labfixer.mamadody.mobi

By Pig, December 17, 2009

labfixer.mamadody.mobi 66.252.13.204
Opened listening TCP connection on port: 113

* C&C Server: 66.252.13.204:15656
* Server Password:
* Username: laMer
* Nickname: XP|ibzcwN
* Channel: (Password: )
* Channeltopic:

* C&C Server: 66.252.13.204:15656
* Server Password:
* Username: laMer
* Nickname: :XPDzsU49
* Channel: #tcp# (Password: d0s)
* Channeltopic: :!clear

Registry Changes by all processes
Create or Open
Changes HKEY_CURRENT_USERSoftwarems32 “DateUsed” = 1261056248
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallms32 “DisplayName” = ms32
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallms32 “UninstallString” = “C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowseriexplorer.pif” -uninstall
HKEY_LOCAL_MACHINESOFTWAREClasses.cha “” = ChatFile
HKEY_LOCAL_MACHINESOFTWAREClasses.chat “” = ChatFile
HKEY_LOCAL_MACHINESOFTWAREClassesChatFile “” = Chat File
HKEY_LOCAL_MACHINESOFTWAREClassesChatFileDefaultIcon “” = “C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowseriexplorer.pif”
HKEY_LOCAL_MACHINESOFTWAREClassesChatFileShellopencommand “” = “C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowseriexplorer.pif” -noconnect
HKEY_LOCAL_MACHINESOFTWAREClassesChatFileShellopenddeexec “” = %1
HKEY_LOCAL_MACHINESOFTWAREClassesChatFileShellopenddeexecApplication “” = mIRC
HKEY_LOCAL_MACHINESOFTWAREClassesChatFileShellopenddeexecifexec “” = %1
HKEY_LOCAL_MACHINESOFTWAREClassesChatFileShellopenddeexecTopic “” = Connect
HKEY_LOCAL_MACHINESOFTWAREClassesirc “” = URL:IRC Protocol
HKEY_LOCAL_MACHINESOFTWAREClassesirc “EditFlags” = [REG_BINARY, size: 4 bytes]
HKEY_LOCAL_MACHINESOFTWAREClassesirc “URL Protocol” =
HKEY_LOCAL_MACHINESOFTWAREClassesircDefaultIcon “” = “C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowseriexplorer.pif”
HKEY_LOCAL_MACHINESOFTWAREClassesircShellopencommand “” = “C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowseriexplorer.pif” -noconnect
HKEY_LOCAL_MACHINESOFTWAREClassesircShellopenddeexec “” = %1
HKEY_LOCAL_MACHINESOFTWAREClassesircShellopenddeexecApplication “” = mIRC
HKEY_LOCAL_MACHINESOFTWAREClassesircShellopenddeexecifexec “” = %1
HKEY_LOCAL_MACHINESOFTWAREClassesircShellopenddeexecTopic “” = Connect
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “VoiceEnabled” = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “UseVoiceTips” = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “KeyHoldHotKey” = [REG_DWORD, value: 00000091]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “UseBeepSRPrompt” = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “SRTimerDelay” = [REG_DWORD, value: 000007D0]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “SRModeID” = [REG_BINARY, size: 16 bytes]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “EnableSpeaking” = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “UseBalloon” = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “UseCharacterFont” = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “UseSoundEffects” = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “SpeakingSpeed” = [REG_DWORD, value: 00000005]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “PropertySheetX” = [REG_DWORD, value: 000F423F]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “PropertySheetY” = [REG_DWORD, value: 000F423F]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “PropertySheetWidth” = [REG_DWORD, value: 00000000]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “PropertySheetHeight” = [REG_DWORD, value: 00000000]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “PropertySheetPage” = [REG_DWORD, value: 00000000]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “CommandsWindowLeft” = [REG_DWORD, value: FFFFFFFF]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “CommandsWindowTop” = [REG_DWORD, value: FFFFFFFF]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “CommandsWindowWidth” = [REG_DWORD, value: 000000C8]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “CommandsWindowHeight” = [REG_DWORD, value: 000000C8]
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “CommandsWindowLocationSet” = [REG_DWORD, value: 00000000]
Reads HKEY_LOCAL_MACHINESOFTWAREMicrosoftCTFSystemShared “CUAS”
HKEY_CURRENT_USERKeyboard LayoutToggle “Language Hotkey”
HKEY_CURRENT_USERKeyboard LayoutToggle “Layout Hotkey”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCTF “EnableAnchorContext”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionIMM “Ime File”
HKEY_CURRENT_USERSoftwareMicrosoftCTF “Disable Thread Input Manager”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion “ProgramFilesDir”
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerShell Folders “Desktop”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShell Folders “Common Desktop”
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerShell Folders “Programs”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShell Folders “Common Programs”
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerShell Folders “Startup”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShell Folders “Common Startup”
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerShell Folders “Start Menu”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShell Folders “Common Start Menu”
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerShell Folders “AppData”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShell Folders “Common AppData”
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerShell Folders “Favorites”
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerShell Folders “Fonts”
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerShell Folders “Personal”
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerShell Folders “SendTo”
HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSession ManagerAppCompatibility “DisableAppCompat”
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{56F9679E-7826-4C84-81F3-532071A8BCC5}InprocServer32 “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows SearchProtocolHandlersFile “ProgID”
HKEY_LOCAL_MACHINESOFTWAREClassesfile “ShellFolder”
HKEY_LOCAL_MACHINESOFTWAREClassesMapi “ShellFolder”
HKEY_LOCAL_MACHINESOFTWAREClassesOutlookexpress “ShellFolder”
HKEY_LOCAL_MACHINESOFTWAREClassesOTFS “ShellFolder”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersDefault “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersDefault “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersDefault “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersDefault “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.bmp “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.bmp “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.bmp “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.bmp “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.c “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.c “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.c “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.c “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cpp “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cpp “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cpp “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cpp “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cs “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cs “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cs “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cs “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cxx “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cxx “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cxx “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cxx “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.doc “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.doc “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.doc “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.doc “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.dot “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.dot “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.dot “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.dot “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.emf “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.emf “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.emf “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.emf “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.eml “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.eml “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.eml “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.eml “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.err “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.err “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.err “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.err “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.gif “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.gif “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.gif “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.gif “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.h “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.h “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.h “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.h “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.htm “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.htm “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.htm “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.htm “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.html “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.html “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.html “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.html “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.hxx “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.hxx “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.hxx “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.hxx “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.idl “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.idl “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.idl “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.idl “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jpeg “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jpeg “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jpeg “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jpeg “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jpg “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jpg “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jpg “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jpg “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jsl “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jsl “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jsl “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jsl “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.mht “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.mht “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.mht “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.mht “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.mhtml “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.mhtml “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.mhtml “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.mhtml “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.nws “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.nws “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.nws “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.nws “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pdf “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pdf “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pdf “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pdf “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.png “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.png “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.png “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.png “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pot “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pot “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pot “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pot “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pps “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pps “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pps “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pps “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.ppt “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.ppt “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.ppt “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.ppt “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.rtf “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.rtf “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.rtf “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.rtf “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.txt “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.txt “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.txt “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.txt “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.vb “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.vb “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.vb “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.vb “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.wmf “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.wmf “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.wmf “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.wmf “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.wrn “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.wrn “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.wrn “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.wrn “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xls “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xls “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xls “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xls “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xlt “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xlt “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xlt “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xlt “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xml “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xml “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xml “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xml “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xsd “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xsd “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xsd “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xsd “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecalendar “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecalendar “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecalendar “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecalendar “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecommunications “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecommunications “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecommunications “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecommunications “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecontact “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecontact “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecontact “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecontact “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypedocument “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypedocument “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypedocument “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypedocument “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeemail “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeemail “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeemail “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeemail “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypefavorite “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypefavorite “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypefavorite “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypefavorite “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypefolder “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypefolder “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypefolder “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypefolder “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeim “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeim “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeim “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeim “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeimages “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeimages “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeimages “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeimages “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypemusic “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypemusic “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypemusic “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypemusic “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypenote “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypenote “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypenote “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypenote “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypepicture “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypepicture “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypepicture “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypepicture “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypepresentation “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypepresentation “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypepresentation “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypepresentation “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeprogram “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeprogram “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeprogram “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeprogram “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypespreadsheet “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypespreadsheet “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypespreadsheet “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypespreadsheet “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypetext “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypetext “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypetext “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypetext “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypevideo “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypevideo “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypevideo “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypevideo “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{750fdf0e-2a26-11d1-a3ea-080036587f03}InProcServer32 “”
HKEY_LOCAL_MACHINESYSTEMWPAMediaCenter “Installed”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCTFSystemShared “CUAS”
HKEY_CURRENT_USERKeyboard LayoutToggle “Language Hotkey”
HKEY_CURRENT_USERKeyboard LayoutToggle “Layout Hotkey”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCTF “EnableAnchorContext”
HKEY_LOCAL_MACHINESOFTWAREClassesHTTPshellopen “command”
HKEY_LOCAL_MACHINESOFTWAREClassesmailtoshellopen “command”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionIMM “Ime File”
HKEY_CURRENT_USERSoftwareMicrosoftCTF “Disable Thread Input Manager”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftRpcSecurityService “DefaultAuthLevel”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCTFSystemShared “CUAS”
HKEY_CURRENT_USERKeyboard LayoutToggle “Language Hotkey”
HKEY_CURRENT_USERKeyboard LayoutToggle “Layout Hotkey”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCTF “EnableAnchorContext”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionIMM “Ime File”
HKEY_CURRENT_USERSoftwareMicrosoftCTF “Disable Thread Input Manager”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “VoiceEnabled”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “UseVoiceTips”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “KeyHoldHotKey”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “UseBeepSRPrompt”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “SRTimerDelay”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “SRModeID”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “EnableSpeaking”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “UseBalloon”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “UseCharacterFont”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “UserFont”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “UseSoundEffects”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “SpeakingSpeed”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “PropertySheetX”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “PropertySheetY”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “PropertySheetWidth”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “PropertySheetHeight”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “PropertySheetPage”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “CommandsWindowLeft”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “CommandsWindowTop”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “CommandsWindowWidth”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “CommandsWindowHeight”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “CommandsWindowLocationSet”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “UseSprites”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “UseUniScribe”
HKEY_CURRENT_USERSoftwareMicrosoftMicrosoft Agent “SystemCharacter”
Enums HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows SearchProtocolHandlers
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows SearchProtocolHandlersFile
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedType

File Changes by all processes
New Files C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser313.INS
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserc5nt6.zip
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser86102025.INS
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsereiuq.msp
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser27296716.INS
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowseriexplorer.pif
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser31861617.INS
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserms32.sys
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser37224256.INS
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserosr32.zip
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser8204747.INS
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserreclicks32.dll
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser7058408.INS
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsers1co.exe
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser5972932.INS
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsers3tu7.dll
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser91723679.INS
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsersrl8tx.zip
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser77463279.INS
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsert3c1k.zip
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser69768441.INS
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsertum8v.exe
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser71793066.INS
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserxw2nc.zip
DeviceRasAcd
Opened Files c:Winmb32.exe
.PIPEwkssvc
.PIPElsarpc
C:ProgrammeWindows Desktop SearchMSNLNamespaceMgr.dll
C:WINDOWSRegistrationR000000000007.clb
C:WINDOWSSystem32cscui.dll
.shadow
C:WINDOWSAppPatchsysmain.sdb
C:WINDOWSAppPatchsystest.sdb
DeviceNamedPipeShimViewer
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser
servers
servers
urls
urls
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserurls.ini
addrbk
addrbk
iexplore
iexplore
rundll32
rundll32

Browser
Browser
channels
channels
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserperform.ini
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsercontrol.ini
aliases
aliases
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowseraliases.ini
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserpopups.ini
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsereiuq.msp
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserxw2nc.zip
srl8tx
srl8tx
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsersrl8tx.zip
c5nt6
c5nt6
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserc5nt6.zip
mkreg
mkreg
C:WINDOWSRegistrationR000000000007.clb
.PIPElsarpc
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserservers.ini
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserservers.ini
t3c1k
t3c1k
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsert3c1k.zip
sounds
sounds
download
download
logs
logs
Winmb32
Winmb32
sr
sr
C:WINDOWSmsagentintlAgt0409.dll
C:WINDOWSRegistrationR000000000007.clb
.PIPElsarpc
Deleted Files
C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserpassword.val
c:Winmb32.exe
Chronological Order Open File: c:Winmb32.exe (OPEN_EXISTING)
Get File Attributes: C:DOKUME~1ADMINI~1LOKALE~1Temp Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:DOKUME~1ADMINI~1LOKALE~1Tempiyexit1.tmp Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindex Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlock Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdate Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecent Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOffice Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoft Flags: (SECURITY_ANONYMOUS)
Find File: c:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoft*.*
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C: Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C: Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und Einstellungen Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll Users Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdaten Flags: (SECURITY_ANONYMOUS)
Find File: c:Winmb32.exe
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserc5nt6.zip
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser313.INS
Create File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser313.INS
Set File Time: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser313.INS
Move File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser313.INS to C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserc5nt6.zip
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsereiuq.msp
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser86102025.INS
Create File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser86102025.INS
Set File Time: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser86102025.INS
Move File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser86102025.INS to C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsereiuq.msp
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowseriexplorer.pif
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser27296716.INS
Create File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser27296716.INS
Set File Time: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser27296716.INS
Move File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser27296716.INS to C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowseriexplorer.pif
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserms32.sys
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser31861617.INS
Create File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser31861617.INS
Set File Time: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser31861617.INS
Move File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser31861617.INS to C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserms32.sys
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserosr32.zip
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser37224256.INS
Create File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser37224256.INS
Set File Time: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser37224256.INS
Move File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser37224256.INS to C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserosr32.zip
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserreclicks32.dll
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser8204747.INS
Create File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser8204747.INS
Set File Time: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser8204747.INS
Move File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser8204747.INS to C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserreclicks32.dll
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsers1co.exe
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser7058408.INS
Create File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser7058408.INS
Set File Time: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser7058408.INS
Move File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser7058408.INS to C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsers1co.exe
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsers3tu7.dll
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser5972932.INS
Create File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser5972932.INS
Set File Time: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser5972932.INS
Move File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser5972932.INS to C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsers3tu7.dll
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsersrl8tx.zip
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser91723679.INS
Create File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser91723679.INS
Set File Time: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser91723679.INS
Move File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser91723679.INS to C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsersrl8tx.zip
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsert3c1k.zip
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser77463279.INS
Create File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser77463279.INS
Set File Time: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser77463279.INS
Move File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser77463279.INS to C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsert3c1k.zip
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsertum8v.exe
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser69768441.INS
Create File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser69768441.INS
Set File Time: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser69768441.INS
Move File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser69768441.INS to C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsertum8v.exe
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserxw2nc.zip
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser71793066.INS
Create File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser71793066.INS
Set File Time: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser71793066.INS
Move File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser71793066.INS to C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserxw2nc.zip
Delete File:
Delete File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserpassword.val
Open File: .PIPEwkssvc (OPEN_EXISTING)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowseriexplorer.pif Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:WINDOWS Flags: (SECURITY_ANONYMOUS)
Open File: .PIPElsarpc (OPEN_EXISTING)
Get File Attributes: C:Dokumente und EinstellungenAdministratorEigene Dateiendesktop.ini Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersDokumentedesktop.ini Flags: (SECURITY_ANONYMOUS)
Open File: C:ProgrammeWindows Desktop SearchMSNLNamespaceMgr.dll (OPEN_EXISTING)
Get File Attributes: C:WINDOWSRegistration Flags: (SECURITY_ANONYMOUS)
Open File: C:WINDOWSRegistrationR000000000007.clb (OPEN_EXISTING)
Open File: C:WINDOWSSystem32cscui.dll (OPEN_EXISTING)
Open File: .shadow (OPEN_EXISTING)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowseriexplorer.pif:Zone.Identifier Flags: (SECURITY_ANONYMOUS)
Open File: C:WINDOWSAppPatchsysmain.sdb (OPEN_EXISTING)
Open File: C:WINDOWSAppPatchsystest.sdb (OPEN_EXISTING)
Open File: DeviceNamedPipeShimViewer (OPEN_EXISTING)
Open File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser ()
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserms32.sys Flags: (SECURITY_ANONYMOUS)
Set File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserms32.sys Flags: (FILE_ATTRIBUTE_ARCHIVE FILE_ATTRIBUTE_COMPRESSED FILE_ATTRIBUTE_COMPRESSED SECURITY_ANONYMOUS)
Open File: servers (OPEN_EXISTING)
Find File: servers
Open File: servers (OPEN_EXISTING)
Get File Attributes: servers Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserservers.ini Flags: (SECURITY_ANONYMOUS)
Open File: urls (OPEN_EXISTING)
Find File: urls
Open File: urls (OPEN_EXISTING)
Get File Attributes: urls Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserurls.ini Flags: (SECURITY_ANONYMOUS)
Open File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserurls.ini (OPEN_EXISTING)
Open File: addrbk (OPEN_EXISTING)
Find File: addrbk
Open File: addrbk (OPEN_EXISTING)
Get File Attributes: addrbk Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowseraddrbk.ini Flags: (SECURITY_ANONYMOUS)
Open File: iexplore (OPEN_EXISTING)
Find File: iexplore
Open File: iexplore (OPEN_EXISTING)
Get File Attributes: iexplore Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:ProgrammeInternet Exploreriexplore.exe Flags: (SECURITY_ANONYMOUS)
Open File: rundll32 (OPEN_EXISTING)
Find File: rundll32
Open File: rundll32 (OPEN_EXISTING)
Get File Attributes: rundll32 Flags: (SECURITY_ANONYMOUS)
Get File Attributes: rundll32.exe Flags: (SECURITY_ANONYMOUS)
Open File: (OPEN_EXISTING)
Find File:
Open File: (OPEN_EXISTING)
Get File Attributes: Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser . Flags: (SECURITY_ANONYMOUS)
Open File: Browser (OPEN_EXISTING)
Find File: Browser
Open File: Browser (OPEN_EXISTING)
Get File Attributes: Browser Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser Flags: (SECURITY_ANONYMOUS)
Open File: channels (OPEN_EXISTING)
Find File: channels
Open File: channels (OPEN_EXISTING)
Get File Attributes: channels Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserchannels.txt Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserperform.ini Flags: (SECURITY_ANONYMOUS)
Open File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserperform.ini (OPEN_EXISTING)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowser . Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsercontrol.ini Flags: (SECURITY_ANONYMOUS)
Open File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsercontrol.ini (OPEN_EXISTING)
Open File: aliases (OPEN_EXISTING)
Find File: aliases
Open File: aliases (OPEN_EXISTING)
Get File Attributes: aliases Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowseraliases.ini Flags: (SECURITY_ANONYMOUS)
Open File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowseraliases.ini (OPEN_EXISTING)
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowseraliases.ini
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserpopups.ini Flags: (SECURITY_ANONYMOUS)
Open File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserpopups.ini (OPEN_EXISTING)
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserpopups.ini
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsertblogo.bmp Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsereiuq.msp Flags: (SECURITY_ANONYMOUS)
Set File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsereiuq.msp Flags: (FILE_ATTRIBUTE_ARCHIVE FILE_ATTRIBUTE_COMPRESSED FILE_ATTRIBUTE_COMPRESSED SECURITY_ANONYMOUS)
Open File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsereiuq.msp (OPEN_EXISTING)
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsereiuq.msp
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserxw2nc.zip Flags: (SECURITY_ANONYMOUS)
Set File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserxw2nc.zip Flags: (FILE_ATTRIBUTE_ARCHIVE FILE_ATTRIBUTE_COMPRESSED FILE_ATTRIBUTE_COMPRESSED SECURITY_ANONYMOUS)
Open File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserxw2nc.zip (OPEN_EXISTING)
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserxw2nc.zip
Open File: srl8tx (OPEN_EXISTING)
Find File: srl8tx
Open File: srl8tx (OPEN_EXISTING)
Get File Attributes: srl8tx Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsersrl8tx.zip Flags: (SECURITY_ANONYMOUS)
Set File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsersrl8tx.zip Flags: (FILE_ATTRIBUTE_ARCHIVE FILE_ATTRIBUTE_COMPRESSED FILE_ATTRIBUTE_COMPRESSED SECURITY_ANONYMOUS)
Open File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsersrl8tx.zip (OPEN_EXISTING)
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsersrl8tx.zip
Open File: c5nt6 (OPEN_EXISTING)
Find File: c5nt6
Open File: c5nt6 (OPEN_EXISTING)
Get File Attributes: c5nt6 Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserc5nt6.zip Flags: (SECURITY_ANONYMOUS)
Set File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserc5nt6.zip Flags: (FILE_ATTRIBUTE_ARCHIVE FILE_ATTRIBUTE_COMPRESSED FILE_ATTRIBUTE_COMPRESSED SECURITY_ANONYMOUS)
Open File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserc5nt6.zip (OPEN_EXISTING)
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserc5nt6.zip
Open File: mkreg (OPEN_EXISTING)
Find File: mkreg
Open File: mkreg (OPEN_EXISTING)
Get File Attributes: mkreg Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsermkreg.hlp Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:WINDOWSRegistration Flags: (SECURITY_ANONYMOUS)
Open File: C:WINDOWSRegistrationR000000000007.clb (OPEN_EXISTING)
Open File: .PIPElsarpc (OPEN_EXISTING)
Open File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserservers.ini (OPEN_EXISTING)
Open File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserservers.ini (OPEN_EXISTING)
Create/Open File: DeviceRasAcd (OPEN_ALWAYS)
Open File: t3c1k (OPEN_EXISTING)
Find File: t3c1k
Open File: t3c1k (OPEN_EXISTING)
Get File Attributes: t3c1k Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsert3c1k.zip Flags: (SECURITY_ANONYMOUS)
Open File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsert3c1k.zip (OPEN_EXISTING)
Open File: sounds (OPEN_EXISTING)
Find File: sounds
Open File: sounds (OPEN_EXISTING)
Get File Attributes: sounds Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsersounds Flags: (SECURITY_ANONYMOUS)
Open File: download (OPEN_EXISTING)
Find File: download
Open File: download (OPEN_EXISTING)
Get File Attributes: download Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserdownload Flags: (SECURITY_ANONYMOUS)
Open File: logs (OPEN_EXISTING)
Find File: logs
Open File: logs (OPEN_EXISTING)
Get File Attributes: logs Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserlogs Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserchannels Flags: (SECURITY_ANONYMOUS)
Open File: Winmb32 (OPEN_EXISTING)
Find File: Winmb32
Open File: Winmb32 (OPEN_EXISTING)
Get File Attributes: Winmb32 Flags: (SECURITY_ANONYMOUS)
Get File Attributes: c:Winmb32.exe Flags: (SECURITY_ANONYMOUS)
Delete File: c:Winmb32.exe
Open File: sr (OPEN_EXISTING)
Find File: sr
Open File: sr (OPEN_EXISTING)
Get File Attributes: sr Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowsersr.dll Flags: (SECURITY_ANONYMOUS)
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftOfficeRecentdateunlockindexBrowserms32.sys
Open File: C:WINDOWSmsagentintlAgt0409.dll (OPEN_EXISTING)
Find File: C:WINDOWSmsagentintlagt????.dll
Get File Attributes: C:WINDOWSRegistration Flags: (SECURITY_ANONYMOUS)
Open File: C:WINDOWSRegistrationR000000000007.clb (OPEN_EXISTING)
Open File: .PIPElsarpc (OPEN_EXISTING)

Categories: Uncategorized