VT Detection ratio: 2 / 53 Document_8724_8241.scr 是什么东东

显示全部楼层 · 发表于 2014-10-28 20:24:34

墨家小子发表于 2014-10-28 20:11

问一下我已经刷了20个3个月的fs激活码，暂时不想用还没有激活，有没有激活时限？

显示全部楼层 · 发表于 2014-10-28 20:25:25

诸葛亮发表于 2014-10-28 20:24
问一下我已经刷了20个3个月的fs激活码，暂时不想用还没有激活，有没有激活时限？

十一月三十日之前激活过期作废

显示全部楼层 · 发表于 2014-10-28 20:26:42

墨家小子发表于 2014-10-28 20:25
十一月三十日之前激活过期作废

看来是时候准备虚拟机了

thank you

显示全部楼层 · 发表于 2014-10-28 20:27:42

                        ___             __ _
      +  /-          / |  ____  __  __/ /_  (_)____    -\  +
      /s  h-          / /| | / __ \/ / / / __ \/ / ___/    -h  s\
      oh-:d/       / ___ |/ / / / /_/ / /_/ / (__  )       /d:-ho
      shh+hy-       /_/  |_/_/ /_/\__,_/_.___/_/____/       -yh+hhs
   -:+hhdhyys/-                                        -\syyhdhh+:-
-//////dhhhhhddhhyss-    Analysis Report    -ssyhhddhhhhhd\\\\\\-
/++/////oydddddhhyys/    ooooooooooooooooooooo    \syyhhdddddyo\\\\\++\
-+++///////odh/-                                           -+hdo\\\\\\\+++-
+++++++++//yy+/:                                           :\+yy\\+++++++++
/+soss+sys//yyo/os++o+:                               :+o++so\oyy\\sys+ssos+\
+oyyyys++o/+yss/+/oyyyy:                            :yyyyo\+\ssy+\o++syyyyo+
+oyyyyyyso+os/o/+yyyyyy/                            \yyyyyy+\o\so+osyyyyyyo+

[#############################################################################]
Analysis Report for Document_8.exe
[#############################################################################]

[=============================================================================]
Table of Contents
[=============================================================================]

- General information
- Document_8.exe
  a) Registry Activities
  b) File Activities
  c) Process Activities
- trwob.exe
   a) Registry Activities
   b) File Activities
   c) Network Activities

[#############################################################################]
1. General Information
[#############################################################################]
[=============================================================================]
Information about Anubis' invocation
[=============================================================================]
      Time needed:       281 s
      Report created:    10/28/14, 12:19:45 UTC
      Termination reason: Timeout
      Program version: 1.76.3886

[#############################################################################]
2. Document_8.exe
[#############################################################################]
[=============================================================================]
General information about this executable
[=============================================================================]
      Analysis Reason: Primary Analysis Subject
      Filename:       Document_8.exe
      Command Line: "C:\Document_8.exe"
      Process-status
      at analysis end: dead
      Exit Code:    0

[=============================================================================]
Load-time Dlls
[=============================================================================]
      Module Name: [ C:\WINDOWS\system32\ntdll.dll ],
            Base Address: [0x7C900000 ], Size: [0x000AF000 ]
      Module Name: [ C:\WINDOWS\system32\kernel32.dll ],
            Base Address: [0x7C800000 ], Size: [0x000F6000 ]
      Module Name: [ C:\WINDOWS\system32\MSVCRT.dll ],
            Base Address: [0x77C10000 ], Size: [0x00058000 ]
      Module Name: [ C:\WINDOWS\system32\USER32.dll ],
            Base Address: [0x7E410000 ], Size: [0x00091000 ]
      Module Name: [ C:\WINDOWS\system32\GDI32.dll ],
            Base Address: [0x77F10000 ], Size: [0x00049000 ]
      Module Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll ],
            Base Address: [0x773D0000 ], Size: [0x00103000 ]
      Module Name: [ C:\WINDOWS\system32\ADVAPI32.dll ],
            Base Address: [0x77DD0000 ], Size: [0x0009B000 ]
      Module Name: [ C:\WINDOWS\system32\RPCRT4.dll ],
            Base Address: [0x77E70000 ], Size: [0x00092000 ]
      Module Name: [ C:\WINDOWS\system32\Secur32.dll ],
            Base Address: [0x77FE0000 ], Size: [0x00011000 ]
      Module Name: [ C:\WINDOWS\system32\SHLWAPI.dll ],
            Base Address: [0x77F60000 ], Size: [0x00076000 ]

