Sample details: 551dcf42025409fbf4a2f27ac5e55e46 --

Hashes
MD5: 551dcf42025409fbf4a2f27ac5e55e46
SHA1: 8626f306e7d3a726c30e095da975355a584b92ac
SHA256: 3c0ead422aba2eaba8967431b9bfd5e116511c48c54da5998455e29ff7a92f28
SSDEEP: 6144:ibS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9LHj:iQtqB5urTIoYWBQk1E+VF9mOx9X
Details
File Type: PE32
Yara Hits
YRP/Microsoft_Visual_Studio_NET | YRP/Microsoft_Visual_C_v70_Basic_NET_additional | YRP/Microsoft_Visual_C_Basic_NET | YRP/Microsoft_Visual_Studio_NET_additional | YRP/Microsoft_Visual_C_v70_Basic_NET | YRP/NET_executable_ | YRP/NET_executable | YRP/NETDLLMicrosoft | YRP/NETexecutableMicrosoft | YRP/IsPE32 | YRP/IsNET_EXE | YRP/IsWindowsGUI | YRP/domain | YRP/IP | YRP/url | YRP/contentis_base64 | YRP/Browsers | YRP/Dropper_Strings | YRP/WMI_strings | YRP/Misc_Suspicious_Strings | YRP/ThreadControl__Context | YRP/inject_thread | YRP/network_smtp_dotNet | YRP/network_dns | YRP/screenshot | YRP/keylogger | YRP/cred_local | YRP/cred_ff | YRP/win_registry | YRP/win_private_profile | YRP/win_files_operation | YRP/win_hook | YRP/Big_Numbers1 | YRP/Advapi_Hash_API | YRP/MD5_Constants | YRP/RIPEMD160_Constants | YRP/SHA1_Constants | YRP/DES_Long | YRP/DES_sbox | YRP/Str_Win32_Wininet_Library | YRP/PredatorPain | YRP/with_sqlite | FlorianRoth/RAT_PredatorPain |
Strings
		!This program cannot be run in DOS mode.
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADPe
!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v2.0.50727
#Strings
<Module>
CMemoryExecute.dll
CMemoryExecute
mscorlib
System
Object
CONTEXT_FULL
CREATE_SUSPENDED
MEM_COMMIT
MEM_RESERVE
PAGE_EXECUTE_READWRITE
IMAGE_DOS_SIGNATURE
IMAGE_NT_SIGNATURE
CreateProcess
VirtualAllocEx
NtUnmapViewOfSection
NtWriteVirtualMemory
NtGetContextThread
NtSetContextThread
NtResumeThread
exeBuffer
hostProcess
optionalArguments
lpApplicationName
lpCommandLine
lpProcessAttributes
lpThreadAttributes
bInheritHandles
dwCreationFlags
lpEnvironment
lpCurrentDirectory
lpStartupInfo
lpProcessInfo
hProcess
lpAddress
dwSize
flAllocationType
flProtect
lpBaseAddress
lpBuffer
lpNumberOfBytesWritten
hThread
lpContext
SuspendCount
System.Reflection
AssemblyTitleAttribute
AssemblyDescriptionAttribute
AssemblyConfigurationAttribute
AssemblyCompanyAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyTrademarkAttribute
AssemblyCultureAttribute
System.Runtime.InteropServices
ComVisibleAttribute
GuidAttribute
AssemblyVersionAttribute
AssemblyFileVersionAttribute
System.Security.Permissions
SecurityPermissionAttribute
SecurityAction
System.Diagnostics
DebuggableAttribute
DebuggingModes
System.Runtime.CompilerServices
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
Buffer
BlockCopy
String
IsNullOrEmpty
Concat
IntPtr
op_Explicit
op_Equality
DllImportAttribute
kernel32.dll
ntdll.dll
System.Security
UnverifiableCodeAttribute
CMemoryExecute
Copyright 
  2012
$8fcd4931-91a2-4e18-849b-70de34ab75df
1.0.0.0
WrapNonExceptionThrows
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb
_CorDllMain
mscoree.dll
!This program cannot be run in DOS mode.
`.rdata
@.data
;\$H}	
O Qh,7D
O$Qh|7D
QQSVWh
%33333
%33333
YYtWC;
f93YYu^h
3f93u9
YYu49]
tqSVWj
GWCSPQ
0vpSW3
GGF;t$
u,WVhT
SVWj X
YYtZFj?V
D$Tj	P
YYt49\$
tff9t$@tI
D$@j	P
YY9t$$t
9^0W~.S
9^0~.S
9^0W~$S
9FHWt#9F0
j_ZRj 
9~(~ZS
9_(YY~{Vf
 C;_(|
f98t	P
9^0~BS
D$.SPf
WWWjhP
?t0j@_+
SVWt|H
H f91t
f90t'P
D$P+D$H
D$X+D$P
D$l+D$d@P3
+D$dAQ
L$H+L$@AQ
Bt9HHt.
Ht'HuE
YY~'Ph$
YYj(Wh
YY_^[Y
 t1Jt3JJt#
FB;T$8|
[9\$ u*
Ht	HHt;j
QQUVWj
F@YtV3
F09~0~
8\t	@@f9
ti;>we
9^(u<9]
u,j$SW
YtcSVj
YYu=9]
;_Tt2SV
0;w`Y|
0C;^`|
tr=xCD
K(;HXt
YYuS9}
YucSSS
!GH!GL
u'9\$$t!
t'8^	t
0;F`Y|
P@YY_^
D$4rAj
D$D;D$<
D$@;D$8s
L$,;L$4vr;L$
D$09D$$wb
YYu)8G
;F4uPj
;F4s>3
YYuL!F4
u0f9^Z
YYu&9D$
u	9Y,u
LV\f!F:
DF\f;B
[f9\N\u
f9^ZtD
FZf9\F\t
rz;~,wu9]
LK\f;J
;A,SVWv
DF\f;A
V w+9^(
`$WtMf
#L$XPQWV
SVWj:Yj:
YY_^[Y
f9_2v#
L$ QSPW
u'9D$ t	
9_\u	S
ub9_\t
uA9_\t.
