Trojan.GenericKD.3472530_5115d32a85 – Adaware

Trojan.Win32.Autoit.abcfq (Kaspersky), Trojan.GenericKD.3472530 (B) (Emsisoft), Trojan.GenericKD.3472530 (AdAware), HackTool.Win32.PassView.FD, Worm.Win32.AutoIt.FD, WormAutoItGen.YR, HackToolPassView.YR, GenericAutorunWorm.YR, TrojanDropperVtimrun.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Worm, HackTool, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 5115d32a85bd187cf7c28cc93fd5ff47

SHA1: f85f9459aad14f3bcf92883d6cb875abca9ce7b7

SHA256: 1b5df068b32db88db332400cbdeea1ca09c54400ac849e84ba28ef1c2e2a7236

SSDeep: 24576:oKjTvnXwYpG0cOyLd9DBowXizbT4dSGNB7dP7/VMffTvYuwBwY:oKjLngcEOyLd9DehzN2VK7vj

Size: 1395200 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2014-10-31 05:28:47

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1620
dwwin.exe:560
schtasks.exe:2024
egei.exe:2012
vbc.exe:2596
vbc.exe:2284

The Trojan injects its code into the following process(es):

RegSvcs.exe:248

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1620 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\egei.exe (16808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\oinwiqb.hts (1278918 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\qbpnba.twf (9269 bytes)

The process RegSvcs.exe:248 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\pid.txt (3 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (0 bytes)

The process egei.exe:2012 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\RegSvcs.exe (32 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7c8f_appcompat.txt (0 bytes)

The process vbc.exe:2596 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (2 bytes)

Registry activity

The process %original file name%.exe:1620 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 27 24 B7 24 21 83 B3 25 95 E6 10 B2 DF A1 9A"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

The process dwwin.exe:560 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 AD 09 76 A0 9B E4 78 FE D5 E2 5F B5 00 D1 C8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process RegSvcs.exe:248 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C]
"Blob" = "04 00 00 00 01 00 00 00 10 00 00 00 6F 7E 74 A3"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\RegSvcs\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 42 55 A8 FB 6E CC 66 79 83 A2 37 EF 31 49 76"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates]
"E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\RegSvcs\DEBUG]
"Trace Level"

The process schtasks.exe:2024 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 EF 36 29 53 2D F3 90 D3 92 6B 70 05 66 B2 E5"

The process egei.exe:2012 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "06 CA F1 84 E9 6F EC C1 22 02 93 67 AB 9A 43 F7"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]
"DWFileTreeRoot"

The process vbc.exe:2596 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 BE 62 BD B5 46 45 1C 2A D5 3D 55 4E 13 E9 77"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

The process vbc.exe:2284 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA 5B EB B7 2B 73 B7 99 C7 39 EE 50 75 B1 E6 38"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

Dropped PE files

MD5	File path
d78037c554f59e29727541f1f39100a9	c:\Documents and Settings\"%CurrentUserName%"\RegSvcs.exe
79cd14a75d06ba52712e45bea1070fba	c:\Documents and Settings\"%CurrentUserName%"\vftqdto\egei.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1620
dwwin.exe:560
schtasks.exe:2024
egei.exe:2012
vbc.exe:2596
vbc.exe:2284
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\egei.exe (16808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\oinwiqb.hts (1278918 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\qbpnba.twf (9269 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\pid.txt (3 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\RegSvcs.exe (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (2 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft Corporation
Product Name: Internet Explorer
Product Version: 11.00.9600.16384
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WEXTRACT.EXE .MUI
Internal Name: Wextract
File Version: 11.00.9600.16384 (winblue_rtm.130821-1623)
File Description: Win32 Cabinet Self-Extractor
Comments:
Language: English (United States)

Company Name: Microsoft CorporationProduct Name: Internet ExplorerProduct Version: 11.00.9600.16384Legal Copyright: (c) Microsoft Corporation. All rights reserved.Legal Trademarks: Original Filename: WEXTRACT.EXE .MUIInternal Name: Wextract File Version: 11.00.9600.16384 (winblue_rtm.130821-1623)File Description: Win32 Cabinet Self-Extractor Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	26980	27136	4.40175	22c7cbc7745692002dbdf65a4bc48e63
.data	32768	6796	1024	2.20139	317f8a934ee443eee01c2a315bde9ca1
.idata	40960	4220	4608	3.49841	a5d9b0c8d0d0e35bcbb5219dda1a3075
.rsrc	49152	1358767	1358848	5.33925	1354df4c47bb5320c49c58763157ec3b
.reloc	1409024	2240	2560	4.41763	7772c8e6ff71410862c324630aac5515

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://whatismyipaddress.com/	184.30.217.129
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	212.30.134.183
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt	212.30.134.183
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt	212.30.134.183
smtp.live.com	65.55.176.126

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Host: whatismyipaddress.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 59

Date: Sat, 24 Sep 2016 05:22:35 GMT

Connection: keep-alive

Access Denied (AK1). Contact support@whatismyipaddress.comHTTP/1.1 200 OK..Content-Type: text/html..Content-Length: 59..Date: Sat, 24 Sep 2016 05:22:35 GMT..Connection: keep-alive..Access Denied (AK1). Contact support@whatismyipaddress.com..

GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: text/plain

Last-Modified: Thu, 14 Apr 2016 22:20:39 GMT

Accept-Ranges: bytes

ETag: "8095d7df9b96d11:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 18

Date: Sat, 24 Sep 2016 05:22:56 GMT

Connection: keep-alive

X-CCC: RU

X-CID: 2

1401D1969BE01E11A6....

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Fri, 15 Apr 2016 17:23:18 GMT

Accept-Ranges: bytes

ETag: "0c730803b97d11:0"

Server: Microsoft-IIS/8.5

X-Powered-By: ASP.NET

X-Powered-By: ARR/2.5

X-Powered-By: ASP.NET

Content-Length: 49640

Date: Sat, 24 Sep 2016 05:22:56 GMT

Connection: keep-alive

X-CCC: RU

X-CID: 2

MSCF............,...................I..................HaR .authroot.stl.%.u3S8..CK...<T.......4v.e.3h.......l...kICY*7-viS.ZH{i.."QY...H.T$!..L..g......k^.w.s..y?..}....4.......d.4...0....)...0..@.......D. 0Y......#p.&;..,..L....._.....ppSf^.....\x....PSSC........4..Apw..:..*....."(..6..............".3..6#.*9..yx>.w..aX....U..:.*G?..3......wY.Z=G..^...J.......Qt.U.xiD2..o....1f.a.9...&...T..\.X<u.WU/.]=./8. .sK.......(.<.A$H.............5...y......"...\...IP..A(y....]..fc`.r)Y.$..<.V.............'....f..X.Y.<......R...zq.5nfO,..NE.....*/ud.7.=.".3..........%.. ....F.......,.e.3.e..... ..T...=x.BD.........R.0..3D.....W......v<\{...Oj>.$YT)LQ..........{.......s=.vs..........dY].<.v..<..w[.{.Z..qV.............= ......5.5........tm... ...SZ.....e-1e<.rX..K3>..~]{b#..&......b.e......;...?......7...!W......e\..a>!{....t.....r...TV...h....4...........Bx...aBp...............F....kx. V.q....g.?.q\.z.?h>V..ORz.....t...%.{w...4..(.......m.|..X\,./.4w.6?M$.q;q.............x?...Auip.... 8..".4...a}E.98T..*...N...7]p<G.&I.........7....@.Q.#.%.:..TE7....d..b. .E.V...-.=1.........j.)t...Z &.e.o..m..L.s.2.\...j4.d..............4.....9...3...03...-2c)L.."..y.7.|... !O.1.....i:....J.:.P..5...6.W...XP..J..^.....u.v....|..U..-..Q..CF.r ..........`.V~.C...=.=.m...6N.,..OV.Z...d.K.-....".D.8.V,}X.P.D..X"8.....;DD."../x.(M..O........1V6R./.3|I...9,........eh..........k...W.....t.*...K..a.....x.0#.t..F.!...7Vk ........7....X......2.t!...AB..b...1.&..S.`G...1@.f.I."...vl.g.}Rs....y.z}....}.

<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Type: application/x-x509-ca-cert

Last-Modified: Thu, 23 Jul 2015 23:16:35 GMT

Accept-Ranges: bytes

ETag: "80b4b9e9dc5d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 889

Date: Sat, 24 Sep 2016 05:22:56 GMT

Connection: keep-alive

X-CCC: RU

X-CID: 2

0..u0..]..............KZ..0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...980901120000Z..280128120000Z0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0.."0...*.H.............0................O.~....%k.H..*.......c..gf.....H ......).e...-....Lp..=.0...O....P...P......R..}.m.50.^Cs.A..j...:V98o.<.i[*M..T.l....<......<.x...tn.Da...F.u......ml.x......8..$.OsT...:...4.....w.... ...Sn..{7t.pG."Qc.y...A&... .F.H.d*..4.,*.l.CJ....|.!h...R...........B0@0...U...........0...U.......0....0...U......`{f.E....P/}..4....K0...*.H..............s.|Ov.......4.(2.|.l., ...S.k^..H......=aM.F..>...cU.....9.C.8../.&;..PV....8...pQ......_.....A..]ud...U0......,.cF.....i...Hd......).........i,i$x....qb......]...G.n*.V1..g.. .l.]F......Q.p..V=a.j.\...=.A...cR.SS. ......_..A..........o. .......fU..H.)&i.HTTP/1.1 200 OK..Content-Type: application/x-x509-ca-c..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1620:

.text

`.data

.idata

@.rsrc

@.reloc

Invalid parameter passed to C runtime function.

advapi32.dll

setupx.dll

setupapi.dll

advpack.dll

wininit.ini

Software\Microsoft\Windows\CurrentVersion\App Paths

ADMQCMD

USRQCMD

FINISHMSG

IXPd.TMP

msdownld.tmp

TMP4351$.TMP

wextract.pdb

PSSSSSSh

SSSh

PSSShp

PSShp

t.ShB

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"

System\CurrentControlSet\Control\Session Manager\FileRenameOperations

wextract_cleanup%d

Command.com /c %s

rundll32.exe %s,InstallHinfSection %s 128 %s

Software\Microsoft\Windows\CurrentVersion\RunOnce

%s /D:%s

PendingFileRenameOperations

SHELL32.DLL

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\

RegCreateKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegCloseKey

ADVAPI32.dll

GetWindowsDirectoryA

KERNEL32.dll

GDI32.dll

ExitWindowsEx

MsgWaitForMultipleObjects

USER32.dll

_amsg_exit

_acmdln

msvcrt.dll

COMCTL32.dll

Cabinet.dll

VERSION.dll

egei.exe

oinwiqb.hts

qbpnba.twf

#1.gwD

fuh.qJD

.bw.!

.!QU`%d

.lHD2

el.dI

w8.zA

EK.FI

%D;8z

Xq!%F

%d|91

(K%ds0

gHd.Ci

`Fy5.kj

.si{u

2%%D

w$E.Fk

\U.cf^

K/Ã•*

:-t} l

fcM;k%D:

K.iv\E

iDuD.Yo

D?Ãš

.yyVG

g?.cA;X

Qt.yLP/`

-@L

OUdP

y.JO8

.CU>f#J

=[/.JBQ8

%Fj,9

Qr.LF

\8.bHls

.UV:g

]Wtn%DIu

VJ=%S

%cK?=

^p?%U

@R%

;.bc{?

yV.nu

.DfvZ

VJj%0X

.uTS{'

Keyi\

&AU^.UF

.Oc~z

jm.zC@

%FYr1

Ã,o

.vhd}

.jIQ@

sA-D%F

}

S.PTS

G*G.aE

dZ.yY

B%CoV

U'.Ry

K(%X_

>[keY

f6.mi

DQcMD

:u%f'Z

egei.exe oinwiqb.hts

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

9 9$9

Kernel32.dll

Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.

CFailed to get disk space information from: %s.

System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?

8Unable to retrieve operating system version information.!Memory allocation request failed.

Filetable full.ÃŠn not change to destination folder.

Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.

(Error creating process . Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.

Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install

Could not create folder '%s'

To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.

Error retrieving Windows folder

$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .

System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.

/C: -- Override Install Command defined by author.

eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?

Could not find the file: %s.

:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.

11.00.9600.16384 (winblue_rtm.130821-1623)

WEXTRACT.EXE .MUI

11.00.9600.16384

egei.exe_2012:

.text

`.rdata

@.data

.rsrc

@.reloc

j.Yf;

r%f;M

j.Xf;

j.Zf;

PSSSSSSh

Gt.Ht$

kernel32.dll

?#%X.y

GetProcessWindowStation

operator

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is compiled without UTF support

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with Unicode property support

\N is not supported in a class

RegDeleteKeyExW

advapi32.dll

Error text not found (please report)

WSOCK32.dll

VERSION.dll

WINMM.dll

COMCTL32.dll

MPR.dll

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

WININET.dll

PSAPI.DLL

IPHLPAPI.DLL

USERENV.dll

UxTheme.dll

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

KERNEL32.dll

OpenWindowStationW

SetProcessWindowStation

CloseWindowStation

MapVirtualKeyW

EnumChildWindows

EnumWindows

VkKeyScanW

GetKeyState

GetKeyboardState

SetKeyboardState

GetAsyncKeyState

keybd_event

EnumThreadWindows

ExitWindowsEx

UnregisterHotKey

RegisterHotKey

GetKeyboardLayoutNameW

USER32.dll

SetViewportOrgEx

GDI32.dll

COMDLG32.dll

RegOpenKeyExW

RegCloseKey

RegCreateKeyExW

RegEnumKeyExW

RegDeleteKeyW

ADVAPI32.dll

ShellExecuteW

SHFileOperationW

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

GetCPInfo

zcÃ

UQ.WP

mI.Us

\.gGL

.FFF

,.bh9

].Whjj*

? ?$?(?,?0?4?8?

2 2$2(2,2024282

1,20242[2

0\0c0k0p0t0x0

1!1%1)1-1

2#3(323=3

6$7(7,70747

5 5-5\9~9

8%9.959@9

2 2 222\2

> >$>(>,>

? ?$?(?,?0?

/AutoIt3ExecuteScript

/AutoIt3ExecuteLine

CMDLINE

CMDLINERAW

FTPSETPROXY

GUICTRLRECVMSG

GUICTRLSENDMSG

GUIGETMSG

GUIREGISTERMSG

HOTKEYSET

HTTPSETPROXY

HTTPSETUSERAGENT

ISKEYWORD

MAPKEYS

MSGBOX

REGENUMKEY

SHELLEXECUTE

SHELLEXECUTEWAIT

TCPACCEPT

TCPCLOSESOCKET

TCPCONNECT

TCPLISTEN

TCPNAMETOIP

TCPRECV

TCPSEND

TCPSHUTDOWN

TCPSTARTUP

TRAYGETMSG

UDPBIND

UDPCLOSESOCKET

UDPOPEN

UDPRECV

UDPSEND

UDPSHUTDOWN

UDPSTARTUP

SendKeyDownDelay

SendKeyDelay

TCPTimeout

mscoree.dll

combase.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

USER32.DLL

789:;?

APPSKEY

WINDOWSDIR

AUTOITEXE

HOTKEYPRESSED

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

KEYS

Line %d:

\\?\UNC\

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

"%s" (%d) : ==> %s:

\??\%s

GUI_RUNDEFMSG

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AUTOIT.ERROR

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

3, 3, 14, 0

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\egei.exe

hXXp://VVV.autoitscript.com/autoit3/

AutoIt3.exe

AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.

Missing operator in expression."Unbalanced brackets in expression.

>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.

Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.

3This keyword cannot be used after a "Then" keyword.

0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.

Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.#Variable subscript badly formatted.*Subscript used on non-accessible variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.

HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

RegSvcs.exe_248:

.text

`.rsrc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

v2.0.50727

CMemoryExecute.dll

CMemoryExecute

PAGE_EXECUTE_READWRITE

.ctor

System.Reflection

System.Runtime.InteropServices

System.Security.Permissions

System.Diagnostics

System.Runtime.CompilerServices

DllImportAttribute

kernel32.dll

ntdll.dll

System.Security

$8fcd4931-91a2-4e18-849b-70de34ab75df

1.0.0.0

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb

mscoree.dll

`.rdata

@.data

.rsrc

D$.SPf

2 34 567

com.apple.Safari

com.apple.WebKit2WebProcess

SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins

"Account","Login Name","Password","Web Site","Comments"

3.7.5

SQLite format 3

CREATE TABLE sqlite_master(

sql text

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins

PK11_GetInternalKeySlot

PK11_CheckUserPassword

large file support is disabled

unknown operation

SQL logic error or missing database

foreign_keys

sqlite_compileoption_get

sqlite_compileoption_used

sqlite_source_id

sqlite_version

sqlite_attach

sqlite_detach

sqlite_stat1

sqlite_rename_parent

sqlite_rename_trigger

sqlite_rename_table

%Y-%m-%d %H:%M:%S

%Y-%m-%d

%H:%M:%S

SQLITE_

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

%s-shm

%s\etilqs_

OsError 0x%x (%u)

Recovered %d frames from WAL file %s

%s-mjX

foreign key constraint failed

unable to use function %s in the requested context

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

statement aborts at %d: [%s] %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

oversized integer: %s%s

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

%s OR name=%Q

type='trigger' AND (%s)

there is already another table or index with this name: %s

sqlite_

table %s may not be altered

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE tbl=%Q

SELECT tbl, idx, stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s %T cannot reference objects in database %s

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

no such collation sequence: %s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

view %s is circularly defined

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

a JOIN clause is required before %s

unable to identify the object to be reindexed

table %s may not be modified

cannot modify %s because it is a view

foreign key mismatch

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

PRIMARY KEY must be unique

automatic extension loading failed: %s

foreign_key_list

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

%s.%s

%s:%d

no such index: %s

sqlite_subquery_%p_

no such table: %s

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

at most %d tables in a join

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unable to close due to unfinished backup operation

unknown database: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

sqlite3_open

sqlite3_prepare

sqlite3_step

sqlite3_column_text

sqlite3_column_int

sqlite3_column_int64

sqlite3_finalize

sqlite3_close

sqlite3_exec

f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb

msvcrt.dll

_wcmdln

COMCTL32.dll

VERSION.dll

FindCloseUrlCache

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

WININET.dll

GetWindowsDirectoryW

KERNEL32.dll

EnumChildWindows

USER32.dll

GDI32.dll

comdlg32.dll

RegCloseKey

RegOpenKeyExW

RegEnumKeyExW

ADVAPI32.dll

ShellExecuteW

SHELL32.dll

ole32.dll

5JEw%Xg

hXXp://VVV.usertrust.com1

3hXXp://crl.usertrust.com/AddTrustExternalCARoot.crl05

hXXp://ocsp.usertrust.com0

1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl05

1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl0t

1hXXp://crt.usertrust.com/UTNAddTrustObject_CA.crt0%

hXXps://secure.comodo.net/CPS0A

0hXXp://crl.comodoca.com/COMODOCodeSigningCA2.crl0r

0hXXp://crt.comodoca.com/COMODOCodeSigningCA2.crt0$

hXXp://ocsp.comodoca.com0

support@nirsoft.net0

t{SSh

v%SSW

Mail PassView

Mozilla\Profiles

Software\Mozilla\Mozilla Thunderbird

%s\Main

sqlite3.dll

nss3.dll

%programfiles%\Mozilla Thunderbird

AddExportHeaderLine

%s %s %s

HTTPMail User Name

SMTP USer Name

HTTPMail Server

SMTP Server

POP3 Password2

IMAP Password2

HTTPMail Password2

SMTP Password2

POP3 Port

IMAP Port

HTTPMail Port

SMTP Port

HTTPMail Secure Connection

SMTP Secure Connection

SMTP Display Name

SMTP Email Address

POP3 Password

IMAP Password

HTTP Password

SMTP Password

HTTP User

SMTP User

HTTP Server URL

HTTP Port

HTTPMail Use SSL

SMTP Use SSL

%s\%s

PopPort

PopPassword

SMTPAccount

SMTPServer

SMTPPort

SMTPLogSecure

SMTPPassword

%s\Accounts

LoginName

SavePasswordText

ESMTPUsername

ESMTPPassword

POP3Password

fb.dat

%s@gmail.com

%s@yahoo.com

Software\Microsoft\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

%s %s

smtp

advapi32.dll

comctl32.dll

*.ini

netmsg.dll

Error %d: %s

%s (%s)

menu_%d

dialog_%d

TranslatorURL

_lng.ini

%-18s: %s

%%-%d.%ds

%s%s

bgcolor="%s"

%s%s>

%s>

report.html

*.txt

*.htm;*.html

*.xml

*.csv

Software\NirSoft\MailPassView

MailPassView

/skeepass

/deleteregkey

Failed to load the executable file !

mail.account.account

mail.server

port

mail.identity

signon.signonfilename

mailbox://%s@%s

imap://%s@%s

mailbox://%s

imap://%s

signons.txt

signons.sqlite

prefs.js

Password.NET Messenger Service

User.NET Messenger Service

Passport.Net\*

ps:password

windowslive:name=

Exception %8.8X at address %8.8X in module %s

Stack Data: %s

Code Data: %s

mozsqlite3.dll

psapi.dll

pstorec.dll

5e7e8100-9138-11d1-945a-00c04fc308ff

00000000-0000-0000-0000-000000000000

220D5CD0-853A-11D0-84BC-00C04FD43F8F

220D5CD1-853A-11D0-84BC-00C04FD43F8F

220D5CC1-853A-11D0-84BC-00C04FD43F8F

417E2D75-84BD-11D0-84BB-00C04FD43F8F

shell32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

shlwapi.dll

%s%s

%s

size="%d"

color="#%s"

width="%s"

%s%s%s

SOFTWARE\Mozilla

mozilla

%s\bin

PathToExe

\sqlite3.dll

\mozsqlite3.dll

Software\Microsoft\Windows Mail

Software\Microsoft\Windows Live Mail

SMTP_Server

SMTP_User_Name

POP3_Password2

IMAP_Password2

NNTP_Password2

SMTP_Password2

SMTP_Email_Address

SMTP_Port

NNTP_Port

IMAP_Port

POP3_Port

SMTP_Secure_Connection

*.oeaccount

\Microsoft\Windows Mail

\Microsoft\Windows Live Mail

f:\Projects\VS2005\mailpv\Release\mailpv.pdb

_acmdln

RPCRT4.dll

GetWindowsDirectoryA

RegDeleteKeyA

RegOpenKeyExA

RegEnumKeyA

RegEnumKeyExA

ShellExecuteA

NirSoftPADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD

Phulli.exe

Microsoft.VisualBasic

System.Windows.Forms

System.Drawing

System.Management

tapi32.dll

rtm.dll

user32.dll

Phulli.Resources.resources

Phulli.Form1.resources

Phulli.My

WindowsFormsApplicationBase

Microsoft.VisualBasic.ApplicationServices

System.Collections.Generic

.cctor

System.Threading

System.ComponentModel

System.CodeDom.Compiler

Microsoft.VisualBasic.Devices

m_MyWebServicesObjectProvider

get_WebServices

HelpKeywordAttribute

System.ComponentModel.Design

WebServices

Microsoft.VisualBasic.CompilerServices

System.Collections

ContainsKey

InvalidOperationException

MyWebServices

encryptedpassstring

encryptedsmtpstring

portstring

encryptedftphost

encryptedftpuser

encryptedftppass

useftp

websitevisitor

websiteblocker

passstring

smtpstring

ftphost

ftpuser

ftppass

WM_KEYUP

WM_KEYDOWN

WM_SYSKEYDOWN

WM_SYSKEYUP

KeyboardHandle

KeyLog

CleanedPasswordsMAIL

CleanedPasswordsWB

System.IO

get_ExecutablePath

WindowsIdentity

System.Security.Principal

set_WindowState

FormWindowState

UnhookWindowsHookEx

SetWindowsHookEx

SetWindowsHookExA

GetAsyncKeyState

vKey

HookKeyboard

UnhookKeyboard

Operators

get_Keyboard

Keyboard

get_CtrlKeyDown

get_AltKeyDown

KeyboardCallback

set_UseShellExecute

Microsoft.VisualBasic.MyServices

System.Collections.ObjectModel

MsgBox

MsgBoxResult

MsgBoxStyle

ForceSteamLogin

System.Net.NetworkInformation

get_OperationalStatus

OperationalStatus

FakemsgInstall

System.Net.Mail

SmtpClient

System.Globalization

set_Port

System.Net

Microsoft.Win32

RegistryKey

OpenSubKey

System.Security.Cryptography

System.Text

set_Key

stealWebroswers

WebClient

readweb

System.IO.Compression

SendLogsFTP

FtpWebRequest

WebRequest

UploadFTP

secretKey

set_KeySize

get_KeySize

System.Net.Sockets

virtualKey

KeyboardHookDelegate

get_Msg

Phulli.My.Resources

System.Resources

get_CMemoryExecute

get_WebBrowserPassView

WebBrowserPassView

System.Configuration

8.0.0.0

My.Computer

My.Application

My.User

My.Forms

My.WebServices

System.Windows.Forms.Form

My.MyProject.Forms

4System.Web.Services.Protocols.SoapHttpClientProtocol

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

11.0.0.0

My.Settings

$1f128a07-8438-4dc0-8205-570da0ccce8d

_CorExeMain

%%0.ÃŸ

Apple Computer\Preferences\keychain.plist

LoadPasswordsIE

LoadPasswordsFirefox

LoadPasswordsChrome

LoadPasswordsOpera

LoadPasswordsSafari

LoadPasswordsSeaMonkey

UseFirefoxProfileFolder

UseFirefoxInstallFolder

UseChromeProfileFolder

UseOperaPasswordFile

FirefoxProfileFolder

FirefoxInstallFolder

ChromeProfileFolder

OperaPasswordFile

Aadvapi32.dll

crypt32.dll

777705555443332

5555443332

wand.dat

@nss3.dll

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe

%programfiles%\Sea Monkey

%programfiles%\Mozilla Firefox

-signons.txt

signons2.txt

signons3.txt

@dllhost.exe

taskhost.exe

taskhostex.exe

Microsoft\Windows\WebCache\WebCacheV01.dat

Microsoft\Windows\WebCache\WebCacheV24.dat

index.dat

hXXps://VVV.google.com/accounts/servicelogin

hXXp://VVV.facebook.com/

hXXps://login.yahoo.com/config/login

hXXp://

hXXps://

PTF://

@history.dat

places.sqlite

Mozilla\Firefox\Profiles

Mozilla\SeaMonkey\Profiles

Mozilla\SeaMonkey

Mozilla\Firefox

profiles.ini

Profile%d

tntdll.dll

sWeb Data

Google\Chrome\User Data

Google\Chrome SxS\User Data

Opera\Opera\wand.dat

Opera\Opera7\profile\wand.dat

Opera

@"%s"

Ashell32.dll

\nss3.dll

.save

vaultcli.dll

abe2869f-9b47-4cd9-a358-c22904dba7f7

Copy &Password

&HTML Report - All Items

HTML R&eport - Selected Items

HTML Report - All Items

HTML Report - Selected Items

Load Passwords From...

Google Chrome

Mozilla Firefox

SeaMonkey

Firefox Options

Master password:

Firefox Profile:

Firefox Installation:

Chrome Options

Opera Options

wand.dat file:

%d Passwords

, %d Selected

Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat)

Loading... %d

KeePass csv file

Opera Password File

Firefox 1.x

Firefox 2.x

Firefox 3.0

Firefox

Chrome

Web Browser

Password

Password Strength

Password Field

WebBrowserPassView.exe

VVV.google.com/Please log in to your Gmail account

VVV.google.com:443/Please log in to your Gmail account

VVV.google.com/Please log in to your Google Account

VVV.google.com:443/Please log in to your Google Account

VVV.google.com

dWindowsLive:name=*

82BD0E67-9FEA-4748-8672-D5EFE5B779B0

Copy Password

%d items

Select Eudora.ini filename/Select the location of Thunderbird installation

Eudora.ini file

SMTP

Windows Mail

Windows Live Mail

Server Port

SMTP Server Port

Mail Password Recovery

mailpv.exe

noftp

Disablecmd

\Windows Update.exe

\WindowsUpdate.exe

SysInfo.txt

\pid.txt

\pidloc.txt

HawkEyeKeylogger

\Mozilla\Firefox\Profiles

127.0.0.1

\SteamAppData.vdf

\ClientRegistry.blob

Dear HawkEye Customers!

HawkEye Logger Details:

Keylogger Enabled:

Operating System:

HawkEye_Keylogger_Execution_Confirmed_

HawkEye Keylogger | Execution Confirmed |

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

autorun.inf

open=Sys.exe

Sys.exe

Software\Microsoft\Windows\CurrentVersion\Run

Windows Update

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

\bitcoin\wallet.dat

_wallet.dat

wallet.dat

Microsoft.NET\Framework\v2.0.50727\vbc.exe

holdermail.txt"

holdermail.txt

Operating System Intel Recovery

Operating System Platform:

Operating System Version:

WEB Browser Password Stealer

Mail Messenger Password Stealer

JDownloader Password Stealer

HawkEye_Keylogger_Stealer_Records_

HawkEye Keylogger | Stealer Records |

holderwb.txt"

holderwb.txt

C:\Users\

_Pin0.jpeg

_Pin1.jpeg

_Pin2.jpeg

_Pin3.jpeg

_Pin4.jpeg

HawkEye Keylogger | RuneScape Stealer |

HawkEye Keylogger | BitCoin Stealer |

Steals the Wallet.DAT file that holds the users bitcoin currency.

\.minecraft\lastlogin

HawkEye Keylogger | MineCraft Stealer |

As you can see, this email has the attached file, containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.

HawkEye Keylogger | Keylog Records |

Keylog Records

.jpeg

HawkEye_Keylogger_Keylog_Records_

hXXp://whatismyipaddress.com/

Phulli.Resources

:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

schtasks.exe_2024:

.text

`.data

.rsrc

USER32.dll

MPR.dll

ole32.dll

Secur32.dll

WS2_32.dll

NETAPI32.dll

SHLWAPI.dll

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

xpsp1res.dll

ScTasks.pdb

%d:%d

kernel32.dll

\/[]:| =;,?$#()!@^"`{}*%

\\%s\%s

5.1.2600.5512 (xpsp.080413-2108)

SchTasks.exe

ScTasks.exe

Windows

Operating System

5.1.2600.5512

Type the password for %s:1Passing the user credential on local connection.

7The Target system must be running Windows XP or above.

PInvalid Syntax. '%s' value is not allowed for '%s' option.

Type "%s" for usage.

KInvalid Syntax. Specify valid numeric value for '%s'.

SInvalid Syntax. Specifiy valid floating point value for '%s'.

HInvalid Syntax. Mandatory option '/%s' is missing.

XInvalid Syntax. '%s' option is not allowed more than '%d' time(s).

5Invalid Argument/Option - '%s'.

[Invalid Syntax. Default option is not allowed more than '%d' time(s).

>Invalid Syntax. Value expected for '%s'.

TInvalid Syntax. '%s' value is not allowed as default argument.

Type "SCHTASKS /CREATE /?" for usage.jERROR: Invalid starttime value (Time should be in hh:mm:ss format).

BERROR: The specified task name "%s" does not exist in the system.

ERROR: Failed to open "StdIn.txt" file.

ERROR: Failed to read "StdIn.txt" file.

ERROR: Password cannot be NULL.

.ERROR: Unable to run the scheduled task "%1".

Type "SCHTASKS /CREATE /?" for usage.KERROR: The scheduled task name cannot be null or more than 239 characters.

vERROR: Invalid syntax Cannot specify password without specifying the user name.

vERROR: Invalid syntax. Cannot specify password without specifying the user name.

wERROR: Invalid syntax. Cannot specify password without specifying the user name.

tERROR: Invalid syntax. Cannot specify password without specifying the user name.

jWARNING: When the run as password is empty, the scheduled task may not run because of the security policy

Task not scheduled3ERROR: Password cannot be more than 64 characters.

BWARNING: Password will be ignored for "NT AUTHORITY\SYSTEM" user.

10/20/2001

15/09/2001

2001/12/30

Scheduled#Please enter the run as user name: )Please enter the run as password for %1: Please enter the run as password for "%1": CThe task will be created under current logged-on user name ("%1").

HOURLY

Hourly

SCHTASKS /Create [/S system [/U username [/P password]]]

G [/RU username [/RP password]] /SC schedule [/MO modifier] [/D day]

F which the command should execute.

H /P password Specifies the password for the given

H /RP password Specifies the password for the user.

I To prompt for the password, the value

D Password will not effect for the

I Valid schedule types: MINUTE, HOURLY,

J Example: C:\windows\system32\calc.exe

HOURLY: 1 - 23 hours.

B SCHTASKS /Create /S system /U user /P password /RU runasuser

B /RP runaspassword /SC HOURLY /TN rtest1 /TR notepad

E SCHTASKS /Create /S system /U domain\user /P password /SC MINUTE

9 /MO 5 /TN rtest2 /TR calc.exe /ST 12:00:00

. /TR c:\windows\system32\freecell

A SCHTASKS /Create /S system /U user /P password /RU runasuser

D /RP runaspassword /SC WEEKLY /TN test1 /TR notepad.exe

B /MO 5 /TN test2 /TR c:\windows\system32\notepad.exe

G end scheduled tasks on a local or remote system. Replaces AT.exe.

SCHTASKS /Query [/S system [/U username [/P password]]] [/FO format]

@ which the command should execute.

B /P password Specifies the password for the given

2 SCHTASKS /Query /S system /U user /P password

> SCHTASKS /Query /FO LIST /V /S system /U user /P password

SCHTASKS /Delete [/S system [/U username [/P password]]] /TN taskname

? which the command should execute.

A /P password Specifies the password for the given

G SCHTASKS /Delete /S system /U user /P password /TN "Start Restore"

I SCHTASKS /Delete /S system /U user /P password /TN "Start Backup" /F

SCHTASKS /Change [/S system [/U username [/P password]]] {[/RU runasuser]

5 [/RP runaspassword] [/TR taskrun]} /TN taskname

B Changes the program to run, or user account and password used

A which the command should execute.

C /P password Specifies the password for the given

H /RP password Specifies a new password for the existing

E user context or the password for a new

I user account. Password will not effect for

; SCHTASKS /Change /RP password /TN "Backup and Restore"

9 SCHTASKS /Change /TR restore.exe /TN "Start Restore"

@ SCHTASKS /Change /S system /U user /P password /RU newuser

SCHTASKS /Run [/S system [/U username [/P password]]] /TN taskname

D which the command should execute.

F /P password Specifies the password for the given

I SCHTASKS /Run /S system /U user /P password /TN "Backup and Restore"

SCHTASKS /End [/S system [/U username [/P password]]] /TN taskname

E which the command should execute.

G /P password Specifies the password for the given

I SCHTASKS /End /S system /U user /P password /TN "Backup and Restore"