HackTool.Win32.PassView_37eaa6c5a3

by malwarelabrobot on October 27th, 2017 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), HackTool.Win32.PassView.FD, GenericAutorunWorm.YR, HackToolPassView.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, HackTool, WormAutorun


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 37eaa6c5a3d77187efe42752713baeed
SHA1: 2f9db8e8dece81221ba9cfa71317b39389082369
SHA256: c45b1c8f8f4e44bc98f74488df60b297b22cd73d003e31ade8f451d2820afbd0
SSDeep: 49152:se1aVShHDV6x5kFm53SyBYIbmlx/ZI ziNhI3rENKq0WXNHN9:se8VS9V25kFm5eIbYv9uNgq0qFN9
Size: 2281396 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2012-06-09 16:19:49
Analyzed on: Windows7 SP1 32-bit


Summary:

HackTool. Can be used to investigate, analyze or compromise the system security. Some HackTools are multi-purpose programs, while others may have legitimate uses.

Payload

Behaviour Description
WormAutorun A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the HackTool's file once a user opens a drive's folder in Windows Explorer.


Process activity

The HackTool creates the following process(es):

dlt.exe:4032
dlt.exe:4028
uce.exe:3104
uce.exe:2856
6785555.exe:3820
%original file name%.exe:2028
vbc.exe:1252
vbc.exe:2064

The HackTool injects its code into the following process(es):

RegSvcs.exe:1688
RegSvcs.exe:676

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process dlt.exe:4032 makes changes in the file system.
The HackTool deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\YWLNQ (0 bytes)

The process dlt.exe:4028 makes changes in the file system.
The HackTool creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\YWLNQ (277 bytes)

The process uce.exe:3104 makes changes in the file system.
The HackTool deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\RYBOP (0 bytes)

The process uce.exe:2856 makes changes in the file system.
The HackTool creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\RYBOP (277 bytes)

The process RegSvcs.exe:1688 makes changes in the file system.
The HackTool creates and/or writes to the following file(s):

C:\Windows\Microsoft.NET\Framework\v4.0.30319\.Identifier (68 bytes)

The process RegSvcs.exe:676 makes changes in the file system.
The HackTool creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\pid.txt (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\pidloc.txt (57 bytes)

The HackTool deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\holdermail.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\holderwb.txt (0 bytes)

The process 6785555.exe:3820 makes changes in the file system.
The HackTool creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\qql.ico (544 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\jfh.jpg (570 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\ngw.docx (548 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\sgg.bmp (502 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\mwl.ico (598 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\hec.bmp (611 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\ufc.xl (587 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\cle.jpg (569 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\uhq.dat (577 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\tar.xl (578 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\jxa.ico (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\cjq.docx (566 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\hil.jpg (557 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\jev.docx (556 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\mqh.jpg (505 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\cxc.mp3 (593 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\nmm.txt (625 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\rss-hbm (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\rqi.jpg (570 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\xxf.ppt (568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\vln.xl (541 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\klo.icm (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\vbt.ppt (591 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\chn.mp3 (594 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\auo.ico (559 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\onu.txt (558 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\hwf.bmp (534 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\dlt.exe (15154 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\hwh.xl (522 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\kka.ppt (577 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\ogi.jpg (611 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\rvf.jpg (530 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\kjf.icm (542 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\sor.docx (513 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\ven.ppt (515 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\ljm.mp4 (517 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\uur.ppt (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\hol.ppt (515 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\rhl.mp4 (561 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\omv.mp4 (516 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\rwm.ico (563 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\ehb.icm (510 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\pvu.xl (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\cxf.dat (514 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\sol.icm (593 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\cfo.txt (636 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\csf.dat (560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\xbg.xl (551 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\emc.icm (604 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\gfb.ico (503 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\$_35.PDF (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\adx.mp3 (600 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\kom.ico (593 bytes)

The HackTool deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\__tmp_rar_sfx_access_check_5070406 (0 bytes)

The process %original file name%.exe:2028 makes changes in the file system.
The HackTool creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\lbr.docx (503 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\tis.mp4 (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\chd.docx (542 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\gbw.pdf (541 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\fpa.jpg (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\bft.icm (577 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\bbn.bmp (669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\ppw.mp4 (604 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\rio.ppt (546 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\clp.bmp (527 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\owl-wuc (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\uce.exe (15154 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\pih.icm (537 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\ckr.dat (510 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\bpn.pdf (589 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\man.mp3 (544 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\csi.ico (595 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\wmi.txt (537 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\bxt.icm (616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\mnc.txt (535 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\tqg.jpg (577 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\rrq.dat (695 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\nxw.ppt (519 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\xmv.dat (645 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\vxa.mp4 (524 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\6785555.exe (3402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\cdt.docx (530 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\fip.txt (603 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\otn.xl (557 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\wnn.icm (561 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\hlh.txt (637 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\aqx.xl (557 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\wmf.ppt (575 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\bgr.pdf (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\uag.mp4 (598 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\nqb.xl (509 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\asw.xl (588 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\mmx.mp3 (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\shf.ppt (574 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\uok.xl (614 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\bvg.ppt (533 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\jtk.ico (567 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\aeo.ppt (604 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\ktk.icm (616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\xau.ppt (550 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\pow.icm (513 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\daf.icm (503 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\vxa.xl (517 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\hfd.ico (636 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\lep.icm (739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\grf.pdf (502 bytes)

The HackTool deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\__tmp_rar_sfx_access_check_5068971 (0 bytes)

The process vbc.exe:1252 makes changes in the file system.
The HackTool creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\holderwb.txt (2 bytes)

The process vbc.exe:2064 makes changes in the file system.
The HackTool creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\holdermail.txt (1120 bytes)

Registry activity

The process dlt.exe:4032 makes changes in the system registry.
The HackTool creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the HackTool adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsUpdate" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\dlt.exe C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\rss-hbm"

The process uce.exe:3104 makes changes in the system registry.
The HackTool creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the HackTool adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsUpdate" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\uce.exe C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\owl-wuc"

The process RegSvcs.exe:676 makes changes in the system registry.
The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\RegSvcs_RASMANCS]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\RegSvcs_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\RegSvcs_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\RegSvcs_RASMANCS]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32]
"EnableFileTracing" = "0"

The process 6785555.exe:3820 makes changes in the system registry.
The HackTool creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The HackTool deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process %original file name%.exe:2028 makes changes in the system registry.
The HackTool creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The HackTool deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

Dropped PE files

MD5 File path
aa2204e7061c00ad3c7829684075c766 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\6785555.exe
71d8f6d5dc35517275bc38ebcc815f9f c:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\uce.exe
71d8f6d5dc35517275bc38ebcc815f9f c:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\dlt.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the HackTool's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name: Hewlett-Packard Development Company, L.P.
Product Name: HP Power Plan Utility
Product Version: 1,0,0,0
Legal Copyright: Copyright (C) 2011 Hewlett-Packard Development Company, L.P.
Legal Trademarks:
Original Filename: SetIcon.exe
Internal Name:
File Version: 1.2.1.0
File Description: SetIcon
Comments:
Language: German (Germany)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 74526 74752 4.54396 a8692f5ba740240ef0f9a827376f76f9
.rdata 81920 7445 7680 3.46159 d4f36accffde0bf520f52486679ccf0d
.data 90112 96036 512 2.46008 b6c7edb5b7fec47a37a622cc5d71f3f4
.CRT 188416 32 512 0.273198 439411041ee0b8261668525c5c132cd9
.rsrc 192512 13792 13824 3.33451 ae6476ec9da57f8380d9632844d92109

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://whatismyipaddress.com/ 104.16.16.96
ftp.shiuye-ortho.com 94.100.31.218
emlinkzz.linkpc.net 197.234.219.55


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1
Host: whatismyipaddress.com
Connection: Keep-Alive


HTTP/1.1 403 Forbidden
Date: Thu, 26 Oct 2017 09:50:39 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d2e7823786f777d860721027e163498dd1509011439; expires=Fri, 26-Oct-18 09:50:39 GMT; path=/; domain=.whatismyipaddress.com; HttpOnly
Cache-Control: max-age=15
Expires: Thu, 26 Oct 2017 09:50:54 GMT
X-Frame-Options: SAMEORIGIN
Server: cloudflare-nginx
CF-RAY: 3b3c833791c18243-KBP
64..Access Denied (CF1).  Scripted access not permitted.  Please conta
ct support@whatismyipaddress.com. ..0..HTTP/1.1 403 Forbidden..Date: T
hu, 26 Oct 2017 09:50:39 GMT..Content-Type: text/html; charset=UTF-8..
Transfer-Encoding: chunked..Connection: keep-alive..Set-Cookie: __cfdu
id=d2e7823786f777d860721027e163498dd1509011439; expires=Fri, 26-Oct-18
 09:50:39 GMT; path=/; domain=.whatismyipaddress.com; HttpOnly..Cache-
Control: max-age=15..Expires: Thu, 26 Oct 2017 09:50:54 GMT..X-Frame-O
ptions: SAMEORIGIN..Server: cloudflare-nginx..CF-RAY: 3b3c833791c18243
-KBP..64..Access Denied (CF1).  Scripted access not permitted.  Please
 contact support@whatismyipaddress.com. ..0..

The HackTool connects to the servers at the folowing location(s):

AcroRd32.exe_3140:

.text
`.rdata
@.data
.rsrc
@.reloc
|rdr|\plug_ins\weblink.api
|rdr|\plug_ins\updater.api
|rdr|\plug_ins\spelling.api
|rdr|\plug_ins\sendmail.api
|rdr|\plug_ins\search5.api
|rdr|\plug_ins\search.api
|rdr|\plug_ins\saveasrtf.api
|rdr|\plug_ins\reflow.api
|rdr|\plug_ins\readoutloud.api
|rdr|\plug_ins\ppklite.api
|rdr|\plug_ins\pddom.api
|rdr|\plug_ins\multimedia.api
|rdr|\plug_ins\makeaccessible.api
|rdr|\plug_ins\ia32.api
|rdr|\plug_ins\hls.api
|rdr|\plug_ins\escript.api
|rdr|\plug_ins\ebook.api
|rdr|\plug_ins\dva.api
|rdr|\plug_ins\digsig.api
|rdr|\plug_ins\compare.api
|rdr|\plug_ins\checkers.api
|rdr|\plug_ins\annots.api
|rdr|\plug_ins\acroform.api
|rdr|\plug_ins\accessibility.api
|rdr|\plug_ins\*.*
|rdr|\cooltype.dll
|rdr|\bib.dll
|rdr|\agm.dll
|rdr|\acrord32.exe
|rdr|\acrord32.dll
|rdr|\ace.dll
|cad|\desktop.ini
|cad|\adobe\acrobat\9.0\usercache.bin
ADOBE_READLOGGER_CMD:COMMENT:%s
AcroRd32Exe.pdb
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegOpenKeyW
RegOpenKeyA
RegOpenKeyExA
ADVAPI32.dll
SHELL32.dll
MSVCP80.dll
MSVCR80.dll
_amsg_exit
_wcmdln
_crt_debugger_hook
GetProcessHeap
888888888
d5%tt]
d5%%%]
PA<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Adobe.Reader" type="win32"></assemblyIdentity><description>Adobe Reader 9.0</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity></dependentAssembly></dependency><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"><security><requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
=.>4>:>@>~>
AcroRd32.dll
\kernel32.dll
sntdll.dll
ykernel32.dll
AdobeAcrobatSpeedLaunchCmdWnd
AdobeReaderSpeedLaunchCmdWnd
comctl32.dll
API_ADOBE_PUBLIC_KEY
T405_ADOBE_PUBLIC_KEY
9.3.3.177
AcroRd32.exe

RegSvcs.exe_1688:

.text
0`.data
.idata
D$.xNA
%c%.8x%s
%s @ %s
%s\%s.%s
mgM
#7@Qhq\1@NWgyxeH\_bpdgc%.2d/%.2d/%d %.2d:%.2d:%.2d
C:\Users\"%CurrentUserName%"\AppData\Roaming\Logs\
Keylogger
emlinkzz.linkpc.net:8881;
ping 192.0.2.2 -n 1 -w %d >nul 2>&1
DEL /s "%s" >nul 2>&1
start /b "" cmd /c del "%%~f0"&exit /b
hXXp://%s%s
%.2d/%.2d/%d %.2d:%.2d:%.2d
%N\%N.UAU
%s*.*
iphlpapi.dll
psapi.dll
kernel32.dll
%s:%u
%s:%d
"%/28;=#$019:>?
gMGGogF %N:%u qFFn/s.h
YqmNr: %N:%u
%s (%s)
%s%s\
winhttp.dll
%s\%s.bat
%s /c "%s"
.buUYrdDdU2
-m "%s"
{GET %s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8
%s%.2d-%.2d-%.4d
[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]
[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]
user32.dll
QUP4215.uee
%s\%s
jmf4rdeN.uee
jmfce4U.uee
jmfN_edrU1.uee
YNN1.uee
%N\YNN1.uee
Mozilla Firefox
%N\Kmfdeew\Hd2UDmA\32mDdeUN.dYd
Mozilla Thunderbird
%N\FJ4YuU2Zd2u\32mDdeUN.dYd
SeaMonkey
%N\Kmfdeew\QUwKmY8UI\32mDdeUN.dYd
%N\emcdYN.WNmY
%N\M3U2w\M3U2w\BwYu.uwr
%N\M3U2w\M3U2w\32mDdeU\BwYu.uwr
%N\.3423eU\wPPm4YrN.Aje
wutw3d15.uee
%c%c%S
%c%c%s
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
P2I3r15.uee
%S:%S
abe2869f-9b47-4cd9-a358-c22904dba7f7
%s\*.*
dYuUA.uwr
tw4erPed.uee
%s:%s
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
jNtP2shh.uee
jNtP3shh.uee
jNtP2s5h.uee
jNtP3s5h.uee
w3d7jN7BdY7Pm2U7rdjUfmYU7es7s7h.uee
w3d7jN7BdY7Pm2U7DdeU7es7s7h.uee
w3d7jN7BdY7Pm2U7DdeU7e57s7h.uee
w3d7jN7BdY7Pm2U7emPwedfwrdmY7es757h.uee
w3d7jN7BdY7Pm2U7NIYPJ7es757h.uee
w3d7jN7BdY7Pm2U732mPUNNrJ2UwuN7es7s7s.uee
w3d7jN7BdY7Pm2U7DdeU7es757h.uee
w3d7jN7BdY7P2r724YrdjU7es7s7h.uee
w3d7jN7BdY7P2r7Nr2dYc7es7s7h.uee
w3d7jN7BdY7P2r7JUw37es7s7h.uee
w3d7jN7BdY7P2r7Nrudm7es7s7h.uee
w3d7jN7BdY7P2r7PmYtU2r7es7s7h.uee
w3d7jN7BdY7P2r7emPweU7es7s7h.uee
w3d7jN7BdY7P2r7jwrJ7es7s7h.uee
w3d7jN7BdY7P2r7j4erdZIrU7es7s7h.uee
w3d7jN7BdY7P2r7rdjU7es7s7h.uee
w3d7jN7BdY7P2r7DdeUNINrUj7es7s7h.uee
w3d7jN7BdY7P2r7UYtd2mYjUYr7es7s7h.uee
w3d7jN7BdY7P2r74rdedrI7es7s7h.uee
w3d7jN7BdY7Pm2U7Nr2dYc7es7s7h.uee
w3d7jN7BdY7Pm2U7U22m2JwYuedYc7es7s7h.uee
w3d7jN7BdY7Pm2U7YwjUu3d3U7es7s7h.uee
w3d7jN7BdY7Pm2U7JwYueU7es7s7h.uee
w3d7jN7BdY7Pm2U7JUw37es7s7h.uee
w3d7jN7BdY7Pm2U7edZ2w2IemwuU27es7s7h.uee
w3d7jN7BdY7Pm2U7NIYPJ7es7s7h.uee
w3d7jN7BdY7Pm2U732mPUNNrJ2UwuN7es7s7h.uee
w3d7jN7BdY7Pm2U732mPUNNUYtd2mYjUYr7es7s7h.uee
w3d7jN7BdY7Pm2U7uwrUrdjU7es7s7h.uee
w3d7jN7BdY7Pm2U7NINdYDm7es7s7h.uee
w3d7jN7BdY7Pm2U7PmYNmeU7es7s7h.uee
w3d7jN7BdY7Pm2U7uUZ4c7es7s7h.uee
w3d7jN7BdY7Pm2U732mDdeU7es7s7h.uee
w3d7jN7BdY7Pm2U7jUjm2I7es7s7h.uee
w3d7jN7BdY7Pm2U74rde7es7s7h.uee
w3d7jN7BdY7Pm2U72reN433m2r7es7s7h.uee
w3d7jN7BdY7Pm2U7dYrU2emP8Uu7es7s7h.uee
4P2rZwNU.uee
tP24YrdjUsSh.uee
jNtP3sSh.uee
jmfP2rsR.uee
N_edrU1.uee
YN32S.uee
3ePS.uee
3euNS.uee
YNN4rde1.uee
NmDrm8Y1.uee
YNNuZj1.uee
0x%.8X (%d)
%c%.8x%s%s
%c%.8x%s\%s
%N\NINrUj15\Pju.UAU
8U2YUe15.uee
advapi32.dll
%d:%s%s;
%d:%I64u:%s%s;
%c%llu
&&&&6666????
""""****
2222::::
$$$$\\\\
00006666
####====
aKeylogger
2017-10-26 10:50:50
hu2.iu[7iuLTiu
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
CreatePipe
PeekNamedPipe
SHFileOperationA
EnumWindows
GetKeyNameTextA
GetKeyState
GetKeyboardState
MapVirtualKeyA
keybd_event
ADVAPI32.DLL
CRYPT32.DLL
GDI32.dll
KERNEL32.dll
msvcrt.dll
NETAPI32.DLL
SHELL32.DLL
USER32.dll
WS2_32.dll
hXXp://VVV.yandex.com

RegSvcs.exe_1688_rwx_00400000_00020000:

.text
0`.data
.idata
D$.xNA
%c%.8x%s
%s @ %s
%s\%s.%s
mgM
#7@Qhq\1@NWgyxeH\_bpdgc%.2d/%.2d/%d %.2d:%.2d:%.2d
C:\Users\"%CurrentUserName%"\AppData\Roaming\Logs\
Keylogger
emlinkzz.linkpc.net:8881;
ping 192.0.2.2 -n 1 -w %d >nul 2>&1
DEL /s "%s" >nul 2>&1
start /b "" cmd /c del "%%~f0"&exit /b
hXXp://%s%s
%.2d/%.2d/%d %.2d:%.2d:%.2d
%N\%N.UAU
%s*.*
iphlpapi.dll
psapi.dll
kernel32.dll
%s:%u
%s:%d
"%/28;=#$019:>?
gMGGogF %N:%u qFFn/s.h
YqmNr: %N:%u
%s (%s)
%s%s\
winhttp.dll
%s\%s.bat
%s /c "%s"
.buUYrdDdU2
-m "%s"
{GET %s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8
%s%.2d-%.2d-%.4d
[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]
[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]
user32.dll
QUP4215.uee
%s\%s
jmf4rdeN.uee
jmfce4U.uee
jmfN_edrU1.uee
YNN1.uee
%N\YNN1.uee
Mozilla Firefox
%N\Kmfdeew\Hd2UDmA\32mDdeUN.dYd
Mozilla Thunderbird
%N\FJ4YuU2Zd2u\32mDdeUN.dYd
SeaMonkey
%N\Kmfdeew\QUwKmY8UI\32mDdeUN.dYd
%N\emcdYN.WNmY
%N\M3U2w\M3U2w\BwYu.uwr
%N\M3U2w\M3U2w\32mDdeU\BwYu.uwr
%N\.3423eU\wPPm4YrN.Aje
wutw3d15.uee
%c%c%S
%c%c%s
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
P2I3r15.uee
%S:%S
abe2869f-9b47-4cd9-a358-c22904dba7f7
%s\*.*
dYuUA.uwr
tw4erPed.uee
%s:%s
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
jNtP2shh.uee
jNtP3shh.uee
jNtP2s5h.uee
jNtP3s5h.uee
w3d7jN7BdY7Pm2U7rdjUfmYU7es7s7h.uee
w3d7jN7BdY7Pm2U7DdeU7es7s7h.uee
w3d7jN7BdY7Pm2U7DdeU7e57s7h.uee
w3d7jN7BdY7Pm2U7emPwedfwrdmY7es757h.uee
w3d7jN7BdY7Pm2U7NIYPJ7es757h.uee
w3d7jN7BdY7Pm2U732mPUNNrJ2UwuN7es7s7s.uee
w3d7jN7BdY7Pm2U7DdeU7es757h.uee
w3d7jN7BdY7P2r724YrdjU7es7s7h.uee
w3d7jN7BdY7P2r7Nr2dYc7es7s7h.uee
w3d7jN7BdY7P2r7JUw37es7s7h.uee
w3d7jN7BdY7P2r7Nrudm7es7s7h.uee
w3d7jN7BdY7P2r7PmYtU2r7es7s7h.uee
w3d7jN7BdY7P2r7emPweU7es7s7h.uee
w3d7jN7BdY7P2r7jwrJ7es7s7h.uee
w3d7jN7BdY7P2r7j4erdZIrU7es7s7h.uee
w3d7jN7BdY7P2r7rdjU7es7s7h.uee
w3d7jN7BdY7P2r7DdeUNINrUj7es7s7h.uee
w3d7jN7BdY7P2r7UYtd2mYjUYr7es7s7h.uee
w3d7jN7BdY7P2r74rdedrI7es7s7h.uee
w3d7jN7BdY7Pm2U7Nr2dYc7es7s7h.uee
w3d7jN7BdY7Pm2U7U22m2JwYuedYc7es7s7h.uee
w3d7jN7BdY7Pm2U7YwjUu3d3U7es7s7h.uee
w3d7jN7BdY7Pm2U7JwYueU7es7s7h.uee
w3d7jN7BdY7Pm2U7JUw37es7s7h.uee
w3d7jN7BdY7Pm2U7edZ2w2IemwuU27es7s7h.uee
w3d7jN7BdY7Pm2U7NIYPJ7es7s7h.uee
w3d7jN7BdY7Pm2U732mPUNNrJ2UwuN7es7s7h.uee
w3d7jN7BdY7Pm2U732mPUNNUYtd2mYjUYr7es7s7h.uee
w3d7jN7BdY7Pm2U7uwrUrdjU7es7s7h.uee
w3d7jN7BdY7Pm2U7NINdYDm7es7s7h.uee
w3d7jN7BdY7Pm2U7PmYNmeU7es7s7h.uee
w3d7jN7BdY7Pm2U7uUZ4c7es7s7h.uee
w3d7jN7BdY7Pm2U732mDdeU7es7s7h.uee
w3d7jN7BdY7Pm2U7jUjm2I7es7s7h.uee
w3d7jN7BdY7Pm2U74rde7es7s7h.uee
w3d7jN7BdY7Pm2U72reN433m2r7es7s7h.uee
w3d7jN7BdY7Pm2U7dYrU2emP8Uu7es7s7h.uee
4P2rZwNU.uee
tP24YrdjUsSh.uee
jNtP3sSh.uee
jmfP2rsR.uee
N_edrU1.uee
YN32S.uee
3ePS.uee
3euNS.uee
YNN4rde1.uee
NmDrm8Y1.uee
YNNuZj1.uee
0x%.8X (%d)
%c%.8x%s%s
%c%.8x%s\%s
%N\NINrUj15\Pju.UAU
8U2YUe15.uee
advapi32.dll
%d:%s%s;
%d:%I64u:%s%s;
%c%llu
&&&&6666????
""""****
2222::::
$$$$\\\\
00006666
####====
aKeylogger
2017-10-26 10:50:50
hu2.iu[7iuLTiu
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
CreatePipe
PeekNamedPipe
SHFileOperationA
EnumWindows
GetKeyNameTextA
GetKeyState
GetKeyboardState
MapVirtualKeyA
keybd_event
ADVAPI32.DLL
CRYPT32.DLL
GDI32.dll
KERNEL32.dll
msvcrt.dll
NETAPI32.DLL
SHELL32.DLL
USER32.dll
WS2_32.dll
hXXp://VVV.yandex.com

RegSvcs.exe_676:

.text
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
v2.0.50727
CMemoryExecute.dll
CMemoryExecute
PAGE_EXECUTE_READWRITE
.ctor
System.Reflection
System.Runtime.InteropServices
System.Security.Permissions
System.Diagnostics
System.Runtime.CompilerServices
DllImportAttribute
kernel32.dll
ntdll.dll
System.Security
$8fcd4931-91a2-4e18-849b-70de34ab75df
1.0.0.0
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb
mscoree.dll
`.rdata
@.data
.rsrc
D$.SPf
 2 34 567
com.apple.Safari
com.apple.WebKit2WebProcess
SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins
"Account","Login Name","Password","Web Site","Comments"
3.7.5
SQLite format 3
CREATE TABLE sqlite_master(
sql text
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins
PK11_GetInternalKeySlot
PK11_CheckUserPassword
large file support is disabled
unknown operation
SQL logic error or missing database
foreign_keys
sqlite_compileoption_get
sqlite_compileoption_used
sqlite_source_id
sqlite_version
sqlite_attach
sqlite_detach
sqlite_stat1
sqlite_rename_parent
sqlite_rename_trigger
sqlite_rename_table
%Y-%m-%d %H:%M:%S
%Y-%m-%d
%H:%M:%S
SQLITE_
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
922337203685477580
API call with %s database connection pointer
%s-shm
%s\etilqs_
OsError 0x%x (%u)
Recovered %d frames from WAL file %s
%s-mjX
foreign key constraint failed
unable to use function %s in the requested context
abort at %d in [%s]: %s
constraint failed at %d in [%s]
cannot open savepoint - SQL statements in progress
no such savepoint: %s
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot change %s wal mode from within a transaction
statement aborts at %d: [%s] %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s
%s: %s
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
too many SQL variables
too many columns in %s
oversized integer: %s%s
misuse of aggregate: %s()
%.*s"%w"%s
%s%.*s"%w"
%s OR name=%Q
type='trigger' AND (%s)
there is already another table or index with this name: %s
sqlite_
table %s may not be altered
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE tbl=%Q
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
too many attached databases - max %d
database %s is already in use
unable to open database: %s
no such database: %s
cannot detach database %s
database %s is locked
%s %T cannot reference objects in database %s
object name reserved for internal use: %s
there is already an index named %s
too many columns on %s
duplicate column name: %s
default value of column [%s] is not constant
table "%s" has more than one primary key
no such collation sequence: %s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
view %s is circularly defined
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
indexed columns are not unique
table %s may not be indexed
views may not be indexed
virtual tables may not be indexed
there is already a table named %s
index %s already exists
sqlite_autoindex_%s_%d
table %s has no column named %s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
a JOIN clause is required before %s
unable to identify the object to be reindexed
table %s may not be modified
cannot modify %s because it is a view
foreign key mismatch
table %S has %d columns but %d values were supplied
%d values for %d columns
table %S has no column named %s
%s.%s may not be NULL
PRIMARY KEY must be unique
automatic extension loading failed: %s
foreign_key_list
malformed database schema (%s)
%s - %s
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
%s.%s
%s:%d
no such index: %s
sqlite_subquery_%p_
no such table: %s
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
no such column: %s
cannot VACUUM - SQL statements in progress
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor did not declare schema: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
cannot use index: %s
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
unable to close due to unfinished backup operation
unknown database: %s
no such vfs: %s
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
sqlite3_open
sqlite3_prepare
sqlite3_step
sqlite3_column_text
sqlite3_column_int
sqlite3_column_int64
sqlite3_finalize
sqlite3_close
sqlite3_exec
f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb
msvcrt.dll
_wcmdln
COMCTL32.dll
VERSION.dll
FindCloseUrlCache
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
WININET.dll
GetWindowsDirectoryW
KERNEL32.dll
EnumChildWindows
USER32.dll
GDI32.dll
comdlg32.dll
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
ADVAPI32.dll
ShellExecuteW
SHELL32.dll
ole32.dll
5JEw%Xg
<assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
hXXp://VVV.usertrust.com1
3hXXp://crl.usertrust.com/AddTrustExternalCARoot.crl05
hXXp://ocsp.usertrust.com0
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl05
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl0t
1hXXp://crt.usertrust.com/UTNAddTrustObject_CA.crt0%
hXXps://secure.comodo.net/CPS0A
0hXXp://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
0hXXp://crt.comodoca.com/COMODOCodeSigningCA2.crt0$
hXXp://ocsp.comodoca.com0
support@nirsoft.net0
t{SSh
v%SSW
Mail PassView
Mozilla\Profiles
Software\Mozilla\Mozilla Thunderbird
%s\Main
sqlite3.dll
nss3.dll
%programfiles%\Mozilla Thunderbird
AddExportHeaderLine
%s %s %s
HTTPMail User Name
SMTP USer Name
HTTPMail Server
SMTP Server
POP3 Password2
IMAP Password2
HTTPMail Password2
SMTP Password2
POP3 Port
IMAP Port
HTTPMail Port
SMTP Port
HTTPMail Secure Connection
SMTP Secure Connection
SMTP Display Name
SMTP Email Address
POP3 Password
IMAP Password
HTTP Password
SMTP Password
HTTP User
SMTP User
HTTP Server URL
HTTP Port
HTTPMail Use SSL
SMTP Use SSL
%s\%s
PopPort
PopPassword
SMTPAccount
SMTPServer
SMTPPort
SMTPLogSecure
SMTPPassword
%s\Accounts
LoginName
SavePasswordText
ESMTPUsername
ESMTPPassword
POP3Password
fb.dat
%s@gmail.com
%s@yahoo.com
Software\Microsoft\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
<meta http-equiv='content-type' content='text/html;charset=%s'>
<br><h4>%s <a href="hXXp://VVV.nirsoft.net/" target="newwin">%s</a></h4><p>
smtp
advapi32.dll
comctl32.dll
*.ini
netmsg.dll
Error %d: %s
%s (%s)
menu_%d
dialog_%d
TranslatorURL
_lng.ini
%-18s: %s
%%-%d.%ds
<td bgcolor=#%s nowrap>%s
<td bgcolor=#%s>%s
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
bgcolor="%s"
<font color="%s">%s</font>
<%s>%s</%s>
</%s>
report.html
*.txt
*.htm;*.html
*.xml
*.csv
Software\NirSoft\MailPassView
MailPassView
/skeepass
/deleteregkey
Failed to load the executable file !
mail.account.account
mail.server
port
mail.identity
signon.signonfilename
mailbox://%s@%s
imap://%s@%s
mailbox://%s
imap://%s
signons.txt
signons.sqlite
prefs.js
Password.NET Messenger Service
User.NET Messenger Service
Passport.Net\*
ps:password
windowslive:name=
Exception %8.8X at address %8.8X in module %s
Stack Data: %s
Code Data: %s
mozsqlite3.dll
psapi.dll
pstorec.dll
5e7e8100-9138-11d1-945a-00c04fc308ff
00000000-0000-0000-0000-000000000000
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
220D5CC1-853A-11D0-84BC-00C04FD43F8F
417E2D75-84BD-11D0-84BB-00C04FD43F8F
shell32.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
shlwapi.dll
<html><head>%s<title>%s</title></head>
%s <h3>%s</h3>
size="%d"
color="#%s"
<font color="%s">
<table border="1" cellpadding="5"><tr%s>
width="%s"
<th%s>%s%s%s
SOFTWARE\Mozilla
mozilla
%s\bin
PathToExe
\sqlite3.dll
\mozsqlite3.dll
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Live Mail
SMTP_Server
SMTP_User_Name
POP3_Password2
IMAP_Password2
NNTP_Password2
SMTP_Password2
SMTP_Email_Address
SMTP_Port
NNTP_Port
IMAP_Port
POP3_Port
SMTP_Secure_Connection
*.oeaccount
\Microsoft\Windows Mail
\Microsoft\Windows Live Mail
f:\Projects\VS2005\mailpv\Release\mailpv.pdb
_acmdln
RPCRT4.dll
GetWindowsDirectoryA
RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyA
RegEnumKeyExA
ShellExecuteA
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="NirSoft" type="win32"></assemblyIdentity><description>NirSoft</description><dependency><dependentAssembly><assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
Debugger.exe
Microsoft.VisualBasic
System.Windows.Forms
System.Drawing
System.Management
tapi32.dll
rtm.dll
user32.dll
Debugger.Debugger.resources
Debugger.Resources.resources
Debugger.My
WindowsFormsApplicationBase
Microsoft.VisualBasic.ApplicationServices
System.ComponentModel
System.CodeDom.Compiler
Microsoft.VisualBasic.Devices
m_MyWebServicesObjectProvider
.cctor
get_WebServices
HelpKeywordAttribute
System.ComponentModel.Design
WebServices
Microsoft.VisualBasic.CompilerServices
System.Collections
ContainsKey
InvalidOperationException
MyWebServices
encryptedpassstring
encryptedsmtpstring
portstring
fakeMSGholder
encryptedftphost
encryptedftpuser
encryptedftppass
useftp
websitevisitor
websiteblocker
passstring
smtpstring
ftphost
ftpuser
ftppass
WM_KEYUP
WM_KEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYUP
KeyboardHandle
KeyLog
CleanedPasswordsMAIL
CleanedPasswordsWB
System.IO
get_ExecutablePath
set_WindowState
FormWindowState
UnhookWindowsHookEx
SetWindowsHookEx
SetWindowsHookExA
GetAsyncKeyState
vKey
HookKeyboard
UnhookKeyboard
Operators
get_Keyboard
Keyboard
get_CtrlKeyDown
get_AltKeyDown
KeyboardCallback
System.Threading
System.Collections.Generic
Microsoft.VisualBasic.MyServices
System.Collections.ObjectModel
MsgBox
MsgBoxResult
MsgBoxStyle
ForceSteamLogin
System.Net.NetworkInformation
get_OperationalStatus
OperationalStatus
FakemsgInstall
System.Net.Mail
SmtpClient
System.Globalization
set_Port
System.Net
Microsoft.Win32
RegistryKey
OpenSubKey
System.Security.Cryptography
System.Text
set_Key
stealWebroswers
WebClient
readweb
System.IO.Compression
SendLogsFTP
FtpWebRequest
WebRequest
UploadFTP
secretKey
set_KeySize
get_KeySize
System.Net.Sockets
virtualKey
KeyboardHookDelegate
get_Msg
Debugger.My.Resources
System.Resources
get_CMemoryExecute
get_WebBrowserPassView
WebBrowserPassView
System.Configuration
8.0.0.0
My.Computer
My.Application
My.User
My.Forms
My.WebServices
System.Windows.Forms.Form
My.MyProject.Forms
4System.Web.Services.Protocols.SoapHttpClientProtocol
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
10.0.0.0
My.Settings
$e48811ca-8af8-4e73-85dd-2045b9cca73a
_CorExeMain
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
%%0.ß
Apple Computer\Preferences\keychain.plist
LoadPasswordsIE
LoadPasswordsFirefox
LoadPasswordsChrome
LoadPasswordsOpera
LoadPasswordsSafari
LoadPasswordsSeaMonkey
UseFirefoxProfileFolder
UseFirefoxInstallFolder
UseChromeProfileFolder
UseOperaPasswordFile
FirefoxProfileFolder
FirefoxInstallFolder
ChromeProfileFolder
OperaPasswordFile
Aadvapi32.dll
crypt32.dll
777705555443332
5555443332
5555443332
wand.dat
@nss3.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe
%programfiles%\Sea Monkey
%programfiles%\Mozilla Firefox
-signons.txt
signons2.txt
signons3.txt
@dllhost.exe
taskhost.exe
taskhostex.exe
Microsoft\Windows\WebCache\WebCacheV01.dat
Microsoft\Windows\WebCache\WebCacheV24.dat
index.dat
hXXps://VVV.google.com/accounts/servicelogin
hXXp://VVV.facebook.com/
hXXps://login.yahoo.com/config/login
hXXp://
hXXps://
PTF://
@history.dat
places.sqlite
Mozilla\Firefox\Profiles
Mozilla\SeaMonkey\Profiles
Mozilla\SeaMonkey
Mozilla\Firefox
profiles.ini
Profile%d
tntdll.dll
sWeb Data
Login Data
Google\Chrome\User Data
Google\Chrome SxS\User Data
Opera\Opera\wand.dat
Opera\Opera7\profile\wand.dat
Opera
@"%s"
Ashell32.dll
\nss3.dll
.save
vaultcli.dll
abe2869f-9b47-4cd9-a358-c22904dba7f7
Copy &Password
&HTML Report - All Items
HTML R&eport - Selected Items
HTML Report - All Items
HTML Report - Selected Items
Load Passwords From...
Google Chrome
Mozilla Firefox
SeaMonkey
Firefox Options
Master password:
Firefox Profile:
Firefox Installation:
Chrome Options
Opera Options
wand.dat file:
%d Passwords
, %d Selected
Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat)
Loading... %d
KeePass csv file
Opera Password File
Firefox 1.x
Firefox 2.x
Firefox 3.0
Firefox
Chrome
Web Browser
Password
Password Strength
Password Field
WebBrowserPassView.exe
VVV.google.com/Please log in to your Gmail account
VVV.google.com:443/Please log in to your Gmail account
VVV.google.com/Please log in to your Google Account
VVV.google.com:443/Please log in to your Google Account
VVV.google.com
dWindowsLive:name=*
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
Copy Password
%d items
Select Eudora.ini filename/Select the location of Thunderbird installation
Eudora.ini file
SMTP
Windows Mail
Windows Live Mail
Server Port
SMTP Server Port
Mail Password Recovery
mailpv.exe
3,  7 #,)
MessageBoxIcon.Error
yesftp
filename.exe
hXXp://VVV.example.com/directory/file.exe
Disablecmd
\Windows Update.exe
\WindowsUpdate.exe
SysInfo.txt
\pid.txt
\pidloc.txt
noftp
\Mozilla\Firefox\Profiles
127.0.0.1
\SteamAppData.vdf
\ClientRegistry.blob
MessageBoxIcon.Exclamation
Keylogger Enabled:
Operating System:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
autorun.inf
open=Sys.exe
Sys.exe
Software\Microsoft\Windows\CurrentVersion\Run
Windows Update
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Microsoft.NET\Framework\v2.0.50727\vbc.exe
holdermail.txt"
holdermail.txt
Operating System Intel Recovery
Operating System Platform:
Operating System Version:
WEB Browser Password Recovery
Mail Messenger Password Recovery
Jdownloader Password Recovery
holderwb.txt"
holderwb.txt
\.minecraft\lastlogin
There is a file attached to this email containing Minecraft username and password download it then decrypt the login information with my Minecraft Decryptor
Logger - Key Recorder - [
Keylogger Log
.jpeg
Logger_KeyLog_
hXXp://whatismyipaddress.com/
Debugger.Resources
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

RegSvcs.exe_676_rwx_00400000_00084000:

.text
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
v2.0.50727
CMemoryExecute.dll
CMemoryExecute
PAGE_EXECUTE_READWRITE
.ctor
System.Reflection
System.Runtime.InteropServices
System.Security.Permissions
System.Diagnostics
System.Runtime.CompilerServices
DllImportAttribute
kernel32.dll
ntdll.dll
System.Security
$8fcd4931-91a2-4e18-849b-70de34ab75df
1.0.0.0
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb
mscoree.dll
`.rdata
@.data
.rsrc
D$.SPf
 2 34 567
com.apple.Safari
com.apple.WebKit2WebProcess
SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins
"Account","Login Name","Password","Web Site","Comments"
3.7.5
SQLite format 3
CREATE TABLE sqlite_master(
sql text
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins
PK11_GetInternalKeySlot
PK11_CheckUserPassword
large file support is disabled
unknown operation
SQL logic error or missing database
foreign_keys
sqlite_compileoption_get
sqlite_compileoption_used
sqlite_source_id
sqlite_version
sqlite_attach
sqlite_detach
sqlite_stat1
sqlite_rename_parent
sqlite_rename_trigger
sqlite_rename_table
%Y-%m-%d %H:%M:%S
%Y-%m-%d
%H:%M:%S
SQLITE_
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
922337203685477580
API call with %s database connection pointer
%s-shm
%s\etilqs_
OsError 0x%x (%u)
Recovered %d frames from WAL file %s
%s-mjX
foreign key constraint failed
unable to use function %s in the requested context
abort at %d in [%s]: %s
constraint failed at %d in [%s]
cannot open savepoint - SQL statements in progress
no such savepoint: %s
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot change %s wal mode from within a transaction
statement aborts at %d: [%s] %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s
%s: %s
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
too many SQL variables
too many columns in %s
oversized integer: %s%s
misuse of aggregate: %s()
%.*s"%w"%s
%s%.*s"%w"
%s OR name=%Q
type='trigger' AND (%s)
there is already another table or index with this name: %s
sqlite_
table %s may not be altered
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE tbl=%Q
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
too many attached databases - max %d
database %s is already in use
unable to open database: %s
no such database: %s
cannot detach database %s
database %s is locked
%s %T cannot reference objects in database %s
object name reserved for internal use: %s
there is already an index named %s
too many columns on %s
duplicate column name: %s
default value of column [%s] is not constant
table "%s" has more than one primary key
no such collation sequence: %s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
view %s is circularly defined
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
indexed columns are not unique
table %s may not be indexed
views may not be indexed
virtual tables may not be indexed
there is already a table named %s
index %s already exists
sqlite_autoindex_%s_%d
table %s has no column named %s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
a JOIN clause is required before %s
unable to identify the object to be reindexed
table %s may not be modified
cannot modify %s because it is a view
foreign key mismatch
table %S has %d columns but %d values were supplied
%d values for %d columns
table %S has no column named %s
%s.%s may not be NULL
PRIMARY KEY must be unique
automatic extension loading failed: %s
foreign_key_list
malformed database schema (%s)
%s - %s
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
%s.%s
%s:%d
no such index: %s
sqlite_subquery_%p_
no such table: %s
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
no such column: %s
cannot VACUUM - SQL statements in progress
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor did not declare schema: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
cannot use index: %s
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
unable to close due to unfinished backup operation
unknown database: %s
no such vfs: %s
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
sqlite3_open
sqlite3_prepare
sqlite3_step
sqlite3_column_text
sqlite3_column_int
sqlite3_column_int64
sqlite3_finalize
sqlite3_close
sqlite3_exec
f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb
msvcrt.dll
_wcmdln
COMCTL32.dll
VERSION.dll
FindCloseUrlCache
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
WININET.dll
GetWindowsDirectoryW
KERNEL32.dll
EnumChildWindows
USER32.dll
GDI32.dll
comdlg32.dll
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
ADVAPI32.dll
ShellExecuteW
SHELL32.dll
ole32.dll
5JEw%Xg
<assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
hXXp://VVV.usertrust.com1
3hXXp://crl.usertrust.com/AddTrustExternalCARoot.crl05
hXXp://ocsp.usertrust.com0
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl05
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl0t
1hXXp://crt.usertrust.com/UTNAddTrustObject_CA.crt0%
hXXps://secure.comodo.net/CPS0A
0hXXp://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
0hXXp://crt.comodoca.com/COMODOCodeSigningCA2.crt0$
hXXp://ocsp.comodoca.com0
support@nirsoft.net0
t{SSh
v%SSW
Mail PassView
Mozilla\Profiles
Software\Mozilla\Mozilla Thunderbird
%s\Main
sqlite3.dll
nss3.dll
%programfiles%\Mozilla Thunderbird
AddExportHeaderLine
%s %s %s
HTTPMail User Name
SMTP USer Name
HTTPMail Server
SMTP Server
POP3 Password2
IMAP Password2
HTTPMail Password2
SMTP Password2
POP3 Port
IMAP Port
HTTPMail Port
SMTP Port
HTTPMail Secure Connection
SMTP Secure Connection
SMTP Display Name
SMTP Email Address
POP3 Password
IMAP Password
HTTP Password
SMTP Password
HTTP User
SMTP User
HTTP Server URL
HTTP Port
HTTPMail Use SSL
SMTP Use SSL
%s\%s
PopPort
PopPassword
SMTPAccount
SMTPServer
SMTPPort
SMTPLogSecure
SMTPPassword
%s\Accounts
LoginName
SavePasswordText
ESMTPUsername
ESMTPPassword
POP3Password
fb.dat
%s@gmail.com
%s@yahoo.com
Software\Microsoft\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
<meta http-equiv='content-type' content='text/html;charset=%s'>
<br><h4>%s <a href="hXXp://VVV.nirsoft.net/" target="newwin">%s</a></h4><p>
smtp
advapi32.dll
comctl32.dll
*.ini
netmsg.dll
Error %d: %s
%s (%s)
menu_%d
dialog_%d
TranslatorURL
_lng.ini
%-18s: %s
%%-%d.%ds
<td bgcolor=#%s nowrap>%s
<td bgcolor=#%s>%s
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
bgcolor="%s"
<font color="%s">%s</font>
<%s>%s</%s>
</%s>
report.html
*.txt
*.htm;*.html
*.xml
*.csv
Software\NirSoft\MailPassView
MailPassView
/skeepass
/deleteregkey
Failed to load the executable file !
mail.account.account
mail.server
port
mail.identity
signon.signonfilename
mailbox://%s@%s
imap://%s@%s
mailbox://%s
imap://%s
signons.txt
signons.sqlite
prefs.js
Password.NET Messenger Service
User.NET Messenger Service
Passport.Net\*
ps:password
windowslive:name=
Exception %8.8X at address %8.8X in module %s
Stack Data: %s
Code Data: %s
mozsqlite3.dll
psapi.dll
pstorec.dll
5e7e8100-9138-11d1-945a-00c04fc308ff
00000000-0000-0000-0000-000000000000
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
220D5CC1-853A-11D0-84BC-00C04FD43F8F
417E2D75-84BD-11D0-84BB-00C04FD43F8F
shell32.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
shlwapi.dll
<html><head>%s<title>%s</title></head>
%s <h3>%s</h3>
size="%d"
color="#%s"
<font color="%s">
<table border="1" cellpadding="5"><tr%s>
width="%s"
<th%s>%s%s%s
SOFTWARE\Mozilla
mozilla
%s\bin
PathToExe
\sqlite3.dll
\mozsqlite3.dll
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Live Mail
SMTP_Server
SMTP_User_Name
POP3_Password2
IMAP_Password2
NNTP_Password2
SMTP_Password2
SMTP_Email_Address
SMTP_Port
NNTP_Port
IMAP_Port
POP3_Port
SMTP_Secure_Connection
*.oeaccount
\Microsoft\Windows Mail
\Microsoft\Windows Live Mail
f:\Projects\VS2005\mailpv\Release\mailpv.pdb
_acmdln
RPCRT4.dll
GetWindowsDirectoryA
RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyA
RegEnumKeyExA
ShellExecuteA
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="NirSoft" type="win32"></assemblyIdentity><description>NirSoft</description><dependency><dependentAssembly><assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
Debugger.exe
Microsoft.VisualBasic
System.Windows.Forms
System.Drawing
System.Management
tapi32.dll
rtm.dll
user32.dll
Debugger.Debugger.resources
Debugger.Resources.resources
Debugger.My
WindowsFormsApplicationBase
Microsoft.VisualBasic.ApplicationServices
System.ComponentModel
System.CodeDom.Compiler
Microsoft.VisualBasic.Devices
m_MyWebServicesObjectProvider
.cctor
get_WebServices
HelpKeywordAttribute
System.ComponentModel.Design
WebServices
Microsoft.VisualBasic.CompilerServices
System.Collections
ContainsKey
InvalidOperationException
MyWebServices
encryptedpassstring
encryptedsmtpstring
portstring
fakeMSGholder
encryptedftphost
encryptedftpuser
encryptedftppass
useftp
websitevisitor
websiteblocker
passstring
smtpstring
ftphost
ftpuser
ftppass
WM_KEYUP
WM_KEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYUP
KeyboardHandle
KeyLog
CleanedPasswordsMAIL
CleanedPasswordsWB
System.IO
get_ExecutablePath
set_WindowState
FormWindowState
UnhookWindowsHookEx
SetWindowsHookEx
SetWindowsHookExA
GetAsyncKeyState
vKey
HookKeyboard
UnhookKeyboard
Operators
get_Keyboard
Keyboard
get_CtrlKeyDown
get_AltKeyDown
KeyboardCallback
System.Threading
System.Collections.Generic
Microsoft.VisualBasic.MyServices
System.Collections.ObjectModel
MsgBox
MsgBoxResult
MsgBoxStyle
ForceSteamLogin
System.Net.NetworkInformation
get_OperationalStatus
OperationalStatus
FakemsgInstall
System.Net.Mail
SmtpClient
System.Globalization
set_Port
System.Net
Microsoft.Win32
RegistryKey
OpenSubKey
System.Security.Cryptography
System.Text
set_Key
stealWebroswers
WebClient
readweb
System.IO.Compression
SendLogsFTP
FtpWebRequest
WebRequest
UploadFTP
secretKey
set_KeySize
get_KeySize
System.Net.Sockets
virtualKey
KeyboardHookDelegate
get_Msg
Debugger.My.Resources
System.Resources
get_CMemoryExecute
get_WebBrowserPassView
WebBrowserPassView
System.Configuration
8.0.0.0
My.Computer
My.Application
My.User
My.Forms
My.WebServices
System.Windows.Forms.Form
My.MyProject.Forms
4System.Web.Services.Protocols.SoapHttpClientProtocol
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
10.0.0.0
My.Settings
$e48811ca-8af8-4e73-85dd-2045b9cca73a
_CorExeMain
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
%%0.ß
Apple Computer\Preferences\keychain.plist
LoadPasswordsIE
LoadPasswordsFirefox
LoadPasswordsChrome
LoadPasswordsOpera
LoadPasswordsSafari
LoadPasswordsSeaMonkey
UseFirefoxProfileFolder
UseFirefoxInstallFolder
UseChromeProfileFolder
UseOperaPasswordFile
FirefoxProfileFolder
FirefoxInstallFolder
ChromeProfileFolder
OperaPasswordFile
Aadvapi32.dll
crypt32.dll
777705555443332
5555443332
5555443332
wand.dat
@nss3.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe
%programfiles%\Sea Monkey
%programfiles%\Mozilla Firefox
-signons.txt
signons2.txt
signons3.txt
@dllhost.exe
taskhost.exe
taskhostex.exe
Microsoft\Windows\WebCache\WebCacheV01.dat
Microsoft\Windows\WebCache\WebCacheV24.dat
index.dat
hXXps://VVV.google.com/accounts/servicelogin
hXXp://VVV.facebook.com/
hXXps://login.yahoo.com/config/login
hXXp://
hXXps://
PTF://
@history.dat
places.sqlite
Mozilla\Firefox\Profiles
Mozilla\SeaMonkey\Profiles
Mozilla\SeaMonkey
Mozilla\Firefox
profiles.ini
Profile%d
tntdll.dll
sWeb Data
Login Data
Google\Chrome\User Data
Google\Chrome SxS\User Data
Opera\Opera\wand.dat
Opera\Opera7\profile\wand.dat
Opera
@"%s"
Ashell32.dll
\nss3.dll
.save
vaultcli.dll
abe2869f-9b47-4cd9-a358-c22904dba7f7
Copy &Password
&HTML Report - All Items
HTML R&eport - Selected Items
HTML Report - All Items
HTML Report - Selected Items
Load Passwords From...
Google Chrome
Mozilla Firefox
SeaMonkey
Firefox Options
Master password:
Firefox Profile:
Firefox Installation:
Chrome Options
Opera Options
wand.dat file:
%d Passwords
, %d Selected
Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat)
Loading... %d
KeePass csv file
Opera Password File
Firefox 1.x
Firefox 2.x
Firefox 3.0
Firefox
Chrome
Web Browser
Password
Password Strength
Password Field
WebBrowserPassView.exe
VVV.google.com/Please log in to your Gmail account
VVV.google.com:443/Please log in to your Gmail account
VVV.google.com/Please log in to your Google Account
VVV.google.com:443/Please log in to your Google Account
VVV.google.com
dWindowsLive:name=*
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
Copy Password
%d items
Select Eudora.ini filename/Select the location of Thunderbird installation
Eudora.ini file
SMTP
Windows Mail
Windows Live Mail
Server Port
SMTP Server Port
Mail Password Recovery
mailpv.exe
3,  7 #,)
MessageBoxIcon.Error
yesftp
filename.exe
hXXp://VVV.example.com/directory/file.exe
Disablecmd
\Windows Update.exe
\WindowsUpdate.exe
SysInfo.txt
\pid.txt
\pidloc.txt
noftp
\Mozilla\Firefox\Profiles
127.0.0.1
\SteamAppData.vdf
\ClientRegistry.blob
MessageBoxIcon.Exclamation
Keylogger Enabled:
Operating System:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
autorun.inf
open=Sys.exe
Sys.exe
Software\Microsoft\Windows\CurrentVersion\Run
Windows Update
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Microsoft.NET\Framework\v2.0.50727\vbc.exe
holdermail.txt"
holdermail.txt
Operating System Intel Recovery
Operating System Platform:
Operating System Version:
WEB Browser Password Recovery
Mail Messenger Password Recovery
Jdownloader Password Recovery
holderwb.txt"
holderwb.txt
\.minecraft\lastlogin
There is a file attached to this email containing Minecraft username and password download it then decrypt the login information with my Minecraft Decryptor
Logger - Key Recorder - [
Keylogger Log
.jpeg
Logger_KeyLog_
hXXp://whatismyipaddress.com/
Debugger.Resources
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    dlt.exe:4032
    dlt.exe:4028
    uce.exe:3104
    uce.exe:2856
    6785555.exe:3820
    %original file name%.exe:2028
    vbc.exe:1252
    vbc.exe:2064

  2. Delete the original HackTool file.
  3. Delete or disinfect the following files created/modified by the HackTool:

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\YWLNQ (277 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\RYBOP (277 bytes)
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\.Identifier (68 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\pid.txt (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\pidloc.txt (57 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\qql.ico (544 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\jfh.jpg (570 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\ngw.docx (548 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\sgg.bmp (502 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\mwl.ico (598 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\hec.bmp (611 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\ufc.xl (587 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\cle.jpg (569 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\uhq.dat (577 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\tar.xl (578 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\jxa.ico (520 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\cjq.docx (566 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\hil.jpg (557 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\jev.docx (556 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\mqh.jpg (505 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\cxc.mp3 (593 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\nmm.txt (625 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\rss-hbm (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\rqi.jpg (570 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\xxf.ppt (568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\vln.xl (541 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\klo.icm (506 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\vbt.ppt (591 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\chn.mp3 (594 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\auo.ico (559 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\onu.txt (558 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\hwf.bmp (534 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\dlt.exe (15154 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\hwh.xl (522 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\kka.ppt (577 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\ogi.jpg (611 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\rvf.jpg (530 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\kjf.icm (542 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\sor.docx (513 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\ven.ppt (515 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\ljm.mp4 (517 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\uur.ppt (506 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\hol.ppt (515 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\rhl.mp4 (561 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\omv.mp4 (516 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\rwm.ico (563 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\ehb.icm (510 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\pvu.xl (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\cxf.dat (514 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\sol.icm (593 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\cfo.txt (636 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\csf.dat (560 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\xbg.xl (551 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\emc.icm (604 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\gfb.ico (503 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\$_35.PDF (17 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\adx.mp3 (600 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\kom.ico (593 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\lbr.docx (503 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\tis.mp4 (601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\chd.docx (542 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\gbw.pdf (541 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\fpa.jpg (506 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\bft.icm (577 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\bbn.bmp (669 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\ppw.mp4 (604 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\rio.ppt (546 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\clp.bmp (527 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\owl-wuc (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\uce.exe (15154 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\pih.icm (537 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\ckr.dat (510 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\bpn.pdf (589 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\man.mp3 (544 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\csi.ico (595 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\wmi.txt (537 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\bxt.icm (616 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\mnc.txt (535 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\tqg.jpg (577 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\rrq.dat (695 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\nxw.ppt (519 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\xmv.dat (645 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\vxa.mp4 (524 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\6785555.exe (3402 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\cdt.docx (530 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\fip.txt (603 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\otn.xl (557 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\wnn.icm (561 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\hlh.txt (637 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\aqx.xl (557 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\wmf.ppt (575 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\bgr.pdf (545 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\uag.mp4 (598 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\nqb.xl (509 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\asw.xl (588 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\mmx.mp3 (520 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\shf.ppt (574 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\uok.xl (614 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\bvg.ppt (533 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\jtk.ico (567 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\aeo.ppt (604 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\ktk.icm (616 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\xau.ppt (550 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\pow.icm (513 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\daf.icm (503 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\vxa.xl (517 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\hfd.ico (636 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\lep.icm (739 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\grf.pdf (502 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\holderwb.txt (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\holdermail.txt (1120 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WindowsUpdate" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\dlt.exe C:\Users\"%CurrentUserName%"\AppData\Local\Temp\73531036\rss-hbm"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WindowsUpdate" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\uce.exe C:\Users\"%CurrentUserName%"\AppData\Local\Temp\14689191\owl-wuc"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  7. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2025 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now