_l9_\t
8^eYYtF
t98^dt4SP
#F\_[Y
u	9^Lu
Rt:Ht)
Kt9Jt-Jt!Jt
xL;~Tu
@H:Bfs
 !""##$%&&&&'(()*+,--./0012345667789:;<======>????@@@@@A>BCDEFFGHIJKfLMNOPQRfSTUVWXYZf[f\]^_`afbcdffffffffffeU
	F(	V,
	G(	W,f
|$ u#QSV
!D$\9D$$
QQSVW3
:?Vuzj
D$$u)W
D$0_^[
<^tU<btQ<
1t}Ht2H
1t[It2I
9{@tTV
PPPPPV
GHVS@W
@I:AIt
YPSSSj|
9_@ub8^
YYu?9E
Y9~8t$9~4~
G;~4YY|
YY[_^]
,9s@u0
Q@PRh 
Q@PRh 
9E t+9E
Yue9D$
YYSSSSSS
9D$ s%
t&)L$ 
t$$9T$$
T$$t C<
YYt?GWSV
YYt6GWSV
t$$VUj
@_^][Y
uj9u ~eh
@S@PSjo
PPPPPP
9}tu	9}
1;uXt	@
9Mpt	;
E\u+VjJ
AAQVjI
u<@@Pj
HtNHtCHtHH
T$(RQj
9\$ uD
Yt,hHDD
SPSVSj^
tq;wL~"h
YYt	VW
<qtM<vu
~F9D$$u@
9T$Pu&9T$$
}tt2SW
9]dYYu
;K@Wt?
IttIt;j
PPPPPP
YYuCCC
t4< t03
YYt-9_0t(V
t(9{ u#QP
	M,	E0C;_
	U,	M0
	M,	E0
U@t"RP
E4;EHt
	} 	E$
#EP#MT
us9u8|
E<9p4t
tH9u8|0
E<8;E`
E\P;E`
Q@PRh 
WWWWWWW
t,WWWWWWW
+2+34+567
+%PQRS
+TUVWXY4Z[\
>]^_`abbcdaaefghijkllllllllmnmnopqrstuuvw
yz{|}~
HtiHt^HtSHtHHt=H
<tHHt0H
GHh@nD
unSWh<
QShl=D
v	N+D$
v	N+D$
com.apple.Safari
com.apple.WebKit2WebProcess
SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins 
"Account","Login Name","Password","Web Site","Comments"
CredReadA
CredFree
CredDeleteA
CredEnumerateA
CredEnumerateW
CryptUnprotectData
CryptAcquireContextA
CryptReleaseContext
CryptCreateHash
CryptGetHashParam
CryptHashData
CryptDestroyHash
InitCommonControlsEx
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
******""""""""""""""""""""
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@l
LLLLLLLLLL
0123456789ABCDEF0123456789abcdef
                             
thstndrd
SQLite format 3
0123456789ABCDEF
naturaleftouterightfullinnercross
onoffalseyestruefull
CREATE TABLE sqlite_master(
  type text,
  name text,
  tbl_name text,
  rootpage integer,
  sql text
A?/,.-
MNOPQRSTUVWXYZ[\
12MNOPmRSTUVWXYZ[\
DEFGHIJKLMNOP
RSTUVWXYZ[\
RSTUVWXYZ[\
12ijk6n
DEFGHIJKLMNOPvRSTUVWXYZ[\
`abcdef
abcdefVW12vtm
^_ aXYZ[\
h)jDEFGHIJKLMNOP
RSTUVWXYZ[\
VWXYZ[\
DEFGHIJKLMNOP~RSTUVWXYZ[\
nDEFGHIJKLMNOPvRSTUVWXYZ[\
:DEFGHIJKLMNOP
RSTUVWXYZ[\
DEFGHIJKLMNOPwRSTUVWXYZ[\
DEFGHIJKLMNOP
RSTUVWXYZ[\
DEFGHIJKLMNOP
RSTUVWXYZ[\
DEFGHIJKLMNOP
RSTUVWXYZ[\
DEFGHIJKLMNOP
RSTUVWXYZ[\
DEFGHIJKLMNOP
RSTUVWXYZ[\
DEFGHIJKLMNOP
RSTUVWXYZ[\
GHEFGHIJKLMNOP
RSTUVWXYZ[\
FGHIJKLMNOP
RSTUVWXYZ[\
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
uLm:.P
)Q+e4"n-.1
3b1$ j
uFo,w_1#
;py=>/q
  ##%%&&))**,,//1122447788;;==>>@@CCEEFFIIJJLLOOQQRRTTWWXX[[]]^^aabbddgghhkkmmnnppssuuvvyyzz||
SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins
0123456789ABCDEF
NSS_Init
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_CheckUserPassword
PK11_Authenticate
PK11SDR_Decrypt
NtQuerySystemInformation
NtLoadDriver
NtUnloadDriver
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtQueryObject
NtSuspendProcess
NtResumeProcess
CreateToolhelp32Snapshot
Module32First
Module32Next
Process32First
Process32Next
GetModuleBaseNameW
EnumProcessModules
GetModuleFileNameExW
EnumProcesses
GetModuleInformation
QueryFullProcessImageNameW
GetProcessTimes
PStoreCreateInstance
SHGetSpecialFolderPathW
SHAutoComplete
file is encrypted or is not a database
bind or column index out of range
auxiliary database format error
authorization denied
large file support is disabled
library routine called out of sequence
datatype mismatch
constraint failed
table contains no data
locking protocol
unable to open database file
database or disk is full
unknown operation
database disk image is malformed
disk I/O error
interrupted
attempt to write a readonly database
database table is locked
database is locked
callback requested query abort
access permission denied
SQL logic error or missing database
not an error
memory
truncate
persist
delete
foreign_keys
recursive_triggers
read_uncommitted
omit_readlock
writable_schema
automatic_index
reverse_unordered_selects
checkpoint_fullfsync
fullfsync
legacy_file_format
empty_result_callbacks
count_changes
short_column_names
full_column_names
group_concat
zeroblob
replace
total_changes
changes
last_insert_rowid
sqlite_compileoption_get
sqlite_compileoption_used
sqlite_source_id
sqlite_version
nullif
randomblob
random
ifnull
coalesce
substr
length
typeof
sqlite_attach
sqlite_detach
tbl,idx,stat
sqlite_stat1
sqlite_rename_parent
sqlite_rename_trigger
sqlite_rename_table
current_timestamp
%Y-%m-%d %H:%M:%S
current_date
%Y-%m-%d
current_time
%H:%M:%S
THREADSAFE=1
TEMP_STORE=1
OMIT_XFER_OPT
OMIT_UTF16
OMIT_TRACE
OMIT_TEMPDB
OMIT_TCL_VARIABLE
OMIT_SHARED_CACHE
OMIT_SCHEMA_VERSION_PRAGMAS
OMIT_SCHEMA_PRAGMAS
OMIT_QUICKBALANCE
OMIT_PROGRESS_CALLBACK
OMIT_PAGER_PRAGMAS
OMIT_OR_OPTIMIZATION
OMIT_MEMORYDB
OMIT_LOAD_EXTENSION
OMIT_INTEGRITY_CHECK
OMIT_FLOATING_POINT
OMIT_EXPLAIN
OMIT_DATETIME_FUNCS
OMIT_COMPOUND_SELECT
OMIT_CHECK
OMIT_CAST
OMIT_BUILTIN_TEST
OMIT_BETWEEN_OPTIMIZATION
OMIT_AUTOVACUUM
OMIT_AUTOINCREMENT
OMIT_AUTHORIZATION
SQLITE_
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
(NULL)
922337203685477580
API call with %s database connection pointer
unopened
invalid
%s-shm
etilqs_
%s\etilqs_
OsError 0x%x (%u)
-journal
Recovered %d frames from WAL file %s
out of memory
%!.15g
%s-mj%08X
foreign key constraint failed
API called with finalized prepared statement
API called with NULL prepared statement
string or blob too big
unable to use function %s in the requested context
abort at %d in [%s]: %s
constraint failed at %d in [%s]
cannot open savepoint - SQL statements in progress
no such savepoint: %s
rollback
release
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
cannot start a transaction within a transaction
cannot rollback - no transaction is active
cannot commit - no transaction is active
database schema has changed
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
too many levels of trigger recursion
out of
cannot change %s wal mode from within a transaction
statement aborts at %d: [%s] %s
integer
misuse of aliased aggregate %s
no such column
ambiguous column name
%s: %s.%s.%s
%s: %s.%s
%s: %s
misuse of aggregate function %.*s()
no such function: %.*s
wrong number of arguments to function %.*s()