[=============================================================================]
Run-time Dlls
[=============================================================================]
      Module Name: [ C:\WINDOWS\system32\UxTheme.dll ],
            Base Address: [0x5AD70000 ], Size: [0x00038000 ]
      Module Name: [ C:\WINDOWS\system32\MSCTF.dll ],
            Base Address: [0x74720000 ], Size: [0x0004C000 ]
      Module Name: [ C:\WINDOWS\system32\OLEAUT32.dll ],
            Base Address: [0x77120000 ], Size: [0x0008B000 ]
      Module Name: [ C:\WINDOWS\system32\wininet.dll ],
            Base Address: [0x771B0000 ], Size: [0x000AA000 ]
      Module Name: [ C:\WINDOWS\system32\ole32.dll ],
            Base Address: [0x774E0000 ], Size: [0x0013D000 ]
      Module Name: [ C:\WINDOWS\system32\CRYPT32.dll ],
            Base Address: [0x77A80000 ], Size: [0x00095000 ]
      Module Name: [ C:\WINDOWS\system32\MSASN1.dll ],
            Base Address: [0x77B20000 ], Size: [0x00012000 ]
      Module Name: [ C:\WINDOWS\system32\Apphelp.dll ],
            Base Address: [0x77B40000 ], Size: [0x00022000 ]

[=============================================================================]
2.a) Document_8.exe - Registry Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Registry Values Read:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      Key: [ HKLM\SOFTWARE\Microsoft\CTF\SystemShared\ ],
         Value Name: [ CUAS ], Value: [ 0 ], 1 time
      Key: [ HKLM\SYSTEM\CurrentControlSet\Control\Session Manager ],
         Value Name: [ CriticalSectionTimeout ], Value: [ 2592000 ], 1 time
      Key: [ HKLM\SYSTEM\WPA\MediaCenter ],
         Value Name: [ Installed ], Value: [ 0 ], 1 time
      Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows ],
         Value Name: [ AppInit_DLLs ], Value: [  ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers ],
         Value Name: [ AuthenticodeEnabled ], Value: [ 0 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers ],
         Value Name: [ DefaultLevel ], Value: [ 262144 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers ],
         Value Name: [ PolicyScope ], Value: [ 0 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers ],
         Value Name: [ TransparentEnabled ], Value: [ 1 ], 2 times
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} ],
         Value Name: [ HashAlg ], Value: [ 32771 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} ],
         Value Name: [ ItemData ], Value: [ 0x5eab304f957a49896a006c1c31154015 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} ],
         Value Name: [ ItemSize ], Value: [ 779 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} ],
         Value Name: [ SaferFlags ], Value: [ 0 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} ],
         Value Name: [ HashAlg ], Value: [ 32771 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} ],
         Value Name: [ ItemData ], Value: [ 0x67b0d48b343a3fd3bce9dc646704f394 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} ],
         Value Name: [ ItemSize ], Value: [ 517 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} ],
         Value Name: [ SaferFlags ], Value: [ 0 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} ],
         Value Name: [ HashAlg ], Value: [ 32771 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} ],
         Value Name: [ ItemData ], Value: [ 0x327802dcfef8c893dc8ab006dd847d1d ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} ],
         Value Name: [ ItemSize ], Value: [ 918 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} ],
         Value Name: [ SaferFlags ], Value: [ 0 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} ],
         Value Name: [ HashAlg ], Value: [ 32771 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} ],
         Value Name: [ ItemData ], Value: [ 0xbd9a2adb42ebd8560e250e4df8162f67 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} ],
         Value Name: [ ItemSize ], Value: [ 229 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} ],
         Value Name: [ SaferFlags ], Value: [ 0 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} ],
         Value Name: [ HashAlg ], Value: [ 32771 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} ],
         Value Name: [ ItemData ], Value: [ 0x386b085f84ecf669d36b956a22c01e80 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} ],
         Value Name: [ ItemSize ], Value: [ 370 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} ],
         Value Name: [ SaferFlags ], Value: [ 0 ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33} ],
         Value Name: [ ItemData ], Value: [ %HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache%OLK* ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33} ],
         Value Name: [ SaferFlags ], Value: [ 0 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName ],
         Value Name: [ ComputerName ], Value: [ PC ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Control\Terminal Server ],
         Value Name: [ TSAppCompat ], Value: [ 0 ], 3 times
      Key: [ HKLM\System\CurrentControlSet\Control\Terminal Server ],
         Value Name: [ TSUserEnabled ], Value: [ 0 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Keyboard Layout\Toggle ],
         Value Name: [ Language Hotkey ], Value: [ 1 ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Keyboard Layout\Toggle ],
         Value Name: [ Layout Hotkey ], Value: [ 2 ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders ],
         Value Name: [ Cache ], Value: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files ], 1 time

[=============================================================================]
2.b) Document_8.exe - File Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Files Created:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File Name: [ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\trwob.exe ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Files Read:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File Name: [ C:\Document_8.exe ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Files Modified:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File Name: [ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\trwob.exe ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File System Control Communication:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File: [ C:\Program Files\Common Files\ ], Control Code: [ 0x00090028 ], 1 time

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Device Control Communication:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File: [ \Device\KsecDD ], Control Code: [ 0x00390008 ], 1 time

