Trojan.Generic.11422296_d93f08d354 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1520
WSCollect.exe:1012

The Trojan injects its code into the following process(es):

WSCollect.exe:244
adobe.snr.patch-painter.exe:676

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1520 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\adobe.snr.patch-painter.exe (1830 bytes)
%Program Files%\WSCollect.exe (7433 bytes)

The process WSCollect.exe:244 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\pid.txt (3 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (30 bytes)

Registry activity

The process %original file name%.exe:1520 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "06 F1 C5 8F E7 8C C8 E3 86 52 83 85 30 1C 74 50"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%]
"WSCollect.exe" = "Universal Adobe Patcher"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data]
"adobe.snr.patch-painter.exe" = "Universal Adobe Patcher"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process WSCollect.exe:244 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1B 3E 3A B5 E3 E9 24 20 B6 43 40 B9 DA 7B 77 8F"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\WSCollect\DEBUG]
"Trace Level" = ""

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\WSCollect\DEBUG]
"Trace Level"

The process WSCollect.exe:1012 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D7 4E 85 77 7E 45 33 F2 D5 1B ED 66 D9 B7 2D 8C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WSCollect" = "%Program Files%\WSCollect.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WSCollect" = "%Program Files%\WSCollect.exe"

The process adobe.snr.patch-painter.exe:676 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A 9A AC B7 29 1D 98 6A 89 03 C9 CE 95 6E 2E F1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1520
WSCollect.exe:1012
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Application Data\adobe.snr.patch-painter.exe (1830 bytes)
%Program Files%\WSCollect.exe (7433 bytes)
%Documents and Settings%\%current user%\Application Data\pid.txt (3 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (30 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WSCollect" = "%Program Files%\WSCollect.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WSCollect" = "%Program Files%\WSCollect.exe"
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: PainteR
Product Name: Universal Adobe Patcher
Product Version: 1.1.0.0
Legal Copyright: PainteR
Legal Trademarks:
Original Filename: adobesnr.exe
Internal Name: Universal Adobe Patcher
File Version: 1.1.0.0
File Description: Universal Adobe Patcher
Comments:
Language: English (United States)

Company Name: PainteR Product Name: Universal Adobe PatcherProduct Version: 1.1.0.0Legal Copyright: PainteR Legal Trademarks: Original Filename: adobesnr.exeInternal Name: Universal Adobe PatcherFile Version: 1.1.0.0File Description: Universal Adobe PatcherComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	1061828	1064960	5.5433	527887ec0149809ff867a8662e29fa06
.rsrc	1073152	20812	24576	3.43999	20fd70c993093037645eecb010d84e1b
.reloc	1097728	12	4096	0.011373	4236a66bef8cef8c12c7ffb05a11c899

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

adobe.snr.patch-painter.exe_676:

`.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

EInvalidGraphicOperation

Uh.SB

USER32.DLL

comctl32.dll

uxtheme.dll

PasswordChar,

OnKeyDown|

OnKeyPress0

OnKeyUpT

ssHorizontal

OnKeyUpt

Proportional

%s%s%s%s%s%s%s%s%s%s

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyworddpA

crSQLWait

%s (%s)

Uh.FD

imm32.dll

AutoHotkeysL

AutoHotkeys

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview@

WindowStatex

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

Uh!%F

1.0.4

MAPI32.DLL

ole32.dll

olepro32.dll

1.2.3

Invalid ZStream operation!

Options.dat

msimg32.dll

TacMDIWnd

Uh.QI

r.uXh

user32.dll

Cannot load image. %s not supported for %s files.

Cannot load image. Palette in %s file is invalid.

Cannot load image. Invalid or unexpected %s image format.

Cannot load image. CRC error found in %s file.

Cannot load image. Extra compressed data found in %s file.

Cannot load image. Compression error found in %s file.

Invalid color format in %s file.

3333333

Conversion between indexed and non-indexed pixel formats is not supported.

Portable network graphics (AlphaControls)

MenuSupport

c:\Skins

WEBBUTTON

1.tmp

.JPEG

2.tmp

" skin. Please, update a skins to latest or link with the AlphaControls support for upgrading of existing skin.

This version of the skin have not complete support by used AlphaControls package release.

TacMenuSupport

TacMenuSupportX

Webdings

DWMAPI.DLL

acMDIIcons

f;p.tI

abcexport

Compression Rate: %d %%

com.adobe.muse.csi

com.adobe.muse.framework.analytics

com.adobe.muse.framework.headlights

com.adobe.common.utils

flash.events

VVV.adobe.com/go/

helpx.adobe.com

com.adobe.muse.csi.CSIMgr

amtlib.dll

Adobe\Adobe After Effects CC 2014\Support Files\

Adobe\Adobe Illustrator CC 2014\Support Files\Contents\Windows\

Adobe\Adobe Illustrator CC 2014 (32 Bit)\Support Files\Contents\Windows\

Adobe\Adobe After Effects CC\Support Files\

Adobe\Adobe Flash Builder 4.7 (64 Bit)\eclipse\plugins\com.adobe.flexide.amt_4.7.0.349722\os\win32\x86_64\

Adobe\Adobe Illustrator CC (64 Bit)\Support Files\Contents\Windows\

lightroom.exe

Adobe\Adobe Illustrator CC\Support Files\Contents\Windows\

MuseOnAIR.swf

Adobe\Adobe After Effects CS6\Support Files\

Adobe\Adobe Illustrator CS6 (64 Bit)\Support Files\Contents\Windows\

Adobe\Adobe Flash Builder 4.6\eclipse\plugins\com.adobe.flexide.amt_4.6.1.335153\os\win32\x86\

Adobe\Adobe Illustrator CS6\Support Files\Contents\Windows\

Adobe\Adobe After Effects CS5.5\Support Files\

Adobe\Adobe Flash Builder 4.5\eclipse\plugins\com.adobe.flexide.amt_4.5.0.308971\os\win32\x86\

Adobe\Adobe Flash Catalyst CS5.5\plugins\com.adobe.flexide.amt_1.5.0.308731\os\win32\x86\

Adobe\Adobe Illustrator CS5.1\Support Files\Contents\Windows\

Adobe\Adobe After Effects CS5\Support Files\

Adobe\Adobe Flash Builder 4\plugins\com.adobe.flexide.amt_4.0.0.272416\os\win32\x86\

Adobe\Adobe Flash Catalyst CS5\plugins\com.adobe.flexide.amt_1.0.0.273393\os\win32\x86\

Adobe\Adobe Illustrator CS5\Support Files\Contents\Windows\

Adobe\Adobe After Effects CS4\Support Files\

Adobe\Adobe Illustrator CS4\Support Files\Contents\Windows\

Patch for activation %s.

Patch to disable the enter Adobe ID requests in %s.

%s pattern : %s

ai_cc_about_tryout.png

ai_cc_about.png

ai_cc_about_tryout@2x.png

ai_cc_about@2x.png

ai_cc_splash_tryout.png

ai_cc_splash.png

ai_cc_splash_tryout@2x.png

ai_cc_splash@2x.png

ai_cs6_splash_tryout.png

ai_cs6_splash.png

ai_about_tryout.png

ai_about.png

AI_SplashTryout.png

AI_Splash.png

Warning: Current operating system does not support 64-bit applications!

"5!5!`"`"

)|'|'u%u%

%"%"%($($

!u%u%g'g'g'g'g'g'w'w'

$c%c%

2!2!|!|!

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

UrlMon

%sPopupClndr

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

SkinData.SkinSection

BoundLabel.Indent

BoundLabel.Font.Charset

BoundLabel.Font.Color

BoundLabel.Font.Height

BoundLabel.Font.Name

BoundLabel.Font.Style

BoundLabel.Layout

BoundLabel.MaxWidth

BoundLabel.UseSkinColor

AddedTitle.Font.Charset

AddedTitle.Font.Color

AddedTitle.Font.Height

AddedTitle.Font.Name

AddedTitle.Font.Style

Items.Strings

AnimEffects.BlendOnMoving.Active

AnimEffects.BlendOnMoving.Time

$AnimEffects.BlendOnMoving.BlendValue

AnimEffects.DialogShow.Time

AnimEffects.DialogShow.Mode

AnimEffects.FormShow.Time

AnimEffects.FormShow.Mode

AnimEffects.FormHide.Time

AnimEffects.FormHide.Mode

AnimEffects.DialogHide.Time

AnimEffects.DialogHide.Mode

AnimEffects.PageChange.Time

ButtonHuge.bmpX7

.bmp&m

c]t%s

Master.bmp&m

0kÃ–o&

*Gq-g}

0~-66.>!!>.66

Edit.png

K&\.JF

Glow.pngVN

E>E.OO

painter.png

Window.pngha

Bp.oN

`>%S,

MenuSupport.IcoLineSkin

ICOLINE!MenuSupport.ExtraLineFont.Charset

MenuSupport.ExtraLineFont.Color

clWindowText MenuSupport.ExtraLineFont.Height

MenuSupport.ExtraLineFont.Name

MenuSupport.ExtraLineFont.Style

ThirdParty.ThirdEdits

ThirdParty.ThirdButtons

ThirdParty.ThirdBitBtns

ThirdParty.ThirdCheckBoxes

ThirdParty.ThirdGroupBoxes

ThirdParty.ThirdListViews

ThirdParty.ThirdPanels

ThirdParty.ThirdGrids

ThirdParty.ThirdTreeViews

ThirdParty.ThirdComboBoxes

ThirdParty.ThirdWWEdits

ThirdParty.ThirdVirtualTrees

ThirdParty.ThirdGridEh

ThirdParty.ThirdPageControl

ThirdParty.ThirdTabControl

ThirdParty.ThirdToolBar

ThirdParty.ThirdStatusBar

ThirdParty.ThirdSpeedButton

ThirdParty.ThirdScrollControl

ThirdParty.ThirdUpDown

ThirdParty.ThirdScrollBar

Constraints.MinHeight

Constraints.MinWidth

TsShellTreeView

sShellTreeView1

sShellTreeView1Change

BoundLabel.Active

BoundLabel.Caption

VertScrollBar.Tracking

KeyPreview

OnKeyPress

FormKeyPress

Constraints.MaxHeight

Constraints.MaxWidth

Glyph.Data

Brush.Color

Pen.Style

GlyphMode.Grayed

Colors.Strings

sEditHexKeyPress

OnKeyDown

FormKeyDown

GetCPInfo

RegOpenKeyExA

RegCloseKey

SetViewportOrgEx

GetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

GetKeyboardType

.idata

.rdata

P.reloc

P.rsrc

.tlsWdJ

version="1.1.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

true

KERNEL32.DLL

advapi32.dll

comdlg32.dll

gdi32.dll

shell32.dll

version.dll

winmm.dll

Add to custom colors set8Listbox (%s) style must be virtual in order to set Count

Error setting %s.Count

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

No help keyword specified.

Text exceeds memo capacity/Menu '%s' is already being used by another form

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Unable to insert a line Clipboard does not support Icons

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Invalid property element: %s

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

"Variant method calls not supported

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

1.1.0.0

adobesnr.exe

adobe.snr.patch-painter.exe_676_rwx_00401000_0016E000:

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

EInvalidGraphicOperation

Uh.SB

USER32.DLL

comctl32.dll

uxtheme.dll

PasswordChar,

OnKeyDown|

OnKeyPress0

OnKeyUpT

ssHorizontal

OnKeyUpt

Proportional

%s%s%s%s%s%s%s%s%s%s

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyworddpA

crSQLWait

%s (%s)

Uh.FD

imm32.dll

AutoHotkeysL

AutoHotkeys

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview@

WindowStatex

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

Uh!%F

1.0.4

MAPI32.DLL

ole32.dll

olepro32.dll

1.2.3

Invalid ZStream operation!

Options.dat

msimg32.dll

TacMDIWnd

Uh.QI

r.uXh

user32.dll

Cannot load image. %s not supported for %s files.

Cannot load image. Palette in %s file is invalid.

Cannot load image. Invalid or unexpected %s image format.

Cannot load image. CRC error found in %s file.

Cannot load image. Extra compressed data found in %s file.

Cannot load image. Compression error found in %s file.

Invalid color format in %s file.

3333333

Conversion between indexed and non-indexed pixel formats is not supported.

Portable network graphics (AlphaControls)

MenuSupport

c:\Skins

WEBBUTTON

1.tmp

.JPEG

2.tmp

" skin. Please, update a skins to latest or link with the AlphaControls support for upgrading of existing skin.

This version of the skin have not complete support by used AlphaControls package release.

TacMenuSupport

TacMenuSupportX

Webdings

DWMAPI.DLL

acMDIIcons

f;p.tI

abcexport

Compression Rate: %d %%

com.adobe.muse.csi

com.adobe.muse.framework.analytics

com.adobe.muse.framework.headlights

com.adobe.common.utils

flash.events

VVV.adobe.com/go/

helpx.adobe.com

com.adobe.muse.csi.CSIMgr

amtlib.dll

Adobe\Adobe After Effects CC 2014\Support Files\

Adobe\Adobe Illustrator CC 2014\Support Files\Contents\Windows\

Adobe\Adobe Illustrator CC 2014 (32 Bit)\Support Files\Contents\Windows\

Adobe\Adobe After Effects CC\Support Files\

Adobe\Adobe Flash Builder 4.7 (64 Bit)\eclipse\plugins\com.adobe.flexide.amt_4.7.0.349722\os\win32\x86_64\

Adobe\Adobe Illustrator CC (64 Bit)\Support Files\Contents\Windows\

lightroom.exe

Adobe\Adobe Illustrator CC\Support Files\Contents\Windows\

MuseOnAIR.swf

Adobe\Adobe After Effects CS6\Support Files\

Adobe\Adobe Illustrator CS6 (64 Bit)\Support Files\Contents\Windows\

Adobe\Adobe Flash Builder 4.6\eclipse\plugins\com.adobe.flexide.amt_4.6.1.335153\os\win32\x86\

Adobe\Adobe Illustrator CS6\Support Files\Contents\Windows\

Adobe\Adobe After Effects CS5.5\Support Files\

Adobe\Adobe Flash Builder 4.5\eclipse\plugins\com.adobe.flexide.amt_4.5.0.308971\os\win32\x86\

Adobe\Adobe Flash Catalyst CS5.5\plugins\com.adobe.flexide.amt_1.5.0.308731\os\win32\x86\

Adobe\Adobe Illustrator CS5.1\Support Files\Contents\Windows\

Adobe\Adobe After Effects CS5\Support Files\

Adobe\Adobe Flash Builder 4\plugins\com.adobe.flexide.amt_4.0.0.272416\os\win32\x86\

Adobe\Adobe Flash Catalyst CS5\plugins\com.adobe.flexide.amt_1.0.0.273393\os\win32\x86\

Adobe\Adobe Illustrator CS5\Support Files\Contents\Windows\

Adobe\Adobe After Effects CS4\Support Files\

Adobe\Adobe Illustrator CS4\Support Files\Contents\Windows\

Patch for activation %s.

Patch to disable the enter Adobe ID requests in %s.

%s pattern : %s

ai_cc_about_tryout.png

ai_cc_about.png

ai_cc_about_tryout@2x.png

ai_cc_about@2x.png

ai_cc_splash_tryout.png

ai_cc_splash.png

ai_cc_splash_tryout@2x.png

ai_cc_splash@2x.png

ai_cs6_splash_tryout.png

ai_cs6_splash.png

ai_about_tryout.png

ai_about.png

AI_SplashTryout.png

AI_Splash.png

Warning: Current operating system does not support 64-bit applications!

"5!5!`"`"

)|'|'u%u%

%"%"%($($

!u%u%g'g'g'g'g'g'w'w'

$c%c%

2!2!|!|!

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

UrlMon

%sPopupClndr

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

SkinData.SkinSection

BoundLabel.Indent

BoundLabel.Font.Charset

BoundLabel.Font.Color

BoundLabel.Font.Height

BoundLabel.Font.Name

BoundLabel.Font.Style

BoundLabel.Layout

BoundLabel.MaxWidth

BoundLabel.UseSkinColor

AddedTitle.Font.Charset

AddedTitle.Font.Color

AddedTitle.Font.Height

AddedTitle.Font.Name

AddedTitle.Font.Style

Items.Strings

AnimEffects.BlendOnMoving.Active

AnimEffects.BlendOnMoving.Time

$AnimEffects.BlendOnMoving.BlendValue

AnimEffects.DialogShow.Time

AnimEffects.DialogShow.Mode

AnimEffects.FormShow.Time

AnimEffects.FormShow.Mode

AnimEffects.FormHide.Time

AnimEffects.FormHide.Mode

AnimEffects.DialogHide.Time

AnimEffects.DialogHide.Mode

AnimEffects.PageChange.Time

ButtonHuge.bmpX7

.bmp&m

c]t%s

Master.bmp&m

0kÃ–o&

*Gq-g}

0~-66.>!!>.66

Edit.png

K&\.JF

Glow.pngVN

E>E.OO

painter.png

Window.pngha

Bp.oN

`>%S,

MenuSupport.IcoLineSkin

ICOLINE!MenuSupport.ExtraLineFont.Charset

MenuSupport.ExtraLineFont.Color

clWindowText MenuSupport.ExtraLineFont.Height

MenuSupport.ExtraLineFont.Name

MenuSupport.ExtraLineFont.Style

ThirdParty.ThirdEdits

ThirdParty.ThirdButtons

ThirdParty.ThirdBitBtns

ThirdParty.ThirdCheckBoxes

ThirdParty.ThirdGroupBoxes

ThirdParty.ThirdListViews

ThirdParty.ThirdPanels

ThirdParty.ThirdGrids

ThirdParty.ThirdTreeViews

ThirdParty.ThirdComboBoxes

ThirdParty.ThirdWWEdits

ThirdParty.ThirdVirtualTrees

ThirdParty.ThirdGridEh

ThirdParty.ThirdPageControl

ThirdParty.ThirdTabControl

ThirdParty.ThirdToolBar

ThirdParty.ThirdStatusBar

ThirdParty.ThirdSpeedButton

ThirdParty.ThirdScrollControl

ThirdParty.ThirdUpDown

ThirdParty.ThirdScrollBar

Constraints.MinHeight

Constraints.MinWidth

TsShellTreeView

sShellTreeView1

sShellTreeView1Change

BoundLabel.Active

BoundLabel.Caption

VertScrollBar.Tracking

KeyPreview

OnKeyPress

FormKeyPress

Constraints.MaxHeight

Constraints.MaxWidth

Glyph.Data

Brush.Color

Pen.Style

GlyphMode.Grayed

Colors.Strings

sEditHexKeyPress

OnKeyDown

FormKeyDown

GetCPInfo

RegOpenKeyExA

RegCloseKey

SetViewportOrgEx

GetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

GetKeyboardType

.idata

.rdata

P.reloc

P.rsrc

Add to custom colors set8Listbox (%s) style must be virtual in order to set Count

Error setting %s.Count

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

No help keyword specified.

Text exceeds memo capacity/Menu '%s' is already being used by another form

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Unable to insert a line Clipboard does not support Icons

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Invalid property element: %s

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

"Variant method calls not supported

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

WSCollect.exe_244:

.text

`.rsrc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

v2.0.50727

CMemoryExecute.dll

CMemoryExecute

PAGE_EXECUTE_READWRITE

.ctor

System.Reflection

System.Runtime.InteropServices

System.Security.Permissions

System.Diagnostics

System.Runtime.CompilerServices

DllImportAttribute

kernel32.dll

ntdll.dll

System.Security

$8fcd4931-91a2-4e18-849b-70de34ab75df

1.0.0.0

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb

mscoree.dll

`.rdata

@.data

.rsrc

D$.SPf

2 34 567

com.apple.Safari

com.apple.WebKit2WebProcess

SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins

"Account","Login Name","Password","Web Site","Comments"

3.7.5

SQLite format 3

CREATE TABLE sqlite_master(

sql text

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins

PK11_GetInternalKeySlot

PK11_CheckUserPassword

large file support is disabled

unknown operation

SQL logic error or missing database

foreign_keys

sqlite_compileoption_get

sqlite_compileoption_used

sqlite_source_id

sqlite_version

sqlite_attach

sqlite_detach

sqlite_stat1

sqlite_rename_parent

sqlite_rename_trigger

sqlite_rename_table

%Y-%m-%d %H:%M:%S

%Y-%m-%d

%H:%M:%S

SQLITE_

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

%s-shm

%s\etilqs_

OsError 0x%x (%u)

Recovered %d frames from WAL file %s

%s-mjX

foreign key constraint failed

unable to use function %s in the requested context

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

statement aborts at %d: [%s] %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

oversized integer: %s%s

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

%s OR name=%Q

type='trigger' AND (%s)

there is already another table or index with this name: %s

sqlite_

table %s may not be altered

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE tbl=%Q

SELECT tbl, idx, stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s %T cannot reference objects in database %s

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

no such collation sequence: %s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

view %s is circularly defined

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

a JOIN clause is required before %s

unable to identify the object to be reindexed

table %s may not be modified

cannot modify %s because it is a view

foreign key mismatch

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

PRIMARY KEY must be unique

automatic extension loading failed: %s

foreign_key_list

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

%s.%s

%s:%d

no such index: %s

sqlite_subquery_%p_

no such table: %s

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

at most %d tables in a join

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unable to close due to unfinished backup operation

unknown database: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

sqlite3_open

sqlite3_prepare

sqlite3_step

sqlite3_column_text

sqlite3_column_int

sqlite3_column_int64

sqlite3_finalize

sqlite3_close

sqlite3_exec

f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb

msvcrt.dll

_wcmdln

COMCTL32.dll

VERSION.dll

FindCloseUrlCache

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

WININET.dll

GetWindowsDirectoryW

KERNEL32.dll

EnumChildWindows

USER32.dll

GDI32.dll

comdlg32.dll

RegCloseKey

RegOpenKeyExW

RegEnumKeyExW

ADVAPI32.dll

ShellExecuteW

SHELL32.dll

ole32.dll

5JEw%Xg

hXXp://VVV.usertrust.com1

3hXXp://crl.usertrust.com/AddTrustExternalCARoot.crl05

hXXp://ocsp.usertrust.com0

1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl05

1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl0t

1hXXp://crt.usertrust.com/UTNAddTrustObject_CA.crt0%

hXXps://secure.comodo.net/CPS0A

0hXXp://crl.comodoca.com/COMODOCodeSigningCA2.crl0r

0hXXp://crt.comodoca.com/COMODOCodeSigningCA2.crt0$

hXXp://ocsp.comodoca.com0

support@nirsoft.net0

t{SSh

v%SSW

Mail PassView

Mozilla\Profiles

Software\Mozilla\Mozilla Thunderbird

%s\Main

sqlite3.dll

nss3.dll

%programfiles%\Mozilla Thunderbird

AddExportHeaderLine

%s %s %s

HTTPMail User Name

SMTP USer Name

HTTPMail Server

SMTP Server

POP3 Password2

IMAP Password2

HTTPMail Password2

SMTP Password2

POP3 Port

IMAP Port

HTTPMail Port

SMTP Port

HTTPMail Secure Connection

SMTP Secure Connection

SMTP Display Name

SMTP Email Address

POP3 Password

IMAP Password

HTTP Password

SMTP Password

HTTP User

SMTP User

HTTP Server URL

HTTP Port

HTTPMail Use SSL

SMTP Use SSL

%s\%s

PopPort

PopPassword

SMTPAccount

SMTPServer

SMTPPort

SMTPLogSecure

SMTPPassword

%s\Accounts

LoginName

SavePasswordText

ESMTPUsername

ESMTPPassword

POP3Password

fb.dat

%s@gmail.com

%s@yahoo.com

Software\Microsoft\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

%s %s

smtp

advapi32.dll

comctl32.dll

*.ini

netmsg.dll

Error %d: %s

%s (%s)

menu_%d

dialog_%d

TranslatorURL

_lng.ini

%-18s: %s

%%-%d.%ds

%s

%s%s

bgcolor="%s"

%s

%s%s>

%s>

report.html

*.txt

*.htm;*.html

*.xml

*.csv

Software\NirSoft\MailPassView

MailPassView

/skeepass

/deleteregkey

Failed to load the executable file !

mail.account.account

mail.server

port

mail.identity

signon.signonfilename

mailbox://%s@%s

imap://%s@%s

mailbox://%s

imap://%s

signons.txt

signons.sqlite

prefs.js

Password.NET Messenger Service

User.NET Messenger Service

Passport.Net\*

ps:password

windowslive:name=

Exception %8.8X at address %8.8X in module %s

Stack Data: %s

Code Data: %s

mozsqlite3.dll

psapi.dll

pstorec.dll

5e7e8100-9138-11d1-945a-00c04fc308ff

00000000-0000-0000-0000-000000000000

220D5CD0-853A-11D0-84BC-00C04FD43F8F

220D5CD1-853A-11D0-84BC-00C04FD43F8F

220D5CC1-853A-11D0-84BC-00C04FD43F8F

417E2D75-84BD-11D0-84BB-00C04FD43F8F

shell32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

shlwapi.dll

%s%s

%s

size="%d"

color="#%s"

width="%s"

%s%s%s

SOFTWARE\Mozilla

mozilla

%s\bin

PathToExe

\sqlite3.dll

\mozsqlite3.dll

Software\Microsoft\Windows Mail

Software\Microsoft\Windows Live Mail

SMTP_Server

SMTP_User_Name

POP3_Password2

IMAP_Password2

NNTP_Password2

SMTP_Password2

SMTP_Email_Address

SMTP_Port

NNTP_Port

IMAP_Port

POP3_Port

SMTP_Secure_Connection

*.oeaccount

\Microsoft\Windows Mail

\Microsoft\Windows Live Mail

f:\Projects\VS2005\mailpv\Release\mailpv.pdb

_acmdln

RPCRT4.dll

GetWindowsDirectoryA

RegDeleteKeyA

RegOpenKeyExA

RegEnumKeyA

RegEnumKeyExA

ShellExecuteA

NirSoftPADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD

Debugger.exe

Microsoft.VisualBasic

System.Windows.Forms

System.Drawing

System.Management

tapi32.dll

rtm.dll

user32.dll

Debugger.Debugger.resources

Debugger.Resources.resources

Debugger.My

WindowsFormsApplicationBase

Microsoft.VisualBasic.ApplicationServices

System.ComponentModel

System.CodeDom.Compiler

Microsoft.VisualBasic.Devices

m_MyWebServicesObjectProvider

.cctor

get_WebServices

HelpKeywordAttribute

System.ComponentModel.Design

WebServices

Microsoft.VisualBasic.CompilerServices

System.Collections

ContainsKey

InvalidOperationException

MyWebServices

encryptedpassstring

encryptedsmtpstring

portstring

fakeMSGholder

encryptedftphost

encryptedftpuser

encryptedftppass

useftp

websitevisitor

websiteblocker

passstring

smtpstring

ftphost

ftpuser

ftppass

WM_KEYUP

WM_KEYDOWN

WM_SYSKEYDOWN

WM_SYSKEYUP

KeyboardHandle

KeyLog

CleanedPasswordsMAIL

CleanedPasswordsWB

System.IO

get_ExecutablePath

WindowsIdentity

System.Security.Principal

set_WindowState

FormWindowState

UnhookWindowsHookEx

SetWindowsHookEx

SetWindowsHookExA

GetAsyncKeyState

vKey

HookKeyboard

UnhookKeyboard

Operators

get_Keyboard

Keyboard

get_CtrlKeyDown

get_AltKeyDown

KeyboardCallback

System.Threading

System.Collections.Generic

Microsoft.VisualBasic.MyServices

System.Collections.ObjectModel

MsgBox

MsgBoxResult

MsgBoxStyle

set_WindowStyle

ProcessWindowStyle

ForceSteamLogin

System.Net.NetworkInformation

get_OperationalStatus

OperationalStatus

FakemsgInstall

System.Net.Mail

SmtpClient

System.Globalization

set_Port

System.Net

Microsoft.Win32

RegistryKey

OpenSubKey

System.Security.Cryptography

System.Text

set_Key

stealWebroswers

WebClient

readweb

System.IO.Compression

SendLogsFTP

FtpWebRequest

WebRequest

UploadFTP

secretKey

set_KeySize

get_KeySize

System.Net.Sockets

virtualKey

KeyboardHookDelegate

get_Msg

Debugger.My.Resources

System.Resources

get_CMemoryExecute

get_WebBrowserPassView

WebBrowserPassView

System.Configuration

8.0.0.0

My.Computer

My.Application

My.User

My.Forms

My.WebServices

System.Windows.Forms.Form

My.MyProject.Forms

4System.Web.Services.Protocols.SoapHttpClientProtocol

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

10.0.0.0

My.Settings

$e48811ca-8af8-4e73-85dd-2045b9cca73a

_CorExeMain

%%0.ÃŸ

Apple Computer\Preferences\keychain.plist

LoadPasswordsIE

LoadPasswordsFirefox

LoadPasswordsChrome

LoadPasswordsOpera

LoadPasswordsSafari

LoadPasswordsSeaMonkey

UseFirefoxProfileFolder

UseFirefoxInstallFolder

UseChromeProfileFolder

UseOperaPasswordFile

FirefoxProfileFolder

FirefoxInstallFolder

ChromeProfileFolder

OperaPasswordFile

Aadvapi32.dll

crypt32.dll

777705555443332

5555443332

wand.dat

@nss3.dll

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe

%programfiles%\Sea Monkey

%programfiles%\Mozilla Firefox

-signons.txt

signons2.txt

signons3.txt

@dllhost.exe

taskhost.exe

taskhostex.exe

Microsoft\Windows\WebCache\WebCacheV01.dat

Microsoft\Windows\WebCache\WebCacheV24.dat

index.dat

hXXps://VVV.google.com/accounts/servicelogin

hXXp://VVV.facebook.com/

hXXps://login.yahoo.com/config/login

hXXp://

hXXps://

PTF://

@history.dat

places.sqlite

Mozilla\Firefox\Profiles

Mozilla\SeaMonkey\Profiles

Mozilla\SeaMonkey

Mozilla\Firefox

profiles.ini

Profile%d

tntdll.dll

sWeb Data

Login Data

Google\Chrome\User Data

Google\Chrome SxS\User Data

Opera\Opera\wand.dat

Opera\Opera7\profile\wand.dat

Opera

@"%s"

Ashell32.dll

\nss3.dll

.save

vaultcli.dll

abe2869f-9b47-4cd9-a358-c22904dba7f7

Copy &Password

&HTML Report - All Items

HTML R&eport - Selected Items

HTML Report - All Items

HTML Report - Selected Items

Load Passwords From...

Google Chrome

Mozilla Firefox

SeaMonkey

Firefox Options

Master password:

Firefox Profile:

Firefox Installation:

Chrome Options

Opera Options

wand.dat file:

%d Passwords

, %d Selected

Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat)

Loading... %d

KeePass csv file

Opera Password File

Firefox 1.x

Firefox 2.x

Firefox 3.0

Firefox

Chrome

Web Browser

Password

Password Strength

Password Field

WebBrowserPassView.exe

VVV.google.com/Please log in to your Gmail account

VVV.google.com:443/Please log in to your Gmail account

VVV.google.com/Please log in to your Google Account

VVV.google.com:443/Please log in to your Google Account

VVV.google.com

dWindowsLive:name=*

82BD0E67-9FEA-4748-8672-D5EFE5B779B0

Copy Password

%d items

Select Eudora.ini filename/Select the location of Thunderbird installation

Eudora.ini file

SMTP

Windows Mail

Windows Live Mail

Server Port

SMTP Server Port

Mail Password Recovery

mailpv.exe

3, 7 #,)

MessageBoxIcon.Error

noftp

filename.exe

hXXp://VVV.example.com/directory/file.exe

Disablecmd

\Windows Update.exe

\WindowsUpdate.exe

SysInfo.txt

\pid.txt

\pidloc.txt

\Mozilla\Firefox\Profiles

127.0.0.1

ping -n 1 -w 3000 1.1.1.1

cmd.exe

\SteamAppData.vdf

\ClientRegistry.blob

MessageBoxIcon.Exclamation

Keylogger Enabled:

Operating System:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

autorun.inf

open=Sys.exe

Sys.exe

Software\Microsoft\Windows\CurrentVersion\Run

Windows Update

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

\bitcoin\wallet.dat

_wallet.dat

wallet.dat

Microsoft.NET\Framework\v2.0.50727\vbc.exe

holdermail.txt"

holdermail.txt

Operating System Intel Recovery

Operating System Platform:

Operating System Version:

WEB Browser Password Recovery

Mail Messenger Password Recovery

Jdownloader Password Recovery

holderwb.txt"

holderwb.txt

C:\Users\

_Pin0.jpeg

_Pin1.jpeg

_Pin2.jpeg

_Pin3.jpeg

_Pin4.jpeg

Steals the Wallet.DAT file that holds the users bitcoin currency

\.minecraft\lastlogin

There is a file attached to this email containing Minecraft username and password download it then decrypt the login information with my Minecraft Decryptor

Predator Pain v14 - Key Recorder - [

Keylogger Log

.jpeg

Predator_Pain_v14_KeyLog_

hXXp://whatismyipaddress.com/

Debugger.Resources

:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

This tool collects Windows Store log files

6.3.9600.16384 (winblue_rtm.130821-1623)

WSCollect.exe

Windows

Operating System

6.3.9600.16384

WSCollect.exe_244_rwx_00400000_00084000: