Technical Information
- <SYSTEM32>\rundll32.exe <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\1SSoW9Vi9WI.jpg
- [<HKCU>\Software\FTPWare\CoreFTP\Sites]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\FTP Explorer\Profiles]
- [<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions]
- [<HKCU>\Software\CoffeeCup Software\Internet\Profiles]
- [<HKCU>\Software\Far2\Plugins\FTP\Hosts]
- [<HKCU>\Software\Far\Plugins\FTP\Hosts]
- [<HKCU>\Software\Google\Google Talk\Accounts]
- [<HKLM>\Software\Ghisler\Total Commander]
- [<HKLM>\SOFTWARE\FlashFXP]
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''
- ClassName: 'gdkWindowToplevel' WindowName: 'The Wireshark Network Analyzer'
- <Current directory>\ufr_files\11-10-2012_23-54-38-heidelbm.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-heidelb.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-paris.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-pisa.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-parism.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-stripe.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-topGradRepeat_1.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-greendot.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-bulzanom.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-bulzano.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-pisam.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-verona.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-venicem.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-veronam.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-backoff.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-backdown.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-praguem.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-prague.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-tyrol.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-venice.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-tyrolm.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-security_watermark_1.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-unlock_optimized.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-unlock_built_ghost.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-unlock_optimized_big.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-unlock_playing.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-unlock_optimized_ghost.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-taskbar_up.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-start_up.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-ul_logo.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-unlock_built_big.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-unlock_built.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-unlock_playing_big.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-topGradRepeat.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-security_watermark.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-ASPdotNET_logo_1.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-help_1.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-darkBlue_GRAD_1.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-window_up.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-unlock_playing_ghost.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-ASPdotNET_logo.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-help.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-darkBlue_GRAD.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Friend.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Follow.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Home.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Peace.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Moon flower.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Ascent.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-wpatop.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Autumn.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Crystal.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Azul.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Power.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Vortec space.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Tulips.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Wind.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-File-Paths.txt
- <Current directory>\ufr_files\11-10-2012_23-54-38-Windows XP.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Radiance.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Purple flower.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Red moon desert.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Stonehenge.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Ripple.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-wpakey.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-newmark8.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-newmark1.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-newtop1.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-nextdown.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-newtop8.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-backup.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-backover.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-mslogo.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-newbtm8.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-newbtm1.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-nextoff.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-skipup.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-skipover.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-wpaback.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-wpaflag.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-wpabtm.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-nextup.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-nextover.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-oemcoa.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-skipoff.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-skipdown.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-safe_easy_faster_ghost.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-best_robust_ghost.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-best_robust_big.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-best_secure.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-best_secure_ghost.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-best_secure_big.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-best_road.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Sample2.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-best_road_big.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-best_robust.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-best_road_ghost.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-connected_data.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-connected_networks_big.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-connected_networks.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-connected_networks_ghost.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-connected_wizard_big.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-connected_wizard.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-connected_data_ghost.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-connected_data_big.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-connected_multiple.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-connected_multiple_ghost.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-connected_multiple_big.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Sample1.jpg
- <Current directory>\ufr_files\Registry-Grabbing.reg
- %TEMP%\Registry-Grabbing.reg
- %TEMP%\11-10-2012_23-54-38-File-Paths.txt
- <Current directory>\ufr_files\11-10-2012_23-54-38-Sunset.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Blue hills.jpg
- %TEMP%\report_11-10-2012_23-54-38-MNCE.bin
- %TEMP%\1SSoW9Vi9WI.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\whatismyip.akamai[1]
- <Current directory>\ufr_files\NO_PWDS_report_11-10-2012_23-54-38-MNCE.bin
- %TEMP%\NO_PWDS_report_11-10-2012_23-54-38-MNCE.bin
- <Current directory>\ufr_files\11-10-2012_23-54-38-Water lilies.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Maize Bkgrd.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Leaves Bkgrd.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Nature Bkgrd.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Sunflower Bkgrd.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Pie Charts Bkgrd.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-1SSoW9Vi9WI.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Winter.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Clear Day Bkgrd.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Glacier Bkgrd.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-Fiesta Bkgrd.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img136.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img126.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img149.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-logo.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-intro_logo.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img110.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img109.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img116.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img123.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img121.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-pen_icon.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-safe_easy_easier_big.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-safe_easy_easier.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-safe_easy_easier_ghost.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-safe_easy_faster_big.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-safe_easy_faster.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-read_icon.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-question_icon.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-safe_easy_better.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-safe_easy_better_ghost.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-safe_easy_better_big.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img103.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-gradient.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-folder_up.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-icon_up.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img014.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img004b.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-control_up.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-connected_wizard_ghost.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-desktop_screen_shot.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-end_up.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-desktop_up.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img033.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img072.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img068.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img074a.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img100.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img089.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img034.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img033a.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img040.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img060.jpg
- <Current directory>\ufr_files\11-10-2012_23-54-38-img046.jpg
- %TEMP%\Registry-Grabbing.reg
- %TEMP%\11-10-2012_23-54-38-File-Paths.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\whatismyip.akamai[1]
- %TEMP%\NO_PWDS_report_11-10-2012_23-54-38-MNCE.bin
- from %TEMP%\report_11-10-2012_23-54-38-MNCE.bin to %TEMP%\NO_PWDS_report_11-10-2012_23-54-38-MNCE.bin
- '94.##0.191.201':25
- 'wh#####yip.akamai.com':80
- wh#####yip.akamai.com/
- DNS ASK sm##.mail.ru
- DNS ASK wh#####yip.akamai.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
- ClassName: 'PROCEXPL' WindowName: ''