HEUR:Trojan-Downloader.Win32.Generic (Kaspersky), Trojan.Generic.18490310 (B) (Emsisoft), Trojan.Generic.18490310 (AdAware), Trojan.Win32.Ransom.FD, Worm.Win32.AutoIt.FD, WormAutoItGen.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Ransom, Trojan, Worm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 2f159d73cfcce4c6440636800c8d822c
SHA1: 33ae3f8a5697a0b99e39343b2b3234e8f0d68732
SHA256: 9ef0f5e7e8ff487a6e55480c9ac9df99fd2165247d9c7e38afa069bd51b8d34b
SSDeep: 12288:8HLUMuiv9RgfSjAzRtyJ4pNugG2IOur5Q:WtARu4p40Il5Q
Size: 522011 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, InstallShieldArchive, UPolyXv05_v6
Company: no certificate found
Created at: 2008-12-24 11:00:07
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
rundll32.exe:2592
Update_v5.67.exe:3196
The Trojan injects its code into the following process(es):
%original file name%.exe:1760
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1760 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_newaccount_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\filesrd_2015[1].txt (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\VAPF0F5P.txt (115 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_quit_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFE.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DCE3BDBF5BDD86E2AB5B471CB90709B4_A7704BF276C97AA4D70879F611AA7DB9 (4268 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\metin2start.bmp (6761 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD87B.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\fTmIQU3LxvB[1].htm (3878 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD86B.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7D10.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\fTmIQU3LxvB[2].htm (4766 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD87C.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\filesrw_2015[1].txt (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\Update_v5[1].67 (4377261 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCE3BDBF5BDD86E2AB5B471CB90709B4_A7704BF276C97AA4D70879F611AA7DB9 (1413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\LVx-xkvaJ0b[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFC.tmp (392 bytes)
C:\filesrw_2015.txt (52 bytes)
C:\Update_v5.67.exe (1166752 bytes)
C:\filesrd_2015.txt (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB (3834 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CEC.tmp (1857 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\snowstorm[1].js (8154 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD86A.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\index2[1].htm (1191 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\like[1].htm (8174 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFD.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_startgame_up.bmp (588 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_settings_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\on[1].png (626 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB (1413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFF.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\sdk[1].js (100760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\back19[1].jpg (11769 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_idpwd_up.bmp (196 bytes)
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFC.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFD.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD86B.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD87B.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7D10.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFE.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD87C.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\Update_v5[1].67 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CEC.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD86A.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFF.tmp (0 bytes)
The process rundll32.exe:2592 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HFF2F6ER\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6ZDFKEVH\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UP31RB6J\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9XT73B7S\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini (67 bytes)
Registry activity
The process %original file name%.exe:1760 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Size" = "10"
[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASAPI32]
"MaxFileSize" = "1048576"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFormatTags" = "2"
[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASAPI32]
"EnableFileTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASMANCS]
"EnableFileTracing" = "0"
[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"InitHits" = "100"
[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"aFormatTagCache" = "01 00 00 00 10 00 00 00 55 00 00 00 1E 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASMANCS]
"ConsoleTracingMask" = "4294901760"
[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Enable" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASAPI32]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASMANCS]
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"
[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFilterTags" = "0"
"fdwSupport" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASMANCS]
"MaxFileSize" = "1048576"
[HKCU\Software\Classes\Local Settings\MuiCache\30\52C64B7E]
"LanguageList" = "en-US, en"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1230109207"
[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASMANCS]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASAPI32]
"ConsoleTracingMask" = "4294901760"
[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Factor" = "20"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
The process Update_v5.67.exe:3196 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASMANCS]
"MaxFileSize" = "1048576"
[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASAPI32]
"MaxFileSize" = "1048576"
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASMANCS]
"FileTracingMask" = "4294901760"
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASAPI32]
"EnableConsoleTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASMANCS]
"EnableConsoleTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 09 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASAPI32]
"EnableFileTracing" = "0"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"
Dropped PE files
MD5 | File path |
---|---|
e227a4ed4c001b36f412cbe8d684520f | c:\Update_v5.67.exe |
e227a4ed4c001b36f412cbe8d684520f | c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\Update_v5[1].67 |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
rundll32.exe:2592
Update_v5.67.exe:3196 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_newaccount_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\filesrd_2015[1].txt (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\VAPF0F5P.txt (115 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_quit_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFE.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DCE3BDBF5BDD86E2AB5B471CB90709B4_A7704BF276C97AA4D70879F611AA7DB9 (4268 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\metin2start.bmp (6761 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD87B.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\fTmIQU3LxvB[1].htm (3878 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD86B.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7D10.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\fTmIQU3LxvB[2].htm (4766 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD87C.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\filesrw_2015[1].txt (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\Update_v5[1].67 (4377261 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCE3BDBF5BDD86E2AB5B471CB90709B4_A7704BF276C97AA4D70879F611AA7DB9 (1413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\LVx-xkvaJ0b[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFC.tmp (392 bytes)
C:\filesrw_2015.txt (52 bytes)
C:\Update_v5.67.exe (1166752 bytes)
C:\filesrd_2015.txt (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB (3834 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CEC.tmp (1857 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\snowstorm[1].js (8154 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD86A.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\index2[1].htm (1191 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\like[1].htm (8174 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFD.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_startgame_up.bmp (588 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_settings_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\on[1].png (626 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB (1413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFF.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\sdk[1].js (100760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\back19[1].jpg (11769 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_idpwd_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HFF2F6ER\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6ZDFKEVH\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UP31RB6J\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9XT73B7S\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini (67 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3, 3, 0, 0
File Description:
Comments:
Language: English (United Kingdom)
Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 3, 3, 0, 0File Description: Comments: Language: English (United Kingdom)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 438272 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 442368 | 262144 | 259072 | 5.49428 | a5f4fb3e4432cd1e1aa40a6202ebdbed |
.rsrc | 704512 | 16384 | 14336 | 4.29037 | b0ece96039787b18a244127a184d73b7 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://www.elitemt2pt.com/index2.php | 104.24.119.234 |
hxxp://www.elitemt2pt.com/images/on.png | 104.24.119.234 |
hxxp://www.elitemt2pt.com/snowstorm.js | 104.24.119.234 |
hxxp://www.elitemt2pt.com/images/launcher/back19.jpg | 104.24.119.234 |
hxxp://scontent.xx.fbcdn.net/pt_PT/sdk.js | |
hxxp://scontent.xx.fbcdn.net/connect/xd_arbiter/r/fTmIQU3LxvB.js?version=42 | |
hxxp://www.elitemt2pt.com/download/filesrd_2015.txt | 104.24.119.234 |
hxxp://www.elitemt2pt.com/download/filesrw_2015.txt | 104.24.119.234 |
hxxp://www.elitemt2pt.com/download/Update_v5.67 | 104.24.119.234 |
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= | |
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA7LCTmysQFUuJVwx7Irekc= | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon | |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon | 173.194.44.65 |
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA7LCTmysQFUuJVwx7Irekc= | 93.184.220.29 |
hxxp://staticxx.facebook.com/connect/xd_arbiter/r/fTmIQU3LxvB.js?version=42 | 31.13.93.7 |
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= | 93.184.220.29 |
hxxp://connect.facebook.net/pt_PT/sdk.js | 31.13.92.14 |
www.facebook.com | 31.13.92.36 |
static.xx.fbcdn.net | 31.13.92.14 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= HTTP/1.1
Cache-Control: max-age = 511667
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 04:57:34 GMT
If-None-Match: "57ff143e-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=504138
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2016 12:58:13 GMT
Etag: "58410a93-1d7"
Expires: Fri, 09 Dec 2016 00:58:13 GMT
Last-Modified: Fri, 02 Dec 2016 05:45:55 GMT
Server: ECS (vie/F2D5)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...20161201220000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&....cd ........\..m. B.]......20161201220000Z....20161208220000Z0...*.H..................^Bf~.d}.J.l.e..izz%.H'..ab.;[...<Y..b/.z]..y..a...i.....>....-....T..{..,.....p?t.1..`..z.W..S6.../\2)1.m..G.xY' 5.....].^?.........Z...I.....8.u........>.*....U........:.C....y.....Qh.w.R......Wd.K.D.....V......*.q'M...On...&.A/.b.QV....).`.ng.......HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=504138..Content-Type: application/ocsp-response..Date: Fri, 02 Dec 2016 12:58:13 GMT..Etag: "58410a93-1d7"..Expires: Fri, 09 Dec 2016 00:58:13 GMT..Last-Modified: Fri, 02 Dec 2016 05:45:55 GMT..Server: ECS (vie/F2D5)..X-Cache: HIT..Content-Length: 471..0..........0..... .....0......0...0.......>.i...G...&....cd ...20161201220000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&....cd ........\..m. B.]......20161201220000Z....20161208220000Z0...*.H..................^Bf~.d}.J.l.e..izz%.H'..ab.;[...<Y..b/.z]..y..a...i.....>....-....T..{..,.....p?t.1..`..z.W..S6.../\2)1.m..G.xY' 5.....].^?.........Z...I.....8.u........>.*....U........:.C....y.....Qh.w.R......Wd.K.D.....V......*.q'M...On...&.A/.b.QV....).`.ng...........
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA7LCTmysQFUuJVwx7Irekc= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=502070
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2016 12:58:19 GMT
Etag: "58410239-1d7"
Expires: Fri, 09 Dec 2016 00:58:19 GMT
Last-Modified: Fri, 02 Dec 2016 05:10:17 GMT
Server: ECS (vie/F2BA)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..20161202044000Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb...Yr;.....9...T..p.. zG....20161202044000Z....20161209035500Z0...*.H..............Ld...w........Q.q...).....o\C.2e<.}b.t.J....Ej.....|Uy%.T..d2........$b...It...W....6n..[yL.b.*..S..;c"..1s...<.......#.:#...^t.3..~.#.H.*%...."...R.mE....h.......( ..xmH..V`i.~d......W. ._..X...{...8.<...2....M.:.V....xh{a2.I....X...P%.V..j0d.........G..HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=502070..Content-Type: application/ocsp-response..Date: Fri, 02 Dec 2016 12:58:19 GMT..Etag: "58410239-1d7"..Expires: Fri, 09 Dec 2016 00:58:19 GMT..Last-Modified: Fri, 02 Dec 2016 05:10:17 GMT..Server: ECS (vie/F2BA)..X-Cache: HIT..Content-Length: 471..0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..20161202044000Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb...Yr;.....9...T..p.. zG....20161202044000Z....20161209035500Z0...*.H..............Ld...w........Q.q...).....o\C.2e<.}b.t.J....Ej.....|Uy%.T..d2........$b...It...W....6n..[yL.b.*..S..;c"..1s...<.......#.:#...^t.3..~.#.H.*%...."...R.mE....h.......( ..xmH..V`i.~d......W. ._..X...{...8.<...2....M.:.V....xh{a2.I....X...P%.V..j0d.........G....
<<< skipped >>>
GET /connect/xd_arbiter/r/fTmIQU3LxvB.js?version=42 HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://VVV.elitemt2pt.com/index2.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: staticxx.facebook.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Expires: Fri, 01 Dec 2017 20:16:32 GMT
Cache-Control: public,max-age=31536000,immutable
Content-Type: text/html; charset=utf-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Vary: Accept-Encoding
Content-Encoding: gzip
X-FB-Debug: DBS4cPOO8p3eFhqpS cmKznbm5bDkKnVxCgoZ9pssIuTzq5OcJfgDpbTqAVViaJ/LnFygcIvQXw/Y7k5FRZWUQ==
Date: Fri, 02 Dec 2016 12:58:07 GMT
Connection: keep-alive
Content-Length: 11585
...........}.{.H....W`m.....:vZ..x...}umU.L..j}.$......,....y@.$W.l}....cA....qe$5<{.....||...2.....x..<.#z....I..."M...e.$a...YFfa<....h:.......$..r..i../..]/i..=...t_..v..>.N.......i........=.B.8.JS.m.i.4.G._.n.&.A...".......4.h1.h_. .*M...?8s..Z.i.FKRm.{..c.......c.t.......*...... .,j..`J..s.?......D.m.."}.H./k.9MI..}.....z........V ....T.B.k...b-0ws.........?...G6.d..r.....g....1.........-.e..Dk.c.....].E.k-........y[vo.0oG4.....R...X...p.....G........}<.....<.pl.......`.a..Q.._.m.o%......&.*.&.qNh..$O..v.|.S..|rb.....;6.D..2........M.....w..f...g...x......s.u..p...8.NC....h.v...1....?>.*.^...j.u.k...Vva<U....7.$...ew....V3..l..f... ..u.E...5..i.d.$....%..,T..H..(..Z..SI......x. ..L..dr....yoD.X3...*..y..c........__.W%6.=..@..d..>...l...#y.^.;..fV....06.. .*Bxn...2...GX.......s.A..`.0w.8... h.........4Lu..;\.. :..-G..A.&(.g.....2(6.g...v..K.;..v..4..&...&..:....G...A/...y...-.....{$N.#..q|/,......d.j..........9.g.y....@.R..&..|C..Vk..z...gL..........;.-.*.z.S.......,J....@....S#......Y..@. GE...]["(<D......xFb*.82...:....}Qs.[....T`....... ..v.T.R...2...B..C\%[.Y...he .f........y.....e...,.....vzil5.e._Z.j....:Q^[ .Y....G.|..s.o.3...........l2fc.#-(.*...F$............EF.:.b...:X..JY._.o..&)5 .N.i8q.;i..2.U...m....@.....>.k....@Gx..B...=3....X^...........(.....,...k...9.6@.. ...>...@.U..1.v.Y..W.Ua...4m...I.C..W..)i......\ ..9.(q......[.. .....>l..i..a.Z.m.D..........|d{.i..M..... ate..].-Q..p.!B..|..............D.s[.B......p..'........\.\........M.....K......N5..*.yhb.
<<< skipped >>>
GET /pt_PT/sdk.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.elitemt2pt.com/index2.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: connect.facebook.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Expose-Headers: X-FB-Content-MD5
x-fb-content-md5: 736864826f5282954678c01f4e78d48b
ETag: "8a0d5807b24937abbd0d0c786da250e2"
X-Frame-Options: DENY
timing-allow-origin: *
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data:;style-src data: 'unsafe-inline' *;connect-src *.facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* hXXps://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Cache-Control: public,max-age=1200,stale-while-revalidate=3600
X-XSS-Protection: 0
Content-Type: application/x-javascript; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15552000; preload
Expires: Fri, 02 Dec 2016 13:03:15 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Content-MD5: 0s8Jdh4ZubYtSx2WL6PVEA==
X-FB-Debug: QWavbFVctq j K1RXzuf6K1LL/AixU4gycQlVRI9KNFbNIYx2jR9lMjtFsZw38xPziLBAvZgkHB/ SX5yk/eWw==
Date: Fri, 02 Dec 2016 12:58:07 GMT
Connection: keep-alive
Content-Length: 59097
............y..H.(...>...X..1x..J....}..[vu..../......0....o,......]s...t.).{FFFD...S..Y......G..?....Q.'.I'...Q...Z.R?8rFI...O{.._{?.._.. .h6..{I...x.(..N.N.>...~..c.[..]o\Jz^.d$:.#.8._.q.M...5,.K.Qcoo:.V...F....s.{.O_..x.v.s..W2...S?.F...W.E.|5...eNuJW......W.4/.n..$F.`VrK.d..h.%Q2.yU..,.TM.6...H...|.:0.?>._S]...K&.0.....W...,3.,Tq.#....)...d..Il71.......A...t.*j......?g..7.l..||.......y|...6...u.^.XU...6......~.....q.M]`Q ..s..E.....S.....dJ'..8...t.R...1...........b..j...I.>V*r.x.......%.c...1..0.c..'.g8...&...\A....R[.7o.m.x.%.6..(..3.Y.e...c......`..b\J3...(.I4v...ug...J...e.....;....n....Je.$.l......|..].c..w....*o.wv.....p..M,.@.&|F`..J.-..t...T...7..V...u(.Z..4e.As.tV.!?.....?.Nv.}.WM.8)...~CW..vv...H..0..QO.p..A.k..cKO.U.E.u....S....};...P..U...Q.H..o.e....].G>T.. $U,...m.[....0C:.......I...g..3L..G.q..z..J~X.Wv..j.}.<0.X....gg../D.1t;..LO(..1.....m.@....o..j.@.......z%'.........@.......C7S.*...../BG'\...Bh.W...R..w $l|.....V.Qw.x.\.rX.`2.....;Q0...B..\U.)..K...).]OXvF.mS.&nv'....v....^5.^.{.<.-~'.z.X\{..~S...{..K^C._.J../.`.ae..APX...d........].. ....v.....E....vI...~.O..K:.n&..sZ.n.lf..mD....u/,>....2....l'..&...3xc....n.....l..i.<....S....4.<.`x.....Ww..K\..vA.,{...Io.._.MKo..h\.>P7JV....5...Jm..K...K"@.64.;....F.........$.u.....&,X.O.Z3x.7.8..1.O.^.w.\....%S3...*....49]M.~...L.9..]d......X.Y-...)).BK....!&A.V....phP.%. ....Us.N.ox.......\.4a.....P..........g.h...q...-.D%..6.w...h.\..q...5........vd.....R.....:F..;.G...fj.wY.l.=;:........wKI..N..:.S.......2#....^.)c
<<< skipped >>>
GET /snowstorm.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.elitemt2pt.com/index2.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.elitemt2pt.com
Connection: Keep-Alive
Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486
HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 12:58:07 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Last-Modified: Tue, 25 Nov 2014 03:00:07 GMT
ETag: W/"b5ad3-510a-508a61bc45bc0"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-WebKit-CSP: default-src 'self'
X-Permitted-Cross-Domain-Policies: master-only
CF-Cache-Status: MISS
Expires: Fri, 02 Dec 2016 16:58:07 GMT
Cache-Control: public, max-age=14400
Server: cloudflare-nginx
CF-RAY: 30aef2d23611290e-OTP
Content-Encoding: gzip
1aa7.............<.s.6..w....o..l...6.9Q..|..M.t..5.L..LB......d......]..%9I;.....X,......c..R..6..o.......OpQ................ ad.......6..Vb!..<..T..e.@.`..TmeSKk..:.p:..K.R..F.F...dJ.......O...k...}..N......!...k.[..\../..!.{.W.F-...|...0..\[...R..lRxZ.@0...f-.&...$...V.,........x.?E\]Z.:.2C. Q ....V..]..d.S.w..".........o...M.j...d}..i..Vek._...z..._k..7...._...xQ. Q.F......y[.....k..V7#.K).W..kQ..H..8......@A..$.....u..w...u.d...c.uU......U..S..KeR.Z}aEcaF.}...,.......I..R.e..F..JX.....n...7..........J...=.H.A.(..Yn.j..p%......W<p...4.x.....Q.p%....&...Z\.....n.....e>tT.K.A.sq.3..].:d.O.R.....Q......T.($$sQ..j'`..Q.P.y}.....5......P. .....*.....A.7...Bkd7....W.A.f0.Lh.,.7K..I...J...\....l`..J.A%.i.......f0...z*..r.W...Z,..)|.P.n$..F...<.4Di`Ak..~....N|....mDm....Q[....F..sY..V8.F.m...R.R...?jk5J~..e..,.d.......q..._.[;...e[..p4o.rl.F.....|.s..7..K.9....YR(..P.5..rQ..Z..@.E......T8>.D.y.K.....5.......z`A...n...!l%RA.v.Lh............e.....>.v.w U..>D%3.j..... .fk...H..._...ogd.X..u....j..."..h.R4.5..|..U.P..l .e)..HX.,.}Q2G{..e ...R.K...]I......X......mM.t....v.a....s.......Z.F(....>...K#...u..]k..,....>g. (..6' ..-k..7...,.#. ...G..k......=.4is.6....p......v...5.:.l.|.Q..R....4.e.i...J#.BW......?...TM..Dz.k%7.Y.uv...m..E..........0.:E..:.-..}0K5..F'...Vm.F..M.\lA.y#...|..2h....B!..--....L{1B.(@.....H..Y.....1.^)............E...x..2x......(..VQwT.s.....n...m].C..ki.Zu.D..'9...s#.....RP|..h....-z00 ..V.b!qGr][.j.@.R.%..I..c[..]....kQ.. .......Q..E... ..........Y.......B..M.v.3x..
<<< skipped >>>
GET /download/filesrw_2015.txt HTTP/1.1
User-Agent: AutoIt
Host: VVV.elitemt2pt.com
Cache-Control: no-cache
Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486
HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 12:58:08 GMT
Content-Type: text/plain
Content-Length: 52
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Last-Modified: Sat, 19 Nov 2016 11:24:33 GMT
ETag: "19c439-34-541a5aab5be40"
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-WebKit-CSP: default-src 'self'
X-Permitted-Cross-Domain-Policies: master-only
Server: cloudflare-nginx
CF-RAY: 30aef2d92199290e-OTP
Update_v5.69.exe..Update_v5.68.exe..Update_v5.67.exeHTTP/1.1 200 OK..Date: Fri, 02 Dec 2016 12:58:08 GMT..Content-Type: text/plain..Content-Length: 52..Connection: keep-alive..X-Frame-Options: SAMEORIGIN..Last-Modified: Sat, 19 Nov 2016 11:24:33 GMT..ETag: "19c439-34-541a5aab5be40"..Accept-Ranges: bytes..X-XSS-Protection: 1; mode=block..X-Content-Type-Options: nosniff..X-WebKit-CSP: default-src 'self'..X-Permitted-Cross-Domain-Policies: master-only..Server: cloudflare-nginx..CF-RAY: 30aef2d92199290e-OTP..Update_v5.69.exe..Update_v5.68.exe..Update_v5.67.exe..
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= HTTP/1.1
Cache-Control: max-age = 511667
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 04:57:34 GMT
If-None-Match: "57ff143e-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=504138
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2016 12:58:13 GMT
Etag: "58410a93-1d7"
Expires: Fri, 09 Dec 2016 00:58:13 GMT
Last-Modified: Fri, 02 Dec 2016 05:45:55 GMT
Server: ECS (vie/F2D5)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...20161201220000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&....cd ........\..m. B.]......20161201220000Z....20161208220000Z0...*.H..................^Bf~.d}.J.l.e..izz%.H'..ab.;[...<Y..b/.z]..y..a...i.....>....-....T..{..,.....p?t.1..`..z.W..S6.../\2)1.m..G.xY' 5.....].^?.........Z...I.....8.u........>.*....U........:.C....y.....Qh.w.R......Wd.K.D.....V......*.q'M...On...&.A/.b.QV....).`.ng.......HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=504138..Content-Type: application/ocsp-response..Date: Fri, 02 Dec 2016 12:58:13 GMT..Etag: "58410a93-1d7"..Expires: Fri, 09 Dec 2016 00:58:13 GMT..Last-Modified: Fri, 02 Dec 2016 05:45:55 GMT..Server: ECS (vie/F2D5)..X-Cache: HIT..Content-Length: 471..0..........0..... .....0......0...0.......>.i...G...&....cd ...20161201220000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&....cd ........\..m. B.]......20161201220000Z....20161208220000Z0...*.H..................^Bf~.d}.J.l.e..izz%.H'..ab.;[...<Y..b/.z]..y..a...i.....>....-....T..{..,.....p?t.1..`..z.W..S6.../\2)1.m..G.xY' 5.....].^?.........Z...I.....8.u........>.*....U........:.C....y.....Qh.w.R......Wd.K.D.....V......*.q'M...On...&.A/.b.QV....).`.ng...........
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA7LCTmysQFUuJVwx7Irekc= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=502070
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2016 12:58:19 GMT
Etag: "58410239-1d7"
Expires: Fri, 09 Dec 2016 00:58:19 GMT
Last-Modified: Fri, 02 Dec 2016 05:10:17 GMT
Server: ECS (vie/F2BA)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..20161202044000Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb...Yr;.....9...T..p.. zG....20161202044000Z....20161209035500Z0...*.H..............Ld...w........Q.q...).....o\C.2e<.}b.t.J....Ej.....|Uy%.T..d2........$b...It...W....6n..[yL.b.*..S..;c"..1s...<.......#.:#...^t.3..~.#.H.*%...."...R.mE....h.......( ..xmH..V`i.~d......W. ._..X...{...8.<...2....M.:.V....xh{a2.I....X...P%.V..j0d.........G..HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=502070..Content-Type: application/ocsp-response..Date: Fri, 02 Dec 2016 12:58:19 GMT..Etag: "58410239-1d7"..Expires: Fri, 09 Dec 2016 00:58:19 GMT..Last-Modified: Fri, 02 Dec 2016 05:10:17 GMT..Server: ECS (vie/F2BA)..X-Cache: HIT..Content-Length: 471..0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..20161202044000Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb...Yr;.....9...T..p.. zG....20161202044000Z....20161209035500Z0...*.H..............Ld...w........Q.q...).....o\C.2e<.}b.t.J....Ej.....|Uy%.T..d2........$b...It...W....6n..[yL.b.*..S..;c"..1s...<.......#.:#...^t.3..~.#.H.*%...."...R.mE....h.......( ..xmH..V`i.~d......W. ._..X...{...8.<...2....M.:.V....xh{a2.I....X...P%.V..j0d.........G....
<<< skipped >>>
GET /images/launcher/back19.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.elitemt2pt.com/index2.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.elitemt2pt.com
Connection: Keep-Alive
Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486
HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 12:58:07 GMT
Content-Type: image/jpeg
Content-Length: 78822
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Last-Modified: Fri, 18 Oct 2013 01:42:24 GMT
ETag: "288c90-133e6-4e8fa0bc88000"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-WebKit-CSP: default-src 'self'
X-Permitted-Cross-Domain-Policies: master-only
CF-Cache-Status: MISS
Expires: Fri, 02 Dec 2016 16:58:07 GMT
Cache-Control: public, max-age=14400
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 30aef2d266302932-OTP
......JFIF.....H.H.....;Exif..II*...........................................(...........1...........2...........>...........?...................*....Q...........Q...........Q..........i.......@...l........'.......'..Adobe Photoshop CS2 Windows.2013:10:18 01:38:48.%z..............................0u......`........:......o.......Photoshop ICC profile...................................x...............................................(...............................i.......H.......H.............JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?..k p)..BB..i.......=..Fe..m.(...2`.?.AV[4Zu..q..5.....O*.2.[..........X...s..~.>..x..h,;.G.*6. H.C.3.'.P..|&-..a:..!........!.y..... ZX.N.)z.4m. p@%Y...._......?...........c*.8..h.Lu.Ob.vX.......sI.....F.,.nS........4..#s.......]bI[?W..2...-.!.:.M...?.._....._.....M._.JC,(....G.......kf.O......6..uV.X..k.3....F.xu....`......c........e.........t....T}wV...{.V..........q..l6>..XG ..[..V......2`..L......kp...]aikD....7........8.:O%\$....f.........]..O.F[.....a...{.Ul.F.o.~.M.........Di..R.....
<<< skipped >>>
GET /download/Update_v5.67 HTTP/1.1
User-Agent: AutoIt
Host: VVV.elitemt2pt.com
Cache-Control: no-cache
Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486
HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 12:58:08 GMT
Content-Type: text/plain
Content-Length: 8995253
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Last-Modified: Mon, 17 Oct 2016 13:54:12 GMT
ETag: "19b92e-8941b5-53f0fe9230900"
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-WebKit-CSP: default-src 'self'
X-Permitted-Cross-Domain-Policies: master-only
Server: cloudflare-nginx
CF-RAY: 30aef2d9b2052932-OTP
MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....h.F.................@...p...............P....@.............................................. .......................................<...........................................................................................................text....@.......8.................. ..`.data....p...P.......>..............@....idata...............H..............@..@.rsrc....@.......<...X..............@..@...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
<<< skipped >>>
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 404 Not Found
Date: Fri, 02 Dec 2016 12:58:54 GMT
Content-Type: text/html; charset=UTF-8
Server: ocsp_responder
Content-Length: 1668
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//VVV.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//VVV.google.com/image..
GET /index2.php HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.elitemt2pt.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 12:58:06 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486; expires=Sat, 02-Dec-17 12:58:06 GMT; path=/; domain=.elitemt2pt.com; HttpOnly
X-Powered-By: PHP/5.5.36
Server: cloudflare-nginx
CF-RAY: 30aef2ccc0e32908-OTP
Content-Encoding: gzip
2d8............lS...6.}^}..A..`....a...^..H6..E[.E@.#..D.........6..=.3.9gf.P......?..............s...=...........&sX:a.&m..8.|b...a..n.Kv..u5_~..Q ...0.3f.H.2....}g|......vb..(T...........*.S...6kp...7....hi...aU.Jl.4..........L..F^...%.....|........I..q..l..`..........) ....8A....#.;m...8...........o.t......8.r/......@ .b:e....K....j.d.....z....o=....Z..-JZ...Oje..e......WV........\..n....-`....z.....:>......(.3.._p..|.&.q2...U..U..........eXm../O.f.g.U....[...3.Z....Fz..GC.......1.._....BW..C...T.U..C.8...'..P..`..2h}.......x'........UB...ub..@.....u....j.wE.v..kk..Ur....j}2......D.........LQ...* 7c.3.......K...^./.(......-U.#t._:..... V....'.............'kP..-.t.f\.DC.. .....y...f..,.}=]...VoM2.....`.M..2^N...t. k........48a...X.n.6.]7_A..2.......Y. ..."'hQ..Jf2.Hb*RN<...]t.U./.b0......;..Iv]...}..^^^.Z....F.2..3....y.Zv.n....EBt~......-J.h...1...Qp,..#_s"..?.x.-s....dt .T."4YG7|1K.sm.9 j2...rz.....%.9....)...V..,q<V.X.....j.$S`.,&t.........oNh....v..._......9..........).pU..#..L...{DR......V .[.c...........~B..;.%.b.......m..=.yM2...J...O......E..<.~.d..mh.R.Zs.......5.C.Y.............}..,..Z.%C..,B..JY..E.P3.E...h.!...Ra...u,<.4i(......v...YM...v..?..d....,..n..?ad.Y,l.c..$h84.d.9..y)A.<.....@%..*..}..\O..{.......9K..a.T.m..C~.ec.{G..8...AC.Y.c...b._..Pewb...r.....k.G...*.`.,.......{b'._.h....V..2.X....PT.f.....U..N).(k.$Wx)_ K..../......K.va..d...~..._iV`.../E..poq........?.....d.>d....D.. B! ..%.w<Y.U.QK#.#Nc...ZTro..16..&.v..n....A.v..kI.[..{.nW".......,^t..o...y..(^.......x.RXm
<<< skipped >>>
GET /images/on.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.elitemt2pt.com/index2.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.elitemt2pt.com
Connection: Keep-Alive
Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486
HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 12:58:07 GMT
Content-Type: image/png
Content-Length: 626
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Last-Modified: Thu, 25 Aug 2011 22:32:44 GMT
ETag: "288c4b-272-4ab5c01e57b00"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-WebKit-CSP: default-src 'self'
X-Permitted-Cross-Domain-Policies: master-only
CF-Cache-Status: MISS
Expires: Fri, 02 Dec 2016 16:58:07 GMT
Cache-Control: public, max-age=14400
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 30aef2d203e22908-OTP
.PNG........IHDR.............(-.S....sBIT.....O.....PLTE...................p........=...........3........f.....p.#.........................}..x..i.....e..{..Q..y..N..G..F.....*..).."~.>m."p.Um.Rj.Q..vf."V..\..^.!M..7..9. W.82.)...1.'%...........).!*.*...................EtRNS.."3DDUfw...............................................................c....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....IDAT..5.Y..P....s%K.J..5"{......d....9O3.$WM_.....,.M.lnE.....j.k.....I..#.v"..........q\c...E.j.\.Qt.................o4<..Xr.O..v..:v.......?...R.....WW.....].w.....j.8..'....(..)(...!'..........u.....IEND.B`.HTTP/1.1 200 OK..Date: Fri, 02 Dec 2016 12:58:07 GMT..Content-Type: image/png..Content-Length: 626..Connection: keep-alive..X-Frame-Options: SAMEORIGIN..Last-Modified: Thu, 25 Aug 2011 22:32:44 GMT..ETag: "288c4b-272-4ab5c01e57b00"..X-XSS-Protection: 1; mode=block..X-Content-Type-Options: nosniff..X-WebKit-CSP: default-src 'self'..X-Permitted-Cross-Domain-Policies: master-only..CF-Cache-Status: MISS..Expires: Fri, 02 Dec 2016 16:58:07 GMT..Cache-Control: public, max-age=14400..Accept-Ranges: bytes..Server: cloudflare-nginx..CF-RAY: 30aef2d203e22908-OTP...PNG........IHDR.............(-.S....sBIT.....O.....PLTE...................p........=...........3........f.....p.#.........................}..x..i.....e..{..Q..y..N..G..F.....*..).."~.>m."p.Um.Rj.Q..vf."V..\..^.!M..7..9. W.82.)...1.'%...........).!*.*...................EtRNS.."3DDUfw.........................................................
<<< skipped >>>
GET /download/filesrd_2015.txt HTTP/1.1
User-Agent: AutoIt
Host: VVV.elitemt2pt.com
Cache-Control: no-cache
Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486
HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 12:58:08 GMT
Content-Type: text/plain
Content-Length: 38
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Last-Modified: Sat, 19 Nov 2016 11:24:32 GMT
ETag: "19c436-26-541a5aaa67c00"
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-WebKit-CSP: default-src 'self'
X-Permitted-Cross-Domain-Policies: master-only
Server: cloudflare-nginx
CF-RAY: 30aef2d847822908-OTP
Update_v5.69.Update_v5.68.Update_v5.67HTTP/1.1 200 OK..Date: Fri, 02 Dec 2016 12:58:08 GMT..Content-Type: text/plain..Content-Length: 38..Connection: keep-alive..X-Frame-Options: SAMEORIGIN..Last-Modified: Sat, 19 Nov 2016 11:24:32 GMT..ETag: "19c436-26-541a5aaa67c00"..Accept-Ranges: bytes..X-XSS-Protection: 1; mode=block..X-Content-Type-Options: nosniff..X-WebKit-CSP: default-src 'self'..X-Permitted-Cross-Domain-Policies: master-only..Server: cloudflare-nginx..CF-RAY: 30aef2d847822908-OTP..Update_v5.69.Update_v5.68.Update_v5.67....
GET /download/Update_v5.67 HTTP/1.1
User-Agent: AutoIt
Host: VVV.elitemt2pt.com
Cache-Control: no-cache
Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486
HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 12:58:08 GMT
Content-Type: text/plain
Content-Length: 8995253
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Last-Modified: Mon, 17 Oct 2016 13:54:12 GMT
ETag: "19b92e-8941b5-53f0fe9230900"
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-WebKit-CSP: default-src 'self'
X-Permitted-Cross-Domain-Policies: master-only
Server: cloudflare-nginx
CF-RAY: 30aef2dac15e2908-OTP
MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....h.F.................@...p...............P....@.............................................. .......................................<...........................................................................................................text....@.......8.................. ..`.data....p...P.......>..............@....idata...............H..............@..@.rsrc....@.......<...X..............@..@...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= HTTP/1.1
Cache-Control: max-age = 511667
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 04:57:34 GMT
If-None-Match: "57ff143e-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=504138
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2016 12:58:13 GMT
Etag: "58410a93-1d7"
Expires: Fri, 09 Dec 2016 00:58:13 GMT
Last-Modified: Fri, 02 Dec 2016 05:45:55 GMT
Server: ECS (vie/F2D5)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...20161201220000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&....cd ........\..m. B.]......20161201220000Z....20161208220000Z0...*.H..................^Bf~.d}.J.l.e..izz%.H'..ab.;[...<Y..b/.z]..y..a...i.....>....-....T..{..,.....p?t.1..`..z.W..S6.../\2)1.m..G.xY' 5.....].^?.........Z...I.....8.u........>.*....U........:.C....y.....Qh.w.R......Wd.K.D.....V......*.q'M...On...&.A/.b.QV....).`.ng.......nt>....
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA7LCTmysQFUuJVwx7Irekc= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=502070
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2016 12:58:19 GMT
Etag: "58410239-1d7"
Expires: Fri, 09 Dec 2016 00:58:19 GMT
Last-Modified: Fri, 02 Dec 2016 05:10:17 GMT
Server: ECS (vie/F2BA)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..20161202044000Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb...Yr;.....9...T..p.. zG....20161202044000Z....20161209035500Z0...*.H..............Ld...w........Q.q...).....o\C.2e<.}b.t.J....Ej.....|Uy%.T..d2........$b...It...W....6n..[yL.b.*..S..;c"..1s...<.......#.:#...^t.3..~.#.H.*%...."...R.mE....h.......( ..xmH..V`i.~d......W. ._..X...{...8.<...2....M.:.V....xh{a2.I....X...P%.V..j0d.........G..HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=502070..Content-Type: application/ocsp-response..Date: Fri, 02 Dec 2016 12:58:19 GMT..Etag: "58410239-1d7"..Expires: Fri, 09 Dec 2016 00:58:19 GMT..Last-Modified: Fri, 02 Dec 2016 05:10:17 GMT..Server: ECS (vie/F2BA)..X-Cache: HIT..Content-Length: 471..0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..20161202044000Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb...Yr;.....9...T..p.. zG....20161202044000Z....20161209035500Z0...*.H..............Ld...w........Q.q...).....o\C.2e<.}b.t.J....Ej.....|Uy%.T..d2........$b...It...W....6n..[yL.b.*..S..;c"..1s...<.......#.:#...^t.3..~.#.H.*%...."...R.mE....h.......( ..xmH..V`i.~d......W. ._..X...{...8.<...2....M.:.V....xh{a2.I....X...P%.V..j0d.........G....
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1760:
`.rsrc
`.rsrc
%f;)s
%f;)s
s%j.Zf
s%j.Zf
tGHt.Ht&
tGHt.Ht&
ItCP
ItCP
tCPh
tCPh
SSSSh
SSSSh
Cv=kAv.SCvs
Cv=kAv.SCvs
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
operator
operator
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
uxtheme.dll
uxtheme.dll
kernel32.dll
kernel32.dll
APPSKEY
APPSKEY
ASC 0%d
ASC 0%d
operand of unlimited repeat could match the empty string
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
POSIX named classes are supported only within a class
erroffset passed as NULL
erroffset passed as NULL
POSIX collating elements are not supported
POSIX collating elements are not supported
this version of PCRE is not compiled with PCRE_UTF8 support
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N, \U, or \u
PCRE does not support \L, \l, \N, \U, or \u
support for \P, \p, and \X has not been compiled
support for \P, \p, and \X has not been compiled
(*VERB) with an argument is not supported
(*VERB) with an argument is not supported
ICMP.DLL
ICMP.DLL
zcÃ
zcÃ
GetProcessHeap
GetProcessHeap
CreatePipe
CreatePipe
GetWindowsDirectoryW
GetWindowsDirectoryW
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
RegDeleteKeyW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
SetViewportOrgEx
SetViewportOrgEx
ShellExecuteExW
ShellExecuteExW
SHFileOperationW
SHFileOperationW
ShellExecuteW
ShellExecuteW
RegisterHotKey
RegisterHotKey
GetKeyboardLayoutNameW
GetKeyboardLayoutNameW
UnregisterHotKey
UnregisterHotKey
ExitWindowsEx
ExitWindowsEx
EnumThreadWindows
EnumThreadWindows
GetAsyncKeyState
GetAsyncKeyState
SetKeyboardState
SetKeyboardState
GetKeyboardState
GetKeyboardState
GetKeyState
GetKeyState
keybd_event
keybd_event
VkKeyScanA
VkKeyScanA
GetKeyboardLayoutNameA
GetKeyboardLayoutNameA
EnumWindows
EnumWindows
EnumChildWindows
EnumChildWindows
MapVirtualKeyW
MapVirtualKeyW
CloseWindowStation
CloseWindowStation
SetProcessWindowStation
SetProcessWindowStation
OpenWindowStationW
OpenWindowStationW
InternetOpenUrlW
InternetOpenUrlW
FtpOpenFileW
FtpOpenFileW
HttpQueryInfoW
HttpQueryInfoW
HttpOpenRequestW
HttpOpenRequestW
HttpSendRequestW
HttpSendRequestW
FtpGetFileSize
FtpGetFileSize
InternetCrackUrlW
InternetCrackUrlW
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
S.nBr
S.nBr
=TGm
=TGm
FtpH|
FtpH|
version="3.0.0.0"
version="3.0.0.0"
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
COMDLG32.dll
COMDLG32.dll
GDI32.dll
GDI32.dll
MPR.dll
MPR.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
PSAPI.DLL
PSAPI.DLL
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
USERENV.dll
USERENV.dll
VERSION.dll
VERSION.dll
WININET.dll
WININET.dll
WINMM.dll
WINMM.dll
WSOCK32.dll
WSOCK32.dll
mscoree.dll
mscoree.dll
CMDLINERAW
CMDLINERAW
CMDLINE
CMDLINE
/AutoIt3ExecuteLine
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
/AutoIt3ExecuteScript
%s (%d) : ==> %s.:
%s (%d) : ==> %s.:
Line %d:
Line %d:
Line %d (File "%s"):
Line %d (File "%s"):
%s (%d) : ==> %s:
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
*.au3;*.a3x
All files (*.*)
All files (*.*)
04090000
04090000
%u.%u.%u.%u
%u.%u.%u.%u
0.0.0.0
0.0.0.0
Mddddd
Mddddd
FTPSETPROXY
FTPSETPROXY
GUICTRLRECVMSG
GUICTRLRECVMSG
GUICTRLSENDMSG
GUICTRLSENDMSG
GUIGETMSG
GUIGETMSG
GUIREGISTERMSG
GUIREGISTERMSG
HOTKEYSET
HOTKEYSET
HTTPSETPROXY
HTTPSETPROXY
ISKEYWORD
ISKEYWORD
MSGBOX
MSGBOX
REGENUMKEY
REGENUMKEY
SHELLEXECUTE
SHELLEXECUTE
SHELLEXECUTEWAIT
SHELLEXECUTEWAIT
TCPACCEPT
TCPACCEPT
TCPCLOSESOCKET
TCPCLOSESOCKET
TCPCONNECT
TCPCONNECT
TCPLISTEN
TCPLISTEN
TCPNAMETOIP
TCPNAMETOIP
TCPRECV
TCPRECV
TCPSEND
TCPSEND
TCPSHUTDOWN
TCPSHUTDOWN
TCPSTARTUP
TCPSTARTUP
TRAYGETMSG
TRAYGETMSG
UDPBIND
UDPBIND
UDPCLOSESOCKET
UDPCLOSESOCKET
UDPOPEN
UDPOPEN
UDPRECV
UDPRECV
UDPSEND
UDPSEND
UDPSHUTDOWN
UDPSHUTDOWN
UDPSTARTUP
UDPSTARTUP
URLDOWNLOADTOFILE
URLDOWNLOADTOFILE
%s (%d) : ==> %s:
%s (%d) : ==> %s:
\??\%s
\??\%s
GUI_RUNDEFMSG
GUI_RUNDEFMSG
FtpBinaryMode
FtpBinaryMode
SendKeyDelay
SendKeyDelay
SendKeyDownDelay
SendKeyDownDelay
TCPTimeout
TCPTimeout
AUTOITCALLVARIABLE%d
AUTOITCALLVARIABLE%d
Keyword
Keyword
AutoIt.Error
AutoIt.Error
Null Object assignment in FOR..IN loop
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
Incorrect Object type in FOR..IN loop
HOTKEYPRESSED
HOTKEYPRESSED
AUTOITEXE
AUTOITEXE
WINDOWSDIR
WINDOWSDIR
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
3, 3, 0, 0
3, 3, 0, 0
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_USERS
HKEY_USERS
%d/d/d
%d/d/d
c:\%original file name%.exe
c:\%original file name%.exe
C:\%original file name%.exe
C:\%original file name%.exe
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
Missing operator in expression."Unbalanced brackets in expression.
Missing operator in expression."Unbalanced brackets in expression.
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
*Unable to get a list of running processes.*Missing separator character after keyword.
*Unable to get a list of running processes.*Missing separator character after keyword.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.
Badly formated Enum statement!Badly formated variable or macro.3This keyword cannot be used after a "Then" keyword.
Badly formated Enum statement!Badly formated variable or macro.3This keyword cannot be used after a "Then" keyword.
>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
%original file name%.exe_1760_rwx_00401000_000AA000:
%f;)s
%f;)s
s%j.Zf
s%j.Zf
tGHt.Ht&
tGHt.Ht&
ItCP
ItCP
tCPh
tCPh
SSSSh
SSSSh
Cv=kAv.SCvs
Cv=kAv.SCvs
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
operator
operator
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
uxtheme.dll
uxtheme.dll
kernel32.dll
kernel32.dll
APPSKEY
APPSKEY
ASC 0%d
ASC 0%d
operand of unlimited repeat could match the empty string
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
POSIX named classes are supported only within a class
erroffset passed as NULL
erroffset passed as NULL
POSIX collating elements are not supported
POSIX collating elements are not supported
this version of PCRE is not compiled with PCRE_UTF8 support
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N, \U, or \u
PCRE does not support \L, \l, \N, \U, or \u
support for \P, \p, and \X has not been compiled
support for \P, \p, and \X has not been compiled
(*VERB) with an argument is not supported
(*VERB) with an argument is not supported
ICMP.DLL
ICMP.DLL
zcÃ
zcÃ
GetProcessHeap
GetProcessHeap
CreatePipe
CreatePipe
GetWindowsDirectoryW
GetWindowsDirectoryW
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
RegDeleteKeyW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
SetViewportOrgEx
SetViewportOrgEx
ShellExecuteExW
ShellExecuteExW
SHFileOperationW
SHFileOperationW
ShellExecuteW
ShellExecuteW
RegisterHotKey
RegisterHotKey
GetKeyboardLayoutNameW
GetKeyboardLayoutNameW
UnregisterHotKey
UnregisterHotKey
ExitWindowsEx
ExitWindowsEx
EnumThreadWindows
EnumThreadWindows
GetAsyncKeyState
GetAsyncKeyState
SetKeyboardState
SetKeyboardState
GetKeyboardState
GetKeyboardState
GetKeyState
GetKeyState
keybd_event
keybd_event
VkKeyScanA
VkKeyScanA
GetKeyboardLayoutNameA
GetKeyboardLayoutNameA
EnumWindows
EnumWindows
EnumChildWindows
EnumChildWindows
MapVirtualKeyW
MapVirtualKeyW
CloseWindowStation
CloseWindowStation
SetProcessWindowStation
SetProcessWindowStation
OpenWindowStationW
OpenWindowStationW
InternetOpenUrlW
InternetOpenUrlW
FtpOpenFileW
FtpOpenFileW
HttpQueryInfoW
HttpQueryInfoW
HttpOpenRequestW
HttpOpenRequestW
HttpSendRequestW
HttpSendRequestW
FtpGetFileSize
FtpGetFileSize
InternetCrackUrlW
InternetCrackUrlW
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
S.nBr
S.nBr
=TGm
=TGm
mscoree.dll
mscoree.dll
KERNEL32.DLL
KERNEL32.DLL
CMDLINERAW
CMDLINERAW
CMDLINE
CMDLINE
/AutoIt3ExecuteLine
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
/AutoIt3ExecuteScript
%s (%d) : ==> %s.:
%s (%d) : ==> %s.:
Line %d:
Line %d:
Line %d (File "%s"):
Line %d (File "%s"):
%s (%d) : ==> %s:
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
*.au3;*.a3x
All files (*.*)
All files (*.*)
04090000
04090000
%u.%u.%u.%u
%u.%u.%u.%u
0.0.0.0
0.0.0.0
Mddddd
Mddddd
FTPSETPROXY
FTPSETPROXY
GUICTRLRECVMSG
GUICTRLRECVMSG
GUICTRLSENDMSG
GUICTRLSENDMSG
GUIGETMSG
GUIGETMSG
GUIREGISTERMSG
GUIREGISTERMSG
HOTKEYSET
HOTKEYSET
HTTPSETPROXY
HTTPSETPROXY
ISKEYWORD
ISKEYWORD
MSGBOX
MSGBOX
REGENUMKEY
REGENUMKEY
SHELLEXECUTE
SHELLEXECUTE
SHELLEXECUTEWAIT
SHELLEXECUTEWAIT
TCPACCEPT
TCPACCEPT
TCPCLOSESOCKET
TCPCLOSESOCKET
TCPCONNECT
TCPCONNECT
TCPLISTEN
TCPLISTEN
TCPNAMETOIP
TCPNAMETOIP
TCPRECV
TCPRECV
TCPSEND
TCPSEND
TCPSHUTDOWN
TCPSHUTDOWN
TCPSTARTUP
TCPSTARTUP
TRAYGETMSG
TRAYGETMSG
UDPBIND
UDPBIND
UDPCLOSESOCKET
UDPCLOSESOCKET
UDPOPEN
UDPOPEN
UDPRECV
UDPRECV
UDPSEND
UDPSEND
UDPSHUTDOWN
UDPSHUTDOWN
UDPSTARTUP
UDPSTARTUP
URLDOWNLOADTOFILE
URLDOWNLOADTOFILE
%s (%d) : ==> %s:
%s (%d) : ==> %s:
\??\%s
\??\%s
GUI_RUNDEFMSG
GUI_RUNDEFMSG
FtpBinaryMode
FtpBinaryMode
SendKeyDelay
SendKeyDelay
SendKeyDownDelay
SendKeyDownDelay
TCPTimeout
TCPTimeout
AUTOITCALLVARIABLE%d
AUTOITCALLVARIABLE%d
Keyword
Keyword
AutoIt.Error
AutoIt.Error
Null Object assignment in FOR..IN loop
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
Incorrect Object type in FOR..IN loop
HOTKEYPRESSED
HOTKEYPRESSED
AUTOITEXE
AUTOITEXE
WINDOWSDIR
WINDOWSDIR
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
3, 3, 0, 0
3, 3, 0, 0
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_USERS
HKEY_USERS
%d/d/d
%d/d/d
c:\%original file name%.exe
c:\%original file name%.exe
C:\%original file name%.exe
C:\%original file name%.exe
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
Missing operator in expression."Unbalanced brackets in expression.
Missing operator in expression."Unbalanced brackets in expression.
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
*Unable to get a list of running processes.*Missing separator character after keyword.
*Unable to get a list of running processes.*Missing separator character after keyword.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.
Badly formated Enum statement!Badly formated variable or macro.3This keyword cannot be used after a "Then" keyword.
Badly formated Enum statement!Badly formated variable or macro.3This keyword cannot be used after a "Then" keyword.
>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
Update_v5.67.exe_3196:
.text
.text
`.data
`.data
.idata
.idata
@.rsrc
@.rsrc
shlwapi.dll
shlwapi.dll
%s %s %s
%s %s %s
GETPASSWORD1
GETPASSWORD1
sfxcmd
sfxcmd
__tmp_rar_sfx_access_check_%u
__tmp_rar_sfx_access_check_%u
-el -s2 "-d%s" "-p%s" "-sp%s"
-el -s2 "-d%s" "-p%s" "-sp%s"
%s.%d.tmp
%s.%d.tmp
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
%s%s%d
%s%s%d
riched32.dll
riched32.dll
riched20.dll
riched20.dll
COMCTL32.DLL
COMCTL32.DLL
%.*s(%d)%s
%.*s(%d)%s
rtmp%d
rtmp%d
C:\Update_v5.67.exe
C:\Update_v5.67.exe
ADVAPI32.DLL
ADVAPI32.DLL
KERNEL32.DLL
KERNEL32.DLL
COMDLG32.DLL
COMDLG32.DLL
GDI32.DLL
GDI32.DLL
SHELL32.DLL
SHELL32.DLL
USER32.DLL
USER32.DLL
OLE32.DLL
OLE32.DLL
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
GetCPInfo
GetCPInfo
GetProcessHeap
GetProcessHeap
SHFileOperationA
SHFileOperationA
ShellExecuteExA
ShellExecuteExA
:(,4;;?@
:(,4;;?@
3,45657879
3,45657879
8888888888887
8888888888887
version="1.0.0.0"
version="1.0.0.0"
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
Shell.Explorer
Shell.Explorer
Enter password
Enter password
&Enter password for the encrypted file:
&Enter password for the encrypted file:
Extracting %s
Extracting %s
Skipping %s
Skipping %s
The file "%s" header is corrupt%The archive comment header is corrupt
The file "%s" header is corrupt%The archive comment header is corrupt
Unknown method in %s
Unknown method in %s
Cannot open %s
Cannot open %s
Cannot create %s
Cannot create %s
Cannot create folder %s6CRC failed in the encrypted file %s (wrong password ?)
Cannot create folder %s6CRC failed in the encrypted file %s (wrong password ?)
CRC failed in %s
CRC failed in %s
Packed data CRC failed in %s
Packed data CRC failed in %s
Wrong password for %s5Write error in the file %s. Probably the disk is full
Wrong password for %s5Write error in the file %s. Probably the disk is full
Read error in the file %s
Read error in the file %s
Extracting from %s
Extracting from %s
ErroraErrors encountered while performing the operation
ErroraErrors encountered while performing the operation
Please close all applications, reboot Windows and restart this installation\Some installation files are corrupt.
Please close all applications, reboot Windows and restart this installation\Some installation files are corrupt.