| HansWurst2k8 | 26.05.2009 14:13 |
Wurden meine Passwörter geklaut ? imrec.exe
Hallo,
hab mir gestern dummerweise was auf einem ungeschütztem rechner eingefangen und hab nun die befürchtung das meine passwörter aus firefox geklaut wurden sind. (die hab ich natürlich sofort alle geändert) tät mich aber trotzdem interessieren ob das wirklich so einfach ist die auszulesen.
daher habe ich die sache auf nem testsystem ohne wichtige daten nochmal nachgestellt. und filemon und wireshark mitlaufen lassen.
im filemon log (siehe unnten) sieht man auf jedenfall das die datei imrec.exe aufs firefoxprofil zugegriffen hat tät mich jetzt nur interessieren ob da auch wirklich was entschlüsselt werden konnte von den passwörtern.
dannach hat eine mail.exe aufs internet zugegriffen.
im wireshark mittschnitt konnte ich aber nichts weiter finden da die verbindung wahrscheinlich verschlüsselt war.
aber ich bin da halt auch nicht so der pro deshalb hier die frage an die profis ob diese beiden programme bekannt sind und wirklich schaden anrichten können (hab über die such leider nix gefunden) Code:
1805 00:06:22 ~ZY5.tmp:592 QUERY INFORMATION C:\WINDOWS\System32\imrec.exe NOT FOUND Attributes: Error
1846 00:06:22 ~ZY5.tmp:592 QUERY INFORMATION C:\WINDOWS\system32\imrec.exe SUCCESS Length: 64000
1847 00:06:22 ~ZY5.tmp:592 QUERY INFORMATION C:\WINDOWS\system32\imrec.exe SUCCESS Attributes: A
6188 00:06:33 cmd.exe:1980 QUERY INFORMATION C:\WINDOWS\System32\imrec.exe SUCCESS Attributes: A
6193 00:06:33 cmd.exe:1980 QUERY INFORMATION C:\WINDOWS\System32\imrec.exe SUCCESS Length: 64000
6194 00:06:33 cmd.exe:1980 QUERY INFORMATION C:\WINDOWS\System32\imrec.exe SUCCESS Attributes: A
6197 00:06:33 cmd.exe:1980 QUERY INFORMATION C:\WINDOWS\System32\imrec.exe SUCCESS Length: 64000
6206 00:06:33 csrss.exe:472 QUERY INFORMATION C:\WINDOWS\System32\imrec.exe SUCCESS Attributes: A
6217 00:06:33 csrss.exe:472 QUERY INFORMATION C:\WINDOWS\System32\imrec.exe SUCCESS Attributes: A
6218 00:06:33 csrss.exe:472 QUERY INFORMATION C:\WINDOWS\System32\imrec.exe SUCCESS Length: 64000
6332 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\imrec.exe.Local\ NOT FOUND Attributes: Error
6333 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.100.0_x-ww_8417450B SUCCESS Attributes: D
6336 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.100.0_x-ww_8417450B\COMCTL32.dll SUCCESS Length: 928768
6337 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.100.0_x-ww_8417450B\COMCTL32.dll SUCCESS Attributes: A
6341 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\progra~1\agnitum\outpos~1\wl_hook.dll SUCCESS Attributes: A
6343 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\progra~1\agnitum\outpos~1\wl_hook.dll SUCCESS Length: 720200
6344 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\progra~1\agnitum\outpos~1\wl_hook.dll SUCCESS Attributes: A
6347 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\progra~1\agnitum\outpos~1\wl_hook.dll SUCCESS Length: 720200
6349 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\progra~1\agnitum\outpos~1\wl_hook.dll SUCCESS Attributes: A
6351 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\progra~1\agnitum\outpos~1\wl_hook.dll SUCCESS Length: 720200
6352 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\progra~1\agnitum\outpos~1\wl_hook.dll SUCCESS Attributes: A
6358 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\progra~1\agnitum\outpos~1\machine.ini SUCCESS Length: 34553
6359 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\progra~1\agnitum\outpos~1\machine.ini SUCCESS Length: 34553
6361 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\progra~1\agnitum\outpos~1 SUCCESS Attributes: D
6371 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\WindowsShell.Manifest SUCCESS Attributes: RHA
6373 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\WindowsShell.Manifest SUCCESS Length: 749
6374 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\WindowsShell.Manifest SUCCESS Attributes: RHA
6377 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\WindowsShell.Manifest SUCCESS Length: 749
6379 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\WindowsShell.Manifest SUCCESS Attributes: RHA
6381 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\WindowsShell.Manifest SUCCESS Length: 749
6384 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\WindowsShell.Manifest SUCCESS Length: 749
6385 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\WindowsShell.Manifest SUCCESS Length: 749
6432 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\SHELL32.dll SUCCESS Length: 8207360
6433 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\SHELL32.dll SUCCESS Attributes: A
6436 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\SHELL32.dll SUCCESS Length: 8207360
6480 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\imrec.exe.Local\ NOT FOUND Attributes: Error
6481 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.100.0_x-ww_8417450B SUCCESS Attributes: D
6485 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\imrec_lng.ini NOT FOUND Attributes: Error
6488 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\trillian NOT FOUND Attributes: Error
6489 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten SUCCESS Attributes: DRH
6490 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Profiles NOT FOUND Attributes: Error
6491 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\.gaim NOT FOUND Attributes: Error
6492 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\.purple NOT FOUND Attributes: Error
6493 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Miranda NOT FOUND Attributes: Error
6515 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten SUCCESS Attributes: DH
6531 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\Secur32.dll SUCCESS Attributes: A
6533 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\Secur32.dll SUCCESS Length: 64512
6534 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\Secur32.dll SUCCESS Attributes: A
6538 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\MySpace\IM\users.txt PATH NOT FOUND Attributes: Error
6539 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Digsby\digsby.dat PATH NOT FOUND Attributes: Error
6546 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\history.dat NOT FOUND Attributes: Error
6547 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\places.sqlite SUCCESS Attributes: A
6549 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\places.sqlite SUCCESS Attributes: A
6551 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nss3.dll SUCCESS Attributes: A
6554 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nss3.dll SUCCESS Attributes: A
6556 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nss3.dll SUCCESS Length: 718328
6557 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nss3.dll SUCCESS Attributes: A
6560 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nss3.dll SUCCESS Length: 718328
6563 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nss3.dll SUCCESS Attributes: A
6565 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nss3.dll SUCCESS Length: 718328
6566 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nss3.dll SUCCESS Attributes: A
6570 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nssutil3.dll SUCCESS Attributes: A
6572 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nssutil3.dll SUCCESS Length: 87544
6573 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nssutil3.dll SUCCESS Attributes: A
6577 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\plc4.dll SUCCESS Attributes: A
6579 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\plc4.dll SUCCESS Length: 20472
6580 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\plc4.dll SUCCESS Attributes: A
6584 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nspr4.dll SUCCESS Attributes: A
6586 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nspr4.dll SUCCESS Length: 198136
6587 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nspr4.dll SUCCESS Attributes: A
6591 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\WSOCK32.dll NOT FOUND Attributes: Error
6592 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\WSOCK32.dll SUCCESS Attributes: A
6594 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\WSOCK32.dll SUCCESS Length: 24576
6595 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\WSOCK32.dll SUCCESS Attributes: A
6599 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\WS2_32.dll NOT FOUND Attributes: Error
6600 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\WS2_32.dll SUCCESS Attributes: A
6602 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\WS2_32.dll SUCCESS Length: 89600
6603 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\WS2_32.dll SUCCESS Attributes: A
6607 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\WS2HELP.dll NOT FOUND Attributes: Error
6608 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\WS2HELP.dll SUCCESS Attributes: A
6610 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\WS2HELP.dll SUCCESS Length: 19968
6611 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\WS2HELP.dll SUCCESS Attributes: A
6615 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\WINMM.dll NOT FOUND Attributes: Error
6616 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\WINMM.dll SUCCESS Attributes: A
6618 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\WINMM.dll SUCCESS Length: 172032
6619 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\WINMM.dll SUCCESS Attributes: A
6623 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\MOZCRT19.dll SUCCESS Attributes: A
6625 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\MOZCRT19.dll SUCCESS Length: 710136
6626 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\MOZCRT19.dll SUCCESS Attributes: A
6630 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\plds4.dll SUCCESS Attributes: A
6632 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\plds4.dll SUCCESS Length: 17400
6633 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\plds4.dll SUCCESS Attributes: A
6637 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\softokn3.dll SUCCESS Attributes: A
6639 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\softokn3.dll SUCCESS Length: 151552
6640 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\softokn3.dll SUCCESS Attributes: A
6643 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\softokn3.dll SUCCESS Length: 151552
6645 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\softokn3.dll SUCCESS Attributes: A
6647 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\softokn3.dll SUCCESS Length: 151552
6648 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\softokn3.dll SUCCESS Attributes: A
6652 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\sqlite3.dll NOT FOUND Attributes: Error
6653 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\sqlite3.dll NOT FOUND Attributes: Error
6654 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system\sqlite3.dll NOT FOUND Attributes: Error
6655 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\sqlite3.dll NOT FOUND Attributes: Error
6656 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\sqlite3.dll SUCCESS Attributes: A
6658 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\sqlite3.dll SUCCESS Length: 395768
6659 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\sqlite3.dll SUCCESS Attributes: A
6663 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nssdbm3.dll SUCCESS Attributes: A
6665 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nssdbm3.dll SUCCESS Length: 103928
6666 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nssdbm3.dll SUCCESS Attributes: A
6669 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nssdbm3.dll SUCCESS Length: 103928
6671 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nssdbm3.dll SUCCESS Attributes: A
6673 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nssdbm3.dll SUCCESS Length: 103928
6674 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\nssdbm3.dll SUCCESS Attributes: A
6683 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\secmod.db SUCCESS Length: 16384
6684 00:06:33 imrec.exe:1996 READ C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\secmod.db SUCCESS Offset: 4096 Length: 4096
6685 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\secmod.db SUCCESS Length: 16384
6686 00:06:33 imrec.exe:1996 READ C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\secmod.db SUCCESS Offset: 8192 Length: 4096
6688 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\freebl3.dll SUCCESS Attributes: A
6690 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\freebl3.dll SUCCESS Length: 233472
6691 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\freebl3.dll SUCCESS Attributes: A
6694 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\freebl3.dll SUCCESS Length: 233472
6696 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\freebl3.dll SUCCESS Attributes: A
6698 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\freebl3.dll SUCCESS Length: 233472
6699 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Programme\Mozilla Firefox\freebl3.dll SUCCESS Attributes: A
6792 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\$winnt$.inf END OF FILE Offset: 289 Length: 4096
6793 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\$winnt$.inf END OF FILE Offset: 289 Length: 4096
6832 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\12520437.cpx END OF FILE Offset: 2151 Length: 4096
6833 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\12520437.cpx END OF FILE Offset: 2151 Length: 4096
6840 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\12520850.cpx END OF FILE Offset: 2233 Length: 4096
6841 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\12520850.cpx END OF FILE Offset: 2233 Length: 4096
6859 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\6to4svc.dll SUCCESS Length: 64512
6860 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\6to4svc.dll SUCCESS Attributes: A
6869 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\aaaamon.dll SUCCESS Length: 29184
6870 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\aaaamon.dll SUCCESS Attributes: A
6883 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\ABCpdf6.dll SUCCESS Length: 10080200
6884 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\ABCpdf6.dll SUCCESS Attributes: A
6899 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\acctres.dll SUCCESS Length: 70144
6900 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\acctres.dll SUCCESS Attributes: A
6904 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\acctres.dll SUCCESS Offset: 4096 Length: 4096
6910 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\accwiz.exe SUCCESS Length: 186368
6911 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\accwiz.exe SUCCESS Attributes: A
6921 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\acelpdec.ax SUCCESS Offset: 4096 Length: 4096
6927 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\acledit.dll SUCCESS Length: 138240
6928 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\acledit.dll SUCCESS Attributes: A
6942 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\comp.exe SUCCESS Length: 16384
6943 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\comp.exe SUCCESS Attributes: A
6972 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\dfrg.msc END OF FILE Offset: 41397 Length: 4096
6973 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\dfrg.msc END OF FILE Offset: 41397 Length: 4096
6985 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\gpkrsrc.dll SUCCESS Length: 10752
6986 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\gpkrsrc.dll SUCCESS Attributes: A
7005 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\kbdpl1.dll SUCCESS Length: 6144
7006 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\kbdpl1.dll SUCCESS Attributes: RA
7021 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\mqtrig.dll SUCCESS Length: 134144
7022 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\mqtrig.dll SUCCESS Attributes: A
7045 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\netui2.dll SUCCESS Length: 321024
7046 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\netui2.dll SUCCESS Attributes: A
7061 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\prnjobs.vbs SUCCESS Length: 35916
7062 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\prnjobs.vbs SUCCESS Attributes: A
7067 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\prnjobs.vbs SUCCESS Offset: 4096 Length: 4096
7068 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\prnjobs.vbs SUCCESS Offset: 8192 Length: 4096
7069 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\prnjobs.vbs SUCCESS Offset: 12288 Length: 4096
7070 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\prnjobs.vbs SUCCESS Offset: 16384 Length: 4096
7071 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\prnjobs.vbs SUCCESS Offset: 20480 Length: 4096
7072 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\prnjobs.vbs SUCCESS Offset: 24576 Length: 4096
7073 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\prnjobs.vbs SUCCESS Offset: 28672 Length: 4096
7074 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\prnjobs.vbs SUCCESS Offset: 32768 Length: 1
7075 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\prnjobs.vbs SUCCESS Offset: 32768 Length: 4096
7076 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\prnjobs.vbs END OF FILE Offset: 35916 Length: 4096
7077 00:06:33 imrec.exe:1996 READ C:\WINDOWS\system32\prnjobs.vbs END OF FILE Offset: 35916 Length: 4096
7089 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\setupapi.dll SUCCESS Length: 1044992
7090 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\setupapi.dll SUCCESS Attributes: A
7105 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\ulib.dll SUCCESS Length: 310272
7106 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\ulib.dll SUCCESS Attributes: A
7122 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\wupdmgr.exe SUCCESS Length: 32256
7123 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\system32\wupdmgr.exe SUCCESS Attributes: A
7136 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\cert8.db SUCCESS Length: 65536
7137 00:06:33 imrec.exe:1996 READ C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\cert8.db SUCCESS Offset: 16384 Length: 16384
7143 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\key3.db SUCCESS Length: 16384
7144 00:06:33 imrec.exe:1996 READ C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\key3.db SUCCESS Offset: 4096 Length: 4096
7145 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\nssckbi.dll NOT FOUND Attributes: Error
7146 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\nssckbi.dll NOT FOUND Attributes: Error
7147 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\signons.txt NOT FOUND Attributes: Error
7148 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\signons2.txt NOT FOUND Attributes: Error
7149 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\signons3.txt SUCCESS Attributes: A
7151 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\signons3.txt SUCCESS Length: 265
7153 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\key3.db SUCCESS Length: 16384
7154 00:06:33 imrec.exe:1996 READ C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\key3.db SUCCESS Offset: 8192 Length: 4096
7161 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\rsaenh.dll SUCCESS Attributes: A
7163 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\rsaenh.dll SUCCESS Length: 181072
7164 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\rsaenh.dll SUCCESS Attributes: A
7167 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\rsaenh.dll SUCCESS Length: 181072
7168 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\rsaenh.dll SUCCESS Length: 181072
7170 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\rsaenh.dll SUCCESS Attributes: A
7172 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\rsaenh.dll SUCCESS Length: 181072
7173 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\rsaenh.dll SUCCESS Attributes: A
7177 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\PSAPI.DLL SUCCESS Attributes: A
7179 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\PSAPI.DLL SUCCESS Length: 22016
7180 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\PSAPI.DLL SUCCESS Attributes: A
7184 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\crypt32.dll SUCCESS Attributes: A
7186 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\crypt32.dll SUCCESS Length: 617472
7187 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\crypt32.dll SUCCESS Attributes: A
7190 00:06:33 imrec.exe:1996 QUERY INFORMATION C:\WINDOWS\System32\crypt32.dll SUCCESS Length: 617472
| 