Susp_Dropper (Kaspersky), Gen:Variant.Symmi.50408 (B) (Emsisoft), Gen:Variant.Symmi.50408 (AdAware), Trojan-Banker.Win32.Brasil.FD, Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, SearchProtectToolbar_pcap.YR, SearchProtectToolbar.YR, GenericAutorunWorm.YR, PUPSpigot.YR (Lavasoft MAS)Behaviour: Banker, Trojan, Worm, PUP, VirTool, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 7919fbff8269158e3157a6a228d9160a
SHA1: dec72c3761e83a68e31a78255f30b2551467c011
SHA256: ddc27c89b4596c11bf0bf73c4852e764ff158a6744ce96cc5226d06d4161960f
SSDeep: 49152:wnsHyjtk2MYC5GDbwciBZujikrBehTFEiYAt7/6R7a4vsOtbw1x8jnp4rlmom:wnsmtk2a3ciBEjiDhqVC7Y7a4vNmx4ok
Size: 3008512 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphi30, BorlandDelphiv30, UPolyXv05_v6
Company: Heaventools Software
Created at: 1992-06-20 01:22:17
Analyzed on: Windows7 SP1 32-bit
Summary: Banker. Steals data relating to online banking systems, e-payment systems and credit card systems.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Trojan creates the following process(es):
%original file name%.exe:3380
The Trojan injects its code into the following process(es):
Synaptics.exe:3580
._cache_%original file name%.exe:3500
mshta.exe:532
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:3380 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Windows\System32\config\SOFTWARE (33519 bytes)
C:\ (4 bytes)
C:\ProgramData\Synaptics\Synaptics.exe (22336 bytes)
C:\ProgramData\Synaptics\RCX1C46.tmp (136247 bytes)
C:\$Directory (96 bytes)
C:\Windows\System32\config\SOFTWARE.LOG1 (28671 bytes)
The process Synaptics.exe:3580 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RCX208B.tmp (137517 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (325 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (876 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ZQHHpXOv.ico (284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RCX205B.tmp (137517 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ZQHHpXOv.exe (5441 bytes)
C:\Users\"%CurrentUserName%"\Downloads\dotNetFx35setup.exe (25426 bytes)
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ZQHHpXOv.ico (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ZQHHpXOv.exe (0 bytes)
The process ._cache_%original file name%.exe:3500 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\yandex_horz_ru.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\index.hta.log (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\styles\installer.css (587 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\scripts\uninstall.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\utt1D01.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\index.hta (739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\main_bittorrent.ico (103 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\yandex_browser_setup.bmp (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\i18n\de.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\3rdparty\FS.ocx (998 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\main_utorrent.ico (107 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\main_icon.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\settings.dat.new (73 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\i18n\es.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\shell_scripts\check_if_cscript_is_working.js (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-732923889-1296844034-1208581001-1000\1f91d2d17ea675d4c2c3192e241743f9_88dcd395-b062-45b3-a6cd-79f37c0eba08 (105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\3rdparty\FS.dll (933 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\install.1486041259.zip (283430 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\scripts\common.js (349 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\i18n\fr.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\scripts\install.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\i18n\pt.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\logo_Yandex_RU_UA_vertical.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\shell_scripts\shell_ping_after_close.js (312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\styles\common.css (102 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\i18n\en.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\scripts\initialize.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\shell_scripts\shell_install_offer.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\i18n\br.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\uninstall.hta (575 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\scripts\es5-shim.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\VDR2FU3X.txt (89 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\i18n\ru.json (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\FCA1BGFM.txt (89 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\search_protect.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\i18n\it.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\yandex_horz.png (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\bt_icon_48px.png (3 bytes)
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\FCA1BGFM.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\utt1D01.tmp (0 bytes)
The process mshta.exe:532 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\index.hta.log (33 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\json[1].js (321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\main_utorrent.ico (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\3rdparty\FS.dll (933 bytes)
Registry activity
The process %original file name%.exe:3380 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synaptics Pointing Device Driver" = "C:\ProgramData\Synaptics\Synaptics.exe"
The Trojan deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
The process Synaptics.exe:3580 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\Synaptics_RASMANCS]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"
[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"
[HKLM\SOFTWARE\Microsoft\Tracing\Synaptics_RASMANCS]
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD]
"Blob" = "0F 00 00 00 01 00 00 00 20 00 00 00 52 29 BA 15"
[HKLM\SOFTWARE\Microsoft\Tracing\Synaptics_RASAPI32]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\Synaptics_RASMANCS]
"ConsoleTracingMask" = "4294901760"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Tracing\Synaptics_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"FileTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\Synaptics_RASMANCS]
"EnableConsoleTracing" = "0"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"D69B561148F01C77C54578C10926DF5B856976AD"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
The process ._cache_%original file name%.exe:3500 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCR\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}]
"(Default)" = "ActiveBinderX Control"
[HKCR\Interface\{8ACDC97A-ED69-44A0-9FA7-214AB3450F2D}\TypeLib]
"Version" = "1.0"
[HKCU\Software\Classes\FalconBetaAccount]
"remote_access_client_id" = "3223060844"
[HKCU\Software\BitTorrent\uTorrent]
"OfferProvider" = ""
[HKCR\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\Verb]
"(Default)" = ""
[HKCR\TypeLib\{C86D85A1-58F7-4E88-993F-F6435AAAAE5F}\1.0]
"(Default)" = "ActiveBinderProj Library"
[HKCR\Interface\{8ACDC97A-ED69-44A0-9FA7-214AB3450F2D}]
"(Default)" = "FS"
[HKCR\Interface\{C936EC34-11FC-4F15-81C3-8AA143BA8E4B}\TypeLib]
"(Default)" = "{C86D85A1-58F7-4E88-993F-F6435AAAAE5F}"
[HKCR\FS.ActiveBinderX]
"(Default)" = "ActiveBinderX Control"
[HKCR\TypeLib\{C86D85A1-58F7-4E88-993F-F6435AAAAE5F}\1.0\0\win32]
"(Default)" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\3rdparty\FS.ocx"
[HKCR\Interface\{C936EC34-11FC-4F15-81C3-8AA143BA8E4B}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"
[HKCR\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\ToolboxBitmap32]
"(Default)" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\3rdparty\FS.ocx,1"
[HKCR\Interface\{8ACDC97A-ED69-44A0-9FA7-214AB3450F2D}\TypeLib]
"(Default)" = "{C86D85A1-58F7-4E88-993F-F6435AAAAE5F}"
[HKCU\Software\BitTorrent\uTorrent]
"OfferViaCAU" = "0"
[HKCR\Interface\{C936EC34-11FC-4F15-81C3-8AA143BA8E4B}]
"(Default)" = "IActiveBinderXEvents"
[HKCR\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\Version]
"(Default)" = "1.0"
[HKCR\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCR\FS.ActiveBinderX\Clsid]
"(Default)" = "{4E120188-0CAC-468C-B2D9-9D1F079EBC25}"
[HKCR\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\ProgID]
"(Default)" = "FS.ActiveBinderX"
[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"
[HKCR\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\Control]
"(Default)" = ""
[HKCR\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\MiscStatus]
"(Default)" = "0"
[HKCR\Interface\{C936EC34-11FC-4F15-81C3-8AA143BA8E4B}\TypeLib]
"Version" = "1.0"
[HKCR\Interface\{8ACDC97A-ED69-44A0-9FA7-214AB3450F2D}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{C936EC34-11FC-4F15-81C3-8AA143BA8E4B}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"
[HKCR\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\Verb\0]
"(Default)" = "Properties,0,2"
[HKCR\Interface\{8ACDC97A-ED69-44A0-9FA7-214AB3450F2D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\TypeLib\{C86D85A1-58F7-4E88-993F-F6435AAAAE5F}\1.0\FLAGS]
"(Default)" = "2"
[HKCR\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\TypeLib]
"(Default)" = "{C86D85A1-58F7-4E88-993F-F6435AAAAE5F}"
[HKCR\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\MiscStatus\1]
"(Default)" = "205201"
[HKCU\Software\BitTorrent\uTorrent]
"OfferName" = ""
[HKCR\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\InprocServer32]
"(Default)" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\3rdparty\FS.ocx"
[HKCU\Software\BitTorrent\uTorrent]
"OfferAccepted" = "0"
[HKCR\TypeLib\{C86D85A1-58F7-4E88-993F-F6435AAAAE5F}\1.0\HELPDIR]
"(Default)" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\3rdparty\"
The process mshta.exe:532 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASMANCS]
"EnableFileTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1299588363"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASMANCS]
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASAPI32]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASMANCS]
"MaxFileSize" = "1048576"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASAPI32]
"EnableConsoleTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASMANCS]
"EnableConsoleTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASAPI32]
"EnableFileTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASMANCS]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASAPI32]
"FileTracingMask" = "4294901760"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3D 00 00 00 09 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASMANCS]
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "mshta.exe"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASAPI32]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
Dropped PE files
MD5 | File path |
---|---|
74d7333e2e4a4b53310253e9bb375146 | c:\ProgramData\Synaptics\Synaptics.exe |
74d7333e2e4a4b53310253e9bb375146 | c:\Users\All Users\Synaptics\Synaptics.exe |
eaba486ca44ce139b1a6c2520fe61837 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\3rdparty\FS.dll |
eed49c88dba5f2aa10cbd3acf66d899d | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\3rdparty\FS.ocx |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:3380
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Windows\System32\config\SOFTWARE (33519 bytes)
C:\ProgramData\Synaptics\Synaptics.exe (22336 bytes)
C:\ProgramData\Synaptics\RCX1C46.tmp (136247 bytes)
C:\$Directory (96 bytes)
C:\Windows\System32\config\SOFTWARE.LOG1 (28671 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RCX208B.tmp (137517 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (325 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (876 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ZQHHpXOv.ico (284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RCX205B.tmp (137517 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ZQHHpXOv.exe (5441 bytes)
C:\Users\"%CurrentUserName%"\Downloads\dotNetFx35setup.exe (25426 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\yandex_horz_ru.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\index.hta.log (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\styles\installer.css (587 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\scripts\uninstall.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\utt1D01.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\index.hta (739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\main_bittorrent.ico (103 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\yandex_browser_setup.bmp (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\i18n\de.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\3rdparty\FS.ocx (998 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\main_utorrent.ico (107 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\main_icon.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\settings.dat.new (73 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\i18n\es.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\shell_scripts\check_if_cscript_is_working.js (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-732923889-1296844034-1208581001-1000\1f91d2d17ea675d4c2c3192e241743f9_88dcd395-b062-45b3-a6cd-79f37c0eba08 (105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\3rdparty\FS.dll (933 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\install.1486041259.zip (283430 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\scripts\common.js (349 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\i18n\fr.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\scripts\install.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\i18n\pt.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\logo_Yandex_RU_UA_vertical.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\shell_scripts\shell_ping_after_close.js (312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\styles\common.css (102 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\i18n\en.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\scripts\initialize.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\shell_scripts\shell_install_offer.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\i18n\br.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\uninstall.hta (575 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\scripts\es5-shim.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\VDR2FU3X.txt (89 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\i18n\ru.json (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\FCA1BGFM.txt (89 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\search_protect.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\i18n\it.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\yandex_horz.png (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD1F34.tmp.1486041259\HTA\images\bt_icon_48px.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\json[1].js (321 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synaptics Pointing Device Driver" = "C:\ProgramData\Synaptics\Synaptics.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: Synaptics
Product Name: Synaptics Pointing Device Driver
Product Version: 1.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.4
File Description: Synaptics Pointing Device Driver
Comments:
Language: Language Neutral
Company Name: SynapticsProduct Name: Synaptics Pointing Device DriverProduct Version: 1.0.0.0Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.4 File Description: Synaptics Pointing Device DriverComments: Language: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
CODE | 4096 | 629740 | 629760 | 4.55603 | 33fbe30e8a64654287edd1bf05ae7c8c |
DATA | 634880 | 11860 | 12288 | 3.36497 | 1f5e19e7d20c1d128443d738ac7bc610 |
BSS | 647168 | 4581 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.idata | 655360 | 10818 | 11264 | 3.40982 | 21ff53180b390dc06e3a1adf0e57a073 |
.tls | 667648 | 16 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rdata | 671744 | 57 | 512 | 0.543857 | a92cf494c617731a527994013429ad97 |
.reloc | 675840 | 43392 | 43520 | 4.62615 | dcd1b1c3f3d28d444920211170d1e8e6 |
.rsrc | 720896 | 2310128 | 2310144 | 5.51937 | 18680aad8fae0c599f9566401f83f8ef |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?i=50 | |
hxxp://download-new.utorrent.com/endpoint/hydra-ut/os/win7/track/stable/browser/ie/os-region/US/os-lang/en/os-ver/6.1/enc-ver/110340173/ | |
hxxp://ip-api.com/json?callback=jQuery19105463438035372657_1486041261457&_=1486041261458 | 81.4.121.206 |
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?i=50&e=eyJldmVudE5hbWUiOiJoeWRyYTEiLCJhY3Rpb24iOiJvZmZlciIsInBpZCI6IjM1MDAiLCJoIjoiWHlMLUY1WGM3XzZWcTRyYyIsInYiOiIxMTAzNDAxNzMiLCJiIjo0MzA4NSwiY2wiOiJ1VG9ycmVudCIsImxuZyI6InJ1Iiwib3NhIjoiMzIiLCJzbG5nIjoiZW4iLCJkYiI6IldpbmRvd3MgSW50ZXJuZXQgRXhwbG9yZXIiLCJkYnYiOiI5LjAiLCJpYnIiOlt7Im5hbWUiOiJGaXJlZm94IiwidmVyc2lvbiI6IjQ5LjAiLCJleGVOYW1lIjoiZmlyZWZveCJ9LHsibmFtZSI6Ikdvb2dsZSBDaHJvbWUiLCJ2ZXJzaW9uIjoiNTQuMCIsImV4ZU5hbWUiOiJjaHJvbWUifSx7Im5hbWUiOiJXaW5kb3dzIEludGVybmV0IEV4cGxvcmVyIiwidmVyc2lvbiI6IjkuMCIsImV4ZU5hbWUiOiJpZXhwbG9yZSJ9XSwib2ZmZXJ0eXBlIjoicHJpbWFyeSIsInByb3ZpZGVyIjoiSXJvblNyYyIsImhvd21hbnkiOjEsIm9mZmVyc2hvd24iOjAsInN0YXR1cyI6ImZhaWxfdG9fbG9hZF9ETEwiLCJpcm9uc3JjX29mZmVyX3ZlcnNpb24iOiIxLjAifQ== | |
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?i=50&e=eyJldmVudE5hbWUiOiJoeWRyYTEiLCJhY3Rpb24iOiJodGFiZWdpbiIsInBpZCI6IjM1MDAiLCJoIjoiWHlMLUY1WGM3XzZWcTRyYyIsInYiOiIxMTAzNDAxNzMiLCJiIjo0MzA4NSwiY2wiOiJ1VG9ycmVudCIsImxuZyI6InJ1Iiwib3NhIjoiMzIiLCJzbG5nIjoiZW4iLCJkYiI6IldpbmRvd3MgSW50ZXJuZXQgRXhwbG9yZXIiLCJkYnYiOiI5LjAiLCJpYnIiOlt7Im5hbWUiOiJGaXJlZm94IiwidmVyc2lvbiI6IjQ5LjAiLCJleGVOYW1lIjoiZmlyZWZveCJ9LHsibmFtZSI6Ikdvb2dsZSBDaHJvbWUiLCJ2ZXJzaW9uIjoiNTQuMCIsImV4ZU5hbWUiOiJjaHJvbWUifSx7Im5hbWUiOiJXaW5kb3dzIEludGVybmV0IEV4cGxvcmVyIiwidmVyc2lvbiI6IjkuMCIsImV4ZU5hbWUiOiJpZXhwbG9yZSJ9XSwiaXAiOiIxOTQuMjQyLjk2LjIxOCIsImNuIjoiVWtyYWluZSIsInBhY2tpZCI6InJ1X3lhbmRleF9pcyJ9 | |
hxxp://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 | 50.23.197.94 |
hxxp://i-50.b-000.xyz.bench.utorrent.com/e?i=50&e=eyJldmVudE5hbWUiOiJoeWRyYTEiLCJhY3Rpb24iOiJvZmZlciIsInBpZCI6IjM1MDAiLCJoIjoiWHlMLUY1WGM3XzZWcTRyYyIsInYiOiIxMTAzNDAxNzMiLCJiIjo0MzA4NSwiY2wiOiJ1VG9ycmVudCIsImxuZyI6InJ1Iiwib3NhIjoiMzIiLCJzbG5nIjoiZW4iLCJkYiI6IldpbmRvd3MgSW50ZXJuZXQgRXhwbG9yZXIiLCJkYnYiOiI5LjAiLCJpYnIiOlt7Im5hbWUiOiJGaXJlZm94IiwidmVyc2lvbiI6IjQ5LjAiLCJleGVOYW1lIjoiZmlyZWZveCJ9LHsibmFtZSI6Ikdvb2dsZSBDaHJvbWUiLCJ2ZXJzaW9uIjoiNTQuMCIsImV4ZU5hbWUiOiJjaHJvbWUifSx7Im5hbWUiOiJXaW5kb3dzIEludGVybmV0IEV4cGxvcmVyIiwidmVyc2lvbiI6IjkuMCIsImV4ZU5hbWUiOiJpZXhwbG9yZSJ9XSwib2ZmZXJ0eXBlIjoicHJpbWFyeSIsInByb3ZpZGVyIjoiSXJvblNyYyIsImhvd21hbnkiOjEsIm9mZmVyc2hvd24iOjAsInN0YXR1cyI6ImZhaWxfdG9fbG9hZF9ETEwiLCJpcm9uc3JjX29mZmVyX3ZlcnNpb24iOiIxLjAifQ== | 23.21.92.252 |
hxxp://download-lb.utorrent.com/endpoint/hydra-ut/os/win7/track/stable/browser/ie/os-region/US/os-lang/en/os-ver/6.1/enc-ver/110340173/ | 67.215.238.66 |
hxxp://i-50.b-000.xyz.bench.utorrent.com/e?i=50&e=eyJldmVudE5hbWUiOiJoeWRyYTEiLCJhY3Rpb24iOiJodGFiZWdpbiIsInBpZCI6IjM1MDAiLCJoIjoiWHlMLUY1WGM3XzZWcTRyYyIsInYiOiIxMTAzNDAxNzMiLCJiIjo0MzA4NSwiY2wiOiJ1VG9ycmVudCIsImxuZyI6InJ1Iiwib3NhIjoiMzIiLCJzbG5nIjoiZW4iLCJkYiI6IldpbmRvd3MgSW50ZXJuZXQgRXhwbG9yZXIiLCJkYnYiOiI5LjAiLCJpYnIiOlt7Im5hbWUiOiJGaXJlZm94IiwidmVyc2lvbiI6IjQ5LjAiLCJleGVOYW1lIjoiZmlyZWZveCJ9LHsibmFtZSI6Ikdvb2dsZSBDaHJvbWUiLCJ2ZXJzaW9uIjoiNTQuMCIsImV4ZU5hbWUiOiJjaHJvbWUifSx7Im5hbWUiOiJXaW5kb3dzIEludGVybmV0IEV4cGxvcmVyIiwidmVyc2lvbiI6IjkuMCIsImV4ZU5hbWUiOiJpZXhwbG9yZSJ9XSwiaXAiOiIxOTQuMjQyLjk2LjIxOCIsImNuIjoiVWtyYWluZSIsInBhY2tpZCI6InJ1X3lhbmRleF9pcyJ9 | 23.21.92.252 |
hxxp://i-50.b-000.xyz.bench.utorrent.com/e?i=50 | 23.21.92.252 |
router.utorrent.com | 82.221.103.244 |
docs.google.com | 216.58.209.206 |
xred.mooo.com | 151.250.208.116 |
router.bittorrent.com | 67.215.246.10 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /e?i=50&e=eyJldmVudE5hbWUiOiJoeWRyYTEiLCJhY3Rpb24iOiJodGFiZWdpbiIsInBpZCI6IjM1MDAiLCJoIjoiWHlMLUY1WGM3XzZWcTRyYyIsInYiOiIxMTAzNDAxNzMiLCJiIjo0MzA4NSwiY2wiOiJ1VG9ycmVudCIsImxuZyI6InJ1Iiwib3NhIjoiMzIiLCJzbG5nIjoiZW4iLCJkYiI6IldpbmRvd3MgSW50ZXJuZXQgRXhwbG9yZXIiLCJkYnYiOiI5LjAiLCJpYnIiOlt7Im5hbWUiOiJGaXJlZm94IiwidmVyc2lvbiI6IjQ5LjAiLCJleGVOYW1lIjoiZmlyZWZveCJ9LHsibmFtZSI6Ikdvb2dsZSBDaHJvbWUiLCJ2ZXJzaW9uIjoiNTQuMCIsImV4ZU5hbWUiOiJjaHJvbWUifSx7Im5hbWUiOiJXaW5kb3dzIEludGVybmV0IEV4cGxvcmVyIiwidmVyc2lvbiI6IjkuMCIsImV4ZU5hbWUiOiJpZXhwbG9yZSJ9XSwiaXAiOiIxOTQuMjQyLjk2LjIxOCIsImNuIjoiVWtyYWluZSIsInBhY2tpZCI6InJ1X3lhbmRleF9pcyJ9 HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Host: i-50.b-000.xyz.bench.utorrent.com
HTTP/1.1 200 OK
Content-Type: text/html
Date: Thu, 02 Feb 2017 13:14:23 GMT
Server: nginx
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: keep-alive
{"response_code":200}..
POST /e?i=50 HTTP/1.1
Host: i-50.b-000.xyz.bench.utorrent.com
User-Agent: Hydra HttpRequest
Connection: close
Content-Length: 234
{"eventName":"hydra1","action":"begin","type":"i","cau":"0","pv":"","cc":"0","bkt1":"0","ssb":"0","v":"110340173","cl":"uTorrent","osv":"6.1","l":"en","pid":"3500","h":"XyL-F5Xc7_6Vq4rc","sid":"XyL-F5Xc7_6Vq4rc1486041259","order":"0"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Thu, 02 Feb 2017 13:14:11 GMT
Server: nginx
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..
POST /e?i=50 HTTP/1.1
Host: i-50.b-000.xyz.bench.utorrent.com
User-Agent: Hydra HttpRequest
Connection: close
Content-Length: 260
{"eventName":"hydra1","action":"packDownloadResult","type":"i","result":"1","cau":"0","pv":"","cc":"0","bkt1":"0","ssb":"2","v":"110340173","cl":"uTorrent","osv":"6.1","l":"en","pid":"3500","h":"XyL-F5Xc7_6Vq4rc","sid":"XyL-F5Xc7_6Vq4rc1486041259","order":"2"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Thu, 02 Feb 2017 13:14:21 GMT
Server: nginx
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..
GET /e?i=50&e=eyJldmVudE5hbWUiOiJoeWRyYTEiLCJhY3Rpb24iOiJvZmZlciIsInBpZCI6IjM1MDAiLCJoIjoiWHlMLUY1WGM3XzZWcTRyYyIsInYiOiIxMTAzNDAxNzMiLCJiIjo0MzA4NSwiY2wiOiJ1VG9ycmVudCIsImxuZyI6InJ1Iiwib3NhIjoiMzIiLCJzbG5nIjoiZW4iLCJkYiI6IldpbmRvd3MgSW50ZXJuZXQgRXhwbG9yZXIiLCJkYnYiOiI5LjAiLCJpYnIiOlt7Im5hbWUiOiJGaXJlZm94IiwidmVyc2lvbiI6IjQ5LjAiLCJleGVOYW1lIjoiZmlyZWZveCJ9LHsibmFtZSI6Ikdvb2dsZSBDaHJvbWUiLCJ2ZXJzaW9uIjoiNTQuMCIsImV4ZU5hbWUiOiJjaHJvbWUifSx7Im5hbWUiOiJXaW5kb3dzIEludGVybmV0IEV4cGxvcmVyIiwidmVyc2lvbiI6IjkuMCIsImV4ZU5hbWUiOiJpZXhwbG9yZSJ9XSwib2ZmZXJ0eXBlIjoicHJpbWFyeSIsInByb3ZpZGVyIjoiSXJvblNyYyIsImhvd21hbnkiOjEsIm9mZmVyc2hvd24iOjAsInN0YXR1cyI6ImZhaWxfdG9fbG9hZF9ETEwiLCJpcm9uc3JjX29mZmVyX3ZlcnNpb24iOiIxLjAifQ== HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Host: i-50.b-000.xyz.bench.utorrent.com
HTTP/1.1 200 OK
Content-Type: text/html
Date: Thu, 02 Feb 2017 13:14:23 GMT
Server: nginx
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: keep-alive
{"response_code":200}..
