Windows version: 6.1 build 7600 Agent started explorer.exe (64)(3540): Attach wsrp2012.exe (32)(13012): Attach streamtransport.

exe (32)(6052): Attach streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject etdctrl.exe (64)(2956): Attach iexplore.exe (32)(8540): Attach brmfcwnd.exe (32)(2420): Attach ufseagnt.exe (64)(4052): Attach chrome.exe (32)(7488): Attach dwm.exe (64)(2708): Attach streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject

1 2 1 2 1 2 1 2

BAD BAD BAD BAD BAD BAD BAD BAD

WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK

1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2

BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD

WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK

streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject werfault.exe (64)(12460): Attach streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject werfault.exe (64)(12460): Detach streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject streamtransport.exe (32)(6052): Inject

1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2

BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD

WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK

streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe pidgin-portable.exe pidgin-portable.exe pidgin-portable.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe

(32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(3040): (32)(3040): (32)(3040): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052):

Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Attach Inject Inject Inject Inject Inject Inject Inject

1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1

BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD

WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK

OK (version 0) OK (version 0) BAD WINSOCK BAD WINSOCK BAD WINSOCK BAD WINSOCK BAD WINSOCK

streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK adobearm.exe (32)(9832): Attach everything.exe (32)(11816): Attach streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK asuite.exe (32)(2164): Attach wcourier.exe (32)(2244): Attach streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK asuite.exe (32)(2164): Inject 1 - OK (version 0) asuite.exe (32)(2164): Inject 2 - OK (version 0) deskto~4.exe (32)(6720): Attach conhost.exe (64)(8260): Attach streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK

streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe

(32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052):

Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject

2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1

BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD

WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK

streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): streamtransport.exe (32)(6052): firefox.exe (32)(12504): Attach firefox.exe (32)(12504): Inject firefox.exe (32)(12504): Inject streamtransport.exe (32)(6052): streamtransport.exe (32)(6052):

Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject 1 - OK 2 - OK Inject Inject

2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2

BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD

WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK

(version 0) (version 0) 1 - BAD WINSOCK 2 - BAD WINSOCK

streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe streamtransport.exe

(32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052): (32)(6052):

Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject Inject

1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2

BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD

WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK WINSOCK

streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK firefox.exe (32)(12504): Detach streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK firefox.exe (32)(7688): Attach firefox.exe (32)(7688): Inject 1 - OK (version 0) firefox.exe (32)(7688): Inject 2 - OK (version 0) streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK batterylife.exe (64)(3196): Attach pidgin-portable.exe (32)(3040): Client initialized on port 50380 firefox.exe (32)(7688): Client initialized on port 64877 iexplore.exe (32)(8756): Attach acrord32.exe (32)(6356): Attach sapiens.exe (32)(4520): Attach thunderbird.exe (32)(12024): Attach plugin-container.exe (32)(9976): Attach plugin-container.exe (32)(9976): Inject 1 - OK (version 0) plugin-container.exe (32)(9976): Inject 2 - OK (version 0) flashplayerplugin_11_4_402_287.exe (32)(12332): Attach flashplayerplugin_11_4_402_287.exe (32)(12332): Inject 1 - OK (version 0) flashplayerplugin_11_4_402_287.exe (32)(12332): Inject 2 - OK (version 0) dllhost.exe (32)(11748): Attach dllhost.exe (32)(11748): Inject 1 - OK (version 0) dllhost.exe (32)(11748): Inject 2 - OK (version 0) alu.exe (32)(3852): Attach streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK

streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK iexplore.exe (32)(8540): Inject 1 - OK (version 0) iexplore.exe (32)(8540): Inject 2 - OK (version 0) chrome.exe (32)(7488): Inject 1 - OK (version 0) chrome.exe (32)(7488): Inject 2 - OK (version 0) chrome.exe (32)(7488): Client initialized on port 58876 streamtransport.exe (32)(6052): Inject 1 - BAD WINSOCK streamtransport.exe (32)(6052): Inject 2 - BAD WINSOCK explorer.exe (64)(3540): Detach wsrp2012.exe (32)(13012): Detach sapiens.exe (32)(4520): Detach etdctrl.exe (64)(2956): Detach wcourier.exe (32)(2244): Detach dwm.exe (64)(2708): Detach acrord32.exe (32)(6356): Detach plugin-container.exe (32)(9976): Detach wsrphook64.exe (64)(9600): Detach wsrphook.exe (32)(11248): Detach batterylife.exe (64)(3196): Detach alu.exe (32)(3852): Detach flashplayerplugin_11_4_402_287.exe (32)(12332): Detach