HackTool.Win32.PassView_1fc67634aa – Adaware

Trojan.Win32.Pakes.agxy (Kaspersky), Gen:Variant.MSILKrypt.37 (B) (Emsisoft), Gen:Variant.MSILKrypt.37 (AdAware), HackTool.Win32.PassView.FD, GenericAutorunWorm.YR, HackToolPassView.YR (Lavasoft MAS)Behaviour: Trojan, Worm, HackTool, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 1fc67634aaa893bc87fb8398e564f8fa

SHA1: be7a5a6476b0050c38da63044d8e9b096bec5d31

SHA256: 71dff77cc15a719a56987ff34a4f82d07db6fe9712696fa935bc663756bd88ac

SSDeep: 24576:JQgNFR4skROdakq2Q8tzeNX1l1 UoBSc1 1jZOKInxv4XFzVF8ixU1H5 3:J5kOYk1zcXZ UoSNvBOmFZK

Size: 1335296 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6

Company: Windows

Created at: 2014-04-28 00:11:22

Analyzed on: WindowsXP SP3 32-bit

Summary: HackTool. Can be used to investigate, analyze or compromise the system security. Some HackTools are multi-purpose programs, while others may have legitimate uses.

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the HackTool's file once a user opens a drive's folder in Windows Explorer.

Process activity

The HackTool creates the following process(es):

FB_2.tmp.exe:240
wmiApSrv.exe:2448
AppLaunch.exe:1768
AppLaunch.exe:2460
AppLaunch.exe:2500
%original file name%.exe:1940
vbc.exe:2080
vbc.exe:3632
FB_3.tmp.exe:1864
FB_3.tmp.exe:596
FB_3.tmp.exe:2232
FB_3.tmp.exe:2192
FB_3.tmp.exe:2032
FB_3.tmp.exe:1684
DW20.EXE:2268
DW20.EXE:260

The HackTool injects its code into the following process(es):

SamSs.exe:2052
FB_1.tmp.exe:120
FB_1.tmp.exe:2416
explorer.exe:2252

File activity

The process AppLaunch.exe:1768 makes changes in the file system.

The HackTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FB_3.tmp.exe (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FB_1.tmp.exe (3715 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FB_2.tmp.exe (1616 bytes)

The process AppLaunch.exe:2460 makes changes in the file system.

The HackTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JvKtWbhov4.ini (0 bytes)

The process AppLaunch.exe:2500 makes changes in the file system.

The HackTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JvKtWbhov4.ini (5 bytes)

The process vbc.exe:2080 makes changes in the file system.

The HackTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (2 bytes)

The process FB_1.tmp.exe:120 makes changes in the file system.

The HackTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft FxCop\SamSs.exe (4185 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft FxCop\wmiApSrv.exe (23 bytes)

The process FB_1.tmp.exe:2416 makes changes in the file system.

The HackTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\pid.txt (4 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (42 bytes)

The HackTool deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@ssl.bing[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@rambler[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@money.ca.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@abmr[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@msnportal.112.2o7[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@kaspersky[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.msn[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@aaa[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@twitter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@auto.search.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@microsoft[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.bing[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hit.gemius[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@pass.yandex[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@atdmt[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@kaspersky.122.2o7[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.ca.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@adnxs[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hm.baidu[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@adgear[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.atdmt[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@insurance[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bing[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yandex[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@msn[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yandex[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.bing[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tns-counter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[2].txt (0 bytes)

The process FB_3.tmp.exe:1864 makes changes in the file system.

The HackTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Cab4.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar5.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab6.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Sample.lnk (591 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Application Data\010112.txt (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar7.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\DataWork\iexplore.exe (1281 bytes)

The HackTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Cab4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab6.tmp (0 bytes)

The process FB_3.tmp.exe:596 makes changes in the file system.

The HackTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XP5 - 5-10-2014-3.33.56-AM.gif (4856 bytes)
%Documents and Settings%\%current user%\Application Data\explorer.exe (1281 bytes)

The process DW20.EXE:2268 makes changes in the file system.

The HackTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\BA8CD.dmp (753351 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dw.log (76 bytes)

The process DW20.EXE:260 makes changes in the file system.

The HackTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\dw.log (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B821B.dmp (746941 bytes)

Registry activity

The process FB_2.tmp.exe:240 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AE E5 2C EA 14 67 CB 12 41 3F E8 2D CC D2 F9 D9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process SamSs.exe:2052 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B3 91 1B D5 EF 6B 5A D1 75 F6 5F 20 EC 31 86 9D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process wmiApSrv.exe:2448 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 72 33 5F 8C D3 3A 7E E9 86 0B 41 9A 4F 50 B2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

To automatically run itself each time Windows is booted, the HackTool adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WMI Performance Adapter" = "%Documents and Settings%\%current user%\Application Data\Microsoft FxCop\wmiApSrv.exe"

The process AppLaunch.exe:1768 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 01 FE 86 D3 4A 76 0B 7E F0 49 BB 23 0A F7 90"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"FB_1.tmp.exe" = "Health Key .and. Certificate Management"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"FB_3.tmp.exe" = "FB_3.tmp"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"FB_2.tmp.exe" = "Health Key .and. Certificate Management"

The HackTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The HackTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The HackTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process AppLaunch.exe:2460 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "42 7D B0 8A 7A 9C 4F DF 68 E6 80 E9 AD D6 9A AD"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The HackTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The HackTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The HackTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The HackTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process AppLaunch.exe:2500 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 FF 4C 41 5C 01 86 42 4E 5F 29 39 34 A2 62 57"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The process %original file name%.exe:1940 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "65 03 7B DB 5D 80 74 5B 72 D0 8C 15 63 65 96 FA"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process vbc.exe:2080 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D4 D3 7C 1C 1B CE 7D A6 1C BD 2C 5D C4 35 9D C1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The process vbc.exe:3632 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 AF DC 32 AD FA 7D E1 54 03 FD 0D 33 30 F9 36"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process FB_1.tmp.exe:120 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C 4C 07 F6 91 EB FF 57 D1 1B 33 C6 2E DF 13 34"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\Microsoft FxCop]
"wmiapsrv.exe" = "Application .Layer. Gateway Service"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

The HackTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The HackTool modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The HackTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process FB_1.tmp.exe:2416 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "13 AC B7 C7 25 B1 B6 54 BB C2 8A BF 09 12 80 4E"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\FB_1.tmp\DEBUG]
"Trace Level" = ""

The HackTool deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\FB_1.tmp\DEBUG]
"Trace Level"

The process FB_3.tmp.exe:1864 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF 5D E5 16 B2 8C 1A 95 91 05 19 15 4F A6 07 36"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

The process FB_3.tmp.exe:596 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 AF 3F E3 72 FA 24 EA FD 84 C7 09 DD AA F1 7F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data]
"explorer.exe" = "explorer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

The HackTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The HackTool modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The HackTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process FB_3.tmp.exe:2232 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 55 19 E5 A6 68 67 9F 28 16 63 47 2F 91 6D CD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process FB_3.tmp.exe:2192 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A6 8F 58 9A DB F3 BF E3 04 F1 7A 32 46 D6 F1 E5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process FB_3.tmp.exe:2032 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9E 45 19 79 82 4C DA F6 F4 A2 8F 50 86 2F C2 3F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process FB_3.tmp.exe:1684 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 C4 D1 93 8D D8 9C 94 B6 CF 2C A3 18 C9 EA F6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process DW20.EXE:2268 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B 0E 48 C7 E2 D0 3C 04 D2 AA 0D C4 47 B3 08 ED"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The HackTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process DW20.EXE:260 makes changes in the system registry.

The HackTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C 4B 8F F7 95 0E 96 F7 09 3E 13 36 4A 25 1B 26"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The HackTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
77d9e0abab37b077d5274d5fb3ffa37f	c:\Documents and Settings\"%CurrentUserName%"\Application Data\DataWork\iexplore.exe
391567e9c5bacb4fab187a24dfd0f825	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft FxCop\SamSs.exe
c95cac8b8ad4a70bb99e734cb2ce26eb	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft FxCop\wmiApSrv.exe
77d9e0abab37b077d5274d5fb3ffa37f	c:\Documents and Settings\"%CurrentUserName%"\Application Data\explorer.exe
391567e9c5bacb4fab187a24dfd0f825	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\FB_1.tmp.exe
0f01ee709ef3d81c2bf736ed4237eaa2	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\FB_2.tmp.exe
77d9e0abab37b077d5274d5fb3ffa37f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\FB_3.tmp.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the HackTool's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
FB_2.tmp.exe:240
wmiApSrv.exe:2448
AppLaunch.exe:1768
AppLaunch.exe:2460
AppLaunch.exe:2500
%original file name%.exe:1940
vbc.exe:2080
vbc.exe:3632
FB_3.tmp.exe:1864
FB_3.tmp.exe:596
FB_3.tmp.exe:2232
FB_3.tmp.exe:2192
FB_3.tmp.exe:2032
FB_3.tmp.exe:1684
DW20.EXE:2268
DW20.EXE:260
Delete the original HackTool file.
Delete or disinfect the following files created/modified by the HackTool:
%Documents and Settings%\%current user%\Local Settings\Temp\FB_3.tmp.exe (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FB_1.tmp.exe (3715 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FB_2.tmp.exe (1616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JvKtWbhov4.ini (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft FxCop\SamSs.exe (4185 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft FxCop\wmiApSrv.exe (23 bytes)
%Documents and Settings%\%current user%\Application Data\pid.txt (4 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab4.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar5.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab6.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Sample.lnk (591 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Application Data\010112.txt (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar7.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\DataWork\iexplore.exe (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XP5 - 5-10-2014-3.33.56-AM.gif (4856 bytes)
%Documents and Settings%\%current user%\Application Data\explorer.exe (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BA8CD.dmp (753351 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dw.log (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B821B.dmp (746941 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WMI Performance Adapter" = "%Documents and Settings%\%current user%\Application Data\Microsoft FxCop\wmiApSrv.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description: Health Key .and. Certificate Management
Comments:
Language: English (United States)