%r %s BY term out of range - should be between 1 and %d
too many terms in ORDER BY clause
%r ORDER BY term does not match any column in the result set
too many terms in %s BY clause
a GROUP BY clause is required before HAVING
aggregate functions are not allowed in the GROUP BY clause
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
too many SQL variables
too many columns in %s
_ROWID_
oversized integer: %s%s
misuse of aggregate: %s()
unknown function: %.*s()
RAISE() may only be used within a trigger-program
%.*s"%w"%s
%s%.*s"%w"
name=%Q
%s OR name=%Q
type='trigger' AND (%s)
tbl_name=%Q
there is already another table or index with this name: %s
sqlite_
table %s may not be altered
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
Cannot add a UNIQUE column
Cannot add a REFERENCES column with non-NULL default value
Cannot add a NOT NULL column with default value NULL
Cannot add a column with non-constant default
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
virtual tables may not be altered
Cannot add a column to a view
sqlite_altertab_%s
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE tbl=%Q
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
too many attached databases - max %d
cannot ATTACH database within transaction
database %s is already in use
database is already attached
attached databases must use the same text encoding as main database
unable to open database: %s
no such database: %s
cannot detach database %s
cannot DETACH database within transaction
database %s is locked
%s %T cannot reference objects in database %s
no such view
no such table
corrupt database
unknown database %T
object name reserved for internal use: %s
table %T already exists
there is already an index named %s
too many columns on %s
duplicate column name: %s
default value of column [%s] is not constant
table "%s" has more than one primary key
INTEGER
no such collation sequence: %s
CREATE TABLE 
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
tbl_name='%q'
parameters are not allowed in views
view %s is circularly defined
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
indexed columns are not unique
altertab_
table %s may not be indexed
views may not be indexed
virtual tables may not be indexed
there is already a table named %s
index %s already exists
sqlite_autoindex_%s_%d
table %s has no column named %s
conflicting ON CONFLICT clauses specified
 UNIQUE
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
name='%q' AND type='index'
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
a JOIN clause is required before %s
unable to open a temporary database file for storing temporary tables
unable to identify the object to be reindexed
table %s may not be modified
cannot modify %s because it is a view
rows deleted
integer overflow
LIKE or GLOB pattern too complex
ESCAPE expression must be a single character
BINARY
foreign key mismatch
table %S has %d columns but %d values were supplied
%d values for %d columns
table %S has no column named %s
rows inserted
%s.%s may not be NULL
PRIMARY KEY must be unique
columns 
column 
 are not unique
 is not unique
automatic extension loading failed: %s
SET NULL
SET DEFAULT
CASCADE
RESTRICT
NO ACTION
foreign_key_list
on_update
on_delete
case_sensitive_like
compile_options
compile_option
wal_checkpoint
wal_autocheckpoint
malformed database schema (%s)
%s - %s
invalid rootpage
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
statement too long
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
only a single result allowed for a SELECT that is part of an expression
no such index: %s
sqlite_subquery_%p_
no such table: %s
no tables specified
too many columns in result set
DISTINCT aggregates must have exactly one argument
temporary trigger may not have qualified name
trigger
cannot create triggers on virtual tables
trigger %T already exists
cannot create trigger on system table
BEFORE
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
type='trigger' AND name='%q'
no such trigger: %S
no such column: %s
rows updated
_rowid_
cannot VACUUM from within a transaction
cannot VACUUM - SQL statements in progress
ATTACH ':memory:' AS vacuum_db;
ATTACH '' AS vacuum_db;
PRAGMA vacuum_db.synchronous=OFF
BEGIN EXCLUSIVE;
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14)   FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence'   AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14)  FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %' 
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21)   FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence'   AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence' 
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master   SELECT type, name, tbl_name, rootpage, sql    FROM main.sqlite_master   WHERE type='view' OR type='trigger'      OR (type='table' AND rootpage=0)
CREATE VIRTUAL TABLE %T
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
name='%q' AND type='table'
vtable constructor failed: %s
vtable constructor did not declare schema: %s
hidden
 hidden
no such module: %s
NOCASE
auto-index
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
cannot use index: %s
parser stack overflow
set list
near "%T": syntax error
too many arguments on function %T
qualified table names are not allowed on INSERT, UPDATE, and DELETE statements within triggers
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
interrupt
unrecognized token: "%T"
2011-01-28 17:03:50 ed759d5a9edb3bba5f48f243df47be29e3fe8cd7
unable to close due to unfinalised statements
unable to close due to unfinished backup operation
unknown error
unable to delete/modify user-function due to active statements
unknown database: %s
unable to delete/modify collation sequence due to active statements
no such vfs: %s
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
sqlite3_open
sqlite3_prepare
sqlite3_step
sqlite3_column_text
sqlite3_column_int
sqlite3_column_int64
sqlite3_finalize
sqlite3_close
sqlite3_exec
VaultOpenVault
VaultCloseVault
VaultEnumerateItems
VaultFree
VaultGetInformation
VaultGetItem
?RSDSiL
f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb
wcscat
_snwprintf
wcsncat
strlen
memset
wcscpy
memcpy
wcschr
_wcsicmp
wcslen
_purecall
wcscmp
memcmp
??2@YAPAXI@Z
??3@YAXPAX@Z
_wcsnicmp
wcsrchr
strcpy
strcmp
malloc
wcstoul
_memicmp
wcsncmp
_strlwr
strchr
_wcslwr
_wcsupr
strftime
_gmtime64
realloc
memchr
msvcrt.dll
__dllonexit
_onexit
_c_exit
_XcptFilter
_cexit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3
ImageList_ReplaceIcon
ImageList_Create
ImageList_AddMasked
ImageList_SetImageCount
CreateStatusWindowW
CreateToolbarEx
COMCTL32.dll
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
VERSION.dll
FindCloseUrlCache
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
WININET.dll
LocalFree
GetFileSize
SystemTimeToFileTime
CloseHandle
FileTimeToLocalFileTime
DeleteFileW
CopyFileW
CreateFileW
WriteFile
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetProcAddress
GetLastError
SetFilePointerEx
CompareFileTime
GetCurrentDirectoryW
ExpandEnvironmentStringsW
MultiByteToWideChar
GlobalLock
FormatMessageW
GetVersionExW
FindClose
GetTempFileNameW
FindFirstFileW
GetFileAttributesW
GetWindowsDirectoryW
GetModuleHandleW
SetFilePointer
ReadFile
GetModuleFileNameW
LockResource
lstrcpyW
lstrlenW
FindResourceW
LoadResource
GlobalAlloc
GlobalUnlock
LoadLibraryExW
GetTempPathW
FindNextFileW
SizeofResource
GetFileTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
GetCurrentProcess
DuplicateHandle
OpenProcess
GetCurrentProcessId
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetPrivateProfileStringW
GetStdHandle
SetErrorMode
ReadProcessMemory
ExitProcess
SetCurrentDirectoryW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
EnumResourceTypesW
UnlockFileEx
GetTempPathA
GetSystemTimeAsFileTime
FormatMessageA
LockFileEx
GetSystemTime
EnterCriticalSection
AreFileApisANSI
GetFullPathNameW
GetDiskFreeSpaceW
DeleteFileA
GetFullPathNameA
InitializeCriticalSection
CreateFileA
GetDiskFreeSpaceA
GetSystemInfo
SetEndOfFile
LeaveCriticalSection
GetFileAttributesA
QueryPerformanceCounter
GetFileAttributesExW
DeleteCriticalSection
InterlockedCompareExchange
UnlockFile
FlushFileBuffers
LockFile
GetTickCount
GetModuleHandleA
GetStartupInfoW
KERNEL32.dll
ChildWindowFromPoint
LoadCursorW
SetCursor
GetSysColorBrush
ShowWindow
SetWindowTextW
SetDlgItemInt
UpdateWindow
SetDlgItemTextW
GetDlgItemTextW
GetClientRect
GetSystemMetrics
DeferWindowPos
CreateWindowExW
GetWindowRect
SendDlgItemMessageW
GetDlgItemInt
EndDialog
SetWindowLongW
GetDlgItem
InvalidateRect
GetWindowPlacement
LoadAcceleratorsW
DefWindowProcW
SendMessageW
PostMessageW
RegisterClassW
MessageBoxW
TranslateAcceleratorW
SetMenu
SetWindowPlacement
LoadImageW
LoadIconW
GetWindowLongW
SetFocus
MoveWindow
GetMenuStringW
GetMenuItemCount
CheckMenuItem
CloseClipboard
GetCursorPos
GetParent
SetClipboardData
GetSysColor
EnableWindow
GetMenu
MapWindowPoints
GetSubMenu
EmptyClipboard
EnableMenuItem
ReleaseDC
GetClassNameW
OpenClipboard
GetWindowTextW
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
DialogBoxParamW
CreateDialogParamW
EnumChildWindows
DestroyWindow
LoadStringW
SetWindowPos
PostQuitMessage
GetMessageW
DrawTextExW
IsDialogMessageW
TranslateMessage
BeginDeferWindowPos
DispatchMessageW
EndDeferWindowPos
RegisterWindowMessageW
TrackPopupMenu
USER32.dll
CreateFontIndirectW
DeleteObject
SetTextColor
SetBkMode
GetDeviceCaps
SelectObject
GetStockObject
SetBkColor
GetTextExtentPoint32W
GDI32.dll
GetOpenFileNameW
GetSaveFileNameW
FindTextW
comdlg32.dll
RegCloseKey
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
ADVAPI32.dll
ShellExecuteW
SHGetFileInfoW
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
SHELL32.dll
CoUninitialize
CoInitialize
CoTaskMemFree
ole32.dll
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
wwwwwp
wwwwwwwwwwwwwwwwwwww~gww
wwwwwwwwwwwwwwN
wwwwww~fww
wwwwwwwwwwp
wwwwwwwwwwxwwN
wwwwpw~fhw
wwwwwwwwwwx
wwwwwwwwwwx
wwwwwwwwww
wwwwww
wwwwwwwwwx
wwwwwwwwwx
wwwwwwwwwx
wwwwwwwwww
wwwwwwwwwwx
wwwwwwwwwwx
wwwwwwp
wwwwwwwwwwx
wwwwwwww
xpwwwwwwwwwwwx
wwwwwwwwwwwp
wwwwwwwwwwwx
wwwwwwwwwwwwwwwwwwwwwwww
wwwwwwwwwww(
*.)7l=
66p?||
5JEw%Xg
%&&@bcd
...(+++JFGG
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <dependency>
    <dependentAssembly>
      <assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
    </dependentAssembly>
  </dependency>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX`
AddTrust AB1&0$
AddTrust External TTP Network1"0 
AddTrust External CA Root0
050607080910Z
200530104838Z0
Salt Lake City1
The USERTRUST Network1!0
http://www.usertrust.com1
UTN-USERFirst-Object0
3http://crl.usertrust.com/AddTrustExternalCARoot.crl05
http://ocsp.usertrust.com0
9f*<Z,m
Salt Lake City1
The USERTRUST Network1!0
http://www.usertrust.com1
UTN-USERFirst-Object0
100510000000Z
150510235959Z0~1
Greater Manchester1
Salford1
COMODO CA Limited1$0"
COMODO Time Stamping Signer0
GS@(YC
1http://crl.usertrust.com/UTN-USERFirst-Object.crl05
http://ocsp.usertrust.com0
Salt Lake City1
The USERTRUST Network1!0
http://www.usertrust.com1
UTN-USERFirst-Object0
110824000000Z
200530104838Z0{1
Greater Manchester1
Salford1
COMODO CA Limited1!0
COMODO Code Signing CA 20
1http://crl.usertrust.com/UTN-USERFirst-Object.crl0t
1http://crt.usertrust.com/UTNAddTrustObject_CA.crt0%
http://ocsp.usertrust.com0
Greater Manchester1
Salford1
COMODO CA Limited1!0
COMODO Code Signing CA 20
120917000000Z
140917235959Z0
525831
Gush Dan1
	Ramat Gan1
5 Hashoshanim st.1
	Nir Sofer1
	Nir Sofer0
https://secure.comodo.net/CPS0A
0http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
0http://crt.comodoca.com/COMODOCodeSigningCA2.crt0$
http://ocsp.comodoca.com0
support@nirsoft.net0
Greater Manchester1
Salford1
COMODO CA Limited1!0
COMODO Code Signing CA 2
Salt Lake City1
The USERTRUST Network1!0
http://www.usertrust.com1
UTN-USERFirst-Object
131113095028Z0#
!This program cannot be run in DOS mode.
`.rdata
@.data
9D$D~ 
;D$D}	
@;D$D|
\$0F;t$(
t'hd&A
YYt @P
SVWh8=A
QQSVWh
333310
w9WWh2
tnSVWj
FVAQPW
uN< tf
D$0hyA
tDhd1A
D$Tj	P
YYt49\$
td8\$@tH
D$@j	P
YY9\$$t
PQh@4A
9^(W~0
9^(W~&
u3C;^(|
9~ ~SS
9_ YY~uVh
_^][YY
,0<	wFA
D$0`5A
D$4PjpX
u0VVh#
D$dl5A
D$dl5A
D$`t$A
?t0j@_+
SVht0A
YYtbC;
VVhd7A
D$<h08A
PWShd8A
D$<PSht8A
uzWh`0A
tNhP:A
t=hd:A
t,h|:A
D$P+D$H
D$X+D$P
D$l+D$d@P3
+D$dAQ
L$H+L$@AQ
VPhf$A
Bt9HHt.
u8h,<A
Ht'HuC
YYuFWVh
t5< w1;]
>u-9w(u(
Y9O$uB
YYt"h,DA
MS Sans Serif
Mail PassView
Mozilla\Profiles
Thunderbird\Profiles
current
Software\Qualcomm\Eudora\CommandLine
Software\Classes\Software\Qualcomm\Eudora\CommandLine\current
Software\Mozilla\Mozilla Thunderbird
%s\Main
Install Directory
sqlite3.dll
nss3.dll
%programfiles%\Mozilla Thunderbird
ShowGridLines
SaveFilterIndex
AddExportHeaderLine
MarkOddEvenRows
%s  %s  %s
POP3 User Name
IMAP User Name
HTTPMail User Name
SMTP USer Name
POP3 Server
IMAP Server
HTTPMail Server
SMTP Server
POP3 Password2
IMAP Password2
HTTPMail Password2
SMTP Password2
POP3 Port
IMAP Port
HTTPMail Port
SMTP Port
POP3 Secure Connection
IMAP Secure Connection
HTTPMail Secure Connection
SMTP Secure Connection
SMTP Display Name
SMTP Email Address
POP3 Password
IMAP Password
HTTP Password
SMTP Password
POP3 User
IMAP User
HTTP User
SMTP User
HTTP Server URL
HTTP Port
POP3 Use SPA
IMAP Use SPA
HTTPMail Use SSL
SMTP Use SSL
Display Name
Identities
Username
Software\Microsoft\Internet Account Manager\Accounts
Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
DisplayName
EmailAddress
PopAccount
PopServer
PopPort
PopLogSecure
PopPassword
SMTPAccount
SMTPServer
SMTPPort
SMTPLogSecure
SMTPPassword
Software\IncrediMail\Identities
Identity
%s\Accounts
Settings
UsesIMAP
LoginName
RealName
ReturnAddress
SavePasswordText
Personalities
Server Details
ESMTPUsername
ESMTPPassword
POP3Server
POP3Username
POP3Password
InstallPath
Software\Group Mail
fb.dat
%s@gmail.com
%s@yahoo.com
"Account","Login Name","Password","Web Site","Comments"
Software\Microsoft\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Software\Microsoft\Office\15.0\Outlook\Profiles
<meta http-equiv='content-type' content='text/html;charset=%s'>
<table dir="rtl"><tr><td>
<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>
</table>
advapi32.dll
CredReadA
CredFree
CredDeleteA
CredEnumerateA
CredEnumerateW
comctl32.dll
InitCommonControlsEx
Error: Cannot load the common control classes.
netmsg.dll
Unknown Error
Error %d: %s
kernel32.dll
%2.2X 
%s (%s)
POP3_credentials
POP3_name
POP3_host
Software\Google\Google Desktop\Mailboxes
Software\Google\Google Talk\Accounts
caption
menu_%d
dialog_%d
strings
general
sysdatetimepick32
charset
TranslatorName
TranslatorURL
_lng.ini
%-18s: %s
%%-%d.%ds 
<td bgcolor=#%s nowrap>%s
<td bgcolor=#%s>%s
&nbsp;
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
 bgcolor="%s"
<table border="1" cellpadding="5">
 nowrap
<font color="%s">%s</font>
</table><p>
<item>
<%s>%s</%s>
</item>
<?xml version="1.0"  encoding="ISO-8859-1" ?>
/nosort
SysListView32
/noloadsettings
report.html
commdlg_FindReplace
*.htm;*.html
General
WinPos
Columns
Software\NirSoft\MailPassView
MailPassView
/stext
/shtml
/sverhtml
/scomma
/stabular
/skeepass
/savelangfile
/deleteregkey
Failed to load the executable file !
user_pref("
mail.account.account
server
identities
mail.server
username
hostname
useSecAuth
mail.identity
useremail
fullname
signon.signonfilename
mailbox://
imap://
mailbox://%s@%s
imap://%s@%s
SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins
mailbox://%s
imap://%s
signons.txt
signons.sqlite
prefs.js
Password.NET Messenger Service
User.NET Messenger Service
Software\Microsoft\MSNMessenger
Software\Microsoft\MessengerService
Passport.Net\*
ps:password
windowslive:name=
Software\Microsoft\IdentityCRL
Dynamic Salt
{Unknown}
Exception %8.8X at address %8.8X in module %s
Registers: 
EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8X
ESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8X
EIP=%8.8X
Stack Data: %s
Code Data: %s
mozsqlite3.dll
NSS_Init
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_CheckUserPassword
PK11_Authenticate
PK11SDR_Decrypt
CreateToolhelp32Snapshot
Module32First
Module32Next
Process32First
Process32Next
psapi.dll
GetModuleBaseNameA
EnumProcessModules
GetModuleFileNameExA
EnumProcesses
GetModuleInformation
\systemroot
STATIC
pstorec.dll
PStoreCreateInstance
5e7e8100-9138-11d1-945a-00c04fc308ff
00000000-0000-0000-0000-000000000000
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
220D5CC1-853A-11D0-84BC-00C04FD43F8F
417E2D75-84BD-11D0-84BB-00C04FD43F8F
shell32.dll
SHGetSpecialFolderPathA
AppData
Favorites
Desktop
Start Menu
Programs
Startup
Common Start Menu
Common Programs
Common Desktop
Common Startup
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
shlwapi.dll
SHAutoComplete
%2.2X%2.2X%2.2X
&quot;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html><head>%s<title>%s</title></head>
<body>
%s <h3>%s</h3>
</body></html>
 size="%d"
 color="#%s"
</font>
<font color="%s">
<table border="1" cellpadding="5"><tr%s>
 width="%s"
<th%s>%s%s%s
</table>
SOFTWARE\Mozilla
mozilla
%s\bin
PathToExe
\sqlite3.dll
\mozsqlite3.dll
sqlite3_open
sqlite3_prepare
sqlite3_step
sqlite3_column_text
sqlite3_column_int
sqlite3_column_int64
sqlite3_finalize
sqlite3_close
sqlite3_exec
iexcl;
pound;
curren;
brvbar;
laquo;
plusmn;
acute;
micro;
middot;
cedil;
raquo;
frac14;
frac12;
frac34;
iquest;
Agrave;
Aacute;
Acirc;
Atilde;
Aring;
AElig;
Ccedil;
Egrave;
Eacute;
Ecirc;
Igrave;
Iacute;
Icirc;
Ntilde;
Ograve;
Oacute;
Ocirc;
Otilde;
times;
Oslash;
Ugrave;
Uacute;
Ucirc;
Yacute;
THORN;
szlig;
agrave;
aacute;
acirc;
atilde;
aring;
aelig;
ccedil;
egrave;
eacute;
ecirc;
igrave;
iacute;
icirc;
ntilde;
ograve;
oacute;
ocirc;
otilde;
divide;
oslash;
ugrave;
uacute;
ucirc;
yacute;
thorn;
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Live Mail
Account_Name
POP3_Server
IMAP_Server
NNTP_Server
SMTP_Server
POP3_User_Name
IMAP_User_Name
NNTP_User_Name
SMTP_User_Name
POP3_Password2
IMAP_Password2
NNTP_Password2
SMTP_Password2
NNTP_Email_Address
SMTP_Email_Address
SMTP_Port
NNTP_Port
IMAP_Port
POP3_Port
SMTP_Secure_Connection
NNTP_Secure_Connection
IMAP_Secure_Connection
POP3_Secure_Connection
*.oeaccount
\Microsoft\Windows Mail
\Microsoft\Windows Live Mail
Store Root
Software\Yahoo\Pager
Yahoo! User ID
EOptions string
f:\Projects\VS2005\mailpv\Release\mailpv.pdb
strcat
sprintf
strncat
strlen
memset
strcpy
_ultoa
_purecall
strchr
_mbscmp
wcsstr
_strcmpi
_mbsicmp
memcpy
??2@YAPAXI@Z
??3@YAXPAX@Z
_stricmp
strrchr
_memicmp
malloc
strcmp
strtoul
memcmp
_strnicmp
wcsncmp
wcschr
wcslen
_strlwr
strncmp
_mbsnbicmp
_snprintf
_mbsrchr
msvcrt.dll
__dllonexit
_onexit
_c_exit
_XcptFilter
_cexit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3
ImageList_ReplaceIcon
ImageList_AddMasked
ImageList_Create
ImageList_SetImageCount
CreateToolbarEx
COMCTL32.dll
UuidFromStringA
RPCRT4.dll
GetPrivateProfileStringA
MultiByteToWideChar
WideCharToMultiByte
ExpandEnvironmentStringsA
LocalFree
WriteFile
GetPrivateProfileSectionA
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalLock
GlobalUnlock
CreateFileA
GetFileSize
GetModuleFileNameA
FindNextFileA
FindFirstFileA
LoadLibraryExA
SetFilePointer
GetLastError
GetFileAttributesA
GetTempFileNameA
FindClose
FormatMessageA
GetWindowsDirectoryA
ReadFile
GetVersionExA
CloseHandle
GetTempPathA
GlobalAlloc
GetComputerNameA
GetPrivateProfileIntA
WritePrivateProfileStringA
EnumResourceNamesA
GetStdHandle
DeleteFileA
ExitProcess
GetCurrentProcess
ReadProcessMemory
GetCurrentProcessId
GetModuleHandleA
GetCurrentDirectoryA
SetCurrentDirectoryA
OpenProcess
FindResourceA
LoadResource
EnumResourceTypesA
SizeofResource
LockResource
GetStartupInfoA
KERNEL32.dll
SetCursor
ChildWindowFromPoint
LoadCursorA
GetSysColorBrush
ShowWindow
GetDlgItem
CreateWindowExA
InvalidateRect
SetDlgItemInt
BeginPaint
GetClientRect
GetWindow
SetDlgItemTextA
DrawFrameControl
GetDlgItemTextA
SendDlgItemMessageA
SetWindowTextA
GetWindowRect
GetSystemMetrics
GetDlgItemInt
DeferWindowPos
EndPaint
EndDialog
GetWindowPlacement
RegisterClassA
UpdateWindow
SetMenu
LoadAcceleratorsA
SetWindowPos
DefWindowProcA
TranslateAcceleratorA
MessageBoxA
SendMessageA
LoadIconA
GetWindowLongA
SetWindowLongA
SetFocus
BeginDeferWindowPos
EndDeferWindowPos
EmptyClipboard
GetSubMenu
MoveWindow
EnableMenuItem
ReleaseDC
CheckMenuItem
GetMenuItemCount
GetMenuStringA
SetClipboardData
EnableWindow
MapWindowPoints
GetCursorPos
LoadImageA
GetSysColor
GetClassNameA
CloseClipboard
GetMenu
OpenClipboard
EnumChildWindows
GetMenuItemInfoA
GetWindowTextA
LoadMenuA
GetParent
LoadStringA
CreateDialogParamA
ModifyMenuA
DestroyWindow
DialogBoxParamA
GetDlgCtrlID
DestroyMenu
PostMessageA
TrackPopupMenu
PostQuitMessage
RegisterWindowMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
DrawTextExA
DispatchMessageA
GetFocus
USER32.dll
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
SelectObject
GetDeviceCaps
SetBkColor
GetTextExtentPoint32A
GDI32.dll
GetSaveFileNameA
GetOpenFileNameA
FindTextA
comdlg32.dll
RegCloseKey
GetUserNameA
RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyA
RegQueryValueExA
RegEnumKeyExA
ADVAPI32.dll
ShellExecuteA
SHBrowseForFolderA
SHGetMalloc
SHGetPathFromIDListA
SHELL32.dll
CoInitialize
CoUninitialize
CoTaskMemFree
ole32.dll
wwwwwp
wwwwwwwwwwwwwwwwwwww~gww
wwwwwwwwwwwwwwN
wwwwww~fww
wwwwpw~fhw
wwwwww
wwwwwwp
wwwwwwww
xpwwwx
pwwwwx
wwwwwwwwwwwp
wwwwwwwwwwwx
wwwwwwwwwwwwwwwwwwwwwwww
wwwwwwwwwww(
wwwwwwwwwwwwwwp
""""" 
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="NirSoft" type="win32"></assemblyIdentity><description>NirSoft</description><dependency><dependentAssembly><assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
v2.0.50727
#Strings
	0	;	F	N	Z	p	
Debugger.exe
Debugger
mscorlib
Microsoft.VisualBasic
System.Windows.Forms
System
System.Drawing
System.Management
user32
tapi32.dll
rtm.dll
user32.dll
kernel32
Debugger.Debugger.resources
Debugger.Resources.resources
<Module>
MyApplication
Debugger.My
WindowsFormsApplicationBase
Microsoft.VisualBasic.ApplicationServices
get_UseCompatibleTextRendering
Application
SetCompatibleTextRenderingDefault
STAThreadAttribute
EditorBrowsableAttribute
System.ComponentModel
EditorBrowsableState
DebuggerHiddenAttribute
System.Diagnostics
AuthenticationMode
set_IsSingleInstance
set_EnableVisualStyles
set_SaveMySettingsOnExit
set_ShutdownStyle
ShutdownMode
DebuggerStepThroughAttribute
set_MainForm
OnCreateMainForm
GeneratedCodeAttribute
System.CodeDom.Compiler
MyComputer
Computer
Microsoft.VisualBasic.Devices
MyProject
Object
m_ComputerObjectProvider
m_AppObjectProvider
m_UserObjectProvider
m_MyFormsObjectProvider
m_MyWebServicesObjectProvider
.cctor
get_GetInstance
get_Computer
get_Application
get_User
get_Forms
get_WebServices
HelpKeywordAttribute
System.ComponentModel.Design
WebServices
StandardModuleAttribute
Microsoft.VisualBasic.CompilerServices
HideModuleNameAttribute
MyForms
m_Debugger
m_FormBeingCreated
Hashtable
System.Collections
ThreadStaticAttribute
get_Debugger
ArgumentException
set_Debugger
TargetInvocationException
System.Reflection
Control
get_IsDisposed
GetTypeFromHandle
RuntimeTypeHandle
ContainsKey
String
GetResourceString
InvalidOperationException
Activator
CreateInstance
ProjectData
SetProjectError
Exception
get_InnerException
get_Message
Remove
Create__Instance__
Instance
Component
Dispose
Dispose__Instance__
instance
RuntimeHelpers
System.Runtime.CompilerServices
GetObjectValue
Equals
GetHashCode
GetType
ToString
MyGroupCollectionAttribute
MyWebServices
ThreadSafeObjectProvider`1
m_ThreadStaticValue
CompilerGeneratedAttribute
GetInstance
ComVisibleAttribute
System.Runtime.InteropServices
components
IContainer
encryptedemailstring
encryptedpassstring
encryptedsmtpstring
portstring
timerstring
fakemgrstring
fakemgrtitle
fakeMSGholder
encryptedftphost
encryptedftpuser
encryptedftppass
encryptedphplink
DestructoneString
DestructtwoString
DestructthreeStringyear
useemail
useftp
usephp
delaytime
clearie
clearff
binder
Downloader
Downloadname
Downloadlink
websitevisitor
websiteblocker
notify
DisableSSL
fakerror
startup
screeny
TaskManager
logger
stealers
misconfig
spreaders
screenynumber
Minecraftt
meltLocation
appname
AccessedThroughPropertyAttribute
emailstring
passstring
smtpstring
ftphost
ftpuser
ftppass
phplink
LHeader
RHeader
UseCaps
BackSpace
WM_KEYUP
WM_KEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYUP
KeyboardHandle
LastCheckedForegroundTitle
callback
KeyLog
Holder
InternalIp
MyFirewall
CleanedPasswordsMAIL
CleanedPasswordsWB
EventHandler
add_Load
System.IO
GetTempPath
Environment
GetFolderPath
SpecialFolder
Concat
get_ExecutablePath
GetFileName
IntPtr
op_Explicit
IDisposable
disposing
DebuggerNonUserCodeAttribute
SuspendLayout
ContainerControl
set_AutoScaleDimensions
set_AutoScaleMode
AutoScaleMode
set_ClientSize
set_FormBorderStyle
FormBorderStyle
set_MaximizeBox
set_MinimizeBox
set_Name
set_Opacity
set_ShowIcon
set_ShowInTaskbar
set_Text
set_WindowState
FormWindowState
ResumeLayout
InitializeComponent
get_CH
set_CH
WithEventsValue
UnhookWindowsHookEx
SetWindowsHookEx
idHook
dwThreadId
SetWindowsHookExA
GetAsyncKeyState
CallNextHookEx
wParam
lParam
lineSetAppSpecific
dwAppSpecific
MgmGetNextMfeStats
pimmStart
pdwBufferSize
pbBuffer
pdwNumEntries
GetForegroundWindow
GetWindowText
lpString
GetWindowTextA
Strings
CompareMethod
Substring
ClearProjectError
GetActiveWindowTitle
op_Inequality
Boolean
Hooked
Process
GetCurrentProcess
get_MainModule
ProcessModule
get_BaseAddress
HookKeyboard
Conversions
ToBoolean
UnhookKeyboard
DateTime
Operators
ConditionalCompareObjectNotEqual
ConcatenateObject
DateAndTime
get_Now
get_Keyboard
Keyboard
get_CtrlKeyDown
get_AltKeyDown
CompareString
ToUpper
get_CapsLock
EndsWith
get_Length
ToInteger
KeyboardCallback
Thread
System.Threading
IEnumerator`1
System.Collections.Generic
Exists
Delete
WriteAllText
EndApp
ServerComputer
get_FileSystem
FileSystemProxy
Microsoft.VisualBasic.MyServices
ReadAllText
DeleteFile
get_Id
ThreadStart
SetApartmentState
ApartmentState
IsNullOrEmpty
Convert
FromBase64String
WriteAllBytes
get_Network
Network
DownloadFile
Directory
GetFiles
GetDirectories
ReadOnlyCollection`1
System.Collections.ObjectModel
GetEnumerator
get_Current
Contains
IEnumerator
MoveNext
get_NewLine
AppendAllText
Interaction
MsgBox
MsgBoxResult
MsgBoxStyle
Form1_Load
EventArgs
sender
GetProcessesByName
ForceSteamLogin
MethodInfo
Assembly
get_EntryPoint
IsDotNet
NetworkInterface
System.Net.NetworkInformation
GetAllNetworkInterfaces
get_NetworkInterfaceType
NetworkInterfaceType
get_OperationalStatus
OperationalStatus
IsConnectedToInternet
Foldersinstall
MessageBox
DialogResult
MessageBoxButtons
MessageBoxIcon
FakemsgInstall
MailMessage
System.Net.Mail
SmtpClient
ToDouble
Replace
get_Name
get_Clock
get_LocalTime
get_Info
ComputerInfo
get_InstalledUICulture
CultureInfo
System.Globalization
get_OSFullName
MailAddress
set_From
get_To
MailAddressCollection
set_Subject
set_Body
set_Port
set_EnableSsl
NetworkCredential
System.Net
set_Credentials
ICredentialsByHost
ServerInstall
get_Registry
RegistryProxy
SetValue
RegistryValueKind
Microsoft.Win32
unHide
DirectoryInfo
FileSystemInfo
set_Attributes
FileAttributes
unhidden
DriveInfo
StreamWriter
GetDrives
get_DriveType
DriveType
TextWriter
WriteLine
SetAttributes
Spread
RegistryKey
FileSystem
FileCopy
Registry
CurrentUser
OpenSubKey
addtostartup
DESCryptoServiceProvider
System.Security.Cryptography
MD5CryptoServiceProvider
ICryptoTransform
Encoding
System.Text
get_Unicode
GetBytes
HashAlgorithm
ComputeHash
set_Key
SymmetricAlgorithm
set_Mode
CipherMode
CreateDecryptor
TransformFinalBlock
GetString
DES_Decrypt
get_ASCII
olddesdc
NewLateBinding
LateGet
ChangeType
StartStealers
LateCall
stealMail
get_Version
Version
get_OSPlatform
get_OSVersion
stealWebroswers
WebClient
StreamReader
Stream
OpenRead
ReadToEnd
readweb
FileStream
DoEvents
WaitUntilFileIsAvailable
Filename
MemoryStream
GZipStream
System.IO.Compression
BitConverter
ToInt32
set_Position
CompressionMode
get_UTF8
DecompressString
compressedText
get_Attachments
AttachmentCollection
Attachment
Collection`1
Minecraftsub
GetProcesses
get_ProcessName
Disabler
Graphics
Bitmap
Rectangle
Monitor
CreateDirectory
get_Screen
Screen
get_Bounds
get_Width
get_Height
FromImage
CopyFromScreen
SendLogs
SendLogsFTP
FtpWebRequest
BinaryWriter
WebRequest
Create
ICredentials
set_Method
GetRequestStream
UploadFTP
ReadAllBytes
SendLogsPHP
DownloadString
UploadPHP
get_TimeOfDay
get_Clipboard
ClipboardProxy
GetText
CH_Changed
RijndaelManaged
AES_Decrypt
CryptoStream
CryptoStreamMode
Decrypt
encryptedBytes
secretKey
Rfc2898DeriveBytes
set_KeySize
get_BlockSize
set_IV
get_KeySize
set_Padding
PaddingMode
getAlgorithm
seekanddestroy
process__1
IPAddress
GetHostName
GetHostEntry
IPHostEntry
get_AddressList
get_AddressFamily
AddressFamily
System.Net.Sockets
GetInternalIP
GetExternalIP
IndexOf
GetBetween
Source
Before
ManagementObjectCollection
ManagementObjectSearcher
ManagementObject
ManagementObjectEnumerator
get_MachineName
ManagementBaseObject
get_Item
GetAntiVirus
GetFirewall
DesignerGeneratedAttribute
KBDLLHOOKSTRUCT
ValueType
vkCode
scanCode
dwExtraInfo
virtualKey
value__
K_Return
K_Backspace
K_Space
K_Control
K_LControl
K_RControl
K_Delete
K_Home
K_Insert
K_Shift
K_LShift
K_RShift
K_Pause
K_PrintScreen
K_LWin
K_RWin
K_LAlt
K_RAlt
K_NumLock
K_CapsLock
K_Down
K_Right
K_Left
K_Numpad0
K_Numpad1
K_Numpad2
K_Numpad3
K_Numpad4
K_Numpad5
K_Numpad6
K_Numpad7
K_Numpad8
K_Numpad9
K_Num_Add
K_Num_Divide
K_Num_Multiply
K_Num_Subtract
K_Num_Decimal
K_Subtract
K_Decimal
KeyboardHookDelegate
MulticastDelegate
TargetObject
TargetMethod
BeginInvoke
IAsyncResult
AsyncCallback
DelegateCallback
DelegateAsyncState
EndInvoke
DelegateAsyncResult
Invoke
Clipboard
NativeWindow
ChangedEvent
SetClipboardViewer
handle
ChangeClipboardChain
SendMessage
Delegate
Combine
add_Changed
remove_Changed
CreateParams
CreateHandle
get_Handle
Install
Uninstall
Message
get_Msg
get_WParam
get_LParam
op_Equality
WndProc
Finalize
Changed
ChangedEventHandler
Resources
Debugger.My.Resources
resourceMan
ResourceManager
System.Resources
resourceCulture
ReferenceEquals
get_Assembly
get_ResourceManager
get_Culture
set_Culture
GetObject
get_CMemoryExecute
get_mailpv
get_WebBrowserPassView
Culture
CMemoryExecute
mailpv
WebBrowserPassView
MySettings
ApplicationSettingsBase
System.Configuration
defaultInstance
addedHandler
addedHandlerLockObject
SettingsBase
Synchronized
get_SaveMySettingsOnExit
AutoSaveSettings
ObjectFlowControl
CheckForSyncLockOnValueType
ShutdownEventHandler
add_Shutdown
get_Default
Default
MySettingsProperty
get_Settings
Settings
WriteProcessMemory
VirtualProtectEx
VirtualAllocEx
SetThreadContext
ResumeThread
ReadProcessMemory
NtUnmapViewOfSection
GetThreadContext
CreateProcessA
StringBuilder
GetEntryAssembly
get_Location
get_SystemDirectory
get_Chars
GetRandomFileName
ChangeExtension
GetDirectoryName
ToInt16
UInt32
Buffer
BlockCopy
AssemblyTrademarkAttribute
AssemblyCompanyAttribute
AssemblyDescriptionAttribute
AssemblyTitleAttribute
GuidAttribute
AssemblyCopyrightAttribute
DebuggableAttribute
DebuggingModes
AssemblyProductAttribute
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
AssemblyFileVersionAttribute
MyTemplate
8.0.0.0
My.Computer
My.Application
My.User
My.Forms
My.WebServices
System.Windows.Forms.Form
Create__Instance__
Dispose__Instance__
My.MyProject.Forms
4System.Web.Services.Protocols.SoapHttpClientProtocol
Create__Instance__
Dispose__Instance__
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
10.0.0.0
My.Settings
$e48811ca-8af8-4e73-85dd-2045b9cca73a
Copyright 
  2014
WrapNonExceptionThrows
1.0.0.0
_CorExeMain
mscoree.dll
wwwwwwwwwwwwwwp
DDDDDDDDDDDDDDp
DDDDDDDDDDDDDDp
LLLLLLLLLN
DDDDDDDDDDDDD@
wwwwwwwDDDDDDDGO
DDDDDD
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>