Trojan.Win32.Swrort_a8d1448419 – Adaware

Trojan.Win32.Swrort.4.FD, TrojanSwrort.YR, BankerGeneric.YR (Lavasoft MAS)Behaviour: Banker, Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: a8d14484191f81e25e7d8ac396dbf9bf

SHA1: 4faa4cdb4a25a0a82028ffb7cbd01b555ae2a5fd

SHA256: 3283fb195a7a308b64ad6ca989c0b472a1a5d6a01f201921f90b0dbba846e816

SSDeep: 24576:MXJ3nvZG/S8H4rY4S5l1xyNoFD03cLWt1qzhGeglQYms:MXdnvZn8H2Y3NxyNVt8zhGepC

Size: 1040024 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: CUZRI

Created at: 2014-08-25 17:55:22

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:1932

Mutexes

The following mutexes were created/opened:

ShimCacheMutex__DDrawCheckExclMode____DDrawExclMode__DDrawDriverObjectListMutexDDrawWindowListMutex

File activity

The process %original file name%.exe:1932 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\licence.txt (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VLC-Media-Player-Artikelbild.jpg (22548 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amazon.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sdaspwn.exe (5662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sdapskill.exe (3635 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sdanircmdc.exe (1960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Giga-G-3d.png (1924 bytes)

Registry activity

The process %original file name%.exe:1932 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 C6 D4 62 FD 44 9E C2 A3 76 C8 50 60 4F A5 46"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\MCD]
"IO Priority" = "0"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1408978522"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\MCD]
"SwapSync" = "1"

[HKCU\Software\Sysinternals\PsKill]
"EulaAccepted" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\MCD]
"Use Generic Stencil" = "1"
"Enumerate as ICD" = "0"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\MCD]
"Enable" = "1"
"Palettized Formats" = "1"

Dropped PE files

MD5	File path
b22171908e066ee0445fce6c8ea30633	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\sdanircmdc.exe
b5891462c9ca5bddfe63d3bae3c14e0b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\sdapskill.exe
7f86945096d03786e6b69dc9f186b432	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\sdaspwn.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\licence.txt (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VLC-Media-Player-Artikelbild.jpg (22548 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amazon.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sdaspwn.exe (5662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sdapskill.exe (3635 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sdanircmdc.exe (1960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Giga-G-3d.png (1924 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	1961984	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	1966080	1007616	1005056	5.49853	4dc333a3949c642fb5ba49e6e8860b46
.rsrc	2973696	28672	28160	4.10297	2291d836594b1ac3fb0dde7b821a64b8

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/track.php?download_id=5479909&session_id=1446337&event_id=1&type_id=2&object_id=0&project=GIGA	80.86.80.170
hxxp://www.giga.de/static/files/sda/licence.txt	80.86.80.170
hxxp://www.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/track.php?download_id=5479909&session_id=1446337&event_id=15&type_id=4&object_id=0&project=GIGA	80.86.80.170
hxxp://www.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/track.php?download_id=5479909&session_id=1446337&event_id=1&type_id=5&object_id=0&project=GIGA	80.86.80.170
hxxp://www.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/track.php?download_id=5479909&session_id=1446337&event_id=3&type_id=5&object_id=0&project=GIGA	80.86.80.170
hxxp://www.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/config.php?format=json&id=5479909	80.86.80.170
hxxp://downloads.giga.de/sda/amazon.png	80.86.80.176
hxxp://media2.giga.de/2014/07/VLC-Media-Player-Artikelbild.jpg	80.86.80.168
hxxp://downloads.giga.de/sda/Giga-G-3d.png	80.86.80.176
hxxp://www.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/track.php?download_id=5479909&session_id=1446337&event_id=6&type_id=5&object_id=0&project=GIGA	80.86.80.170
hxxp://www.giga.dehxxp://www.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/track.php?download_id=5479909&session_id=1446337&event_id=1&type_id=5&object_id=0&project=GIGA	80.86.80.170
hxxp://www.giga.dehxxp://www.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/track.php?download_id=5479909&session_id=1446337&event_id=15&type_id=4&object_id=0&project=GIGA	80.86.80.170
hxxp://www.giga.dehxxp://www.giga.de/static/files/sda/licence.txt	80.86.80.170
hxxp://downloads.giga.dehxxp://downloads.giga.de/sda/amazon.png	80.86.80.176
hxxp://media2.giga.dehxxp://media2.giga.de/2014/07/VLC-Media-Player-Artikelbild.jpg	80.86.80.168
hxxp://downloads.giga.dehxxp://downloads.giga.de/sda/Giga-G-3d.png	80.86.80.176
hxxp://www.giga.dehxxp://www.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/track.php?download_id=5479909&session_id=1446337&event_id=1&type_id=2&object_id=0&project=GIGA	80.86.80.170
hxxp://www.giga.dehxxp://www.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/track.php?download_id=5479909&session_id=1446337&event_id=6&type_id=5&object_id=0&project=GIGA	80.86.80.170
hxxp://www.giga.dehxxp://www.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/config.php?format=json&id=5479909	80.86.80.170
hxxp://www.giga.dehxxp://www.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/track.php?download_id=5479909&session_id=1446337&event_id=3&type_id=5&object_id=0&project=GIGA	80.86.80.170

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET hXXp://VVV.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/config.php?format=json&id=5479909 HTTP/1.1

Host: VVV.giga.de

Connection: close

Accept-Encoding:

Cache-Control: no-cache, no-store

Pragma: no-cache

User-Agent: econa-sda

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 29 Jun 2015 21:28:16 GMT

Content-Type: text/json; charset=ISO-8859-1

Connection: close

X-Powered-By: PHP/5.5.23

Content-Length: 2243

Expires: Wed, 29 Jul 2015 21:28:16 GMT

Cache-Control: max-age=2592000

X-Content-Type-Options: nosniff

{"date":"2014-08-30 18:32:22","browser":{"type":"Chrome","version":"36.0.1985.143"},"file":{"id":"75087","name":"VLC Media Player","image_url":"http:\/\/media2.giga.de\/2014\/07\/VLC-Media-Player-Artikelbild.jpg","download_url":"https:\/\/files.giga-downloads.de\/multimedia\/vlc-2.2.1-win64.exe","download_type":"download","description_url":"http:\/\/VVV.giga.de\/downloads\/vlc-media-player\/"},"main_bundle":[{"id":5,"name":"GIGA Startseite","headline":"","description":"GIGA als Startseite im Browser festlegen","icon_file":"http:\/\/downloads.giga.de\/sda\/Giga-G-3d.png","download_url":"","privacy_url":"http:\/\/VVV.giga.de\/info\/datenschutz\/","disclaimer_text":"Wenn du dich f\u00fcr die GIGA Startseite entschieden hast, stimmst du durch Klick auf \"Weiter\" den GIGA |LDatenschutzbestimmungen::http:\/\/VVV.giga.de\/info\/datenschutz\/|L zu.","install_params":"http:\/\/VVV.giga.de\/?utm_source=SDA&utm_medium=plugin&utm_campaign=april2015","install_type":"startpage","install_blocking":"0","require_browser_close":"0","default_activated":"1","browser_in":"","options":[{"id":12,"name":"Startseite","description":"GIGA als Startseite im Browser festlegen","value":"1","required":"1","param_on":"","param_off":"","fn_mod_on":"","fn_mod_off":""}]}],"additional_bundles":[{"id":4,"name":"Amazon Icon","headline":"","description":"Verkn\u00fcpfung zu Amazon auf dem Desktop erstellen","icon_file":"http:\/\/downloads.giga.de\/sda\/amazon.png","download_url":"http:\/\/VVV.giga.de\/static\/files\/sda\/econa\/amazonicon_v10.exe",