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Health Key .and. Certificate ManagementComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	1332612	1332736	5.47173	2e854268e4ada84b8a9a2851518e605d
.rsrc	1343488	1536	1536	2.42876	41c6368a56d7cce293f239c01a41631e
.reloc	1351680	12	512	0.070639	b30366d8c5223a997ea61c68d06f7877

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://a26.ms.akamai.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt
hxxp://whatismyipaddress.com/	66.171.248.172
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt	212.30.134.169
smtp.mail.ru	94.100.180.160
scalar.1eko.com	198.57.167.235

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Type: text/plain

Last-Modified: Wed, 12 Mar 2014 05:29:31 GMT

Accept-Ranges: bytes

ETag: "806f4cbb43dcf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 18

Cache-Control: max-age=6486

Date: Sat, 10 May 2014 00:33:31 GMT

Connection: keep-alive

X-CCC: RU

X-CID: 2

1401CF3DB40B609892HTTP/1.1 200 OK..Content-Type: text/plain..Last-Modified: Wed, 12 Mar 2014 05:29:31 GMT..Accept-Ranges: bytes..ETag: "806f4cbb43dcf1:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Content-Length: 18..Cache-Control: max-age=6486..Date: Sat, 10 May 2014 00:33:31 GMT..Connection: keep-alive..X-CCC: RU..X-CID: 2..1401CF3DB40B609892..

GET / HTTP/1.1

Host: whatismyipaddress.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 10 May 2014 00:34:00 GMT

Server: Apache/2.2.26 (Unix) DAV/2 PHP/5.4.24 mod_ssl/2.2.26 OpenSSL/0.9.8y

X-Powered-By: PHP/5.4.24

Set-Cookie: pt=d4c010b5b8ca52f366f239384e46161f; expires=Sun, 11-May-2014 00:34:00 GMT

Cache-Control: max-age=15

MS-Author-Via: DAV

Vary: Accept-Encoding

Keep-Alive: timeout=15, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html

2407..<!doctype html>.<html lang="en">.<head>..<meta charset="windows-1252">..<meta name="robots" content="noarchive">..<title>What Is My IP Address? IP Address Tools and More</title>..<meta name="description" content="IP address lookup, location, proxy detection, email tracing, IP hiding tips, blacklist check, speed test, and forums. Find, get, and show my IP address.">..<meta name="keywords" content="my ip ,ip, address, my, what, is, find, get, show, locate, change, location, how, do, i, ip address, proxy, server, anonymous, hide, conceal, stealth, surf, web, anonymizer, anonymize, changer, privacy, geolocation, geolocate, lookup, look up, locate, trace, track, email, source, headers">..<meta property="fb:admins" content="607824267" />..<link rel="shortcut icon" href="hXXp://cdn.whatismyipaddress.com/favicon.ico">..<link rel="stylesheet" type="text/css" href="hXXp://cdn.whatismyipaddress.com/css/myip_v4_3.css">..<link rel="publisher" href="hXXps://plus.google.com/ whatismyipaddress">..<link rel="canonical" href="hXXp://whatismyipaddress.com">..<script type="text/javascript">if (top.location!= self.location) {top.location = self.location.href;}</script>..<script type='text/javascript'>...var googletag = googletag || {};...googletag.cmd = googletag.cmd || [];...(function() {...var gads = document.createElement('script');...gads.async = true;...gads.type = 'text/javascript';...var useSSL = 'https:' == document.

<<< skipped >>>

Map

The HackTool connects to the servers at the folowing location(s):

Strings from Dumps

FB_1.tmp.exe_120_rwx_00A2A000_00002000:

.XHyP

DW20.EXE_260:

.text

`.data

.cdata

.rsrc

watson.microsoft.com

.mdmp

%s?szAppName=%S&szAppVer=%S&szAppStamp=%S&szModName=%S&szModVer=%S&szModStamp=%S&fDebug=%S&offset=%S

/dw/stagetwo.asp

%s/%S/%S/%S/%S/%S/%S/%S/%S.htm

Failed to fill report params from generic params

Not offering reporting

%s Mode

Failed to get a reporting destination

Nothing to report from queue

No reports left to send. Removing queue triggers and bailing.

Failed to plug UI; LCID=%u

Ignoring %S due to unknown queue version

Reporting is disabled

SignOff queue reporting is disabled

Queued Reporting Mode called but still want to report to the queue

Bad queue type to report from

No reports for given queue mask - %u

Invalid queue mask - %u

Suspending: Force cancel to queued reporting

Suspending: Force cancel to network reporting

CreateWindowExA failed with %d.

Application Error Reporting %d

WatsonQueuedReportingInstanceVerification

riched20.dll

qMicrosoft\PCHealth\ErrorReporting\DW

msaccess.exe

http://watson.microsoft.com/dw/dcp.asp

http://watson.microsoft.com/dw/watsoninfo.asp

dwintl20.dll

Launching lightweight browser with URL

mshtml.dll

Not reporting

Reporting

DWBypassQueue

DWExplainerURL

DWNoSignOffQueueReporting

DWAlwaysReport

DWReporteeName

DWURLLaunch

DWNoExternalURL

DWStressReport

ole32.dll

imm32.dll

BTLog.dll

Microsoft\PCHealth\ErrorReporting\DW

HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger

http://

https://

Software\Microsoft\PCHealth\ErrorReporting\DW\Debug

%s\%s

https

DwBTLog.log

Failed to get minidump for %S!

szAppName=%s

szAppVer=%d.%d.%d.%d

szAppStamp=x

szModName=%s

szModVer=%d.%d.%d.%d

szModStamp=x

fDebug=%s

offset=x

microsoft.com

.msn.com

.microsoft.com

d:d:d d-d-d

/dw/generictwo.asp

kernel32.dll

psapi.dll

mso.dll

MsoDWRecover%x

MsoDWHang%x

Launching browser with URL

shell32.dll

%d.%d.%d.%d

%d.%d.%d.%d.x.%d.%d

shfolder.dll

unknown.sig

%s dw20.exe %d.%d.%d.%d

RegKey=

ResponseURL=

URLLaunch=

NoExternalURL=

%s:(%s) XX

%s:(%s) X

%s:(%s)

%s:(%s) %s

registry.txt

wql.txt

Windows NT Version %d.%d Build: %d

Stage 1 server response: %s

Stage 2 server response: %s

Stage 4 server response: %s

StatusCode: %d

Opening server: %s

HttpOpen failed.

Opening %s Request:

HTTPS

HttpSend Failed.

HttpWrite Failed, GLE=%d.

HttpEndReq failed.

Count filename length greater than MAX_PATH, can't report.

Filesystem reporting: count file updated

FReportToQueue: GetLastError=%u

FReportToQueue: File Tree Root does not exist: %S

Failed to add heap file to cab: %S

memory.dmp

mdmpmem.hdmp

version.txt

Network reporting complete.

Network reporting failed.

Application Error Reporting Transfer %d

Filesystem reporting complete

Filesystem reporting: cab successfully written

Filesystem reporting: could not find/create directory for cab/count

Filesystem reporting: redirection failure, too many redirects

Filesystem reporting: redirection failure, no previous roots

Filesystem reporting: improper file tree root

Filesystem reporting cancelled

Filesystem reporting: file tree root is too long

Record: 0xxx

Address: 0xxx

Code: 0xx

Flags: 0xx

x:x

(%d.%d:%d.%d)

Checksum: 0xx

Time Stamp: 0xx

Image Base: 0xx

Image Size: 0xx

Module %d

Windows NT %d.%d Build: %d

CPU AMD Feature Code: X

CPU Version: X CPU Feature Code: X

CPU Vendor Code: X - X - X

0xx:

0xx: x x x x

EFlags: 0xx ESP: 0xx SegSs: 0xx

EIP: 0xx EBP: 0xx SegCs: 0xx

EBX: 0xx ECX: 0xx EDX: 0xx

EDI: 0xx ESI: 0xx EAX: 0xx

Thread ID: 0xx

Thread %d

Memory Range %d

Software\Microsoft\PCHealth\ErrorReporting\DW

OkToReportFromTheseQueues

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Failed to obtain queue mutex. GetLastError=%u

FGetQueueMutex: WaitForSingleObject returned %u

Failed to open or create queue mutex. GetLastError=%u

Failed queued reporting pester check

Failed to create run reg key

Persistent run key is set.

CoInitializeEx() returned 0x%x.

Reporting to Admin Queue

Reporting to Regular Queue

Reporting to SignOff Queue

Reporting to Headless Queue

Reporting from Regular Queue

Reporting from SignOff Queue

Reporting from Headless Queue

OOM Failed to alloc QueuedReportData

FAllocSD: GetLastError=%u

%s%s%s

FEnsureQueueDirW: GetLastError=%u

Failed to write snt. GLE: %u

Failed to create snt. GLE: %u

Failed to set info; bad queue type: %u

Failed to open reg key for queue

Failed to get windows folder path for queue: %u

Failed to move instr file from queue A to queue B - %u

Failed to move cab file from queue A to queue B - %u

Did not move any reports from admin q to user q

Did not move any reports from user q to headless q

Queue types that have reports: %u

Setting triggerAtConnectionMade to: %u

Setting triggerAtLogon to: %u

Setting the queue trigger based upon: %u

SUCCESS adding report to queue

Launched (%S)

Failed to store the SensSubscription. hr: %d

failed to allocate PROGID string: %S

Failed putting SubscriberInterface. hr: %d

Failed putting PerUser. hr: %d

Failed putting Enabled. hr: %d

Failed putting MachineName. hr: %d

Failed putting OwnerSID. hr: %d

Failed putting Description. hr: %d

Failed putting InterfaceID. hr: %d

Failed putting EventClassID. hr: %d

Failed putting MethodName. hr: %d

Failed putting SubscriptionName. hr: %d

Failed putting PublisherID. hr: %d

Failed putting SubscriberCLSID. hr: %d

Failed putting SubscriptionID. hr: %d

Failed CoCreateInstance on EventSubscription. hr: %d

Failed to remove the SensSubscription. hr: %d

failed to allocate query string: %S

Failed CoCreateInstance on EventSystem. hr: %d

SENS: StringFromIID() returned <%x>

DWSHARED: SysAllocString(%s) failed!

Failed to subscribe subscription %u. hr: %d

Failed to get data for subscription %u. hr: %d

Failed to query install reg key

Failed to open install reg key

Software\Microsoft\PCHealth\ErrorReporting\DW\Installed

HKEY_USERS\

HKEY_CURRENT_CONFIG\

HKEY_CLASSES_ROOT\

HKEY_LOCAL_MACHINE\

HKEY_CURRENT_USER\

initing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

freeing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

0addref CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

QIing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

releasing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

deleting CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

creating CDwAccessible: hwnd %x, idc %d

WriteAtOffset.Write(0x%x) failed, 0xx

WriteAtOffset.Seek(0x%x) failed, 0xx

WriteMemoryFromProcess.Read(0x%I64x, 0x%x) failed, 0xx

WriteStringToPool.Write(0x%x) failed, 0xx

WriteFunctionTable.RawEntries.Write(0x%x) failed, 0xx

WriteFunctionTable.RawTable.Write(0x%x) failed, 0xx

WriteFunctionTableList.DumpTable.Write(0x%x) failed, 0xx

WriteFunctionTableList.Seek(0x%x) failed, 0xx

WriteDirectoryEntry.Write(0x%x) failed, 0xx

Thread(0x%x) callback returned FALSE

WriteSystemInfo.GetOsCsdString failed, 0xx

WriteSystemInfo.GetCpuInfo failed, 0xx

CalculateSizeForSystemInfo.GetOsCsdString failed, 0xx

WriteHeader.GetCurrentTimeDate failed, 0xx

WriteDirectoryTable.Seek(0x%x) failed, 0xx

WriteMemoryInfo.Write(0x%x) failed, 0xx

WriteMemoryInfo.QueryVirtual(0x%I64x) failed, 0xx

WriteFullMemory virtual memory layout changed, retries %d, 0x%I64x (0x%I64x:0x%I64x) vs. 0x%I64x (0x%I64x:0x%I64x)

WriteFullMemory.Memory.Write(0x%x) failed, 0xx

WriteFullMemory.Memory.Read(0x%I64x, 0x%x) failed, retries %d, 0xx

WriteFullMemory.QueryVirtual(0x%I64x) for data failed, 0xx

WriteFullMemory.Desc.Write(0x%x) failed, 0xx

WriteFullMemory.QueryVirtual(0x%I64x) for info failed, 0xx

Kernel minidump write failed, 0xx

MarshalExceptionPointers.CxRecord.Read(0x%I64x, 0x%x) failed, 0xx

MarshalExceptionPointers.ExRecord.Read(0x%I64x, 0x%x) failed, 0xx

Invalid exception record parameter count (0x%x)

Invalid exception record size (0x%x)

Invalid CPU type (0x%x)

Invalid function table size (0x%x)

GetSystemType.GetOsInfo failed, 0xx

GetSystemType.GetCpuType failed, 0xx

Write.Start failed, 0xx

Dump type requires streaming but output provider does not support streaming

Invalid dump type 0x%x

dbghelp.dll

Alloc(0x%x) failed

Thread(0x%x) will not be included

GenGetImageSections.Section.Read(0x%I64x, 0x%x) failed, 0xx

GenGetImageSections.GenImageNtHeader(0x%I64x) failed

GenGetImageSections.Read(0x%I64x, 0x%x) failed, 0xx

0GenAllocateThreadObject.GetTebInfo(0x%x) failed, 0xx

GenAllocateThreadObject.GetContext(0x%x) failed, 0xx

GenAllocateThreadObject.Open(0x%x) failed, 0xx

GenReadTlsDirectory.Index(0x%I64x, %ws) failed, 0xx

GenReadTlsDirectory(0x%I64x, %ws) unknown machine 0x%x

GenReadTlsDirectory.Read(0x%I64x, %ws) failed, 0xx

GenAllocateModuleObject.GenDebugRecord(0x%I64x, %ws) failed, 0xx

GenAllocateModuleObject.GenImageNtHeader(0x%I64x, %ws) failed, 0xx

GenAllocateModuleObject.GetImageHeaderInfo(0x%I64x, %ws) failed, 0xx

GenAllocateModuleObject.GetVersion(0x%I64x, %ws) failed, 0xx

GenAllocateProcessObject.GetPeb(0x%x) failed, 0xx

GenIncludeUnwindInfoMemory.Enum(0x%I64x, 0x%x) failed, 0xx

GenGenTebMemory.TLS(0x%I64x) failed, 0xx

GenScanAddressSpace.QueryVirtual(0x%I64x) failed, 0xx

0GenGetAuxMemory(%ws) failed, 0xx

GenGetProcessInfo.EnumUnloadedModules(0x%x) failed, 0xx

GenGetProcessInfo.EnumUnloadedModules(0x%x) looped

GenGetProcessInfo.EnumFunctionTableEntries(0x%I64x, 0x%x) failed, 0xx

GenGetProcessInfo.EnumFunctionTables(0x%x) failed, 0xx

GenGetProcessInfo.EnumFunctionTables(0x%x) looped

GenGetProcessInfo.EnumModules(0x%x) failed, 0xx

GenGetProcessInfo.EnumModules(0x%x) looped

GenGetProcessInfo.EnumThreads(0x%x) failed, 0xx

GenGetProcessInfo.EnumThreads(0x%x) looped

GenGetProcessInfo.Start(0x%x) failed, 0xx

GenWriteHandleData.Desc.Write(0x%x) failed, 0xx

GenWriteHandleData.Header.Write(0x%x) failed, 0xx

GenWriteHandleData.ObjectName.Write(0x%x) failed, 0xx

GenWriteHandleData.ObjectNameLen.Write(0x%x) failed, 0xx

GenWriteHandleData.TypeName.Write(0x%x) failed, 0xx

GenWriteHandleData.TypeNameLen.Write(0x%x) failed, 0xx

GenWriteHandleData.Start(0x%x) failed, 0xx

GenWriteHandleData.Seek(0x%x) failed, 0xx

Software\Microsoft\Windows NT\CurrentVersion\MiniDumpAuxiliaryDlls

Software\Microsoft\Windows NT\CurrentVersion\KnownManagedDebuggingDlls

version.dll

ntdll.dll

%$%,%4%<%

S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%

b%c%d%e%f%g%h%i%j%k%l%

!"#$%&'()* ,-./0123456789:;<=

!!!!2222

%%%f||||

!!!!2222||||

!"#$%&'(

'()* ,-./0

&'()* ,-./

&'()* ,-./012345

3456789

.ASex

!"#$%&'()* ,-./012

!"#$%&'()

?msodatad.dat

msodatalast.dat

Unicows.dll

Kernel32.dll

SHLWAPI.DLL

GDI32.DLL

wintrust.dll

1108160

0u.hN

0SSh

t.WWWj

PSSh07

t5SSh(

PSSSSSSh

0SSSSh

ADVAPI32.dll

COMCTL32.dll

GDI32.dll

KERNEL32.dll

OLEACC.dll

OLEAUT32.dll

MSVCRT.dll

RPCRT4.dll

SHELL32.dll

SHLWAPI.dll

urlmon.dll

USER32.dll

VERSION.dll

WININET.dll

RegCloseKey

RegOpenKeyExA

RegCreateKeyExA

ReportEventA

ReportEventW

RegEnumKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyW

GetProcessHeap

GetSystemWindowsDirectoryW

_amsg_exit

_acmdln

ShellExecuteExA

UrlGetPartA

CreateURLMoniker

CreateDialogIndirectParamA

EnumWindows

HttpQueryInfoA

HttpSendRequestExA

HttpOpenRequestA

InternetCanonicalizeUrlA

InternetCrackUrlA

HttpEndRequestA

dw20.pdb

\devsplab1\otools\BBT_TEMP\DW20O.pdb

winword.exe

wwordlt.exe

excel.exe

excellt.exe

mspub.exe

frontpg.exe

outlook.exe

powerpnt.exe

powpntlt.exe

onenote.exe

infopath.exe

winproj.exe

ois.exe

visio.exe

`!`'`)` `

e%f-f|3 f'f/f

]!^"^#^ ^$^

t.uGuHu

x4x7x%x-x x

h&h(h.hMh:h%h h,k/k-k1k4kmk

k%lzmcmdmvm

^Q]Q~NzP}P\PGPCPLPZPIPePvPNPUPuPtPwPOP

]8^6^3^7^

ichczc]eVeQeYeWe_UOeXeUeTe

{1{ {-{/{2{8{

r6s%s4s)s:t*t3t"t%t5t6t4t/t

t&t(t%u&ukuju

WHX%X

`IaJa aEa6a2a.aFa/aOa)a@a bh

d@d%d'd

duewexei

kCpDpJpHpIpEpFp

S$S%S&S'S(S)S S,S.S2S3S5S6S8S:S;SBSFSKSNSOSPSUSVSXSYS[S]S_SbSdSeSgShSiSjSkSmStSvSzS}S~S

U U!U"U#U$U%U(U)U U:U=U?UBUGUIULUSUTUXUYUZU[U]U`UgUhUiUkUlUmUnUoUpUqUrUsUtUxUyUzU

c c!c"c#c$c%c&c'c.c0c1c5c7c?cRcSc[c\c]c^c_c`cacbcccdcfcjclcsctcyc~c

m!m#m$m&mCmDmEmFmGmHmImJmKmLmMmNmOmPmQmRmSmTmUmVmWm[m\m]mkmqmrmsm

nRsSsh

evg%f

m.tRa

gtr%x

Q%SKg

f.ebp>QI

y.yxT

fn:q%uN

aw.Toiz

RMeXe

S#S$S%S;ScSdSrSsStSuS

`!`"`&`'`)`*` `,`-`.`/`0`2`3`4`5`6`:`=`>`?`

^ ^!^"^#^$^%^&^'^.^}^

c c!c"c#c$c%c&c'c*c7c:c;cSc[c1e?e@eAeBeCeDeEe

f f!f"f#f$f%f&f'f(f)f*f f,f-f

m m!m"m#m$m%m&m'm(m)m*m m,m-m.m1m2m3m4m5m6m7m8m9m:m;m<m>m?m@mBmCmDmGmHmImJmKmLmMmNmOmPmQmRmSmTmUm</m>

u u-u.uFuGuHuIuJuKuLuMuNuOuPuQuRuSu

U U!U"U#U$U%U&U'U(U4UJU

](^)^*^ ^,^-^/^0^1^

m/mAmFmVmWmXmYmZm[m\m]m^m_m`mambmcmdmemfmgmhmimjmkmlmmmnmompmqmrmsmtmumvmwmxmymzm{m|m}m~m

x x!x"x#x$x%x'x(x)x*x x,x.x/x0x1x2x3x4x5x6x7x8x9x:x;x<x>x?x@xAxXy_yaycydyeygyiyjykylynyoy</x>

} }!}"}#}$}%}&}'}

] ]!]"]#]$]%]&]'](])]*] ],]-].]/]0]

]2^3^4^5^6^7^8^9^:^;^<^>^

cMeNeOePeQeReSeTeUeWeXeYeZe[e]ebe

X X!X"X#X$X%X&X'X(X)X*X X,X-X.X/X0X1X3X4X6X7X8X9X:X;X<X>X?X@XAXBXCXDXEXFXGXHXJXTX_X`XfXmX</X>

d%d-d0d=dRdad2e\e^e_e`eaecedeeefegeheiejele

s"s#s$s%s&s(s)s,s-s/s0s1s2s3s4s5s6s8s9s>s@sGs

u$u%u&u/ujukulumunuouqurusutu

duewexeyeze{e

~ ~!~"~#~$~%~&~'~(~*~ ~-~8~:~0

| |!|"|#|$|%|&|(|)|*|-|.|/|0|1|2|6|

{3~3}3|3

eZl%u

Q.YeY

R:\Sg|p5rL

e$e#e e4e5e7e6e8eKuHeVeUeMeXe^e]erexei

s4s/s)s%s>sNsOs

s&t*t)t.tbt

2%2.bx

{ | }9},

d6exe9j

]%sOu4](n

m.t.zB}

w%xIyWy

^vcÓv

%f?iCt

U>_.lE

f.ebp

.nrR=

{fn:q%uN

fb_3.tmp.exe

name="Microsoft.Windows.ErrorReporter"

version="5.1.0.0"

publicKeyToken="6595b64144ccf1df" />

<description>Windows Error Reporting</description>

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

1%s\%s\%s\%s\%s\%s\%s\%s

AppName: %s AppVer: %s AppStamp:%s

ModName: %s ModVer: %s ModStamp:%s

fDebug: %s Offset: %s

Main_AlwaysReportBtn=

Main_NoReportBtn=

Main_ReportBtn=

General_Reportee=

CheckBoxRegKey=

ReportingFlags=

Stage1URL=

Stage2URL=

%General_Reportee%

%u %s

%u.%u %s

%s %s %s %s in %s %s %s fDebug %s at offset %s

Bucket: d

BucketTable %d

%s, %s, %s, %s, %s, %s, %s, %s, %s, %s %s

\dw.log

policy.txt

crash.log

status.txt

hits.log

count.txt

%s\%s\%s

%s\%s\%s\%s

eDWQueuedReporting

DWPersistentQueuedReporting

"%s\%s" -%c

dwtrig20.exe

ReportSize=

\*.cab

dwq.snt

"%s" -%c %u

SEventSystem.EventSubscription

SubscriptionID=%s

#$%&%&'(

Comctl32.dll

FB_3.tmp.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\B821B.dmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

.NET Runtime 2.0 Error Reporting

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\dw.log

Microsoft Application Error Reporting

11.0.8160

Windows

DW20.Exe

explorer.exe_2252:

.text

`.rsrc

@.reloc

v2.0.50727

Microsoft.VisualBasic

MyWebServices

KeyboardHookDelegate

Microsoft.VisualBasic.ApplicationServices

.ctor

Microsoft.VisualBasic.Devices

.cctor

get_WebServices

m_MyWebServicesObjectProvider

WebServices

KeyboardHandle

SetWindowsHookEx

SetWindowsHookExA

GetAsyncKeyState

vKey

tapi32.dll

rtm.dll

user32.dll

UpFTP

UpFTPImg

Password

SMTP

Port

wMsg

EnumChildWindows

System.Text

System.Windows.Forms

System.Threading

System.ComponentModel

System.CodeDom.Compiler

System.Diagnostics

Microsoft.VisualBasic.CompilerServices

System.ComponentModel.Design

HelpKeywordAttribute

System.Runtime.CompilerServices

System.Runtime.InteropServices

Operators

Keyboard

get_Keyboard

get_CtrlKeyDown

get_AltKeyDown

System.IO

System.Net

WebClient

MsgBoxResult

MsgBoxStyle

MsgBox

ProcessWindowStyle

get_WindowStyle

Microsoft.VisualBasic.MyServices

get_ExecutablePath

Join

Microsoft.Win32

RegistryKey

OpenSubKey

OperatingSystem

System.Drawing

System.Drawing.Imaging

System.Net.Mail

SmtpClient

System.Collections.ObjectModel

set_Port

System.Security.Cryptography

PasswordDeriveBytes

CryptDeriveKey

set_Key

explorer.exe

8.0.0.0

My.Application

My.WebServices

My.Computer

My.User

4System.Web.Services.Protocols.SoapHttpClientProtocol

_CorExeMain

mscoree.dll

MsgFalse

MsgMsg

http://www.exampleserver.com/directfile.exe

setup.exe

ftp.exampleserver.com

smtp.mail.ru

Application.StartupPath

MsgFalse

Hello, this is a message letting you know that your keylogger has been freshly installed on

http://automation.whatismyip.com/n09230945.asp

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System

DisableCMD

C:\Windows\System32\

.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

127.0.0.1

SOFTWARE\Microsoft\Windows NT\CurrentVersion

Windows Key:

Windows 95

Windows 98

Windows ME

Windows NT

Windows 2K3

Windows Vista

Windows 7

Windows Task Manager

.html

ftp://

FTP information is valid and working!

FTP information is invalid:

Software\Microsoft\Windows\CurrentVersion\

Software\Microsoft\Windows\CurrentVersion\Run

1.0.0.0

DW20.EXE_2268:

.text

`.data

.cdata

.rsrc

watson.microsoft.com

.mdmp

%s?szAppName=%S&szAppVer=%S&szAppStamp=%S&szModName=%S&szModVer=%S&szModStamp=%S&fDebug=%S&offset=%S

/dw/stagetwo.asp

%s/%S/%S/%S/%S/%S/%S/%S/%S.htm

Failed to fill report params from generic params

Not offering reporting

%s Mode

Failed to get a reporting destination

Nothing to report from queue

No reports left to send. Removing queue triggers and bailing.

Failed to plug UI; LCID=%u

Ignoring %S due to unknown queue version

Reporting is disabled

SignOff queue reporting is disabled

Queued Reporting Mode called but still want to report to the queue

Bad queue type to report from

No reports for given queue mask - %u

Invalid queue mask - %u

Suspending: Force cancel to queued reporting

Suspending: Force cancel to network reporting

CreateWindowExA failed with %d.

Application Error Reporting %d

WatsonQueuedReportingInstanceVerification

riched20.dll

qMicrosoft\PCHealth\ErrorReporting\DW

msaccess.exe

http://watson.microsoft.com/dw/dcp.asp

http://watson.microsoft.com/dw/watsoninfo.asp

dwintl20.dll

Launching lightweight browser with URL

mshtml.dll

Not reporting

Reporting

DWBypassQueue

DWExplainerURL

DWNoSignOffQueueReporting

DWAlwaysReport

DWReporteeName

DWURLLaunch

DWNoExternalURL

DWStressReport

ole32.dll

imm32.dll

BTLog.dll

Microsoft\PCHealth\ErrorReporting\DW

HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger

http://

https://

Software\Microsoft\PCHealth\ErrorReporting\DW\Debug

%s\%s

https

DwBTLog.log

Failed to get minidump for %S!

szAppName=%s

szAppVer=%d.%d.%d.%d

szAppStamp=x

szModName=%s

szModVer=%d.%d.%d.%d

szModStamp=x

fDebug=%s

offset=x

microsoft.com

.msn.com

.microsoft.com

d:d:d d-d-d

/dw/generictwo.asp

kernel32.dll

psapi.dll

mso.dll

MsoDWRecover%x

MsoDWHang%x

Launching browser with URL

shell32.dll

%d.%d.%d.%d

%d.%d.%d.%d.x.%d.%d

shfolder.dll

unknown.sig

%s dw20.exe %d.%d.%d.%d

RegKey=

ResponseURL=

URLLaunch=

NoExternalURL=

%s:(%s) XX

%s:(%s) X

%s:(%s)

%s:(%s) %s

registry.txt

wql.txt

Windows NT Version %d.%d Build: %d

Stage 1 server response: %s

Stage 2 server response: %s

Stage 4 server response: %s

StatusCode: %d

Opening server: %s

HttpOpen failed.

Opening %s Request:

HTTPS

HttpSend Failed.

HttpWrite Failed, GLE=%d.

HttpEndReq failed.

Count filename length greater than MAX_PATH, can't report.

Filesystem reporting: count file updated

FReportToQueue: GetLastError=%u

FReportToQueue: File Tree Root does not exist: %S

Failed to add heap file to cab: %S

memory.dmp

mdmpmem.hdmp

version.txt

Network reporting complete.

Network reporting failed.

Application Error Reporting Transfer %d

Filesystem reporting complete

Filesystem reporting: cab successfully written

Filesystem reporting: could not find/create directory for cab/count

Filesystem reporting: redirection failure, too many redirects

Filesystem reporting: redirection failure, no previous roots

Filesystem reporting: improper file tree root

Filesystem reporting cancelled

Filesystem reporting: file tree root is too long

Record: 0xxx

Address: 0xxx

Code: 0xx

Flags: 0xx

x:x

(%d.%d:%d.%d)

Checksum: 0xx

Time Stamp: 0xx

Image Base: 0xx

Image Size: 0xx

Module %d

Windows NT %d.%d Build: %d

CPU AMD Feature Code: X

CPU Version: X CPU Feature Code: X

CPU Vendor Code: X - X - X

0xx:

0xx: x x x x

EFlags: 0xx ESP: 0xx SegSs: 0xx

EIP: 0xx EBP: 0xx SegCs: 0xx

EBX: 0xx ECX: 0xx EDX: 0xx

EDI: 0xx ESI: 0xx EAX: 0xx

Thread ID: 0xx

Thread %d

Memory Range %d

Software\Microsoft\PCHealth\ErrorReporting\DW

OkToReportFromTheseQueues

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Failed to obtain queue mutex. GetLastError=%u

FGetQueueMutex: WaitForSingleObject returned %u

Failed to open or create queue mutex. GetLastError=%u

Failed queued reporting pester check

Failed to create run reg key

Persistent run key is set.

CoInitializeEx() returned 0x%x.

Reporting to Admin Queue

Reporting to Regular Queue

Reporting to SignOff Queue

Reporting to Headless Queue

Reporting from Regular Queue

Reporting from SignOff Queue

Reporting from Headless Queue

OOM Failed to alloc QueuedReportData

FAllocSD: GetLastError=%u

%s%s%s

FEnsureQueueDirW: GetLastError=%u

Failed to write snt. GLE: %u

Failed to create snt. GLE: %u

Failed to set info; bad queue type: %u

Failed to open reg key for queue

Failed to get windows folder path for queue: %u

Failed to move instr file from queue A to queue B - %u

Failed to move cab file from queue A to queue B - %u

Did not move any reports from admin q to user q

Did not move any reports from user q to headless q

Queue types that have reports: %u

Setting triggerAtConnectionMade to: %u

Setting triggerAtLogon to: %u

Setting the queue trigger based upon: %u

SUCCESS adding report to queue

Launched (%S)

Failed to store the SensSubscription. hr: %d

failed to allocate PROGID string: %S

Failed putting SubscriberInterface. hr: %d

Failed putting PerUser. hr: %d

Failed putting Enabled. hr: %d

Failed putting MachineName. hr: %d

Failed putting OwnerSID. hr: %d

Failed putting Description. hr: %d

Failed putting InterfaceID. hr: %d

Failed putting EventClassID. hr: %d

Failed putting MethodName. hr: %d

Failed putting SubscriptionName. hr: %d

Failed putting PublisherID. hr: %d

Failed putting SubscriberCLSID. hr: %d

Failed putting SubscriptionID. hr: %d

Failed CoCreateInstance on EventSubscription. hr: %d

Failed to remove the SensSubscription. hr: %d

failed to allocate query string: %S

Failed CoCreateInstance on EventSystem. hr: %d

SENS: StringFromIID() returned <%x>

DWSHARED: SysAllocString(%s) failed!

Failed to subscribe subscription %u. hr: %d

Failed to get data for subscription %u. hr: %d

Failed to query install reg key

Failed to open install reg key

Software\Microsoft\PCHealth\ErrorReporting\DW\Installed

HKEY_USERS\

HKEY_CURRENT_CONFIG\

HKEY_CLASSES_ROOT\

HKEY_LOCAL_MACHINE\

HKEY_CURRENT_USER\

initing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

freeing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

0addref CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

QIing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

releasing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

deleting CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

creating CDwAccessible: hwnd %x, idc %d

WriteAtOffset.Write(0x%x) failed, 0xx

WriteAtOffset.Seek(0x%x) failed, 0xx

WriteMemoryFromProcess.Read(0x%I64x, 0x%x) failed, 0xx

WriteStringToPool.Write(0x%x) failed, 0xx

WriteFunctionTable.RawEntries.Write(0x%x) failed, 0xx

WriteFunctionTable.RawTable.Write(0x%x) failed, 0xx

WriteFunctionTableList.DumpTable.Write(0x%x) failed, 0xx

WriteFunctionTableList.Seek(0x%x) failed, 0xx

WriteDirectoryEntry.Write(0x%x) failed, 0xx

Thread(0x%x) callback returned FALSE

WriteSystemInfo.GetOsCsdString failed, 0xx

WriteSystemInfo.GetCpuInfo failed, 0xx

CalculateSizeForSystemInfo.GetOsCsdString failed, 0xx

WriteHeader.GetCurrentTimeDate failed, 0xx

WriteDirectoryTable.Seek(0x%x) failed, 0xx

WriteMemoryInfo.Write(0x%x) failed, 0xx

WriteMemoryInfo.QueryVirtual(0x%I64x) failed, 0xx

WriteFullMemory virtual memory layout changed, retries %d, 0x%I64x (0x%I64x:0x%I64x) vs. 0x%I64x (0x%I64x:0x%I64x)

WriteFullMemory.Memory.Write(0x%x) failed, 0xx

WriteFullMemory.Memory.Read(0x%I64x, 0x%x) failed, retries %d, 0xx

WriteFullMemory.QueryVirtual(0x%I64x) for data failed, 0xx

WriteFullMemory.Desc.Write(0x%x) failed, 0xx

WriteFullMemory.QueryVirtual(0x%I64x) for info failed, 0xx

Kernel minidump write failed, 0xx

MarshalExceptionPointers.CxRecord.Read(0x%I64x, 0x%x) failed, 0xx

MarshalExceptionPointers.ExRecord.Read(0x%I64x, 0x%x) failed, 0xx

Invalid exception record parameter count (0x%x)

Invalid exception record size (0x%x)

Invalid CPU type (0x%x)

Invalid function table size (0x%x)

GetSystemType.GetOsInfo failed, 0xx

GetSystemType.GetCpuType failed, 0xx

Write.Start failed, 0xx

Dump type requires streaming but output provider does not support streaming

Invalid dump type 0x%x

dbghelp.dll

Alloc(0x%x) failed

Thread(0x%x) will not be included

GenGetImageSections.Section.Read(0x%I64x, 0x%x) failed, 0xx

GenGetImageSections.GenImageNtHeader(0x%I64x) failed

GenGetImageSections.Read(0x%I64x, 0x%x) failed, 0xx

0GenAllocateThreadObject.GetTebInfo(0x%x) failed, 0xx

GenAllocateThreadObject.GetContext(0x%x) failed, 0xx

GenAllocateThreadObject.Open(0x%x) failed, 0xx

GenReadTlsDirectory.Index(0x%I64x, %ws) failed, 0xx

GenReadTlsDirectory(0x%I64x, %ws) unknown machine 0x%x

GenReadTlsDirectory.Read(0x%I64x, %ws) failed, 0xx

GenAllocateModuleObject.GenDebugRecord(0x%I64x, %ws) failed, 0xx

GenAllocateModuleObject.GenImageNtHeader(0x%I64x, %ws) failed, 0xx

GenAllocateModuleObject.GetImageHeaderInfo(0x%I64x, %ws) failed, 0xx

GenAllocateModuleObject.GetVersion(0x%I64x, %ws) failed, 0xx

GenAllocateProcessObject.GetPeb(0x%x) failed, 0xx

GenIncludeUnwindInfoMemory.Enum(0x%I64x, 0x%x) failed, 0xx

GenGenTebMemory.TLS(0x%I64x) failed, 0xx

GenScanAddressSpace.QueryVirtual(0x%I64x) failed, 0xx

0GenGetAuxMemory(%ws) failed, 0xx

GenGetProcessInfo.EnumUnloadedModules(0x%x) failed, 0xx

GenGetProcessInfo.EnumUnloadedModules(0x%x) looped

GenGetProcessInfo.EnumFunctionTableEntries(0x%I64x, 0x%x) failed, 0xx

GenGetProcessInfo.EnumFunctionTables(0x%x) failed, 0xx

GenGetProcessInfo.EnumFunctionTables(0x%x) looped

GenGetProcessInfo.EnumModules(0x%x) failed, 0xx

GenGetProcessInfo.EnumModules(0x%x) looped

GenGetProcessInfo.EnumThreads(0x%x) failed, 0xx

GenGetProcessInfo.EnumThreads(0x%x) looped

GenGetProcessInfo.Start(0x%x) failed, 0xx

GenWriteHandleData.Desc.Write(0x%x) failed, 0xx

GenWriteHandleData.Header.Write(0x%x) failed, 0xx

GenWriteHandleData.ObjectName.Write(0x%x) failed, 0xx

GenWriteHandleData.ObjectNameLen.Write(0x%x) failed, 0xx

GenWriteHandleData.TypeName.Write(0x%x) failed, 0xx

GenWriteHandleData.TypeNameLen.Write(0x%x) failed, 0xx

GenWriteHandleData.Start(0x%x) failed, 0xx

GenWriteHandleData.Seek(0x%x) failed, 0xx

Software\Microsoft\Windows NT\CurrentVersion\MiniDumpAuxiliaryDlls

Software\Microsoft\Windows NT\CurrentVersion\KnownManagedDebuggingDlls

version.dll

ntdll.dll

%$%,%4%<%

S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%

b%c%d%e%f%g%h%i%j%k%l%

!"#$%&'()* ,-./0123456789:;<=

!!!!2222

%%%f||||

!!!!2222||||

!"#$%&'(

'()* ,-./0

&'()* ,-./

&'()* ,-./012345

3456789

.ASex

!"#$%&'()* ,-./012

!"#$%&'()

?msodatad.dat

msodatalast.dat

Unicows.dll

Kernel32.dll

SHLWAPI.DLL

GDI32.DLL

wintrust.dll

1108160

0u.hN

0SSh

t.WWWj

PSSh07

t5SSh(

PSSSSSSh

0SSSSh

ADVAPI32.dll

COMCTL32.dll

GDI32.dll

KERNEL32.dll

OLEACC.dll

OLEAUT32.dll

MSVCRT.dll

RPCRT4.dll

SHELL32.dll

SHLWAPI.dll

urlmon.dll

USER32.dll

VERSION.dll

WININET.dll

RegCloseKey

RegOpenKeyExA

RegCreateKeyExA

ReportEventA

ReportEventW

RegEnumKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyW

GetProcessHeap

GetSystemWindowsDirectoryW

_amsg_exit

_acmdln

ShellExecuteExA

UrlGetPartA

CreateURLMoniker

CreateDialogIndirectParamA

EnumWindows

HttpQueryInfoA

HttpSendRequestExA

HttpOpenRequestA

InternetCanonicalizeUrlA

InternetCrackUrlA

HttpEndRequestA

dw20.pdb

\devsplab1\otools\BBT_TEMP\DW20O.pdb

winword.exe

wwordlt.exe

excel.exe

excellt.exe

mspub.exe

frontpg.exe

outlook.exe

powerpnt.exe

powpntlt.exe

onenote.exe

infopath.exe

winproj.exe

ois.exe

visio.exe

`!`'`)` `

e%f-f|3 f'f/f

]!^"^#^ ^$^

t.uGuHu

x4x7x%x-x x

h&h(h.hMh:h%h h,k/k-k1k4kmk

k%lzmcmdmvm

^Q]Q~NzP}P\PGPCPLPZPIPePvPNPUPuPtPwPOP

]8^6^3^7^

ichczc]eVeQeYeWe_UOeXeUeTe

{1{ {-{/{2{8{

r6s%s4s)s:t*t3t"t%t5t6t4t/t

t&t(t%u&ukuju

WHX%X

`IaJa aEa6a2a.aFa/aOa)a@a bh

d@d%d'd

duewexei

kCpDpJpHpIpEpFp

S$S%S&S'S(S)S S,S.S2S3S5S6S8S:S;SBSFSKSNSOSPSUSVSXSYS[S]S_SbSdSeSgShSiSjSkSmStSvSzS}S~S

U U!U"U#U$U%U(U)U U:U=U?UBUGUIULUSUTUXUYUZU[U]U`UgUhUiUkUlUmUnUoUpUqUrUsUtUxUyUzU

c c!c"c#c$c%c&c'c.c0c1c5c7c?cRcSc[c\c]c^c_c`cacbcccdcfcjclcsctcyc~c

m!m#m$m&mCmDmEmFmGmHmImJmKmLmMmNmOmPmQmRmSmTmUmVmWm[m\m]mkmqmrmsm

nRsSsh

evg%f

m.tRa

gtr%x

Q%SKg

f.ebp>QI

y.yxT

fn:q%uN

aw.Toiz

RMeXe

S#S$S%S;ScSdSrSsStSuS

`!`"`&`'`)`*` `,`-`.`/`0`2`3`4`5`6`:`=`>`?`

^ ^!^"^#^$^%^&^'^.^}^

c c!c"c#c$c%c&c'c*c7c:c;cSc[c1e?e@eAeBeCeDeEe

f f!f"f#f$f%f&f'f(f)f*f f,f-f

m m!m"m#m$m%m&m'm(m)m*m m,m-m.m1m2m3m4m5m6m7m8m9m:m;m<m>m?m@mBmCmDmGmHmImJmKmLmMmNmOmPmQmRmSmTmUm</m>

u u-u.uFuGuHuIuJuKuLuMuNuOuPuQuRuSu

U U!U"U#U$U%U&U'U(U4UJU

](^)^*^ ^,^-^/^0^1^

m/mAmFmVmWmXmYmZm[m\m]m^m_m`mambmcmdmemfmgmhmimjmkmlmmmnmompmqmrmsmtmumvmwmxmymzm{m|m}m~m

x x!x"x#x$x%x'x(x)x*x x,x.x/x0x1x2x3x4x5x6x7x8x9x:x;x<x>x?x@xAxXy_yaycydyeygyiyjykylynyoy</x>

} }!}"}#}$}%}&}'}

] ]!]"]#]$]%]&]'](])]*] ],]-].]/]0]

]2^3^4^5^6^7^8^9^:^;^<^>^

cMeNeOePeQeReSeTeUeWeXeYeZe[e]ebe

X X!X"X#X$X%X&X'X(X)X*X X,X-X.X/X0X1X3X4X6X7X8X9X:X;X<X>X?X@XAXBXCXDXEXFXGXHXJXTX_X`XfXmX</X>

d%d-d0d=dRdad2e\e^e_e`eaecedeeefegeheiejele

s"s#s$s%s&s(s)s,s-s/s0s1s2s3s4s5s6s8s9s>s@sGs

u$u%u&u/ujukulumunuouqurusutu

duewexeyeze{e

~ ~!~"~#~$~%~&~'~(~*~ ~-~8~:~0

| |!|"|#|$|%|&|(|)|*|-|.|/|0|1|2|6|

{3~3}3|3

eZl%u

Q.YeY

R:\Sg|p5rL

e$e#e e4e5e7e6e8eKuHeVeUeMeXe^e]erexei

s4s/s)s%s>sNsOs

s&t*t)t.tbt

2%2.bx

{ | }9},

d6exe9j

]%sOu4](n

m.t.zB}

w%xIyWy

^vcÓv

%f?iCt

U>_.lE

f.ebp

.nrR=

{fn:q%uN

explorer.exe

name="Microsoft.Windows.ErrorReporter"

version="5.1.0.0"

publicKeyToken="6595b64144ccf1df" />

<description>Windows Error Reporting</description>

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

1%s\%s\%s\%s\%s\%s\%s\%s

AppName: %s AppVer: %s AppStamp:%s

ModName: %s ModVer: %s ModStamp:%s

fDebug: %s Offset: %s

Main_AlwaysReportBtn=

Main_NoReportBtn=

Main_ReportBtn=

General_Reportee=

CheckBoxRegKey=

ReportingFlags=

Stage1URL=

Stage2URL=

%General_Reportee%

%u %s

%u.%u %s

%s %s %s %s in %s %s %s fDebug %s at offset %s

Bucket: d

BucketTable %d

%s, %s, %s, %s, %s, %s, %s, %s, %s, %s %s

\dw.log

policy.txt

crash.log

status.txt

hits.log

count.txt

%s\%s\%s

%s\%s\%s\%s

eDWQueuedReporting

DWPersistentQueuedReporting

"%s\%s" -%c

dwtrig20.exe

ReportSize=

\*.cab

dwq.snt

"%s" -%c %u

SEventSystem.EventSubscription

SubscriptionID=%s

#$%&%&'(

Comctl32.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\BA8CD.dmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

.NET Runtime 2.0 Error Reporting

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\dw.log

Microsoft Application Error Reporting

11.0.8160

Windows

DW20.Exe

explorer.exe_2252_rwx_00400000_00010000:

.text

`.rsrc

@.reloc

v2.0.50727

Microsoft.VisualBasic

MyWebServices

KeyboardHookDelegate

Microsoft.VisualBasic.ApplicationServices

.ctor

Microsoft.VisualBasic.Devices

.cctor

get_WebServices

m_MyWebServicesObjectProvider

WebServices

KeyboardHandle

SetWindowsHookEx

SetWindowsHookExA

GetAsyncKeyState

vKey

tapi32.dll

rtm.dll

user32.dll

UpFTP

UpFTPImg

Password

SMTP

Port

wMsg

EnumChildWindows

System.Text

System.Windows.Forms

System.Threading

System.ComponentModel

System.CodeDom.Compiler

System.Diagnostics

Microsoft.VisualBasic.CompilerServices

System.ComponentModel.Design

HelpKeywordAttribute

System.Runtime.CompilerServices

System.Runtime.InteropServices

Operators

Keyboard

get_Keyboard

get_CtrlKeyDown

get_AltKeyDown

System.IO

System.Net

WebClient

MsgBoxResult

MsgBoxStyle

MsgBox

ProcessWindowStyle

get_WindowStyle

Microsoft.VisualBasic.MyServices

get_ExecutablePath

Join

Microsoft.Win32

RegistryKey

OpenSubKey

OperatingSystem

System.Drawing

System.Drawing.Imaging

System.Net.Mail

SmtpClient

System.Collections.ObjectModel

set_Port

System.Security.Cryptography

PasswordDeriveBytes

CryptDeriveKey

set_Key

explorer.exe

8.0.0.0

My.Application

My.WebServices

My.Computer

My.User

4System.Web.Services.Protocols.SoapHttpClientProtocol

_CorExeMain

mscoree.dll

MsgFalse

MsgMsg

http://www.exampleserver.com/directfile.exe

setup.exe

ftp.exampleserver.com

smtp.mail.ru

Application.StartupPath

MsgFalse

Hello, this is a message letting you know that your keylogger has been freshly installed on

http://automation.whatismyip.com/n09230945.asp

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System

DisableCMD

C:\Windows\System32\

.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

127.0.0.1

SOFTWARE\Microsoft\Windows NT\CurrentVersion

Windows Key:

Windows 95

Windows 98

Windows ME

Windows NT

Windows 2K3

Windows Vista

Windows 7

Windows Task Manager

.html

ftp://

FTP information is valid and working!

FTP information is invalid:

Software\Microsoft\Windows\CurrentVersion\

Software\Microsoft\Windows\CurrentVersion\Run

1.0.0.0

FB_1.tmp.exe_2416:

.text

`.rsrc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

v2.0.50727

CMemoryExecute.dll

CMemoryExecute

PAGE_EXECUTE_READWRITE

.ctor

System.Reflection

System.Runtime.InteropServices

System.Security.Permissions

System.Diagnostics

System.Runtime.CompilerServices

DllImportAttribute

kernel32.dll

ntdll.dll

System.Security

$8fcd4931-91a2-4e18-849b-70de34ab75df

1.0.0.0

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb

mscoree.dll

`.rdata

@.data

.rsrc

D$.SPf

2 34 567

com.apple.Safari

com.apple.WebKit2WebProcess

SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins

"Account","Login Name","Password","Web Site","Comments"

3.7.5

SQLite format 3

CREATE TABLE sqlite_master(

sql text

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins

PK11_GetInternalKeySlot

PK11_CheckUserPassword

large file support is disabled

unknown operation

SQL logic error or missing database

foreign_keys

sqlite_compileoption_get

sqlite_compileoption_used

sqlite_source_id

sqlite_version

sqlite_attach

sqlite_detach

sqlite_stat1

sqlite_rename_parent

sqlite_rename_trigger

sqlite_rename_table

%Y-%m-%d %H:%M:%S

%Y-%m-%d

%H:%M:%S

SQLITE_

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

%s-shm

%s\etilqs_

OsError 0x%x (%u)

Recovered %d frames from WAL file %s

%s-mjX

foreign key constraint failed

unable to use function %s in the requested context

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

statement aborts at %d: [%s] %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

oversized integer: %s%s

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

%s OR name=%Q

type='trigger' AND (%s)

there is already another table or index with this name: %s

sqlite_

table %s may not be altered

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE tbl=%Q

SELECT tbl, idx, stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s %T cannot reference objects in database %s

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

no such collation sequence: %s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

view %s is circularly defined

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

a JOIN clause is required before %s

unable to identify the object to be reindexed

table %s may not be modified

cannot modify %s because it is a view

foreign key mismatch

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

PRIMARY KEY must be unique

automatic extension loading failed: %s

foreign_key_list

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

%s.%s

%s:%d

no such index: %s

sqlite_subquery_%p_

no such table: %s

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

at most %d tables in a join

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unable to close due to unfinished backup operation

unknown database: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

sqlite3_open

sqlite3_prepare

sqlite3_step

sqlite3_column_text

sqlite3_column_int

sqlite3_column_int64

sqlite3_finalize

sqlite3_close

sqlite3_exec

f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb

msvcrt.dll

_wcmdln

COMCTL32.dll

VERSION.dll

FindCloseUrlCache

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

WININET.dll

GetWindowsDirectoryW

KERNEL32.dll

EnumChildWindows

USER32.dll

GDI32.dll

comdlg32.dll

RegCloseKey

RegOpenKeyExW

RegEnumKeyExW

ADVAPI32.dll

ShellExecuteW

SHELL32.dll

ole32.dll

5JEw%Xg

http://www.usertrust.com1

3http://crl.usertrust.com/AddTrustExternalCARoot.crl05

http://ocsp.usertrust.com0

1http://crl.usertrust.com/UTN-USERFirst-Object.crl05

1http://crl.usertrust.com/UTN-USERFirst-Object.crl0t

1http://crt.usertrust.com/UTNAddTrustObject_CA.crt0%

https://secure.comodo.net/CPS0A

0http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r

0http://crt.comodoca.com/COMODOCodeSigningCA2.crt0$

http://ocsp.comodoca.com0

support@nirsoft.net0

t{SSh

v%SSW

Mail PassView

Mozilla\Profiles

Software\Mozilla\Mozilla Thunderbird

%s\Main

sqlite3.dll

nss3.dll

%programfiles%\Mozilla Thunderbird

AddExportHeaderLine

%s %s %s

HTTPMail User Name

SMTP USer Name

HTTPMail Server

SMTP Server

POP3 Password2

IMAP Password2

HTTPMail Password2

SMTP Password2

POP3 Port

IMAP Port

HTTPMail Port

SMTP Port

HTTPMail Secure Connection

SMTP Secure Connection

SMTP Display Name

SMTP Email Address

POP3 Password

IMAP Password

HTTP Password

SMTP Password

HTTP User

SMTP User

HTTP Server URL

HTTP Port

HTTPMail Use SSL

SMTP Use SSL

%s\%s

PopPort

PopPassword

SMTPAccount

SMTPServer

SMTPPort

SMTPLogSecure

SMTPPassword

%s\Accounts

LoginName

SavePasswordText

ESMTPUsername

ESMTPPassword

POP3Password

fb.dat

%s@gmail.com

%s@yahoo.com

Software\Microsoft\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

smtp

advapi32.dll

comctl32.dll

*.ini

netmsg.dll

Error %d: %s

%s (%s)

menu_%d

dialog_%d

TranslatorURL

_lng.ini

%-18s: %s

%%-%d.%ds

bgcolor="%s"

<%s>%s

report.html

*.txt

*.htm;*.html

*.xml

*.csv

Software\NirSoft\MailPassView

MailPassView

/skeepass

/deleteregkey

Failed to load the executable file !

mail.account.account

mail.server

port

mail.identity

signon.signonfilename

mailbox://%s@%s

imap://%s@%s

mailbox://%s

imap://%s

signons.txt

signons.sqlite

prefs.js

Password.NET Messenger Service

User.NET Messenger Service

Passport.Net\*

ps:password

windowslive:name=

Exception %8.8X at address %8.8X in module %s

Stack Data: %s

Code Data: %s

mozsqlite3.dll

psapi.dll

pstorec.dll

5e7e8100-9138-11d1-945a-00c04fc308ff

00000000-0000-0000-0000-000000000000

220D5CD0-853A-11D0-84BC-00C04FD43F8F

220D5CD1-853A-11D0-84BC-00C04FD43F8F

220D5CC1-853A-11D0-84BC-00C04FD43F8F

417E2D75-84BD-11D0-84BB-00C04FD43F8F

shell32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

shlwapi.dll

%s <h3>%s</h3>

size="%d"

color="#%s"

width="%s"

<th%s>%s%s%s</th%s>

SOFTWARE\Mozilla

mozilla

%s\bin

PathToExe

\sqlite3.dll

\mozsqlite3.dll

Software\Microsoft\Windows Mail

Software\Microsoft\Windows Live Mail

SMTP_Server

SMTP_User_Name

POP3_Password2

IMAP_Password2

NNTP_Password2

SMTP_Password2

SMTP_Email_Address

SMTP_Port

NNTP_Port

IMAP_Port

POP3_Port

SMTP_Secure_Connection

*.oeaccount

\Microsoft\Windows Mail

\Microsoft\Windows Live Mail

f:\Projects\VS2005\mailpv\Release\mailpv.pdb

_acmdln

RPCRT4.dll

GetWindowsDirectoryA

RegDeleteKeyA

RegOpenKeyExA

RegEnumKeyA

RegEnumKeyExA

ShellExecuteA

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="NirSoft" type="win32"></assemblyIdentity><description>NirSoft</description><dependency><dependentAssembly><assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD

Microsoft.exe

Microsoft.VisualBasic

System.Windows.Forms

System.Drawing

System.Management

tapi32.dll

rtm.dll

user32.dll

Microsoft.Form1.resources

Microsoft.Resources.resources

Microsoft.My

WindowsFormsApplicationBase

Microsoft.VisualBasic.ApplicationServices

System.ComponentModel

System.CodeDom.Compiler

Microsoft.VisualBasic.Devices

m_MyWebServicesObjectProvider

.cctor

get_WebServices

HelpKeywordAttribute

System.ComponentModel.Design

WebServices

Microsoft.VisualBasic.CompilerServices

System.Collections

ContainsKey

InvalidOperationException

MyWebServices

encryptedpassstring

encryptedsmtpstring

portstring

encryptedftphost

encryptedftpuser

encryptedftppass

useftp

websitevisitor

websiteblocker

passstring

smtpstring

ftphost

ftpuser

ftppass

WM_KEYUP

WM_KEYDOWN

WM_SYSKEYDOWN

WM_SYSKEYUP

KeyboardHandle

KeyLog

CleanedPasswordsMAIL

CleanedPasswordsWB

System.IO

get_ExecutablePath

WindowsIdentity

System.Security.Principal

set_WindowState

FormWindowState

UnhookWindowsHookEx

SetWindowsHookEx

SetWindowsHookExA

GetAsyncKeyState

vKey

HookKeyboard

UnhookKeyboard

Operators

get_Keyboard

Keyboard

get_CtrlKeyDown

get_AltKeyDown

KeyboardCallback

set_UseShellExecute

System.Threading

System.Collections.Generic

Microsoft.VisualBasic.MyServices

System.Collections.ObjectModel

MsgBox

MsgBoxResult

MsgBoxStyle

ForceSteamLogin

System.Net.NetworkInformation

get_OperationalStatus

OperationalStatus

FakemsgInstall

System.Net.Mail

SmtpClient

System.Globalization

set_Port

System.Net

Microsoft.Win32

RegistryKey

OpenSubKey

System.Security.Cryptography

System.Text

set_Key

stealWebroswers

WebClient

readweb

System.IO.Compression

SendLogsFTP

FtpWebRequest

WebRequest

UploadFTP

secretKey

set_KeySize

get_KeySize

System.Net.Sockets

virtualKey

KeyboardHookDelegate

get_Msg

Microsoft.My.Resources

System.Resources

get_CMemoryExecute

get_WebBrowserPassView

WebBrowserPassView

System.Configuration

8.0.0.0

My.Computer

My.Application

My.User

My.Forms

My.WebServices

System.Windows.Forms.Form

My.MyProject.Forms

4System.Web.Services.Protocols.SoapHttpClientProtocol

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

10.0.0.0

My.Settings

$104c270e-c552-4216-b1b0-d68a8f9c4a3e

_CorExeMain

<asmv1:assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"></asmv1:assembly>

If you want to change the Windows User Account Control level replace the

requestedExecutionLevel node with one of the following.

Specifying requestedExecutionLevel node will disable file and registry virtualization.

compatibility then delete the requestedExecutionLevel node.

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

%%0.ß

Apple Computer\Preferences\keychain.plist

LoadPasswordsIE

LoadPasswordsFirefox

LoadPasswordsChrome

LoadPasswordsOpera

LoadPasswordsSafari

LoadPasswordsSeaMonkey

UseFirefoxProfileFolder

UseFirefoxInstallFolder

UseChromeProfileFolder

UseOperaPasswordFile

FirefoxProfileFolder

FirefoxInstallFolder

ChromeProfileFolder

OperaPasswordFile

Aadvapi32.dll

crypt32.dll

777705555443332

5555443332

wand.dat

@nss3.dll

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe

%programfiles%\Sea Monkey

%programfiles%\Mozilla Firefox

-signons.txt

signons2.txt

signons3.txt

@dllhost.exe

taskhost.exe

taskhostex.exe

Microsoft\Windows\WebCache\WebCacheV01.dat

Microsoft\Windows\WebCache\WebCacheV24.dat

index.dat

https://www.google.com/accounts/servicelogin

http://www.facebook.com/

https://login.yahoo.com/config/login

http://

https://

ftp://

@history.dat

places.sqlite

Mozilla\Firefox\Profiles

Mozilla\SeaMonkey\Profiles

Mozilla\SeaMonkey

Mozilla\Firefox

profiles.ini

Profile%d

tntdll.dll

sWeb Data

Google\Chrome\User Data

Google\Chrome SxS\User Data

Opera\Opera\wand.dat

Opera\Opera7\profile\wand.dat

Opera

@"%s"

Ashell32.dll

\nss3.dll

.save

vaultcli.dll

abe2869f-9b47-4cd9-a358-c22904dba7f7

Copy &Password

&HTML Report - All Items

HTML R&eport - Selected Items

HTML Report - All Items

HTML Report - Selected Items

Load Passwords From...

Google Chrome

Mozilla Firefox

SeaMonkey

Firefox Options

Master password:

Firefox Profile:

Firefox Installation:

Chrome Options

Opera Options

wand.dat file:

%d Passwords

, %d Selected

Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat)

Loading... %d

KeePass csv file

Opera Password File

Firefox 1.x

Firefox 2.x

Firefox 3.0

Firefox

Chrome

Web Browser

Password

Password Strength

Password Field

WebBrowserPassView.exe

www.google.com/Please log in to your Gmail account

www.google.com:443/Please log in to your Gmail account

www.google.com/Please log in to your Google Account

www.google.com:443/Please log in to your Google Account

www.google.com

dWindowsLive:name=*

82BD0E67-9FEA-4748-8672-D5EFE5B779B0

Copy Password

%d items

Select Eudora.ini filename/Select the location of Thunderbird installation

Eudora.ini file

SMTP

Windows Mail

Windows Live Mail

Server Port

SMTP Server Port

Mail Password Recovery

mailpv.exe

3; ; #.)

3600000

noftp

Disablecmd

\Windows Update.exe

\WindowsUpdate.exe

SysInfo.txt

\pid.txt

\pidloc.txt

\Mozilla\Firefox\Profiles

127.0.0.1

\SteamAppData.vdf

\ClientRegistry.blob

Keylogger Enabled:

Operating System:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

autorun.inf

open=Sys.exe

Sys.exe

Software\Microsoft\Windows\CurrentVersion\Run

Windows Update

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

\bitcoin\wallet.dat

_wallet.dat

wallet.dat

Microsoft.NET\Framework\v2.0.50727\vbc.exe

holdermail.txt"

holdermail.txt

Operating System Intel Recovery

Operating System Platform:

Operating System Version:

WEB Browser Password Recovery

Mail Messenger Password Recovery

Jdownloader Password Recovery

holderwb.txt"

holderwb.txt

C:\Users\

_Pin0.jpeg

_Pin1.jpeg

_Pin2.jpeg

_Pin3.jpeg

_Pin4.jpeg

Steals the Wallet.DAT file that holds the users bitcoin currency

\.minecraft\lastlogin

There is a file attached to this email containing Minecraft username and password download it then decrypt the login information with my Minecraft Decryptor

Predator Pain v13 - Key Recorder - [

Keylogger Log

.jpeg

Predator_Pain_v13_KeyLog_

http://whatismyipaddress.com/

Microsoft.Resources

:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

FB_1.tmp.exe_2416_rwx_00400000_00084000: