txxf.info(Passwd Stealer)

DNS Lookup
Host Name IP Address
0 127.0.0.1
txxf.info
txxf.info 74.126.180.84
UDP Connections
Remote IP Address: 127.0.0.1 Port: 1061
Send Datagram: 240 packet(s) of size 1
Recv Datagram: 240 packet(s) of size 1
Download URLs
http://74.126.180.84/5.exe (txxf.info)

Outgoing connection to remote server: txxf.info TCP port 80

DNS Lookup
Host Name IP Address
0 127.0.0.1
txxf.info
txxf.info 74.126.180.84
UDP Connections
Remote IP Address: 127.0.0.1 Port: 1061
Send Datagram: 240 packet(s) of size 1
Recv Datagram: 240 packet(s) of size 1
Download URLs
http://74.126.180.84/5.exe (txxf.info)

Outgoing connection to remote server: txxf.info TCP port 80

File Changes by all processes
New Files DeviceRasAcd
DeviceTcp
DeviceIp
DeviceIp
C:calcs.exe
Opened Files .PIPElsarpc
c:autoexec.bat
.PIPEROUTER
.Ip
Deleted Files
Chronological Order Open File: .PIPElsarpc (OPEN_EXISTING)
Get File Attributes: c:autoexec.bat Flags: (SECURITY_ANONYMOUS)
Open File: c:autoexec.bat (OPEN_EXISTING)
Find File: C:Dokumente und EinstellungenAll UsersAnwendungsdatenMicrosoftNetworkConnectionsPbk*.pbk
Find File: C:WINDOWSsystem32Ras*.pbk
Find File: C:Dokumente und EinstellungenAdministratorAnwendungsdatenMicrosoftNetworkConnectionsPbk*.pbk
Create/Open File: DeviceRasAcd (OPEN_ALWAYS)
Open File: .PIPEROUTER (OPEN_EXISTING)
Create/Open File: DeviceTcp (OPEN_ALWAYS)
Create/Open File: DeviceIp (OPEN_ALWAYS)
Create/Open File: DeviceIp (OPEN_ALWAYS)
Open File: .Ip (OPEN_EXISTING)
Move File: C:calcs.tv to C:calcs.exe
Get File Attributes: C:WINDOWS Flags: (SECURITY_ANONYMOUS)