Gen.Variant.Kazy.634405_f2a8cabc9f – Adaware

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Kazy.634405 (B) (Emsisoft), Gen:Variant.Kazy.634405 (AdAware), GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: Trojan, Worm, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: f2a8cabc9f14f48bed078505d4e636f6

SHA1: 57ac09a9fe8c63227a4dfa5660d3023a1e455e63

SHA256: cba963b335e30d6a19d978e8fa9a5f9f71d66c5f046237ba30d0ba90e09b0017

SSDeep: 24576:GgDa823MoUFuULMjdbh4HzIJxHiIZ4erEs2s3QyZ2Sfgg5jk4:GD823MWSYdbhoEJw8RgyYM

Size: 1220608 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6

Company: no certificate found

Created at: 2015-06-09 16:46:00

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):

vbc.exe:2400
vbc.exe:2228
%original file name%.exe:468

The Trojan injects its code into the following process(es):

RegAsm.exe:324

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process vbc.exe:2400 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (399 bytes)

The process vbc.exe:2228 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (400 bytes)

The process %original file name%.exe:468 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\Startup\x6JYniCRZK.lnk (951 bytes)
%Documents and Settings%\%current user%\Application Data\qmkth8tnb\3257.xml (7386 bytes)

The process RegAsm.exe:324 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\pid.txt (3 bytes)
%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (656 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (56 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (0 bytes)

Registry activity

The process vbc.exe:2400 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 04 48 AF 2B A8 A4 55 98 26 0B 76 5F E1 38 62"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process vbc.exe:2228 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "40 C3 48 E1 E1 81 D5 67 C3 0F 03 BD 34 C7 C9 6F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process %original file name%.exe:468 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F BC 7A D3 D7 22 B0 15 50 6C 75 18 23 A1 82 BF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

The process RegAsm.exe:324 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\RegAsm\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 C6 35 86 77 94 91 0A 16 83 05 5D 2A AE CD D2"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Update" = "%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\RegAsm\DEBUG]
"Trace Level"

Dropped PE files

MD5	File path
c08b53d25dab60ba0dba975b46d0b27a	c:\Documents and Settings\"%CurrentUserName%"\Application Data\WindowsUpdate.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
vbc.exe:2400
vbc.exe:2228
%original file name%.exe:468
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (399 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\x6JYniCRZK.lnk (951 bytes)
%Documents and Settings%\%current user%\Application Data\qmkth8tnb\3257.xml (7386 bytes)
%Documents and Settings%\%current user%\Application Data\pid.txt (3 bytes)
%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe (53 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (56 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Update" = "%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: wBzbmMmAGm
Product Name: I6JUgLZE
Product Version: 3.5.948.386
Legal Copyright: Copyright (C) 2008-2011 g4lG3lb Lwl9XLKkYV1u
Legal Trademarks:
Original Filename: gGGfpyB.exe
Internal Name: gGGfpyB.exe
File Version: 3.5.948.386
File Description: dmB9jsDecDi
Comments: yilmPzz
Language: English (United States)

Company Name: wBzbmMmAGmProduct Name: I6JUgLZEProduct Version: 3.5.948.386Legal Copyright: Copyright (C) 2008-2011 g4lG3lb Lwl9XLKkYV1uLegal Trademarks: Original Filename: gGGfpyB.exeInternal Name: gGGfpyB.exeFile Version: 3.5.948.386File Description: dmB9jsDecDiComments: yilmPzzLanguage: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	1214356	1214464	5.49375	afaefdf6310331217ec158f4ebf9dd1b
.sdata	1228800	247	512	2.00947	24ff9b8cc837d33737a0f6c16dd7d2b7
.rsrc	1236992	3776	4096	3.75887	6b831e3b7bc5c1422173f6d83d851230
.reloc	1245184	12	512	0.070639	e31651808b67bb4cc5760a6711de9dc4

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://whatismyipaddress.com/	23.67.128.45
hxxp://whatismyipaddress.com/api.html	23.67.128.45
smtp.fmentreprises.co.uk	208.91.199.225

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Host: whatismyipaddress.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Server: AkamaiGHost

Content-Length: 0

Location: hXXp://whatismyipaddress.com/api.html

Date: Sat, 05 Dec 2015 19:44:34 GMT

Connection: keep-alive

....

GET /api.html HTTP/1.1

Host: whatismyipaddress.com

HTTP/1.1 200 OK

Server: Apache/2.2.29 (Unix) DAV/2 PHP/5.4.45 mod_ssl/2.2.29 OpenSSL/0.9.8zg

Last-Modified: Thu, 03 Dec 2015 18:02:41 GMT

ETag: "1e9a998-14c-526023267b240"

MS-Author-Via: DAV

Content-Type: text/html

Date: Sat, 05 Dec 2015 19:44:34 GMT

Content-Length: 332

Connection: keep-alive

<html>.<head>.<link rel="shortcut icon" href="hXXp://cdn.whatismyipaddress.com/favicon.ico">.</head>.<body>.This site requires a valid browser user-agent and does not allow scripted access.<br>.For API details please visit hXXp://whatismyipaddress.com/api<br>.You can also contact at us support@whatismyipaddress.com.</body>.</html>HTTP/1.1 200 OK..Server: Apache/2.2.29 (Unix) DAV/2 PHP/5.4.45 mod_ssl/2.2.29 OpenSSL/0.9.8zg..Last-Modified: Thu, 03 Dec 2015 18:02:41 GMT..ETag: "1e9a998-14c-526023267b240"..MS-Author-Via: DAV..Content-Type: text/html..Date: Sat, 05 Dec 2015 19:44:34 GMT..Content-Length: 332..Connection: keep-alive..<html>.<head>.<link rel="shortcut icon" href="hXXp://cdn.whatismyipaddress.com/favicon.ico">.</head>.<body>.This site requires a valid browser user-agent and does not allow scripted access.<br>.For API details please visit hXXp://whatismyipaddress.com/api<br>.You can also contact at us support@whatismyipaddress.com.</body>.</html>..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

RegAsm.exe_324:

.text

`.rsrc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

`.rdata

@.data

.rsrc

%UUUU3

tcPW

-4-4--567

%s%2.2X

Browser Password Dump

%s v%s by SecurityXploded

hXXp://securityxploded.com/browser-password-dump.php

BrowserPasswordDump

%s.exe [-h | -f ]

//Dump login passwords from all the Browsers to console

%s.exe

//Dump login passwords from all the Browsers to a file 'c:\passlist.txt'

%s.exe -f "c:\passlist.txt"

%s.exe -h

pstorec.dll

http:/

https:/

abe2869f-9b47-4cd9-a358-c22904dba7f7

hXXps://%s

hXXp://%s

Cannot close vault. Error (%d)

Web Data

select * from logins where blacklisted_by_user=0;

\MapleStudio\ChromePlus\User Data\Default\

\Google\Chrome SxS\User Data\Default\

\Google\Chrome\User Data\Default\

Opera\Opera\

Opera\Opera\profile\

wand.dat

account

passwords

data

server

%s\Safari\Apple Application Support\plutil.exe

%s\Apple\Apple Application Support\plutil.exe

%s\%s\keychain.plist

%skeytest.tmp

"%s" -convert xml1 -s -o "%s" "%s"

Google Chrome

Opera Browser

Firefox

Chrome SXS

SeaMonkey

Browser: %s

Website: %s

Username: %s

Password: %s

vaultcli.dll

Error: Failed to create file '%s' for writing Password list. Make sure you have specified correct & full file path

Browser Password Recovery Report

Website URL

Password

Produced by %s from hXXp://VVV.SecurityXploded.com

Tip: For more options type %s.exe -h

This is command-line application. Kindly Run it from the CMD Prompt

Press any key to exit....

SOFTWARE\Clients\StartMenuInternet\SEAMONKEY.EXE\shell\open\command

SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command

Mozilla\SeaMonkey

Mozilla\Firefox

\profiles.ini

select * from moz_logins;

/signons.txt

/signons2.txt

/signons3.txt

\signons.sqlite

nss3.dll

PK11_GetInternalKeySlot

PK11_CheckUserPassword

SQLite format 3

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

3.6.16

sqlite_version

RowKey

SQL logic error or missing database

large file support is disabled

sqlite_detach

sqlite_attach

d-d-d d:d:d

d:d:d

d-d-d

922337203685477580

%s\etilqs_

OsError 0x%x (%u)

invalid page number %d

2nd reference to page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

Page %d:

unable to get the page. error code=%d

sqlite3BtreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in header on page %d

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Fragmented space is %d byte reported as %d on page %d

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

keyinfo(%d

%s(%d)

%s-mjX

unable to use function %s in the requested context

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s

database table is locked: %s

cannot open virtual table: %s

cannot open view: %s

no such column: "%s"

cannot open indexed column for writing

cannot open value of type %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

misuse of aggregate: %s()

%.*s"%w"%s

sqlite_rename_table

sqlite_rename_trigger

%s OR name=%Q

there is already another table or index with this name: %s

sqlite_

table %s may not be altered

view %s may not be altered

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

sqlite_stat1

CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

SELECT idx, stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

no such collation sequence: %s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

DELETE FROM %s.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

unable to identify the object to be reindexed

table %s may not be modified

cannot modify %s because it is a view

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

PRIMARY KEY must be unique

sqlite3_extension_init

unable to open shared library [%s]

no entry point [%s] in shared library [%s]

error during initialization: %s

automatic extension loading failed: %s

foreign_key_list

*** in database %s ***

unsupported encoding: %s

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

%s.%s

%s:%d

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

sqlite_subquery_%p_

no such table: %s

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

-- TRIGGER %s

no such column: %s

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

at most %d tables in a join

cannot use index: %s

TABLE %s

%s AS %s

%s WITH INDEX %s

%s VIA MULTI-INDEX UNION

%s USING PRIMARY KEY

%s VIRTUAL TABLE INDEX %d:%s

%s ORDER BY

unable to close due to unfinished backup operation

no such vfs: %s

GetProcessWindowStation

operator

GetProcessHeap

KERNEL32.dll

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

SHELL32.dll

ole32.dll

CRYPT32.dll

GetCPInfo

OLEAUT32.dll

zcÃ

kernel32.dll

\StringFileInfo\xx\%s

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msimn.exe

outlook.exe

msimn.exe

%Program Files%\Microsoft Office\Office\Outlook.exe

Email Password Dump

hXXp://securityxploded.com/email-password-dump.php

EmailPasswordDump

//Dump all the Email passwords to console

//Dump all the Email passwords to a file "c:\passlist.txt"

\.purple\accounts.xml

%s\%s

@gmail.com

@yahoo.com

Software\Paltalk\%s

Software\Google\Google Talk\Accounts\%s

Microsoft_WinInet_VVV.google.com:443

%sMiranda_Mirror_%d.bin

LoginPassword

LoginName

LoginServer

gmail.com

%s\%s\%s.dat

pop3password=

esmtpaccount=

esmtppassword=

smtphost=

SmtpPassword

ESMTPAccountKey

c:\Program Files\Foxmail\mail

%s\%s\Account.stg

%Program Files%\Foxmail 7.0\Data\AccCfg\Accounts.tdat

PopPassword

SmtpAccount

SmtpServer

%s\%s\Accounts

%s\%s\Accounts\%s

Mozilla Thunderbird

Windows Live Mail

Windows Credential Manager

Application:%s

Email ID: %s

WindowsLive:name=*

Software\Microsoft\Windows Live Mail

hXXps://

00000050

.oeaccount

Software\Microsoft\IdentityCRL\Creds\%s

ps:password

Email Password Recovery Report

Produced by EmailPasswordDump v%s from hXXp://VVV.SecurityXploded.com

SOFTWARE\Clients\Mail\Mozilla Thunderbird\shell\open\command

kpstorec.dll

220D5CC1-853A-11D0-84BC-00C04FD43F8F

417e2d75-84bd-11d0-84bb-00c04fd43f8f

220D5CD0-853A-11D0-84BC-00C04FD43F8F

220D5CD1-853A-11D0-84BC-00C04FD43F8F

IMAP Password

IMAP Port

POP3 Password

POP3 Port

SMTP User

SMTP Password

SMTP Server

SMTP Port

HTTP User

HTTP Password

HTTP Server URL

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows Messaging Subsystem\Profiles

%s\%s\%s

%s\%s\%s\%s

SMTP Email Address

IMAP Password2

POP3 Password2

SMTP User Name

SMTP Password2

HTTPMail User Name

HTTPMail Password2

HTTPMail Server

LDAP Password2

Specified master password "%s" is wrong. Please try again with correct password

GetWindowsDirectoryA

RegEnumKeyExA

USERENV.dll

VERSION.dll

RPCRT4.dll

v2.0.50727

Stub.exe

Microsoft.VisualBasic

System.Windows.Forms

System.Drawing

System.Management

System.Xml

tapi32.dll

rtm.dll

user32.dll

ntdll.dll

Crypt32.dll

Stub.Form1.resources

Stub.Resources.resources

Stub.My

WindowsFormsApplicationBase

Microsoft.VisualBasic.ApplicationServices

System.Collections.Generic

.ctor

.cctor

System.Diagnostics

System.Threading

System.Runtime.CompilerServices

System.ComponentModel

System.CodeDom.Compiler

Microsoft.VisualBasic.Devices

m_MyWebServicesObjectProvider

get_WebServices

HelpKeywordAttribute

System.ComponentModel.Design

WebServices

Microsoft.VisualBasic.CompilerServices

System.Collections

System.Reflection

ContainsKey

InvalidOperationException

MyWebServices

System.Runtime.InteropServices

encryptedpassstring

encryptedsmtpstring

portstring

encryptedftphost

encryptedftpuser

encryptedftppass

useftp

websitevisitor

websiteblocker

fakeMSGholder

passstring

smtpstring

ftphost

ftpuser

ftppass

WM_KEYUP

WM_KEYDOWN

WM_SYSKEYDOWN

WM_SYSKEYUP

KeyboardHandle

KeyLog

CleanedPasswordsMAIL

CleanedPasswordsWB

System.IO

get_ExecutablePath

WindowsIdentity

System.Security.Principal

set_WindowState

FormWindowState

UnhookWindowsHookEx

SetWindowsHookEx

SetWindowsHookExA

GetAsyncKeyState

vKey

HookKeyboard

UnhookKeyboard

Operators

get_Keyboard

Keyboard

get_CtrlKeyDown

get_AltKeyDown

KeyboardCallback

set_UseShellExecute

Microsoft.VisualBasic.MyServices

System.Collections.ObjectModel

MsgBox

MsgBoxResult

MsgBoxStyle

ForceSteamLogin

System.Net.NetworkInformation

get_OperationalStatus

OperationalStatus

FakemsgInstall

System.Net.Mail

SmtpClient

System.Globalization

set_Port

System.Net

Microsoft.Win32

RegistryKey

OpenSubKey

System.Security.Cryptography

System.Text

set_Key

StealPasswords

stealWebroswers

WebClient

readweb

System.IO.Compression

SendLogsFTP

FtpWebRequest

WebRequest

UploadFTP

secretKey

set_KeySize

get_KeySize

System.Net.Sockets

virtualKey

KeyboardHookDelegate

get_Msg

System.Security

ProcessHandle

Stub.My.Resources

System.Resources

get_WebBrowserPassView

WebBrowserPassView

System.Configuration

GoogleChrome

MozillaFirefox

loadCerts

FTPCommander

System.Text.RegularExpressions

WindowsKey

SQLite

SQLDataTypeSize

sqlite_master_entry

sql_statement

Passwords

PasswordSource

FtpCommander

8.0.0.0

My.Computer

My.Application

My.User

My.Forms

My.WebServices

System.Windows.Forms.Form

My.MyProject.Forms

4System.Web.Services.Protocols.SoapHttpClientProtocol

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

12.0.0.0

My.Settings

$3e46a124-e015-4b12-9390-f16ac4d7ad53

1.0.0.0

_CorExeMain

mscoree.dll

{3C374A40-BAE4-11CF-BF7D-00AA006946EE}

{AFA0DC11-C313-11D0-831A-00C04FD5AE38}

hXXp://

Hmscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

Fkernel32.dll

USER32.DLL

hXXp://VVV.facebook.com/

hXXps://VVV.facebook.com/

hXXp://twitter.com/

hXXps://twitter.com/

hXXps://login.yahoo.com/config/login

hXXps://pinterest.com/login/

hXXp://VVV.linkedin.com/

hXXps://my.screenname.aol.com/_cqr/login/login.psp

hXXps://VVV.amazon.com/ap/signin/190-9059340-4656153

hXXps://signin.ebay.com/ws/ebayisapi.dll

hXXps://accounts.google.com/servicelogin

hXXps://VVV.google.com/accounts/servicelogin

hXXp://digg.com

hXXp://VVV.myspace.com

hXXps://myspace.com

hXXps://VVV.amazon.com/gp/css/homepage.html

hXXp://VVV.stumbleupon.com/sign_up.php

hXXp://slashdot.org/bookmark.pl

hXXp://VVV.reddit.com/login

1200000

noftp

MessageBoxIcon.Information

Disablecmd

\Windows Update.exe

\WindowsUpdate.exe

SysInfo.txt

\pid.txt

\pidloc.txt

HawkEyeKeylogger

\Mozilla\Firefox\Profiles

127.0.0.1

\SteamAppData.vdf

\ClientRegistry.blob

MessageBoxIcon.Error

MessageBoxIcon.Exclamation

MessageBoxIcon.Question

Dear HawkEye Customers!

HawkEye Admin

HawkEye Logger Details

Keylogger Enabled:

Operating System:

HawkEye_Keylogger_Execution_Confirmed_

HawkEye Keylogger | Execution Confirmed |

Dear HawkEye Customer!

This is a notification generated by

after successful injection of your server.

Best Regards
HawkEye Admin

************************************************************
HawkEye Keylogger's Detail
************************************************************
Server Name:

Keylogger Enabled:

Operating System:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

autorun.inf

open=Sys.exe

Sys.exe

Software\Microsoft\Windows\CurrentVersion\Run

Windows Update

\bitcoin\wallet.dat

_wallet.dat

wallet.dat

Microsoft.NET\Framework\v2.0.50727\vbc.exe

holdermail.txt"

holdermail.txt

Source:{4}{4}{0}{5}Host:{4}{4}{1}{5}Username:{4}{2}{5}Password:{4}{3}{5}{5}

Operating System Intel Recovery

Operating System Platform:

Operating System Version:

HawkEye_Keylogger_Recoveries_

HawkEye Keylogger | Recoveries |

****************************************************
Operating System Intel Recovery
****************************************************
PC Name:

Operating System Platform:

Operating System Version:

C:\Users\

_Pin0.jpeg

_Pin1.jpeg

_Pin2.jpeg

_Pin3.jpeg

_Pin4.jpeg

HawkEye Keylogger | RuneScape Recoveries |

Dear HawkEye Customer!

HawkEye Keylogger | BitCoin Recoveries |

As you can see, this email has attached file(s) containing the wallet.dat file which holds the users Bitcoin Currency.

\.minecraft\lastlogin

HawkEye Keylogger | MineCraft Recoveries |

As you can see, this email has the attached file(s) containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.

HawkEye Keylogger | Keyboard

Keyboard Records

.jpeg

HawkEye_Keylogger_Keylog_Records_

PTF://

HawkEye Keylogger | Keyboard Clipboards Records |

**************************************
Keyboard Records
**************************************

hXXp://192.99.212.64/WebPanel/log.php?username=

hXXp://whatismyipaddress.com/

Stub.Resources

:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

\Google\Chrome\User Data\Default\Login Data

logins

origin_url

password_value

moz_logins

formSubmitURL

encryptedPassword

\Mozilla Firefox\

mozglue.dll

\sitemanager.xml

\recentservers.xml

;Server=(?.*?);Port=(?.*?);Password=(?.*?);User=(?.*?);

port

password

C:\cftp\Ftplist.txt

\cftp\Ftplist.txt

\FTP Commander Deluxe\Ftplist.txt

password = (?.*?)

hXXp://dyn.com/dns/

\Dyn\Updater\daemon.cfg

\Dyn\Updater\config.dyndns

hXXps://VVV.noip.com/

CKey

SOFTWARE\Microsoft\Windows NT\CurrentVersion

RegAsm.exe_324_rwx_00400000_00122000: