104 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.687000990 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.687169075 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.687192917 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.687206984 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.687223911 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.687232971 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.687527895 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.687663078 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.687681913 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.688035965 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.688229084 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.688249111 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.688261032 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.688275099 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.688283920 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.688596010 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.688733101 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.688750982 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.688791037 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.688807964 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.689223051 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.689251900 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.689400911 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.689848900 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.689868927 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.689883947 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.689897060 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.689904928 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.690284014 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.690314054 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.690448046 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.690574884 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.691493034 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.691525936 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.691545010 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.691557884 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.691566944 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.691575050 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.691795111 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.691813946 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.691826105 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.691839933 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.691848993 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.692223072 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.692354918 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.692403078 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.692423105 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.692431927 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.692579985 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.692601919 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:46.692740917 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.692866087 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.693382025 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.693519115 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:46.700927019 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.683605909 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.683624029 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.683626890 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.683746099 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.683878899 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.683882952 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.683897972 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684015036 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.684032917 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684092999 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.684185028 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684189081 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684202909 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684205055 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684405088 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.684412003 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684451103 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684454918 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684457064 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.684458017 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684461117 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684463024 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684586048 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.684602976 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684607029 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684621096 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684662104 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.684710026 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.684896946 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684900999 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684912920 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684916019 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.684917927 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685009003 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.685025930 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685100079 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.685220957 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.685250998 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.685252905 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685256958 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685261011 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685262918 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685281992 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685285091 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685333967 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.685338974 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685457945 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.685486078 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.685513020 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.685519934 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685523987 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685525894 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685540915 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685544968 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685651064 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.685656071 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685704947 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.685705900 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685709953 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685741901 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.685816050 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.685821056 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685898066 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.685950994 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685955048 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685959101 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685961962 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.685964108 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.686053991 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.686084986 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.686085939 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.686090946 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.686093092 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.686096907 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.686284065 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.686294079 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.686297894 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.686300039 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.686304092 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.686306000 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.686330080 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.686436892 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.686444044 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.686472893 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.686500072 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.686530113 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.686533928 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.686537027 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.686678886 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.686708927 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.687483072 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.687500000 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.687504053 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.687506914 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.687520981 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.687522888 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.687525034 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.687526941 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.687527895 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.687530041 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.687531948 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.687534094 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:47.687700987 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.687738895 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.687767029 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.687793970 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.687820911 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:47.688002110 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.684071064 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684079885 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684093952 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684186935 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.684334993 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684341908 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684357882 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684362888 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684366941 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684467077 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.684475899 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684533119 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.684561014 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.684680939 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684686899 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684701920 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684705973 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684709072 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684873104 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684875011 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.684880972 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684895039 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684901953 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.684920073 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.684957981 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.685062885 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.685090065 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.685137033 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685142994 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685157061 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685161114 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685163975 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685365915 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.685373068 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685403109 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685405016 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.685410023 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685416937 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685420990 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685432911 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.685528040 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.685534000 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685564995 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.685638905 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.685650110 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685656071 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685658932 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685663939 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685667038 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685746908 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.685776949 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.685781002 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685801029 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685816050 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685820103 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685897112 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.685903072 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.685931921 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.686006069 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.686055899 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686062098 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686065912 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686069012 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686073065 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686151028 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.686182022 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.686186075 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686384916 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.686486959 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686496019 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686500072 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686502934 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686506987 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686635017 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686640024 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686641932 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686736107 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.686785936 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.686789989 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686856031 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.686903000 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.686928034 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686933041 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686937094 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686939001 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.686940908 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.687031031 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.687047005 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.687086105 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.687089920 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.687103033 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.687105894 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.687124968 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.687218904 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.687223911 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.687252998 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.688025951 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.688035011 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.688039064 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.688040972 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.688043118 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.688045025 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.688046932 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.688049078 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.688050985 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:48.688185930 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.688232899 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.688270092 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.688297987 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:48.688472033 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.683679104 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.683686972 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.683690071 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.683808088 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.683903933 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.683907986 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.683912039 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.683917046 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.683918953 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684042931 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.684052944 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684092045 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.684123993 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.684192896 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684197903 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684204102 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684206963 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684210062 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684312105 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.684319019 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684334993 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684339046 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684365034 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.684396982 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.684453964 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.684530973 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.684536934 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684561014 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684565067 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684568882 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684571028 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684575081 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684703112 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684706926 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684710026 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684824944 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.684833050 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684860945 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684864044 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.684865952 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684870958 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684892893 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.684922934 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.684952021 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.684989929 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.684993982 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685058117 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.685065031 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685095072 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.685108900 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685113907 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685141087 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.685226917 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.685231924 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685236931 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685250998 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685296059 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685359001 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.685364008 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685401917 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.685458899 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685462952 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685466051 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685487986 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.685503006 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685590982 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.685595989 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685600042 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685620070 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.685622931 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685699940 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.685741901 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685745955 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685801029 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.685806036 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685864925 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685868979 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685883999 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.685889006 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685965061 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.685980082 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.685982943 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.686053038 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.686058044 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.686093092 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.686096907 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.686136007 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.686141014 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.686170101 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.686206102 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.686209917 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.686261892 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.686266899 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.686319113 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.686322927 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.686345100 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.686350107 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.686419010 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.686435938 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.686512947 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.687925100 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.687932968 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.687937021 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.687939882 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.687942982 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.687944889 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.687946081 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.687947989 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:49.688064098 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.688091040 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.688117981 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:49.688290119 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:50.683878899 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.683887959 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.683891058 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.683976889 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:50.684042931 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684047937 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684051037 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684130907 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:50.684139967 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684168100 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684171915 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684181929 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:50.684276104 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:50.684283018 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684365034 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684369087 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684376001 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684385061 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:50.684391975 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684520006 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:50.684550047 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:50.684555054 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684561014 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684564114 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684566975 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684672117 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:50.684676886 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684708118 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:50.684762001 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684766054 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684770107 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684772015 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684792042 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684878111 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:50.684883118 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:24:50.684931040 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:50.684957981 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:50.685178995 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:24:58.838834047 MEZ10428080192.168.1.10109.74.3.6
Nov 13, 2014 13:24:58.838855982 MEZ80801042109.74.3.6192.168.1.10
Nov 13, 2014 13:24:58.838956118 MEZ10428080192.168.1.10109.74.3.6
Nov 13, 2014 13:24:58.840712070 MEZ10428080192.168.1.10109.74.3.6
Nov 13, 2014 13:24:58.840722084 MEZ80801042109.74.3.6192.168.1.10
Nov 13, 2014 13:24:58.975220919 MEZ80801042109.74.3.6192.168.1.10
Nov 13, 2014 13:24:58.975568056 MEZ10428080192.168.1.10109.74.3.6
Nov 13, 2014 13:24:58.978718996 MEZ10428080192.168.1.10109.74.3.6
Nov 13, 2014 13:24:58.978733063 MEZ80801042109.74.3.6192.168.1.10
Nov 13, 2014 13:24:59.152532101 MEZ10468080192.168.1.10177.73.233.170
Nov 13, 2014 13:24:59.152553082 MEZ80801046177.73.233.170192.168.1.10
Nov 13, 2014 13:24:59.152637005 MEZ10468080192.168.1.10177.73.233.170
Nov 13, 2014 13:24:59.154980898 MEZ10468080192.168.1.10177.73.233.170
Nov 13, 2014 13:24:59.154989958 MEZ80801046177.73.233.170192.168.1.10
Nov 13, 2014 13:24:59.712924004 MEZ80801046177.73.233.170192.168.1.10
Nov 13, 2014 13:24:59.713046074 MEZ10468080192.168.1.10177.73.233.170
Nov 13, 2014 13:24:59.713362932 MEZ10468080192.168.1.10177.73.233.170
Nov 13, 2014 13:24:59.713376999 MEZ80801046177.73.233.170192.168.1.10
Nov 13, 2014 13:24:59.781894922 MEZ10508080192.168.1.10212.19.62.76
Nov 13, 2014 13:24:59.781913042 MEZ80801050212.19.62.76192.168.1.10
Nov 13, 2014 13:24:59.781996012 MEZ10508080192.168.1.10212.19.62.76
Nov 13, 2014 13:24:59.782852888 MEZ10508080192.168.1.10212.19.62.76
Nov 13, 2014 13:24:59.782872915 MEZ80801050212.19.62.76192.168.1.10
Nov 13, 2014 13:24:59.879905939 MEZ80801050212.19.62.76192.168.1.10
Nov 13, 2014 13:24:59.880006075 MEZ10508080192.168.1.10212.19.62.76
Nov 13, 2014 13:24:59.880295038 MEZ10508080192.168.1.10212.19.62.76
Nov 13, 2014 13:24:59.880306959 MEZ80801050212.19.62.76192.168.1.10
Nov 13, 2014 13:24:59.939657927 MEZ10548080192.168.1.10144.76.59.84
Nov 13, 2014 13:24:59.939685106 MEZ80801054144.76.59.84192.168.1.10
Nov 13, 2014 13:24:59.939779043 MEZ10548080192.168.1.10144.76.59.84
Nov 13, 2014 13:24:59.940680981 MEZ10548080192.168.1.10144.76.59.84
Nov 13, 2014 13:24:59.940701008 MEZ80801054144.76.59.84192.168.1.10
Nov 13, 2014 13:25:03.177433014 MEZ80103846.183.219.78192.168.1.10
Nov 13, 2014 13:25:03.177937031 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:25:26.963504076 MEZ80801054144.76.59.84192.168.1.10
Nov 13, 2014 13:25:26.963632107 MEZ10548080192.168.1.10144.76.59.84
Nov 13, 2014 13:25:26.981338978 MEZ10548080192.168.1.10144.76.59.84
Nov 13, 2014 13:25:26.981352091 MEZ80801054144.76.59.84192.168.1.10
Nov 13, 2014 13:25:26.981812000 MEZ103880192.168.1.1046.183.219.78
Nov 13, 2014 13:25:27.060324907 MEZ10588080192.168.1.1064.27.101.155
Nov 13, 2014 13:25:27.060348034 MEZ8080105864.27.101.155192.168.1.10
Nov 13, 2014 13:25:27.060476065 MEZ10588080192.168.1.1064.27.101.155
Nov 13, 2014 13:25:27.061527014 MEZ10588080192.168.1.1064.27.101.155
Nov 13, 2014 13:25:27.061539888 MEZ8080105864.27.101.155192.168.1.10
Nov 13, 2014 13:25:27.250752926 MEZ8080105864.27.101.155192.168.1.10
Nov 13, 2014 13:25:27.250869036 MEZ10588080192.168.1.1064.27.101.155
Nov 13, 2014 13:25:27.251180887 MEZ10588080192.168.1.1064.27.101.155
Nov 13, 2014 13:25:27.251193047 MEZ8080105864.27.101.155192.168.1.10
Nov 13, 2014 13:25:27.327485085 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:27.327542067 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:27.329269886 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:27.330569029 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:27.330591917 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.466257095 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.473479986 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.473494053 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.473637104 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.473654032 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.473844051 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.479571104 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.479581118 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.479583979 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.479681015 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.505177975 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.505187035 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.505294085 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.505306959 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.505433083 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.511379004 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.548171997 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.548180103 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.548301935 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.548315048 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.548418045 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.557188034 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.557194948 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.557354927 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.764897108 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.781862974 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.781872034 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.781991959 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.782004118 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.782120943 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.790407896 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.790417910 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.790421963 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.790528059 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.798774958 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.798783064 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.798887014 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.798898935 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.799001932 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.807619095 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.807626963 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.807640076 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.807734966 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.816509962 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.816972017 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.817023993 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.825598001 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.825632095 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.826057911 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.826109886 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.826559067 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.835932970 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.835968971 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.836338043 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.845746040 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.845779896 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.845792055 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.846221924 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.854798079 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.854809046 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.854909897 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.854922056 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.855025053 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.859709024 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.863807917 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.863815069 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.863918066 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.863929987 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.864032984 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.979991913 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.995271921 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.995280027 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.995384932 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:28.995397091 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:28.995500088 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.003379107 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.042853117 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.042860985 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.042964935 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.042977095 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.043080091 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.051194906 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.061753988 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.061789036 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.062215090 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.062268019 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.062716961 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.069674015 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.092972994 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.093008995 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.093487978 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.093539000 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.093991041 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.109034061 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.109075069 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.109091043 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.109541893 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.117711067 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.117748022 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.118191004 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.118242025 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.118696928 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.126717091 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.132719994 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.132755041 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.133440018 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.133481979 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.134027004 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.134991884 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.160317898 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.160430908 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.160442114 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.174482107 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.174489021 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.174592972 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.174604893 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.174711943 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.184051037 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.184060097 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.184063911 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.184165001 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.198502064 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.198510885 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.198613882 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.198626041 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.198729038 MEZ10628080192.168.1.10178.210.167.213
Nov 13, 2014 13:25:29.214284897 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.226850986 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.226859093 MEZ80801062178.210.167.213192.168.1.10
Nov 13, 2014 13:25:29.226962090 MEZ106280801