UDS:DangerousObject.Multi.Generic (Kaspersky), Trojan.Win32.IEDummy.FD (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: a1b4ea28a0341393f08da060cd016483
SHA1: d4fd42eeb197790a549c18d22bd56c4210c5b98e
SHA256: bb93faf1703c350e143206ac469e6a138fa1338dc29d7d7b15b7e16de12c633f
SSDeep: 98304:t3AAiq7cZh5jpnfFAoe5sQ5U4z8riF9yew8f4d:t3AAc3FfiU 8riLyew8f
Size: 3383296 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PolyEnE001byLennartHedlund, UPolyXv05_v6
Company: no certificate found
Created at: 2015-09-23 13:47:17
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:668
The Trojan injects its code into the following process(es):
Injection.exe:1940
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:668 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Vista 13\Injection.exe (3730 bytes)
C:\Vista 13\Injection.ini (100 bytes)
%System%\drivers\etc\hosts (2 bytes)
%System%\D3DX9_43.dll (12288 bytes)
C:\Vista 13\Vista 13.dll (260 bytes)
Registry activity
The process Injection.exe:1940 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 7D 2E D9 CC 0B 71 27 F9 F6 51 0B 3A 3C 72 5B"
The process %original file name%.exe:668 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "20 C1 5F D0 FF 93 FA 5E 9B 9A 8C 1A F6 71 67 BE"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
Dropped PE files
MD5 | File path |
---|---|
faaedb168307c97a77d00771d1d45a3b | c:\Vista 13\Injection.exe |
17b2fe8b5d4979b8d07d32bc830265ed | c:\Vista 13\Vista 13.dll |
86e39e9161c3d930d93822f1563c280d | c:\WINDOWS\system32\D3DX9_43.dll |
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 2072 bytes in size. The following strings are added to the hosts file listed below:
127.0.0.1 | www.virustotal.com |
127.0.0.1 | virustotal.com |
127.0.0.1 | www.pekalongan-kommuniti.com |
127.0.0.1 | pekalongan-kommuniti.com |
127.0.0.1 | http://www.pekalongan-kommuniti.com/ |
127.0.0.1 | http://www.pury-cyber.blogspot.co.id/ |
127.0.0.1 | https://www.pury-cyber.blogspot.co.id/ |
127.0.0.1 | pury-cyber.blogspot.co.id |
127.0.0.1 | pury-cyber.blogspot.com |
127.0.0.1 | www.pury-cyber.blogspot.co.id |
127.0.0.1 | www.pury-cyber.blogspot.com |
127.0.0.1 | gudang-citer.blogspot.com |
127.0.0.1 | gudang-citer.blogspot.co.id |
127.0.0.1 | http://www.gudang-citer.blogspot.co.id/ |
127.0.0.1 | www.gudang-citer.blogspot.co.id |
127.0.0.1 | http://gembelcit.blogspot.co.id/ |
127.0.0.1 | http://www.gembelcit.blogspot.co.id/ |
127.0.0.1 | www.gembelcit.blogspot.co.id |
127.0.0.1 | gembelcit.blogspot.co.id |
127.0.0.1 | http://www.dukun-cit.com/ |
127.0.0.1 | www.dukun-cit.com |
127.0.0.1 | dukun-cit.com |
127.0.0.1 | http://pesantren-citer.blogspot.co.id/ |
127.0.0.1 | http://pesantren-citer.blogspot.com/ |
127.0.0.1 | http://www.pesantren-citer.blogspot.co.id/ |
127.0.0.1 | http://www.pesantren-citer.blogspot.com/ |
127.0.0.1 | www.pesantren-citer.blogspot.com |
127.0.0.1 | pesantren-citer.blogspot.com |
127.0.0.1 | www.pesantren-citer.blogspot.co.id |
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:668
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Vista 13\Injection.exe (3730 bytes)
C:\Vista 13\Injection.ini (100 bytes)
%System%\drivers\etc\hosts (2 bytes)
%System%\D3DX9_43.dll (12288 bytes)
C:\Vista 13\Vista 13.dll (260 bytes) - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: Vista 13
Product Name: Vista 13
Product Version: 1.00
Legal Copyright: Vista 13
Legal Trademarks: Vista 13
Original Filename: Vista 13 - Point Blank Garena Indonesia.exe
Internal Name: Vista 13 - Point Blank Garena Indonesia
File Version: 1.00
File Description: Vista 13
Comments: Vista 13
Language: English (United States)
Company Name: Vista 13Product Name: Vista 13Product Version: 1.00Legal Copyright: Vista 13Legal Trademarks: Vista 13Original Filename: Vista 13 - Point Blank Garena Indonesia.exeInternal Name: Vista 13 - Point Blank Garena IndonesiaFile Version: 1.00File Description: Vista 13Comments: Vista 13Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 16520 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.data | 24576 | 3048 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.vmp0 | 28672 | 3457652 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.vmp1 | 3489792 | 3372923 | 3375104 | 5.37483 | 136463ff084dab51e7a9730a82b63f97 |
.rsrc | 6864896 | 2596 | 4096 | 1.54274 | e127eeafd98887bc0e1d5c50a4f3d040 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://blogspot.l.googleusercontent.com/ | |
hxxp://v2.zopim.com/?3IFwmxUXebISVHvic5bMQKSIRSRHo688 | |
hxxp://googlecode.l.googleusercontent.com/svn/trunk/html5.js | |
hxxp://v2.zopim.com/bin/v/widget_v2.106.js | |
hxxp://blogspot.l.googleusercontent.com/favicon.ico | |
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.7.1/jquery.min.js | |
hxxp://e3821.dspe1.akamaiedge.net/en_US/all.js | |
hxxp://scontent.xx.fbcdn.net/rsrc.php/v2/ya/r/3rhSv5V8j3o.gif | |
hxxp://static.xx.fbcdn.net/rsrc.php/v2/ya/r/3rhSv5V8j3o.gif | 31.13.92.14 |
hxxp://connect.facebook.net/en_US/all.js | 23.64.223.139 |
hxxp://vista-tigabelas.blogspot.com/favicon.ico | 216.58.209.161 |
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js | 216.58.209.202 |
hxxp://html5shiv.googlecode.com/svn/trunk/html5.js | 64.233.164.82 |
hxxp://vista-tigabelas.blogspot.com/ | 216.58.209.161 |
jp06.zopim.com | 52.69.112.0 |
apis.google.com | 173.194.113.197 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /ajax/libs/jquery/1.7.1/jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://vista-tigabelas.blogspot.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Mon, 02 Apr 2012 18:24:28 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Date: Mon, 07 Sep 2015 18:08:50 GMT
Expires: Tue, 06 Sep 2016 18:08:50 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 33186
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 1855993
.............~.F....?......!J......7.......Y...h....w.T*.".Y.Y...|.D.. (g..;.....b=q.8......?.....w.....>.......g{s.....2...........e. WK?VI.h....~.<n...fy6.....e.z...8.{.U......(.. .e.8....V...}.[..|../.......j-.~'...Q.....%Q.KV...Ec....q.{...x........*..^...^Vn........&_...~.....o.Z..~..^....{?.S..&.w.W.|A...r......t.../V.,.Dt.Pf...&yYLv.U......r.Q}.^']...*W.:H.........~_=.r..s.^..T..=l.]..)Vj.......^.ys...x...C_.h..&............`.^b<.^:_m1'Y....c.....e..1Oo....q...q.x......o...........?..q:..;.>.whu.....=.... . P..i...I..E.!..f.&v(.......m...r...w~.SW.......6p>...........,.........Lsj...L7..j.......y..'.F..h44..SY.V.......i.mw...4Yi.H{'.._..].9?...}..Jn................5Q%m.y.,v.5U.(.^..\-.R...?^m."...7e..vy...b...L..%....]..f...l5>...nw.rYx..|8..V.......0F..|4....<.q....d.(~...h....p.......q1.......y..ZF.p1..;.^..W.Y...(.....<x.F...iI.t..n..p.-......w.p:..I.\.:x\...H..T.j...../i..h....3....Y..w.......5...:..n.....U...]B..`.ZQ..nE}.....L..`..A..W....C.\'......e^./.j\[...6.v."..u...-..K.3Tb....24>,..hD.R..<.F..q5C..vR.iO)Z.(..&T..v.Z#.. .._ts..1.H..=....H1...6..@....9..v...=Q...RZ ..SIt.}.....J.me.....Yq`..5......5.....28L..~.-L.=...b)M'..Gd.....1..,.:H...f.....h..T. Q...~.|%#%....y....7....L......"QU.y0H...<.s....n....I'Z............A........K...k..2...P._..1Z...B..4~.&..h.o{.y..q.......Z..R...l......&.....>....P.......&.;W.3...L......@$...,....Q..U1..hC1.$ .;ByWj.M..... B=1....s_....:HP...&.7.&..>7.(=.....P.b8...Q..Nw,...E........t;.4..`..._ F.P.......t....hm..w...Q....
<<< skipped >>>
GET /rsrc.php/v2/ya/r/3rhSv5V8j3o.gif HTTP/1.1
Accept: */*
Referer: hXXp://vista-tigabelas.blogspot.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.xx.fbcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT
Content-MD5: mB0qbhI5nsDyc9mlRioodg==
Expires: Thu, 15 Sep 2016 23:12:38 GMT
Cache-Control: public, max-age=31536000
Timing-Allow-Origin: *
Content-Type: image/gif
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
X-FB-Debug: N50KYmTcOOIcTLiz0DXqzC6ftJEBlIui6dYGz34FjuccN6 J2X24dZ8knPTKlFvRPZEm/fqC9UjLDtXL4 Qu9A==
Date: Tue, 29 Sep 2015 05:42:04 GMT
Connection: keep-alive
Content-Length: 3140
GIF89a..................................y........j.....d|.u..}...........................................................n..............w..............Sn......................................................................................................................................................................q...................................t....................p....................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0280117407206811B42AB08EEDFBFF03" xmpMM:DocumentID="xmp.did:D45F7D93583711E0A1AB8A6CE8208B7E" xmpMM:InstanceID="xmp.iid:D45F7D92583711E0A1AB8A6CE8208B7E" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:467D404D11206811A72CAD457977F9AE" stRef:documentID="xmp.did:0280117407206811B42AB08EEDFBFF03"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;
<<< skipped >>>
GET /svn/trunk/html5.js HTTP/1.1
Accept: */*
Referer: hXXp://vista-tigabelas.blogspot.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: html5shiv.googlecode.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 29 Sep 2015 05:40:26 GMT
Server: Apache
Last-Modified: Thu, 26 Sep 2013 10:05:28 GMT
ETag: "32//trunk/html5.js"
Accept-Ranges: bytes
Expires: Tue, 29 Sep 2015 05:43:26 GMT
Content-Length: 2429
Content-Type: text/javascript
Cache-Control: public, max-age=180
Age: 96
/*. HTML5 Shiv v3.7.0 | @afarkas @jdalton @jon_neal @rem | MIT/GPL2 Licensed.*/.(function(l,f){function m(){var a=e.elements;return"string"==typeof a?a.split(" "):a}function i(a){var b=n[a[o]];b||(b={},h ,a[o]=h,n[h]=b);return b}function p(a,b,c){b||(b=f);if(g)return b.createElement(a);c||(c=i(b));b=c.cache[a]?c.cache[a].cloneNode():r.test(a)?(c.cache[a]=c.createElem(a)).cloneNode():c.createElem(a);return b.canHaveChildren&&!s.test(a)?c.frag.appendChild(b):b}function t(a,b){if(!b.cache)b.cache={},b.createElem=a.createElement,b.createFrag=a.createDocumentFragment,b.frag=b.createFrag();.a.createElement=function(c){return!e.shivMethods?b.createElem(c):p(c,a,b)};a.createDocumentFragment=Function("h,f","return function(){var n=f.cloneNode(),c=n.createElement;h.shivMethods&&(" m().join().replace(/[\w\-] /g,function(a){b.createElem(a);b.frag.createElement(a);return'c("' a '")'}) ");return n}")(e,b.frag)}function q(a){a||(a=f);var b=i(a);if(e.shivCSS&&!j&&!b.hasCSS){var c,d=a;c=d.createElement("p");d=d.getElementsByTagName("head")[0]||d.documentElement;c.innerHTML="x<style>article,aside,dialog,figcaption,figure,footer,header,hgroup,main,nav,section{display:block}mark{background:#FF0;color:#000}template{display:none}</style>";.c=d.insertBefore(c.lastChild,d.firstChild);b.hasCSS=!!c}g||t(a,b);return a}var k=l.html5||{},s=/^<|^(?:button|map|select|textarea|object|iframe|option|optgroup)$/i,r=/^(?:a|b|code|div|fieldset|h1|h2|h3|h4|h5|h6|i|label|li|ol|p|q|span|strong|style|table|tbody|td|th|tr|ul)$/i,j,o="_h
<<< skipped >>>
GET /?3IFwmxUXebISVHvic5bMQKSIRSRHo688 HTTP/1.1
Accept: */*
Referer: hXXp://vista-tigabelas.blogspot.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v2.zopim.com
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Date: Tue, 29 Sep 2015 05:42:02 GMT
Content-Type: application/octet-stream
Content-Length: 0
Connection: keep-alive
Set-Cookie: __cfduid=db23f0a1417fce7283265dbff48e70ba61443505322; expires=Wed, 28-Sep-16 05:42:02 GMT; path=/; domain=.zopim.com; HttpOnly
Location: hXXp://v2.zopim.com/bin/v/widget_v2.106.js
ETag: "5604b8c6-0"
Expires: Tue, 29 Sep 2015 08:58:22 GMT
Cache-Control: max-age=14400
Cache-Control: max-age=14400, public, must-revalidate, proxy-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 22d55cc919a92bac-AMS
....
GET /bin/v/widget_v2.106.js HTTP/1.1
Accept: */*
Referer: hXXp://vista-tigabelas.blogspot.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v2.zopim.com
Connection: Keep-Alive
Cookie: __cfduid=db23f0a1417fce7283265dbff48e70ba61443505322
HTTP/1.1 200 OK
Date: Tue, 29 Sep 2015 05:42:02 GMT
Content-Type: application/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Fri, 26 Sep 2025 05:42:02 GMT
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 22d55cc979b42bac-AMS
3d27..............y{.8.(.?.......!.t..0q.%,...Io...0...N.t.B.g.U...1$=.=....Y.%.J.R.T*mVo2...p`y..Oo.n.O..v.8....?r..?S..q.V....m.&.m..Z\......(...7.n..}.Y....Nx{..!..[....y.............{.#........~.....o.mB..7..x..h..... s.e...h<...c...[...4g.....".t........ .Y.x.. ..FK.F..]............b.H..%4.H.?^.0F..............K..........5{...Kh.F...0...u...7...%4. .7K.u...... ...4V...,i......>|C>|_.......wl..K....._Bd....\....n./..4..,.. ..N."'.......K.f..s........nL....e0........[d..E..".%.p..p...#d.hIeGX...%.?.`I..a..-...J..~..=..o..@..,.a.4L..a.|.,.0A.?...'.zz.*.,.a..v.i).$..YR...7^.pc. .t%H{..S4t..j=.........~z2.~zA....8=......?...g}...i....Fi/}..F0z...o..K.&ww.p.. I.........&...d4.\.Q.h........p.o....c...Q........ia.....a.i...l...:.....t.!b.&..G..[..`2.G.....mb..F......j..#....<..0|}.M.]8..._..{.1J..x"U....F.......4......}..|d.....(.. .....!O..e.....?$..N^.&.GX.........{,ksv..A....1.G..c...........8......1..^.../n......%0. .OI...(=.......7.%..$....1p.q.r#.....}8.w.....T,q......?......5}.u.......f..@.D...S;.9..".j".OX@7P..v8Af@o..... .[.....B...>e.!O.i.....).....c.h...2....$.......~.^< ^D...S....6............C)H(..>i...S...P....GR...|.....U.C..B..1;.....z...Ui....^Y.. e...c..!....._b..ALfL..z.Qg..A..)P..eJB...#.M^......y..n.O...$.?....~.O......Th...U.RKA%....b/..].y.....^...2Z.......<H...........Y.).p..2..,c.]#.'.<.tW.t........-.D..f..C..G..q.1.a.h.\.:~...q.R.Sv......Qe.........].V.....k.!N.)...@....H.m..{.$$t4...R`.6.`...c.Q....o1.|HC.....=R.O.{.S...>......kl...#..a...........G.......hEP
<<< skipped >>>
GET / HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vista-tigabelas.blogspot.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Expires: Tue, 29 Sep 2015 05:42:02 GMT
Date: Tue, 29 Sep 2015 05:42:02 GMT
Cache-Control: private, max-age=0
Last-Modified: Sun, 27 Sep 2015 20:51:19 GMT
ETag: "a7ea887d-e7e3-4c48-9685-2cb7d0432ac1"
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Length: 14349
Server: GSE
...........}.z.8....S ..HjS.%Y...9..t|&Nrb'=..|..@.c.T...(~.....n....&.I:.3..b.(......x........:!.`n..<._...Q...2....?*..`1h4........M.j..o. ........NmZ7.y..l.5.s......h...(,@o.....T.&<.......;!...kN.[W..........j5...#.n.tT..M...]i<..\[..^.....>}.L...X.S1.....<.q.3GQ.Q]}.....?..;.....?.1..G....tN...W.:2.S......B.......5.....b.......@.V..f<z'@..Ou..u...&<B.a.x...h.d.4.RJJi.Lj...p.@<cTj4.Zu...........7......gW........O_..~.v..KPc0.u.5y.m..v..K)......<h....u..........O...U .k,..JI....5.3.......3.....5!v@NOH.......Q..J..?.....H.6..r...t.9H.._..!%...w.1..{V....1\'..G.}...v.v......_&..'.'......e.8....f...-......r#.....<...C....Q.C.y<..]....3.|......y....o.C....o..v..-CCI..~m..ldR.IZc/..X...5...F.2...r..k7.{X..E.....T...y7..6zs....".k...u5*.s....K.....5.T1f.;g....Q{sX;v..h.n...i .!B6...>...JVDz[....h.U0.|P....?Y.e...b(:......L.|0....J.EU4.....U x....3.....Tx..H....JX&h...........R:>?m.v...H.1....N".R..,..gi..@!A.P.[P.ts.9.}......X..L.C,7.i..zh}........V.,9D....F l.70.........q..#..hW...0...2.w.|.?|H.F..%..,Y0.5.z.#5Gi .8...l._.>.....J.sX....D04..t.....Z....F..a'1a~.0.Z7|...L.f....^%.P.........CFuLo.;fDn^I..'2..#U....*...H.h....M@=G.e...9A...4. M....Q.mZ..H.".E...._...@..Pw..S.6.^.i...2i...... ... .%..(L.p....e..1JA..#m..k..../...-.&.....MF..adH.hU0.....A0.<?....6......L...hyn.`.... .........@..B. ......@.B.p...Qr.I....tJ..=a%Z.z....sIf..D.......Px..._.....s..........G.Q._."P.. M...K......9..N..q`zI.....$<..X...6.E.].H!...3..bM."..|"<Em..9......U.)5......a........u..oO
<<< skipped >>>
GET /favicon.ico HTTP/1.1
Accept: */*
Referer: hXXp://vista-tigabelas.blogspot.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vista-tigabelas.blogspot.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: image/x-icon
Expires: Tue, 29 Sep 2015 05:42:03 GMT
Date: Tue, 29 Sep 2015 05:42:03 GMT
Cache-Control: private, max-age=86400
Last-Modified: Sun, 27 Sep 2015 20:51:19 GMT
ETag: "a7ea887d-e7e3-4c48-9685-2cb7d0432ac1"
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Length: 795
Server: GSE
..........u.]lKa.._..Db.,].....v.i...w"!. !.....D...0!.D$.......Q3..\.D..p%.$.r!...W\..{V.do....9...>....1...3..}b.4!f.!4.[.../.9ML.\...:_K.l.n..`:....Ro<..o....B...z.Z.<4....U...<Eu"....A..S...[..<PX$!2...v..z.z....*9r...A(..x.:N.!.F..w;R....F... ..l..p.U.}........`.=dN..Q.........o.P.!j.E P.ys6#..A.w...... .U..t..(...>...-..L...A..sm...........Q^>.....z...*..?..."?L...~..:.!e%**......5....H........tz<......}....6...&....D...V.F..m....h.}.^..._........G`...W.A$RA.....}.E<:.7.z..ds....u...5.?.Db.df.2.'.t..u...=.l@:...l.v.}..;9..g...L'..O......H..Q[.$S.x\.Tz;0.V.d/.~...g...7Y.@..S.....w..x.z..K......go.......Ne..%...{4.{>#<......t..|...7c.=t..<d,........<X.~..~..z..o.c.?....i....I........9lk.6.a...Qz.P..fL..x.~C......A.?..{..y;.;.Q;.mjB..q...fd[v............ D...p....L.^.l.."......~.....
GET /en_US/all.js HTTP/1.1
Accept: */*
Referer: hXXp://vista-tigabelas.blogspot.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: connect.facebook.net
Connection: Keep-Alive
HTTP/1.1 200 OK
ETag: "35d3ec4731a74aa8d2b7bebb6c8a4c89"
Content-Type: application/x-javascript; charset=utf-8
Timing-Allow-Origin: *
Vary: Accept-Encoding
Content-Encoding: gzip
Content-MD5: M4gGc94dKEVZWRLgf6Y7ag==
X-FB-Debug: Eg8Nn05ISHdWP5ELAMyuJE2HFGKK6yIA5O85QwGn2Ozbdhv2hf w/QUgI/jNl opHCZBD92 XetbfO0/6X7mg==
Content-Length: 54473
Cache-Control: public, max-age=1200
Expires: Tue, 29 Sep 2015 06:02:03 GMT
Date: Tue, 29 Sep 2015 05:42:03 GMT
Connection: keep-alive
............k..H.7...>...1.6-.vN-....a&..I6IO......h..%.".....?..U."E.NO......Su..........O..=m>m.>.......&...l...d..].......#/.t~......?.?...j?P...,..d..A/.&...a.kP.r..z.$.......j. ....=..r....YJ]...M..d.....}}...d#.]..R:.....w........'........\7..T[.k.....].d...?W.....y..I.W.'..8.d&..S.\..>.&4t.v.D.ZS..0....dn...<...d..*...t....`....*EV[)$.1.N....w:T.F..]..........^...d.`..'.q'...y?L.j..L&I.d.........,.N....F:.'...@N./...oR#o.....V...5tga6.Mj.y,..Q.6eg..09.E[...p;....?...W....$.fC..V....^.4.....H..y.z.....Y.f..=.Z.Io..S.6..,..;;......l.\...R..;..g.T965..4.......z.z.Q.........g...s..5r..nc.D..G.)m.q......rv./...@..~a.^.}D..J&..I......,pj...G....|..e....e...... 1f.~.>$.L.qhA.fJ......%..[.<_..^`.....W..]..Q;.Q.......3S.$2...Bk..^e.X?.{&...X6... ={c.[...7zA.......7.I....X.............x>. .G7.u.vp29.......P..am......ga.u...lv..}..iX(.....~8O..p..ojyP.....7...h2..Y...U......H..........].. ..w.n..P.y.A>.......2....,..G...t...@..M. .=...O..8..1..U'.z{K.)...?.w..K..>..i2.R.....c..s..^c....'.g.M/..............(....Z..f.um.^...f.......9...5j.F.P....f0.}..^.]....E..NS/....G8s.H....r.....!i...Q;..u..u.....I|..z.-..@kH......-.. .h..........5.)C}Ve...\.W..0.$.....,.........}?jL......CG.|.....&.V&O..8@.{..Fo..4.C..p..[ .p........\....D8.n.B..u.a.Z}._.^..~x.....i..(...:..U.Mf.....A..F...w_.....[B.,.X.....#.........X.uq.n9...u.J1.9......5....Q...4E....5..}..a....;".......#.:....4.'.3?...=$Q..%......R;....... .Q.S......t._..M...DoH..xuR.....kof..y...i.......pv.......;.{. .-.H....1.~LK2&RB}.1z......
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
iexplore.exe_1276:
%?9-*09,*19}*09
%?9-*09,*19}*09
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
SHDOCVW.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
IE-X-X
rsabase.dll
rsabase.dll
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
dw15 -x -s %u
watson.microsoft.com
watson.microsoft.com
IEWatsonURL
IEWatsonURL
%s -h %u
%s -h %u
iedw.exe
iedw.exe
Iexplore.XPExceptionFilter
Iexplore.XPExceptionFilter
jscript.DLL
jscript.DLL
mshtml.dll
mshtml.dll
mlang.dll
mlang.dll
urlmon.dll
urlmon.dll
wininet.dll
wininet.dll
shdocvw.DLL
shdocvw.DLL
browseui.DLL
browseui.DLL
comctl32.DLL
comctl32.DLL
IEXPLORE.EXE
IEXPLORE.EXE
iexplore.pdb
iexplore.pdb
ADVAPI32.dll
ADVAPI32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
IExplorer.EXE
IExplorer.EXE
IIIIIB(II<.fg>
IIIIIB(II<.fg>
7?_____ZZSSH%
7?_____ZZSSH%
)z.UUUUUUUU
)z.UUUUUUUU
,....Qym
,....Qym
````2```
````2```
{.QLQIIIKGKGKGKGKGKG
{.QLQIIIKGKGKGKGKGKG
;33;33;0
;33;33;0
8888880
8888880
8887080
8887080
browseui.dll
browseui.dll
shdocvw.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512
Injection.exe_1940:
.packed
.packed
.RLPack
.RLPack
kernel32.dll
kernel32.dll
Windows
Windows
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
oleaut32.dll
EVariantBadIndexError
EVariantBadIndexError
ssShift
ssShift
htKeyword
htKeyword
EInvalidOperation
EInvalidOperation
u%CNu
u%CNu
%s_%d
%s_%d
EInvalidGraphicOperation
EInvalidGraphicOperation
USER32.DLL
USER32.DLL
comctl32.dll
comctl32.dll
uxtheme.dll
uxtheme.dll
Proportional
Proportional
MAPI32.DLL
MAPI32.DLL
!"#$%d
!"#$%d
PasswordChar
PasswordChar
OnKeyDown
OnKeyDown
OnKeyPress
OnKeyPress
OnKeyUp
OnKeyUp
OnKeyUp|
OnKeyUp|
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
JumpID("","%s")
TKeyEvent
TKeyEvent
TKeyPressEvent
TKeyPressEvent
HelpKeyword|
HelpKeyword|
crSQLWait
crSQLWait
%s (%s)
%s (%s)
imm32.dll
imm32.dll
AutoHotkeys
AutoHotkeys
ssHotTrack
ssHotTrack
TWindowState
TWindowState
poProportional
poProportional
TWMKey
TWMKey
KeyPreview
KeyPreview
WindowState
WindowState
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
vcltest3.dll
User32.dll
User32.dll
pbSA.exe
pbSA.exe
333333333333333333
333333333333333333
33333833
33333833
3333339
3333339
3333333333333338
3333333333333338
:*"*"$3338
:*"*"$3338
3333333
3333333
33333333
33333333
33333333333
33333333333
3333333333338
3333333333338
33338?383
33338?383
333333333333
333333333333
:*3:"$3338
:*3:"$3338
333333333333333
333333333333333
KWindows
KWindows
UrlMon
UrlMon
Font.Charset
Font.Charset
Font.Color
Font.Color
Font.Height
Font.Height
Font.Name
Font.Name
Font.Style
Font.Style
Picture.Data
Picture.Data
PointBlank.exe
PointBlank.exe
Dynamic Link Library (DLL)|*.dll
Dynamic Link Library (DLL)|*.dll
%SEoM
%SEoM
94T%x
94T%x
sMtp
sMtp
o:.Lk>d
o:.Lk>d
.Kl,P]
.Kl,P]
%XYbY}
%XYbY}
Keyw;
Keyw;
hV%u'
hV%u'
njX%S
njX%S
@%F?-
@%F?-
USER32.DqL
USER32.DqL
t.BP(
t.BP(
$%CY^B
$%CY^B
9CMDX@
9CMDX@
_vo%ug
_vo%ug
"#$%d
"#$%d
9@gKey
9@gKey
%u#mV
%u#mV
.EO=l(xH'
.EO=l(xH'
%xiED!ºx
%xiED!ºx
x(t7.aFz
x(t7.aFz
%s g(
%s g(
W"%dH
W"%dH
.EWY(
.EWY(
0DÃ
0DÃ
<.an.>
<.an.>
JCh;go.ry
JCh;go.ry
tR>'\%cT
tR>'\%cT
%Cl_RA
%Cl_RA
T$%Ci~?
T$%Ci~?
@keys
@keys
4567890
4567890
tÖ!G
tÖ!G
uDPj#D
uDPj#D
6tÃ_
6tÃ_
0R;B0%uGU
0R;B0%uGU
x.LG
x.LG
12345678
12345678
.cPl3Qh
.cPl3Qh
%s
%s
I%x*~@D'
I%x*~@D'
o%xRW
o%xRW
UdPK
UdPK
.HKrT
.HKrT
_%ug8'3
_%ug8'3
u_ q\.lX
u_ q\.lX
h 4c%X-
h 4c%X-
,* 71.02-(^
,* 71.02-(^
dÃTHqd
dÃTHqd
.QHIb
.QHIb
IDm%D
IDm%D
DK.AN
DK.AN
%xBTPt
%xBTPt
No help keyword specified.
No help keyword specified.
No help found for %s#No context-sensitive help installed$No topic-based help system installed
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Unable to insert a line Clipboard does not support Icons/Menu '%s' is already being used by another form
Unable to insert a line Clipboard does not support Icons/Menu '%s' is already being used by another form
Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count
Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count
Unsupported clipboard format
Unsupported clipboard format
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
List capacity out of bounds (%d)
List capacity out of bounds (%d)
List count out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Error reading %s%s%s: %s
Resource %s not found
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Property %s does not exist
Cannot assign a %s to a %s
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot create file "%s". %s
Cannot open file "%s". %s
Cannot open file "%s". %s
Unable to write to %s
Unable to write to %s
Invalid stream format$''%s'' is not a valid component name
Invalid stream format$''%s'' is not a valid component name
Ancestor for '%s' not found
Ancestor for '%s' not found
External exception %x
External exception %x
Interface not supported
Interface not supported
%s (%s, line %d)
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
System Error. Code: %d.
"Variant method calls not supported
"Variant method calls not supported
Invalid variant operation%Invalid variant operation (%s%.8x)
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
Operation not supported
Integer overflow Invalid floating point operation
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'
No argument for format '%s'
!'%s' is not a valid integer value('%s' is not a valid floating point value
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
'%s' is not a valid time!'%s' is not a valid date and time
I/O error %d
I/O error %d
1.0.0.0
1.0.0.0
Injection.exe_1940_rwx_00401000_00063000:
kernel32.dll
kernel32.dll
Windows
Windows
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
oleaut32.dll
EVariantBadIndexError
EVariantBadIndexError
ssShift
ssShift
htKeyword
htKeyword
EInvalidOperation
EInvalidOperation
u%CNu
u%CNu
%s_%d
%s_%d
EInvalidGraphicOperation
EInvalidGraphicOperation
USER32.DLL
USER32.DLL
comctl32.dll
comctl32.dll
uxtheme.dll
uxtheme.dll
Proportional
Proportional
MAPI32.DLL
MAPI32.DLL
!"#$%d
!"#$%d
PasswordChar
PasswordChar
OnKeyDown
OnKeyDown
OnKeyPress
OnKeyPress
OnKeyUp
OnKeyUp
OnKeyUp|
OnKeyUp|
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
JumpID("","%s")
TKeyEvent
TKeyEvent
TKeyPressEvent
TKeyPressEvent
HelpKeyword|
HelpKeyword|
crSQLWait
crSQLWait
%s (%s)
%s (%s)
imm32.dll
imm32.dll
AutoHotkeys
AutoHotkeys
ssHotTrack
ssHotTrack
TWindowState
TWindowState
poProportional
poProportional
TWMKey
TWMKey
KeyPreview
KeyPreview
WindowState
WindowState
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
vcltest3.dll
User32.dll
User32.dll
pbSA.exe
pbSA.exe
Injection.exe_1940_rwx_00465000_00052000:
333333333333333333
333333333333333333
33333833
33333833
3333339
3333339
3333333333333338
3333333333333338
:*"*"$3338
:*"*"$3338
3333333
3333333
33333333
33333333
33333333333
33333333333
3333333333338
3333333333338
33338?383
33338?383
333333333333
333333333333
:*3:"$3338
:*3:"$3338
333333333333333
333333333333333
KWindows
KWindows
UrlMon
UrlMon
Font.Charset
Font.Charset
Font.Color
Font.Color
Font.Height
Font.Height
Font.Name
Font.Name
Font.Style
Font.Style
Picture.Data
Picture.Data
PointBlank.exe
PointBlank.exe
Dynamic Link Library (DLL)|*.dll
Dynamic Link Library (DLL)|*.dll
No help keyword specified.
No help keyword specified.
No help found for %s#No context-sensitive help installed$No topic-based help system installed
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Unable to insert a line Clipboard does not support Icons/Menu '%s' is already being used by another form
Unable to insert a line Clipboard does not support Icons/Menu '%s' is already being used by another form
Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count
Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count
Unsupported clipboard format
Unsupported clipboard format
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
List capacity out of bounds (%d)
List capacity out of bounds (%d)
List count out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Error reading %s%s%s: %s
Resource %s not found
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Property %s does not exist
Cannot assign a %s to a %s
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot create file "%s". %s
Cannot open file "%s". %s
Cannot open file "%s". %s
Unable to write to %s
Unable to write to %s
Invalid stream format$''%s'' is not a valid component name
Invalid stream format$''%s'' is not a valid component name
Ancestor for '%s' not found
Ancestor for '%s' not found
External exception %x
External exception %x
Interface not supported
Interface not supported
%s (%s, line %d)
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
System Error. Code: %d.
"Variant method calls not supported
"Variant method calls not supported
Invalid variant operation%Invalid variant operation (%s%.8x)
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
Operation not supported
Integer overflow Invalid floating point operation
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'
No argument for format '%s'
!'%s' is not a valid integer value('%s' is not a valid floating point value
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
'%s' is not a valid time!'%s' is not a valid date and time
I/O error %d
I/O error %d
1.0.0.0
1.0.0.0
Injection.exe_1940_rwx_00542000_00001000:
kernel32.dll
kernel32.dll