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Memory Mapped Files:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File Name: [ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\trwob.exe ]
      File Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll ]
      File Name: [ C:\WINDOWS\WindowsShell.Manifest ]
      File Name: [ C:\WINDOWS\system32\Apphelp.dll ]
      File Name: [ C:\WINDOWS\system32\MSCTF.dll ]
      File Name: [ C:\WINDOWS\system32\UxTheme.dll ]
      File Name: [ C:\WINDOWS\system32\imm32.dll ]
      File Name: [ C:\WINDOWS\system32\wininet.dll ]
      File Name: [ C:\Windows\AppPatch\sysmain.sdb ]

[=============================================================================]
2.c) Document_8.exe - Process Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Processes Created:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      Executable: [ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\trwob.exe ], Command Line: [  ]
      Executable: [  ], Command Line: [ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\trwob.exe ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Remote Threads Created:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      Affected Process: [ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\trwob.exe ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Foreign Memory Regions Read:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      Process: [ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\trwob.exe ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Foreign Memory Regions Written:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      Process: [ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\trwob.exe ]

[#############################################################################]
3. trwob.exe
[#############################################################################]
[=============================================================================]
General information about this executable
[=============================================================================]
      Analysis Reason: Started by Document_8.exe
      Filename:       trwob.exe
      Command Line: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\trwob.exe
      Process-status
      at analysis end: alive
      Exit Code:    0

[=============================================================================]
Load-time Dlls
[=============================================================================]
      Module Name: [ C:\WINDOWS\system32\ntdll.dll ],
            Base Address: [0x7C900000 ], Size: [0x000AF000 ]
      Module Name: [ C:\WINDOWS\system32\kernel32.dll ],
            Base Address: [0x7C800000 ], Size: [0x000F6000 ]
      Module Name: [ C:\WINDOWS\system32\MSVCRT.dll ],
            Base Address: [0x77C10000 ], Size: [0x00058000 ]
      Module Name: [ C:\WINDOWS\system32\USER32.dll ],
            Base Address: [0x7E410000 ], Size: [0x00091000 ]
      Module Name: [ C:\WINDOWS\system32\GDI32.dll ],
            Base Address: [0x77F10000 ], Size: [0x00049000 ]
      Module Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll ],
            Base Address: [0x773D0000 ], Size: [0x00103000 ]
      Module Name: [ C:\WINDOWS\system32\ADVAPI32.dll ],
            Base Address: [0x77DD0000 ], Size: [0x0009B000 ]
      Module Name: [ C:\WINDOWS\system32\RPCRT4.dll ],
            Base Address: [0x77E70000 ], Size: [0x00092000 ]
      Module Name: [ C:\WINDOWS\system32\Secur32.dll ],
            Base Address: [0x77FE0000 ], Size: [0x00011000 ]
      Module Name: [ C:\WINDOWS\system32\SHLWAPI.dll ],
            Base Address: [0x77F60000 ], Size: [0x00076000 ]

[=============================================================================]
Run-time Dlls
[=============================================================================]
      Module Name: [ C:\WINDOWS\system32\UxTheme.dll ],
            Base Address: [0x5AD70000 ], Size: [0x00038000 ]
      Module Name: [ C:\WINDOWS\system32\NETAPI32.dll ],
            Base Address: [0x5B860000 ], Size: [0x00055000 ]
      Module Name: [ C:\WINDOWS\system32\hnetcfg.dll ],
            Base Address: [0x662B0000 ], Size: [0x00058000 ]
      Module Name: [ C:\WINDOWS\system32\mswsock.dll ],
            Base Address: [0x71A50000 ], Size: [0x0003F000 ]
      Module Name: [ C:\WINDOWS\System32\wshtcpip.dll ],
            Base Address: [0x71A90000 ], Size: [0x00008000 ]
      Module Name: [ C:\WINDOWS\system32\WS2HELP.dll ],
            Base Address: [0x71AA0000 ], Size: [0x00008000 ]
      Module Name: [ C:\WINDOWS\system32\WS2_32.dll ],
            Base Address: [0x71AB0000 ], Size: [0x00017000 ]
      Module Name: [ C:\WINDOWS\system32\wsock32.dll ],
            Base Address: [0x71AD0000 ], Size: [0x00009000 ]
      Module Name: [ C:\WINDOWS\system32\sensapi.dll ],
            Base Address: [0x722B0000 ], Size: [0x00005000 ]
      Module Name: [ C:\WINDOWS\system32\MSCTF.dll ],
            Base Address: [0x74720000 ], Size: [0x0004C000 ]
      Module Name: [ C:\WINDOWS\system32\USERENV.dll ],
            Base Address: [0x769C0000 ], Size: [0x000B4000 ]
      Module Name: [ C:\WINDOWS\system32\WINMM.dll ],
            Base Address: [0x76B40000 ], Size: [0x0002D000 ]
      Module Name: [ C:\WINDOWS\system32\rtutils.dll ],
            Base Address: [0x76E80000 ], Size: [0x0000E000 ]
      Module Name: [ C:\WINDOWS\system32\rasman.dll ],
            Base Address: [0x76E90000 ], Size: [0x00012000 ]
      Module Name: [ C:\WINDOWS\system32\TAPI32.dll ],
            Base Address: [0x76EB0000 ], Size: [0x0002F000 ]
      Module Name: [ C:\WINDOWS\system32\RASAPI32.DLL ],
            Base Address: [0x76EE0000 ], Size: [0x0003C000 ]
      Module Name: [ C:\WINDOWS\system32\DNSAPI.dll ],
            Base Address: [0x76F20000 ], Size: [0x00027000 ]
      Module Name: [ C:\WINDOWS\system32\rasadhlp.dll ],
            Base Address: [0x76FC0000 ], Size: [0x00006000 ]
      Module Name: [ C:\WINDOWS\system32\OLEAUT32.dll ],
            Base Address: [0x77120000 ], Size: [0x0008B000 ]
      Module Name: [ C:\WINDOWS\system32\wininet.dll ],
            Base Address: [0x771B0000 ], Size: [0x000AA000 ]
      Module Name: [ C:\WINDOWS\system32\ole32.dll ],
            Base Address: [0x774E0000 ], Size: [0x0013D000 ]
      Module Name: [ C:\WINDOWS\system32\CRYPT32.dll ],
            Base Address: [0x77A80000 ], Size: [0x00095000 ]
      Module Name: [ C:\WINDOWS\system32\MSASN1.dll ],
            Base Address: [0x77B20000 ], Size: [0x00012000 ]
      Module Name: [ C:\WINDOWS\system32\VERSION.dll ],
            Base Address: [0x77C00000 ], Size: [0x00008000 ]
      Module Name: [ C:\WINDOWS\system32\shell32.dll ],
            Base Address: [0x7C9C0000 ], Size: [0x00817000 ]
      Module Name: [ C:\WINDOWS\system32\urlmon.dll ],
            Base Address: [0x7E1E0000 ], Size: [0x000A2000 ]

[=============================================================================]
3.a) trwob.exe - Registry Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Registry Values Modified:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      Key: [ HKLM\SYSTEM\CURRENTCONTROLSET\HARDWARE PROFILES\CURRENT\Software\Microsoft\windows\CurrentVersion\Internet Settings ],
         Value Name: [ ProxyEnable ], New Value: [ 0 ]
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders ],
         Value Name: [ Common AppData ], New Value: [ C:\Documents and Settings\All Users\Application Data ]
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths ],
         Value Name: [ Directory ], New Value: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 ]
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths ],
         Value Name: [ Paths ], New Value: [ 4 ]
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path1 ],
         Value Name: [ CacheLimit ], New Value: [ 40852 ]
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path1 ],
         Value Name: [ CachePath ], New Value: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Cache1 ]
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path2 ],
         Value Name: [ CacheLimit ], New Value: [ 40852 ]
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path2 ],
         Value Name: [ CachePath ], New Value: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Cache2 ]
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path3 ],
         Value Name: [ CacheLimit ], New Value: [ 40852 ]
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path3 ],
         Value Name: [ CachePath ], New Value: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Cache3 ]
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path4 ],
         Value Name: [ CacheLimit ], New Value: [ 40852 ]
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path4 ],
         Value Name: [ CachePath ], New Value: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Cache4 ]
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders ],
         Value Name: [ AppData ], New Value: [ C:\Documents and Settings\Administrator\Application Data ]
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders ],
         Value Name: [ Cache ], New Value: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files ]
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders ],
         Value Name: [ Cookies ], New Value: [ C:\Documents and Settings\Administrator\Cookies ]
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders ],
         Value Name: [ History ], New Value: [ C:\Documents and Settings\Administrator\Local Settings\History ]
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ],
         Value Name: [ IntranetName ], New Value: [ 1 ]
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ],
         Value Name: [ ProxyBypass ], New Value: [ 1 ]
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ],
         Value Name: [ UNCAsIntranet ], New Value: [ 1 ]
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\windows\CurrentVersion\Internet Settings ],
         Value Name: [ MigrateProxy ], New Value: [ 1 ]
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\windows\CurrentVersion\Internet Settings ],
         Value Name: [ ProxyEnable ], New Value: [ 0 ]
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections ],
         Value Name: [ SavedLegacySettings ], New Value: [ 0x3c0000001600000001000000000000000000000000000000040000000000 ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Registry Values Read:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      Key: [ HKLM\SOFTWARE\Microsoft\CTF\SystemShared\ ],
         Value Name: [ CUAS ], Value: [ 0 ], 1 time
      Key: [ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ],
         Value Name: [ UrlEncoding ], Value: [ 0x00000000 ], 2 times
      Key: [ HKLM\SYSTEM\CurrentControlSet\Control\Session Manager ],
         Value Name: [ CriticalSectionTimeout ], Value: [ 2592000 ], 1 time
      Key: [ HKLM\SYSTEM\CurrentControlSet\Services\Winsock\Parameters ],
         Value Name: [ Transports ], Value: [ 0x5400630070006900700000004e0065007400420049004f00530000000000 ], 2 times
      Key: [ HKLM\SYSTEM\Setup ],
         Value Name: [ SystemSetupInProgress ], Value: [ 0 ], 1 time
      Key: [ HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS ],
         Value Name: [ * ], Value: [ 1 ], 1 time
      Key: [ HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL ],
         Value Name: [ * ], Value: [ 1 ], 1 time
      Key: [ HKLM\Software\Microsoft\Tracing ],
         Value Name: [ EnableConsoleTracing ], Value: [ 0 ], 1 time
      Key: [ HKLM\Software\Microsoft\Tracing\RASAPI32 ],
         Value Name: [ ConsoleTracingMask ], Value: [ 4294901760 ], 3 times
      Key: [ HKLM\Software\Microsoft\Tracing\RASAPI32 ],
         Value Name: [ EnableConsoleTracing ], Value: [ 0 ], 3 times
      Key: [ HKLM\Software\Microsoft\Tracing\RASAPI32 ],
         Value Name: [ EnableFileTracing ], Value: [ 0 ], 3 times
      Key: [ HKLM\Software\Microsoft\Tracing\RASAPI32 ],
         Value Name: [ FileDirectory ], Value: [ %windir%\tracing ], 6 times
      Key: [ HKLM\Software\Microsoft\Tracing\RASAPI32 ],
         Value Name: [ FileTracingMask ], Value: [ 4294901760 ], 3 times
      Key: [ HKLM\Software\Microsoft\Tracing\RASAPI32 ],
         Value Name: [ MaxFileSize ], Value: [ 1048576 ], 3 times
      Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList ],
         Value Name: [ AllUsersProfile ], Value: [ All Users ], 2 times
      Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList ],
         Value Name: [ DefaultUserProfile ], Value: [ Default User ], 2 times
      Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList ],
         Value Name: [ ProfilesDirectory ], Value: [ %SystemDrive%\Documents and Settings ], 4 times
      Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-842925246-1425521274-308236825-500 ],
         Value Name: [ ProfileImagePath ], Value: [ %SystemDrive%\Documents and Settings\Administrator ], 2 times
      Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows ],
         Value Name: [ AppInit_DLLs ], Value: [  ], 1 time
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion ],
         Value Name: [ CommonFilesDir ], Value: [ C:\Program Files\Common Files ], 2 times
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion ],
         Value Name: [ ProgramFilesDir ], Value: [ C:\Program Files ], 2 times
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ],
         Value Name: [ Common AppData ], Value: [ %ALLUSERSPROFILE%\Application Data ], 1 time
      Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers ],
         Value Name: [ TransparentEnabled ], Value: [ 1 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName ],
         Value Name: [ ComputerName ], Value: [ PC ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm ],
         Value Name: [ wheel ], Value: [ 1 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Control\ProductOptions ],
         Value Name: [ ProductType ], Value: [ WinNT ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
         Value Name: [ ComSpec ], Value: [ %SystemRoot%\system32\cmd.exe ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
         Value Name: [ FP_NO_HOST_CHECK ], Value: [ NO ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
         Value Name: [ NUMBER_OF_PROCESSORS ], Value: [ 1 ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
         Value Name: [ OS ], Value: [ Windows_NT ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
         Value Name: [ PATHEXT ], Value: [ .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
         Value Name: [ PROCESSOR_ARCHITECTURE ], Value: [ x86 ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
         Value Name: [ PROCESSOR_IDENTIFIER ], Value: [ x86 Family 6 Model 3 Stepping 3, GenuineIntel ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
         Value Name: [ PROCESSOR_LEVEL ], Value: [ 6 ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
         Value Name: [ PROCESSOR_REVISION ], Value: [ 0303 ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
         Value Name: [ Path ], Value: [ %SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
         Value Name: [ TEMP ], Value: [ %SystemRoot%\TEMP ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
         Value Name: [ TMP ], Value: [ %SystemRoot%\TEMP ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
         Value Name: [ windir ], Value: [ %SystemRoot% ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Control\Terminal Server ],
         Value Name: [ TSAppCompat ], Value: [ 0 ], 3 times
      Key: [ HKLM\System\CurrentControlSet\Control\Terminal Server ],
         Value Name: [ TSUserEnabled ], Value: [ 0 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters ],
         Value Name: [ Domain ], Value: [  ], 2 times
      Key: [ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters ],
         Value Name: [ Hostname ], Value: [ pc ], 2 times
      Key: [ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters ],
         Value Name: [ UseDomainNameDevolution ], Value: [ 0 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock ],
         Value Name: [ HelperDllName ], Value: [ %SystemRoot%\System32\wshtcpip.dll ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock ],
         Value Name: [ Mapping ], Value: [ 0x0b0000000300000002000000010000000600000002000000010000000000 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock ],
         Value Name: [ MaxSockaddrLength ], Value: [ 16 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock ],
         Value Name: [ MinSockaddrLength ], Value: [ 16 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock ],
         Value Name: [ UseDelayedAcceptance ], Value: [ 0 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters ],
         Value Name: [ WinSock_Registry_Version ], Value: [ 2.0 ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5 ],
         Value Name: [ Num_Catalog_Entries ], Value: [ 3 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5 ],
         Value Name: [ Serial_Access_Num ], Value: [ 4 ], 2 times
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 ],
         Value Name: [ DisplayString ], Value: [ Tcpip ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 ],
         Value Name: [ Enabled ], Value: [ 1 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 ],
         Value Name: [ LibraryPath ], Value: [ %SystemRoot%\System32\mswsock.dll ], 2 times
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 ],
         Value Name: [ ProviderId ], Value: [ 0x409d05229e7ecf11ae5a00aa00a7112b ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 ],
         Value Name: [ StoresServiceClassInfo ], Value: [ 0 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 ],
         Value Name: [ SupportedNameSpace ], Value: [ 12 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 ],
         Value Name: [ Version ], Value: [ 0 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 ],
         Value Name: [ DisplayString ], Value: [ NTDS ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 ],
         Value Name: [ Enabled ], Value: [ 1 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 ],
         Value Name: [ LibraryPath ], Value: [ %SystemRoot%\System32\winrnr.dll ], 2 times
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 ],
         Value Name: [ ProviderId ], Value: [ 0xee37263b80e5cf11a55500c04fd8d4ac ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 ],
         Value Name: [ StoresServiceClassInfo ], Value: [ 0 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 ],
         Value Name: [ SupportedNameSpace ], Value: [ 32 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 ],
         Value Name: [ Version ], Value: [ 0 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 ],
         Value Name: [ DisplayString ], Value: [ Network Location Awareness (NLA) Namespace ], 4 times
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 ],
         Value Name: [ Enabled ], Value: [ 1 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 ],
         Value Name: [ LibraryPath ], Value: [ %SystemRoot%\System32\mswsock.dll ], 2 times
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 ],
         Value Name: [ ProviderId ], Value: [ 0x3a244266a83ba64abaa52e0bd71fdd83 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 ],
         Value Name: [ StoresServiceClassInfo ], Value: [ 0 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 ],
         Value Name: [ SupportedNameSpace ], Value: [ 15 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 ],
         Value Name: [ Version ], Value: [ 0 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9 ],
         Value Name: [ Next_Catalog_Entry_ID ], Value: [ 1020 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9 ],
         Value Name: [ Num_Catalog_Entries ], Value: [ 13 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9 ],
         Value Name: [ Serial_Access_Num ], Value: [ 6 ], 2 times
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001 ],
         Value Name: [ PackedCatalogItem ], Value: [ %SystemRoot%\system32\mswsock. ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002 ],
         Value Name: [ PackedCatalogItem ], Value: [ %SystemRoot%\system32\mswsock. ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003 ],
         Value Name: [ PackedCatalogItem ], Value: [ %SystemRoot%\system32\mswsock. ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004 ],
         Value Name: [ PackedCatalogItem ], Value: [ %SystemRoot%\system32\rsvpsp.d ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005 ],
         Value Name: [ PackedCatalogItem ], Value: [ %SystemRoot%\system32\rsvpsp.d ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006 ],
         Value Name: [ PackedCatalogItem ], Value: [ %SystemRoot%\system32\mswsock. ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007 ],
         Value Name: [ PackedCatalogItem ], Value: [ %SystemRoot%\system32\mswsock. ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008 ],
         Value Name: [ PackedCatalogItem ], Value: [ %SystemRoot%\system32\mswsock. ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009 ],
         Value Name: [ PackedCatalogItem ], Value: [ %SystemRoot%\system32\mswsock. ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010 ],
         Value Name: [ PackedCatalogItem ], Value: [ %SystemRoot%\system32\mswsock. ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011 ],
         Value Name: [ PackedCatalogItem ], Value: [ %SystemRoot%\system32\mswsock. ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012 ],
         Value Name: [ PackedCatalogItem ], Value: [ %SystemRoot%\system32\mswsock. ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013 ],
         Value Name: [ PackedCatalogItem ], Value: [ %SystemRoot%\system32\mswsock. ], 1 time
      Key: [ HKLM\System\Setup ],
         Value Name: [ SystemSetupInProgress ], Value: [ 0 ], 3 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Environment ],
         Value Name: [ TEMP ], Value: [ %USERPROFILE%\Local Settings\Temp ], 4 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Environment ],
         Value Name: [ TMP ], Value: [ %USERPROFILE%\Local Settings\Temp ], 4 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Keyboard Layout\Toggle ],
         Value Name: [ Language Hotkey ], Value: [ 1 ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Keyboard Layout\Toggle ],
         Value Name: [ Layout Hotkey ], Value: [ 2 ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ],
         Value Name: [ EnableHttp1_1 ], Value: [ 1 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ],
         Value Name: [ EnableNegotiate ], Value: [ 1 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ],
         Value Name: [ MimeExclusionListForCache ], Value: [ multipart/mixed multipart/x-mixed-replace multipart/x-byteranges  ], 4 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ],
         Value Name: [ WarnOnPost ], Value: [ 0x01000000 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows NT\CurrentVersion\Winlogon ],
         Value Name: [ ParseAutoexec ], Value: [ 1 ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ],
         Value Name: [ AppData ], Value: [ %USERPROFILE%\Application Data ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ],
         Value Name: [ Cache ], Value: [ %USERPROFILE%\Local Settings\Temporary Internet Files ], 3 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ],
         Value Name: [ Cookies ], Value: [ %USERPROFILE%\Cookies ], 3 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ],
         Value Name: [ History ], Value: [ %USERPROFILE%\Local Settings\History ], 3 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ],
         Value Name: [ Local Settings ], Value: [ %USERPROFILE%\Local Settings ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ],
         Value Name: [ Personal ], Value: [ %USERPROFILE%\My Documents ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache ],
         Value Name: [ Signature ], Value: [ Client UrlCache MMF Ver 5.2 ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content ],
         Value Name: [ CacheLimit ], Value: [ 163410 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content ],
         Value Name: [ CachePrefix ], Value: [  ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content ],
         Value Name: [ PerUserItem ], Value: [ 1 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies ],
         Value Name: [ CacheLimit ], Value: [ 8192 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies ],
         Value Name: [ CachePrefix ], Value: [ Cookie: ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies ],
         Value Name: [ PerUserItem ], Value: [ 1 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012011021720110218 ],
         Value Name: [ CacheLimit ], Value: [ 8192 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012011021720110218 ],
         Value Name: [ CacheOptions ], Value: [ 11 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012011021720110218 ],
         Value Name: [ CachePath ], Value: [ %USERPROFILE%\Local Settings\History\History.IE5\MSHist012011021720110218\ ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012011021720110218 ],
         Value Name: [ CachePrefix ], Value: [ :2011021720110218:  ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012011021720110218 ],
         Value Name: [ CacheRepair ], Value: [ 0 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012011021820110219 ],
         Value Name: [ CacheLimit ], Value: [ 8192 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012011021820110219 ],
         Value Name: [ CacheOptions ], Value: [ 11 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012011021820110219 ],
         Value Name: [ CachePath ], Value: [ %USERPROFILE%\Local Settings\History\History.IE5\MSHist012011021820110219\ ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012011021820110219 ],
         Value Name: [ CachePrefix ], Value: [ :2011021820110219:  ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012011021820110219 ],
         Value Name: [ CacheRepair ], Value: [ 0 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History ],
         Value Name: [ CacheLimit ], Value: [ 8192 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History ],
         Value Name: [ CachePrefix ], Value: [ Visited: ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History ],
         Value Name: [ PerUserItem ], Value: [ 1 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ],
         Value Name: [ IntranetName ], Value: [ 1 ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ],
         Value Name: [ ProxyBypass ], Value: [ 1 ], 5 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\ProtocolDefaults\ ],
         Value Name: [ http ], Value: [ 3 ], 5 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 ],
         Value Name: [ Flags ], Value: [ 33 ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 ],
         Value Name: [ Flags ], Value: [ 219 ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 ],
         Value Name: [ Flags ], Value: [ 71 ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 ],
         Value Name: [ 1A10 ], Value: [ 1 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 ],
         Value Name: [ Flags ], Value: [ 1 ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 ],
         Value Name: [ Flags ], Value: [ 3 ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\windows\CurrentVersion\Internet Settings ],
         Value Name: [ MigrateProxy ], Value: [ 1 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\windows\CurrentVersion\Internet Settings ],
         Value Name: [ ProxyEnable ], Value: [ 0 ], 1 time
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections ],
         Value Name: [ DefaultConnectionSettings ], Value: [ 0x3c0000000300000001000000000000000000000000000000040000000000 ], 2 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections ],
         Value Name: [ SavedLegacySettings ], Value: [ 0x3c0000001500000001000000000000000000000000000000040000000000 ], 4 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Volatile Environment ],
         Value Name: [ APPDATA ], Value: [ C:\Documents and Settings\Administrator\Application Data ], 4 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Volatile Environment ],
         Value Name: [ CLIENTNAME ], Value: [ Console ], 4 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Volatile Environment ],
         Value Name: [ HOMEDRIVE ], Value: [ C: ], 4 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Volatile Environment ],
         Value Name: [ HOMEPATH ], Value: [ \Documents and Settings\Administrator ], 4 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Volatile Environment ],
         Value Name: [ HOMESHARE ], Value: [  ], 4 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Volatile Environment ],
         Value Name: [ LOGONSERVER ], Value: [ \\PC ], 4 times
      Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Volatile Environment ],
         Value Name: [ SESSIONNAME ], Value: [ Console ], 4 times

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Monitored Registry Keys:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      Key: [ HKLM\Software\Microsoft\Tracing\RASAPI32 ],
         Watch subtree: [ 0 ], Notify Filter: [ Attributes Change,Value Change,Security Descriptor Change ], 3 times
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5 ],
         Watch subtree: [ 0 ], Notify Filter: [ Key Change ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9 ],
         Watch subtree: [ 0 ], Notify Filter: [ Key Change ], 1 time

[=============================================================================]
3.b) trwob.exe - File Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Files Deleted:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File Name: [ C:\Document_8.exe ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Files Read:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File Name: [ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\trwob.exe ]
      File Name: [ PIPE\lsarpc ]
      File Name: [ c:\autoexec.bat ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Files Modified:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File Name: [ PIPE\lsarpc ]
      File Name: [ \Device\Afd\Endpoint ]
      File Name: [ \Device\RasAcd ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File System Control Communication:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File: [ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ ], Control Code: [ 0x00090028 ], 1 time
      File: [ PIPE\lsarpc ], Control Code: [ 0x0011C017 ], 16 times

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Device Control Communication:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File: [ \Device\KsecDD ], Control Code: [ 0x00390008 ], 8 times
      File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_GET_INFO (0x0001207B) ], 2 times
      File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_SET_CONTEXT (0x00012047) ], 42 times
      File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_BIND (0x00012003) ], 10 times
      File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_GET_TDI_HANDLES (0x00012037) ], 23 times
      File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_GET_SOCK_NAME (0x0001202F) ], 10 times
      File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_CONNECT (0x00012007) ], 10 times
      File: [ unnamed file ], Control Code: [ 0x00120028 ], 5 times
      File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_SEND (0x0001201F) ], 5 times
      File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_RECV (0x00012017) ], 24 times
      File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_SET_INFO (0x0001203B) ], 15 times
      File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_DISCONNECT (0x0001202B) ], 3 times

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Memory Mapped Files:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File Name: [ C:\WINDOWS\System32\wshtcpip.dll ]
      File Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll ]
      File Name: [ C:\WINDOWS\WindowsShell.Manifest ]
      File Name: [ C:\WINDOWS\system32\DNSAPI.dll ]
      File Name: [ C:\WINDOWS\system32\MSCTF.dll ]
      File Name: [ C:\WINDOWS\system32\RASAPI32.DLL ]
      File Name: [ C:\WINDOWS\system32\TAPI32.dll ]
      File Name: [ C:\WINDOWS\system32\UxTheme.dll ]
      File Name: [ C:\WINDOWS\system32\WINMM.dll ]
      File Name: [ C:\WINDOWS\system32\WS2HELP.dll ]
      File Name: [ C:\WINDOWS\system32\WS2_32.dll ]
      File Name: [ C:\WINDOWS\system32\hnetcfg.dll ]
      File Name: [ C:\WINDOWS\system32\imm32.dll ]
      File Name: [ C:\WINDOWS\system32\mswsock.dll ]
      File Name: [ C:\WINDOWS\system32\rasadhlp.dll ]
      File Name: [ C:\WINDOWS\system32\rasman.dll ]
      File Name: [ C:\WINDOWS\system32\rtutils.dll ]
      File Name: [ C:\WINDOWS\system32\sensapi.dll ]
      File Name: [ C:\WINDOWS\system32\shell32.dll ]
      File Name: [ C:\WINDOWS\system32\urlmon.dll ]
      File Name: [ C:\WINDOWS\system32\wininet.dll ]
      File Name: [ C:\WINDOWS\system32\wsock32.dll ]

[=============================================================================]
3.c) trwob.exe - Network Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
DNS Queries:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      Name: [ happy-family.awardspace.com ], Query Type: [ DNS_TYPE_A ],
         Query Result: [ 83.125.22.155 ], Successful: [ 1 ], Protocol: [  ]
      Name: [ gcmired.atwebpages.com ], Query Type: [ DNS_TYPE_A ],
         Query Result: [ 83.125.22.165 ], Successful: [ 1 ], Protocol: [  ]

[#############################################################################]
                     International Secure Systems Lab
                        http://www.iseclab.org

Vienna University of Technology    Eurecom France          UC Santa Barbara
http://www.tuwien.ac.at       http://www.eurecom.fr  http://www.cs.ucsb.edu

                        Contact: anubis@iseclab.org

显示全部楼层 · 发表于 2014-10-28 20:28:25

诸葛亮发表于 2014-10-28 20:26
看来是时候准备虚拟机了thank you

实机安装吧

显示全部楼层 · 发表于 2014-10-28 21:17:06

Baidu Antivirus不杀

显示全部楼层 · 发表于 2014-10-28 21:31:05

360 过诺顿扫描主防未测

显示全部楼层 · 发表于 2014-10-28 22:05:08

N 21

显示全部楼层 · 发表于 2014-10-28 22:07:18

显示全部楼层 · 发表于 2014-10-28 22:45:51

好压EAV火绒扫描KILL

[可疑文件] VT Detection ratio: 2 / 53 Document_8724_8241.scr 是什么东东

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源