POST /e?i=50 HTTP/1.1
Host: i-50.b-000.xyz.bench.utorrent.com
User-Agent: Hydra HttpRequest
Connection: close
Content-Length: 269
{"eventName":"hydra1","action":"INFO","type":"i","res":"1276x846","cts":"1486041261","pv":"","cau":"0","cc":"0","bkt1":"0","ssb":"2","v":"110340173","cl":"uTorrent","osv":"6.1","l":"en","pid":"3500","h":"XyL-F5Xc7_6Vq4rc","sid":"XyL-F5Xc7_6Vq4rc1486041259","order":"3"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Thu, 02 Feb 2017 13:14:21 GMT
Server: nginx
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..
GET /endpoint/hydra-ut/os/win7/track/stable/browser/ie/os-region/US/os-lang/en/os-ver/6.1/enc-ver/110340173/ HTTP/1.1
Host: download-lb.utorrent.com
User-Agent: Hydra HttpRequest
Connection: close
Content-Length: 0
HTTP/1.1 200 OK
Server: nginx/1.6.1
Date: Thu, 02 Feb 2017 13:14:12 GMT
Content-Type: application/octet-stream
Content-Length: 2433470
Connection: close
X-bt-sig: ed74f62c2065e2de0a42a98efbb935249067560e409d7bfa76f6bb990fcc7fffba908611a1f3fdda4fabdd9714a33a90c104c4deb8893d7796ed33e0807ac0a120c584912a859d727b7d35cb98d70ac50d64c9eb39482c9d29e4eca2d3a4df8a32bf6020690e9839c9856371d5fac5b0f3fcdfa4ccf98a64fad340e639e61f56a525ce89d0c14c038ae4910c9659dce0bac6fa2de8d97a6b74f03a45c77e3f63cfe18b39caec457108c89968f8a2b9eb728cb1e33bb811fcd965aaec515d04fcece92af6937f9a41cc8bd04e16d7bd275ab8681b295b9d61e2a2632965b6c282f6ebe8d50dc2b9c92905b2563cb81323f69c1d67b845c07862e54709776ebd46
Last-Modified: Fri, 23 Dec 2016 02:15:40 0000
Accept-Ranges: none
Content-Disposition: attachment; filename="hta.zip"
X-bt-size: 2433470
Cache-Control: private
X-rl-mx: true
Rule-UUID: de7f6050-4f7c-45cf-a888-37b23152e2e9
Content-MD5: 42b82dd2a060a92920f1f05ca770a33e
Expires: Tue, 01 Jan 1980 00:00:00 0000
X-bt-hash: 82fd8cfe4bfe89745cae17cfef11c43e83a581ec
PK........qO.I..c.............index.hta<html>..<head>. <title>Loading...</title>. <meta charset="utf-8">. <meta http-equiv="X-UA-Compatible" content="IE=9">. <meta http-equiv="MSThemeCompatible" content="yes">.. <script src="scripts/initialize.js"></script>.. <link rel="stylesheet" href="styles/common.css"/>.. <!--[if lte IE 8]>. <script src="scripts/es5-shim.js"></script>. <![endif]-->..</head>..<style>. * {. overflow: hidden;. margin: 0px;. padding: 0px;. z-index: 0;. }.</style>..<body class="installer_body">. <!-- this is the loading img while loading offer page -->. <div id='loading_img'></div>.</body>..<script src="scripts/common.js"></script>..<script src="scripts/install.js"></script>..</html>.PK........qO.Iw[Yy?...?.......uninstall.hta<html>..<head>. <title>Loading...</title>. <meta charset="utf-8">. <meta http-equiv="X-UA-Compatible" content="IE=9">. <meta http-equiv="MSThemeCompatible" content="yes">.. <script src="scripts/initialize.js"></script>.. <link rel="stylesheet" href="styles/common.css"/>... <!--[if lte IE 8]>. <script language="javascript" type="text/javascript" src='scripts/es5-shim.js'></script>. <![endif]-->..</head>..<body class="installer
<<< skipped >>>
GET /json?callback=jQuery19105463438035372657_1486041261457&_=1486041261458 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: ip-api.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Type: text/javascript; charset=utf-8
Date: Thu, 02 Feb 2017 13:14:23 GMT
Content-Length: 321
jQuery19105463438035372657_1486041261457({"as":"AS31561 PITLINE-AS","city":"Kharkiv","country":"Ukraine","countryCode":"UA","isp":"Pitline Ltd","lat":49.9808,"lon":36.2527,"org":"Pitline Ltd","query":"194.242.96.218","region":"63","regionName":"Kharkivs'ka Oblast'","status":"success","timezone":"Europe/Kiev","zip":""});HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Content-Type: text/javascript; charset=utf-8..Date: Thu, 02 Feb 2017 13:14:23 GMT..Content-Length: 321..jQuery19105463438035372657_1486041261457({"as":"AS31561 PITLINE-AS","city":"Kharkiv","country":"Ukraine","countryCode":"UA","isp":"Pitline Ltd","lat":49.9808,"lon":36.2527,"org":"Pitline Ltd","query":"194.242.96.218","region":"63","regionName":"Kharkivs'ka Oblast'","status":"success","timezone":"Europe/Kiev","zip":""});..
GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1
User-Agent: MyApp
Host: freedns.afraid.org
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 02 Feb 2017 13:14:24 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Cache: MISS
77..xred.mooo.com|151.250.208.116|hXXp://freedns.afraid.org/dynamic/update.php?bUxTREVRbG1pZlBtWWg0V0lqWmVESm43OjEyOTUxNjgz..0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 02 Feb 2017 13:14:24 GMT..Content-Type: text/plain; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Cache: MISS..77..xred.mooo.com|151.250.208.116|hXXp://freedns.afraid.org/dynamic/update.php?bUxTREVRbG1pZlBtWWg0V0lqWmVESm43OjEyOTUxNjgz..0..
POST /e?i=50 HTTP/1.1
Host: i-50.b-000.xyz.bench.utorrent.com
User-Agent: Hydra HttpRequest
Connection: close
Content-Length: 248
{"eventName":"hydra1","action":"packDownloadStarted","type":"i","cau":"0","pv":"","cc":"0","bkt1":"0","ssb":"0","v":"110340173","cl":"uTorrent","osv":"6.1","l":"en","pid":"3500","h":"XyL-F5Xc7_6Vq4rc","sid":"XyL-F5Xc7_6Vq4rc1486041259","order":"1"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Thu, 02 Feb 2017 13:14:11 GMT
Server: nginx
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
Synaptics.exe_3580:
.idata
.idata
.rdata
.rdata
P.reloc
P.reloc
P.rsrc
P.rsrc
kernel32.dll
kernel32.dll
Windows
Windows
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
oleaut32.dll
EVariantBadIndexError
EVariantBadIndexError
ssShift
ssShift
htKeyword
htKeyword
EInvalidOperation
EInvalidOperation
u%CNu
u%CNu
%s[%d]
%s[%d]
%s_%d
%s_%d
EInvalidGraphicOperation
EInvalidGraphicOperation
USER32.DLL
USER32.DLL
comctl32.dll
comctl32.dll
uxtheme.dll
uxtheme.dll
MAPI32.DLL
MAPI32.DLL
Uh=%C
Uh=%C
ssHorizontal
ssHorizontal
OnKeyDowntgC
OnKeyDowntgC
OnKeyPress(gC
OnKeyPress(gC
OnKeyUpLfC
OnKeyUpLfC
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
JumpID("","%s")
TKeyEvent
TKeyEvent
TKeyPressEvent
TKeyPressEvent
HelpKeyword
HelpKeyword
crSQLWait
crSQLWait
%s (%s)
%s (%s)
imm32.dll
imm32.dll
AutoHotkeys
AutoHotkeys
AutoHotkeys
AutoHotkeys
ssHotTrack
ssHotTrack
TWindowState
TWindowState
poProportional
poProportional
TWMKey
TWMKey
KeyPreview
KeyPreview
WindowState
WindowState
tagMSG
tagMSG
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
vcltest3.dll
User32.dll
User32.dll
OnActionExecute
OnActionExecute
TOrtusShellFolder
TOrtusShellFolder
TOrtusShellSpecialFolder
TOrtusShellSpecialFolder
OrtusShellGlobal
OrtusShellGlobal
*TOrtusShellChangeNotifierAssocChangedEvent
*TOrtusShellChangeNotifierAssocChangedEvent
(TOrtusShellChangeNotifierAttributesEvent
(TOrtusShellChangeNotifierAttributesEvent
$TOrtusShellChangeNotifierCreateEvent
$TOrtusShellChangeNotifierCreateEvent
$TOrtusShellChangeNotifierDeleteEvent
$TOrtusShellChangeNotifierDeleteEvent
&TOrtusShellChangeNotifierDriveAddEvent
&TOrtusShellChangeNotifierDriveAddEvent
)TOrtusShellChangeNotifierDriveAddGUIEvent
)TOrtusShellChangeNotifierDriveAddGUIEvent
*TOrtusShellChangeNotifierDriveRemovedEvent
*TOrtusShellChangeNotifierDriveRemovedEvent
'TOrtusShellChangeNotifierFreeSpaceEvent
'TOrtusShellChangeNotifierFreeSpaceEvent
TOrtusShellChangeNotifierMediaInsertedEvent
TOrtusShellChangeNotifierMediaInsertedEvent
*TOrtusShellChangeNotifierMediaRemovedEvent
*TOrtusShellChangeNotifierMediaRemovedEvent
#TOrtusShellChangeNotifierMkDirEvent
#TOrtusShellChangeNotifierMkDirEvent
&TOrtusShellChangeNotifierNetShareEvent
&TOrtusShellChangeNotifierNetShareEvent
(TOrtusShellChangeNotifierNetUnshareEvent
(TOrtusShellChangeNotifierNetUnshareEvent
*TOrtusShellChangeNotifierRenameFolderEvent
*TOrtusShellChangeNotifierRenameFolderEvent
(TOrtusShellChangeNotifierRenameItemEvent
(TOrtusShellChangeNotifierRenameItemEvent
#TOrtusShellChangeNotifierRmDirEvent
#TOrtusShellChangeNotifierRmDirEvent
.TOrtusShellChangeNotifierServerDisconnectEvent
.TOrtusShellChangeNotifierServerDisconnectEvent
'TOrtusShellChangeNotifierUpdateDirEvent
'TOrtusShellChangeNotifierUpdateDirEvent
)TOrtusShellChangeNotifierUpdateImageEvent
)TOrtusShellChangeNotifierUpdateImageEvent
(TOrtusShellChangeNotifierUpdateItemEvent
(TOrtusShellChangeNotifierUpdateItemEvent
TOrtusShellChangeNotifierItem
TOrtusShellChangeNotifierItem
TCustomOrtusShellChangeNotifier
TCustomOrtusShellChangeNotifier
OrtusShellChangeNotifier
OrtusShellChangeNotifier
TOrtusShellChangeNotifierFolder
TOrtusShellChangeNotifierFolder
TOrtusShellChangeNotifierFolders
TOrtusShellChangeNotifierFolders
TOrtusShellChangeNotifier
TOrtusShellChangeNotifier
MsgId_OrtusShellChangeNotifier
MsgId_OrtusShellChangeNotifier
SHELL32.DLL
SHELL32.DLL
Unknown (Windows
Unknown (Windows
shell32.dll
shell32.dll
{374DE290-123F-4565-9164-39C4925E467B}
{374DE290-123F-4565-9164-39C4925E467B}
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
\StringFileInfo\%0.4x%0.4x\%s
\StringFileInfo\%0.4x%0.4x\%s
cmd.exe /C
cmd.exe /C
00-00-00-00-00-00
00-00-00-00-00-00
Uh.ZG
Uh.ZG
$000000.tmp
$000000.tmp
ole32.dll
ole32.dll
Excel.Application
Excel.Application
.xlsm
.xlsm
getservbyport
getservbyport
WSAAsyncGetServByPort
WSAAsyncGetServByPort
WSAJoinLeaf
WSAJoinLeaf
WS2_32.DLL
WS2_32.DLL
127.0.0.1
127.0.0.1
TIdSocketListWindows
TIdSocketListWindows
TIdStackWindowsU
TIdStackWindowsU
IdStackWindows
IdStackWindows
%s, %d %s %d %s %s
%s, %d %s %d %s %s
ftpTransfer
ftpTransfer
ftpReady
ftpReady
ftpAborted
ftpAborted
ClientPortMin
ClientPortMin
ClientPortMax
ClientPortMax
Port
Port
EIdCanNotBindPortInRange
EIdCanNotBindPortInRange
EIdInvalidPortRangeSVW
EIdInvalidPortRangeSVW
saUsernamePassword
saUsernamePassword
Password
Password
0.0.0.1
0.0.0.1
TIdTCPStream
TIdTCPStream
End of stream: %s at %d
End of stream: %s at %d
TIdTCPConnection
TIdTCPConnection
TIdTCPConnectiond!H
TIdTCPConnectiond!H
IdTCPConnection
IdTCPConnection
EIdTCPConnectionError
EIdTCPConnectionError
EIdObjectTypeNotSupported
EIdObjectTypeNotSupported
TIdTCPClient
TIdTCPClient
TIdTCPClient`CH
TIdTCPClient`CH
IdTCPClient
IdTCPClient
BoundPort
BoundPort
PortU
PortU
%s
%s
=?WINDOWS
=?WINDOWS
Indy 9.00.10
Indy 9.00.10
atLogin
atLogin
IdSMTP
IdSMTP
TIdSMTP
TIdSMTP
Password
Password
AUTH LOGIN
AUTH LOGIN
LOGIN
LOGIN
libeay32.dll
libeay32.dll
ssleay32.dll
ssleay32.dll
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_CTX_use_certificate_file
SSL_get_peer_certificate
SSL_get_peer_certificate
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_check_private_key
SSL_CTX_check_private_key
X509_STORE_CTX_get_current_cert
X509_STORE_CTX_get_current_cert
des_set_key
des_set_key
sslvrfFailIfNoPeerCert
sslvrfFailIfNoPeerCert
TPasswordEvent
TPasswordEvent
Certificate
Certificate
RootCertFile
RootCertFile
CertFile
CertFile
KeyFile
KeyFile
OnGetPassword
OnGetPassword
EIdOSSLLoadingRootCertError
EIdOSSLLoadingRootCertError
EIdOSSLLoadingCertErrorl'I
EIdOSSLLoadingCertErrorl'I
EIdOSSLLoadingKeyError
EIdOSSLLoadingKeyError
TRootKey
TRootKey
RootKey
RootKey
MonitoredKey
MonitoredKey
WatchSubKeys
WatchSubKeys
\libeay32.dll
\libeay32.dll
\ssleay32.dll
\ssleay32.dll
\SSLLibrary.ddl
\SSLLibrary.ddl
afraid.org/api
afraid.org/api
GetCMDAccess
GetCMDAccess
Synaptics.exe
Synaptics.exe
Synaptics.dll
Synaptics.dll
.xlsx
.xlsx
smtp.gmail.com
smtp.gmail.com
ShellExecute=
ShellExecute=
autorun.inf
autorun.inf
PORT
PORT
EXEURL1
EXEURL1
cachex.ini
cachex.ini
xred.mooo.com
xred.mooo.com
hXXp://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
hXXp://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
INIURL1
INIURL1
hXXps://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
hXXps://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
INIURL2
INIURL2
hXXps://VVV.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
hXXps://VVV.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
INIURL3
INIURL3
hXXp://xred.site50.net/syn/SUpdate.ini
hXXp://xred.site50.net/syn/SUpdate.ini
hXXps://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
hXXps://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
EXEURL2
EXEURL2
hXXps://VVV.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
hXXps://VVV.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
EXEURL3
EXEURL3
hXXp://xred.site50.net/syn/Synaptics.rar
hXXp://xred.site50.net/syn/Synaptics.rar
SSLURL1
SSLURL1
hXXps://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
hXXps://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
SSLURL2
SSLURL2
hXXps://VVV.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
hXXps://VVV.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
SSLURL3
SSLURL3
hXXp://xred.site50.net/syn/SSLLibrary.dll
hXXp://xred.site50.net/syn/SSLLibrary.dll
xredline2@gmail.com;xredline3@gmail.com
xredline2@gmail.com;xredline3@gmail.com
PASSWORD
PASSWORD
xredline1@gmail.com
xredline1@gmail.com
KEYBOARDHOOK
KEYBOARDHOOK
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
TCP Client -> Aktif
TCP Client -> Aktif
TCP Client -> Pasif
TCP Client -> Pasif
Keyboard Hook -> Active
Keyboard Hook -> Active
Keyboard Hook -> Deactive
Keyboard Hook -> Deactive
#!V!W!"!&!r%!%#%%%'%)%c%e%g%C%
#!V!W!"!&!r%!%#%%%'%)%c%e%g%C%
P%S%V%Y%\%
P%S%V%Y%\%
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123456789:;?
!"#$%&'()* ,-./0123456789:;?
&'()* ,-./0123456789:;?
&'()* ,-./0123456789:;?
1iu2.iu
1iu2.iu
user32.dll
user32.dll
GetKeyboardType
GetKeyboardType
advapi32.dll
advapi32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegFlushKey
RegFlushKey
RegCreateKeyExA
RegCreateKeyExA
GetCPInfo
GetCPInfo
CreatePipe
CreatePipe
version.dll
version.dll
gdi32.dll
gdi32.dll
SetViewportOrgEx
SetViewportOrgEx
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
MapVirtualKeyExA
MapVirtualKeyExA
MapVirtualKeyA
MapVirtualKeyA
LoadKeyboardLayoutA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyboardLayout
GetKeyState
GetKeyState
GetKeyNameTextA
GetKeyNameTextA
EnumWindows
EnumWindows
EnumThreadWindows
EnumThreadWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
ShellExecuteExA
ShellExecuteExA
wininet.dll
wininet.dll
InternetOpenUrlA
InternetOpenUrlA
wsock32.dll
wsock32.dll
netapi32.dll
netapi32.dll
; ;$;(;,;0;4;8;
; ;$;(;,;0;4;8;
3"3*323:3
3"3*323:3
? ?$?(?,?0?4?8?@?`?
? ?$?(?,?0?4?8?@?`?
= =$=(=
= =$=(=
8#8'8 8/83888
8#8'8 8/83888
8,9094989
8,9094989
:#:': :/:4:
:#:': :/:4:
:|;5<:>
:|;5<:>
7 8$8(8,8
7 8$8(8,8
8)9-91989
8)9-91989
9-:1:5:<:>
9-:1:5:<:>
:2;6;:;@;
:2;6;:;@;
2 2$2(2,20282`2
2 2$2(2,20282`2
8(8-858`8
8(8-858`8
3 3$3(3,3034383
3 3$3(3,3034383
9 9$929|9
9 9$929|9
5_5K5b5
5_5K5b5
333333333333333333
333333333333333333
33333833
33333833
3333339
3333339
3333333333333338
3333333333333338
:*"*"$3338
:*"*"$3338
3333333
3333333
33333333
33333333
33333333333
33333333333
3333333333338
3333333333338
33338?383
33338?383
333333333333
333333333333
:*3:"$3338
:*3:"$3338
333333333333333
333333333333333
.edata
.edata
KBHks.dll
KBHks.dll
7 7$7,777
7 7$7,777
KWindows
KWindows
(OrtusShellChangeNotifier
(OrtusShellChangeNotifier
UrlMon
UrlMon
#IdSMTP
#IdSMTP
IdTCPStream
IdTCPStream
IdTCPServer
IdTCPServer
Font.Charset
Font.Charset
Font.Color
Font.Color
Font.Height
Font.Height
Font.Name
Font.Name
Font.Style
Font.Style
[Content_Types].xml
[Content_Types].xml
_rels/.rels
_rels/.rels
xl/_rels/workbook.xml.rels
xl/_rels/workbook.xml.rels
xl/workbook.xml
xl/workbook.xml
xl/vbaProject.bin
xl/vbaProject.bin
T@:.xx
T@:.xx
xl/theme/theme1.xml
xl/theme/theme1.xml
xl/styles.xml
xl/styles.xml
xl/worksheets/sheet1.xml
xl/worksheets/sheet1.xml
docProps/core.xml
docProps/core.xml
docProps/app.xml
docProps/app.xml
[Content_Types].xmlPK
[Content_Types].xmlPK
_rels/.relsPK
_rels/.relsPK
xl/_rels/workbook.xml.relsPK
xl/_rels/workbook.xml.relsPK
xl/workbook.xmlPK
xl/workbook.xmlPK
xl/vbaProject.binPK
xl/vbaProject.binPK
xl/theme/theme1.xmlPK
xl/theme/theme1.xmlPK
xl/styles.xmlPK
xl/styles.xmlPK
xl/worksheets/sheet1.xmlPK
xl/worksheets/sheet1.xmlPK
docProps/core.xmlPK
docProps/core.xmlPK
docProps/app.xmlPK
docProps/app.xmlPK
Error creating SSL context. Could not load root certificate.
Error creating SSL context. Could not load root certificate.
Could not load certificate.#Could not load key, check password.
Could not load certificate.#Could not load key, check password.
SSL status: "%s"
SSL status: "%s"
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Command not supported.
Command not supported.
Address type not supported.$Error accepting connection with SSL.
Address type not supported.$Error accepting connection with SSL.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation already in progress.
Operation already in progress.
Socket operation on non-socket.
Socket operation on non-socket.
Protocol not supported.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
Protocol family not supported.0Address family not supported by protocol family.
%s is not a valid service.
%s is not a valid service.
Socket Error # %d
Socket Error # %d
Operation would block.
Operation would block.
Operation now in progress.
Operation now in progress.
Object type not supported.
Object type not supported.
No data to read.$Can not bind in port range (%d - %d)
No data to read.$Can not bind in port range (%d - %d)
Invalid Port Range (%d - %d)
Invalid Port Range (%d - %d)
@ Outside address*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
@ Outside address*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Resolving hostname %s.
Connecting to %s.
Connecting to %s.
JPEG error #%d
JPEG error #%d
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.4Failed attempting to retrieve time zone information.
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.4Failed attempting to retrieve time zone information.
File "%s" not found
File "%s" not found
No help keyword specified.
No help keyword specified.
Alt Clipboard does not support Icons
Alt Clipboard does not support Icons
Text exceeds memo capacity/Menu '%s' is already being used by another form
Text exceeds memo capacity/Menu '%s' is already being used by another form
No help found for %s#No context-sensitive help installed$No topic-based help system installed
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Failed to set data for '%s'
Failed to set data for '%s'
Resource %s not found
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Property %s does not exist
Thread creation error: %s
Thread creation error: %s
Thread Error: %s (%d)
Thread Error: %s (%d)
Unsupported clipboard format
Unsupported clipboard format
Cannot open file "%s". %s
Cannot open file "%s". %s
Unable to write to %s
Unable to write to %s
Invalid stream format$''%s'' is not a valid component name
Invalid stream format$''%s'' is not a valid component name
Invalid data type for '%s' List capacity out of bounds (%d)
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Error reading %s%s%s: %s
Failed to get data for '%s'
Failed to get data for '%s'
Ancestor for '%s' not found
Ancestor for '%s' not found
Cannot assign a %s to a %s
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot create file "%s". %s
=Overflow while converting variant of type (%s) into type (%s)
=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
Operation not supported
External exception %x
External exception %x
Interface not supported
Interface not supported
%s (%s, line %d)
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
System Error. Code: %d.
Operation aborted(Exception %s in module %s at %p.
Operation aborted(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
No argument for format '%s'"Variant method calls not supported
Invalid variant operation
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)
%s5Could not convert variant of type (%s) into type (%s)
Integer overflow Invalid floating point operation
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid class typecast0Access violation at address %p. %s of address %p
!'%s' is not a valid integer value('%s' is not a valid floating point value
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
'%s' is not a valid time!'%s' is not a valid date and time
'%s' is not a valid GUID value!'%s' is not a valid boolean value
'%s' is not a valid GUID value!'%s' is not a valid boolean value
I/O error %d
I/O error %d
1.0.0.4
1.0.0.4
1.0.0.0
1.0.0.0
mshta.exe_532:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32
clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
ADVAPI32.dll
ADVAPI32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
_amsg_exit
_amsg_exit
_acmdln
_acmdln
mshta.pdb
mshta.pdb
name="Microsoft.Windows.InetCore.mshta"
name="Microsoft.Windows.InetCore.mshta"
version="5.1.0.0"
version="5.1.0.0"
Kernel32.dll
Kernel32.dll
2kernel32.dll
2kernel32.dll
9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
MSHTA.EXE
MSHTA.EXE
Windows
Windows
9.00.8112.16421
9.00.8112.16421