Gen.Variant.Razy.41811_f181ccdffe – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):

vbc.exe:2364
vbc.exe:2556
%original file name%.exe:580

The Trojan injects its code into the following process(es):

Document00000pdf.exe:1524
Document00000pdf.exe:1512
Document00000pdf.exe:940
Document00000pdf.exe:1484

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process vbc.exe:2556 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (2 bytes)

The process %original file name%.exe:580 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe (10177 bytes)

The process Document00000pdf.exe:1512 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\pid.txt (4 bytes)
%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe (10177 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (82 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (0 bytes)

Registry activity

The process vbc.exe:2364 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6C 36 63 77 68 2A 28 8B 1E 92 FA 81 39 55 82 54"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process vbc.exe:2556 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 A5 83 F8 7F 08 68 A2 69 0F 44 D1 3D D8 A6 18"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The process %original file name%.exe:580 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 8C 6B 04 EF 70 A0 F6 46 4D 30 7C 4A 51 48 6B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data]
"Document00000pdf.exe" = "Document000000pdf"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process Document00000pdf.exe:1524 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B1 63 39 2F 0C 8C 36 06 C8 81 F6 E6 3C 42 D6 42"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe"

The process Document00000pdf.exe:1512 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Document00000pdf\DEBUG]
"Trace Level" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 75 D6 F9 D3 2D CC B7 24 CB 3C 3F 6B 2C C9 9D"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Update" = "%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Document00000pdf\DEBUG]
"Trace Level"

The process Document00000pdf.exe:940 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A FB FD 6D E2 25 36 89 7F 5E CD E8 1C E5 44 AF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe"

The process Document00000pdf.exe:1484 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A 05 86 86 B9 82 C5 80 0F A7 47 8C 10 CA C2 BF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
vbc.exe:2364
vbc.exe:2556
%original file name%.exe:580
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe (10177 bytes)
%Documents and Settings%\%current user%\Application Data\pid.txt (4 bytes)
%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe (10177 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (82 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Document00000pdf.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Update" = "%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: doc
Product Name: Process Hacker
Product Version: 2.38.0.100
Legal Copyright: Licensed under the GNU GPL v3.
Legal Trademarks:
Original Filename: Documentt000000pdf.exe
Internal Name: Documentt000000pdf.exe
File Version: 2.38.0.100
File Description: Document000000pdf
Comments: Process Hacker
Language: Language Neutral

Company Name: docProduct Name: Process HackerProduct Version: 2.38.0.100Legal Copyright: Licensed under the GNU GPL v3.Legal Trademarks: Original Filename: Documentt000000pdf.exeInternal Name: Documentt000000pdf.exeFile Version: 2.38.0.100File Description: Document000000pdfComments: Process HackerLanguage: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	1583012	1583104	5.15042	f9f4ea822850b518048b70552064efa1
.rsrc	1597440	11776	11776	5.26554	efdcb0b469c91625ca37bb8dbeb9e8c4
.reloc	1613824	12	512	0.070639	f76a510ea64b3acb7a7ce8d345c4e3bd

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://whatismyipaddress.com/	2.21.160.45
hxxp://whatismyipaddress.com/api.html	2.21.160.45
mail.puresteeldesign.com	50.28.10.112

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Host: whatismyipaddress.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Server: AkamaiGHost

Content-Length: 0

Location: hXXp://whatismyipaddress.com/api.html

Date: Sat, 07 May 2016 23:02:46 GMT

Connection: keep-alive

....

GET /api.html HTTP/1.1

Host: whatismyipaddress.com

HTTP/1.1 200 OK

Server: Apache/2.2.29 (Unix) DAV/2 PHP/5.4.45 mod_ssl/2.2.29 OpenSSL/0.9.8zg

Last-Modified: Mon, 01 Feb 2016 20:41:18 GMT

ETag: "e72908-e0-52abb68241780"

MS-Author-Via: DAV

Content-Type: text/html

Date: Sat, 07 May 2016 23:02:46 GMT

Content-Length: 224

Connection: keep-alive

<html><head><link rel="shortcut icon" href="hXXp://cdn.whatismyipaddress.com/favicon.ico"></head><body>No scripted access. See hXXp://cdn.whatismyipaddress.com/api.html or contact support@whatismyipaddress.com</body></html>HTTP/1.1 200 OK..Server: Apache/2.2.29 (Unix) DAV/2 PHP/5.4.45 mod_ssl/2.2.29 OpenSSL/0.9.8zg..Last-Modified: Mon, 01 Feb 2016 20:41:18 GMT..ETag: "e72908-e0-52abb68241780"..MS-Author-Via: DAV..Content-Type: text/html..Date: Sat, 07 May 2016 23:02:46 GMT..Content-Length: 224..Connection: keep-alive..<html><head><link rel="shortcut icon" href="http://cdn.whatismyipaddress.com/favicon.ico"></head><body>No scripted access. See hXXp://cdn.whatismyipaddress.com/api.html or contact support@whatismyipaddress.com</body></html>..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

Document00000pdf.exe_1484_rwx_00E50000_0000F000:

l.dli

Document00000pdf.exe_940:

.text

`.rsrc

@.reloc

K.nK:

%F=OS

{VGi.aJ

.LP2N

.Zp6oJ

U.WCM

%fLF*

6.ZpXx

$%Svc

.Ndvii

fBt.LB

.hZdDif

GV^%%f

.NvqPQ

.MqAD

^u%UUp

.kbA(

(%f\K

.uA?S2?

K.bUd

dCP?.xYH

.CUKa/

_.Sv8

%4u~A

6/D.VB

p.zGk6C

yq.XV

.BkxD

8:.Jk

3/q"j%c

.aSk\h_

i.MHf

.xI^iF

&.EV&s

8%xw-

.CgHv~

%S#E{

.Sw?N8

j.PN:

.hej[

4.Jxc

.uc}M

X%dIi

Tz.od

]JÃŒ

E.HT5

1.UO~

3R.Cl

$.UmW

}.sC>

v2.0.50727

System.Windows.Forms

6HsgHkEt03.resources

Q4k7swzMHODLnkgHCT.resources

TbeXyjIAnnkI.resources

2oJlEfjqKw.resources

Ty6B6WDJPG.resources

Uba7KFWJWnwO0h.resources

6fOgsVvqh9yXF7V.resources

7QRDyoTZDPqAFRC.resources

IvTmoxEDpb5.resources

b3BLGBrovFkNLeSDCVv.resources

gddkRvED70E6dUoYC.resources

50mFX4tJJzYM.resources

bqpYsKUhlcQaUacSd4.resources

0R1UvSEkdVHb3i8t5r.resources

6wheDZ8EfXLtTa08b.resources

TBoYmyED8IeIzQO.resources

80SWgwbogUTKad.resources

oSOWjGfD5P.resources

IWQJGlUzd9.resources

6lEm9T2MCWCT3.resources

I8kXXgH1gT5LO1sat9r.resources

Gj80HYYuNOC7UYiyh.resources

ECKtt8Rj5wGAv.resources

QikkqWtwZPrHL8sNX.resources

5YIktPs9vnBLEgs9Un.resources

0yNkQjownhZtij.resources

GFgorLzqtHgBuMRYW.resources

v3IiWuw5OBY1yHWHP.resources

CbxYClYSdEws5Ur.resources

XvgUsiuoplkd.resources

OcWh57tEFohb0.resources

P4v1fNe5tQrvFjdPEwI.resources

FiP69O9Mug9o.resources

dIfBQrnyFkqdP.resources

BjtJf0AkWxQ1G.resources

fN0Q4qWY8Ve7o6qMPY.resources

gdOeOCkC5z3bOm.resources

uNQPkO2rkkFjKGj.resources

CJWmDGClHDhZFzmR.resources

PMsm9E1cokX4ZAu.resources

TiJi96Eeo4HybQs2.resources

KoNzdVgPtTv.resources

npeo0o7LvP.resources

boktVO8Kz1YBWlPk.resources

EO5EzeYXDaUkg.resources

NoZQ65KWqzB.resources

oGvA0k1SjBFa.resources

uIyabEm1K5H6.resources

DcFqIMHN3znwxgQD4q.resources

xo0nnjFFbQWYKG.resources

GZ7hjNZRfW4oef9gV4a.resources

LV7hX4dknWvKbcP4.resources

HYJNGF6RiAQnsGNU.resources

j2ILTvDgzC.resources

dCKFtPisTB.resources

pwVDyC3dBI.resources

czKv6avrAP1.resources

jv3VxDUFefdYU52e0c.resources

7IwmS6KD7NQfTkaZhQ.resources

OAj4oi380wkxfhJ4lh6.resources

0D9PNDqLWvQF.resources

0VlKF2lL71SHTd8N.resources

1hypp6AJzUisU.resources

AGLvRbfHvGP2Cn.resources

xmw3tTayEKMKqIvaIWb.resources

qC0ZQas3GP.resources

adVCuzkW8mxh.resources

FHdo9ReQbb3PPUR4.resources

jG3WHZgVjzhqm.resources

HUs2X7r4sIMVN2d.resources

PNUHoHvf7a8vYnV.resources

8VfebGL7hvRvS2.resources

cPYZWRYEqa84A8Ka.resources

XmNeGpp4zPQVd9SzR.resources

Vq2x6hxf2mYi8OsJ.resources

stGJQPAv4lHBavMi.resources

4a4QROKQjXs8A.resources

AUnQqN6cQk8w6GQLe4.resources

FFwCsLU6hpMmbxQzkC6.resources

lmOXDWESrqOKj87hPX.resources

KT1JdA1AKUOo.resources

zzKftjpYj43hAipmbaU.resources

OgxQYvpC0CzT2DD.resources

kYslATWA8WS.resources

LsyceSn0CjTKun.resources

ZMmv8Z8iF9g6rBXElX.resources

eHWYEjfCmwhRsdS6.resources

OtD8YrJcBGxrwBd6Q.resources

frz6zXYPubUeY.resources

093foLlSXbGD3L.resources

frUC1n2GS81ga.resources

yMC52de38NKeDyLlR1q.resources

2x9j1r8xkhj.resources

oFWO3KwZcxzLtM.resources

P6yTqg8t8MTrNgKSY.resources

g382pnV0T0Ohkde.resources

nb8XhhaPELnG.resources

kGLvp05BJB4L.resources

YoUYOkqUMyF.resources

y8YmmQqoDfdM3oviRKA.resources

wtZerLauFJ.resources

xzb01snkv4AIZ5.resources

0Q52eiYA6gEKvJj3.resources

6V1XZkZ5zQgoWI.resources

uv1XsXGySZ.resources

DnTeAzwuSYr5co.resources

77KTWZJEA9MUKY.resources

RjhtHuWe0ouc.resources

jeQUSCBKDur5553rCPx.resources

yjBJjRyU41vxp.resources

sOOl465A0pspYsI9t.resources

V8SqgXjoEkVXXLC.resources

YcZRGbQYmFT.resources

Yi84VVOapsy.resources

eVRGBumRbPWdTS4nI2.resources

Shonxl287aAqOwKQ.resources

4V5ygwXpHVQs2pFkPL.resources

3bpv5iEyVO3aVae.resources

C6lbgnhGUWBtq7.resources

9ypUTXQqsCK7AVSFq.resources

G1xkxlZoT0RxblNM41.resources

GIYc5uSIQG14BBhv.resources

nK80wvjPU0n.resources

pC2Xqcl4ZmaYCt.resources

D5JIo6LQd2VDsR.resources

mhdij29aBW6WA9Ihz.resources

2FG0yjRWcJ1gYuQXq4U.resources

BSFC3usTiQHFKHy0.resources

O66GMIllOKM.resources

M9DLWpj927.resources

z8y4wgItBAFW.resources

A98txRxncRkWe5hUe0g.resources

Y1HZDktwFeQdOHiW.resources

sGmDNYZwR8l.resources

ICYnMgYxEErm.resources

.cctor

System.Security.Cryptography

System.Reflection

System.IO

.ctor

System.Threading

GetExecutingAssembly

set_Key

System.Runtime.CompilerServices

FtpbyoYSXTDiHGFHp4

FtVTLdyFtpD

YAywvWFpUuDP3thY

Te9PgvDpSqlU3X

BWnreeJB8u2CrTRO

SwHi0TZscPnYCVUURlP

zwj6kAuvtMsgc

81GOto5SjOiNuwPyh

RUWZTVhKZrTcP

24UiigCrtPC7WNMi9

WEbbM07mYms

Pc5lGWebIWjOped

TcP7hvR45moDc1Eo

ZcuAH3rkWFTP7gYQ

5iAkSQL8Y9

VdMmXzB1sshTzBcH7Q

VOcetsHfZwebXW2k8

EBZW74KEYUdPg2E

RnHSqLH6VC2hTM9mC8

X3HwPgOOPqA9iO7UrL

CrtPQ3BDxlvBNJk

pEIC05o80Lw8CrT7qk

9i7iCZFKeyXgAKEKph

54A7wV3lOJpeNzSQlrh

5cmd8utKZYdOOPdYuwd

kWSShhsvcSK099

4FEmsGzeeF10ql

cQ1RIpVcYeAJhnKey

Nqv50UQcmdnKtgPf

bvdviStCP3G

roxd7KHteEXe

MEXevFHk3LPsVCkNsKc

sPweBf7PlrUatDuUeDY

0lxBzJ1qWEXegC

Pb3eYHYLCmD7D1

kEYNzJN9NKDs

WlKEYtIs4VesUb

UJdUJEftpidgNaBf

qfurlKWxc5JHC

eAQ9YExe6Fdl

5q3XaHvtLssH

GBh6FTp4t5bWU

kEyVxEwJa8QJObqVN0s

nuwZ9exezj

adMDURlz47Z

jCqqFCV9eXemV4md

2CMdPHpH7PGT

DcexE8OTNQjjWWA

zk0Ourld9WTsNvb2b

X7sE96sQLVKLNJPNh

6XV4rIObUrLGSr

bMaKmsShGIz

Rx2oMOWkeyd4JD7

6fxSutH8DORzOuFkEy

0X6lftPWO6rljHCy0

LxaEN3YCmDg126EqoBb

iDdf6cRtYyCGbJqmkl

TPOijMSgXg

System.Diagnostics

System.Security

2.38.0.100

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

_CorExeMain

mscoree.dll

O.nM:

System.Reflection.ParameterInfo

System.Reflection.Assembly

System.Byte[]

Document00000pdf.exe

Document00000pdf.exe_940_rwx_00400000_0013A000:

.text

`.rsrc

@.reloc

K.nK:

%F=OS

{VGi.aJ

.LP2N

.Zp6oJ

U.WCM

%fLF*

6.ZpXx

$%Svc

.Ndvii

fBt.LB

.hZdDif

GV^%%f

.NvqPQ

.MqAD

^u%UUp

.kbA(

(%f\K

.uA?S2?

K.bUd

dCP?.xYH

.CUKa/

_.Sv8

%4u~A

6/D.VB

p.zGk6C

yq.XV

.BkxD

8:.Jk

3/q"j%c

.aSk\h_

i.MHf

.xI^iF

&.EV&s

8%xw-

.CgHv~

%S#E{

.Sw?N8

j.PN:

.hej[

4.Jxc

.uc}M

X%dIi

Tz.od

]JÃŒ

E.HT5

1.UO~

3R.Cl

$.UmW

}.sC>

v2.0.50727

System.Windows.Forms

6HsgHkEt03.resources

Q4k7swzMHODLnkgHCT.resources

TbeXyjIAnnkI.resources

2oJlEfjqKw.resources

Ty6B6WDJPG.resources

Uba7KFWJWnwO0h.resources

6fOgsVvqh9yXF7V.resources

7QRDyoTZDPqAFRC.resources

IvTmoxEDpb5.resources

b3BLGBrovFkNLeSDCVv.resources

gddkRvED70E6dUoYC.resources

50mFX4tJJzYM.resources

bqpYsKUhlcQaUacSd4.resources

0R1UvSEkdVHb3i8t5r.resources

6wheDZ8EfXLtTa08b.resources

TBoYmyED8IeIzQO.resources

80SWgwbogUTKad.resources

oSOWjGfD5P.resources

IWQJGlUzd9.resources

6lEm9T2MCWCT3.resources

I8kXXgH1gT5LO1sat9r.resources

Gj80HYYuNOC7UYiyh.resources

ECKtt8Rj5wGAv.resources

QikkqWtwZPrHL8sNX.resources

5YIktPs9vnBLEgs9Un.resources

0yNkQjownhZtij.resources

GFgorLzqtHgBuMRYW.resources

v3IiWuw5OBY1yHWHP.resources

CbxYClYSdEws5Ur.resources

XvgUsiuoplkd.resources

OcWh57tEFohb0.resources

P4v1fNe5tQrvFjdPEwI.resources

FiP69O9Mug9o.resources

dIfBQrnyFkqdP.resources

BjtJf0AkWxQ1G.resources

fN0Q4qWY8Ve7o6qMPY.resources

gdOeOCkC5z3bOm.resources

uNQPkO2rkkFjKGj.resources

CJWmDGClHDhZFzmR.resources

PMsm9E1cokX4ZAu.resources

TiJi96Eeo4HybQs2.resources

KoNzdVgPtTv.resources

npeo0o7LvP.resources

boktVO8Kz1YBWlPk.resources

EO5EzeYXDaUkg.resources

NoZQ65KWqzB.resources

oGvA0k1SjBFa.resources

uIyabEm1K5H6.resources

DcFqIMHN3znwxgQD4q.resources

xo0nnjFFbQWYKG.resources

GZ7hjNZRfW4oef9gV4a.resources

LV7hX4dknWvKbcP4.resources

HYJNGF6RiAQnsGNU.resources

j2ILTvDgzC.resources

dCKFtPisTB.resources

pwVDyC3dBI.resources

czKv6avrAP1.resources

jv3VxDUFefdYU52e0c.resources

7IwmS6KD7NQfTkaZhQ.resources

OAj4oi380wkxfhJ4lh6.resources

0D9PNDqLWvQF.resources

0VlKF2lL71SHTd8N.resources

1hypp6AJzUisU.resources

AGLvRbfHvGP2Cn.resources

xmw3tTayEKMKqIvaIWb.resources

qC0ZQas3GP.resources

adVCuzkW8mxh.resources

FHdo9ReQbb3PPUR4.resources

jG3WHZgVjzhqm.resources

HUs2X7r4sIMVN2d.resources

PNUHoHvf7a8vYnV.resources

8VfebGL7hvRvS2.resources

cPYZWRYEqa84A8Ka.resources

XmNeGpp4zPQVd9SzR.resources

Vq2x6hxf2mYi8OsJ.resources

stGJQPAv4lHBavMi.resources

4a4QROKQjXs8A.resources

AUnQqN6cQk8w6GQLe4.resources

FFwCsLU6hpMmbxQzkC6.resources

lmOXDWESrqOKj87hPX.resources

KT1JdA1AKUOo.resources

zzKftjpYj43hAipmbaU.resources

OgxQYvpC0CzT2DD.resources

kYslATWA8WS.resources

LsyceSn0CjTKun.resources

ZMmv8Z8iF9g6rBXElX.resources

eHWYEjfCmwhRsdS6.resources

OtD8YrJcBGxrwBd6Q.resources

frz6zXYPubUeY.resources

093foLlSXbGD3L.resources

frUC1n2GS81ga.resources

yMC52de38NKeDyLlR1q.resources

2x9j1r8xkhj.resources

oFWO3KwZcxzLtM.resources

P6yTqg8t8MTrNgKSY.resources

g382pnV0T0Ohkde.resources

nb8XhhaPELnG.resources

kGLvp05BJB4L.resources

YoUYOkqUMyF.resources

y8YmmQqoDfdM3oviRKA.resources

wtZerLauFJ.resources

xzb01snkv4AIZ5.resources

0Q52eiYA6gEKvJj3.resources

6V1XZkZ5zQgoWI.resources

uv1XsXGySZ.resources

DnTeAzwuSYr5co.resources

77KTWZJEA9MUKY.resources

RjhtHuWe0ouc.resources

jeQUSCBKDur5553rCPx.resources

yjBJjRyU41vxp.resources

sOOl465A0pspYsI9t.resources

V8SqgXjoEkVXXLC.resources

YcZRGbQYmFT.resources

Yi84VVOapsy.resources

eVRGBumRbPWdTS4nI2.resources

Shonxl287aAqOwKQ.resources

4V5ygwXpHVQs2pFkPL.resources

3bpv5iEyVO3aVae.resources

C6lbgnhGUWBtq7.resources

9ypUTXQqsCK7AVSFq.resources

G1xkxlZoT0RxblNM41.resources

GIYc5uSIQG14BBhv.resources

nK80wvjPU0n.resources

pC2Xqcl4ZmaYCt.resources

D5JIo6LQd2VDsR.resources

mhdij29aBW6WA9Ihz.resources

2FG0yjRWcJ1gYuQXq4U.resources

BSFC3usTiQHFKHy0.resources

O66GMIllOKM.resources

M9DLWpj927.resources

z8y4wgItBAFW.resources

A98txRxncRkWe5hUe0g.resources

Y1HZDktwFeQdOHiW.resources

sGmDNYZwR8l.resources

ICYnMgYxEErm.resources

.cctor

System.Security.Cryptography

System.Reflection

System.IO

.ctor

System.Threading

GetExecutingAssembly

set_Key

System.Runtime.CompilerServices

FtpbyoYSXTDiHGFHp4

FtVTLdyFtpD

YAywvWFpUuDP3thY

Te9PgvDpSqlU3X

BWnreeJB8u2CrTRO

SwHi0TZscPnYCVUURlP

zwj6kAuvtMsgc

81GOto5SjOiNuwPyh

RUWZTVhKZrTcP

24UiigCrtPC7WNMi9

WEbbM07mYms

Pc5lGWebIWjOped

TcP7hvR45moDc1Eo

ZcuAH3rkWFTP7gYQ

5iAkSQL8Y9

VdMmXzB1sshTzBcH7Q

VOcetsHfZwebXW2k8

EBZW74KEYUdPg2E

RnHSqLH6VC2hTM9mC8

X3HwPgOOPqA9iO7UrL

CrtPQ3BDxlvBNJk

pEIC05o80Lw8CrT7qk

9i7iCZFKeyXgAKEKph

54A7wV3lOJpeNzSQlrh

5cmd8utKZYdOOPdYuwd

kWSShhsvcSK099

4FEmsGzeeF10ql

cQ1RIpVcYeAJhnKey

Nqv50UQcmdnKtgPf

bvdviStCP3G

roxd7KHteEXe

MEXevFHk3LPsVCkNsKc

sPweBf7PlrUatDuUeDY

0lxBzJ1qWEXegC

Pb3eYHYLCmD7D1

kEYNzJN9NKDs

WlKEYtIs4VesUb

UJdUJEftpidgNaBf

qfurlKWxc5JHC

eAQ9YExe6Fdl

5q3XaHvtLssH

GBh6FTp4t5bWU

kEyVxEwJa8QJObqVN0s

nuwZ9exezj

adMDURlz47Z

jCqqFCV9eXemV4md

2CMdPHpH7PGT

DcexE8OTNQjjWWA

zk0Ourld9WTsNvb2b

X7sE96sQLVKLNJPNh

6XV4rIObUrLGSr

bMaKmsShGIz

Rx2oMOWkeyd4JD7

6fxSutH8DORzOuFkEy

0X6lftPWO6rljHCy0

LxaEN3YCmDg126EqoBb

iDdf6cRtYyCGbJqmkl

TPOijMSgXg

System.Diagnostics

System.Security

2.38.0.100

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

_CorExeMain

mscoree.dll

O.nM:

System.Reflection.ParameterInfo

System.Reflection.Assembly

System.Byte[]

Document00000pdf.exe

Document00000pdf.exe_1524:

.text

`.rsrc

@.reloc

6v.JZ Y=

Xs.Bsq

-AA}by

IC.KF

.Rrr:

`pFm.iY

^@\%X;

`~.nD

L.aCCJ

44S%S

Wv*.te

)%FTM.

7t%x0

/-"V%dv

lF%F>

.px)]

s.bI$Rwbn

Ok.WL

.kM2i

.v%DTp

%XdwB

zvV\.EFJm{

4.Cf@

.iTv5

JFz[/.Qx

"(.RF~

&.fF#

.iC@q

$w.YI

:|.%xRt

HN.HN^$n(jt

.%S~(

x).Ak2h"

v2.0.50727

System.Windows.Forms

HfQVU8IeE0V8.resources

Rc0WSlbch0o0o.resources

TkPe6x7h8B.resources

zWLwsiBXLJgkoLUa4Qb.resources

5n6eX2B0Fvgb.resources

UU1HytYxzm.resources

jqQyQarMSZqJZ.resources

jly7ivE1hDdHTAcG.resources

M8AVXWTmEynCUZMv9rC.resources

b8e3mCNiCHER6I.resources

L43U1MIHrrz.resources

iblZIAgA15Kv8FbGV.resources

4M8ciWzI3PMy9MxrKX.resources

a43K7lVdIIgE22.resources

pjYCh1mqJHXO.resources

2e56FdD6wiwrchO9Hi6.resources

VJty5TSX4fedXM.resources

ZDkMJhjioLL4S.resources

qqIBipd7DqoS2wBtNl.resources

5rbbkjsUO5AfA92.resources

dZmFJiI9kJtbgxt4mn.resources

BFDhU5FGeeBOS9oA.resources

mHMNUnuAdNkg0HB.resources

xzjAh2KrRT7.resources

oEbuYZZXP0khUG.resources

ucQsv9vk41qyU.resources

CcwQDEYWaTcarDRBqtA.resources

AKryATVaRhLs8VB.resources

hN3dAHa5Md5XNu0.resources

Y9brkL0iJP75VpdkN7I.resources

ab74UiRnOwv.resources

nVE9mYfI8CUwK.resources

pHqG61PGVcwE.resources

phWOGdSIqKd2tYq.resources

n16dk8Bn4zTB.resources

qu76dtlIf2NuLp8BV.resources

iOQbTzhhsEeGOLNB9S.resources

51HLJs8iuPMN.resources

ofvgyDD1K720TPyu.resources

4pbI0qE0YdZ8.resources

JcFWUxcPRb8.resources

g4V2dDHwNGJWr.resources

f4nPQu3OkUde.resources

8XKWCnaDzJ.resources

UA06xwHsbgiWs372RJF.resources

HaPJjuf4r3Go.resources

mr0j7gh1wGB1.resources

ZINUJ6EQlvqpH.resources

NCiTP9dC0iSU.resources

bnFZCM6SHzIdLH.resources

iJMukwWz3af2uYJK4a.resources

twH1gxYDpHAl1y.resources

GakTgQ6yYcI601.resources

nDwgSCENACOnlml1vOK.resources

Umm5roL5UK.resources

3Cak8kFLFdvJL.resources

eG3QRsboCE8dzaEr.resources

k3nHFioxAY0t2aL.resources

hwRMTeZ9X9LlVsEh.resources

HtBxwnUCu3WIt2k.resources

Z0p9fegbn4Gm.resources

OnkARfz5cfD6rbprEJ.resources

QrjcljvDMm6.resources

Xi6OZa6AHdy.resources

DUeaGzy5gI8.resources

ke8xiAjUmi2MiMG3Z.resources

QgYuYVgd8Y.resources

q1dpajEdDR.resources

6BXZFdeNWQ.resources

piXesydu4SUQnh.resources

J6PsK3Scl5cfowpp.resources

GALznoto9ZOR.resources

bvj7UuhhYIICEu.resources

urzCEfCNUSkNTrKbr1.resources

O97sTr3e5eay6ehw6Q.resources

qsSIYchlXseaT3PIM.resources

1AKOs0CckcC.resources

wX6h1J7EfMhC.resources

032JmvTm3z0.resources

WqCVbt4UZa.resources

.cctor

System.Security.Cryptography

System.Reflection

System.IO

voRE5H8OssH6JPQ

.ctor

System.Threading

GetExecutingAssembly

set_Key

System.Runtime.CompilerServices

qntbAFtP3K

kpklcmdkF3Kk

6x0mtiPMJFtPWc

AHT0qSGuDpofs

3ytKnoz5CmDM0o23qa

h8dLIrOhmdwEBH

HfVCkSqlrA

KGrfW17p4CrtPx

casShGmpVzTzt7KS9

Hg7f3EoSuDPEz4rhAM

LUxFTPHo8u

mdTEm7IjawewFtCPs

MUIy5zporTDA

PUTsx7rUmSGrmBa

keyTh1eAN2nTiuMEuo

1dsb1ChzAlN7SshAGb

p3pMCMD3rMTrwv0Qk

KiTdEBj4sshI

iLgwfTp4BXRUZynylo7

aUi4uRLsEwreFcZ8Ts

LH0g1nTCPIDDhnixl

NCWcraSd1bCrTAa

MExkEYoO1lEb

jI4p4faRkgCmD1vhE1

key33ZMjfoUDsz

nsOIAi0fGWcmdh6By

hJJQYcrtVOE2Pu1q

hCuCf9uDBvcmdvwwkt

VwmyudPDHkgh

OEZViwmXZ7bX1DJeuDp

No0TgYEFFUdpLhj6

EFtplGn2z5I5

jhMsgqE7yaOCXag

LY2pVIrCmd

yzcPtokEYavnLoNoU

R577KurLLqX5WfKxxfC

uOYuhynrbztcPzDoDT

7GU1NZuunIosSh

FtPB9GXt7MQ

4ftommmSGtV8w8Yo

crt1gfnHJL

Msg6iryHXel

u8YmmXizlUrlN

SSHz7oebillYY

vkEyNjORar

ilswE2cMDrHlHRrfKU

urlGCIAVmw

MJwEBDDdFJp7bT0Jy

FTPkxRNTQahb4IW

nbICRT5LjK

mmSG9yjKL0

lesm9H9rKWeBy6bKi

Ah7jzriZbnLmseXet

Yme6zexESLoSb2

RCRUDpXBY654LZuGYM

7aUwEBgva3vL

bsqlHjo4WpbIoXh

mYgWeBCzu78E2

fNrDKey4l8WpsKYG

cx8KEYNH9QVr

System.Diagnostics

System.Security

2.38.0.100

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

_CorExeMain

mscoree.dll

System.Reflection.Assembly

System.Byte[]

System.Reflection.ParameterInfo

Document00000pdf.exe

Document00000pdf.exe_940_rwx_00E00000_0000F000:

l.dlf

l.dli

Document00000pdf.exe_1524_rwx_00400000_000E8000:

.text

`.rsrc

@.reloc

6v.JZ Y=

Xs.Bsq

-AA}by

IC.KF

.Rrr:

`pFm.iY

^@\%X;

`~.nD

L.aCCJ

44S%S

Wv*.te

)%FTM.

7t%x0

/-"V%dv

lF%F>

.px)]

s.bI$Rwbn

Ok.WL

.kM2i

.v%DTp

%XdwB

zvV\.EFJm{

4.Cf@

.iTv5

JFz[/.Qx

"(.RF~

&.fF#

.iC@q

$w.YI

:|.%xRt

HN.HN^$n(jt

.%S~(

x).Ak2h"

v2.0.50727

System.Windows.Forms

HfQVU8IeE0V8.resources

Rc0WSlbch0o0o.resources

TkPe6x7h8B.resources

zWLwsiBXLJgkoLUa4Qb.resources

5n6eX2B0Fvgb.resources

UU1HytYxzm.resources

jqQyQarMSZqJZ.resources

jly7ivE1hDdHTAcG.resources

M8AVXWTmEynCUZMv9rC.resources

b8e3mCNiCHER6I.resources

L43U1MIHrrz.resources

iblZIAgA15Kv8FbGV.resources

4M8ciWzI3PMy9MxrKX.resources

a43K7lVdIIgE22.resources

pjYCh1mqJHXO.resources

2e56FdD6wiwrchO9Hi6.resources

VJty5TSX4fedXM.resources

ZDkMJhjioLL4S.resources

qqIBipd7DqoS2wBtNl.resources

5rbbkjsUO5AfA92.resources

dZmFJiI9kJtbgxt4mn.resources

BFDhU5FGeeBOS9oA.resources

mHMNUnuAdNkg0HB.resources

xzjAh2KrRT7.resources

oEbuYZZXP0khUG.resources

ucQsv9vk41qyU.resources

CcwQDEYWaTcarDRBqtA.resources

AKryATVaRhLs8VB.resources

hN3dAHa5Md5XNu0.resources

Y9brkL0iJP75VpdkN7I.resources

ab74UiRnOwv.resources

nVE9mYfI8CUwK.resources

pHqG61PGVcwE.resources

phWOGdSIqKd2tYq.resources

n16dk8Bn4zTB.resources

qu76dtlIf2NuLp8BV.resources

iOQbTzhhsEeGOLNB9S.resources

51HLJs8iuPMN.resources

ofvgyDD1K720TPyu.resources

4pbI0qE0YdZ8.resources

JcFWUxcPRb8.resources

g4V2dDHwNGJWr.resources

f4nPQu3OkUde.resources

8XKWCnaDzJ.resources

UA06xwHsbgiWs372RJF.resources

HaPJjuf4r3Go.resources

mr0j7gh1wGB1.resources

ZINUJ6EQlvqpH.resources

NCiTP9dC0iSU.resources

bnFZCM6SHzIdLH.resources

iJMukwWz3af2uYJK4a.resources

twH1gxYDpHAl1y.resources

GakTgQ6yYcI601.resources

nDwgSCENACOnlml1vOK.resources

Umm5roL5UK.resources

3Cak8kFLFdvJL.resources

eG3QRsboCE8dzaEr.resources

k3nHFioxAY0t2aL.resources

hwRMTeZ9X9LlVsEh.resources

HtBxwnUCu3WIt2k.resources

Z0p9fegbn4Gm.resources

OnkARfz5cfD6rbprEJ.resources

QrjcljvDMm6.resources

Xi6OZa6AHdy.resources

DUeaGzy5gI8.resources

ke8xiAjUmi2MiMG3Z.resources

QgYuYVgd8Y.resources

q1dpajEdDR.resources

6BXZFdeNWQ.resources

piXesydu4SUQnh.resources

J6PsK3Scl5cfowpp.resources

GALznoto9ZOR.resources

bvj7UuhhYIICEu.resources

urzCEfCNUSkNTrKbr1.resources

O97sTr3e5eay6ehw6Q.resources

qsSIYchlXseaT3PIM.resources

1AKOs0CckcC.resources

wX6h1J7EfMhC.resources

032JmvTm3z0.resources

WqCVbt4UZa.resources

.cctor

System.Security.Cryptography

System.Reflection

System.IO

voRE5H8OssH6JPQ

.ctor

System.Threading

GetExecutingAssembly

set_Key

System.Runtime.CompilerServices

qntbAFtP3K

kpklcmdkF3Kk

6x0mtiPMJFtPWc

AHT0qSGuDpofs

3ytKnoz5CmDM0o23qa

h8dLIrOhmdwEBH

HfVCkSqlrA

KGrfW17p4CrtPx

casShGmpVzTzt7KS9

Hg7f3EoSuDPEz4rhAM

LUxFTPHo8u

mdTEm7IjawewFtCPs

MUIy5zporTDA

PUTsx7rUmSGrmBa

keyTh1eAN2nTiuMEuo

1dsb1ChzAlN7SshAGb

p3pMCMD3rMTrwv0Qk

KiTdEBj4sshI

iLgwfTp4BXRUZynylo7

aUi4uRLsEwreFcZ8Ts

LH0g1nTCPIDDhnixl

NCWcraSd1bCrTAa

MExkEYoO1lEb

jI4p4faRkgCmD1vhE1

key33ZMjfoUDsz

nsOIAi0fGWcmdh6By

hJJQYcrtVOE2Pu1q

hCuCf9uDBvcmdvwwkt

VwmyudPDHkgh

OEZViwmXZ7bX1DJeuDp

No0TgYEFFUdpLhj6

EFtplGn2z5I5

jhMsgqE7yaOCXag

LY2pVIrCmd

yzcPtokEYavnLoNoU

R577KurLLqX5WfKxxfC

uOYuhynrbztcPzDoDT

7GU1NZuunIosSh

FtPB9GXt7MQ

4ftommmSGtV8w8Yo

crt1gfnHJL

Msg6iryHXel

u8YmmXizlUrlN

SSHz7oebillYY

vkEyNjORar

ilswE2cMDrHlHRrfKU

urlGCIAVmw

MJwEBDDdFJp7bT0Jy

FTPkxRNTQahb4IW

nbICRT5LjK

mmSG9yjKL0

lesm9H9rKWeBy6bKi

Ah7jzriZbnLmseXet

Yme6zexESLoSb2

RCRUDpXBY654LZuGYM

7aUwEBgva3vL

bsqlHjo4WpbIoXh

mYgWeBCzu78E2

fNrDKey4l8WpsKYG

cx8KEYNH9QVr

System.Diagnostics

System.Security

2.38.0.100

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

_CorExeMain

mscoree.dll

System.Reflection.Assembly

System.Byte[]

System.Reflection.ParameterInfo

Document00000pdf.exe

Document00000pdf.exe_1524_rwx_00A5A000_00002000:

.VByZX

Document00000pdf.exe_1524_rwx_00DB0000_0000E000:

l.dli

l.dlf

.lZx%

Document00000pdf.exe_1512:

.text

`.rsrc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

v2.0.50727

CMemoryExecute.dll

CMemoryExecute

PAGE_EXECUTE_READWRITE

.ctor

System.Reflection

System.Runtime.InteropServices

System.Security.Permissions

System.Diagnostics

System.Runtime.CompilerServices

DllImportAttribute

kernel32.dll

ntdll.dll

System.Security

$8fcd4931-91a2-4e18-849b-70de34ab75df

1.0.0.0

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb

mscoree.dll

`.rdata

@.data

.rsrc

D$.SPf

2 34 567

com.apple.Safari

com.apple.WebKit2WebProcess

SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins

"Account","Login Name","Password","Web Site","Comments"

3.7.5

SQLite format 3

CREATE TABLE sqlite_master(

sql text

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins

PK11_GetInternalKeySlot

PK11_CheckUserPassword

large file support is disabled

unknown operation

SQL logic error or missing database

foreign_keys

sqlite_compileoption_get

sqlite_compileoption_used

sqlite_source_id

sqlite_version

sqlite_attach

sqlite_detach

sqlite_stat1

sqlite_rename_parent

sqlite_rename_trigger

sqlite_rename_table

%Y-%m-%d %H:%M:%S

%Y-%m-%d

%H:%M:%S

SQLITE_

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

%s-shm

%s\etilqs_

OsError 0x%x (%u)

Recovered %d frames from WAL file %s

%s-mjX

foreign key constraint failed

unable to use function %s in the requested context

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

statement aborts at %d: [%s] %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

oversized integer: %s%s

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

%s OR name=%Q

type='trigger' AND (%s)

there is already another table or index with this name: %s

sqlite_

table %s may not be altered

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE tbl=%Q

SELECT tbl, idx, stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s %T cannot reference objects in database %s

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

no such collation sequence: %s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

view %s is circularly defined

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

a JOIN clause is required before %s

unable to identify the object to be reindexed

table %s may not be modified

cannot modify %s because it is a view

foreign key mismatch

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

PRIMARY KEY must be unique

automatic extension loading failed: %s

foreign_key_list

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

%s.%s

%s:%d

no such index: %s

sqlite_subquery_%p_

no such table: %s

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

at most %d tables in a join

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unable to close due to unfinished backup operation

unknown database: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

sqlite3_open

sqlite3_prepare

sqlite3_step

sqlite3_column_text

sqlite3_column_int

sqlite3_column_int64

sqlite3_finalize

sqlite3_close

sqlite3_exec

f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb

msvcrt.dll

_wcmdln

COMCTL32.dll

VERSION.dll

FindCloseUrlCache

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

WININET.dll

GetWindowsDirectoryW

KERNEL32.dll

EnumChildWindows

USER32.dll

GDI32.dll

comdlg32.dll

RegCloseKey

RegOpenKeyExW

RegEnumKeyExW

ADVAPI32.dll

ShellExecuteW

SHELL32.dll

ole32.dll

5JEw%Xg

hXXp://VVV.usertrust.com1

3hXXp://crl.usertrust.com/AddTrustExternalCARoot.crl05

hXXp://ocsp.usertrust.com0

1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl05

1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl0t

1hXXp://crt.usertrust.com/UTNAddTrustObject_CA.crt0%

hXXps://secure.comodo.net/CPS0A

0hXXp://crl.comodoca.com/COMODOCodeSigningCA2.crl0r

0hXXp://crt.comodoca.com/COMODOCodeSigningCA2.crt0$

hXXp://ocsp.comodoca.com0

support@nirsoft.net0

t{SSh

v%SSW

Mail PassView

Mozilla\Profiles

Software\Mozilla\Mozilla Thunderbird

%s\Main

sqlite3.dll

nss3.dll

%programfiles%\Mozilla Thunderbird

AddExportHeaderLine

%s %s %s

HTTPMail User Name

SMTP USer Name

HTTPMail Server

SMTP Server

POP3 Password2

IMAP Password2

HTTPMail Password2

SMTP Password2

POP3 Port

IMAP Port

HTTPMail Port

SMTP Port

HTTPMail Secure Connection

SMTP Secure Connection

SMTP Display Name

SMTP Email Address

POP3 Password

IMAP Password

HTTP Password

SMTP Password

HTTP User

SMTP User

HTTP Server URL

HTTP Port

HTTPMail Use SSL

SMTP Use SSL

%s\%s

PopPort

PopPassword

SMTPAccount

SMTPServer

SMTPPort

SMTPLogSecure

SMTPPassword

%s\Accounts

LoginName

SavePasswordText

ESMTPUsername

ESMTPPassword

POP3Password

fb.dat

%s@gmail.com

%s@yahoo.com

Software\Microsoft\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

%s %s

smtp

advapi32.dll

comctl32.dll

*.ini

netmsg.dll

Error %d: %s

%s (%s)

menu_%d

dialog_%d

TranslatorURL

_lng.ini

%-18s: %s

%%-%d.%ds

%s

%s%s

bgcolor="%s"

%s

%s%s>

%s>

report.html

*.txt

*.htm;*.html

*.xml

*.csv

Software\NirSoft\MailPassView

MailPassView

/skeepass

/deleteregkey

Failed to load the executable file !

mail.account.account

mail.server

port

mail.identity

signon.signonfilename

mailbox://%s@%s

imap://%s@%s

mailbox://%s

imap://%s

signons.txt

signons.sqlite

prefs.js

Password.NET Messenger Service

User.NET Messenger Service

Passport.Net\*

ps:password

windowslive:name=

Exception %8.8X at address %8.8X in module %s

Stack Data: %s

Code Data: %s

mozsqlite3.dll

psapi.dll

pstorec.dll

5e7e8100-9138-11d1-945a-00c04fc308ff

00000000-0000-0000-0000-000000000000

220D5CD0-853A-11D0-84BC-00C04FD43F8F

220D5CD1-853A-11D0-84BC-00C04FD43F8F

220D5CC1-853A-11D0-84BC-00C04FD43F8F

417E2D75-84BD-11D0-84BB-00C04FD43F8F

shell32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

shlwapi.dll

%s%s

%s

size="%d"

color="#%s"

width="%s"

%s%s%s

SOFTWARE\Mozilla

mozilla

%s\bin

PathToExe

\sqlite3.dll

\mozsqlite3.dll

Software\Microsoft\Windows Mail

Software\Microsoft\Windows Live Mail

SMTP_Server

SMTP_User_Name

POP3_Password2

IMAP_Password2

NNTP_Password2

SMTP_Password2

SMTP_Email_Address

SMTP_Port

NNTP_Port

IMAP_Port

POP3_Port

SMTP_Secure_Connection

*.oeaccount

\Microsoft\Windows Mail

\Microsoft\Windows Live Mail

f:\Projects\VS2005\mailpv\Release\mailpv.pdb

_acmdln

RPCRT4.dll

GetWindowsDirectoryA

RegDeleteKeyA

RegOpenKeyExA

RegEnumKeyA

RegEnumKeyExA

ShellExecuteA

NirSoftPADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD

Debugger.exe

Microsoft.VisualBasic

System.Windows.Forms

System.Drawing

System.Management

tapi32.dll

rtm.dll

user32.dll

Debugger.Debugger.resources

Debugger.Resources.resources

Debugger.My

WindowsFormsApplicationBase

Microsoft.VisualBasic.ApplicationServices

System.ComponentModel

System.CodeDom.Compiler

Microsoft.VisualBasic.Devices

m_MyWebServicesObjectProvider

.cctor

get_WebServices

HelpKeywordAttribute

System.ComponentModel.Design

WebServices

Microsoft.VisualBasic.CompilerServices

System.Collections

ContainsKey

InvalidOperationException

MyWebServices

encryptedpassstring

encryptedsmtpstring

portstring

fakeMSGholder

encryptedftphost

encryptedftpuser

encryptedftppass

useftp

websitevisitor

websiteblocker

passstring

smtpstring

ftphost

ftpuser

ftppass

WM_KEYUP

WM_KEYDOWN

WM_SYSKEYDOWN

WM_SYSKEYUP

KeyboardHandle

KeyLog

CleanedPasswordsMAIL

CleanedPasswordsWB

System.IO

get_ExecutablePath

set_WindowState

FormWindowState

UnhookWindowsHookEx

SetWindowsHookEx

SetWindowsHookExA

GetAsyncKeyState

vKey

HookKeyboard

UnhookKeyboard

Operators

get_Keyboard

Keyboard

get_CtrlKeyDown

get_AltKeyDown

KeyboardCallback

System.Threading

System.Collections.Generic

Microsoft.VisualBasic.MyServices

System.Collections.ObjectModel

MsgBox

MsgBoxResult

MsgBoxStyle

ForceSteamLogin

System.Net.NetworkInformation

get_OperationalStatus

OperationalStatus

FakemsgInstall

System.Net.Mail

SmtpClient

System.Globalization

set_Port

System.Net

Microsoft.Win32

RegistryKey

OpenSubKey

System.Security.Cryptography

System.Text

set_Key

stealWebroswers

WebClient

readweb

System.IO.Compression

SendLogsFTP

FtpWebRequest

WebRequest

UploadFTP

secretKey

set_KeySize

get_KeySize

System.Net.Sockets

virtualKey

KeyboardHookDelegate

get_Msg

Debugger.My.Resources

System.Resources

get_CMemoryExecute

get_WebBrowserPassView

WebBrowserPassView

System.Configuration

8.0.0.0

My.Computer

My.Application

My.User

My.Forms

My.WebServices

System.Windows.Forms.Form

My.MyProject.Forms

4System.Web.Services.Protocols.SoapHttpClientProtocol

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

10.0.0.0

My.Settings

$e48811ca-8af8-4e73-85dd-2045b9cca73a

_CorExeMain

%%0.ÃŸ

Apple Computer\Preferences\keychain.plist

LoadPasswordsIE

LoadPasswordsFirefox

LoadPasswordsChrome

LoadPasswordsOpera

LoadPasswordsSafari

LoadPasswordsSeaMonkey

UseFirefoxProfileFolder

UseFirefoxInstallFolder

UseChromeProfileFolder

UseOperaPasswordFile

FirefoxProfileFolder

FirefoxInstallFolder

ChromeProfileFolder

OperaPasswordFile

Aadvapi32.dll

crypt32.dll

777705555443332

5555443332

wand.dat

@nss3.dll

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe

%programfiles%\Sea Monkey

%programfiles%\Mozilla Firefox

-signons.txt

signons2.txt

signons3.txt

@dllhost.exe

taskhost.exe

taskhostex.exe

Microsoft\Windows\WebCache\WebCacheV01.dat

Microsoft\Windows\WebCache\WebCacheV24.dat

index.dat

hXXps://VVV.google.com/accounts/servicelogin

hXXp://VVV.facebook.com/

hXXps://login.yahoo.com/config/login

hXXp://

hXXps://

PTF://

@history.dat

places.sqlite

Mozilla\Firefox\Profiles

Mozilla\SeaMonkey\Profiles

Mozilla\SeaMonkey

Mozilla\Firefox

profiles.ini

Profile%d

tntdll.dll

sWeb Data

Login Data

Google\Chrome\User Data

Google\Chrome SxS\User Data

Opera\Opera\wand.dat

Opera\Opera7\profile\wand.dat

Opera

@"%s"

Ashell32.dll

\nss3.dll

.save

vaultcli.dll

abe2869f-9b47-4cd9-a358-c22904dba7f7

Copy &Password

&HTML Report - All Items

HTML R&eport - Selected Items

HTML Report - All Items

HTML Report - Selected Items

Load Passwords From...

Google Chrome

Mozilla Firefox

SeaMonkey

Firefox Options

Master password:

Firefox Profile:

Firefox Installation:

Chrome Options

Opera Options

wand.dat file:

%d Passwords

, %d Selected

Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat)

Loading... %d

KeePass csv file

Opera Password File

Firefox 1.x

Firefox 2.x

Firefox 3.0

Firefox

Chrome

Web Browser

Password

Password Strength

Password Field

WebBrowserPassView.exe

VVV.google.com/Please log in to your Gmail account

VVV.google.com:443/Please log in to your Gmail account

VVV.google.com/Please log in to your Google Account

VVV.google.com:443/Please log in to your Google Account

VVV.google.com

dWindowsLive:name=*

82BD0E67-9FEA-4748-8672-D5EFE5B779B0

Copy Password

%d items

Select Eudora.ini filename/Select the location of Thunderbird installation

Eudora.ini file

SMTP

Windows Mail

Windows Live Mail

Server Port

SMTP Server Port

Mail Password Recovery

mailpv.exe

3, 7 #,)

2400000

MessageBoxIcon.Error

noftp

filename.exe

hXXp://VVV.example.com/directory/file.exe

Disablecmd

\Windows Update.exe

\WindowsUpdate.exe

SysInfo.txt

\pid.txt

\pidloc.txt

\Mozilla\Firefox\Profiles

127.0.0.1

\SteamAppData.vdf

\ClientRegistry.blob

MessageBoxIcon.Exclamation

Keylogger Enabled:

Operating System:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

autorun.inf

open=Sys.exe

Sys.exe

Software\Microsoft\Windows\CurrentVersion\Run

Windows Update

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Microsoft.NET\Framework\v2.0.50727\vbc.exe

holdermail.txt"

holdermail.txt

Operating System Intel Recovery

Operating System Platform:

Operating System Version:

WEB Browser Password Recovery

Mail Messenger Password Recovery

Jdownloader Password Recovery

holderwb.txt"

holderwb.txt

\.minecraft\lastlogin

There is a file attached to this email containing Minecraft username and password download it then decrypt the login information with my Minecraft Decryptor

Logger - Key Recorder - [

Keylogger Log

.jpeg

Logger_KeyLog_

hXXp://whatismyipaddress.com/

Debugger.Resources

:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Document00000pdf.exe_1512_rwx_00400000_00084000: