Gen.Variant.Razy.41811_f181ccdffe

by malwarelabrobot on May 9th, 2016 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Razy.41811 (B) (Emsisoft), Gen:Variant.Razy.41811 (AdAware), HackTool.Win32.PassView.FD, GenericAutorunWorm.YR, HackToolPassView.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, HackTool, WormAutorun


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: f181ccdffea1ef8e218cfc586b5ff546
SHA1: c1e27b12ffdb8f3a58a7b208eb3fedea0af9deb9
SHA256: a047a53c858719eb9b5f95ba676b1ed88316cd78c14dbe356dc67512ece7617c
SSDeep: 24576:IEjhykOFjtsOkA5U0U2lalNsvJKo8p1vD S3qZ2b/BIT06cxVJrFg:hjhykOFnK0Rk281y0dl6yg
Size: 1595904 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2016-04-20 03:34:55
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour Description
WormAutorun A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Trojan creates the following process(es):

vbc.exe:2364
vbc.exe:2556
%original file name%.exe:580

The Trojan injects its code into the following process(es):

Document00000pdf.exe:1524
Document00000pdf.exe:1512
Document00000pdf.exe:940
Document00000pdf.exe:1484

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process vbc.exe:2556 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (2 bytes)

The process %original file name%.exe:580 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe (10177 bytes)

The process Document00000pdf.exe:1512 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\pid.txt (4 bytes)
%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe (10177 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (82 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (0 bytes)

Registry activity

The process vbc.exe:2364 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6C 36 63 77 68 2A 28 8B 1E 92 FA 81 39 55 82 54"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process vbc.exe:2556 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 A5 83 F8 7F 08 68 A2 69 0F 44 D1 3D D8 A6 18"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The process %original file name%.exe:580 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 8C 6B 04 EF 70 A0 F6 46 4D 30 7C 4A 51 48 6B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data]
"Document00000pdf.exe" = "Document000000pdf"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process Document00000pdf.exe:1524 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B1 63 39 2F 0C 8C 36 06 C8 81 F6 E6 3C 42 D6 42"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe"

The process Document00000pdf.exe:1512 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Document00000pdf\DEBUG]
"Trace Level" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 75 D6 F9 D3 2D CC B7 24 CB 3C 3F 6B 2C C9 9D"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Update" = "%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Document00000pdf\DEBUG]
"Trace Level"

The process Document00000pdf.exe:940 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A FB FD 6D E2 25 36 89 7F 5E CD E8 1C E5 44 AF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe"

The process Document00000pdf.exe:1484 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A 05 86 86 B9 82 C5 80 0F A7 47 8C 10 CA C2 BF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name: doc
Product Name: Process Hacker
Product Version: 2.38.0.100
Legal Copyright: Licensed under the GNU GPL v3.
Legal Trademarks:
Original Filename: Documentt000000pdf.exe
Internal Name: Documentt000000pdf.exe
File Version: 2.38.0.100
File Description: Document000000pdf
Comments: Process Hacker
Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 8192 1583012 1583104 5.15042 f9f4ea822850b518048b70552064efa1
.rsrc 1597440 11776 11776 5.26554 efdcb0b469c91625ca37bb8dbeb9e8c4
.reloc 1613824 12 512 0.070639 f76a510ea64b3acb7a7ce8d345c4e3bd

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://whatismyipaddress.com/ 2.21.160.45
hxxp://whatismyipaddress.com/api.html 2.21.160.45
mail.puresteeldesign.com 50.28.10.112


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1
Host: whatismyipaddress.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Server: AkamaiGHost
Content-Length: 0
Location: hXXp://whatismyipaddress.com/api.html
Date: Sat, 07 May 2016 23:02:46 GMT
Connection: keep-alive
....


GET /api.html HTTP/1.1


Host: whatismyipaddress.com


HTTP/1.1 200 OK
Server: Apache/2.2.29 (Unix) DAV/2 PHP/5.4.45 mod_ssl/2.2.29 OpenSSL/0.9.8zg
Last-Modified: Mon, 01 Feb 2016 20:41:18 GMT
ETag: "e72908-e0-52abb68241780"
MS-Author-Via: DAV
Content-Type: text/html
Date: Sat, 07 May 2016 23:02:46 GMT
Content-Length: 224
Connection: keep-alive
<html><head><link rel="shortcut icon" href="hXXp://cdn.
whatismyipaddress.com/favicon.ico"></head><body>No scri
pted access.  See hXXp://cdn.whatismyipaddress.com/api.html or contact
 [email protected]</body></html>HTTP/1.1 200 O
K..Server: Apache/2.2.29 (Unix) DAV/2 PHP/5.4.45 mod_ssl/2.2.29 OpenSS
L/0.9.8zg..Last-Modified: Mon, 01 Feb 2016 20:41:18 GMT..ETag: "e72908
-e0-52abb68241780"..MS-Author-Via: DAV..Content-Type: text/html..Date:
 Sat, 07 May 2016 23:02:46 GMT..Content-Length: 224..Connection: keep-
alive..<html><head><link rel="shortcut icon" href="http
://cdn.whatismyipaddress.com/favicon.ico"></head><body>
No scripted access.  See hXXp://cdn.whatismyipaddress.com/api.html or 
contact [email protected]</body></html>..

The Trojan connects to the servers at the folowing location(s):

Document00000pdf.exe_1484_rwx_00E50000_0000F000:

l.dli

Document00000pdf.exe_940:

.text
`.rsrc
@.reloc
K.nK:
%F=OS
{VGi.aJ
.LP2N
.Zp6oJ
U.WCM
%fLF*
6.ZpXx
$%Svc
.Ndvii
fBt.LB
.hZdDif
GV^%%f
.NvqPQ
.MqAD
^u%UUp
.kbA(
(%f\K
.uA?S2?
K.bUd
dCP?.xYH
.CUKa/
_.Sv8
%4u~A
6/D.VB
p.zGk6C
yq.XV
.BkxD
8:.Jk
3/q"j%c
.aSk\h_
i.MHf
.xI^iF
&.EV&s
8%xw-
.CgHv~
%S#E{
.Sw?N8
j.PN:
.hej[
4.Jxc
.uc}M
X%dIi
Tz.od
]JÌ
E.HT5
1.UO~
3R.Cl
$.UmW
}.sC>
v2.0.50727
System.Windows.Forms
6HsgHkEt03.resources
Q4k7swzMHODLnkgHCT.resources
TbeXyjIAnnkI.resources
2oJlEfjqKw.resources
Ty6B6WDJPG.resources
Uba7KFWJWnwO0h.resources
6fOgsVvqh9yXF7V.resources
7QRDyoTZDPqAFRC.resources
IvTmoxEDpb5.resources
b3BLGBrovFkNLeSDCVv.resources
gddkRvED70E6dUoYC.resources
50mFX4tJJzYM.resources
bqpYsKUhlcQaUacSd4.resources
0R1UvSEkdVHb3i8t5r.resources
6wheDZ8EfXLtTa08b.resources
TBoYmyED8IeIzQO.resources
80SWgwbogUTKad.resources
oSOWjGfD5P.resources
IWQJGlUzd9.resources
6lEm9T2MCWCT3.resources
I8kXXgH1gT5LO1sat9r.resources
Gj80HYYuNOC7UYiyh.resources
ECKtt8Rj5wGAv.resources
QikkqWtwZPrHL8sNX.resources
5YIktPs9vnBLEgs9Un.resources
0yNkQjownhZtij.resources
GFgorLzqtHgBuMRYW.resources
v3IiWuw5OBY1yHWHP.resources
CbxYClYSdEws5Ur.resources
XvgUsiuoplkd.resources
OcWh57tEFohb0.resources
P4v1fNe5tQrvFjdPEwI.resources
FiP69O9Mug9o.resources
dIfBQrnyFkqdP.resources
BjtJf0AkWxQ1G.resources
fN0Q4qWY8Ve7o6qMPY.resources
gdOeOCkC5z3bOm.resources
uNQPkO2rkkFjKGj.resources
CJWmDGClHDhZFzmR.resources
PMsm9E1cokX4ZAu.resources
TiJi96Eeo4HybQs2.resources
KoNzdVgPtTv.resources
npeo0o7LvP.resources
boktVO8Kz1YBWlPk.resources
EO5EzeYXDaUkg.resources
NoZQ65KWqzB.resources
oGvA0k1SjBFa.resources
uIyabEm1K5H6.resources
DcFqIMHN3znwxgQD4q.resources
xo0nnjFFbQWYKG.resources
GZ7hjNZRfW4oef9gV4a.resources
LV7hX4dknWvKbcP4.resources
HYJNGF6RiAQnsGNU.resources
j2ILTvDgzC.resources
dCKFtPisTB.resources
pwVDyC3dBI.resources
czKv6avrAP1.resources
jv3VxDUFefdYU52e0c.resources
7IwmS6KD7NQfTkaZhQ.resources
OAj4oi380wkxfhJ4lh6.resources
0D9PNDqLWvQF.resources
0VlKF2lL71SHTd8N.resources
1hypp6AJzUisU.resources
AGLvRbfHvGP2Cn.resources
xmw3tTayEKMKqIvaIWb.resources
qC0ZQas3GP.resources
adVCuzkW8mxh.resources
FHdo9ReQbb3PPUR4.resources
jG3WHZgVjzhqm.resources
HUs2X7r4sIMVN2d.resources
PNUHoHvf7a8vYnV.resources
8VfebGL7hvRvS2.resources
cPYZWRYEqa84A8Ka.resources
XmNeGpp4zPQVd9SzR.resources
Vq2x6hxf2mYi8OsJ.resources
stGJQPAv4lHBavMi.resources
4a4QROKQjXs8A.resources
AUnQqN6cQk8w6GQLe4.resources
FFwCsLU6hpMmbxQzkC6.resources
lmOXDWESrqOKj87hPX.resources
KT1JdA1AKUOo.resources
zzKftjpYj43hAipmbaU.resources
OgxQYvpC0CzT2DD.resources
kYslATWA8WS.resources
LsyceSn0CjTKun.resources
ZMmv8Z8iF9g6rBXElX.resources
eHWYEjfCmwhRsdS6.resources
OtD8YrJcBGxrwBd6Q.resources
frz6zXYPubUeY.resources
093foLlSXbGD3L.resources
frUC1n2GS81ga.resources
yMC52de38NKeDyLlR1q.resources
2x9j1r8xkhj.resources
oFWO3KwZcxzLtM.resources
P6yTqg8t8MTrNgKSY.resources
g382pnV0T0Ohkde.resources
nb8XhhaPELnG.resources
kGLvp05BJB4L.resources
YoUYOkqUMyF.resources
y8YmmQqoDfdM3oviRKA.resources
wtZerLauFJ.resources
xzb01snkv4AIZ5.resources
0Q52eiYA6gEKvJj3.resources
6V1XZkZ5zQgoWI.resources
uv1XsXGySZ.resources
DnTeAzwuSYr5co.resources
77KTWZJEA9MUKY.resources
RjhtHuWe0ouc.resources
jeQUSCBKDur5553rCPx.resources
yjBJjRyU41vxp.resources
sOOl465A0pspYsI9t.resources
V8SqgXjoEkVXXLC.resources
YcZRGbQYmFT.resources
Yi84VVOapsy.resources
eVRGBumRbPWdTS4nI2.resources
Shonxl287aAqOwKQ.resources
4V5ygwXpHVQs2pFkPL.resources
3bpv5iEyVO3aVae.resources
C6lbgnhGUWBtq7.resources
9ypUTXQqsCK7AVSFq.resources
G1xkxlZoT0RxblNM41.resources
GIYc5uSIQG14BBhv.resources
nK80wvjPU0n.resources
pC2Xqcl4ZmaYCt.resources
D5JIo6LQd2VDsR.resources
mhdij29aBW6WA9Ihz.resources
2FG0yjRWcJ1gYuQXq4U.resources
BSFC3usTiQHFKHy0.resources
O66GMIllOKM.resources
M9DLWpj927.resources
z8y4wgItBAFW.resources
A98txRxncRkWe5hUe0g.resources
Y1HZDktwFeQdOHiW.resources
sGmDNYZwR8l.resources
ICYnMgYxEErm.resources
.cctor
System.Security.Cryptography
System.Reflection
System.IO
.ctor
System.Threading
GetExecutingAssembly
set_Key
System.Runtime.CompilerServices
FtpbyoYSXTDiHGFHp4
FtVTLdyFtpD
YAywvWFpUuDP3thY
Te9PgvDpSqlU3X
BWnreeJB8u2CrTRO
SwHi0TZscPnYCVUURlP
zwj6kAuvtMsgc
81GOto5SjOiNuwPyh
RUWZTVhKZrTcP
24UiigCrtPC7WNMi9
WEbbM07mYms
Pc5lGWebIWjOped
TcP7hvR45moDc1Eo
ZcuAH3rkWFTP7gYQ
5iAkSQL8Y9
VdMmXzB1sshTzBcH7Q
VOcetsHfZwebXW2k8
EBZW74KEYUdPg2E
RnHSqLH6VC2hTM9mC8
X3HwPgOOPqA9iO7UrL
CrtPQ3BDxlvBNJk
pEIC05o80Lw8CrT7qk
9i7iCZFKeyXgAKEKph
54A7wV3lOJpeNzSQlrh
5cmd8utKZYdOOPdYuwd
kWSShhsvcSK099
4FEmsGzeeF10ql
cQ1RIpVcYeAJhnKey
Nqv50UQcmdnKtgPf
bvdviStCP3G
roxd7KHteEXe
MEXevFHk3LPsVCkNsKc
sPweBf7PlrUatDuUeDY
0lxBzJ1qWEXegC
Pb3eYHYLCmD7D1
kEYNzJN9NKDs
WlKEYtIs4VesUb
UJdUJEftpidgNaBf
qfurlKWxc5JHC
eAQ9YExe6Fdl
5q3XaHvtLssH
GBh6FTp4t5bWU
kEyVxEwJa8QJObqVN0s
nuwZ9exezj
adMDURlz47Z
jCqqFCV9eXemV4md
2CMdPHpH7PGT
DcexE8OTNQjjWWA
zk0Ourld9WTsNvb2b
X7sE96sQLVKLNJPNh
6XV4rIObUrLGSr
bMaKmsShGIz
Rx2oMOWkeyd4JD7
6fxSutH8DORzOuFkEy
0X6lftPWO6rljHCy0
LxaEN3YCmDg126EqoBb
iDdf6cRtYyCGbJqmkl
TPOijMSgXg
System.Diagnostics
System.Security
2.38.0.100
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
_CorExeMain
mscoree.dll
O.nM:
System.Reflection.ParameterInfo
System.Reflection.Assembly
System.Byte[]
Document00000pdf.exe

Document00000pdf.exe_940_rwx_00400000_0013A000:

.text
`.rsrc
@.reloc
K.nK:
%F=OS
{VGi.aJ
.LP2N
.Zp6oJ
U.WCM
%fLF*
6.ZpXx
$%Svc
.Ndvii
fBt.LB
.hZdDif
GV^%%f
.NvqPQ
.MqAD
^u%UUp
.kbA(
(%f\K
.uA?S2?
K.bUd
dCP?.xYH
.CUKa/
_.Sv8
%4u~A
6/D.VB
p.zGk6C
yq.XV
.BkxD
8:.Jk
3/q"j%c
.aSk\h_
i.MHf
.xI^iF
&.EV&s
8%xw-
.CgHv~
%S#E{
.Sw?N8
j.PN:
.hej[
4.Jxc
.uc}M
X%dIi
Tz.od
]JÌ
E.HT5
1.UO~
3R.Cl
$.UmW
}.sC>
v2.0.50727
System.Windows.Forms
6HsgHkEt03.resources
Q4k7swzMHODLnkgHCT.resources
TbeXyjIAnnkI.resources
2oJlEfjqKw.resources
Ty6B6WDJPG.resources
Uba7KFWJWnwO0h.resources
6fOgsVvqh9yXF7V.resources
7QRDyoTZDPqAFRC.resources
IvTmoxEDpb5.resources
b3BLGBrovFkNLeSDCVv.resources
gddkRvED70E6dUoYC.resources
50mFX4tJJzYM.resources
bqpYsKUhlcQaUacSd4.resources
0R1UvSEkdVHb3i8t5r.resources
6wheDZ8EfXLtTa08b.resources
TBoYmyED8IeIzQO.resources
80SWgwbogUTKad.resources
oSOWjGfD5P.resources
IWQJGlUzd9.resources
6lEm9T2MCWCT3.resources
I8kXXgH1gT5LO1sat9r.resources
Gj80HYYuNOC7UYiyh.resources
ECKtt8Rj5wGAv.resources
QikkqWtwZPrHL8sNX.resources
5YIktPs9vnBLEgs9Un.resources
0yNkQjownhZtij.resources
GFgorLzqtHgBuMRYW.resources
v3IiWuw5OBY1yHWHP.resources
CbxYClYSdEws5Ur.resources
XvgUsiuoplkd.resources
OcWh57tEFohb0.resources
P4v1fNe5tQrvFjdPEwI.resources
FiP69O9Mug9o.resources
dIfBQrnyFkqdP.resources
BjtJf0AkWxQ1G.resources
fN0Q4qWY8Ve7o6qMPY.resources
gdOeOCkC5z3bOm.resources
uNQPkO2rkkFjKGj.resources
CJWmDGClHDhZFzmR.resources
PMsm9E1cokX4ZAu.resources
TiJi96Eeo4HybQs2.resources
KoNzdVgPtTv.resources
npeo0o7LvP.resources
boktVO8Kz1YBWlPk.resources
EO5EzeYXDaUkg.resources
NoZQ65KWqzB.resources
oGvA0k1SjBFa.resources
uIyabEm1K5H6.resources
DcFqIMHN3znwxgQD4q.resources
xo0nnjFFbQWYKG.resources
GZ7hjNZRfW4oef9gV4a.resources
LV7hX4dknWvKbcP4.resources
HYJNGF6RiAQnsGNU.resources
j2ILTvDgzC.resources
dCKFtPisTB.resources
pwVDyC3dBI.resources
czKv6avrAP1.resources
jv3VxDUFefdYU52e0c.resources
7IwmS6KD7NQfTkaZhQ.resources
OAj4oi380wkxfhJ4lh6.resources
0D9PNDqLWvQF.resources
0VlKF2lL71SHTd8N.resources
1hypp6AJzUisU.resources
AGLvRbfHvGP2Cn.resources
xmw3tTayEKMKqIvaIWb.resources
qC0ZQas3GP.resources
adVCuzkW8mxh.resources
FHdo9ReQbb3PPUR4.resources
jG3WHZgVjzhqm.resources
HUs2X7r4sIMVN2d.resources
PNUHoHvf7a8vYnV.resources
8VfebGL7hvRvS2.resources
cPYZWRYEqa84A8Ka.resources
XmNeGpp4zPQVd9SzR.resources
Vq2x6hxf2mYi8OsJ.resources
stGJQPAv4lHBavMi.resources
4a4QROKQjXs8A.resources
AUnQqN6cQk8w6GQLe4.resources
FFwCsLU6hpMmbxQzkC6.resources
lmOXDWESrqOKj87hPX.resources
KT1JdA1AKUOo.resources
zzKftjpYj43hAipmbaU.resources
OgxQYvpC0CzT2DD.resources
kYslATWA8WS.resources
LsyceSn0CjTKun.resources
ZMmv8Z8iF9g6rBXElX.resources
eHWYEjfCmwhRsdS6.resources
OtD8YrJcBGxrwBd6Q.resources
frz6zXYPubUeY.resources
093foLlSXbGD3L.resources
frUC1n2GS81ga.resources
yMC52de38NKeDyLlR1q.resources
2x9j1r8xkhj.resources
oFWO3KwZcxzLtM.resources
P6yTqg8t8MTrNgKSY.resources
g382pnV0T0Ohkde.resources
nb8XhhaPELnG.resources
kGLvp05BJB4L.resources
YoUYOkqUMyF.resources
y8YmmQqoDfdM3oviRKA.resources
wtZerLauFJ.resources
xzb01snkv4AIZ5.resources
0Q52eiYA6gEKvJj3.resources
6V1XZkZ5zQgoWI.resources
uv1XsXGySZ.resources
DnTeAzwuSYr5co.resources
77KTWZJEA9MUKY.resources
RjhtHuWe0ouc.resources
jeQUSCBKDur5553rCPx.resources
yjBJjRyU41vxp.resources
sOOl465A0pspYsI9t.resources
V8SqgXjoEkVXXLC.resources
YcZRGbQYmFT.resources
Yi84VVOapsy.resources
eVRGBumRbPWdTS4nI2.resources
Shonxl287aAqOwKQ.resources
4V5ygwXpHVQs2pFkPL.resources
3bpv5iEyVO3aVae.resources
C6lbgnhGUWBtq7.resources
9ypUTXQqsCK7AVSFq.resources
G1xkxlZoT0RxblNM41.resources
GIYc5uSIQG14BBhv.resources
nK80wvjPU0n.resources
pC2Xqcl4ZmaYCt.resources
D5JIo6LQd2VDsR.resources
mhdij29aBW6WA9Ihz.resources
2FG0yjRWcJ1gYuQXq4U.resources
BSFC3usTiQHFKHy0.resources
O66GMIllOKM.resources
M9DLWpj927.resources
z8y4wgItBAFW.resources
A98txRxncRkWe5hUe0g.resources
Y1HZDktwFeQdOHiW.resources
sGmDNYZwR8l.resources
ICYnMgYxEErm.resources
.cctor
System.Security.Cryptography
System.Reflection
System.IO
.ctor
System.Threading
GetExecutingAssembly
set_Key
System.Runtime.CompilerServices
FtpbyoYSXTDiHGFHp4
FtVTLdyFtpD
YAywvWFpUuDP3thY
Te9PgvDpSqlU3X
BWnreeJB8u2CrTRO
SwHi0TZscPnYCVUURlP
zwj6kAuvtMsgc
81GOto5SjOiNuwPyh
RUWZTVhKZrTcP
24UiigCrtPC7WNMi9
WEbbM07mYms
Pc5lGWebIWjOped
TcP7hvR45moDc1Eo
ZcuAH3rkWFTP7gYQ
5iAkSQL8Y9
VdMmXzB1sshTzBcH7Q
VOcetsHfZwebXW2k8
EBZW74KEYUdPg2E
RnHSqLH6VC2hTM9mC8
X3HwPgOOPqA9iO7UrL
CrtPQ3BDxlvBNJk
pEIC05o80Lw8CrT7qk
9i7iCZFKeyXgAKEKph
54A7wV3lOJpeNzSQlrh
5cmd8utKZYdOOPdYuwd
kWSShhsvcSK099
4FEmsGzeeF10ql
cQ1RIpVcYeAJhnKey
Nqv50UQcmdnKtgPf
bvdviStCP3G
roxd7KHteEXe
MEXevFHk3LPsVCkNsKc
sPweBf7PlrUatDuUeDY
0lxBzJ1qWEXegC
Pb3eYHYLCmD7D1
kEYNzJN9NKDs
WlKEYtIs4VesUb
UJdUJEftpidgNaBf
qfurlKWxc5JHC
eAQ9YExe6Fdl
5q3XaHvtLssH
GBh6FTp4t5bWU
kEyVxEwJa8QJObqVN0s
nuwZ9exezj
adMDURlz47Z
jCqqFCV9eXemV4md
2CMdPHpH7PGT
DcexE8OTNQjjWWA
zk0Ourld9WTsNvb2b
X7sE96sQLVKLNJPNh
6XV4rIObUrLGSr
bMaKmsShGIz
Rx2oMOWkeyd4JD7
6fxSutH8DORzOuFkEy
0X6lftPWO6rljHCy0
LxaEN3YCmDg126EqoBb
iDdf6cRtYyCGbJqmkl
TPOijMSgXg
System.Diagnostics
System.Security
2.38.0.100
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
_CorExeMain
mscoree.dll
O.nM:
System.Reflection.ParameterInfo
System.Reflection.Assembly
System.Byte[]
Document00000pdf.exe

Document00000pdf.exe_1524:

.text
`.rsrc
@.reloc
6v.JZ Y=
Xs.Bsq
-AA}by
IC.KF
.Rrr:
`pFm.iY
^@\%X;
`~.nD
L.aCCJ
44S%S
Wv*.te
)%FTM.
7t%x0
/-"V%dv
lF%F>
.px)]
s.bI$Rwbn
Ok.WL
.kM2i
.v%DTp
%XdwB
zvV\.EFJm{
4.Cf@
.iTv5
JFz[/.Qx
"(.RF~
&.fF#
.iC@q
$w.YI
:|.%xRt
HN.HN^$n(jt
.%S~(
x).Ak2h"
v2.0.50727
System.Windows.Forms
HfQVU8IeE0V8.resources
Rc0WSlbch0o0o.resources
TkPe6x7h8B.resources
zWLwsiBXLJgkoLUa4Qb.resources
5n6eX2B0Fvgb.resources
UU1HytYxzm.resources
jqQyQarMSZqJZ.resources
jly7ivE1hDdHTAcG.resources
M8AVXWTmEynCUZMv9rC.resources
b8e3mCNiCHER6I.resources
L43U1MIHrrz.resources
iblZIAgA15Kv8FbGV.resources
4M8ciWzI3PMy9MxrKX.resources
a43K7lVdIIgE22.resources
pjYCh1mqJHXO.resources
2e56FdD6wiwrchO9Hi6.resources
VJty5TSX4fedXM.resources
ZDkMJhjioLL4S.resources
qqIBipd7DqoS2wBtNl.resources
5rbbkjsUO5AfA92.resources
dZmFJiI9kJtbgxt4mn.resources
BFDhU5FGeeBOS9oA.resources
mHMNUnuAdNkg0HB.resources
xzjAh2KrRT7.resources
oEbuYZZXP0khUG.resources
ucQsv9vk41qyU.resources
CcwQDEYWaTcarDRBqtA.resources
AKryATVaRhLs8VB.resources
hN3dAHa5Md5XNu0.resources
Y9brkL0iJP75VpdkN7I.resources
ab74UiRnOwv.resources
nVE9mYfI8CUwK.resources
pHqG61PGVcwE.resources
phWOGdSIqKd2tYq.resources
n16dk8Bn4zTB.resources
qu76dtlIf2NuLp8BV.resources
iOQbTzhhsEeGOLNB9S.resources
51HLJs8iuPMN.resources
ofvgyDD1K720TPyu.resources
4pbI0qE0YdZ8.resources
JcFWUxcPRb8.resources
g4V2dDHwNGJWr.resources
f4nPQu3OkUde.resources
8XKWCnaDzJ.resources
UA06xwHsbgiWs372RJF.resources
HaPJjuf4r3Go.resources
mr0j7gh1wGB1.resources
ZINUJ6EQlvqpH.resources
NCiTP9dC0iSU.resources
bnFZCM6SHzIdLH.resources
iJMukwWz3af2uYJK4a.resources
twH1gxYDpHAl1y.resources
GakTgQ6yYcI601.resources
nDwgSCENACOnlml1vOK.resources
Umm5roL5UK.resources
3Cak8kFLFdvJL.resources
eG3QRsboCE8dzaEr.resources
k3nHFioxAY0t2aL.resources
hwRMTeZ9X9LlVsEh.resources
HtBxwnUCu3WIt2k.resources
Z0p9fegbn4Gm.resources
OnkARfz5cfD6rbprEJ.resources
QrjcljvDMm6.resources
Xi6OZa6AHdy.resources
DUeaGzy5gI8.resources
ke8xiAjUmi2MiMG3Z.resources
QgYuYVgd8Y.resources
q1dpajEdDR.resources
6BXZFdeNWQ.resources
piXesydu4SUQnh.resources
J6PsK3Scl5cfowpp.resources
GALznoto9ZOR.resources
bvj7UuhhYIICEu.resources
urzCEfCNUSkNTrKbr1.resources
O97sTr3e5eay6ehw6Q.resources
qsSIYchlXseaT3PIM.resources
1AKOs0CckcC.resources
wX6h1J7EfMhC.resources
032JmvTm3z0.resources
WqCVbt4UZa.resources
.cctor
System.Security.Cryptography
System.Reflection
System.IO
voRE5H8OssH6JPQ
.ctor
System.Threading
GetExecutingAssembly
set_Key
System.Runtime.CompilerServices
qntbAFtP3K
kpklcmdkF3Kk
6x0mtiPMJFtPWc
AHT0qSGuDpofs
3ytKnoz5CmDM0o23qa
h8dLIrOhmdwEBH
HfVCkSqlrA
KGrfW17p4CrtPx
casShGmpVzTzt7KS9
Hg7f3EoSuDPEz4rhAM
LUxFTPHo8u
mdTEm7IjawewFtCPs
MUIy5zporTDA
PUTsx7rUmSGrmBa
keyTh1eAN2nTiuMEuo
1dsb1ChzAlN7SshAGb
p3pMCMD3rMTrwv0Qk
KiTdEBj4sshI
iLgwfTp4BXRUZynylo7
aUi4uRLsEwreFcZ8Ts
LH0g1nTCPIDDhnixl
NCWcraSd1bCrTAa
MExkEYoO1lEb
jI4p4faRkgCmD1vhE1
key33ZMjfoUDsz
nsOIAi0fGWcmdh6By
hJJQYcrtVOE2Pu1q
hCuCf9uDBvcmdvwwkt
VwmyudPDHkgh
OEZViwmXZ7bX1DJeuDp
No0TgYEFFUdpLhj6
EFtplGn2z5I5
jhMsgqE7yaOCXag
LY2pVIrCmd
yzcPtokEYavnLoNoU
R577KurLLqX5WfKxxfC
uOYuhynrbztcPzDoDT
7GU1NZuunIosSh
FtPB9GXt7MQ
4ftommmSGtV8w8Yo
crt1gfnHJL
Msg6iryHXel
u8YmmXizlUrlN
SSHz7oebillYY
vkEyNjORar
ilswE2cMDrHlHRrfKU
urlGCIAVmw
MJwEBDDdFJp7bT0Jy
FTPkxRNTQahb4IW
nbICRT5LjK
mmSG9yjKL0
lesm9H9rKWeBy6bKi
Ah7jzriZbnLmseXet
Yme6zexESLoSb2
RCRUDpXBY654LZuGYM
7aUwEBgva3vL
bsqlHjo4WpbIoXh
mYgWeBCzu78E2
fNrDKey4l8WpsKYG
cx8KEYNH9QVr
System.Diagnostics
System.Security
2.38.0.100
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
_CorExeMain
mscoree.dll
System.Reflection.Assembly
System.Byte[]
System.Reflection.ParameterInfo
Document00000pdf.exe

Document00000pdf.exe_940_rwx_00E00000_0000F000:

l.dlf
l.dli

Document00000pdf.exe_1524_rwx_00400000_000E8000:

.text
`.rsrc
@.reloc
6v.JZ Y=
Xs.Bsq
-AA}by
IC.KF
.Rrr:
`pFm.iY
^@\%X;
`~.nD
L.aCCJ
44S%S
Wv*.te
)%FTM.
7t%x0
/-"V%dv
lF%F>
.px)]
s.bI$Rwbn
Ok.WL
.kM2i
.v%DTp
%XdwB
zvV\.EFJm{
4.Cf@
.iTv5
JFz[/.Qx
"(.RF~
&.fF#
.iC@q
$w.YI
:|.%xRt
HN.HN^$n(jt
.%S~(
x).Ak2h"
v2.0.50727
System.Windows.Forms
HfQVU8IeE0V8.resources
Rc0WSlbch0o0o.resources
TkPe6x7h8B.resources
zWLwsiBXLJgkoLUa4Qb.resources
5n6eX2B0Fvgb.resources
UU1HytYxzm.resources
jqQyQarMSZqJZ.resources
jly7ivE1hDdHTAcG.resources
M8AVXWTmEynCUZMv9rC.resources
b8e3mCNiCHER6I.resources
L43U1MIHrrz.resources
iblZIAgA15Kv8FbGV.resources
4M8ciWzI3PMy9MxrKX.resources
a43K7lVdIIgE22.resources
pjYCh1mqJHXO.resources
2e56FdD6wiwrchO9Hi6.resources
VJty5TSX4fedXM.resources
ZDkMJhjioLL4S.resources
qqIBipd7DqoS2wBtNl.resources
5rbbkjsUO5AfA92.resources
dZmFJiI9kJtbgxt4mn.resources
BFDhU5FGeeBOS9oA.resources
mHMNUnuAdNkg0HB.resources
xzjAh2KrRT7.resources
oEbuYZZXP0khUG.resources
ucQsv9vk41qyU.resources
CcwQDEYWaTcarDRBqtA.resources
AKryATVaRhLs8VB.resources
hN3dAHa5Md5XNu0.resources
Y9brkL0iJP75VpdkN7I.resources
ab74UiRnOwv.resources
nVE9mYfI8CUwK.resources
pHqG61PGVcwE.resources
phWOGdSIqKd2tYq.resources
n16dk8Bn4zTB.resources
qu76dtlIf2NuLp8BV.resources
iOQbTzhhsEeGOLNB9S.resources
51HLJs8iuPMN.resources
ofvgyDD1K720TPyu.resources
4pbI0qE0YdZ8.resources
JcFWUxcPRb8.resources
g4V2dDHwNGJWr.resources
f4nPQu3OkUde.resources
8XKWCnaDzJ.resources
UA06xwHsbgiWs372RJF.resources
HaPJjuf4r3Go.resources
mr0j7gh1wGB1.resources
ZINUJ6EQlvqpH.resources
NCiTP9dC0iSU.resources
bnFZCM6SHzIdLH.resources
iJMukwWz3af2uYJK4a.resources
twH1gxYDpHAl1y.resources
GakTgQ6yYcI601.resources
nDwgSCENACOnlml1vOK.resources
Umm5roL5UK.resources
3Cak8kFLFdvJL.resources
eG3QRsboCE8dzaEr.resources
k3nHFioxAY0t2aL.resources
hwRMTeZ9X9LlVsEh.resources
HtBxwnUCu3WIt2k.resources
Z0p9fegbn4Gm.resources
OnkARfz5cfD6rbprEJ.resources
QrjcljvDMm6.resources
Xi6OZa6AHdy.resources
DUeaGzy5gI8.resources
ke8xiAjUmi2MiMG3Z.resources
QgYuYVgd8Y.resources
q1dpajEdDR.resources
6BXZFdeNWQ.resources
piXesydu4SUQnh.resources
J6PsK3Scl5cfowpp.resources
GALznoto9ZOR.resources
bvj7UuhhYIICEu.resources
urzCEfCNUSkNTrKbr1.resources
O97sTr3e5eay6ehw6Q.resources
qsSIYchlXseaT3PIM.resources
1AKOs0CckcC.resources
wX6h1J7EfMhC.resources
032JmvTm3z0.resources
WqCVbt4UZa.resources
.cctor
System.Security.Cryptography
System.Reflection
System.IO
voRE5H8OssH6JPQ
.ctor
System.Threading
GetExecutingAssembly
set_Key
System.Runtime.CompilerServices
qntbAFtP3K
kpklcmdkF3Kk
6x0mtiPMJFtPWc
AHT0qSGuDpofs
3ytKnoz5CmDM0o23qa
h8dLIrOhmdwEBH
HfVCkSqlrA
KGrfW17p4CrtPx
casShGmpVzTzt7KS9
Hg7f3EoSuDPEz4rhAM
LUxFTPHo8u
mdTEm7IjawewFtCPs
MUIy5zporTDA
PUTsx7rUmSGrmBa
keyTh1eAN2nTiuMEuo
1dsb1ChzAlN7SshAGb
p3pMCMD3rMTrwv0Qk
KiTdEBj4sshI
iLgwfTp4BXRUZynylo7
aUi4uRLsEwreFcZ8Ts
LH0g1nTCPIDDhnixl
NCWcraSd1bCrTAa
MExkEYoO1lEb
jI4p4faRkgCmD1vhE1
key33ZMjfoUDsz
nsOIAi0fGWcmdh6By
hJJQYcrtVOE2Pu1q
hCuCf9uDBvcmdvwwkt
VwmyudPDHkgh
OEZViwmXZ7bX1DJeuDp
No0TgYEFFUdpLhj6
EFtplGn2z5I5
jhMsgqE7yaOCXag
LY2pVIrCmd
yzcPtokEYavnLoNoU
R577KurLLqX5WfKxxfC
uOYuhynrbztcPzDoDT
7GU1NZuunIosSh
FtPB9GXt7MQ
4ftommmSGtV8w8Yo
crt1gfnHJL
Msg6iryHXel
u8YmmXizlUrlN
SSHz7oebillYY
vkEyNjORar
ilswE2cMDrHlHRrfKU
urlGCIAVmw
MJwEBDDdFJp7bT0Jy
FTPkxRNTQahb4IW
nbICRT5LjK
mmSG9yjKL0
lesm9H9rKWeBy6bKi
Ah7jzriZbnLmseXet
Yme6zexESLoSb2
RCRUDpXBY654LZuGYM
7aUwEBgva3vL
bsqlHjo4WpbIoXh
mYgWeBCzu78E2
fNrDKey4l8WpsKYG
cx8KEYNH9QVr
System.Diagnostics
System.Security
2.38.0.100
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
_CorExeMain
mscoree.dll
System.Reflection.Assembly
System.Byte[]
System.Reflection.ParameterInfo
Document00000pdf.exe

Document00000pdf.exe_1524_rwx_00A5A000_00002000:

.VByZX

Document00000pdf.exe_1524_rwx_00DB0000_0000E000:

l.dli
l.dlf
.lZx%

Document00000pdf.exe_1512:

.text
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
v2.0.50727
CMemoryExecute.dll
CMemoryExecute
PAGE_EXECUTE_READWRITE
.ctor
System.Reflection
System.Runtime.InteropServices
System.Security.Permissions
System.Diagnostics
System.Runtime.CompilerServices
DllImportAttribute
kernel32.dll
ntdll.dll
System.Security
$8fcd4931-91a2-4e18-849b-70de34ab75df
1.0.0.0
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb
mscoree.dll
`.rdata
@.data
.rsrc
D$.SPf
 2 34 567
com.apple.Safari
com.apple.WebKit2WebProcess
SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins
"Account","Login Name","Password","Web Site","Comments"
3.7.5
SQLite format 3
CREATE TABLE sqlite_master(
sql text
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins
PK11_GetInternalKeySlot
PK11_CheckUserPassword
large file support is disabled
unknown operation
SQL logic error or missing database
foreign_keys
sqlite_compileoption_get
sqlite_compileoption_used
sqlite_source_id
sqlite_version
sqlite_attach
sqlite_detach
sqlite_stat1
sqlite_rename_parent
sqlite_rename_trigger
sqlite_rename_table
%Y-%m-%d %H:%M:%S
%Y-%m-%d
%H:%M:%S
SQLITE_
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
922337203685477580
API call with %s database connection pointer
%s-shm
%s\etilqs_
OsError 0x%x (%u)
Recovered %d frames from WAL file %s
%s-mjX
foreign key constraint failed
unable to use function %s in the requested context
abort at %d in [%s]: %s
constraint failed at %d in [%s]
cannot open savepoint - SQL statements in progress
no such savepoint: %s
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot change %s wal mode from within a transaction
statement aborts at %d: [%s] %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s
%s: %s
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
too many SQL variables
too many columns in %s
oversized integer: %s%s
misuse of aggregate: %s()
%.*s"%w"%s
%s%.*s"%w"
%s OR name=%Q
type='trigger' AND (%s)
there is already another table or index with this name: %s
sqlite_
table %s may not be altered
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE tbl=%Q
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
too many attached databases - max %d
database %s is already in use
unable to open database: %s
no such database: %s
cannot detach database %s
database %s is locked
%s %T cannot reference objects in database %s
object name reserved for internal use: %s
there is already an index named %s
too many columns on %s
duplicate column name: %s
default value of column [%s] is not constant
table "%s" has more than one primary key
no such collation sequence: %s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
view %s is circularly defined
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
indexed columns are not unique
table %s may not be indexed
views may not be indexed
virtual tables may not be indexed
there is already a table named %s
index %s already exists
sqlite_autoindex_%s_%d
table %s has no column named %s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
a JOIN clause is required before %s
unable to identify the object to be reindexed
table %s may not be modified
cannot modify %s because it is a view
foreign key mismatch
table %S has %d columns but %d values were supplied
%d values for %d columns
table %S has no column named %s
%s.%s may not be NULL
PRIMARY KEY must be unique
automatic extension loading failed: %s
foreign_key_list
malformed database schema (%s)
%s - %s
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
%s.%s
%s:%d
no such index: %s
sqlite_subquery_%p_
no such table: %s
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
no such column: %s
cannot VACUUM - SQL statements in progress
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor did not declare schema: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
cannot use index: %s
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
unable to close due to unfinished backup operation
unknown database: %s
no such vfs: %s
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
sqlite3_open
sqlite3_prepare
sqlite3_step
sqlite3_column_text
sqlite3_column_int
sqlite3_column_int64
sqlite3_finalize
sqlite3_close
sqlite3_exec
f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb
msvcrt.dll
_wcmdln
COMCTL32.dll
VERSION.dll
FindCloseUrlCache
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
WININET.dll
GetWindowsDirectoryW
KERNEL32.dll
EnumChildWindows
USER32.dll
GDI32.dll
comdlg32.dll
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
ADVAPI32.dll
ShellExecuteW
SHELL32.dll
ole32.dll
5JEw%Xg
<assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
hXXp://VVV.usertrust.com1
3hXXp://crl.usertrust.com/AddTrustExternalCARoot.crl05
hXXp://ocsp.usertrust.com0
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl05
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl0t
1hXXp://crt.usertrust.com/UTNAddTrustObject_CA.crt0%
hXXps://secure.comodo.net/CPS0A
0hXXp://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
0hXXp://crt.comodoca.com/COMODOCodeSigningCA2.crt0$
hXXp://ocsp.comodoca.com0
[email protected]
t{SSh
v%SSW
Mail PassView
Mozilla\Profiles
Software\Mozilla\Mozilla Thunderbird
%s\Main
sqlite3.dll
nss3.dll
%programfiles%\Mozilla Thunderbird
AddExportHeaderLine
%s %s %s
HTTPMail User Name
SMTP USer Name
HTTPMail Server
SMTP Server
POP3 Password2
IMAP Password2
HTTPMail Password2
SMTP Password2
POP3 Port
IMAP Port
HTTPMail Port
SMTP Port
HTTPMail Secure Connection
SMTP Secure Connection
SMTP Display Name
SMTP Email Address
POP3 Password
IMAP Password
HTTP Password
SMTP Password
HTTP User
SMTP User
HTTP Server URL
HTTP Port
HTTPMail Use SSL
SMTP Use SSL
%s\%s
PopPort
PopPassword
SMTPAccount
SMTPServer
SMTPPort
SMTPLogSecure
SMTPPassword
%s\Accounts
LoginName
SavePasswordText
ESMTPUsername
ESMTPPassword
POP3Password
fb.dat
%[email protected]
%[email protected]
Software\Microsoft\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
<meta http-equiv='content-type' content='text/html;charset=%s'>
<br><h4>%s <a href="hXXp://VVV.nirsoft.net/" target="newwin">%s</a></h4><p>
smtp
advapi32.dll
comctl32.dll
*.ini
netmsg.dll
Error %d: %s
%s (%s)
menu_%d
dialog_%d
TranslatorURL
_lng.ini
%-18s: %s
%%-%d.%ds
<td bgcolor=#%s nowrap>%s
<td bgcolor=#%s>%s
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
bgcolor="%s"
<font color="%s">%s</font>
<%s>%s</%s>
</%s>
report.html
*.txt
*.htm;*.html
*.xml
*.csv
Software\NirSoft\MailPassView
MailPassView
/skeepass
/deleteregkey
Failed to load the executable file !
mail.account.account
mail.server
port
mail.identity
signon.signonfilename
mailbox://%s@%s
imap://%s@%s
mailbox://%s
imap://%s
signons.txt
signons.sqlite
prefs.js
Password.NET Messenger Service
User.NET Messenger Service
Passport.Net\*
ps:password
windowslive:name=
Exception %8.8X at address %8.8X in module %s
Stack Data: %s
Code Data: %s
mozsqlite3.dll
psapi.dll
pstorec.dll
5e7e8100-9138-11d1-945a-00c04fc308ff
00000000-0000-0000-0000-000000000000
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
220D5CC1-853A-11D0-84BC-00C04FD43F8F
417E2D75-84BD-11D0-84BB-00C04FD43F8F
shell32.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
shlwapi.dll
<html><head>%s<title>%s</title></head>
%s <h3>%s</h3>
size="%d"
color="#%s"
<font color="%s">
<table border="1" cellpadding="5"><tr%s>
width="%s"
<th%s>%s%s%s
SOFTWARE\Mozilla
mozilla
%s\bin
PathToExe
\sqlite3.dll
\mozsqlite3.dll
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Live Mail
SMTP_Server
SMTP_User_Name
POP3_Password2
IMAP_Password2
NNTP_Password2
SMTP_Password2
SMTP_Email_Address
SMTP_Port
NNTP_Port
IMAP_Port
POP3_Port
SMTP_Secure_Connection
*.oeaccount
\Microsoft\Windows Mail
\Microsoft\Windows Live Mail
f:\Projects\VS2005\mailpv\Release\mailpv.pdb
_acmdln
RPCRT4.dll
GetWindowsDirectoryA
RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyA
RegEnumKeyExA
ShellExecuteA
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="NirSoft" type="win32"></assemblyIdentity><description>NirSoft</description><dependency><dependentAssembly><assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
Debugger.exe
Microsoft.VisualBasic
System.Windows.Forms
System.Drawing
System.Management
tapi32.dll
rtm.dll
user32.dll
Debugger.Debugger.resources
Debugger.Resources.resources
Debugger.My
WindowsFormsApplicationBase
Microsoft.VisualBasic.ApplicationServices
System.ComponentModel
System.CodeDom.Compiler
Microsoft.VisualBasic.Devices
m_MyWebServicesObjectProvider
.cctor
get_WebServices
HelpKeywordAttribute
System.ComponentModel.Design
WebServices
Microsoft.VisualBasic.CompilerServices
System.Collections
ContainsKey
InvalidOperationException
MyWebServices
encryptedpassstring
encryptedsmtpstring
portstring
fakeMSGholder
encryptedftphost
encryptedftpuser
encryptedftppass
useftp
websitevisitor
websiteblocker
passstring
smtpstring
ftphost
ftpuser
ftppass
WM_KEYUP
WM_KEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYUP
KeyboardHandle
KeyLog
CleanedPasswordsMAIL
CleanedPasswordsWB
System.IO
get_ExecutablePath
set_WindowState
FormWindowState
UnhookWindowsHookEx
SetWindowsHookEx
SetWindowsHookExA
GetAsyncKeyState
vKey
HookKeyboard
UnhookKeyboard
Operators
get_Keyboard
Keyboard
get_CtrlKeyDown
get_AltKeyDown
KeyboardCallback
System.Threading
System.Collections.Generic
Microsoft.VisualBasic.MyServices
System.Collections.ObjectModel
MsgBox
MsgBoxResult
MsgBoxStyle
ForceSteamLogin
System.Net.NetworkInformation
get_OperationalStatus
OperationalStatus
FakemsgInstall
System.Net.Mail
SmtpClient
System.Globalization
set_Port
System.Net
Microsoft.Win32
RegistryKey
OpenSubKey
System.Security.Cryptography
System.Text
set_Key
stealWebroswers
WebClient
readweb
System.IO.Compression
SendLogsFTP
FtpWebRequest
WebRequest
UploadFTP
secretKey
set_KeySize
get_KeySize
System.Net.Sockets
virtualKey
KeyboardHookDelegate
get_Msg
Debugger.My.Resources
System.Resources
get_CMemoryExecute
get_WebBrowserPassView
WebBrowserPassView
System.Configuration
8.0.0.0
My.Computer
My.Application
My.User
My.Forms
My.WebServices
System.Windows.Forms.Form
My.MyProject.Forms
4System.Web.Services.Protocols.SoapHttpClientProtocol
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
10.0.0.0
My.Settings
$e48811ca-8af8-4e73-85dd-2045b9cca73a
_CorExeMain
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
%%0.ß
Apple Computer\Preferences\keychain.plist
LoadPasswordsIE
LoadPasswordsFirefox
LoadPasswordsChrome
LoadPasswordsOpera
LoadPasswordsSafari
LoadPasswordsSeaMonkey
UseFirefoxProfileFolder
UseFirefoxInstallFolder
UseChromeProfileFolder
UseOperaPasswordFile
FirefoxProfileFolder
FirefoxInstallFolder
ChromeProfileFolder
OperaPasswordFile
Aadvapi32.dll
crypt32.dll
777705555443332
5555443332
5555443332
wand.dat
@nss3.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe
%programfiles%\Sea Monkey
%programfiles%\Mozilla Firefox
-signons.txt
signons2.txt
signons3.txt
@dllhost.exe
taskhost.exe
taskhostex.exe
Microsoft\Windows\WebCache\WebCacheV01.dat
Microsoft\Windows\WebCache\WebCacheV24.dat
index.dat
hXXps://VVV.google.com/accounts/servicelogin
hXXp://VVV.facebook.com/
hXXps://login.yahoo.com/config/login
hXXp://
hXXps://
PTF://
@history.dat
places.sqlite
Mozilla\Firefox\Profiles
Mozilla\SeaMonkey\Profiles
Mozilla\SeaMonkey
Mozilla\Firefox
profiles.ini
Profile%d
tntdll.dll
sWeb Data
Login Data
Google\Chrome\User Data
Google\Chrome SxS\User Data
Opera\Opera\wand.dat
Opera\Opera7\profile\wand.dat
Opera
@"%s"
Ashell32.dll
\nss3.dll
.save
vaultcli.dll
abe2869f-9b47-4cd9-a358-c22904dba7f7
Copy &Password
&HTML Report - All Items
HTML R&eport - Selected Items
HTML Report - All Items
HTML Report - Selected Items
Load Passwords From...
Google Chrome
Mozilla Firefox
SeaMonkey
Firefox Options
Master password:
Firefox Profile:
Firefox Installation:
Chrome Options
Opera Options
wand.dat file:
%d Passwords
, %d Selected
Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat)
Loading... %d
KeePass csv file
Opera Password File
Firefox 1.x
Firefox 2.x
Firefox 3.0
Firefox
Chrome
Web Browser
Password
Password Strength
Password Field
WebBrowserPassView.exe
VVV.google.com/Please log in to your Gmail account
VVV.google.com:443/Please log in to your Gmail account
VVV.google.com/Please log in to your Google Account
VVV.google.com:443/Please log in to your Google Account
VVV.google.com
dWindowsLive:name=*
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
Copy Password
%d items
Select Eudora.ini filename/Select the location of Thunderbird installation
Eudora.ini file
SMTP
Windows Mail
Windows Live Mail
Server Port
SMTP Server Port
Mail Password Recovery
mailpv.exe
3,  7 #,)
2400000
MessageBoxIcon.Error
noftp
filename.exe
hXXp://VVV.example.com/directory/file.exe
Disablecmd
\Windows Update.exe
\WindowsUpdate.exe
SysInfo.txt
\pid.txt
\pidloc.txt
\Mozilla\Firefox\Profiles
127.0.0.1
\SteamAppData.vdf
\ClientRegistry.blob
MessageBoxIcon.Exclamation
Keylogger Enabled:
Operating System:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
autorun.inf
open=Sys.exe
Sys.exe
Software\Microsoft\Windows\CurrentVersion\Run
Windows Update
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Microsoft.NET\Framework\v2.0.50727\vbc.exe
holdermail.txt"
holdermail.txt
Operating System Intel Recovery
Operating System Platform:
Operating System Version:
WEB Browser Password Recovery
Mail Messenger Password Recovery
Jdownloader Password Recovery
holderwb.txt"
holderwb.txt
\.minecraft\lastlogin
There is a file attached to this email containing Minecraft username and password download it then decrypt the login information with my Minecraft Decryptor
Logger - Key Recorder - [
Keylogger Log
.jpeg
Logger_KeyLog_
hXXp://whatismyipaddress.com/
Debugger.Resources
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Document00000pdf.exe_1512_rwx_00400000_00084000:

.text
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
v2.0.50727
CMemoryExecute.dll
CMemoryExecute
PAGE_EXECUTE_READWRITE
.ctor
System.Reflection
System.Runtime.InteropServices
System.Security.Permissions
System.Diagnostics
System.Runtime.CompilerServices
DllImportAttribute
kernel32.dll
ntdll.dll
System.Security
$8fcd4931-91a2-4e18-849b-70de34ab75df
1.0.0.0
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb
mscoree.dll
`.rdata
@.data
.rsrc
D$.SPf
 2 34 567
com.apple.Safari
com.apple.WebKit2WebProcess
SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins
"Account","Login Name","Password","Web Site","Comments"
3.7.5
SQLite format 3
CREATE TABLE sqlite_master(
sql text
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins
PK11_GetInternalKeySlot
PK11_CheckUserPassword
large file support is disabled
unknown operation
SQL logic error or missing database
foreign_keys
sqlite_compileoption_get
sqlite_compileoption_used
sqlite_source_id
sqlite_version
sqlite_attach
sqlite_detach
sqlite_stat1
sqlite_rename_parent
sqlite_rename_trigger
sqlite_rename_table
%Y-%m-%d %H:%M:%S
%Y-%m-%d
%H:%M:%S
SQLITE_
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
922337203685477580
API call with %s database connection pointer
%s-shm
%s\etilqs_
OsError 0x%x (%u)
Recovered %d frames from WAL file %s
%s-mjX
foreign key constraint failed
unable to use function %s in the requested context
abort at %d in [%s]: %s
constraint failed at %d in [%s]
cannot open savepoint - SQL statements in progress
no such savepoint: %s
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot change %s wal mode from within a transaction
statement aborts at %d: [%s] %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s
%s: %s
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
too many SQL variables
too many columns in %s
oversized integer: %s%s
misuse of aggregate: %s()
%.*s"%w"%s
%s%.*s"%w"
%s OR name=%Q
type='trigger' AND (%s)
there is already another table or index with this name: %s
sqlite_
table %s may not be altered
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE tbl=%Q
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
too many attached databases - max %d
database %s is already in use
unable to open database: %s
no such database: %s
cannot detach database %s
database %s is locked
%s %T cannot reference objects in database %s
object name reserved for internal use: %s
there is already an index named %s
too many columns on %s
duplicate column name: %s
default value of column [%s] is not constant
table "%s" has more than one primary key
no such collation sequence: %s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
view %s is circularly defined
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
indexed columns are not unique
table %s may not be indexed
views may not be indexed
virtual tables may not be indexed
there is already a table named %s
index %s already exists
sqlite_autoindex_%s_%d
table %s has no column named %s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
a JOIN clause is required before %s
unable to identify the object to be reindexed
table %s may not be modified
cannot modify %s because it is a view
foreign key mismatch
table %S has %d columns but %d values were supplied
%d values for %d columns
table %S has no column named %s
%s.%s may not be NULL
PRIMARY KEY must be unique
automatic extension loading failed: %s
foreign_key_list
malformed database schema (%s)
%s - %s
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
%s.%s
%s:%d
no such index: %s
sqlite_subquery_%p_
no such table: %s
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
no such column: %s
cannot VACUUM - SQL statements in progress
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor did not declare schema: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
cannot use index: %s
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
unable to close due to unfinished backup operation
unknown database: %s
no such vfs: %s
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
sqlite3_open
sqlite3_prepare
sqlite3_step
sqlite3_column_text
sqlite3_column_int
sqlite3_column_int64
sqlite3_finalize
sqlite3_close
sqlite3_exec
f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb
msvcrt.dll
_wcmdln
COMCTL32.dll
VERSION.dll
FindCloseUrlCache
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
WININET.dll
GetWindowsDirectoryW
KERNEL32.dll
EnumChildWindows
USER32.dll
GDI32.dll
comdlg32.dll
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
ADVAPI32.dll
ShellExecuteW
SHELL32.dll
ole32.dll
5JEw%Xg
<assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
hXXp://VVV.usertrust.com1
3hXXp://crl.usertrust.com/AddTrustExternalCARoot.crl05
hXXp://ocsp.usertrust.com0
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl05
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl0t
1hXXp://crt.usertrust.com/UTNAddTrustObject_CA.crt0%
hXXps://secure.comodo.net/CPS0A
0hXXp://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
0hXXp://crt.comodoca.com/COMODOCodeSigningCA2.crt0$
hXXp://ocsp.comodoca.com0
[email protected]
t{SSh
v%SSW
Mail PassView
Mozilla\Profiles
Software\Mozilla\Mozilla Thunderbird
%s\Main
sqlite3.dll
nss3.dll
%programfiles%\Mozilla Thunderbird
AddExportHeaderLine
%s %s %s
HTTPMail User Name
SMTP USer Name
HTTPMail Server
SMTP Server
POP3 Password2
IMAP Password2
HTTPMail Password2
SMTP Password2
POP3 Port
IMAP Port
HTTPMail Port
SMTP Port
HTTPMail Secure Connection
SMTP Secure Connection
SMTP Display Name
SMTP Email Address
POP3 Password
IMAP Password
HTTP Password
SMTP Password
HTTP User
SMTP User
HTTP Server URL
HTTP Port
HTTPMail Use SSL
SMTP Use SSL
%s\%s
PopPort
PopPassword
SMTPAccount
SMTPServer
SMTPPort
SMTPLogSecure
SMTPPassword
%s\Accounts
LoginName
SavePasswordText
ESMTPUsername
ESMTPPassword
POP3Password
fb.dat
%[email protected]
%[email protected]
Software\Microsoft\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
<meta http-equiv='content-type' content='text/html;charset=%s'>
<br><h4>%s <a href="hXXp://VVV.nirsoft.net/" target="newwin">%s</a></h4><p>
smtp
advapi32.dll
comctl32.dll
*.ini
netmsg.dll
Error %d: %s
%s (%s)
menu_%d
dialog_%d
TranslatorURL
_lng.ini
%-18s: %s
%%-%d.%ds
<td bgcolor=#%s nowrap>%s
<td bgcolor=#%s>%s
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
bgcolor="%s"
<font color="%s">%s</font>
<%s>%s</%s>
</%s>
report.html
*.txt
*.htm;*.html
*.xml
*.csv
Software\NirSoft\MailPassView
MailPassView
/skeepass
/deleteregkey
Failed to load the executable file !
mail.account.account
mail.server
port
mail.identity
signon.signonfilename
mailbox://%s@%s
imap://%s@%s
mailbox://%s
imap://%s
signons.txt
signons.sqlite
prefs.js
Password.NET Messenger Service
User.NET Messenger Service
Passport.Net\*
ps:password
windowslive:name=
Exception %8.8X at address %8.8X in module %s
Stack Data: %s
Code Data: %s
mozsqlite3.dll
psapi.dll
pstorec.dll
5e7e8100-9138-11d1-945a-00c04fc308ff
00000000-0000-0000-0000-000000000000
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
220D5CC1-853A-11D0-84BC-00C04FD43F8F
417E2D75-84BD-11D0-84BB-00C04FD43F8F
shell32.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
shlwapi.dll
<html><head>%s<title>%s</title></head>
%s <h3>%s</h3>
size="%d"
color="#%s"
<font color="%s">
<table border="1" cellpadding="5"><tr%s>
width="%s"
<th%s>%s%s%s
SOFTWARE\Mozilla
mozilla
%s\bin
PathToExe
\sqlite3.dll
\mozsqlite3.dll
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Live Mail
SMTP_Server
SMTP_User_Name
POP3_Password2
IMAP_Password2
NNTP_Password2
SMTP_Password2
SMTP_Email_Address
SMTP_Port
NNTP_Port
IMAP_Port
POP3_Port
SMTP_Secure_Connection
*.oeaccount
\Microsoft\Windows Mail
\Microsoft\Windows Live Mail
f:\Projects\VS2005\mailpv\Release\mailpv.pdb
_acmdln
RPCRT4.dll
GetWindowsDirectoryA
RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyA
RegEnumKeyExA
ShellExecuteA
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="NirSoft" type="win32"></assemblyIdentity><description>NirSoft</description><dependency><dependentAssembly><assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
Debugger.exe
Microsoft.VisualBasic
System.Windows.Forms
System.Drawing
System.Management
tapi32.dll
rtm.dll
user32.dll
Debugger.Debugger.resources
Debugger.Resources.resources
Debugger.My
WindowsFormsApplicationBase
Microsoft.VisualBasic.ApplicationServices
System.ComponentModel
System.CodeDom.Compiler
Microsoft.VisualBasic.Devices
m_MyWebServicesObjectProvider
.cctor
get_WebServices
HelpKeywordAttribute
System.ComponentModel.Design
WebServices
Microsoft.VisualBasic.CompilerServices
System.Collections
ContainsKey
InvalidOperationException
MyWebServices
encryptedpassstring
encryptedsmtpstring
portstring
fakeMSGholder
encryptedftphost
encryptedftpuser
encryptedftppass
useftp
websitevisitor
websiteblocker
passstring
smtpstring
ftphost
ftpuser
ftppass
WM_KEYUP
WM_KEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYUP
KeyboardHandle
KeyLog
CleanedPasswordsMAIL
CleanedPasswordsWB
System.IO
get_ExecutablePath
set_WindowState
FormWindowState
UnhookWindowsHookEx
SetWindowsHookEx
SetWindowsHookExA
GetAsyncKeyState
vKey
HookKeyboard
UnhookKeyboard
Operators
get_Keyboard
Keyboard
get_CtrlKeyDown
get_AltKeyDown
KeyboardCallback
System.Threading
System.Collections.Generic
Microsoft.VisualBasic.MyServices
System.Collections.ObjectModel
MsgBox
MsgBoxResult
MsgBoxStyle
ForceSteamLogin
System.Net.NetworkInformation
get_OperationalStatus
OperationalStatus
FakemsgInstall
System.Net.Mail
SmtpClient
System.Globalization
set_Port
System.Net
Microsoft.Win32
RegistryKey
OpenSubKey
System.Security.Cryptography
System.Text
set_Key
stealWebroswers
WebClient
readweb
System.IO.Compression
SendLogsFTP
FtpWebRequest
WebRequest
UploadFTP
secretKey
set_KeySize
get_KeySize
System.Net.Sockets
virtualKey
KeyboardHookDelegate
get_Msg
Debugger.My.Resources
System.Resources
get_CMemoryExecute
get_WebBrowserPassView
WebBrowserPassView
System.Configuration
8.0.0.0
My.Computer
My.Application
My.User
My.Forms
My.WebServices
System.Windows.Forms.Form
My.MyProject.Forms
4System.Web.Services.Protocols.SoapHttpClientProtocol
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
10.0.0.0
My.Settings
$e48811ca-8af8-4e73-85dd-2045b9cca73a
_CorExeMain
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
%%0.ß
Apple Computer\Preferences\keychain.plist
LoadPasswordsIE
LoadPasswordsFirefox
LoadPasswordsChrome
LoadPasswordsOpera
LoadPasswordsSafari
LoadPasswordsSeaMonkey
UseFirefoxProfileFolder
UseFirefoxInstallFolder
UseChromeProfileFolder
UseOperaPasswordFile
FirefoxProfileFolder
FirefoxInstallFolder
ChromeProfileFolder
OperaPasswordFile
Aadvapi32.dll
crypt32.dll
777705555443332
5555443332
5555443332
wand.dat
@nss3.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe
%programfiles%\Sea Monkey
%programfiles%\Mozilla Firefox
-signons.txt
signons2.txt
signons3.txt
@dllhost.exe
taskhost.exe
taskhostex.exe
Microsoft\Windows\WebCache\WebCacheV01.dat
Microsoft\Windows\WebCache\WebCacheV24.dat
index.dat
hXXps://VVV.google.com/accounts/servicelogin
hXXp://VVV.facebook.com/
hXXps://login.yahoo.com/config/login
hXXp://
hXXps://
PTF://
@history.dat
places.sqlite
Mozilla\Firefox\Profiles
Mozilla\SeaMonkey\Profiles
Mozilla\SeaMonkey
Mozilla\Firefox
profiles.ini
Profile%d
tntdll.dll
sWeb Data
Login Data
Google\Chrome\User Data
Google\Chrome SxS\User Data
Opera\Opera\wand.dat
Opera\Opera7\profile\wand.dat
Opera
@"%s"
Ashell32.dll
\nss3.dll
.save
vaultcli.dll
abe2869f-9b47-4cd9-a358-c22904dba7f7
Copy &Password
&HTML Report - All Items
HTML R&eport - Selected Items
HTML Report - All Items
HTML Report - Selected Items
Load Passwords From...
Google Chrome
Mozilla Firefox
SeaMonkey
Firefox Options
Master password:
Firefox Profile:
Firefox Installation:
Chrome Options
Opera Options
wand.dat file:
%d Passwords
, %d Selected
Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat)
Loading... %d
KeePass csv file
Opera Password File
Firefox 1.x
Firefox 2.x
Firefox 3.0
Firefox
Chrome
Web Browser
Password
Password Strength
Password Field
WebBrowserPassView.exe
VVV.google.com/Please log in to your Gmail account
VVV.google.com:443/Please log in to your Gmail account
VVV.google.com/Please log in to your Google Account
VVV.google.com:443/Please log in to your Google Account
VVV.google.com
dWindowsLive:name=*
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
Copy Password
%d items
Select Eudora.ini filename/Select the location of Thunderbird installation
Eudora.ini file
SMTP
Windows Mail
Windows Live Mail
Server Port
SMTP Server Port
Mail Password Recovery
mailpv.exe
3,  7 #,)
2400000
MessageBoxIcon.Error
noftp
filename.exe
hXXp://VVV.example.com/directory/file.exe
Disablecmd
\Windows Update.exe
\WindowsUpdate.exe
SysInfo.txt
\pid.txt
\pidloc.txt
\Mozilla\Firefox\Profiles
127.0.0.1
\SteamAppData.vdf
\ClientRegistry.blob
MessageBoxIcon.Exclamation
Keylogger Enabled:
Operating System:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
autorun.inf
open=Sys.exe
Sys.exe
Software\Microsoft\Windows\CurrentVersion\Run
Windows Update
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Microsoft.NET\Framework\v2.0.50727\vbc.exe
holdermail.txt"
holdermail.txt
Operating System Intel Recovery
Operating System Platform:
Operating System Version:
WEB Browser Password Recovery
Mail Messenger Password Recovery
Jdownloader Password Recovery
holderwb.txt"
holderwb.txt
\.minecraft\lastlogin
There is a file attached to this email containing Minecraft username and password download it then decrypt the login information with my Minecraft Decryptor
Logger - Key Recorder - [
Keylogger Log
.jpeg
Logger_KeyLog_
hXXp://whatismyipaddress.com/
Debugger.Resources
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Document00000pdf.exe_1512_rwx_675A6000_00003000:

.Qg<-Qg
*Rg`.Rg|)RgL Rg


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    vbc.exe:2364
    vbc.exe:2556
    %original file name%.exe:580

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe (10177 bytes)
    %Documents and Settings%\%current user%\Application Data\pid.txt (4 bytes)
    %Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe (10177 bytes)
    %System%\wbem\Logs\wbemprox.log (150 bytes)
    %Documents and Settings%\%current user%\Application Data\pidloc.txt (82 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Windows Update" = "%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  7. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now