10:18 <+pozican_> WebSoftCodecDrivern.exe
10:18 <+pozican_> hxxp://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=HTML%5FDLOADER%2EFOG&VSect=Sn
10:18 <+pozican_> we foudn it at
10:18 <+pozican_> 77.91.227.179:/soft/WebSoftCodecDrivern.exe
10:18 <+pozican_> it was a redirect from an IFRAME
10:18 <+pozican_> that took them to 77.91.227.179