Trojan.Win32.Inject.lqbl (Kaspersky), Trojan.Generic.11177802 (AdAware), HackTool.Win32.PassView.FD, GenericAutorunWorm.YR, HackToolPassView.YR (Lavasoft MAS)Behaviour: Trojan, Worm, HackTool, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 4cca3652abf9c4e91c312d34bd6bb0b9
SHA1: c12a0fd24a98445acb6de45dada2e730f32e78a2
SHA256: eb57707be7b666e731e3a2e33c9f4649f15eacce2200e96af10350c25e70b6f0
SSDeep: 12288:Jat0EAH49n8BesoxEmzvSxjsbIhUQzkit KQ8MP7Ge3QEY3akGStNlRypFvxCcEP:4t24TsgvSaIhptElie3lwRnypF58ptHj
Size: 1055502 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2013-08-22 16:00:50
Analyzed on: WindowsXP SP3 32-bit
Summary: HackTool. Can be used to investigate, analyze or compromise the system security. Some HackTools are multi-purpose programs, while others may have legitimate uses.
Dynamic Analysis
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the HackTool's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The HackTool creates the following process(es):
ttyWs.exe:468
vbc.exe:192
vbc.exe:1556
%original file name%.exe:208
The HackTool injects its code into the following process(es):
RegSvcs.exe:436
File activity
The process ttyWs.exe:468 makes changes in the file system.
The HackTool creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (5065 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kXm28Sf.EP4 (3073 bytes)
The HackTool deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kXm28Sf.EP4 (0 bytes)
The process RegSvcs.exe:436 makes changes in the file system.
The HackTool creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\pid.txt (3 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (57 bytes)
The HackTool deletes the following file(s):
%Documents and Settings%\%current user%\Cookies\Current_User@ssl.bing[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@money.ca.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@abmr[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@msnportal.112.2o7[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@kaspersky[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.msn[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@aaa[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@twitter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@auto.search.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@microsoft[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@rambler[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.bing[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@kaspersky.122.2o7[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.ca.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@atdmt[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@adnxs[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hm.baidu[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@adgear[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.atdmt[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@insurance[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bing[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@msn[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yandex[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.bing[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tns-counter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[2].txt (0 bytes)
The process vbc.exe:192 makes changes in the file system.
The HackTool creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (2 bytes)
The process %original file name%.exe:208 makes changes in the file system.
The HackTool creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\mKh40Fd\ttyWs.exe (15289 bytes)
%Documents and Settings%\%current user%\mKh40Fd\fSp.fjx (213 bytes)
The HackTool deletes the following file(s):
%Documents and Settings%\%current user%\mKh40Fd\__tmp_rar_sfx_access_check_922203 (0 bytes)
Registry activity
The process ttyWs.exe:468 makes changes in the system registry.
The HackTool creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 6B 0E B2 1F C8 82 6B BD 33 C3 DC D0 09 EB 0E"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
To automatically run itself each time Windows is booted, the HackTool adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"hHs44Ny" = "C:\DOCUME~1\"%CurrentUserName%"\mKh40Fd\ttyWs.exe"
The process RegSvcs.exe:436 makes changes in the system registry.
The HackTool creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\ESENT\Process\RegSvcs\DEBUG]
"Trace Level" = ""
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EC A5 33 8D D6 59 24 EA E9 37 F4 73 27 E9 9C 05"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"
The HackTool deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\ESENT\Process\RegSvcs\DEBUG]
"Trace Level"
The process vbc.exe:192 makes changes in the system registry.
The HackTool creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B EA 48 86 71 70 05 89 6F 1A 3D 66 BB 7B F9 D9"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The process vbc.exe:1556 makes changes in the system registry.
The HackTool creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6C 8C 89 55 9E 60 E8 8E B4 13 E5 76 CB B4 4C 9C"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
The process %original file name%.exe:208 makes changes in the system registry.
The HackTool creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 8A C9 F8 76 18 11 81 14 FF 85 FF C3 EE 92 6F"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\mKh40Fd]
"ttyWs.exe" = "ttyWs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The HackTool modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The HackTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The HackTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Dropped PE files
| MD5 | File path |
|---|---|
| 754eb0ceef77e51a4db4f902a57f68ca | c:\Documents and Settings\"%CurrentUserName%"\mKh40Fd\ttyWs.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the HackTool's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
ttyWs.exe:468
vbc.exe:192
vbc.exe:1556
%original file name%.exe:208 - Delete the original HackTool file.
- Delete or disinfect the following files created/modified by the HackTool:
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (5065 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kXm28Sf.EP4 (3073 bytes)
%Documents and Settings%\%current user%\Application Data\pid.txt (3 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holderwb.txt (2 bytes)
%Documents and Settings%\%current user%\mKh40Fd\ttyWs.exe (15289 bytes)
%Documents and Settings%\%current user%\mKh40Fd\fSp.fjx (213 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"hHs44Ny" = "C:\DOCUME~1\"%CurrentUserName%"\mKh40Fd\ttyWs.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 151934 | 152064 | 4.64444 | 92abffc6a56a40e47e60620bc02b652e |
| .rdata | 159744 | 20291 | 20480 | 3.69144 | 3bc937cdae1248917ecca2bfbd21ec86 |
| .data | 180224 | 136672 | 5120 | 1.76024 | ec6b38244c52a1c8d4b504f9e1522d10 |
| .rsrc | 319488 | 47316 | 47616 | 3.61566 | 3724e8847f6d9e177aa1cea5600c32fe |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 3
852c6c8c616e8b4d1bdefd5c1f2204e6
66bcb0dd80b0f3bf8b5486e83a4efea1
c3760426f1c8e6fadaf230c18541d350
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://whatismyipaddress.com/ | 66.80.82.69 |
| smtp.gmail.com | 173.194.68.108 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET / HTTP/1.1
Host: whatismyipaddress.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2014 00:48:56 GMT
Server: Apache
Set-Cookie: pt=d6d9357e59530f952a7bb58d713ac864; expires=Wed, 16-Apr-2014 00:48:56 GMT
Cache-Control: max-age=15
Vary: Accept-Encoding
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
1fad..<!doctype html>.<html lang="en">.<head>..<meta charset="windows-1252">..<meta name="robots" content="noarchive">..<title>What Is My IP Address? IP Address Tools and More</title>..<meta name="description" content="IP address lookup, location, proxy detection, email tracing, IP hiding tips, blacklist check, speed test, and forums. Find, get, and show my IP address.">..<meta name="keywords" content="my ip ,ip, address, my, what, is, find, get, show, locate, change, location, how, do, i, ip address, proxy, server, anonymous, hide, conceal, stealth, surf, web, anonymizer, anonymize, changer, privacy, geolocation, geolocate, lookup, look up, locate, trace, track, email, source, headers">..<meta property="fb:admins" content="607824267" />..<link rel="shortcut icon" href="hXXp://cdn.whatismyipaddress.com/favicon.ico">..<link rel="stylesheet" type="text/css" href="hXXp://cdn.whatismyipaddress.com/css/myip_v4_3.css">..<link rel="publisher" href="hXXps://plus.google.com/ whatismyipaddress">..<link rel="canonical" href="hXXp://whatismyipaddress.com">. .<script type="text/javascript">if (top.location!= self.location) {top.location = self.location.href;}</script> ..<script type='text/javascript'>...var googletag = googletag || {};...googletag.cmd = googletag.cmd || [];...(function() {...var gads = document.createElement('script');...gads.async = true;...gads.type = 'text/javascript';...var useSSL = 'https:' == docu
<<
<<< skipped >>>
Map
Strings from Dumps
RegSvcs.exe_436:
.text
.text
`.rsrc
`.rsrc
@.reloc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
v2.0.50727
v2.0.50727
CMemoryExecute.dll
CMemoryExecute.dll
CMemoryExecute
CMemoryExecute
PAGE_EXECUTE_READWRITE
PAGE_EXECUTE_READWRITE
.ctor
.ctor
System.Reflection
System.Reflection
System.Runtime.InteropServices
System.Runtime.InteropServices
System.Security.Permissions
System.Security.Permissions
System.Diagnostics
System.Diagnostics
System.Runtime.CompilerServices
System.Runtime.CompilerServices
DllImportAttribute
DllImportAttribute
kernel32.dll
kernel32.dll
ntdll.dll
ntdll.dll
System.Security
System.Security
$8fcd4931-91a2-4e18-849b-70de34ab75df
$8fcd4931-91a2-4e18-849b-70de34ab75df
1.0.0.0
1.0.0.0
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb
C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb
mscoree.dll
mscoree.dll
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
D$.SPf
D$.SPf
2 34 567
2 34 567
com.apple.Safari
com.apple.Safari
com.apple.WebKit2WebProcess
com.apple.WebKit2WebProcess
SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins
SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins
"Account","Login Name","Password","Web Site","Comments"
"Account","Login Name","Password","Web Site","Comments"
3.7.5
3.7.5
SQLite format 3
SQLite format 3
CREATE TABLE sqlite_master(
CREATE TABLE sqlite_master(
sql text
sql text
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins
SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
PK11_CheckUserPassword
PK11_CheckUserPassword
large file support is disabled
large file support is disabled
unknown operation
unknown operation
SQL logic error or missing database
SQL logic error or missing database
foreign_keys
foreign_keys
sqlite_compileoption_get
sqlite_compileoption_get
sqlite_compileoption_used
sqlite_compileoption_used
sqlite_source_id
sqlite_source_id
sqlite_version
sqlite_version
sqlite_attach
sqlite_attach
sqlite_detach
sqlite_detach
sqlite_stat1
sqlite_stat1
sqlite_rename_parent
sqlite_rename_parent
sqlite_rename_trigger
sqlite_rename_trigger
sqlite_rename_table
sqlite_rename_table
%Y-%m-%d %H:%M:%S
%Y-%m-%d %H:%M:%S
%Y-%m-%d
%Y-%m-%d
%H:%M:%S
%H:%M:%S
SQLITE_
SQLITE_
failed to allocate %u bytes of memory
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
failed memory resize %u to %u bytes
922337203685477580
922337203685477580
API call with %s database connection pointer
API call with %s database connection pointer
%s-shm
%s-shm
%s\etilqs_
%s\etilqs_
OsError 0x%x (%u)
OsError 0x%x (%u)
Recovered %d frames from WAL file %s
Recovered %d frames from WAL file %s
%s-mjX
%s-mjX
foreign key constraint failed
foreign key constraint failed
unable to use function %s in the requested context
unable to use function %s in the requested context
abort at %d in [%s]: %s
abort at %d in [%s]: %s
constraint failed at %d in [%s]
constraint failed at %d in [%s]
cannot open savepoint - SQL statements in progress
cannot open savepoint - SQL statements in progress
no such savepoint: %s
no such savepoint: %s
cannot %s savepoint - SQL statements in progress
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot change %s wal mode from within a transaction
cannot change %s wal mode from within a transaction
statement aborts at %d: [%s] %s
statement aborts at %d: [%s] %s
misuse of aliased aggregate %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s.%s
%s: %s.%s
%s: %s.%s
%s: %s
%s: %s
%r %s BY term out of range - should be between 1 and %d
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
variable number must be between ?1 and ?%d
too many SQL variables
too many SQL variables
too many columns in %s
too many columns in %s
oversized integer: %s%s
oversized integer: %s%s
misuse of aggregate: %s()
misuse of aggregate: %s()
%.*s"%w"%s
%.*s"%w"%s
%s%.*s"%w"
%s%.*s"%w"
%s OR name=%Q
%s OR name=%Q
type='trigger' AND (%s)
type='trigger' AND (%s)
there is already another table or index with this name: %s
there is already another table or index with this name: %s
sqlite_
sqlite_
table %s may not be altered
table %s may not be altered
view %s may not be altered
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_altertab_%s
CREATE TABLE %Q.%s(%s)
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE tbl=%Q
DELETE FROM %Q.%s WHERE tbl=%Q
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
invalid name: "%s"
too many attached databases - max %d
too many attached databases - max %d
database %s is already in use
database %s is already in use
unable to open database: %s
unable to open database: %s
no such database: %s
no such database: %s
cannot detach database %s
cannot detach database %s
database %s is locked
database %s is locked
%s %T cannot reference objects in database %s
%s %T cannot reference objects in database %s
object name reserved for internal use: %s
object name reserved for internal use: %s
there is already an index named %s
there is already an index named %s
too many columns on %s
too many columns on %s
duplicate column name: %s
duplicate column name: %s
default value of column [%s] is not constant
default value of column [%s] is not constant
table "%s" has more than one primary key
table "%s" has more than one primary key
no such collation sequence: %s
no such collation sequence: %s
CREATE %s %.*s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
view %s is circularly defined
view %s is circularly defined
table %s may not be dropped
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
use DROP VIEW to delete view %s
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
foreign key on %s should reference only one column of table %T
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
unknown column "%s" in foreign key definition
indexed columns are not unique
indexed columns are not unique
table %s may not be indexed
table %s may not be indexed
views may not be indexed
views may not be indexed
virtual tables may not be indexed
virtual tables may not be indexed
there is already a table named %s
there is already a table named %s
index %s already exists
index %s already exists
sqlite_autoindex_%s_%d
sqlite_autoindex_%s_%d
table %s has no column named %s
table %s has no column named %s
CREATE%s INDEX %.*s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
a JOIN clause is required before %s
a JOIN clause is required before %s
unable to identify the object to be reindexed
unable to identify the object to be reindexed
table %s may not be modified
table %s may not be modified
cannot modify %s because it is a view
cannot modify %s because it is a view
foreign key mismatch
foreign key mismatch
table %S has %d columns but %d values were supplied
table %S has %d columns but %d values were supplied
%d values for %d columns
%d values for %d columns
table %S has no column named %s
table %S has no column named %s
%s.%s may not be NULL
%s.%s may not be NULL
PRIMARY KEY must be unique
PRIMARY KEY must be unique
automatic extension loading failed: %s
automatic extension loading failed: %s
foreign_key_list
foreign_key_list
malformed database schema (%s)
malformed database schema (%s)
%s - %s
%s - %s
unsupported file format
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
unknown or unsupported join type: %T %T%s%T
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
cannot join using column %s - column not present in both tables
%s.%s
%s.%s
%s:%d
%s:%d
no such index: %s
no such index: %s
sqlite_subquery_%p_
sqlite_subquery_%p_
no such table: %s
no such table: %s
cannot create %s trigger on view: %S
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
no such trigger: %S
no such column: %s
no such column: %s
cannot VACUUM - SQL statements in progress
cannot VACUUM - SQL statements in progress
PRAGMA vacuum_db.synchronous=OFF
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor failed: %s
vtable constructor did not declare schema: %s
vtable constructor did not declare schema: %s
no such module: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
at most %d tables in a join
cannot use index: %s
cannot use index: %s
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
unable to close due to unfinished backup operation
unable to close due to unfinished backup operation
unknown database: %s
unknown database: %s
no such vfs: %s
no such vfs: %s
database corruption at line %d of [%.10s]
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
cannot open file at line %d of [%.10s]
sqlite3_open
sqlite3_open
sqlite3_prepare
sqlite3_prepare
sqlite3_step
sqlite3_step
sqlite3_column_text
sqlite3_column_text
sqlite3_column_int
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_int64
sqlite3_finalize
sqlite3_finalize
sqlite3_close
sqlite3_close
sqlite3_exec
sqlite3_exec
f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb
f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb
msvcrt.dll
msvcrt.dll
_wcmdln
_wcmdln
COMCTL32.dll
COMCTL32.dll
VERSION.dll
VERSION.dll
FindCloseUrlCache
FindCloseUrlCache
FindNextUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryW
WININET.dll
WININET.dll
GetWindowsDirectoryW
GetWindowsDirectoryW
KERNEL32.dll
KERNEL32.dll
EnumChildWindows
EnumChildWindows
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
comdlg32.dll
comdlg32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
5JEw%Xg
5JEw%Xg
<assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
<assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
http://www.usertrust.com1
http://www.usertrust.com1
3http://crl.usertrust.com/AddTrustExternalCARoot.crl05
3http://crl.usertrust.com/AddTrustExternalCARoot.crl05
http://ocsp.usertrust.com0
http://ocsp.usertrust.com0
1http://crl.usertrust.com/UTN-USERFirst-Object.crl05
1http://crl.usertrust.com/UTN-USERFirst-Object.crl05
1http://crl.usertrust.com/UTN-USERFirst-Object.crl0t
1http://crl.usertrust.com/UTN-USERFirst-Object.crl0t
1http://crt.usertrust.com/UTNAddTrustObject_CA.crt0%
1http://crt.usertrust.com/UTNAddTrustObject_CA.crt0%
https://secure.comodo.net/CPS0A
https://secure.comodo.net/CPS0A
0http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
0http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
0http://crt.comodoca.com/COMODOCodeSigningCA2.crt0$
0http://crt.comodoca.com/COMODOCodeSigningCA2.crt0$
http://ocsp.comodoca.com0
http://ocsp.comodoca.com0
support@nirsoft.net0
support@nirsoft.net0
t{SSh
t{SSh
v%SSW
v%SSW
Mail PassView
Mail PassView
Mozilla\Profiles
Mozilla\Profiles
Software\Mozilla\Mozilla Thunderbird
Software\Mozilla\Mozilla Thunderbird
%s\Main
%s\Main
sqlite3.dll
sqlite3.dll
nss3.dll
nss3.dll
%programfiles%\Mozilla Thunderbird
%programfiles%\Mozilla Thunderbird
AddExportHeaderLine
AddExportHeaderLine
%s %s %s
%s %s %s
HTTPMail User Name
HTTPMail User Name
SMTP USer Name
SMTP USer Name
HTTPMail Server
HTTPMail Server
SMTP Server
SMTP Server
POP3 Password2
POP3 Password2
IMAP Password2
IMAP Password2
HTTPMail Password2
HTTPMail Password2
SMTP Password2
SMTP Password2
POP3 Port
POP3 Port
IMAP Port
IMAP Port
HTTPMail Port
HTTPMail Port
SMTP Port
SMTP Port
HTTPMail Secure Connection
HTTPMail Secure Connection
SMTP Secure Connection
SMTP Secure Connection
SMTP Display Name
SMTP Display Name
SMTP Email Address
SMTP Email Address
POP3 Password
POP3 Password
IMAP Password
IMAP Password
HTTP Password
HTTP Password
SMTP Password
SMTP Password
HTTP User
HTTP User
SMTP User
SMTP User
HTTP Server URL
HTTP Server URL
HTTP Port
HTTP Port
HTTPMail Use SSL
HTTPMail Use SSL
SMTP Use SSL
SMTP Use SSL
%s\%s
%s\%s
PopPort
PopPort
PopPassword
PopPassword
SMTPAccount
SMTPAccount
SMTPServer
SMTPServer
SMTPPort
SMTPPort
SMTPLogSecure
SMTPLogSecure
SMTPPassword
SMTPPassword
%s\Accounts
%s\Accounts
LoginName
LoginName
SavePasswordText
SavePasswordText
ESMTPUsername
ESMTPUsername
ESMTPPassword
ESMTPPassword
POP3Password
POP3Password
fb.dat
fb.dat
%s@gmail.com
%s@gmail.com
%s@yahoo.com
%s@yahoo.com
Software\Microsoft\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
<meta http-equiv="content-type" content="text/html;charset=%s" />
<meta http-equiv="content-type" content="text/html;charset=%s" />
<br /><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p></p>
<br /><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p></p>
smtp
smtp
advapi32.dll
advapi32.dll
comctl32.dll
comctl32.dll
*.ini
*.ini
netmsg.dll
netmsg.dll
Error %d: %s
Error %d: %s
%s (%s)
%s (%s)
menu_%d
menu_%d
dialog_%d
dialog_%d
TranslatorURL
TranslatorURL
_lng.ini
_lng.ini
%-18s: %s
%-18s: %s
%%-%d.%ds
%%-%d.%ds
<td bgcolor="s" nowrap>%s</td>
<td bgcolor="s" nowrap>%s</td>
<td bgcolor="s">%s</td>
<td bgcolor="s">%s</td>
<tr><td%s nowrap><b>%s</b><td bgcolor="s">%s</td></td%s></tr>
<tr><td%s nowrap><b>%s</b><td bgcolor="s">%s</td></td%s></tr>
bgcolor="%s"
bgcolor="%s"
<font color="%s">%s</font>
<font color="%s">%s</font>
<%s>%s
<%s>%s
report.html
report.html
*.txt
*.txt
*.htm;*.html
*.htm;*.html
*.xml
*.xml
*.csv
*.csv
Software\NirSoft\MailPassView
Software\NirSoft\MailPassView
MailPassView
MailPassView
/skeepass
/skeepass
/deleteregkey
/deleteregkey
Failed to load the executable file !
Failed to load the executable file !
mail.account.account
mail.account.account
mail.server
mail.server
port
port
mail.identity
mail.identity
signon.signonfilename
signon.signonfilename
mailbox://%s@%s
mailbox://%s@%s
imap://%s@%s
imap://%s@%s
mailbox://%s
mailbox://%s
imap://%s
imap://%s
signons.txt
signons.txt
signons.sqlite
signons.sqlite
prefs.js
prefs.js
Password.NET Messenger Service
Password.NET Messenger Service
User.NET Messenger Service
User.NET Messenger Service
Passport.Net\*
Passport.Net\*
ps:password
ps:password
windowslive:name=
windowslive:name=
Exception %8.8X at address %8.8X in module %s
Exception %8.8X at address %8.8X in module %s
Stack Data: %s
Stack Data: %s
Code Data: %s
Code Data: %s
mozsqlite3.dll
mozsqlite3.dll
psapi.dll
psapi.dll
pstorec.dll
pstorec.dll
5e7e8100-9138-11d1-945a-00c04fc308ff
5e7e8100-9138-11d1-945a-00c04fc308ff
00000000-0000-0000-0000-000000000000
00000000-0000-0000-0000-000000000000
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
220D5CC1-853A-11D0-84BC-00C04FD43F8F
220D5CC1-853A-11D0-84BC-00C04FD43F8F
417E2D75-84BD-11D0-84BB-00C04FD43F8F
417E2D75-84BD-11D0-84BB-00C04FD43F8F
shell32.dll
shell32.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
shlwapi.dll
shlwapi.dll
<html><head>%s<title>%s</title></head></html>
<html><head>%s<title>%s</title></head></html>
%s <h3>%s</h3>
%s <h3>%s</h3>
size="%d"
size="%d"
color="#%s"
color="#%s"
<font color="%s"></font>
<font color="%s"></font>
<table border="1" cellpadding="5"><tr%s></tr%s></table>
<table border="1" cellpadding="5"><tr%s></tr%s></table>
width="%s"
width="%s"
<th%s>%s%s%s</th%s>
<th%s>%s%s%s</th%s>
SOFTWARE\Mozilla
SOFTWARE\Mozilla
mozilla
mozilla
%s\bin
%s\bin
PathToExe
PathToExe
\sqlite3.dll
\sqlite3.dll
\mozsqlite3.dll
\mozsqlite3.dll
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Live Mail
Software\Microsoft\Windows Live Mail
SMTP_Server
SMTP_Server
SMTP_User_Name
SMTP_User_Name
POP3_Password2
POP3_Password2
IMAP_Password2
IMAP_Password2
NNTP_Password2
NNTP_Password2
SMTP_Password2
SMTP_Password2
SMTP_Email_Address
SMTP_Email_Address
SMTP_Port
SMTP_Port
NNTP_Port
NNTP_Port
IMAP_Port
IMAP_Port
POP3_Port
POP3_Port
SMTP_Secure_Connection
SMTP_Secure_Connection
*.oeaccount
*.oeaccount
\Microsoft\Windows Mail
\Microsoft\Windows Mail
\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
f:\Projects\VS2005\mailpv\Release\mailpv.pdb
f:\Projects\VS2005\mailpv\Release\mailpv.pdb
_acmdln
_acmdln
RPCRT4.dll
RPCRT4.dll
GetWindowsDirectoryA
GetWindowsDirectoryA
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
RegEnumKeyA
RegEnumKeyA
RegEnumKeyExA
RegEnumKeyExA
ShellExecuteA
ShellExecuteA
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="NirSoft" type="win32"></assemblyIdentity><description>NirSoft</description><dependency><dependentAssembly><assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="NirSoft" type="win32"></assemblyIdentity><description>NirSoft</description><dependency><dependentAssembly><assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
Microsoft.exe
Microsoft.exe
Microsoft.VisualBasic
Microsoft.VisualBasic
System.Windows.Forms
System.Windows.Forms
System.Drawing
System.Drawing
System.Management
System.Management
tapi32.dll
tapi32.dll
rtm.dll
rtm.dll
user32.dll
user32.dll
Microsoft.Form1.resources
Microsoft.Form1.resources
Microsoft.Resources.resources
Microsoft.Resources.resources
Microsoft.My
Microsoft.My
WindowsFormsApplicationBase
WindowsFormsApplicationBase
Microsoft.VisualBasic.ApplicationServices
Microsoft.VisualBasic.ApplicationServices
System.ComponentModel
System.ComponentModel
System.CodeDom.Compiler
System.CodeDom.Compiler
Microsoft.VisualBasic.Devices
Microsoft.VisualBasic.Devices
m_MyWebServicesObjectProvider
m_MyWebServicesObjectProvider
.cctor
.cctor
get_WebServices
get_WebServices
HelpKeywordAttribute
HelpKeywordAttribute
System.ComponentModel.Design
System.ComponentModel.Design
WebServices
WebServices
Microsoft.VisualBasic.CompilerServices
Microsoft.VisualBasic.CompilerServices
System.Collections
System.Collections
ContainsKey
ContainsKey
InvalidOperationException
InvalidOperationException
MyWebServices
MyWebServices
encryptedpassstring
encryptedpassstring
encryptedsmtpstring
encryptedsmtpstring
portstring
portstring
encryptedftphost
encryptedftphost
encryptedftpuser
encryptedftpuser
encryptedftppass
encryptedftppass
useftp
useftp
websitevisitor
websitevisitor
websiteblocker
websiteblocker
passstring
passstring
smtpstring
smtpstring
ftphost
ftphost
ftpuser
ftpuser
ftppass
ftppass
WM_KEYUP
WM_KEYUP
WM_KEYDOWN
WM_KEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYUP
WM_SYSKEYUP
KeyboardHandle
KeyboardHandle
KeyLog
KeyLog
CleanedPasswordsMAIL
CleanedPasswordsMAIL
CleanedPasswordsWB
CleanedPasswordsWB
System.IO
System.IO
get_ExecutablePath
get_ExecutablePath
WindowsIdentity
WindowsIdentity
System.Security.Principal
System.Security.Principal
set_WindowState
set_WindowState
FormWindowState
FormWindowState
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookEx
SetWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
GetAsyncKeyState
GetAsyncKeyState
vKey
vKey
HookKeyboard
HookKeyboard
UnhookKeyboard
UnhookKeyboard
Operators
Operators
get_Keyboard
get_Keyboard
Keyboard
Keyboard
get_CtrlKeyDown
get_CtrlKeyDown
get_AltKeyDown
get_AltKeyDown
KeyboardCallback
KeyboardCallback
set_UseShellExecute
set_UseShellExecute
System.Threading
System.Threading
System.Collections.Generic
System.Collections.Generic
Microsoft.VisualBasic.MyServices
Microsoft.VisualBasic.MyServices
System.Collections.ObjectModel
System.Collections.ObjectModel
MsgBox
MsgBox
MsgBoxResult
MsgBoxResult
MsgBoxStyle
MsgBoxStyle
ForceSteamLogin
ForceSteamLogin
System.Net.NetworkInformation
System.Net.NetworkInformation
get_OperationalStatus
get_OperationalStatus
OperationalStatus
OperationalStatus
FakemsgInstall
FakemsgInstall
System.Net.Mail
System.Net.Mail
SmtpClient
SmtpClient
System.Globalization
System.Globalization
set_Port
set_Port
System.Net
System.Net
Microsoft.Win32
Microsoft.Win32
RegistryKey
RegistryKey
OpenSubKey
OpenSubKey
System.Security.Cryptography
System.Security.Cryptography
System.Text
System.Text
set_Key
set_Key
stealWebroswers
stealWebroswers
WebClient
WebClient
readweb
readweb
System.IO.Compression
System.IO.Compression
SendLogsFTP
SendLogsFTP
FtpWebRequest
FtpWebRequest
WebRequest
WebRequest
UploadFTP
UploadFTP
secretKey
secretKey
set_KeySize
set_KeySize
get_KeySize
get_KeySize
System.Net.Sockets
System.Net.Sockets
virtualKey
virtualKey
KeyboardHookDelegate
KeyboardHookDelegate
get_Msg
get_Msg
Microsoft.My.Resources
Microsoft.My.Resources
System.Resources
System.Resources
get_CMemoryExecute
get_CMemoryExecute
get_WebBrowserPassView
get_WebBrowserPassView
WebBrowserPassView
WebBrowserPassView
System.Configuration
System.Configuration
8.0.0.0
8.0.0.0
My.Computer
My.Computer
My.Application
My.Application
My.User
My.User
My.Forms
My.Forms
My.WebServices
My.WebServices
System.Windows.Forms.Form
System.Windows.Forms.Form
My.MyProject.Forms
My.MyProject.Forms
4System.Web.Services.Protocols.SoapHttpClientProtocol
4System.Web.Services.Protocols.SoapHttpClientProtocol
3System.Resources.Tools.StronglyTypedResourceBuilder
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
10.0.0.0
10.0.0.0
My.Settings
My.Settings
$104c270e-c552-4216-b1b0-d68a8f9c4a3e
$104c270e-c552-4216-b1b0-d68a8f9c4a3e
_CorExeMain
_CorExeMain
<asmv1:assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"></asmv1:assembly>
<asmv1:assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"></asmv1:assembly>
<assemblyIdentity version="1.0.0.0" name="MyApplication.app" />
<assemblyIdentity version="1.0.0.0" name="MyApplication.app" />
If you want to change the Windows User Account Control level replace the
If you want to change the Windows User Account Control level replace the
requestedExecutionLevel node with one of the following.
requestedExecutionLevel node with one of the following.
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
Specifying requestedExecutionLevel node will disable file and registry virtualization.
Specifying requestedExecutionLevel node will disable file and registry virtualization.
compatibility then delete the requestedExecutionLevel node.
compatibility then delete the requestedExecutionLevel node.
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
<!-- A list of all Windows versions that this application is designed to work with. Windows will automatically select the most compatible environment.-->
<!-- A list of all Windows versions that this application is designed to work with. Windows will automatically select the most compatible environment.-->
<!-- If your application is designed to work with Windows 7, uncomment the following supportedOS node-->
<!-- If your application is designed to work with Windows 7, uncomment the following supportedOS node-->
<!--<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>-->
<!--<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>-->
<!-- Enable themes for Windows common controls and dialogs (Windows XP and later) -->
<!-- Enable themes for Windows common controls and dialogs (Windows XP and later) -->
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
%%0.ß
%%0.ß
Apple Computer\Preferences\keychain.plist
Apple Computer\Preferences\keychain.plist
LoadPasswordsIE
LoadPasswordsIE
LoadPasswordsFirefox
LoadPasswordsFirefox
LoadPasswordsChrome
LoadPasswordsChrome
LoadPasswordsOpera
LoadPasswordsOpera
LoadPasswordsSafari
LoadPasswordsSafari
LoadPasswordsSeaMonkey
LoadPasswordsSeaMonkey
UseFirefoxProfileFolder
UseFirefoxProfileFolder
UseFirefoxInstallFolder
UseFirefoxInstallFolder
UseChromeProfileFolder
UseChromeProfileFolder
UseOperaPasswordFile
UseOperaPasswordFile
FirefoxProfileFolder
FirefoxProfileFolder
FirefoxInstallFolder
FirefoxInstallFolder
ChromeProfileFolder
ChromeProfileFolder
OperaPasswordFile
OperaPasswordFile
Aadvapi32.dll
Aadvapi32.dll
crypt32.dll
crypt32.dll
777705555443332
777705555443332
5555443332
5555443332
5555443332
5555443332
wand.dat
wand.dat
@nss3.dll
@nss3.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe
%programfiles%\Sea Monkey
%programfiles%\Sea Monkey
%programfiles%\Mozilla Firefox
%programfiles%\Mozilla Firefox
-signons.txt
-signons.txt
signons2.txt
signons2.txt
signons3.txt
signons3.txt
@dllhost.exe
@dllhost.exe
taskhost.exe
taskhost.exe
taskhostex.exe
taskhostex.exe
Microsoft\Windows\WebCache\WebCacheV01.dat
Microsoft\Windows\WebCache\WebCacheV01.dat
Microsoft\Windows\WebCache\WebCacheV24.dat
Microsoft\Windows\WebCache\WebCacheV24.dat
index.dat
index.dat
https://www.google.com/accounts/servicelogin
https://www.google.com/accounts/servicelogin
http://www.facebook.com/
http://www.facebook.com/
https://login.yahoo.com/config/login
https://login.yahoo.com/config/login
http://
http://
https://
https://
ftp://
ftp://
@history.dat
@history.dat
places.sqlite
places.sqlite
Mozilla\Firefox\Profiles
Mozilla\Firefox\Profiles
Mozilla\SeaMonkey\Profiles
Mozilla\SeaMonkey\Profiles
Mozilla\SeaMonkey
Mozilla\SeaMonkey
Mozilla\Firefox
Mozilla\Firefox
profiles.ini
profiles.ini
Profile%d
Profile%d
tntdll.dll
tntdll.dll
sWeb Data
sWeb Data
Login Data
Login Data
Google\Chrome\User Data
Google\Chrome\User Data
Google\Chrome SxS\User Data
Google\Chrome SxS\User Data
Opera\Opera\wand.dat
Opera\Opera\wand.dat
Opera\Opera7\profile\wand.dat
Opera\Opera7\profile\wand.dat
Opera
Opera
@"%s"
@"%s"
Ashell32.dll
Ashell32.dll
\nss3.dll
\nss3.dll
.save
.save
vaultcli.dll
vaultcli.dll
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
Copy &Password
Copy &Password
&HTML Report - All Items
&HTML Report - All Items
HTML R&eport - Selected Items
HTML R&eport - Selected Items
HTML Report - All Items
HTML Report - All Items
HTML Report - Selected Items
HTML Report - Selected Items
Load Passwords From...
Load Passwords From...
Google Chrome
Google Chrome
Mozilla Firefox
Mozilla Firefox
SeaMonkey
SeaMonkey
Firefox Options
Firefox Options
Master password:
Master password:
Firefox Profile:
Firefox Profile:
Firefox Installation:
Firefox Installation:
Chrome Options
Chrome Options
Opera Options
Opera Options
wand.dat file:
wand.dat file:
%d Passwords
%d Passwords
, %d Selected
, %d Selected
Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat)
Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat)
Loading... %d
Loading... %d
KeePass csv file
KeePass csv file
Opera Password File
Opera Password File
Firefox 1.x
Firefox 1.x
Firefox 2.x
Firefox 2.x
Firefox 3.0
Firefox 3.0
Firefox
Firefox
Chrome
Chrome
Web Browser
Web Browser
Password
Password
Password Strength
Password Strength
Password Field
Password Field
WebBrowserPassView.exe
WebBrowserPassView.exe
www.google.com/Please log in to your Gmail account
www.google.com/Please log in to your Gmail account
www.google.com:443/Please log in to your Gmail account
www.google.com:443/Please log in to your Gmail account
www.google.com/Please log in to your Google Account
www.google.com/Please log in to your Google Account
www.google.com:443/Please log in to your Google Account
www.google.com:443/Please log in to your Google Account
www.google.com
www.google.com
dWindowsLive:name=*
dWindowsLive:name=*
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
Copy Password
Copy Password
%d items
%d items
Select Eudora.ini filename/Select the location of Thunderbird installation
Select Eudora.ini filename/Select the location of Thunderbird installation
Eudora.ini file
Eudora.ini file
SMTP
SMTP
Windows Mail
Windows Mail
Windows Live Mail
Windows Live Mail
Server Port
Server Port
SMTP Server Port
SMTP Server Port
Mail Password Recovery
Mail Password Recovery
mailpv.exe
mailpv.exe
#. ; 3;)
#. ; 3;)
noftp
noftp
Disablecmd
Disablecmd
\Windows Update.exe
\Windows Update.exe
\WindowsUpdate.exe
\WindowsUpdate.exe
SysInfo.txt
SysInfo.txt
\pid.txt
\pid.txt
\pidloc.txt
\pidloc.txt
\Mozilla\Firefox\Profiles
\Mozilla\Firefox\Profiles
127.0.0.1
127.0.0.1
\SteamAppData.vdf
\SteamAppData.vdf
\ClientRegistry.blob
\ClientRegistry.blob
Keylogger Enabled:
Keylogger Enabled:
Operating System:
Operating System:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
autorun.inf
autorun.inf
open=Sys.exe
open=Sys.exe
Sys.exe
Sys.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Windows Update
Windows Update
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
\bitcoin\wallet.dat
\bitcoin\wallet.dat
_wallet.dat
_wallet.dat
wallet.dat
wallet.dat
Microsoft.NET\Framework\v2.0.50727\vbc.exe
Microsoft.NET\Framework\v2.0.50727\vbc.exe
holdermail.txt"
holdermail.txt"
holdermail.txt
holdermail.txt
Operating System Intel Recovery
Operating System Intel Recovery
Operating System Platform:
Operating System Platform:
Operating System Version:
Operating System Version:
WEB Browser Password Recovery
WEB Browser Password Recovery
Mail Messenger Password Recovery
Mail Messenger Password Recovery
Jdownloader Password Recovery
Jdownloader Password Recovery
holderwb.txt"
holderwb.txt"
holderwb.txt
holderwb.txt
C:\Users\
C:\Users\
_Pin0.jpeg
_Pin0.jpeg
_Pin1.jpeg
_Pin1.jpeg
_Pin2.jpeg
_Pin2.jpeg
_Pin3.jpeg
_Pin3.jpeg
_Pin4.jpeg
_Pin4.jpeg
Steals the Wallet.DAT file that holds the users bitcoin currency
Steals the Wallet.DAT file that holds the users bitcoin currency
\.minecraft\lastlogin
\.minecraft\lastlogin
There is a file attached to this email containing Minecraft username and password download it then decrypt the login information with my Minecraft Decryptor
There is a file attached to this email containing Minecraft username and password download it then decrypt the login information with my Minecraft Decryptor
Predator Pain v13 - Key Recorder - [
Predator Pain v13 - Key Recorder - [
Keylogger Log
Keylogger Log
.jpeg
.jpeg
Predator_Pain_v13_KeyLog_
Predator_Pain_v13_KeyLog_
http://whatismyipaddress.com/
http://whatismyipaddress.com/
Microsoft.Resources
Microsoft.Resources
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
RegSvcs.exe_436_rwx_00400000_00084000:
.text
.text
`.rsrc
`.rsrc
@.reloc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
v2.0.50727
v2.0.50727
CMemoryExecute.dll
CMemoryExecute.dll
CMemoryExecute
CMemoryExecute
PAGE_EXECUTE_READWRITE
PAGE_EXECUTE_READWRITE
.ctor
.ctor
System.Reflection
System.Reflection
System.Runtime.InteropServices
System.Runtime.InteropServices
System.Security.Permissions
System.Security.Permissions
System.Diagnostics
System.Diagnostics
System.Runtime.CompilerServices
System.Runtime.CompilerServices
DllImportAttribute
DllImportAttribute
kernel32.dll
kernel32.dll
ntdll.dll
ntdll.dll
System.Security
System.Security
$8fcd4931-91a2-4e18-849b-70de34ab75df
$8fcd4931-91a2-4e18-849b-70de34ab75df
1.0.0.0
1.0.0.0
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb
C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb
mscoree.dll
mscoree.dll
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
D$.SPf
D$.SPf
2 34 567
2 34 567
com.apple.Safari
com.apple.Safari
com.apple.WebKit2WebProcess
com.apple.WebKit2WebProcess
SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins
SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins
"Account","Login Name","Password","Web Site","Comments"
"Account","Login Name","Password","Web Site","Comments"
3.7.5
3.7.5
SQLite format 3
SQLite format 3
CREATE TABLE sqlite_master(
CREATE TABLE sqlite_master(
sql text
sql text
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins
SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
PK11_CheckUserPassword
PK11_CheckUserPassword
large file support is disabled
large file support is disabled
unknown operation
unknown operation
SQL logic error or missing database
SQL logic error or missing database
foreign_keys
foreign_keys
sqlite_compileoption_get
sqlite_compileoption_get
sqlite_compileoption_used
sqlite_compileoption_used
sqlite_source_id
sqlite_source_id
sqlite_version
sqlite_version
sqlite_attach
sqlite_attach
sqlite_detach
sqlite_detach
sqlite_stat1
sqlite_stat1
sqlite_rename_parent
sqlite_rename_parent
sqlite_rename_trigger
sqlite_rename_trigger
sqlite_rename_table
sqlite_rename_table
%Y-%m-%d %H:%M:%S
%Y-%m-%d %H:%M:%S
%Y-%m-%d
%Y-%m-%d
%H:%M:%S
%H:%M:%S
SQLITE_
SQLITE_
failed to allocate %u bytes of memory
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
failed memory resize %u to %u bytes
922337203685477580
922337203685477580
API call with %s database connection pointer
API call with %s database connection pointer
%s-shm
%s-shm
%s\etilqs_
%s\etilqs_
OsError 0x%x (%u)
OsError 0x%x (%u)
Recovered %d frames from WAL file %s
Recovered %d frames from WAL file %s
%s-mjX
%s-mjX
foreign key constraint failed
foreign key constraint failed
unable to use function %s in the requested context
unable to use function %s in the requested context
abort at %d in [%s]: %s
abort at %d in [%s]: %s
constraint failed at %d in [%s]
constraint failed at %d in [%s]
cannot open savepoint - SQL statements in progress
cannot open savepoint - SQL statements in progress
no such savepoint: %s
no such savepoint: %s
cannot %s savepoint - SQL statements in progress
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot change %s wal mode from within a transaction
cannot change %s wal mode from within a transaction
statement aborts at %d: [%s] %s
statement aborts at %d: [%s] %s
misuse of aliased aggregate %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s.%s
%s: %s.%s
%s: %s.%s
%s: %s
%s: %s
%r %s BY term out of range - should be between 1 and %d
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
variable number must be between ?1 and ?%d
too many SQL variables
too many SQL variables
too many columns in %s
too many columns in %s
oversized integer: %s%s
oversized integer: %s%s
misuse of aggregate: %s()
misuse of aggregate: %s()
%.*s"%w"%s
%.*s"%w"%s
%s%.*s"%w"
%s%.*s"%w"
%s OR name=%Q
%s OR name=%Q
type='trigger' AND (%s)
type='trigger' AND (%s)
there is already another table or index with this name: %s
there is already another table or index with this name: %s
sqlite_
sqlite_
table %s may not be altered
table %s may not be altered
view %s may not be altered
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_altertab_%s
CREATE TABLE %Q.%s(%s)
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE tbl=%Q
DELETE FROM %Q.%s WHERE tbl=%Q
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
invalid name: "%s"
too many attached databases - max %d
too many attached databases - max %d
database %s is already in use
database %s is already in use
unable to open database: %s
unable to open database: %s
no such database: %s
no such database: %s
cannot detach database %s
cannot detach database %s
database %s is locked
database %s is locked
%s %T cannot reference objects in database %s
%s %T cannot reference objects in database %s
object name reserved for internal use: %s
object name reserved for internal use: %s
there is already an index named %s
there is already an index named %s
too many columns on %s
too many columns on %s
duplicate column name: %s
duplicate column name: %s
default value of column [%s] is not constant
default value of column [%s] is not constant
table "%s" has more than one primary key
table "%s" has more than one primary key
no such collation sequence: %s
no such collation sequence: %s
CREATE %s %.*s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
view %s is circularly defined
view %s is circularly defined
table %s may not be dropped
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
use DROP VIEW to delete view %s
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
foreign key on %s should reference only one column of table %T
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
unknown column "%s" in foreign key definition
indexed columns are not unique
indexed columns are not unique
table %s may not be indexed
table %s may not be indexed
views may not be indexed
views may not be indexed
virtual tables may not be indexed
virtual tables may not be indexed
there is already a table named %s
there is already a table named %s
index %s already exists
index %s already exists
sqlite_autoindex_%s_%d
sqlite_autoindex_%s_%d
table %s has no column named %s
table %s has no column named %s
CREATE%s INDEX %.*s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
a JOIN clause is required before %s
a JOIN clause is required before %s
unable to identify the object to be reindexed
unable to identify the object to be reindexed
table %s may not be modified
table %s may not be modified
cannot modify %s because it is a view
cannot modify %s because it is a view
foreign key mismatch
foreign key mismatch
table %S has %d columns but %d values were supplied
table %S has %d columns but %d values were supplied
%d values for %d columns
%d values for %d columns
table %S has no column named %s
table %S has no column named %s
%s.%s may not be NULL
%s.%s may not be NULL
PRIMARY KEY must be unique
PRIMARY KEY must be unique
automatic extension loading failed: %s
automatic extension loading failed: %s
foreign_key_list
foreign_key_list
malformed database schema (%s)
malformed database schema (%s)
%s - %s
%s - %s
unsupported file format
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
unknown or unsupported join type: %T %T%s%T
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
cannot join using column %s - column not present in both tables
%s.%s
%s.%s
%s:%d
%s:%d
no such index: %s
no such index: %s
sqlite_subquery_%p_
sqlite_subquery_%p_
no such table: %s
no such table: %s
cannot create %s trigger on view: %S
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
no such trigger: %S
no such column: %s
no such column: %s
cannot VACUUM - SQL statements in progress
cannot VACUUM - SQL statements in progress
PRAGMA vacuum_db.synchronous=OFF
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor failed: %s
vtable constructor did not declare schema: %s
vtable constructor did not declare schema: %s
no such module: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
at most %d tables in a join
cannot use index: %s
cannot use index: %s
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
unable to close due to unfinished backup operation
unable to close due to unfinished backup operation
unknown database: %s
unknown database: %s
no such vfs: %s
no such vfs: %s
database corruption at line %d of [%.10s]
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
cannot open file at line %d of [%.10s]
sqlite3_open
sqlite3_open
sqlite3_prepare
sqlite3_prepare
sqlite3_step
sqlite3_step
sqlite3_column_text
sqlite3_column_text
sqlite3_column_int
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_int64
sqlite3_finalize
sqlite3_finalize
sqlite3_close
sqlite3_close
sqlite3_exec
sqlite3_exec
f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb
f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb
msvcrt.dll
msvcrt.dll
_wcmdln
_wcmdln
COMCTL32.dll
COMCTL32.dll
VERSION.dll
VERSION.dll
FindCloseUrlCache
FindCloseUrlCache
FindNextUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryW
WININET.dll
WININET.dll
GetWindowsDirectoryW
GetWindowsDirectoryW
KERNEL32.dll
KERNEL32.dll
EnumChildWindows
EnumChildWindows
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
comdlg32.dll
comdlg32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
5JEw%Xg
5JEw%Xg
<assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
<assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
http://www.usertrust.com1
http://www.usertrust.com1
3http://crl.usertrust.com/AddTrustExternalCARoot.crl05
3http://crl.usertrust.com/AddTrustExternalCARoot.crl05
http://ocsp.usertrust.com0
http://ocsp.usertrust.com0
1http://crl.usertrust.com/UTN-USERFirst-Object.crl05
1http://crl.usertrust.com/UTN-USERFirst-Object.crl05
1http://crl.usertrust.com/UTN-USERFirst-Object.crl0t
1http://crl.usertrust.com/UTN-USERFirst-Object.crl0t
1http://crt.usertrust.com/UTNAddTrustObject_CA.crt0%
1http://crt.usertrust.com/UTNAddTrustObject_CA.crt0%
https://secure.comodo.net/CPS0A
https://secure.comodo.net/CPS0A
0http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
0http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
0http://crt.comodoca.com/COMODOCodeSigningCA2.crt0$
0http://crt.comodoca.com/COMODOCodeSigningCA2.crt0$
http://ocsp.comodoca.com0
http://ocsp.comodoca.com0
support@nirsoft.net0
support@nirsoft.net0
t{SSh
t{SSh
v%SSW
v%SSW
Mail PassView
Mail PassView
Mozilla\Profiles
Mozilla\Profiles
Software\Mozilla\Mozilla Thunderbird
Software\Mozilla\Mozilla Thunderbird
%s\Main
%s\Main
sqlite3.dll
sqlite3.dll
nss3.dll
nss3.dll
%programfiles%\Mozilla Thunderbird
%programfiles%\Mozilla Thunderbird
AddExportHeaderLine
AddExportHeaderLine
%s %s %s
%s %s %s
HTTPMail User Name
HTTPMail User Name
SMTP USer Name
SMTP USer Name
HTTPMail Server
HTTPMail Server
SMTP Server
SMTP Server
POP3 Password2
POP3 Password2
IMAP Password2
IMAP Password2
HTTPMail Password2
HTTPMail Password2
SMTP Password2
SMTP Password2
POP3 Port
POP3 Port
IMAP Port
IMAP Port
HTTPMail Port
HTTPMail Port
SMTP Port
SMTP Port
HTTPMail Secure Connection
HTTPMail Secure Connection
SMTP Secure Connection
SMTP Secure Connection
SMTP Display Name
SMTP Display Name
SMTP Email Address
SMTP Email Address
POP3 Password
POP3 Password
IMAP Password
IMAP Password
HTTP Password
HTTP Password
SMTP Password
SMTP Password
HTTP User
HTTP User
SMTP User
SMTP User
HTTP Server URL
HTTP Server URL
HTTP Port
HTTP Port
HTTPMail Use SSL
HTTPMail Use SSL
SMTP Use SSL
SMTP Use SSL
%s\%s
%s\%s
PopPort
PopPort
PopPassword
PopPassword
SMTPAccount
SMTPAccount
SMTPServer
SMTPServer
SMTPPort
SMTPPort
SMTPLogSecure
SMTPLogSecure
SMTPPassword
SMTPPassword
%s\Accounts
%s\Accounts
LoginName
LoginName
SavePasswordText
SavePasswordText
ESMTPUsername
ESMTPUsername
ESMTPPassword
ESMTPPassword
POP3Password
POP3Password
fb.dat
fb.dat
%s@gmail.com
%s@gmail.com
%s@yahoo.com
%s@yahoo.com
Software\Microsoft\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
<meta http-equiv="content-type" content="text/html;charset=%s" />
<meta http-equiv="content-type" content="text/html;charset=%s" />
<br /><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p></p>
<br /><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p></p>
smtp
smtp
advapi32.dll
advapi32.dll
comctl32.dll
comctl32.dll
*.ini
*.ini
netmsg.dll
netmsg.dll
Error %d: %s
Error %d: %s
%s (%s)
%s (%s)
menu_%d
menu_%d
dialog_%d
dialog_%d
TranslatorURL
TranslatorURL
_lng.ini
_lng.ini
%-18s: %s
%-18s: %s
%%-%d.%ds
%%-%d.%ds
<td bgcolor="s" nowrap>%s</td>
<td bgcolor="s" nowrap>%s</td>
<td bgcolor="s">%s</td>
<td bgcolor="s">%s</td>
<tr><td%s nowrap><b>%s</b><td bgcolor="s">%s</td></td%s></tr>
<tr><td%s nowrap><b>%s</b><td bgcolor="s">%s</td></td%s></tr>
bgcolor="%s"
bgcolor="%s"
<font color="%s">%s</font>
<font color="%s">%s</font>
<%s>%s
<%s>%s
report.html
report.html
*.txt
*.txt
*.htm;*.html
*.htm;*.html
*.xml
*.xml
*.csv
*.csv
Software\NirSoft\MailPassView
Software\NirSoft\MailPassView
MailPassView
MailPassView
/skeepass
/skeepass
/deleteregkey
/deleteregkey
Failed to load the executable file !
Failed to load the executable file !
mail.account.account
mail.account.account
mail.server
mail.server
port
port
mail.identity
mail.identity
signon.signonfilename
signon.signonfilename
mailbox://%s@%s
mailbox://%s@%s
imap://%s@%s
imap://%s@%s
mailbox://%s
mailbox://%s
imap://%s
imap://%s
signons.txt
signons.txt
signons.sqlite
signons.sqlite
prefs.js
prefs.js
Password.NET Messenger Service
Password.NET Messenger Service
User.NET Messenger Service
User.NET Messenger Service
Passport.Net\*
Passport.Net\*
ps:password
ps:password
windowslive:name=
windowslive:name=
Exception %8.8X at address %8.8X in module %s
Exception %8.8X at address %8.8X in module %s
Stack Data: %s
Stack Data: %s
Code Data: %s
Code Data: %s
mozsqlite3.dll
mozsqlite3.dll
psapi.dll
psapi.dll
pstorec.dll
pstorec.dll
5e7e8100-9138-11d1-945a-00c04fc308ff
5e7e8100-9138-11d1-945a-00c04fc308ff
00000000-0000-0000-0000-000000000000
00000000-0000-0000-0000-000000000000
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
220D5CC1-853A-11D0-84BC-00C04FD43F8F
220D5CC1-853A-11D0-84BC-00C04FD43F8F
417E2D75-84BD-11D0-84BB-00C04FD43F8F
417E2D75-84BD-11D0-84BB-00C04FD43F8F
shell32.dll
shell32.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
shlwapi.dll
shlwapi.dll
<html><head>%s<title>%s</title></head></html>
<html><head>%s<title>%s</title></head></html>
%s <h3>%s</h3>
%s <h3>%s</h3>
size="%d"
size="%d"
color="#%s"
color="#%s"
<font color="%s"></font>
<font color="%s"></font>
<table border="1" cellpadding="5"><tr%s></tr%s></table>
<table border="1" cellpadding="5"><tr%s></tr%s></table>
width="%s"
width="%s"
<th%s>%s%s%s</th%s>
<th%s>%s%s%s</th%s>
SOFTWARE\Mozilla
SOFTWARE\Mozilla
mozilla
mozilla
%s\bin
%s\bin
PathToExe
PathToExe
\sqlite3.dll
\sqlite3.dll
\mozsqlite3.dll
\mozsqlite3.dll
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Live Mail
Software\Microsoft\Windows Live Mail
SMTP_Server
SMTP_Server
SMTP_User_Name
SMTP_User_Name
POP3_Password2
POP3_Password2
IMAP_Password2
IMAP_Password2
NNTP_Password2
NNTP_Password2
SMTP_Password2
SMTP_Password2
SMTP_Email_Address
SMTP_Email_Address
SMTP_Port
SMTP_Port
NNTP_Port
NNTP_Port
IMAP_Port
IMAP_Port
POP3_Port
POP3_Port
SMTP_Secure_Connection
SMTP_Secure_Connection
*.oeaccount
*.oeaccount
\Microsoft\Windows Mail
\Microsoft\Windows Mail
\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
f:\Projects\VS2005\mailpv\Release\mailpv.pdb
f:\Projects\VS2005\mailpv\Release\mailpv.pdb
_acmdln
_acmdln
RPCRT4.dll
RPCRT4.dll
GetWindowsDirectoryA
GetWindowsDirectoryA
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
RegEnumKeyA
RegEnumKeyA
RegEnumKeyExA
RegEnumKeyExA
ShellExecuteA
ShellExecuteA
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="NirSoft" type="win32"></assemblyIdentity><description>NirSoft</description><dependency><dependentAssembly><assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="NirSoft" type="win32"></assemblyIdentity><description>NirSoft</description><dependency><dependentAssembly><assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
Microsoft.exe
Microsoft.exe
Microsoft.VisualBasic
Microsoft.VisualBasic
System.Windows.Forms
System.Windows.Forms
System.Drawing
System.Drawing
System.Management
System.Management
tapi32.dll
tapi32.dll
rtm.dll
rtm.dll
user32.dll
user32.dll
Microsoft.Form1.resources
Microsoft.Form1.resources
Microsoft.Resources.resources
Microsoft.Resources.resources
Microsoft.My
Microsoft.My
WindowsFormsApplicationBase
WindowsFormsApplicationBase
Microsoft.VisualBasic.ApplicationServices
Microsoft.VisualBasic.ApplicationServices
System.ComponentModel
System.ComponentModel
System.CodeDom.Compiler
System.CodeDom.Compiler
Microsoft.VisualBasic.Devices
Microsoft.VisualBasic.Devices
m_MyWebServicesObjectProvider
m_MyWebServicesObjectProvider
.cctor
.cctor
get_WebServices
get_WebServices
HelpKeywordAttribute
HelpKeywordAttribute
System.ComponentModel.Design
System.ComponentModel.Design
WebServices
WebServices
Microsoft.VisualBasic.CompilerServices
Microsoft.VisualBasic.CompilerServices
System.Collections
System.Collections
ContainsKey
ContainsKey
InvalidOperationException
InvalidOperationException
MyWebServices
MyWebServices
encryptedpassstring
encryptedpassstring
encryptedsmtpstring
encryptedsmtpstring
portstring
portstring
encryptedftphost
encryptedftphost
encryptedftpuser
encryptedftpuser
encryptedftppass
encryptedftppass
useftp
useftp
websitevisitor
websitevisitor
websiteblocker
websiteblocker
passstring
passstring
smtpstring
smtpstring
ftphost
ftphost
ftpuser
ftpuser
ftppass
ftppass
WM_KEYUP
WM_KEYUP
WM_KEYDOWN
WM_KEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYUP
WM_SYSKEYUP
KeyboardHandle
KeyboardHandle
KeyLog
KeyLog
CleanedPasswordsMAIL
CleanedPasswordsMAIL
CleanedPasswordsWB
CleanedPasswordsWB
System.IO
System.IO
get_ExecutablePath
get_ExecutablePath
WindowsIdentity
WindowsIdentity
System.Security.Principal
System.Security.Principal
set_WindowState
set_WindowState
FormWindowState
FormWindowState
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookEx
SetWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
GetAsyncKeyState
GetAsyncKeyState
vKey
vKey
HookKeyboard
HookKeyboard
UnhookKeyboard
UnhookKeyboard
Operators
Operators
get_Keyboard
get_Keyboard
Keyboard
Keyboard
get_CtrlKeyDown
get_CtrlKeyDown
get_AltKeyDown
get_AltKeyDown
KeyboardCallback
KeyboardCallback
set_UseShellExecute
set_UseShellExecute
System.Threading
System.Threading
System.Collections.Generic
System.Collections.Generic
Microsoft.VisualBasic.MyServices
Microsoft.VisualBasic.MyServices
System.Collections.ObjectModel
System.Collections.ObjectModel
MsgBox
MsgBox
MsgBoxResult
MsgBoxResult
MsgBoxStyle
MsgBoxStyle
ForceSteamLogin
ForceSteamLogin
System.Net.NetworkInformation
System.Net.NetworkInformation
get_OperationalStatus
get_OperationalStatus
OperationalStatus
OperationalStatus
FakemsgInstall
FakemsgInstall
System.Net.Mail
System.Net.Mail
SmtpClient
SmtpClient
System.Globalization
System.Globalization
set_Port
set_Port
System.Net
System.Net
Microsoft.Win32
Microsoft.Win32
RegistryKey
RegistryKey
OpenSubKey
OpenSubKey
System.Security.Cryptography
System.Security.Cryptography
System.Text
System.Text
set_Key
set_Key
stealWebroswers
stealWebroswers
WebClient
WebClient
readweb
readweb
System.IO.Compression
System.IO.Compression
SendLogsFTP
SendLogsFTP
FtpWebRequest
FtpWebRequest
WebRequest
WebRequest
UploadFTP
UploadFTP
secretKey
secretKey
set_KeySize
set_KeySize
get_KeySize
get_KeySize
System.Net.Sockets
System.Net.Sockets
virtualKey
virtualKey
KeyboardHookDelegate
KeyboardHookDelegate
get_Msg
get_Msg
Microsoft.My.Resources
Microsoft.My.Resources
System.Resources
System.Resources
get_CMemoryExecute
get_CMemoryExecute
get_WebBrowserPassView
get_WebBrowserPassView
WebBrowserPassView
WebBrowserPassView
System.Configuration
System.Configuration
8.0.0.0
8.0.0.0
My.Computer
My.Computer
My.Application
My.Application
My.User
My.User
My.Forms
My.Forms
My.WebServices
My.WebServices
System.Windows.Forms.Form
System.Windows.Forms.Form
My.MyProject.Forms
My.MyProject.Forms
4System.Web.Services.Protocols.SoapHttpClientProtocol
4System.Web.Services.Protocols.SoapHttpClientProtocol
3System.Resources.Tools.StronglyTypedResourceBuilder
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
10.0.0.0
10.0.0.0
My.Settings
My.Settings
$104c270e-c552-4216-b1b0-d68a8f9c4a3e
$104c270e-c552-4216-b1b0-d68a8f9c4a3e
_CorExeMain
_CorExeMain
<asmv1:assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"></asmv1:assembly>
<asmv1:assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"></asmv1:assembly>
<assemblyIdentity version="1.0.0.0" name="MyApplication.app" />
<assemblyIdentity version="1.0.0.0" name="MyApplication.app" />
If you want to change the Windows User Account Control level replace the
If you want to change the Windows User Account Control level replace the
requestedExecutionLevel node with one of the following.
requestedExecutionLevel node with one of the following.
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
Specifying requestedExecutionLevel node will disable file and registry virtualization.
Specifying requestedExecutionLevel node will disable file and registry virtualization.
compatibility then delete the requestedExecutionLevel node.
compatibility then delete the requestedExecutionLevel node.
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
<!-- A list of all Windows versions that this application is designed to work with. Windows will automatically select the most compatible environment.-->
<!-- A list of all Windows versions that this application is designed to work with. Windows will automatically select the most compatible environment.-->
<!-- If your application is designed to work with Windows 7, uncomment the following supportedOS node-->
<!-- If your application is designed to work with Windows 7, uncomment the following supportedOS node-->
<!--<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>-->
<!--<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>-->
<!-- Enable themes for Windows common controls and dialogs (Windows XP and later) -->
<!-- Enable themes for Windows common controls and dialogs (Windows XP and later) -->
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
%%0.ß
%%0.ß
Apple Computer\Preferences\keychain.plist
Apple Computer\Preferences\keychain.plist
LoadPasswordsIE
LoadPasswordsIE
LoadPasswordsFirefox
LoadPasswordsFirefox
LoadPasswordsChrome
LoadPasswordsChrome
LoadPasswordsOpera
LoadPasswordsOpera
LoadPasswordsSafari
LoadPasswordsSafari
LoadPasswordsSeaMonkey
LoadPasswordsSeaMonkey
UseFirefoxProfileFolder
UseFirefoxProfileFolder
UseFirefoxInstallFolder
UseFirefoxInstallFolder
UseChromeProfileFolder
UseChromeProfileFolder
UseOperaPasswordFile
UseOperaPasswordFile
FirefoxProfileFolder
FirefoxProfileFolder
FirefoxInstallFolder
FirefoxInstallFolder
ChromeProfileFolder
ChromeProfileFolder
OperaPasswordFile
OperaPasswordFile
Aadvapi32.dll
Aadvapi32.dll
crypt32.dll
crypt32.dll
777705555443332
777705555443332
5555443332
5555443332
5555443332
5555443332
wand.dat
wand.dat
@nss3.dll
@nss3.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe
%programfiles%\Sea Monkey
%programfiles%\Sea Monkey
%programfiles%\Mozilla Firefox
%programfiles%\Mozilla Firefox
-signons.txt
-signons.txt
signons2.txt
signons2.txt
signons3.txt
signons3.txt
@dllhost.exe
@dllhost.exe
taskhost.exe
taskhost.exe
taskhostex.exe
taskhostex.exe
Microsoft\Windows\WebCache\WebCacheV01.dat
Microsoft\Windows\WebCache\WebCacheV01.dat
Microsoft\Windows\WebCache\WebCacheV24.dat
Microsoft\Windows\WebCache\WebCacheV24.dat
index.dat
index.dat
https://www.google.com/accounts/servicelogin
https://www.google.com/accounts/servicelogin
http://www.facebook.com/
http://www.facebook.com/
https://login.yahoo.com/config/login
https://login.yahoo.com/config/login
http://
http://
https://
https://
ftp://
ftp://
@history.dat
@history.dat
places.sqlite
places.sqlite
Mozilla\Firefox\Profiles
Mozilla\Firefox\Profiles
Mozilla\SeaMonkey\Profiles
Mozilla\SeaMonkey\Profiles
Mozilla\SeaMonkey
Mozilla\SeaMonkey
Mozilla\Firefox
Mozilla\Firefox
profiles.ini
profiles.ini
Profile%d
Profile%d
tntdll.dll
tntdll.dll
sWeb Data
sWeb Data
Login Data
Login Data
Google\Chrome\User Data
Google\Chrome\User Data
Google\Chrome SxS\User Data
Google\Chrome SxS\User Data
Opera\Opera\wand.dat
Opera\Opera\wand.dat
Opera\Opera7\profile\wand.dat
Opera\Opera7\profile\wand.dat
Opera
Opera
@"%s"
@"%s"
Ashell32.dll
Ashell32.dll
\nss3.dll
\nss3.dll
.save
.save
vaultcli.dll
vaultcli.dll
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
Copy &Password
Copy &Password
&HTML Report - All Items
&HTML Report - All Items
HTML R&eport - Selected Items
HTML R&eport - Selected Items
HTML Report - All Items
HTML Report - All Items
HTML Report - Selected Items
HTML Report - Selected Items
Load Passwords From...
Load Passwords From...
Google Chrome
Google Chrome
Mozilla Firefox
Mozilla Firefox
SeaMonkey
SeaMonkey
Firefox Options
Firefox Options
Master password:
Master password:
Firefox Profile:
Firefox Profile:
Firefox Installation:
Firefox Installation:
Chrome Options
Chrome Options
Opera Options
Opera Options
wand.dat file:
wand.dat file:
%d Passwords
%d Passwords
, %d Selected
, %d Selected
Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat)
Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat)
Loading... %d
Loading... %d
KeePass csv file
KeePass csv file
Opera Password File
Opera Password File
Firefox 1.x
Firefox 1.x
Firefox 2.x
Firefox 2.x
Firefox 3.0
Firefox 3.0
Firefox
Firefox
Chrome
Chrome
Web Browser
Web Browser
Password
Password
Password Strength
Password Strength
Password Field
Password Field
WebBrowserPassView.exe
WebBrowserPassView.exe
www.google.com/Please log in to your Gmail account
www.google.com/Please log in to your Gmail account
www.google.com:443/Please log in to your Gmail account
www.google.com:443/Please log in to your Gmail account
www.google.com/Please log in to your Google Account
www.google.com/Please log in to your Google Account
www.google.com:443/Please log in to your Google Account
www.google.com:443/Please log in to your Google Account
www.google.com
www.google.com
dWindowsLive:name=*
dWindowsLive:name=*
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
Copy Password
Copy Password
%d items
%d items
Select Eudora.ini filename/Select the location of Thunderbird installation
Select Eudora.ini filename/Select the location of Thunderbird installation
Eudora.ini file
Eudora.ini file
SMTP
SMTP
Windows Mail
Windows Mail
Windows Live Mail
Windows Live Mail
Server Port
Server Port
SMTP Server Port
SMTP Server Port
Mail Password Recovery
Mail Password Recovery
mailpv.exe
mailpv.exe
#. ; 3;)
#. ; 3;)
noftp
noftp
Disablecmd
Disablecmd
\Windows Update.exe
\Windows Update.exe
\WindowsUpdate.exe
\WindowsUpdate.exe
SysInfo.txt
SysInfo.txt
\pid.txt
\pid.txt
\pidloc.txt
\pidloc.txt
\Mozilla\Firefox\Profiles
\Mozilla\Firefox\Profiles
127.0.0.1
127.0.0.1
\SteamAppData.vdf
\SteamAppData.vdf
\ClientRegistry.blob
\ClientRegistry.blob
Keylogger Enabled:
Keylogger Enabled:
Operating System:
Operating System:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
autorun.inf
autorun.inf
open=Sys.exe
open=Sys.exe
Sys.exe
Sys.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Windows Update
Windows Update
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
\bitcoin\wallet.dat
\bitcoin\wallet.dat
_wallet.dat
_wallet.dat
wallet.dat
wallet.dat
Microsoft.NET\Framework\v2.0.50727\vbc.exe
Microsoft.NET\Framework\v2.0.50727\vbc.exe
holdermail.txt"
holdermail.txt"
holdermail.txt
holdermail.txt
Operating System Intel Recovery
Operating System Intel Recovery
Operating System Platform:
Operating System Platform:
Operating System Version:
Operating System Version:
WEB Browser Password Recovery
WEB Browser Password Recovery
Mail Messenger Password Recovery
Mail Messenger Password Recovery
Jdownloader Password Recovery
Jdownloader Password Recovery
holderwb.txt"
holderwb.txt"
holderwb.txt
holderwb.txt
C:\Users\
C:\Users\
_Pin0.jpeg
_Pin0.jpeg
_Pin1.jpeg
_Pin1.jpeg
_Pin2.jpeg
_Pin2.jpeg
_Pin3.jpeg
_Pin3.jpeg
_Pin4.jpeg
_Pin4.jpeg
Steals the Wallet.DAT file that holds the users bitcoin currency
Steals the Wallet.DAT file that holds the users bitcoin currency
\.minecraft\lastlogin
\.minecraft\lastlogin
There is a file attached to this email containing Minecraft username and password download it then decrypt the login information with my Minecraft Decryptor
There is a file attached to this email containing Minecraft username and password download it then decrypt the login information with my Minecraft Decryptor
Predator Pain v13 - Key Recorder - [
Predator Pain v13 - Key Recorder - [
Keylogger Log
Keylogger Log
.jpeg
.jpeg
Predator_Pain_v13_KeyLog_
Predator_Pain_v13_KeyLog_
http://whatismyipaddress.com/
http://whatismyipaddress.com/
Microsoft.Resources
Microsoft.Resources
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
RegSvcs.exe_436_rwx_00A2A000_00003000:
okEy
okEy