3 2 247 s 01/09/12, 15:36:24 UTC Timeout 1.75.3394 $Revision: 3603 $ Dec 30 2011 23:19:18

true true false false false false false false false false false true true true true false false false false false false false false true false true false 7

2 1 Primary Analysis Subject 816b5164836b18d7778c1307c77df307.zeustracker 816b516483.exe C:\816b516483.exe "C:\816b516483.exe" dead 0 816b5164836b18d7778c1307c77df307 25cc73f0953fe4033ead23a21b123e737a72fa2a 109568 3 2 Started by 816b516483.exe erud.exe C:\Documents and Settings\Administrator\Application Data\Xuke\erud.exe "C:\Documents and Settings\Administrator\Application Data\Xuke\erud.exe" dead 0 709df910866f41c9cbd427ee9fa7ceb2 bde5601b87a34043ec5f8e3053632ad8128c8813 109568 4 3 erud.exe wrote to the virtual memory of this process Explorer.EXE C:\WINDOWS\Explorer.EXE C:\WINDOWS\Explorer.EXE alive 0 12896823fb95bfb3dc9b46bcaedc9923 9d2bf84874abc5b6e9a2744b7865c193c08d362f 1033728 5 3 erud.exe wrote to the virtual memory of this process ctfmon.exe C:\WINDOWS\system32\ctfmon.exe "C:\WINDOWS\system32\ctfmon.exe" alive 0 5f1d5f88303d4a4dbc8e5f97ba967cc3 99cb7370f16773c8e2d0c86fe805ec638ab126e9 15360 6 3 erud.exe wrote to the virtual memory of this process msmsgs.exe C:\Program Files\Messenger\msmsgs.exe "C:\Program Files\Messenger\msmsgs.exe" /background alive 0 3e930c641079443d4de036167a69caa2 ac40479e28fb680aff76e41fa14ebe18b3392629 1695232 7 3 erud.exe wrote to the virtual memory of this process reader_sl.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe "C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe" dead 0 54c88bfbd055621e2306534f445c0c8d 960a171e826c077187fe634103874644327a6110 40048 8 3 erud.exe wrote to the virtual memory of this process wscntfy.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wscntfy.exe alive 0 f92e1076c42fcd6db3d72d8cfe9816d5 549f0a01848375d03159fc74171ed97790fa9650 13824 9 3 erud.exe wrote to the virtual memory of this process otlsxk.exe C:\Program Files\Common Files\otlsxk.exe "C:\Program Files\Common Files\otlsxk.exe" alive 0 ed22e108cca63fab4ad592f04b117289 a11b96e200594f19b8e67af04797b61267710fec 327901 UPX All_Versions SN:1634 10 3 erud.exe wrote to the virtual memory of this process qfunmp.exe C:\Program Files\Common Files\qfunmp.exe "C:\Program Files\Common Files\qfunmp.exe" alive 0 ec95a4d3adc866c53bfafc3ba177d905 78d7358cebb7681ba22b1ec453eb98308eadd619 1256684 ......... 11 2 Started by 816b516483.exe cmd.exe C:\WINDOWS\system32\cmd.exe "C:\WINDOWS\system32\cmd.exe" /c "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp7e65d85f.bat" dead 1 6d778e0f95447e6546553eeea709d03c 811a005cf787c6ccbe0d9f1c36c1d49a9cb71fd1 389120