3 2 252 s 07/10/12, 08:10:13 UTC Timeout 1.76.3886 $Revision: 3914 $ May 14 2012 20:16:24

true true false false false false false false false false false true true true true false false false false false false false false false false true false 6

2 1 Primary Analysis Subject 17e167a93858ac67451f5a57441acf5a.zeustracker 17e167a938.exe C:\17e167a938.exe "C:\17e167a938.exe" alive 0 17e167a93858ac67451f5a57441acf5a b2eed37ce1efc7229157c0190f29287b2a56401d 188416 3 2 Started by 17e167a938.exe ohwyf.exe C:\Documents and Settings\Administrator\Application Data\Otec\ohwyf.exe "C:\Documents and Settings\Administrator\Application Data\Otec\ohwyf.exe" alive 0 17e167a93858ac67451f5a57441acf5a b2eed37ce1efc7229157c0190f29287b2a56401d 188416 4 3 ohwyf.exe wrote to the virtual memory of this process Explorer.EXE C:\WINDOWS\Explorer.EXE C:\WINDOWS\Explorer.EXE alive 0 12896823fb95bfb3dc9b46bcaedc9923 9d2bf84874abc5b6e9a2744b7865c193c08d362f 1033728 5 3 ohwyf.exe wrote to the virtual memory of this process ctfmon.exe C:\WINDOWS\system32\ctfmon.exe "C:\WINDOWS\system32\ctfmon.exe" alive 0 5f1d5f88303d4a4dbc8e5f97ba967cc3 99cb7370f16773c8e2d0c86fe805ec638ab126e9 15360 6 3 ohwyf.exe wrote to the virtual memory of this process msmsgs.exe C:\Program Files\Messenger\msmsgs.exe "C:\Program Files\Messenger\msmsgs.exe" /background alive 0 3e930c641079443d4de036167a69caa2 ac40479e28fb680aff76e41fa14ebe18b3392629 1695232 7 3 ohwyf.exe wrote to the virtual memory of this process reader_sl.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe "C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe" alive 0 54c88bfbd055621e2306534f445c0c8d 960a171e826c077187fe634103874644327a6110 40048 8 3 ohwyf.exe wrote to the virtual memory of this process wscntfy.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wscntfy.exe alive 0 f92e1076c42fcd6db3d72d8cfe9816d5 549f0a01848375d03159fc74171ed97790fa9650 13824