<<< skipped >>>

HEAD hXXp://downloads.giga.de/sda/amazon.png HTTP/1.1

Host: downloads.giga.de

Connection: close

Accept-Encoding:

Cache-Control: no-cache, no-store

Pragma: no-cache

User-Agent: econa-sda

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 29 Jun 2015 21:28:18 GMT

Content-Type: image/png

Content-Length: 1532

Last-Modified: Wed, 29 Aug 2012 08:58:35 GMT

Connection: close

Accept-Ranges: bytes

GET hXXp://VVV.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/track.php?download_id=5479909&session_id=1446337&event_id=6&type_id=5&object_id=0&project=GIGA HTTP/1.1

Host: VVV.giga.de

Connection: close

Accept-Encoding:

Cache-Control: no-cache, no-store

Pragma: no-cache

User-Agent: econa-sda

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 29 Jun 2015 21:28:19 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.5.23

Content-Length: 0

Expires: Wed, 29 Jul 2015 21:28:19 GMT

Cache-Control: max-age=2592000

X-Content-Type-Options: nosniff

HEAD hXXp://downloads.giga.de/sda/Giga-G-3d.png HTTP/1.1

Host: downloads.giga.de

Connection: close

Accept-Encoding:

Cache-Control: no-cache, no-store

Pragma: no-cache

User-Agent: econa-sda

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 29 Jun 2015 21:28:20 GMT

Content-Type: image/png

Content-Length: 23548

Last-Modified: Wed, 29 Aug 2012 08:58:35 GMT

Connection: close

Accept-Ranges: bytes

GET hXXp://VVV.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/track.php?download_id=5479909&session_id=1446337&event_id=1&type_id=5&object_id=0&project=GIGA HTTP/1.1

Host: VVV.giga.de

Connection: close

Accept-Encoding:

Cache-Control: no-cache, no-store

Pragma: no-cache

User-Agent: econa-sda

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 29 Jun 2015 21:28:15 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.5.23

Content-Length: 0

Expires: Wed, 29 Jul 2015 21:28:15 GMT

Cache-Control: max-age=2592000

X-Content-Type-Options: nosniff

HEAD hXXp://media2.giga.de/2014/07/VLC-Media-Player-Artikelbild.jpg HTTP/1.1

Host: media2.giga.de

Connection: close

Accept-Encoding:

Cache-Control: no-cache, no-store

Pragma: no-cache

User-Agent: econa-sda

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 29 Jun 2015 21:28:18 GMT

Content-Type: image/jpeg

Connection: close

Last-Modified: Mon, 02 Mar 2015 17:27:36 GMT

ETag: "2f8ca9d-2a77a-5105188bc7200"

Accept-Ranges: bytes

Content-Length: 173946

Cache-Control: max-age=172800

Expires: Wed, 01 Jul 2015 21:28:18 GMT

X-Cache-Status: desktop:MISS

Pragma: public

Cache-Control: max-age=172800, public, must-revalidate, proxy-revalidate

X-Content-Type-Options: nosniff

GET hXXp://media2.giga.de/2014/07/VLC-Media-Player-Artikelbild.jpg HTTP/1.1

Host: media2.giga.de

Range: bytes=0-

Connection: close

Accept-Encoding:

Cache-Control: no-cache, no-store

Pragma: no-cache

User-Agent: econa-sda

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 29 Jun 2015 21:28:18 GMT

Content-Type: image/jpeg

Connection: close

Content-Length: 173946

ETag: "2f8ca9d-2a77a-5105188bc7200"

Accept-Ranges: bytes

Cache-Control: max-age=172800

Expires: Wed, 01 Jul 2015 21:28:18 GMT

Last-Modified: Mon, 29 Jun 2015 21:28:18 GMT

X-Content-Type-Options: nosniff

X-Cache-Status: desktop:MISS

Pragma: public

Cache-Control: max-age=172800, public, must-revalidate, proxy-revalidate

X-Content-Type-Options: nosniff

......JFIF.....H.H......Created with GIMP...C....................................................................C.......................................................................h.............................................................................................x.....LZ..=r.*"..M.].2.Z{X.o.Fb..R.W=..........D.....p.....D...p.d@....................#.5...b)&!.j...w.eY.5.Xm..0.>......E.o.................Nv........5y<.2GPH..... <t&...Xub.in...0.Goc.b`..L5.QuCT]E.5...`\!.&U..j;E.a.&..............Z.#s.............EkY.4...X..V.4.Z.. .!Z.d..O...t.............}-*L.u',..::..Y.=7,\............v. .d....3&.;...vc..f............!..`...P.........L..E..\.&..&..( (...W..&..........=....k .*....TOQ.p*....,7..Q9q.Zn..2.5W:0.....r..|......8....tU.`....J..@..B&.nM......V"9%&..\......{...M.......:.....'Om~...&.<.......L90......|..=.N............}..}.o.q:.....u...b.[."t\.&.j.&....{.rl....n...O5.V.=.......J...t.M']&.....^...Q.....5.Q9......b4ecw .......R2%..J.J.{_......._....Q.'b.u.w.|..$...Ud..{t.8.Z.,;..=..\.............6C...o......./.#y.}V/...5..X.....F)\.pX...{...lC...v....o.......xmG.7...j..a9.......e.L@.i.Xv.V..v[O.....<K.....{. .1.^.nS.x........o..<hG.p..Tfk....Q7..V.5.r.:5...FH...J..X...7.....T..........y:.....b.I3]....U..]...8...3%c.Zc.gA.w...\.~.=..)...j.o......B.......J..mqI..|.......Gx.O...VoC;<i.e..9.U.t6..Td..../@.....z6....}R...F)...r0x..w.R...a#c\.S1...H.=.........RV{..8_...@........2U..>`......\.^c...t0oi.fJ.......=M&..T%{...l~=.N?N...c.f...$..$N.".k.~.=.3...r.....Y.....D.O{. .

<<< skipped >>>

GET hXXp://VVV.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/track.php?download_id=5479909&session_id=1446337&event_id=3&type_id=5&object_id=0&project=GIGA HTTP/1.1

Host: VVV.giga.de

Connection: close

Accept-Encoding:

Cache-Control: no-cache, no-store

Pragma: no-cache

User-Agent: econa-sda

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 29 Jun 2015 21:28:15 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.5.23

Content-Length: 0

Expires: Wed, 29 Jul 2015 21:28:15 GMT

Cache-Control: max-age=2592000

X-Content-Type-Options: nosniff

GET hXXp://downloads.giga.de/sda/amazon.png HTTP/1.1

Host: downloads.giga.de

Range: bytes=0-

Connection: close

Accept-Encoding:

