Trojan.Win32.Autoit.abcfq (Kaspersky), Trojan.GenericKD.3472530 (B) (Emsisoft), Trojan.GenericKD.3472530 (AdAware), HackTool.Win32.PassView.FD, Worm.Win32.AutoIt.FD, WormAutoItGen.YR, HackToolPassView.YR, GenericAutorunWorm.YR, TrojanDropperVtimrun.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Worm, HackTool, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 5115d32a85bd187cf7c28cc93fd5ff47
SHA1: f85f9459aad14f3bcf92883d6cb875abca9ce7b7
SHA256: 1b5df068b32db88db332400cbdeea1ca09c54400ac849e84ba28ef1c2e2a7236
SSDeep: 24576:oKjTvnXwYpG0cOyLd9DBowXizbT4dSGNB7dP7/VMffTvYuwBwY:oKjLngcEOyLd9DehzN2VK7vj
Size: 1395200 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-10-31 05:28:47
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1620
dwwin.exe:560
schtasks.exe:2024
egei.exe:2012
vbc.exe:2596
vbc.exe:2284
The Trojan injects its code into the following process(es):
RegSvcs.exe:248
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1620 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\egei.exe (16808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\oinwiqb.hts (1278918 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\qbpnba.twf (9269 bytes)
The process RegSvcs.exe:248 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\pid.txt (3 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (0 bytes)
The process egei.exe:2012 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\RegSvcs.exe (32 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\7c8f_appcompat.txt (0 bytes)
The process vbc.exe:2596 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (2 bytes)
Registry activity
The process %original file name%.exe:1620 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 27 24 B7 24 21 83 B3 25 95 E6 10 B2 DF A1 9A"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"
The process dwwin.exe:560 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 AD 09 76 A0 9B E4 78 FE D5 E2 5F B5 00 D1 C8"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process RegSvcs.exe:248 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C]
"Blob" = "04 00 00 00 01 00 00 00 10 00 00 00 6F 7E 74 A3"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\ESENT\Process\RegSvcs\DEBUG]
"Trace Level" = ""
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 42 55 A8 FB 6E CC 66 79 83 A2 37 EF 31 49 76"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"
The Trojan deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates]
"E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C"
[HKLM\SOFTWARE\Microsoft\ESENT\Process\RegSvcs\DEBUG]
"Trace Level"
The process schtasks.exe:2024 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 EF 36 29 53 2D F3 90 D3 92 6B 70 05 66 B2 E5"
The process egei.exe:2012 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "06 CA F1 84 E9 6F EC C1 22 02 93 67 AB 9A 43 F7"
The Trojan deletes the following registry key(s):
[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]
The Trojan deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]
"DWFileTreeRoot"
The process vbc.exe:2596 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 BE 62 BD B5 46 45 1C 2A D5 3D 55 4E 13 E9 77"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
The process vbc.exe:2284 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA 5B EB B7 2B 73 B7 99 C7 39 EE 50 75 B1 E6 38"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
Dropped PE files
MD5 | File path |
---|---|
d78037c554f59e29727541f1f39100a9 | c:\Documents and Settings\"%CurrentUserName%"\RegSvcs.exe |
79cd14a75d06ba52712e45bea1070fba | c:\Documents and Settings\"%CurrentUserName%"\vftqdto\egei.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1620
dwwin.exe:560
schtasks.exe:2024
egei.exe:2012
vbc.exe:2596
vbc.exe:2284 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\egei.exe (16808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\oinwiqb.hts (1278918 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\qbpnba.twf (9269 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\pid.txt (3 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\RegSvcs.exe (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (2 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: Microsoft Corporation
Product Name: Internet Explorer
Product Version: 11.00.9600.16384
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WEXTRACT.EXE .MUI
Internal Name: Wextract
File Version: 11.00.9600.16384 (winblue_rtm.130821-1623)
File Description: Win32 Cabinet Self-Extractor
Comments:
Language: English (United States)
Company Name: Microsoft CorporationProduct Name: Internet ExplorerProduct Version: 11.00.9600.16384Legal Copyright: (c) Microsoft Corporation. All rights reserved.Legal Trademarks: Original Filename: WEXTRACT.EXE .MUIInternal Name: Wextract File Version: 11.00.9600.16384 (winblue_rtm.130821-1623)File Description: Win32 Cabinet Self-Extractor Comments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 26980 | 27136 | 4.40175 | 22c7cbc7745692002dbdf65a4bc48e63 |
.data | 32768 | 6796 | 1024 | 2.20139 | 317f8a934ee443eee01c2a315bde9ca1 |
.idata | 40960 | 4220 | 4608 | 3.49841 | a5d9b0c8d0d0e35bcbb5219dda1a3075 |
.rsrc | 49152 | 1358767 | 1358848 | 5.33925 | 1354df4c47bb5320c49c58763157ec3b |
.reloc | 1409024 | 2240 | 2560 | 4.41763 | 7772c8e6ff71410862c324630aac5515 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://whatismyipaddress.com/ | 184.30.217.129 |
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt | |
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab | |
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt | |
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | 212.30.134.183 |
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt | 212.30.134.183 |
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt | 212.30.134.183 |
smtp.live.com | 65.55.176.126 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET / HTTP/1.1
Host: whatismyipaddress.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 59
Date: Sat, 24 Sep 2016 05:22:35 GMT
Connection: keep-alive
Access Denied (AK1). Contact support@whatismyipaddress.comHTTP/1.1 200 OK..Content-Type: text/html..Content-Length: 59..Date: Sat, 24 Sep 2016 05:22:35 GMT..Connection: keep-alive..Access Denied (AK1). Contact support@whatismyipaddress.com..
GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: VVV.download.windowsupdate.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Cache-Control: max-age=604800
Content-Type: text/plain
Last-Modified: Thu, 14 Apr 2016 22:20:39 GMT
Accept-Ranges: bytes
ETag: "8095d7df9b96d11:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 18
Date: Sat, 24 Sep 2016 05:22:56 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
1401D1969BE01E11A6....
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: VVV.download.windowsupdate.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Cache-Control: max-age=604800
Content-Type: application/octet-stream
Last-Modified: Fri, 15 Apr 2016 17:23:18 GMT
Accept-Ranges: bytes
ETag: "0c730803b97d11:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
X-Powered-By: ARR/2.5
X-Powered-By: ASP.NET
Content-Length: 49640
Date: Sat, 24 Sep 2016 05:22:56 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............,...................I..................HaR .authroot.stl.%.u3S8..CK...<T.......4v.e.3h.......l...kICY*7-viS.ZH{i.."QY...H.T$!..L..g......k^.w.s..y?..}....4.......d.4...0....)...0..@.......D. 0Y......#p.&;..,..L....._.....ppSf^.....\x....PSSC........4..Apw..:..*....."(..6..............".3..6#.*9..yx>.w..aX....U..:.*G?..3......wY.Z=G..^...J.......Qt.U.xiD2..o....1f.a.9...&...T..\.X<u.WU/.]=./8. .sK.......(.<.A$H.............5...y......"...\...IP..A(y....]..fc`.r)Y.$..<.V.............'....f..X.Y.<......R...zq.5nfO,..NE.....*/ud.7.=.".3..........%.. ....F.......,.e.3.e..... ..T...=x.BD.........R.0..3D.....W......v<\{...Oj>.$YT)LQ..........{.......s=.vs..........dY].<.v..<..w[.{.Z..qV.............= ......5.5........tm... ...SZ.....e-1e<.rX..K3>..~]{b#..&......b.e......;...?......7...!W......e\..a>!{....t.....r...TV...h....4...........Bx...aBp...............F....kx. V.q....g.?.q\.z.?h>V..ORz.....t...%.{w...4..(.......m.|..X\,./.4w.6?M$.q;q.............x?...Auip.... 8..".4...a}E.98T..*...N...7]p<G.&I.........7....@.Q.#.%.:..TE7....d..b. .E.V...-.=1.........j.)t...Z &.e.o..m..L.s.2.\...j4.d..............4.....9...3...03...-2c)L.."..y.7.|... !O.1.....i:....J.:.P..5...6.W...XP..J..^.....u.v....|..U..-..Q..CF.r ..........`.V~.C...=.=.m...6N.,..OV.Z...d.K.-....".D.8.V,}X.P.D..X"8.....;DD."../x.(M..O........1V6R./.3|I...9,........eh..........k...W.....t.*...K..a.....x.0#.t..F.!...7Vk ........7....X......2.t!...AB..b...1.&..S.`G...1@.f.I."...vl.g.}Rs....y.z}....}.
<<< skipped >>>
GET /msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: VVV.download.windowsupdate.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Content-Type: application/x-x509-ca-cert
Last-Modified: Thu, 23 Jul 2015 23:16:35 GMT
Accept-Ranges: bytes
ETag: "80b4b9e9dc5d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 889
Date: Sat, 24 Sep 2016 05:22:56 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
0..u0..]..............KZ..0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...980901120000Z..280128120000Z0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0.."0...*.H.............0................O.~....%k.H..*.......c..gf.....H ......).e...-....Lp..=.0...O....P...P......R..}.m.50.^Cs.A..j...:V98o.<.i[*M..T.l....<......<.x...tn.Da...F.u......ml.x......8..$.OsT...:...4.....w.... ...Sn..{7t.pG."Qc.y...A&... .F.H.d*..4.,*.l.CJ....|.!h...R...........B0@0...U...........0...U.......0....0...U......`{f.E....P/}..4....K0...*.H..............s.|Ov.......4.(2.|.l., ...S.k^..H......=aM.F..>...cU.....9.C.8../.&;..PV....8...pQ......_.....A..]ud...U0......,.cF.....i...Hd......).........i,i$x....qb......]...G.n*.V1..g.. .l.]F......Q.p..V=a.j.\...=.A...cR.SS. ......_..A..........o. .......fU..H.)&i.HTTP/1.1 200 OK..Content-Type: application/x-x509-ca-c..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1620:
.text
.text
`.data
`.data
.idata
.idata
@.rsrc
@.rsrc
@.reloc
@.reloc
Invalid parameter passed to C runtime function.
Invalid parameter passed to C runtime function.
advapi32.dll
advapi32.dll
setupx.dll
setupx.dll
setupapi.dll
setupapi.dll
advpack.dll
advpack.dll
wininit.ini
wininit.ini
Software\Microsoft\Windows\CurrentVersion\App Paths
Software\Microsoft\Windows\CurrentVersion\App Paths
ADMQCMD
ADMQCMD
USRQCMD
USRQCMD
FINISHMSG
FINISHMSG
IXPd.TMP
IXPd.TMP
msdownld.tmp
msdownld.tmp
TMP4351$.TMP
TMP4351$.TMP
wextract.pdb
wextract.pdb
PSSSSSSh
PSSSSSSh
SSSh
SSSh
PSSShp
PSSShp
PSShp
PSShp
t.ShB
t.ShB
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"
System\CurrentControlSet\Control\Session Manager\FileRenameOperations
System\CurrentControlSet\Control\Session Manager\FileRenameOperations
wextract_cleanup%d
wextract_cleanup%d
Command.com /c %s
Command.com /c %s
rundll32.exe %s,InstallHinfSection %s 128 %s
rundll32.exe %s,InstallHinfSection %s 128 %s
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\RunOnce
%s /D:%s
%s /D:%s
PendingFileRenameOperations
PendingFileRenameOperations
SHELL32.DLL
SHELL32.DLL
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryInfoKeyA
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
GDI32.dll
GDI32.dll
ExitWindowsEx
ExitWindowsEx
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
USER32.dll
USER32.dll
_amsg_exit
_amsg_exit
_acmdln
_acmdln
msvcrt.dll
msvcrt.dll
COMCTL32.dll
COMCTL32.dll
Cabinet.dll
Cabinet.dll
VERSION.dll
VERSION.dll
egei.exe
egei.exe
oinwiqb.hts
oinwiqb.hts
qbpnba.twf
qbpnba.twf
#1.gwD
#1.gwD
fuh.qJD
fuh.qJD
.bw.!
.bw.!
.!QU`%d
.!QU`%d
.lHD2
.lHD2
el.dI
el.dI
w8.zA
w8.zA
EK.FI
EK.FI
%D;8z
%D;8z
Xq!%F
Xq!%F
%d|91
%d|91
(K%ds0
(K%ds0
gHd.Ci
gHd.Ci
`Fy5.kj
`Fy5.kj
.si{u
.si{u
2%%D
2%%D
w$E.Fk
w$E.Fk
\U.cf^
\U.cf^
K/Õ*
K/Õ*
:-t} l
:-t} l
fcM;k%D:
fcM;k%D:
K.iv\E
K.iv\E
iDuD.Yo
iDuD.Yo
D?Ú
D?Ú
.yyVG
.yyVG
g?.cA;X
g?.cA;X
Qt.yLP/`
Qt.yLP/`
-@L
-@L
OUdP
OUdP
y.JO8
y.JO8
.CU>f#J
.CU>f#J
=[/.JBQ8
=[/.JBQ8
%Fj,9
%Fj,9
Qr.LF
Qr.LF
\8.bHls
\8.bHls
.UV:g
.UV:g
]Wtn%DIu
]Wtn%DIu
VJ=%S
VJ=%S
%cK?=
%cK?=
^p?%U
^p?%U
@R%
@R%
;.bc{?
;.bc{?
yV.nu
yV.nu
.DfvZ
.DfvZ
VJj%0X
VJj%0X
n
n
.uTS{'
.uTS{'
Keyi\
Keyi\
&AU^.UF
&AU^.UF
.Oc~z
.Oc~z
jm.zC@
jm.zC@
%FYr1
%FYr1
Ã,o
Ã,o
.vhd}
.vhd}
.jIQ@
.jIQ@
sA-D%F
sA-D%F
}
}
S.PTS
S.PTS
G*G.aE
G*G.aE
dZ.yY
dZ.yY
B%CoV
B%CoV
U'.Ry
U'.Ry
K(%X_
K(%X_
>[keY
>[keY
f6.mi
f6.mi
DQcMD
DQcMD
:u%f'Z
:u%f'Z
egei.exe oinwiqb.hts
egei.exe oinwiqb.hts
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
9 9$9
9 9$9
Kernel32.dll
Kernel32.dll
Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.
Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.
CFailed to get disk space information from: %s.
CFailed to get disk space information from: %s.
System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?
System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?
8Unable to retrieve operating system version information.!Memory allocation request failed.
8Unable to retrieve operating system version information.!Memory allocation request failed.
Filetable full.Ên not change to destination folder.
Filetable full.Ên not change to destination folder.
Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.
Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.
(Error creating process . Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
(Error creating process . Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install
Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install
Could not create folder '%s'
Could not create folder '%s'
To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.
To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.
Error retrieving Windows folder
Error retrieving Windows folder
$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .
$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .
System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.
System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.
/C: -- Override Install Command defined by author.
/C: -- Override Install Command defined by author.
eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?
eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?
Could not find the file: %s.
Could not find the file: %s.
:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.
:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.
11.00.9600.16384 (winblue_rtm.130821-1623)
11.00.9600.16384 (winblue_rtm.130821-1623)
WEXTRACT.EXE .MUI
WEXTRACT.EXE .MUI
11.00.9600.16384
11.00.9600.16384
egei.exe_2012:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
j.Yf;
j.Yf;
r%f;M
r%f;M
j.Xf;
j.Xf;
j.Zf;
j.Zf;
PSSSSSSh
PSSSSSSh
Gt.Ht$
Gt.Ht$
kernel32.dll
kernel32.dll
?#%X.y
?#%X.y
GetProcessWindowStation
GetProcessWindowStation
operator
operator
operand of unlimited repeat could match the empty string
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
POSIX named classes are supported only within a class
erroffset passed as NULL
erroffset passed as NULL
POSIX collating elements are not supported
POSIX collating elements are not supported
this version of PCRE is compiled without UTF support
this version of PCRE is compiled without UTF support
PCRE does not support \L, \l, \N{name}, \U, or \u
PCRE does not support \L, \l, \N{name}, \U, or \u
support for \P, \p, and \X has not been compiled
support for \P, \p, and \X has not been compiled
this version of PCRE is not compiled with Unicode property support
this version of PCRE is not compiled with Unicode property support
\N is not supported in a class
\N is not supported in a class
RegDeleteKeyExW
RegDeleteKeyExW
advapi32.dll
advapi32.dll
Error text not found (please report)
Error text not found (please report)
WSOCK32.dll
WSOCK32.dll
VERSION.dll
VERSION.dll
WINMM.dll
WINMM.dll
COMCTL32.dll
COMCTL32.dll
MPR.dll
MPR.dll
InternetCrackUrlW
InternetCrackUrlW
HttpQueryInfoW
HttpQueryInfoW
HttpOpenRequestW
HttpOpenRequestW
HttpSendRequestW
HttpSendRequestW
FtpOpenFileW
FtpOpenFileW
FtpGetFileSize
FtpGetFileSize
InternetOpenUrlW
InternetOpenUrlW
WININET.dll
WININET.dll
PSAPI.DLL
PSAPI.DLL
IPHLPAPI.DLL
IPHLPAPI.DLL
USERENV.dll
USERENV.dll
UxTheme.dll
UxTheme.dll
GetProcessHeap
GetProcessHeap
CreatePipe
CreatePipe
GetWindowsDirectoryW
GetWindowsDirectoryW
KERNEL32.dll
KERNEL32.dll
OpenWindowStationW
OpenWindowStationW
SetProcessWindowStation
SetProcessWindowStation
CloseWindowStation
CloseWindowStation
MapVirtualKeyW
MapVirtualKeyW
EnumChildWindows
EnumChildWindows
EnumWindows
EnumWindows
VkKeyScanW
VkKeyScanW
GetKeyState
GetKeyState
GetKeyboardState
GetKeyboardState
SetKeyboardState
SetKeyboardState
GetAsyncKeyState
GetAsyncKeyState
keybd_event
keybd_event
EnumThreadWindows
EnumThreadWindows
ExitWindowsEx
ExitWindowsEx
UnregisterHotKey
UnregisterHotKey
RegisterHotKey
RegisterHotKey
GetKeyboardLayoutNameW
GetKeyboardLayoutNameW
USER32.dll
USER32.dll
SetViewportOrgEx
SetViewportOrgEx
GDI32.dll
GDI32.dll
COMDLG32.dll
COMDLG32.dll
RegOpenKeyExW
RegOpenKeyExW
RegCloseKey
RegCloseKey
RegCreateKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteKeyW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteW
ShellExecuteW
SHFileOperationW
SHFileOperationW
ShellExecuteExW
ShellExecuteExW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
GetCPInfo
GetCPInfo
zcÃ
zcÃ
UQ.WP
UQ.WP
mI.Us
mI.Us
\.gGL
\.gGL
.FFF
.FFF
,.bh9
,.bh9
].Whjj*
].Whjj*
? ?$?(?,?0?4?8?
? ?$?(?,?0?4?8?
2 2$2(2,2024282
2 2$2(2,2024282
1,20242[2
1,20242[2
0\0c0k0p0t0x0
0\0c0k0p0t0x0
1!1%1)1-1
1!1%1)1-1
2#3(323=3
2#3(323=3
6$7(7,70747
6$7(7,70747
5 5-5\9~9
5 5-5\9~9
8%9.959@9
8%9.959@9
2 2 222\2
2 2 222\2
> >$>(>,>
> >$>(>,>
? ?$?(?,?0?
? ?$?(?,?0?
/AutoIt3ExecuteScript
/AutoIt3ExecuteScript
/AutoIt3ExecuteLine
/AutoIt3ExecuteLine
CMDLINE
CMDLINE
CMDLINERAW
CMDLINERAW
FTPSETPROXY
FTPSETPROXY
GUICTRLRECVMSG
GUICTRLRECVMSG
GUICTRLSENDMSG
GUICTRLSENDMSG
GUIGETMSG
GUIGETMSG
GUIREGISTERMSG
GUIREGISTERMSG
HOTKEYSET
HOTKEYSET
HTTPSETPROXY
HTTPSETPROXY
HTTPSETUSERAGENT
HTTPSETUSERAGENT
ISKEYWORD
ISKEYWORD
MAPKEYS
MAPKEYS
MSGBOX
MSGBOX
REGENUMKEY
REGENUMKEY
SHELLEXECUTE
SHELLEXECUTE
SHELLEXECUTEWAIT
SHELLEXECUTEWAIT
TCPACCEPT
TCPACCEPT
TCPCLOSESOCKET
TCPCLOSESOCKET
TCPCONNECT
TCPCONNECT
TCPLISTEN
TCPLISTEN
TCPNAMETOIP
TCPNAMETOIP
TCPRECV
TCPRECV
TCPSEND
TCPSEND
TCPSHUTDOWN
TCPSHUTDOWN
TCPSTARTUP
TCPSTARTUP
TRAYGETMSG
TRAYGETMSG
UDPBIND
UDPBIND
UDPCLOSESOCKET
UDPCLOSESOCKET
UDPOPEN
UDPOPEN
UDPRECV
UDPRECV
UDPSEND
UDPSEND
UDPSHUTDOWN
UDPSHUTDOWN
UDPSTARTUP
UDPSTARTUP
SendKeyDownDelay
SendKeyDownDelay
SendKeyDelay
SendKeyDelay
TCPTimeout
TCPTimeout
mscoree.dll
mscoree.dll
combase.dll
combase.dll
- floating point support not loaded
- floating point support not loaded
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
USER32.DLL
USER32.DLL
789:;?
789:;?
APPSKEY
APPSKEY
WINDOWSDIR
WINDOWSDIR
AUTOITEXE
AUTOITEXE
HOTKEYPRESSED
HOTKEYPRESSED
%s (%d) : ==> %s.:
%s (%d) : ==> %s.:
Line %d:
Line %d:
Line %d (File "%s"):
Line %d (File "%s"):
%s (%d) : ==> %s:
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
*.au3;*.a3x
All files (*.*)
All files (*.*)
KEYS
KEYS
Line %d:
Line %d:
\\?\UNC\
\\?\UNC\
04090000
04090000
%u.%u.%u.%u
%u.%u.%u.%u
0.0.0.0
0.0.0.0
Mddddd
Mddddd
"%s" (%d) : ==> %s:
"%s" (%d) : ==> %s:
\??\%s
\??\%s
GUI_RUNDEFMSG
GUI_RUNDEFMSG
AUTOITCALLVARIABLE%d
AUTOITCALLVARIABLE%d
255.255.255.255
255.255.255.255
Keyword
Keyword
AUTOIT.ERROR
AUTOIT.ERROR
Null Object assignment in FOR..IN loop
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
Incorrect Object type in FOR..IN loop
3, 3, 14, 0
3, 3, 14, 0
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_USERS
HKEY_USERS
%d/d/d
%d/d/d
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\egei.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\egei.exe
hXXp://VVV.autoitscript.com/autoit3/
hXXp://VVV.autoitscript.com/autoit3/
AutoIt3.exe
AutoIt3.exe
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
Missing operator in expression."Unbalanced brackets in expression.
Missing operator in expression."Unbalanced brackets in expression.
>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.
3This keyword cannot be used after a "Then" keyword.
3This keyword cannot be used after a "Then" keyword.
0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.#Variable subscript badly formatted.*Subscript used on non-accessible variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.#Variable subscript badly formatted.*Subscript used on non-accessible variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.
HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.
String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.
RegSvcs.exe_248:
.text
.text
`.rsrc
`.rsrc
@.reloc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
v2.0.50727
v2.0.50727
CMemoryExecute.dll
CMemoryExecute.dll
CMemoryExecute
CMemoryExecute
PAGE_EXECUTE_READWRITE
PAGE_EXECUTE_READWRITE
.ctor
.ctor
System.Reflection
System.Reflection
System.Runtime.InteropServices
System.Runtime.InteropServices
System.Security.Permissions
System.Security.Permissions
System.Diagnostics
System.Diagnostics
System.Runtime.CompilerServices
System.Runtime.CompilerServices
DllImportAttribute
DllImportAttribute
kernel32.dll
kernel32.dll
ntdll.dll
ntdll.dll
System.Security
System.Security
$8fcd4931-91a2-4e18-849b-70de34ab75df
$8fcd4931-91a2-4e18-849b-70de34ab75df
1.0.0.0
1.0.0.0
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb
C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb
mscoree.dll
mscoree.dll
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
D$.SPf
D$.SPf
2 34 567
2 34 567
com.apple.Safari
com.apple.Safari
com.apple.WebKit2WebProcess
com.apple.WebKit2WebProcess
SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins
SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins
"Account","Login Name","Password","Web Site","Comments"
"Account","Login Name","Password","Web Site","Comments"
3.7.5
3.7.5
SQLite format 3
SQLite format 3
CREATE TABLE sqlite_master(
CREATE TABLE sqlite_master(
sql text
sql text
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins
SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
PK11_CheckUserPassword
PK11_CheckUserPassword
large file support is disabled
large file support is disabled
unknown operation
unknown operation
SQL logic error or missing database
SQL logic error or missing database
foreign_keys
foreign_keys
sqlite_compileoption_get
sqlite_compileoption_get
sqlite_compileoption_used
sqlite_compileoption_used
sqlite_source_id
sqlite_source_id
sqlite_version
sqlite_version
sqlite_attach
sqlite_attach
sqlite_detach
sqlite_detach
sqlite_stat1
sqlite_stat1
sqlite_rename_parent
sqlite_rename_parent
sqlite_rename_trigger
sqlite_rename_trigger
sqlite_rename_table
sqlite_rename_table
%Y-%m-%d %H:%M:%S
%Y-%m-%d %H:%M:%S
%Y-%m-%d
%Y-%m-%d
%H:%M:%S
%H:%M:%S
SQLITE_
SQLITE_
failed to allocate %u bytes of memory
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
failed memory resize %u to %u bytes
922337203685477580
922337203685477580
API call with %s database connection pointer
API call with %s database connection pointer
%s-shm
%s-shm
%s\etilqs_
%s\etilqs_
OsError 0x%x (%u)
OsError 0x%x (%u)
Recovered %d frames from WAL file %s
Recovered %d frames from WAL file %s
%s-mjX
%s-mjX
foreign key constraint failed
foreign key constraint failed
unable to use function %s in the requested context
unable to use function %s in the requested context
abort at %d in [%s]: %s
abort at %d in [%s]: %s
constraint failed at %d in [%s]
constraint failed at %d in [%s]
cannot open savepoint - SQL statements in progress
cannot open savepoint - SQL statements in progress
no such savepoint: %s
no such savepoint: %s
cannot %s savepoint - SQL statements in progress
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot change %s wal mode from within a transaction
cannot change %s wal mode from within a transaction
statement aborts at %d: [%s] %s
statement aborts at %d: [%s] %s
misuse of aliased aggregate %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s.%s
%s: %s.%s
%s: %s.%s
%s: %s
%s: %s
%r %s BY term out of range - should be between 1 and %d
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
variable number must be between ?1 and ?%d
too many SQL variables
too many SQL variables
too many columns in %s
too many columns in %s
oversized integer: %s%s
oversized integer: %s%s
misuse of aggregate: %s()
misuse of aggregate: %s()
%.*s"%w"%s
%.*s"%w"%s
%s%.*s"%w"
%s%.*s"%w"
%s OR name=%Q
%s OR name=%Q
type='trigger' AND (%s)
type='trigger' AND (%s)
there is already another table or index with this name: %s
there is already another table or index with this name: %s
sqlite_
sqlite_
table %s may not be altered
table %s may not be altered
view %s may not be altered
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_altertab_%s
CREATE TABLE %Q.%s(%s)
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE tbl=%Q
DELETE FROM %Q.%s WHERE tbl=%Q
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
invalid name: "%s"
too many attached databases - max %d
too many attached databases - max %d
database %s is already in use
database %s is already in use
unable to open database: %s
unable to open database: %s
no such database: %s
no such database: %s
cannot detach database %s
cannot detach database %s
database %s is locked
database %s is locked
%s %T cannot reference objects in database %s
%s %T cannot reference objects in database %s
object name reserved for internal use: %s
object name reserved for internal use: %s
there is already an index named %s
there is already an index named %s
too many columns on %s
too many columns on %s
duplicate column name: %s
duplicate column name: %s
default value of column [%s] is not constant
default value of column [%s] is not constant
table "%s" has more than one primary key
table "%s" has more than one primary key
no such collation sequence: %s
no such collation sequence: %s
CREATE %s %.*s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
view %s is circularly defined
view %s is circularly defined
table %s may not be dropped
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
use DROP VIEW to delete view %s
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
foreign key on %s should reference only one column of table %T
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
unknown column "%s" in foreign key definition
indexed columns are not unique
indexed columns are not unique
table %s may not be indexed
table %s may not be indexed
views may not be indexed
views may not be indexed
virtual tables may not be indexed
virtual tables may not be indexed
there is already a table named %s
there is already a table named %s
index %s already exists
index %s already exists
sqlite_autoindex_%s_%d
sqlite_autoindex_%s_%d
table %s has no column named %s
table %s has no column named %s
CREATE%s INDEX %.*s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
a JOIN clause is required before %s
a JOIN clause is required before %s
unable to identify the object to be reindexed
unable to identify the object to be reindexed
table %s may not be modified
table %s may not be modified
cannot modify %s because it is a view
cannot modify %s because it is a view
foreign key mismatch
foreign key mismatch
table %S has %d columns but %d values were supplied
table %S has %d columns but %d values were supplied
%d values for %d columns
%d values for %d columns
table %S has no column named %s
table %S has no column named %s
%s.%s may not be NULL
%s.%s may not be NULL
PRIMARY KEY must be unique
PRIMARY KEY must be unique
automatic extension loading failed: %s
automatic extension loading failed: %s
foreign_key_list
foreign_key_list
malformed database schema (%s)
malformed database schema (%s)
%s - %s
%s - %s
unsupported file format
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
unknown or unsupported join type: %T %T%s%T
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
cannot join using column %s - column not present in both tables
%s.%s
%s.%s
%s:%d
%s:%d
no such index: %s
no such index: %s
sqlite_subquery_%p_
sqlite_subquery_%p_
no such table: %s
no such table: %s
cannot create %s trigger on view: %S
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
no such trigger: %S
no such column: %s
no such column: %s
cannot VACUUM - SQL statements in progress
cannot VACUUM - SQL statements in progress
PRAGMA vacuum_db.synchronous=OFF
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor failed: %s
vtable constructor did not declare schema: %s
vtable constructor did not declare schema: %s
no such module: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
at most %d tables in a join
cannot use index: %s
cannot use index: %s
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
unable to close due to unfinished backup operation
unable to close due to unfinished backup operation
unknown database: %s
unknown database: %s
no such vfs: %s
no such vfs: %s
database corruption at line %d of [%.10s]
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
cannot open file at line %d of [%.10s]
sqlite3_open
sqlite3_open
sqlite3_prepare
sqlite3_prepare
sqlite3_step
sqlite3_step
sqlite3_column_text
sqlite3_column_text
sqlite3_column_int
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_int64
sqlite3_finalize
sqlite3_finalize
sqlite3_close
sqlite3_close
sqlite3_exec
sqlite3_exec
f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb
f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb
msvcrt.dll
msvcrt.dll
_wcmdln
_wcmdln
COMCTL32.dll
COMCTL32.dll
VERSION.dll
VERSION.dll
FindCloseUrlCache
FindCloseUrlCache
FindNextUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryW
WININET.dll
WININET.dll
GetWindowsDirectoryW
GetWindowsDirectoryW
KERNEL32.dll
KERNEL32.dll
EnumChildWindows
EnumChildWindows
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
comdlg32.dll
comdlg32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
5JEw%Xg
5JEw%Xg
hXXp://VVV.usertrust.com1
hXXp://VVV.usertrust.com1
3hXXp://crl.usertrust.com/AddTrustExternalCARoot.crl05
3hXXp://crl.usertrust.com/AddTrustExternalCARoot.crl05
hXXp://ocsp.usertrust.com0
hXXp://ocsp.usertrust.com0
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl05
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl05
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl0t
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl0t
1hXXp://crt.usertrust.com/UTNAddTrustObject_CA.crt0%
1hXXp://crt.usertrust.com/UTNAddTrustObject_CA.crt0%
hXXps://secure.comodo.net/CPS0A
hXXps://secure.comodo.net/CPS0A
0hXXp://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
0hXXp://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
0hXXp://crt.comodoca.com/COMODOCodeSigningCA2.crt0$
0hXXp://crt.comodoca.com/COMODOCodeSigningCA2.crt0$
hXXp://ocsp.comodoca.com0
hXXp://ocsp.comodoca.com0
support@nirsoft.net0
support@nirsoft.net0
t{SSh
t{SSh
v%SSW
v%SSW
Mail PassView
Mail PassView
Mozilla\Profiles
Mozilla\Profiles
Software\Mozilla\Mozilla Thunderbird
Software\Mozilla\Mozilla Thunderbird
%s\Main
%s\Main
sqlite3.dll
sqlite3.dll
nss3.dll
nss3.dll
%programfiles%\Mozilla Thunderbird
%programfiles%\Mozilla Thunderbird
AddExportHeaderLine
AddExportHeaderLine
%s %s %s
%s %s %s
HTTPMail User Name
HTTPMail User Name
SMTP USer Name
SMTP USer Name
HTTPMail Server
HTTPMail Server
SMTP Server
SMTP Server
POP3 Password2
POP3 Password2
IMAP Password2
IMAP Password2
HTTPMail Password2
HTTPMail Password2
SMTP Password2
SMTP Password2
POP3 Port
POP3 Port
IMAP Port
IMAP Port
HTTPMail Port
HTTPMail Port
SMTP Port
SMTP Port
HTTPMail Secure Connection
HTTPMail Secure Connection
SMTP Secure Connection
SMTP Secure Connection
SMTP Display Name
SMTP Display Name
SMTP Email Address
SMTP Email Address
POP3 Password
POP3 Password
IMAP Password
IMAP Password
HTTP Password
HTTP Password
SMTP Password
SMTP Password
HTTP User
HTTP User
SMTP User
SMTP User
HTTP Server URL
HTTP Server URL
HTTP Port
HTTP Port
HTTPMail Use SSL
HTTPMail Use SSL
SMTP Use SSL
SMTP Use SSL
%s\%s
%s\%s
PopPort
PopPort
PopPassword
PopPassword
SMTPAccount
SMTPAccount
SMTPServer
SMTPServer
SMTPPort
SMTPPort
SMTPLogSecure
SMTPLogSecure
SMTPPassword
SMTPPassword
%s\Accounts
%s\Accounts
LoginName
LoginName
SavePasswordText
SavePasswordText
ESMTPUsername
ESMTPUsername
ESMTPPassword
ESMTPPassword
POP3Password
POP3Password
fb.dat
fb.dat
%s@gmail.com
%s@gmail.com
%s@yahoo.com
%s@yahoo.com
Software\Microsoft\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
%s %s
%s %s
smtp
smtp
advapi32.dll
advapi32.dll
comctl32.dll
comctl32.dll
*.ini
*.ini
netmsg.dll
netmsg.dll
Error %d: %s
Error %d: %s
%s (%s)
%s (%s)
menu_%d
menu_%d
dialog_%d
dialog_%d
TranslatorURL
TranslatorURL
_lng.ini
_lng.ini
%-18s: %s
%-18s: %s
%%-%d.%ds
%%-%d.%ds
%s %s %s %s %s%s %s%sbgcolor="%s"
bgcolor="%s"
%s
%s
%s%s>
%s%s>
%s>
%s>
report.html
report.html
*.txt
*.txt
*.htm;*.html
*.htm;*.html
*.xml
*.xml
*.csv
*.csv
Software\NirSoft\MailPassView
Software\NirSoft\MailPassView
MailPassView
MailPassView
/skeepass
/skeepass
/deleteregkey
/deleteregkey
Failed to load the executable file !
Failed to load the executable file !
mail.account.account
mail.account.account
mail.server
mail.server
port
port
mail.identity
mail.identity
signon.signonfilename
signon.signonfilename
mailbox://%s@%s
mailbox://%s@%s
imap://%s@%s
imap://%s@%s
mailbox://%s
mailbox://%s
imap://%s
imap://%s
signons.txt
signons.txt
signons.sqlite
signons.sqlite
prefs.js
prefs.js
Password.NET Messenger Service
Password.NET Messenger Service
User.NET Messenger Service
User.NET Messenger Service
Passport.Net\*
Passport.Net\*
ps:password
ps:password
windowslive:name=
windowslive:name=
Exception %8.8X at address %8.8X in module %s
Exception %8.8X at address %8.8X in module %s
Stack Data: %s
Stack Data: %s
Code Data: %s
Code Data: %s
mozsqlite3.dll
mozsqlite3.dll
psapi.dll
psapi.dll
pstorec.dll
pstorec.dll
5e7e8100-9138-11d1-945a-00c04fc308ff
5e7e8100-9138-11d1-945a-00c04fc308ff
00000000-0000-0000-0000-000000000000
00000000-0000-0000-0000-000000000000
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
220D5CC1-853A-11D0-84BC-00C04FD43F8F
220D5CC1-853A-11D0-84BC-00C04FD43F8F
417E2D75-84BD-11D0-84BB-00C04FD43F8F
417E2D75-84BD-11D0-84BB-00C04FD43F8F
shell32.dll
shell32.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
shlwapi.dll
shlwapi.dll
%s%s%s%s%s
%s
%s
%s
size="%d"
size="%d"
color="#%s"
color="#%s"
width="%s"
width="%s"
%s%s%s | %s%s%s SOFTWARE\Mozilla SOFTWARE\Mozilla mozilla mozilla %s\bin %s\bin PathToExe PathToExe \sqlite3.dll \sqlite3.dll \mozsqlite3.dll \mozsqlite3.dll Software\Microsoft\Windows Mail Software\Microsoft\Windows Mail Software\Microsoft\Windows Live Mail Software\Microsoft\Windows Live Mail SMTP_Server SMTP_Server SMTP_User_Name SMTP_User_Name POP3_Password2 POP3_Password2 IMAP_Password2 IMAP_Password2 NNTP_Password2 NNTP_Password2 SMTP_Password2 SMTP_Password2 SMTP_Email_Address SMTP_Email_Address SMTP_Port SMTP_Port NNTP_Port NNTP_Port IMAP_Port IMAP_Port POP3_Port POP3_Port SMTP_Secure_Connection SMTP_Secure_Connection *.oeaccount *.oeaccount \Microsoft\Windows Mail \Microsoft\Windows Mail \Microsoft\Windows Live Mail \Microsoft\Windows Live Mail f:\Projects\VS2005\mailpv\Release\mailpv.pdb f:\Projects\VS2005\mailpv\Release\mailpv.pdb _acmdln _acmdln RPCRT4.dll RPCRT4.dll GetWindowsDirectoryA GetWindowsDirectoryA RegDeleteKeyA RegDeleteKeyA RegOpenKeyExA RegOpenKeyExA RegEnumKeyA RegEnumKeyA RegEnumKeyExA RegEnumKeyExA ShellExecuteA ShellExecuteA NirSoftPADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD NirSoftPADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD Phulli.exe Phulli.exe Microsoft.VisualBasic Microsoft.VisualBasic System.Windows.Forms System.Windows.Forms System.Drawing System.Drawing System.Management System.Management tapi32.dll tapi32.dll rtm.dll rtm.dll user32.dll user32.dll Phulli.Resources.resources Phulli.Resources.resources Phulli.Form1.resources Phulli.Form1.resources Phulli.My Phulli.My WindowsFormsApplicationBase WindowsFormsApplicationBase Microsoft.VisualBasic.ApplicationServices Microsoft.VisualBasic.ApplicationServices System.Collections.Generic System.Collections.Generic .cctor .cctor System.Threading System.Threading System.ComponentModel System.ComponentModel System.CodeDom.Compiler System.CodeDom.Compiler Microsoft.VisualBasic.Devices Microsoft.VisualBasic.Devices m_MyWebServicesObjectProvider m_MyWebServicesObjectProvider get_WebServices get_WebServices HelpKeywordAttribute HelpKeywordAttribute System.ComponentModel.Design System.ComponentModel.Design WebServices WebServices Microsoft.VisualBasic.CompilerServices Microsoft.VisualBasic.CompilerServices System.Collections System.Collections ContainsKey ContainsKey InvalidOperationException InvalidOperationException MyWebServices MyWebServices encryptedpassstring encryptedpassstring encryptedsmtpstring encryptedsmtpstring portstring portstring encryptedftphost encryptedftphost encryptedftpuser encryptedftpuser encryptedftppass encryptedftppass useftp useftp websitevisitor websitevisitor websiteblocker websiteblocker passstring passstring smtpstring smtpstring ftphost ftphost ftpuser ftpuser ftppass ftppass WM_KEYUP WM_KEYUP WM_KEYDOWN WM_KEYDOWN WM_SYSKEYDOWN WM_SYSKEYDOWN WM_SYSKEYUP WM_SYSKEYUP KeyboardHandle KeyboardHandle KeyLog KeyLog CleanedPasswordsMAIL CleanedPasswordsMAIL CleanedPasswordsWB CleanedPasswordsWB System.IO System.IO get_ExecutablePath get_ExecutablePath WindowsIdentity WindowsIdentity System.Security.Principal System.Security.Principal set_WindowState set_WindowState FormWindowState FormWindowState UnhookWindowsHookEx UnhookWindowsHookEx SetWindowsHookEx SetWindowsHookEx SetWindowsHookExA SetWindowsHookExA GetAsyncKeyState GetAsyncKeyState vKey vKey HookKeyboard HookKeyboard UnhookKeyboard UnhookKeyboard Operators Operators get_Keyboard get_Keyboard Keyboard Keyboard get_CtrlKeyDown get_CtrlKeyDown get_AltKeyDown get_AltKeyDown KeyboardCallback KeyboardCallback set_UseShellExecute set_UseShellExecute Microsoft.VisualBasic.MyServices Microsoft.VisualBasic.MyServices System.Collections.ObjectModel System.Collections.ObjectModel MsgBox MsgBox MsgBoxResult MsgBoxResult MsgBoxStyle MsgBoxStyle ForceSteamLogin ForceSteamLogin System.Net.NetworkInformation System.Net.NetworkInformation get_OperationalStatus get_OperationalStatus OperationalStatus OperationalStatus FakemsgInstall FakemsgInstall System.Net.Mail System.Net.Mail SmtpClient SmtpClient System.Globalization System.Globalization set_Port set_Port System.Net System.Net Microsoft.Win32 Microsoft.Win32 RegistryKey RegistryKey OpenSubKey OpenSubKey System.Security.Cryptography System.Security.Cryptography System.Text System.Text set_Key set_Key stealWebroswers stealWebroswers WebClient WebClient readweb readweb System.IO.Compression System.IO.Compression SendLogsFTP SendLogsFTP FtpWebRequest FtpWebRequest WebRequest WebRequest UploadFTP UploadFTP secretKey secretKey set_KeySize set_KeySize get_KeySize get_KeySize System.Net.Sockets System.Net.Sockets virtualKey virtualKey KeyboardHookDelegate KeyboardHookDelegate get_Msg get_Msg Phulli.My.Resources Phulli.My.Resources System.Resources System.Resources get_CMemoryExecute get_CMemoryExecute get_WebBrowserPassView get_WebBrowserPassView WebBrowserPassView WebBrowserPassView System.Configuration System.Configuration 8.0.0.0 8.0.0.0 My.Computer My.Computer My.Application My.Application My.User My.User My.Forms My.Forms My.WebServices My.WebServices System.Windows.Forms.Form System.Windows.Forms.Form My.MyProject.Forms My.MyProject.Forms 4System.Web.Services.Protocols.SoapHttpClientProtocol 4System.Web.Services.Protocols.SoapHttpClientProtocol 3System.Resources.Tools.StronglyTypedResourceBuilder 3System.Resources.Tools.StronglyTypedResourceBuilder 4.0.0.0 4.0.0.0 KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator 11.0.0.0 11.0.0.0 My.Settings My.Settings $1f128a07-8438-4dc0-8205-570da0ccce8d $1f128a07-8438-4dc0-8205-570da0ccce8d _CorExeMain _CorExeMain %%0.ß %%0.ß Apple Computer\Preferences\keychain.plist Apple Computer\Preferences\keychain.plist LoadPasswordsIE LoadPasswordsIE LoadPasswordsFirefox LoadPasswordsFirefox LoadPasswordsChrome LoadPasswordsChrome LoadPasswordsOpera LoadPasswordsOpera LoadPasswordsSafari LoadPasswordsSafari LoadPasswordsSeaMonkey LoadPasswordsSeaMonkey UseFirefoxProfileFolder UseFirefoxProfileFolder UseFirefoxInstallFolder UseFirefoxInstallFolder UseChromeProfileFolder UseChromeProfileFolder UseOperaPasswordFile UseOperaPasswordFile FirefoxProfileFolder FirefoxProfileFolder FirefoxInstallFolder FirefoxInstallFolder ChromeProfileFolder ChromeProfileFolder OperaPasswordFile OperaPasswordFile Aadvapi32.dll Aadvapi32.dll crypt32.dll crypt32.dll 777705555443332 777705555443332 5555443332 5555443332 5555443332 5555443332 wand.dat wand.dat @nss3.dll @nss3.dll SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe %programfiles%\Sea Monkey %programfiles%\Sea Monkey %programfiles%\Mozilla Firefox %programfiles%\Mozilla Firefox -signons.txt -signons.txt signons2.txt signons2.txt signons3.txt signons3.txt @dllhost.exe @dllhost.exe taskhost.exe taskhost.exe taskhostex.exe taskhostex.exe Microsoft\Windows\WebCache\WebCacheV01.dat Microsoft\Windows\WebCache\WebCacheV01.dat Microsoft\Windows\WebCache\WebCacheV24.dat Microsoft\Windows\WebCache\WebCacheV24.dat index.dat index.dat hXXps://VVV.google.com/accounts/servicelogin hXXps://VVV.google.com/accounts/servicelogin hXXp://VVV.facebook.com/ hXXp://VVV.facebook.com/ hXXps://login.yahoo.com/config/login hXXps://login.yahoo.com/config/login hXXp:// hXXp:// hXXps:// hXXps:// PTF:// PTF:// @history.dat @history.dat places.sqlite places.sqlite Mozilla\Firefox\Profiles Mozilla\Firefox\Profiles Mozilla\SeaMonkey\Profiles Mozilla\SeaMonkey\Profiles Mozilla\SeaMonkey Mozilla\SeaMonkey Mozilla\Firefox Mozilla\Firefox profiles.ini profiles.ini Profile%d Profile%d tntdll.dll tntdll.dll sWeb Data sWeb Data Login Data Login Data Google\Chrome\User Data Google\Chrome\User Data Google\Chrome SxS\User Data Google\Chrome SxS\User Data Opera\Opera\wand.dat Opera\Opera\wand.dat Opera\Opera7\profile\wand.dat Opera\Opera7\profile\wand.dat Opera Opera @"%s" @"%s" Ashell32.dll Ashell32.dll \nss3.dll \nss3.dll .save .save vaultcli.dll vaultcli.dll abe2869f-9b47-4cd9-a358-c22904dba7f7 abe2869f-9b47-4cd9-a358-c22904dba7f7 Copy &Password Copy &Password &HTML Report - All Items &HTML Report - All Items HTML R&eport - Selected Items HTML R&eport - Selected Items HTML Report - All Items HTML Report - All Items HTML Report - Selected Items HTML Report - Selected Items Load Passwords From... Load Passwords From... Google Chrome Google Chrome Mozilla Firefox Mozilla Firefox SeaMonkey SeaMonkey Firefox Options Firefox Options Master password: Master password: Firefox Profile: Firefox Profile: Firefox Installation: Firefox Installation: Chrome Options Chrome Options Opera Options Opera Options wand.dat file: wand.dat file: %d Passwords %d Passwords , %d Selected , %d Selected Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat) Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat) Loading... %d Loading... %d KeePass csv file KeePass csv file Opera Password File Opera Password File Firefox 1.x Firefox 1.x Firefox 2.x Firefox 2.x Firefox 3.0 Firefox 3.0 Firefox Firefox Chrome Chrome Web Browser Web Browser Password Password Password Strength Password Strength Password Field Password Field WebBrowserPassView.exe WebBrowserPassView.exe VVV.google.com/Please log in to your Gmail account VVV.google.com/Please log in to your Gmail account VVV.google.com:443/Please log in to your Gmail account VVV.google.com:443/Please log in to your Gmail account VVV.google.com/Please log in to your Google Account VVV.google.com/Please log in to your Google Account VVV.google.com:443/Please log in to your Google Account VVV.google.com:443/Please log in to your Google Account VVV.google.com VVV.google.com dWindowsLive:name=* dWindowsLive:name=* 82BD0E67-9FEA-4748-8672-D5EFE5B779B0 82BD0E67-9FEA-4748-8672-D5EFE5B779B0 Copy Password Copy Password %d items %d items Select Eudora.ini filename/Select the location of Thunderbird installation Select Eudora.ini filename/Select the location of Thunderbird installation Eudora.ini file Eudora.ini file SMTP SMTP Windows Mail Windows Mail Windows Live Mail Windows Live Mail Server Port Server Port SMTP Server Port SMTP Server Port Mail Password Recovery Mail Password Recovery mailpv.exe mailpv.exe noftp noftp Disablecmd Disablecmd \Windows Update.exe \Windows Update.exe \WindowsUpdate.exe \WindowsUpdate.exe SysInfo.txt SysInfo.txt \pid.txt \pid.txt \pidloc.txt \pidloc.txt HawkEyeKeylogger HawkEyeKeylogger \Mozilla\Firefox\Profiles \Mozilla\Firefox\Profiles 127.0.0.1 127.0.0.1 \SteamAppData.vdf \SteamAppData.vdf \ClientRegistry.blob \ClientRegistry.blob Dear HawkEye Customers! Dear HawkEye Customers! HawkEye Logger Details: HawkEye Logger Details: Keylogger Enabled: Keylogger Enabled: Operating System: Operating System: HawkEye_Keylogger_Execution_Confirmed_ HawkEye_Keylogger_Execution_Confirmed_ HawkEye Keylogger | Execution Confirmed | HawkEye Keylogger | Execution Confirmed | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced autorun.inf autorun.inf open=Sys.exe open=Sys.exe Sys.exe Sys.exe Software\Microsoft\Windows\CurrentVersion\Run Software\Microsoft\Windows\CurrentVersion\Run Windows Update Windows Update C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe \bitcoin\wallet.dat \bitcoin\wallet.dat _wallet.dat _wallet.dat wallet.dat wallet.dat Microsoft.NET\Framework\v2.0.50727\vbc.exe Microsoft.NET\Framework\v2.0.50727\vbc.exe holdermail.txt" holdermail.txt" holdermail.txt holdermail.txt Operating System Intel Recovery Operating System Intel Recovery Operating System Platform: Operating System Platform: Operating System Version: Operating System Version: WEB Browser Password Stealer WEB Browser Password Stealer Mail Messenger Password Stealer Mail Messenger Password Stealer JDownloader Password Stealer JDownloader Password Stealer HawkEye_Keylogger_Stealer_Records_ HawkEye_Keylogger_Stealer_Records_ HawkEye Keylogger | Stealer Records | HawkEye Keylogger | Stealer Records | holderwb.txt" holderwb.txt" holderwb.txt holderwb.txt C:\Users\ C:\Users\ _Pin0.jpeg _Pin0.jpeg _Pin1.jpeg _Pin1.jpeg _Pin2.jpeg _Pin2.jpeg _Pin3.jpeg _Pin3.jpeg _Pin4.jpeg _Pin4.jpeg HawkEye Keylogger | RuneScape Stealer | HawkEye Keylogger | RuneScape Stealer | HawkEye Keylogger | BitCoin Stealer | HawkEye Keylogger | BitCoin Stealer | Steals the Wallet.DAT file that holds the users bitcoin currency. Steals the Wallet.DAT file that holds the users bitcoin currency. \.minecraft\lastlogin \.minecraft\lastlogin HawkEye Keylogger | MineCraft Stealer | HawkEye Keylogger | MineCraft Stealer | As you can see, this email has the attached file, containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor. As you can see, this email has the attached file, containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor. HawkEye Keylogger | Keylog Records | HawkEye Keylogger | Keylog Records | Keylog Records Keylog Records .jpeg .jpeg HawkEye_Keylogger_Keylog_Records_ HawkEye_Keylogger_Keylog_Records_ hXXp://whatismyipaddress.com/ hXXp://whatismyipaddress.com/ Phulli.Resources Phulli.Resources :\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe :\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe schtasks.exe_2024: .text .text `.data `.data .rsrc .rsrc USER32.dll USER32.dll MPR.dll MPR.dll ole32.dll ole32.dll Secur32.dll Secur32.dll WS2_32.dll WS2_32.dll NETAPI32.dll NETAPI32.dll SHLWAPI.dll SHLWAPI.dll msvcrt.dll msvcrt.dll KERNEL32.dll KERNEL32.dll NTDLL.DLL NTDLL.DLL xpsp1res.dll xpsp1res.dll ScTasks.pdb ScTasks.pdb %d:%d %d:%d kernel32.dll kernel32.dll \/[]:| =;,?$#()!@^"`{}*% \/[]:| =;,?$#()!@^"`{}*% \\%s\%s \\%s\%s 5.1.2600.5512 (xpsp.080413-2108) 5.1.2600.5512 (xpsp.080413-2108) SchTasks.exe SchTasks.exe ScTasks.exe ScTasks.exe Windows Windows Operating System Operating System 5.1.2600.5512 5.1.2600.5512 Type the password for %s:1Passing the user credential on local connection. Type the password for %s:1Passing the user credential on local connection. 7The Target system must be running Windows XP or above. 7The Target system must be running Windows XP or above. PInvalid Syntax. '%s' value is not allowed for '%s' option. PInvalid Syntax. '%s' value is not allowed for '%s' option. Type "%s" for usage. Type "%s" for usage. KInvalid Syntax. Specify valid numeric value for '%s'. KInvalid Syntax. Specify valid numeric value for '%s'. SInvalid Syntax. Specifiy valid floating point value for '%s'. SInvalid Syntax. Specifiy valid floating point value for '%s'. HInvalid Syntax. Mandatory option '/%s' is missing. HInvalid Syntax. Mandatory option '/%s' is missing. XInvalid Syntax. '%s' option is not allowed more than '%d' time(s). XInvalid Syntax. '%s' option is not allowed more than '%d' time(s). 5Invalid Argument/Option - '%s'. 5Invalid Argument/Option - '%s'. [Invalid Syntax. Default option is not allowed more than '%d' time(s). [Invalid Syntax. Default option is not allowed more than '%d' time(s). >Invalid Syntax. Value expected for '%s'. >Invalid Syntax. Value expected for '%s'. TInvalid Syntax. '%s' value is not allowed as default argument. TInvalid Syntax. '%s' value is not allowed as default argument. Type "SCHTASKS /CREATE /?" for usage.jERROR: Invalid starttime value (Time should be in hh:mm:ss format). Type "SCHTASKS /CREATE /?" for usage.jERROR: Invalid starttime value (Time should be in hh:mm:ss format). BERROR: The specified task name "%s" does not exist in the system. BERROR: The specified task name "%s" does not exist in the system. ERROR: Failed to open "StdIn.txt" file. ERROR: Failed to open "StdIn.txt" file. ERROR: Failed to read "StdIn.txt" file. ERROR: Failed to read "StdIn.txt" file. ERROR: Password cannot be NULL. ERROR: Password cannot be NULL. .ERROR: Unable to run the scheduled task "%1". .ERROR: Unable to run the scheduled task "%1". Type "SCHTASKS /CREATE /?" for usage.KERROR: The scheduled task name cannot be null or more than 239 characters. Type "SCHTASKS /CREATE /?" for usage.KERROR: The scheduled task name cannot be null or more than 239 characters. vERROR: Invalid syntax Cannot specify password without specifying the user name. vERROR: Invalid syntax Cannot specify password without specifying the user name. vERROR: Invalid syntax. Cannot specify password without specifying the user name. vERROR: Invalid syntax. Cannot specify password without specifying the user name. wERROR: Invalid syntax. Cannot specify password without specifying the user name. wERROR: Invalid syntax. Cannot specify password without specifying the user name. tERROR: Invalid syntax. Cannot specify password without specifying the user name. tERROR: Invalid syntax. Cannot specify password without specifying the user name. jWARNING: When the run as password is empty, the scheduled task may not run because of the security policy jWARNING: When the run as password is empty, the scheduled task may not run because of the security policy Task not scheduled3ERROR: Password cannot be more than 64 characters. Task not scheduled3ERROR: Password cannot be more than 64 characters. BWARNING: Password will be ignored for "NT AUTHORITY\SYSTEM" user. BWARNING: Password will be ignored for "NT AUTHORITY\SYSTEM" user. 10/20/2001 10/20/2001 15/09/2001 15/09/2001 2001/12/30 2001/12/30 Scheduled#Please enter the run as user name: )Please enter the run as password for %1: Please enter the run as password for "%1": CThe task will be created under current logged-on user name ("%1"). Scheduled#Please enter the run as user name: )Please enter the run as password for %1: Please enter the run as password for "%1": CThe task will be created under current logged-on user name ("%1"). HOURLY HOURLY Hourly Hourly SCHTASKS /Create [/S system [/U username [/P password]]] SCHTASKS /Create [/S system [/U username [/P password]]] G [/RU username [/RP password]] /SC schedule [/MO modifier] [/D day] G [/RU username [/RP password]] /SC schedule [/MO modifier] [/D day] F which the command should execute. F which the command should execute. H /P password Specifies the password for the given H /P password Specifies the password for the given H /RP password Specifies the password for the user. H /RP password Specifies the password for the user. I To prompt for the password, the value I To prompt for the password, the value D Password will not effect for the D Password will not effect for the I Valid schedule types: MINUTE, HOURLY, I Valid schedule types: MINUTE, HOURLY, J Example: C:\windows\system32\calc.exe J Example: C:\windows\system32\calc.exe HOURLY: 1 - 23 hours. HOURLY: 1 - 23 hours. B SCHTASKS /Create /S system /U user /P password /RU runasuser B SCHTASKS /Create /S system /U user /P password /RU runasuser B /RP runaspassword /SC HOURLY /TN rtest1 /TR notepad B /RP runaspassword /SC HOURLY /TN rtest1 /TR notepad E SCHTASKS /Create /S system /U domain\user /P password /SC MINUTE E SCHTASKS /Create /S system /U domain\user /P password /SC MINUTE 9 /MO 5 /TN rtest2 /TR calc.exe /ST 12:00:00 9 /MO 5 /TN rtest2 /TR calc.exe /ST 12:00:00 . /TR c:\windows\system32\freecell . /TR c:\windows\system32\freecell A SCHTASKS /Create /S system /U user /P password /RU runasuser A SCHTASKS /Create /S system /U user /P password /RU runasuser D /RP runaspassword /SC WEEKLY /TN test1 /TR notepad.exe D /RP runaspassword /SC WEEKLY /TN test1 /TR notepad.exe B /MO 5 /TN test2 /TR c:\windows\system32\notepad.exe B /MO 5 /TN test2 /TR c:\windows\system32\notepad.exe
G end scheduled tasks on a local or remote system. Replaces AT.exe. G end scheduled tasks on a local or remote system. Replaces AT.exe. SCHTASKS /Query [/S system [/U username [/P password]]] [/FO format] SCHTASKS /Query [/S system [/U username [/P password]]] [/FO format] @ which the command should execute. @ which the command should execute. B /P password Specifies the password for the given B /P password Specifies the password for the given 2 SCHTASKS /Query /S system /U user /P password 2 SCHTASKS /Query /S system /U user /P password > SCHTASKS /Query /FO LIST /V /S system /U user /P password > SCHTASKS /Query /FO LIST /V /S system /U user /P password SCHTASKS /Delete [/S system [/U username [/P password]]] /TN taskname SCHTASKS /Delete [/S system [/U username [/P password]]] /TN taskname ? which the command should execute. ? which the command should execute. A /P password Specifies the password for the given A /P password Specifies the password for the given G SCHTASKS /Delete /S system /U user /P password /TN "Start Restore" G SCHTASKS /Delete /S system /U user /P password /TN "Start Restore" I SCHTASKS /Delete /S system /U user /P password /TN "Start Backup" /F I SCHTASKS /Delete /S system /U user /P password /TN "Start Backup" /F SCHTASKS /Change [/S system [/U username [/P password]]] {[/RU runasuser] SCHTASKS /Change [/S system [/U username [/P password]]] {[/RU runasuser] 5 [/RP runaspassword] [/TR taskrun]} /TN taskname 5 [/RP runaspassword] [/TR taskrun]} /TN taskname B Changes the program to run, or user account and password used B Changes the program to run, or user account and password used A which the command should execute. A which the command should execute. C /P password Specifies the password for the given C /P password Specifies the password for the given H /RP password Specifies a new password for the existing H /RP password Specifies a new password for the existing E user context or the password for a new E user context or the password for a new I user account. Password will not effect for I user account. Password will not effect for ; SCHTASKS /Change /RP password /TN "Backup and Restore" ; SCHTASKS /Change /RP password /TN "Backup and Restore" 9 SCHTASKS /Change /TR restore.exe /TN "Start Restore" 9 SCHTASKS /Change /TR restore.exe /TN "Start Restore" @ SCHTASKS /Change /S system /U user /P password /RU newuser @ SCHTASKS /Change /S system /U user /P password /RU newuser SCHTASKS /Run [/S system [/U username [/P password]]] /TN taskname SCHTASKS /Run [/S system [/U username [/P password]]] /TN taskname D which the command should execute. D which the command should execute. F /P password Specifies the password for the given F /P password Specifies the password for the given I SCHTASKS /Run /S system /U user /P password /TN "Backup and Restore" I SCHTASKS /Run /S system /U user /P password /TN "Backup and Restore" SCHTASKS /End [/S system [/U username [/P password]]] /TN taskname SCHTASKS /End [/S system [/U username [/P password]]] /TN taskname E which the command should execute. E which the command should execute. G /P password Specifies the password for the given G /P password Specifies the password for the given I SCHTASKS /End /S system /U user /P password /TN "Backup and Restore" I SCHTASKS /End /S system /U user /P password /TN "Backup and Restore" |
---|