Cache-Control: no-cache, no-store

Pragma: no-cache

User-Agent: econa-sda

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 29 Jun 2015 21:28:18 GMT

Content-Type: image/png

Content-Length: 1532

Last-Modified: Wed, 29 Aug 2012 08:58:35 GMT

Connection: close

Content-Range: bytes 0-1531/1532

.PNG........IHDR... ... .....szz.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....kIDATXG...L.U..........#.. ...2..H`.Od.......?...G..M.c...j...MIM...\NR...d:.".B.J....y.o..t_..W...l...=.9..=?.....4...q...I..f...|..N".in..h4..'.........V...........N.....8c...hIc.............`..}H..y.PYY...#B...I..............t...=99.==="......v.$.mmm.:u....".,X..0DD.D.l...FBB.}.]..~...@JJ."##..I.....pn....9r.....//......(..v..a.......H.;...[.n.... V.Q);.B....:....li'.03P...t....%%%...Czz:.......7...S.%K......J....$.g\".4.J......M...dH.322..,Z...2.p..Y.""k...>.<y.UUU(**... ..........A..766b..e....f.>.#.........hxP"..' `.......`..H....X.f..n7...uN.-h..8.X.\..ow.....c`@.%...X.%.S@.....8?.....R: ...d...L.! :.0.............[.G|...T..;.......@....t.d...b..m......BHH._{.. ....z..U.V.F7....RPP.(V..g...&.d..#O.%$..r...;:;;..N.2E..$..%ER.X......,...........3.R?...3M..(..(**.aaa~.".....a"..ya7.C........0oH6.a'.r.......E$77....~9c...:}..n.qz...S..?........MZ.....&.;..w.......!.,g.,.\L...../,,..v....K........W..S.8{..bX.]...;H^".e...........P}....#??..d.........%.. ...J....`4..E..&...5i.M..L?..X./...}.. ..\.u.......w.P)2...U.O....Gk.6.E7T.30?t.h.gn>..../$.tY".$<87trq...h....~..u.,.F...En:....{S;.H.. 0/......y:.GA0......w..n.=.......<b..._...gyn@.*..;....k.A.|......6..r..w..q ..Ka.x...,...`.].....}3...`...D/.!k.........e{z-.M...0.=.............=.'..{Ca.N.So...cY.]$jD.....1.#.$...u=w..A.rT.H...l..:..&G...L3..8.".W~.s...(..nL..?2.{. r..&.2K....e.%.B.UxtR.......8..".\..L..O...F..K9..}.

<<< skipped >>>

GET hXXp://downloads.giga.de/sda/Giga-G-3d.png HTTP/1.1

Host: downloads.giga.de

Range: bytes=0-

Connection: close

Accept-Encoding:

Cache-Control: no-cache, no-store

Pragma: no-cache

User-Agent: econa-sda

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 29 Jun 2015 21:28:20 GMT

Content-Type: image/png

Content-Length: 23548

Last-Modified: Wed, 29 Aug 2012 08:58:35 GMT

Connection: close

Content-Range: bytes 0-23547/23548

.PNG........IHDR.............\r.f....pHYs...........~....OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<< skipped >>>

GET hXXp://VVV.giga.de/static/files/sda/licence.txt HTTP/1.1

Host: VVV.giga.de

Range: bytes=0-

Connection: close

Accept-Encoding:

Cache-Control: no-cache, no-store

Pragma: no-cache

User-Agent: econa-sda

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 29 Jun 2015 21:28:15 GMT

Content-Type: text/plain; charset=UTF-8

Content-Length: 3645

Connection: close

Vary: Accept-Encoding

Last-Modified: Tue, 24 Mar 2015 09:11:31 GMT

ETag: "3c44bf2-e3d-512052b20094b"

Expires: Wed, 01 Jul 2015 21:28:15 GMT

Cache-Control: max-age=172800

X-Cache-Status: desktop:HIT

Pragma: public

Cache-Control: max-age=172800, public, must-revalidate, proxy-revalidate

X-Content-Type-Options: nosniff

Content-Range: bytes 0-3644/3645

Endnutzerlizenzvereinbarung..1. Der "Software Download Assistent von giga.de" (nachfolgend SDA) ist ein kostenloser Service der Webseite www.giga.de. Dem Kunden wird mit dem Download des SDA ein nicht ausschlie.liches, zeitlich unbegrenztes, nicht-.bertragbares, unentgeltliches Nutzungsrecht einger.umt. Es bezieht sich ausschlie.lich auf das Downloaden der auf der Webseite VVV.giga.de von der GIGA Digital AG angebotenen Software-Programme anderer Anbieter. F.r die mit Hilfe des SDA von der GIGA Digital AG heruntergeladenen Software-Programme gelten die Lizenzbedingungen des jeweiligen Software-Anbieters...2. Alle sonstigen Rechte am SDA, insbesondere das Recht der Vervielf.ltigung, Verbreitung sowie .bersetzungen, bleiben bei der GIGA Digital AG. Die .berlassung von Quellprogrammen ist ausgeschlossen...3. Kopien des SDA d.rfen nur f.r Archivzwecke, als Ersatz oder zur Fehlersuche angefertigt werden...4. GIGA Digital AG gew.hrleistet, dass der SDA mit der gebotenen Sorgfalt und Fachkenntnis erstellt worden und dass der SDA frei von Viren, Trojanern oder .hnlichen Schadprogrammen ist. F.r den v.lligen Ausschluss von etwaigen Fehlern des SDA .bernimmt GIGA Digital AG jedoch keinerlei Gew.hr. GIGA Digital AG .bernimmt auch keinerlei Gew.hr oder Haftung f.r die mit Hilfe des SDA von der Webseite von GIGA Digital AG heruntergeladene Fremdsoftware (siehe auch Ziffer 1 letzter Satz)...5. GIGA Digital AG haftet ansonsten nur f.r Sch.den, die durch fehlende von ihr zugesicherte Eigenschaften entstanden sind, sowie f.r Sc

<<< skipped >>>

HEAD hXXp://downloads.giga.de/sda/amazon.png HTTP/1.1

Host: downloads.giga.de

Connection: close

Accept-Encoding:

Cache-Control: no-cache, no-store

Pragma: no-cache

User-Agent: econa-sda

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 29 Jun 2015 21:28:18 GMT

Content-Type: image/png

Content-Length: 1532

Last-Modified: Wed, 29 Aug 2012 08:58:35 GMT

Connection: close

Accept-Ranges: bytes

HEAD hXXp://VVV.giga.de/static/files/sda/licence.txt HTTP/1.1

Host: VVV.giga.de

Connection: close

Accept-Encoding:

Cache-Control: no-cache, no-store

Pragma: no-cache

User-Agent: econa-sda

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 29 Jun 2015 21:28:15 GMT

Content-Type: text/plain; charset=UTF-8

Connection: close

Vary: Accept-Encoding

Last-Modified: Tue, 24 Mar 2015 09:11:31 GMT

ETag: "3c44bf2-e3d-512052b20094b"

Content-Length: 3645

Expires: Wed, 01 Jul 2015 21:28:15 GMT

Cache-Control: max-age=172800

X-Cache-Status: desktop:HIT

Pragma: public

Cache-Control: max-age=172800, public, must-revalidate, proxy-revalidate

X-Content-Type-Options: nosniff

Accept-Ranges: bytes

GET hXXp://VVV.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/track.php?download_id=5479909&session_id=1446337&event_id=15&type_id=4&object_id=0&project=GIGA HTTP/1.1

Host: VVV.giga.de

Connection: close

Accept-Encoding:

Cache-Control: no-cache, no-store

Pragma: no-cache

User-Agent: econa-sda

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 29 Jun 2015 21:28:15 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.5.23

Content-Length: 0

Expires: Wed, 29 Jul 2015 21:28:15 GMT

Cache-Control: max-age=2592000

X-Content-Type-Options: nosniff

GET hXXp://downloads.giga.de/sda/amazon.png HTTP/1.1

Host: downloads.giga.de

Range: bytes=0-

Connection: close

Accept-Encoding:

Cache-Control: no-cache, no-store

Pragma: no-cache

User-Agent: econa-sda

HTTP/1.1 206 Partial Content

Server: nginx

Date: Mon, 29 Jun 2015 21:28:18 GMT

Content-Type: image/png

Content-Length: 1532

Last-Modified: Wed, 29 Aug 2012 08:58:35 GMT

Connection: close

Content-Range: bytes 0-1531/1532

<<< skipped >>>

GET hXXp://VVV.giga.de/wp-content/plugins/econa-basic/features/sda-advanced/api/track.php?download_id=5479909&session_id=1446337&event_id=1&type_id=2&object_id=0&project=GIGA HTTP/1.1

Host: VVV.giga.de

Connection: close

Accept-Encoding:

Cache-Control: no-cache, no-store

Pragma: no-cache

User-Agent: econa-sda

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 29 Jun 2015 21:28:14 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.5.23

Content-Length: 0

Expires: Wed, 29 Jul 2015 21:28:14 GMT

Cache-Control: max-age=2592000

X-Content-Type-Options: nosniff

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1932:

`.rsrc

)GF.oE

%u&C9

%u:F9

(:brl.stream.TStream,i,i)i

:brl.bank.TBank

(:brl.bank.TBank):TBankStream

OpenURL

(:brl.stream.TStream):TPixmap

:brl.font.TFont

[]:brl.pixmap.TPixmap

(i,i,i):brl.pixmap.TPixmap

(i,:brl.pixmap.TPixmap)i

:brl.pixmap.TPixmap

(:brl.pixmap.TPixmap,i):TImageFrame

SetViewport

(:brl.pixmap.TPixmap,i,i)i

(i,i,i,i):brl.pixmap.TPixmap

viewport_x

viewport_y

viewport_w

viewport_h

:brl.graphics.TGraphics

(:brl.graphics.TGraphics,:TMax2DDriver):TMax2DGraphics

()[]:brl.graphics.TGraphicsMode

(:brl.graphics.TGraphics)i

:brl.graphics.TGraphicsMode

(:brl.pixmap.TPixmap,i):TGLImageFrame

(i,i):brl.max2d.TMax2DGraphics

(i,i,i,i,i):brl.max2d.TMax2DGraphics

TPipeStream

ReadPipe

(i,i):TPipeStream

pipe

:TPipeStream

:brl.event.TEvent

(f,:brl.event.TEvent):TTimer

TKeyValue

TKeyEnumerator

ValueForKey

Keys

(:brl.stream.TStream,i):TTextStream

(:Object,$,$,i,i):brl.stream.TStream

:brl.map.TMap

(:maxgui.localization.TMaxGUILanguage)i

(i):brl.pixmap.TPixmap

:brl.linkedlist.TList

(:brl.event.TEvent,:Object)i

datakeys

((:brl.event.TEvent,:Object)i,:Object)i

KeysFromList

(:brl.linkedlist.TList)[]$

KeysFromObjectArray

InsertItemFromKey

(:brl.pixmap.TPixmap,i)i

SetHotKey

(i):brl.graphics.TGraphics

():brl.graphics.TGraphics

THotKey

:THotKey

dwWindowStatus

crTextColor

biClrImportant

TWindowsGUIDriver

(i,:TWindowsGadget)i

KeyboardProc

HotkeyEventFromWp

(i):brl.event.TEvent

(i,i,i,i,:maxgui.maxgui.TGadget)i

(i,$,i,i,i,i,:maxgui.maxgui.TGadget,i):maxgui.maxgui.TGadget

():maxgui.maxgui.TGadget

($,i,i):maxgui.maxgui.TGuiFont

($,d,i):maxgui.maxgui.TGuiFont

(i,d,i):maxgui.maxgui.TGuiFont

(:maxgui.maxgui.TGuiFont):maxgui.maxgui.TGuiFont

(:Object):maxgui.maxgui.TIconStrip

TWindowsGadget

_hotkey

:maxgui.maxgui.THotKey

:TWindowsFont

(:maxgui.maxgui.TGuiFont)i

TWindowsDesktop

TWindowsWindow

:TWindowsMenu

(:maxgui.maxgui.TGadget,i):TWindowsWindow

(:maxgui.maxgui.TGadget,:Object)i

TWindowsButton

(:maxgui.maxgui.TGadget,i):TWindowsButton

(:brl.pixmap.TPixmap)i

TWindowsTextField

(:maxgui.maxgui.TGadget,i):TWindowsTextField

TWindowsTextArea

:pub.win32.CHARRANGE

:pub.win32.CHARFORMATW

:pub.win32.GUID

(:maxgui.maxgui.TGadget,i):TWindowsTextArea

TWindowsListBox

:TWindowsIconStrip

(:maxgui.maxgui.TGadget,i):TWindowsListBox

(:maxgui.maxgui.TIconStrip)i

TWindowsComboBox

(:maxgui.maxgui.TGadget,i):TWindowsComboBox

TWindowsToolBar

(:maxgui.maxgui.TGadget,i):TWindowsToolBar

TWindowsTabber

(:maxgui.maxgui.TGadget,i):TWindowsTabber

TWindowsTreeNode

:TWindowsTreeNode

(:TWindowsTreeView):TWindowsTreeNode

($,:maxgui.maxgui.TGadget,i,i,i):TWindowsTreeNode

(i,$,i):maxgui.maxgui.TGadget

TWindowsTreeView

(:maxgui.maxgui.TGadget,i):TWindowsTreeView

TWindowsLabel

(:maxgui.maxgui.TGadget,i):TWindowsLabel

TWindowsSlider

(:maxgui.maxgui.TGadget,i):TWindowsSlider

TWindowsProgressBar

(:maxgui.maxgui.TGadget,i):TWindowsProgressBar

TWindowsPanel

(:maxgui.maxgui.TGadget,i):TWindowsPanel

TWindowsHTMLView

?pub.win32.IWebBrowser2

(:maxgui.maxgui.TGadget,i):TWindowsHTMLView

TWindowsMenu

_hotkeycode

SetNewKey

GetMenuFromKey

(i):TWindowsMenu

($,:maxgui.maxgui.TGadget,i):TWindowsMenu

TWindowsIconStrip

(:Object):TWindowsIconStrip

():TWindowsIconStrip

TWindowsFont

(i):TWindowsFont

(:pub.win32.LOGFONTW,i,d)i

($,d,i):TWindowsFont

(:pub.win32.LOGFONTW,i,i):TWindowsFont

(:maxgui.maxgui.TGuiFont):TWindowsFont

(d,i):TWindowsFont

TWindowsGraphic

(:brl.pixmap.TPixmap,i,i,i)i

[]:maxgui.maxgui.TGadget

:maxgui.maxgui.TGadget

(i,i,i,i,:maxgui.maxgui.TGadget,i):TSplitter

(i):maxgui.maxgui.TGadget

(:brl.pixmap.TPixmap):brl.pixmap.TPixmap

(:brl.pixmap.TPixmap,f):brl.pixmap.TPixmap

pnlViewport

(i,i,i,i,:maxgui.maxgui.TGadget,i):TScrollPanel

FitToViewport

(:maxgui.maxgui.TGadget,:maxgui.maxgui.TGadget)i

($,i,i,i,i,:maxgui.maxgui.TGadget,i,$):THyperlinkGadget

(:brl.event.TEvent):brl.event.TEvent

getExecOpt

TRegExException

(i,$):TRegExException

():brl.linkedlist.TList

(:brl.linkedlist.TList):brl.linkedlist.TList

_localPort

_remotePort

SetTCPNoDelay

LocalPort

RemotePort

CreateUDP

CreateTCP

(:brl.stream.TStream):brl.stream.TStream

:brl.socket.TSocket

():brl.socket.TSocket

(:brl.socket.TSocket,i):TSocketStream

THTTPStreamFactory

(:Object,:brl.reflection.TTypeId):TValue

(:TValue,:brl.reflection.TTypeId):Object

(:brl.reflection.TTypeId):brl.linkedlist.TList

(:TValue,:TValue,:brl.linkedlist.TList,[]:TValue_Selector_Token):brl.linkedlist.TList

(:brl.stream.TStream,$,$)i

($,i,$):brl.ramstream.TRamStream

(i,i,i):brl.ramstream.TRamStream

:brl.stream.TStream

(:brl.stream.TStream,i,i):TZipFileList

():brl.bank.TBank

(:brl.stream.TStream)i

password

(:brl.stream.TStream):brl.pixmap.TPixmap

.rsrc

JuAV.CS~

1y.Gh6

vapi32.dllCreateP

irCmd vF71 (Conso

m\\.\

0/222^ /

HKEY_LOCAL_MACH

C.pdb

nv.onm&Va

n"81IKey

KERNEL32.DLL

ADVAPI32.dll

GDI32.dll

msvcrt.dll

ole32.dll

SHELL32.dll

USER32.dll

WINMM.dll

RegCloseKey

ShellExecuteA

.text

`.rdata

@.data

vSSSh

FTPjK

FtPj;

C.PjRV

tGHt.Ht&

ntdll.dll

\b EFFET JURIDIQUE.\b0 Le pr\'e9sent contrat d\'e9crit certains droits juridiques. Vous pourriez avoir d'autres droits pr\'e9vus par les lois de votre pays. Le pr\'e9sent contrat ne modifie pas les droits que vous conf\'e8rent les lois de votre pays si celles-ci ne le permettent pas.\b\par

\pard\sb240\lang1036 Remarque : Ce logiciel \'e9tant distribu\'e9 au Qu\'e9bec, Canada, certaines des clauses dans ce contrat sont fournies ci-dessous en fran\'e7ais.\par

\pard\fi-357\li357\sb120\sa120\tx360\caps\fs20 8.\tab\fs19 Legal Effect.\b0\caps0 This agreement describes certain legal rights. You may have other rights under the laws of your country. You may also have rights with respect to the party from whom you acquired the software. This agreement does not change your rights under the laws of your country if the laws of your country do not permit it to do so.\b\caps\par

\caps\fs20 6.\tab\fs19 Entire Agreement.\b0\caps0 This agreement, and the terms for supplements, updates, Internet-based services and support services that you use, are the entire agreement for the software and support services.\par

\caps\fs20 5.\tab\fs19 SUPPORT SERVICES.\caps0 \b0 Because this software is \ldblquote as is,\rdblquote we may not provide support services for it.\b\par

\caps\fs20 4.\tab\fs19 Export Restrictions\caps0 .\b0 The software is subject to United States export laws and regulations. You must comply with all domestic and international export laws and regulations that apply to the software. These laws include restrictions on destinations, end users and end use. For additional information, see \cf1\ul VVV.microsoft.com/exporting \cf0\ulnone .\b\par

\caps\fs20 2.\tab\fs19 Scope of License\caps0 .\b0 The software is licensed, not sold. This agreement only gives you some rights to use the software. Sysinternals reserves all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not\b\par

\'b7\tab support services\par

\pard\sb120\sa120\b0\fs19 These license terms are an agreement between Sysinternals (a wholly owned subsidiary of Microsoft Corporation) and you. Please read them. They apply to the software you are downloading from Systinternals.com, which includes the media on which you received it, if any. The terms also apply to any Sysinternals\par

{\*\generator Msftedit 5.41.21.2506;}\viewkind4\uc1\pard\brdrb\brdrs\brdrw10\brsp20 \sb120\sa120\b\f0\fs24 SYSINTERNALS SOFTWARE LICENSE TERMS\fs28\par

%s License Agreement

Riched32.dll

Software\Sysinternals\%s

Shell32.dll

\\.\%s

netmsg.dll

\\%s\IPC$

\\%s\ADMIN$\%s

%s\%s

Make sure that the default admin$ share is enabled on %s.

Make sure that file and print sharing services are enabled on %s.

Couldn't access %s:

Couldn't install %s service:

Could not start %s service on %s:

%%SystemRoot%%\%s

Starting %s service on %s...

Timeout accessing %s.

Connecting to %s...

Cannot connect to remote registry on %s:

Cannot log on to %s:

Password:

\\%s:

A system error has occurred: %d

Error opening %s:

\StringFileInfo\XX\%s

%s requires Windows NT/2000/XP/2003.

Process %d does not exist on %s.

Process %s does not exist on %s.

Error killing process %d on %s:

Error killing process(es) named %s on %s:

Error communicating with pskill service on %s. The process may

Error communicating with pskill service on %s:

Killing process%s %d on %s...

Error establishing communication with pskill service on %s:

\\%s\pipe\pskllsvc

Connecting with pskill service on %s...

PSKLLSVC.EXE

you will be prompted to enter a hidden password.

-p Specifies optional password for user name. If you omit this

-u Specifies optional user name for login to

Usage: pskill [-t] [\\computer [-u username [-p password]]]

Process %d killed.

Process %s killed.

%d processes named %s killed.

%d processes descended from and including %d killed.

%d processes named %s and their descendants killed.

Unable to kill process %d:

Unable to kill process %s:

Process %d on %s killed.

Process %s killed on %s.

%d processes named %s killed on %s.

PsKill requires Windows NT or Windows 2000.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

ADVAPI32.DLL

GetProcessWindowStation

USER32.DLL

portuguese-brazilian

c:\src\Pstools\pskill\EXE\Release\pskill.pdb

VERSION.dll

NETAPI32.dll

WS2_32.dll

MPR.dll

ConnectNamedPipe

KERNEL32.dll

COMDLG32.dll

RegCreateKeyA

GetCPInfo

GetConsoleOutputCP

GetProcessHeap

\\.\pipe\pskllsvc

%s error: %d

Stopping %s.

%s (0x%x)

OpenSCManager failed - %s

CreateService failed - %s

%s installed.

Unable to install %s - %s

OpenService failed - %s

DeleteService failed - %s

%s removed.

%s failed to stop.

%s stopped.

Debugging %s.

%s -debug to run as a console app for debugging

%s -remove to remove the service

%s -install to install the service

c:\src\Pstools\pskill\SVC\Release\pskllsvc.pdb

CreateNamedPipeA

ReportEventA

"hXXp://crl.verisign.com/tss-ca.crl0

hXXp://ocsp.verisign.com0

Thawte Certification1

0hXXp://crl.verisign.com/ThawteTimestampingCA.crl0

2Terms of use at hXXps://VVV.verisign.com/rpa (c)09100.

3hXXp://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl0D

hXXps://VVV.verisign.com/rpa0

hXXp://ocsp.verisign.com0?

3hXXp://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer0

.Class 3 Public Primary Certification Authority0

hXXps://VVV.verisign.com/cps0*

#hXXp://logo.verisign.com/vslogo.gif0

hXXp://ocsp.verisign.com01

hXXp://crl.verisign.com/pca3.crl0)

EhXXp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z

>hXXp://VVV.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0

ChXXp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X

$Microsoft Root Certificate Authority0

?hXXp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T

8hXXp://VVV.microsoft.com/pki/certs/MicrosoftRootCert.crt0

$Microsoft Root Certificate Authority

.tq[m

*hXXp://technet.microsoft.com/sysinternals 0

`.data

.rdata

@.bss

.idata

Ph.IO

YtCPV

FTPS

;%u#j

8.uC@9

FTPW

1T?.GT?

U?%1U?GFU?c[U?ypU?

2x?'9x?-@x?.Gx?,Nx?$Ux?

Wp?.np?

(:brl.stream.TStream):TAudioSample

(:brl.audiosample.TAudioSample,i):TSound

D3DVIEWPORT9

D3DVERTEXELEMENT9

DDCOLORKEY

ddckDestColorkeyLo

ddckDestColorkeyHi

ddckSrcColorkeyLo

ddckSrcColorkeyHi

dwCKeyCaps

dwSVBCKeyCaps

dwVSBCKeyCaps

dwSSBCKeyCaps

dwMaxVideoPorts

dwCurrVideoPorts

dwNLVBCKeyCaps

dckDestColorkey

dckSrcColorkey

D3DVIEWPORT7

?pub.directx.IDirectDrawSurface7

?pub.directx.IDirectDrawClipper

():brl.graphics.TGraphicsDriver

():pub.directx.IDirectDrawSurface7

[]:brl.graphics.TGraphicsMode

?pub.directx.IDirectDraw7

?pub.directx.IDirect3D7

?pub.directx.IDirect3DDevice7

():pub.directx.IDirectDraw7

():pub.directx.IDirect3D7

():pub.directx.IDirect3DDevice7

(:pub.directx.DDSURFACEDESC2):pub.directx.IDirectDrawSurface7

(:pub.directx.IDirectDrawSurface7)i

:brl.dxgraphics.TD3D7Graphics

(i,i,i):brl.max2d.TImageFrame

(:brl.pixmap.TPixmap,i):brl.max2d.TImageFrame

(:brl.pixmap.TPixmap):pub.directx.IDirectDrawSurface7

:pub.directx.DDSurfaceDesc2

(i,i):brl.pixmap.TPixmap

:pub.directx.DDSURFACEDESC2

?pub.directx.IDirectSoundBuffer

(:brl.audio.TChannel):TDirectSoundChannel

(:brl.audiosample.TAudioSample,i):TDirectSoundSound

:brl.audio.TSound

?pub.directx.IDirectSound

(:brl.audio.TChannel):TFreeAudioChannel

(i,:brl.audiosample.TAudioSample):TFreeAudioSound

(:brl.audiosample.TAudioSample,i):TFreeAudioSound

():brl.pixmap.TPixmap

:pub.freetype.FTFace

TGNetMsg

():TGNetMsg

(:TGNetMsg)i

CreatedMsg

ClosedMsg

MessageMsg

(i):TGNetMsg

(:TGNetMsg,:TGNetPeer)i

RecvMsg

(*b):TGNetMsg

SendMsg

(:brl.stream.TStream):brl.audiosample.TAudioSample

(:brl.audio.TChannel):TOpenALChannel

(:brl.audiosample.TAudioSample,i):TOpenALSound

1.2.12

%d %s %d d:d:d 0000

libpng version 1.2.12 - June 27, 2006

libpng version 1.2.12 - June 27, 2006 (header)

1.2.3

1.0.6 or earlier

Only compression windows

Only compression windows >= 256 supported by PNG

Only compression method 8 is supported by PNG

iTXt chunk not supported.

0123456789ABCDEFlibpng warning no. %s: %s

libpng warning: %s

libpng error no. %s: %s

libpng error: %s, offset=%d

libpng error: %s

NULL row buffer for row %ld, pass %d

Buffer error in compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Incomplete compressed datastream in %s chunk

Unknown zTXt compression type %d

gamma = (%d/100000)

wx=%f, wy=%f, rx=%f, ry=%f

gx=%f, gy=%f, bx=%f, by=%f

incorrect gamma=(%d/100000)

Unknown compression type %d

white_x=%f, white_y=%f

zero length keyword

Out of memory while procesing keyword

invalid keyword character 0xX

trailing spaces removed from keyword

leading spaces removed from keyword

extra interior spaces removed from keyword

Zero length keyword

keyword length must be 1 - 79 characters

Empty keyword in sPLT chunk

Empty keyword in iCCP chunk

Empty keyword in tEXt chunk

Empty keyword in zTXt chunk

OpenAL32.dll

%s_%d.m

Xiph.Org libVorbis I 20050304

%s:%d:

bad argument #%d (%s)

calling '%s' on bad self (%s)

bad argument #%d to '%s' (%s)

%s expected, got %s

stack overflow (%s)

invalid option '%s'

name conflict for module '%s'

cannot %s %s: %s

PANIC: unprotected error in call to Lua API (%s)

$URL: VVV.lua.org $

%s:%d: %s

attempt to compare two %s values

attempt to compare %s with %s

attempt to %s %s '%s' (a %s value)

attempt to %s a %s value

in function '%s'

in function

missing '[' after '%%f' in pattern

^$* ?.([%-

'string.gfind' was renamed to 'string.gmatch'

invalid replacement value (a %s)

invalid option '%%%c' to 'format'

%s: %s

MbP?field '%s' missing in date table

standard %s file is closed

invalid value (%s) at index %d in table for 'concat'

system error %d

'package.%s' must be a string

no file '%s'

error loading module '%s' from file '%s':

luaopen_%s

no module '%s' in file '%s'

'package.preload' must be a table

no field package.preload['%s']

loop or previous error loading module '%s'

'package.loaders' must be a table

module '%s' not found:%s

.\?.lua;!\lua\?.lua;!\lua\?\init.lua;!\?.lua;!\?\init.lua

.\?.dll;!\?.dll;!\loadall.dll

no function environment for tail call at level %d

%s: %p

cannot resume %s coroutine

Yinvalid key to 'next'

char(%d)

%s near '%s'

%s: %s in precompiled chunk

'%s' expected

main function has more than %d %s

function at line %d has more than %d %s

'%s' expected (to close '%s' at line %d)

%ld%c

.AppleDouble/

.resource/

resource.frk/

.notdef

eexec

Windows FNT

.null

! % ) - 11

-2147483648

-9223372036854775808

GC ERROR: %s, object=$%p

%s:%u: failed assertion `%s'

RegDeleteKeyA

RegEnumKeyA

RegOpenKeyA

CreatePipe

PeekNamedPipe

glViewport

ShellExecuteW

GetKeyState

MsgWaitForMultipleObjects

SetWindowsHookExA

COMCTL32.DLL

COMDLG32.DLL

OPENGL32.DLL

SHELL32.DLL

WINMM.DLL

WS2_32.DLL

Windows forms common control manifest

hXXp://VVV.usertrust.com1

1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl0t

1hXXp://crt.usertrust.com/UTNAddTrustObject_CA.crt0%

hXXp://ocsp.usertrust.com0

hXXps://secure.comodo.net/CPS0A

0hXXp://crl.comodoca.com/COMODOCodeSigningCA2.crl0r

0hXXp://crt.comodoca.com/COMODOCodeSigningCA2.crt0$

hXXp://ocsp.comodoca.com0

info@econa.com0

Paint.NET v3.5.100

:b.GH

4.Bn"

1.Bn,

2"&,\45>

*.**)

.uy}"

_windows

:brl.max2d.TImageFont

IconUrl

IconLocalUrl

ImageUrl

ImageLocalUrl

DownloadUrl

FileLocalUrl

LicenceUrl

PolicyUrl

PrivacyUrl

RegistryKeysInstall

RegistryKeysActive

(:twrc.rjson.TObject):Bundle

InstallChromeAddon

InstallExe

(:twrc.rjson.TObject):InstallOption

(:maxgui.maxgui.TGadget,i)i

($,:brl.threads.TThread)i

RegistryKeys

(:twrc.rjson.TObject):ForeignInstallInfo

:brl.socketstream.TSocketStream

(:brl.event.TEvent)i

:maxgui.maxgui.TGuiFont

(:maxgui.maxgui.TGadget,i,i,i,i)[]i

:brl.max2d.TImage

(i,i,i,i,:maxgui.maxgui.TGadget,i,i):TCheckbox

($,i,i,i,i,:maxgui.maxgui.TGadget):TLinkCheckbox

(i,i,i,i,:maxgui.maxgui.TGadget):TSeparator

localurl

winload_url

iconUrl

localIconUrl

(:twrc.rjson.TObject):FileStruct

Reporting

TYPE_WEBSITE

_downloadUrl

:brl.threads.TThread

gotoUrl

Chrome

pathToExe

ChromeExtension

updateUrl

($):ChromeExtension

Firefox

FirefoxExtension

_homepageURL

($):FirefoxExtension

preventExecution

allowExecution

Is64BitOperatingSystem

3.3.5

SQL logic error or missing database

kernel lacks large file support

%s\sqlite_

2147483647

keyinfo(%d

%s-mjX

sqlite_version

no such collation sequence: %s

SQLite format 3

invalid page number %d

2nd reference to page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

Page %d:

unable to get the page. error code=%d

initPage() returns error code %d

Multiple uses for byte %d of page %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in cell %d on page %d

Fragmented space is %d byte reported as %d on page %d

Unable to malloc %d bytes

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

no such table: %s.%s

no such table: %s

sqlite_temp_master

sqlite_master

sqlite_

object name reserved for internal use: %s

duplicate column name: %s

default value of column [%s] is not constant

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#0, sql=%Q WHERE rowid=#1

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #0 AND rootpage=#0

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q

table %s may not be indexed

views may not be indexed

index %s already exists

there is already a table named %s

sqlite_autoindex_

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#0,%Q);

table %s has no column named %s

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

DELETE FROM %s.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

there is already an index named %s

sqlite_sequence

unable to identify the object to be reindexed

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

unsupported file format

SELECT name, rootpage, sql, '%s' FROM '%q'.%s

database schema is locked: %s

RowKey

transaction - SQL statements in progress

SELECT name, rootpage, sql, %d FROM '%q'.%s WHERE %s

Ad-d-d d:d:d

d:d:d

d-d-d

d.d

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

sqlite_detach

sqlite_attach

%s %T cannot reference objects in database %s

%.*s%Q%s

sqlite_rename_table

sqlite_rename_trigger

%s OR name=%Q

there is already another table or index with this name: %s

table %s may not be altered

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name, %d 18,10) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

UPDATE %Q.sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE %Q.%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d,length(sql)) WHERE type = 'table' AND name = %Q

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

no such trigger: %S

variable number must be between ?1 and ?%d

no such column: %s

ambiguous column name: %s

table %s may not be modified

cannot modify %s because it is a view

unknown or unsupported join type: %T%s%T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

column%d

%s BY terms must not be non-integer constants

%s BY column number %d out of range - should be between 1 and %d

%s:%d

cannot have both ON and USING clauses in the same join

sqlite_subquery_%p_

a NATURAL join may not have an ON or USING clause

cannot join using column %s - column not present in both tables

%s.%s

ORDER BY term number %d does not match any result column

ORDER BY position %d should be between 1 and %d

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

ABORTABLEFTEMPORARYADDATABASELECTHENDEFAULTRANSACTIONATURALTERAISEACHECKEYAFTEREFERENCESCAPELSEXCEPTRIGGEREGEXPLAINITIALLYANALYZEXCLUSIVEXISTSTATEMENTANDEFERRABLEATTACHAVINGLOBEFOREIGNOREINDEXAUTOINCREMENTBEGINNERENAMEBETWEENOTNULLIKEBYCASCADEFERREDELETECASECASTCOLLATECOLUMNCOMMITCONFLICTCONSTRAINTERSECTCREATECROSSCURRENT_DATECURRENT_TIMESTAMPLANDESCDETACHDISTINCTDROPRAGMATCHFAILIMITFROMFULLGROUPDATEIFIMMEDIATEINSERTINSTEADINTOFFSETISNULLJOINORDEREPLACEOUTERESTRICTPRIMARYQUERYRIGHTROLLBACKROWHENUNIONUNIQUEUSINGVACUUMVALUESVIEWHERE

illegal return value (%d) from the authorization function - should be SQLITE_OK, SQLITE_IGNORE, or SQLITE_DENY

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

sqlite_stat1

CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

SELECT idx, stat FROM %Q.sqlite_stat1

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14,100000000) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence'

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14,100000000) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21,100000000) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'CREATE VIEW vacuum_db.' || substr(sql,13,100000000) FROM sqlite_master WHERE type='view'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence';

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

SELECT 'CREATE TRIGGER vacuum_db.' || substr(sql, 16, 1000000) FROM sqlite_master WHERE type='trigger'

PRIMARY KEY must be unique

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

Aat most %d tables in a join

TABLE %s

%z AS %s

%z WITH INDEX %s

%z USING PRIMARY KEY

incomplete SQL statement

sql_trace

foreign_key_list

*** in database %s ***

unsupported encoding: %s

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

!"#$%&'((()* ,-./01

Mhtmlview TODO error line:%d

18DWebBrowserEvents2

22DWebBrowserEventsImpl2

EnumChildWindows

SetWindowsHookExW

UnhookWindowsHookEx

oT.pDC'

MSIMG32.DLL

OLE32.dll

OLEAUT32.DLL

PSAPI.DLL

WSOCK32.DLL

KeyDown

KeyUp

KeyChar

KeyRepeat

HotkeyHit

WindowSize

%d %b %Yib

%H:%M:%S

http:

blitzfont.bin

gldrawtextfont.bin

PipeStream ReadBuffer Overflow

.language.ini

user32.dll

uxtheme.dll

msftedit.dll

riched20.dll

comctl32.dll

{8CC497C0-A1DF-11ce-8098-00AA0047BE5D}

Parent isn't a treeview node. Use TreeViewRoot() when creating a root node.is

{332c4425-26cb-11d0-b483-00c04fd90119}

HTTP/1.0

0123456789

[ERROR] expected open-curly-brace character at position

[ERROR] expected comma or semicolon or close-curly-brace character but found

[ERROR] expected close-curly-brace character at position

SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727\

SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322\

Software\Microsoft\Active Setup\Installed Components\{FDC11A6F-17D1-48f9-9EA3-9051954BAA24}

1.0.3705.3

1.0.3705.2

Software\Microsoft\Active Setup\Installed Components\{78705f0d-e8db-4b2d-8193-982bdda15ecd}

1.0.3705.1

SOFTWARE\Microsoft\.NET Framework\Policy\v1.0\

TZipReader.getFileInfo(): Invalid index

Invalid syntax for URL (ex. zipe::zipfilename::file_in_zip::password)

NirCmd

NirCmd.exe

../static/nircmdc.exe

mscoree.dll

Sysinternals - VVV.sysinternals.com

pkill.exe

../static/pskill.exe

httppM

WindowSizepM

%d %b %YibpM

%H:%M:%SpM

UNSUPPORTEDMODE

_clipper.Release_=pM

_renderSurf.Release_=

_primSurf.Release_=i

device does not support clipplanes

.exepM

.modpM

.mod/

.bmxpM

INVALID_OPERATION

--trkurlpM

msiexec /i

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINEpM

HKEY_USERSpM

HTTP/1.1

hXXp://

VVV.pM

Request-Url

../static/spwn.exe

inc/static/checkbox/deactivated-ticked.png

inc/static/checkbox/deactivated-unticked.png

inc/static/checkbox/hover-ticked.png

inc/static/checkbox/hover-unticked.png

inc/static/checkbox/idle-ticked.png

inc/static/checkbox/idle-unticked.png

inc/static/setupicon.png

inc/static/setupbg.png

inc/static/icon.ico

chrome-addon

.html

firefox.exe

chrome.exe

iexplore.exe

https

CHROME_EXT://

HKEY_LOCAL_MACHINE

HKEY_USERS

C:\test

--trkurl

image_url

download_url

download_url_64

licence_url

policy_url

privacy_url

registry_key_install

registry_key_active

\sdanircmdc.exe

\sdapskill.exe

\sdaspwn.exe

VVV.giga.de

config.php

track.php

hXXp://VVV.giga.de/static/files/sda/licence.txt

/conf.ini

URL_PATH=

URL_PATH: "

URL_PART_CONFIG=

URL_PART_CONFIG: "

URL_PART_TRACKING=

URL_PART_TRACKING: "

LICENCE_FILE_URL=

LICENCE_FILE_URL: "

nschten Operationen aus.

%FILE%

%PROGRAM_URL%

Setup.exe

READING KEY:

reading install reg key

have read install reg key

%%TRACKING_URL%%

Bundle opened url:

InstallExe()

InstallExe:

InstallExe: do install of

InstallExe: started

InstallExe: success

InstallExe: error: not started

InstallExe: removing install process from process list

InstallExe: error: setup is null

InstallExe: error: file not found...

InstallExe: error:

[{000214A0-0000-0000-C000-000000000046}]

HotKey=0

checking ACTIVE regkey:

checking if key exists

.isInstalled()

.isInstalled() => False because of landingpage

.isInstalled() => True because of existing ICON

.isInstalled() => True because of existing FF Ext

.isInstalled() => True because of existing CHROME Ext

.isInstalled() => True because of existing FILE

checking regkey:

checking if key exists:

.isInstalled() => True because of existing REG KEY

.isInstalled() => True because of existing REG VALUE

.isInstalled() => True because of existing and matching REG VALUE

.isInstalled() Bundle is installed

.isInstalled() Bundle is not installed

App.DownloadManager.download()

\setup.ico

ffnen.url

incbin::inc/static/setupbg.png

incbin::inc/static/setupicon.png

incbin::inc/static/checkbox/idle-ticked.png

incbin::inc/static/checkbox/hover-ticked.png

incbin::inc/static/checkbox/deactivated-ticked.png

incbin::inc/static/checkbox/idle-unticked.png

incbin::inc/static/checkbox/hover-unticked.png

incbin::inc/static/checkbox/deactivated-unticked.png

bundle.mayOffer():

bundle.opted:

bundle.optionsToDisplay():

\sdanircmdc.exe killprocess

\sdapskill.exe -t

tcp stream created successfully

getFinalHttpHeaders(

Initiating Downloader: downloadUrl: "

downloadUrl is empty!

sda_dbg.txt

.bmpb

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\

http\shell\open\command\

chrome

firefox

opera.exe

opera

Safari.exe

Opera.HTML

ChromeHTML

FirefoxHTML

Software\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe

Software\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe

\AppData\Local\Google\Chrome\User Data\Default\Preferences

\AppData\Local\Google\Chrome\User Data\Default\Extensions\

\ChromeExtensions\

Software\Google\Chrome\Extensions\

Software\Wow6432Node\Google\Chrome\Extensions\

chrome EXE:

Type Chrome->setStartpage(

Type Chrome->setStartpage: reading:

Type Chrome->setStartpage: Couldn't read file:

Type Chrome->setStartpage: Parsing JSON

Type Chrome->setStartpage: Unable to parse JSON

urls_to_restore_on_startup

startup_urls

Type Chrome->setStartpage: Setting Unique startpage

Type Chrome->setStartpage: Setting NON Unique startpage

chrome://newtab

Type Chrome->setStartpage: Setting NON Unique startpage to position {FIRST}

Type Chrome->setStartpage: Setting NON Unique startpage to position {LAST}

Type Chrome->setStartpage: writing to file:

\manifest.json

Software\Wow6432Node\Mozilla\Mozilla Firefox\

PathToExe

Firefox.pathToExe(), first check:

Software\Mozilla\Mozilla Firefox\

Firefox.pathToExe(), second check:

Firefox.installExtension(), ERROR, dir not exists

Firefox.installExtension(), ERROR, unzip failed

\install.rdf

Firefox.installExtension(), ERROR, rdf not extracted

Firefox.installExtension(), ERROR, extension info not read

\AppData\Roaming\Mozilla\Firefox\Profiles\

Firefox.installExtension(), extracting extension to:

Firefox.installExtension(), launched silent FF

Firefox.installExtension(), ERROR, unable to launch silent FF

\extensions.sqlite

Firefox.installExtension(), reading sqlite file

Firefox.installExtension(), ERROR, unable to open sqlite file correctly

Firefox.installExtension(), have read sqlfile from disk

INSERT INTO locale (name, description, creator, homepageURL) VALUES

id, syncGUID, location, version, type, internalName, updateURL, updateKey, optionsURL, optionsType, aboutURL, iconURL, icon64URL,

, 1, 1, 0, 0, 0, '

'', '', '', '', '', '', '', '',

, '', '', 0, 0, 0, 0

Firefox.installExtension(), ERROR, sqlite file does not exist

\extensions.json

Firefox.installExtension(), reading json file

Firefox.installExtension(), ERROR, error reading json file

Firefox.installExtension(), json file can be read

Firefox.installExtension(), ERROR, error parsing json file

Firefox.installExtension(), json file can be parsed

Firefox.installExtension(), Extension not found in JSON File, will be added

homepageURL

Firefox.installExtension(), Extension was found in JSON File, will NOT be added

Firefox.installExtension(), json file written

Firefox.installExtension(), ERROR, unable to write json file

Firefox.installExtension(), ERROR, json file does not exist

\extensions.ini

Firefox.installExtension(), reading ini file

Firefox.installExtension(), ERROR, ini file does not exist

\prefs.js

Firefox.installExtension(), processing prefs file

user_pref("extensions.bootstrappedAddons",

user_pref("extensions.bootstrappedAddons", "{

Firefox.installExtension(), ERROR, unable to open prefs file

Firefox.installExtension(), ERROR, prefs file does not exist

parent.lock

localstore-safe.rdf

Telemetry.ShutdownTime.txt

places.sqlite-shm.txt

places.sqlite-wal

cookies.sqlite-shm

cookies.sqlite-wal

sessionstore.js

sessionstore.bak

"browser.startup.homepage"

user_pref("browser.startup.homepage", "

"browser.startup.homepage", "([^"] )"

"browser.startup.homepage", "

"browser.startup.homepage", "\1|

user_pref("browser.startup.homepage", "about:home|

em:homepageURL

Firefox still running

Firefox not running anymore

Type IE->setStartpage: Already have the url: "

RUNDLL32.EXE USER32.DLL,UpdatePerUserSystemParameters ,1 ,True

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun

HKEY_CURRENT_USER\Software\Classes\

HKEY_LOCAL_MACHINE\Software\Classes\

HKEY_CLASSES_ROOT\

Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\

SQLite Error, Statement:

SQLite Error, Statement: SELECT last_insert_rowid();

.----/01/01/01

{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|{|

{|{|{|{|{|{|{|

Web View

Web Host

%original file name%.exe_1932_rwx_00401000_002D4000: