Trojan.Win32.Vimditator.gsm (Kaspersky), Trojan-Dropper.RAR.Agent (A) (Emsisoft), (AdAware), WormAutoItGen.YR, GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: ef176263c02a5722c86ff835bdcacc0a
SHA1: 67005ec7b3f8b997f8ba41d056152476163db0e2
SHA256: 02966c24b821f8db75d34fed92f504377ef5afa9def151e64d57da8acfaeae90
SSDeep: 49152:/tJgzMngbFbqn9TxHZ/i2Ggr5kFm53Sya5T:/ibqn995/55kFm5W5T
Size: 1836556 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2012-06-09 16:19:49
Analyzed on: WindowsXP SP3 32-bit
Summary: Worm. A program that is primarily replicating on networks or removable drives.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Worm creates the following process(es):
vbc.exe:344
vbc.exe:1144
%original file name%.exe:636
The Worm injects its code into the following process(es):
xaaoclphoyys.exe:852
RegSvcs.exe:528
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process vbc.exe:344 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (400 bytes)
The process vbc.exe:1144 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (399 bytes)
The process xaaoclphoyys.exe:852 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\1f5pn1963m431\amtryglqrhnpf.vbs (131 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\run.vbs (94 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\odsuxp.cmd (73 bytes)
The process RegSvcs.exe:528 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\pid.txt (3 bytes)
%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (656 bytes)
%System%\wbem\Logs\wbemprox.log (152 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (57 bytes)
The Worm deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (0 bytes)
The process %original file name%.exe:636 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\1f5pn1963m431\wqysku.ZAJ (90 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\zvvuayagm.EMS (7547 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\yxsjjocyy (2409088 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\xaaoclphoyys.exe (15361 bytes)
The Worm deletes the following file(s):
%Documents and Settings%\%current user%\1f5pn1963m431\__tmp_rar_sfx_access_check_1114718 (0 bytes)
Registry activity
The process vbc.exe:344 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 C2 30 77 A7 57 01 42 60 EC 40 0D D3 EF 59 1B"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
The process vbc.exe:1144 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 38 52 70 37 29 BA D1 75 39 8C 0D 21 1F 0F D0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
The process xaaoclphoyys.exe:852 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 94 72 A2 81 21 01 8B 3C 11 66 54 51 96 A6 7F"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\C:\DOCUME~1\adm]
"1F5PN1~1" = "C:\DOCUME~1\"%CurrentUserName%"\1F5PN1~1\amtryglqrhnpf.vbs"
The process RegSvcs.exe:528 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\ESENT\Process\RegSvcs\DEBUG]
"Trace Level" = ""
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "42 AB 72 5B D9 43 09 A8 78 F9 DB 2F 26 05 82 C5"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"
To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Update" = "%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe"
The Worm deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\ESENT\Process\RegSvcs\DEBUG]
"Trace Level"
The process %original file name%.exe:636 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 90 F9 77 28 EF 02 09 D2 50 D7 6B 8E 3B 3F 61"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\1f5pn1963m431]
"xaaoclphoyys.exe" = "AutoIt v3 Script"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Dropped PE files
MD5 | File path |
---|---|
71d8f6d5dc35517275bc38ebcc815f9f | c:\Documents and Settings\"%CurrentUserName%"\1f5pn1963m431\xaaoclphoyys.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
vbc.exe:344
vbc.exe:1144
%original file name%.exe:636 - Delete the original Worm file.
- Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (400 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\amtryglqrhnpf.vbs (131 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\run.vbs (94 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\odsuxp.cmd (73 bytes)
%Documents and Settings%\%current user%\Application Data\pid.txt (3 bytes)
%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe (32 bytes)
%System%\wbem\Logs\wbemprox.log (152 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (57 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\wqysku.ZAJ (90 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\zvvuayagm.EMS (7547 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\yxsjjocyy (2409088 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\xaaoclphoyys.exe (15361 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\C:\DOCUME~1\adm]
"1F5PN1~1" = "C:\DOCUME~1\"%CurrentUserName%"\1F5PN1~1\amtryglqrhnpf.vbs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Update" = "%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 74526 | 74752 | 4.54396 | a8692f5ba740240ef0f9a827376f76f9 |
.rdata | 81920 | 7445 | 7680 | 3.46159 | d4f36accffde0bf520f52486679ccf0d |
.data | 90112 | 96036 | 512 | 2.46008 | b6c7edb5b7fec47a37a622cc5d71f3f4 |
.CRT | 188416 | 32 | 512 | 0.273198 | 439411041ee0b8261668525c5c132cd9 |
.rsrc | 192512 | 28736 | 29184 | 3.52491 | 9309ec256e1c20dc19301e6f40a4b09e |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://whatismyipaddress.com/ | 66.171.248.172 |
smtp.ybeoffice123.com | 208.91.199.225 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET / HTTP/1.1
Host: whatismyipaddress.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 27 Feb 2015 17:30:04 GMT
Server: Apache/2.2.26 (Unix) DAV/2 PHP/5.4.30 mod_ssl/2.2.26 OpenSSL/0.9.8zc
Set-Cookie: pt=8651c37cbeec0dad198626c770a8acfe; expires=Sat, 28-Feb-2015 17:30:04 GMT
Cache-Control: max-age=15
MS-Author-Via: DAV
Vary: Accept-Encoding
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
218c..<!doctype html>.<html lang="en">.<head>..<meta charset="windows-1252">..<meta name="robots" content="noarchive">..<title>What Is My IP Address? IP Address Tools and More</title>..<meta name="description" content="IP address lookup, location, proxy detection, email tracing, IP hiding tips, blacklist check, speed test, and forums. Find, get, and show my IP address.">..<meta name="keywords" content="my ip ,ip, address, adress, my, what, is, find, get, show, locate, change, location, how, do, i, ip address, proxy, server, anonymous, hide, conceal, stealth, surf, web, anonymizer, anonymize, changer, privacy, geolocation, geolocate, lookup, look up, locate, trace, track, email, source, headers">..<meta property="fb:admins" content="607824267" />..<link rel="shortcut icon" href="hXXp://cdn.whatismyipaddress.com/favicon.ico">..<link rel="stylesheet" type="text/css" href="hXXp://cdn.whatismyipaddress.com/css/myip_v4_3.css">..<link rel="publisher" href="hXXps://plus.google.com/ whatismyipaddress">..<link rel="canonical" href="hXXp://whatismyipaddress.com">..<link rel="alternate" hreflang="fr" href="hXXp://whatismyipaddress.com/fr/mon-ip">..<link rel="alternate" hreflang="de" href="hXXp://whatismyipaddress.com/de/meine-ip">..<link rel="alternate" hreflang="es" href="hXXp://whatismyipaddress.com/es/mi-ip">..<link rel="alternate" hreflang="tr" href="hXXp://whatismyipaddress.com/tr/ip-im">..<link rel="alterna
<<< skipped >>>
Map
The Worm connects to the servers at the folowing location(s):
Strings from Dumps
xaaoclphoyys.exe_852:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
s%j.Zf
s%j.Zf
8crtsu
8crtsu
:crts
:crts
crts
crts
GetProcessWindowStation
GetProcessWindowStation
operator
operator
uxtheme.dll
uxtheme.dll
kernel32.dll
kernel32.dll
operand of unlimited repeat could match the empty string
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
POSIX named classes are supported only within a class
erroffset passed as NULL
erroffset passed as NULL
POSIX collating elements are not supported
POSIX collating elements are not supported
this version of PCRE is not compiled with PCRE_UTF8 support
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N{name}, \U, or \u
PCRE does not support \L, \l, \N{name}, \U, or \u
support for \P, \p, and \X has not been compiled
support for \P, \p, and \X has not been compiled
this version of PCRE is not compiled with PCRE_UCP support
this version of PCRE is not compiled with PCRE_UCP support
ICMP.DLL
ICMP.DLL
advapi32.dll
advapi32.dll
RegDeleteKeyExW
RegDeleteKeyExW
Error text not found (please report)
Error text not found (please report)
WSOCK32.dll
WSOCK32.dll
VERSION.dll
VERSION.dll
WINMM.dll
WINMM.dll
COMCTL32.dll
COMCTL32.dll
MPR.dll
MPR.dll
InternetCrackUrlW
InternetCrackUrlW
HttpQueryInfoW
HttpQueryInfoW
HttpOpenRequestW
HttpOpenRequestW
HttpSendRequestW
HttpSendRequestW
FtpOpenFileW
FtpOpenFileW
FtpGetFileSize
FtpGetFileSize
InternetOpenUrlW
InternetOpenUrlW
WININET.dll
WININET.dll
PSAPI.DLL
PSAPI.DLL
USERENV.dll
USERENV.dll
GetProcessHeap
GetProcessHeap
CreatePipe
CreatePipe
GetWindowsDirectoryW
GetWindowsDirectoryW
KERNEL32.dll
KERNEL32.dll
OpenWindowStationW
OpenWindowStationW
SetProcessWindowStation
SetProcessWindowStation
CloseWindowStation
CloseWindowStation
MapVirtualKeyW
MapVirtualKeyW
EnumChildWindows
EnumChildWindows
EnumWindows
EnumWindows
VkKeyScanW
VkKeyScanW
GetKeyState
GetKeyState
GetKeyboardState
GetKeyboardState
SetKeyboardState
SetKeyboardState
GetAsyncKeyState
GetAsyncKeyState
keybd_event
keybd_event
EnumThreadWindows
EnumThreadWindows
ExitWindowsEx
ExitWindowsEx
UnregisterHotKey
UnregisterHotKey
RegisterHotKey
RegisterHotKey
GetKeyboardLayoutNameW
GetKeyboardLayoutNameW
USER32.dll
USER32.dll
SetViewportOrgEx
SetViewportOrgEx
GDI32.dll
GDI32.dll
COMDLG32.dll
COMDLG32.dll
RegOpenKeyExW
RegOpenKeyExW
RegCloseKey
RegCloseKey
RegCreateKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteKeyW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteW
ShellExecuteW
SHFileOperationW
SHFileOperationW
ShellExecuteExW
ShellExecuteExW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
GetCPInfo
GetCPInfo
zcÃ
zcÃ
L.aVFY)
L.aVFY)
.ijjrc
.ijjrc
g%D`-
g%D`-
sssh6
sssh6
uW.MW
uW.MW
3.3/464(5,5054585
3.3/464(5,5054585
8 8$8(8,808
8 8$8(8,808
= =$=(=,=0=4=8=
= =$=(=,=0=4=8=
0 0$0(0,0004080
0 0$0(0,0004080
:*;3;?;|;
:*;3;?;|;
11
11
2 323[3.5
2 323[3.5
? ?@?`?
? ?@?`?
= =$=(=,=0=4=
= =$=(=,=0=4=
5 5$5(5,5054585
5 5$5(5,5054585
CADjD%D
CADjD%D
mscoree.dll
mscoree.dll
nKERNEL32.DLL
nKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
WUSER32.DLL
WUSER32.DLL
CMDLINERAW
CMDLINERAW
CMDLINE
CMDLINE
/AutoIt3ExecuteLine
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
/AutoIt3ExecuteScript
%s (%d) : ==> %s.:
%s (%d) : ==> %s.:
Line %d:
Line %d:
Line %d (File "%s"):
Line %d (File "%s"):
%s (%d) : ==> %s:
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
*.au3;*.a3x
All files (*.*)
All files (*.*)
#NoAutoIt3Execute
#NoAutoIt3Execute
APPSKEY
APPSKEY
Line %d:
Line %d:
04090000
04090000
%u.%u.%u.%u
%u.%u.%u.%u
0.0.0.0
0.0.0.0
Mddddd
Mddddd
%s (%d) : ==> %s:
%s (%d) : ==> %s:
UDPSTARTUP
UDPSTARTUP
UDPSHUTDOWN
UDPSHUTDOWN
UDPSEND
UDPSEND
UDPRECV
UDPRECV
UDPOPEN
UDPOPEN
UDPCLOSESOCKET
UDPCLOSESOCKET
UDPBIND
UDPBIND
TRAYGETMSG
TRAYGETMSG
TCPSTARTUP
TCPSTARTUP
TCPSHUTDOWN
TCPSHUTDOWN
TCPSEND
TCPSEND
TCPRECV
TCPRECV
TCPNAMETOIP
TCPNAMETOIP
TCPLISTEN
TCPLISTEN
TCPCONNECT
TCPCONNECT
TCPCLOSESOCKET
TCPCLOSESOCKET
TCPACCEPT
TCPACCEPT
SHELLEXECUTEWAIT
SHELLEXECUTEWAIT
SHELLEXECUTE
SHELLEXECUTE
REGENUMKEY
REGENUMKEY
MSGBOX
MSGBOX
ISKEYWORD
ISKEYWORD
HTTPSETUSERAGENT
HTTPSETUSERAGENT
HTTPSETPROXY
HTTPSETPROXY
HOTKEYSET
HOTKEYSET
GUIREGISTERMSG
GUIREGISTERMSG
GUIGETMSG
GUIGETMSG
GUICTRLSENDMSG
GUICTRLSENDMSG
GUICTRLRECVMSG
GUICTRLRECVMSG
FTPSETPROXY
FTPSETPROXY
\??\%s
\??\%s
GUI_RUNDEFMSG
GUI_RUNDEFMSG
SendKeyDelay
SendKeyDelay
SendKeyDownDelay
SendKeyDownDelay
TCPTimeout
TCPTimeout
AUTOITCALLVARIABLE%d
AUTOITCALLVARIABLE%d
255.255.255.255
255.255.255.255
Keyword
Keyword
AutoIt.Error
AutoIt.Error
Null Object assignment in FOR..IN loop
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
Incorrect Object type in FOR..IN loop
HOTKEYPRESSED
HOTKEYPRESSED
AUTOITEXE
AUTOITEXE
WINDOWSDIR
WINDOWSDIR
3, 3, 8, 1
3, 3, 8, 1
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_USERS
HKEY_USERS
%d/d/d
%d/d/d
%Documents and Settings%\%current user%\1f5pn1963m431\xaaoclphoyys.exe
%Documents and Settings%\%current user%\1f5pn1963m431\xaaoclphoyys.exe
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
Missing operator in expression."Unbalanced brackets in expression.
Missing operator in expression."Unbalanced brackets in expression.
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.
3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.
String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.
hXXp://VVV.autoitscript.com/autoit3/
hXXp://VVV.autoitscript.com/autoit3/
AutoIt3.exe
AutoIt3.exe
xaaoclphoyys.exe_852_rwx_01280000_00001000:
.reloc
.reloc
RegSvcs.exe_528:
.text
.text
`.rsrc
`.rsrc
@.reloc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
%UUUU3
%UUUU3
tcPW
tcPW
-4-4--567
-4-4--567
%s%2.2X
%s%2.2X
Browser Password Dump
Browser Password Dump
%s v%s by SecurityXploded
%s v%s by SecurityXploded
hXXp://securityxploded.com/browser-password-dump.php
hXXp://securityxploded.com/browser-password-dump.php
BrowserPasswordDump
BrowserPasswordDump
%s.exe [-h | -f ]
%s.exe [-h | -f ]
//Dump login passwords from all the Browsers to console
//Dump login passwords from all the Browsers to console
%s.exe
%s.exe
//Dump login passwords from all the Browsers to a file 'c:\passlist.txt'
//Dump login passwords from all the Browsers to a file 'c:\passlist.txt'
%s.exe -f "c:\passlist.txt"
%s.exe -f "c:\passlist.txt"
%s.exe -h
%s.exe -h
pstorec.dll
pstorec.dll
http:/
http:/
https:/
https:/
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
hXXps://%s
hXXps://%s
hXXp://%s
hXXp://%s
Cannot close vault. Error (%d)
Cannot close vault. Error (%d)
Web Data
Web Data
Login Data
Login Data
select * from logins where blacklisted_by_user=0;
select * from logins where blacklisted_by_user=0;
\MapleStudio\ChromePlus\User Data\Default\
\MapleStudio\ChromePlus\User Data\Default\
\Google\Chrome SxS\User Data\Default\
\Google\Chrome SxS\User Data\Default\
\Google\Chrome\User Data\Default\
\Google\Chrome\User Data\Default\
Opera\Opera\
Opera\Opera\
Opera\Opera\profile\
Opera\Opera\profile\
wand.dat
wand.dat
account
account
passwords
passwords
data
data
server
server
%s\Safari\Apple Application Support\plutil.exe
%s\Safari\Apple Application Support\plutil.exe
%s\Apple\Apple Application Support\plutil.exe
%s\Apple\Apple Application Support\plutil.exe
%s\%s\keychain.plist
%s\%s\keychain.plist
%skeytest.tmp
%skeytest.tmp
"%s" -convert xml1 -s -o "%s" "%s"
"%s" -convert xml1 -s -o "%s" "%s"
Google Chrome
Google Chrome
Opera Browser
Opera Browser
Firefox
Firefox
Chrome SXS
Chrome SXS
SeaMonkey
SeaMonkey
Browser: %s
Browser: %s
Website: %s
Website: %s
Username: %s
Username: %s
Password: %s
Password: %s
vaultcli.dll
vaultcli.dll
Error: Failed to create file '%s' for writing Password list. Make sure you have specified correct & full file path
Error: Failed to create file '%s' for writing Password list. Make sure you have specified correct & full file path
Browser Password Recovery Report
Browser Password Recovery Report
Website URL
Website URL
Password
Password
Produced by %s from hXXp://VVV.SecurityXploded.com
Produced by %s from hXXp://VVV.SecurityXploded.com
Tip: For more options type %s.exe -h
Tip: For more options type %s.exe -h
This is command-line application. Kindly Run it from the CMD Prompt
This is command-line application. Kindly Run it from the CMD Prompt
Press any key to exit....
Press any key to exit....
SOFTWARE\Clients\StartMenuInternet\SEAMONKEY.EXE\shell\open\command
SOFTWARE\Clients\StartMenuInternet\SEAMONKEY.EXE\shell\open\command
SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command
SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command
Mozilla\SeaMonkey
Mozilla\SeaMonkey
Mozilla\Firefox
Mozilla\Firefox
\profiles.ini
\profiles.ini
select * from moz_logins;
select * from moz_logins;
/signons.txt
/signons.txt
/signons2.txt
/signons2.txt
/signons3.txt
/signons3.txt
\signons.sqlite
\signons.sqlite
nss3.dll
nss3.dll
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
PK11_CheckUserPassword
PK11_CheckUserPassword
SQLite format 3
SQLite format 3
CREATE TABLE sqlite_master(
CREATE TABLE sqlite_master(
sql text
sql text
CREATE TEMP TABLE sqlite_temp_master(
CREATE TEMP TABLE sqlite_temp_master(
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
3.6.16
3.6.16
sqlite_version
sqlite_version
RowKey
RowKey
SQL logic error or missing database
SQL logic error or missing database
large file support is disabled
large file support is disabled
sqlite_detach
sqlite_detach
sqlite_attach
sqlite_attach
d-d-d d:d:d
d-d-d d:d:d
d:d:d
d:d:d
d-d-d
d-d-d
922337203685477580
922337203685477580
%s\etilqs_
%s\etilqs_
OsError 0x%x (%u)
OsError 0x%x (%u)
invalid page number %d
invalid page number %d
2nd reference to page %d
2nd reference to page %d
Failed to read ptrmap key=%d
Failed to read ptrmap key=%d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
%d of %d pages missing from overflow list starting at %d
%d of %d pages missing from overflow list starting at %d
failed to get page %d
failed to get page %d
freelist leaf count too big on page %d
freelist leaf count too big on page %d
Page %d:
Page %d:
unable to get the page. error code=%d
unable to get the page. error code=%d
sqlite3BtreeInitPage() returns error code %d
sqlite3BtreeInitPage() returns error code %d
On tree page %d cell %d:
On tree page %d cell %d:
On page %d at right child:
On page %d at right child:
Corruption detected in header on page %d
Corruption detected in header on page %d
Corruption detected in cell %d on page %d
Corruption detected in cell %d on page %d
Multiple uses for byte %d of page %d
Multiple uses for byte %d of page %d
Fragmented space is %d byte reported as %d on page %d
Fragmented space is %d byte reported as %d on page %d
Page %d is never used
Page %d is never used
Pointer map page %d is referenced
Pointer map page %d is referenced
Outstanding page count goes from %d to %d during this analysis
Outstanding page count goes from %d to %d during this analysis
keyinfo(%d
keyinfo(%d
%s(%d)
%s(%d)
%s-mjX
%s-mjX
unable to use function %s in the requested context
unable to use function %s in the requested context
cannot open savepoint - SQL statements in progress
cannot open savepoint - SQL statements in progress
no such savepoint: %s
no such savepoint: %s
cannot %s savepoint - SQL statements in progress
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_temp_master
sqlite_temp_master
sqlite_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s
database table is locked: %s
database table is locked: %s
cannot open virtual table: %s
cannot open virtual table: %s
cannot open view: %s
cannot open view: %s
no such column: "%s"
no such column: "%s"
cannot open indexed column for writing
cannot open indexed column for writing
cannot open value of type %s
cannot open value of type %s
misuse of aliased aggregate %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s.%s
%s: %s.%s
%s: %s.%s
%s: %s
%s: %s
not authorized to use function: %s
not authorized to use function: %s
%r %s BY term out of range - should be between 1 and %d
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
variable number must be between ?1 and ?%d
too many SQL variables
too many SQL variables
too many columns in %s
too many columns in %s
misuse of aggregate: %s()
misuse of aggregate: %s()
%.*s"%w"%s
%.*s"%w"%s
sqlite_rename_table
sqlite_rename_table
sqlite_rename_trigger
sqlite_rename_trigger
%s OR name=%Q
%s OR name=%Q
there is already another table or index with this name: %s
there is already another table or index with this name: %s
sqlite_
sqlite_
table %s may not be altered
table %s may not be altered
view %s may not be altered
view %s may not be altered
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
sqlite_sequence
sqlite_sequence
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_altertab_%s
sqlite_stat1
sqlite_stat1
CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)
CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
SELECT idx, stat FROM %Q.sqlite_stat1
SELECT idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
invalid name: "%s"
too many attached databases - max %d
too many attached databases - max %d
database %s is already in use
database %s is already in use
unable to open database: %s
unable to open database: %s
no such database: %s
no such database: %s
cannot detach database %s
cannot detach database %s
database %s is locked
database %s is locked
%s %T cannot reference objects in database %s
%s %T cannot reference objects in database %s
access to %s.%s.%s is prohibited
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
object name reserved for internal use: %s
there is already an index named %s
there is already an index named %s
too many columns on %s
too many columns on %s
duplicate column name: %s
duplicate column name: %s
default value of column [%s] is not constant
default value of column [%s] is not constant
table "%s" has more than one primary key
table "%s" has more than one primary key
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
no such collation sequence: %s
no such collation sequence: %s
CREATE %s %.*s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE TABLE %Q.sqlite_sequence(name,seq)
CREATE TABLE %Q.sqlite_sequence(name,seq)
view %s is circularly defined
view %s is circularly defined
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
table %s may not be dropped
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
use DROP VIEW to delete view %s
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
foreign key on %s should reference only one column of table %T
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
unknown column "%s" in foreign key definition
indexed columns are not unique
indexed columns are not unique
table %s may not be indexed
table %s may not be indexed
views may not be indexed
views may not be indexed
virtual tables may not be indexed
virtual tables may not be indexed
there is already a table named %s
there is already a table named %s
index %s already exists
index %s already exists
sqlite_autoindex_%s_%d
sqlite_autoindex_%s_%d
table %s has no column named %s
table %s has no column named %s
CREATE%s INDEX %.*s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q
DELETE FROM %Q.%s WHERE name=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
unable to identify the object to be reindexed
unable to identify the object to be reindexed
table %s may not be modified
table %s may not be modified
cannot modify %s because it is a view
cannot modify %s because it is a view
table %S has %d columns but %d values were supplied
table %S has %d columns but %d values were supplied
%d values for %d columns
%d values for %d columns
table %S has no column named %s
table %S has no column named %s
%s.%s may not be NULL
%s.%s may not be NULL
PRIMARY KEY must be unique
PRIMARY KEY must be unique
sqlite3_extension_init
sqlite3_extension_init
unable to open shared library [%s]
unable to open shared library [%s]
no entry point [%s] in shared library [%s]
no entry point [%s] in shared library [%s]
error during initialization: %s
error during initialization: %s
automatic extension loading failed: %s
automatic extension loading failed: %s
foreign_key_list
foreign_key_list
*** in database %s ***
*** in database %s ***
unsupported encoding: %s
unsupported encoding: %s
malformed database schema (%s)
malformed database schema (%s)
%s - %s
%s - %s
unsupported file format
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s
SELECT name, rootpage, sql FROM '%q'.%s
database schema is locked: %s
database schema is locked: %s
unknown or unsupported join type: %T %T%s%T
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
cannot join using column %s - column not present in both tables
%s.%s
%s.%s
%s:%d
%s:%d
ORDER BY clause should come after %s not before
ORDER BY clause should come after %s not before
LIMIT clause should come after %s not before
LIMIT clause should come after %s not before
SELECTs to the left and right of %s do not have the same number of result columns
SELECTs to the left and right of %s do not have the same number of result columns
no such index: %s
no such index: %s
sqlite_subquery_%p_
sqlite_subquery_%p_
no such table: %s
no such table: %s
sqlite3_get_table() called with two or more incompatible queries
sqlite3_get_table() called with two or more incompatible queries
cannot create %s trigger on view: %S
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
no such trigger: %S
-- TRIGGER %s
-- TRIGGER %s
no such column: %s
no such column: %s
PRAGMA vacuum_db.synchronous=OFF
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor failed: %s
vtable constructor did not declare schema: %s
vtable constructor did not declare schema: %s
no such module: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
at most %d tables in a join
cannot use index: %s
cannot use index: %s
TABLE %s
TABLE %s
%s AS %s
%s AS %s
%s WITH INDEX %s
%s WITH INDEX %s
%s VIA MULTI-INDEX UNION
%s VIA MULTI-INDEX UNION
%s USING PRIMARY KEY
%s USING PRIMARY KEY
%s VIRTUAL TABLE INDEX %d:%s
%s VIRTUAL TABLE INDEX %d:%s
%s ORDER BY
%s ORDER BY
unable to close due to unfinished backup operation
unable to close due to unfinished backup operation
no such vfs: %s
no such vfs: %s
GetProcessWindowStation
GetProcessWindowStation
operator
operator
GetProcessHeap
GetProcessHeap
KERNEL32.dll
KERNEL32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
CRYPT32.dll
CRYPT32.dll
GetCPInfo
GetCPInfo
OLEAUT32.dll
OLEAUT32.dll
zcÃ
zcÃ
kernel32.dll
kernel32.dll
\StringFileInfo\xx\%s
\StringFileInfo\xx\%s
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msimn.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msimn.exe
outlook.exe
outlook.exe
msimn.exe
msimn.exe
%Program Files%\Microsoft Office\Office\Outlook.exe
%Program Files%\Microsoft Office\Office\Outlook.exe
Email Password Dump
Email Password Dump
hXXp://securityxploded.com/email-password-dump.php
hXXp://securityxploded.com/email-password-dump.php
EmailPasswordDump
EmailPasswordDump
//Dump all the Email passwords to console
//Dump all the Email passwords to console
//Dump all the Email passwords to a file "c:\passlist.txt"
//Dump all the Email passwords to a file "c:\passlist.txt"
\.purple\accounts.xml
\.purple\accounts.xml
%s\%s
%s\%s
@gmail.com
@gmail.com
@yahoo.com
@yahoo.com
Software\Paltalk\%s
Software\Paltalk\%s
Software\Google\Google Talk\Accounts\%s
Software\Google\Google Talk\Accounts\%s
Microsoft_WinInet_VVV.google.com:443
Microsoft_WinInet_VVV.google.com:443
%sMiranda_Mirror_%d.bin
%sMiranda_Mirror_%d.bin
LoginPassword
LoginPassword
LoginName
LoginName
LoginServer
LoginServer
gmail.com
gmail.com
%s\%s\%s.dat
%s\%s\%s.dat
pop3password=
pop3password=
esmtpaccount=
esmtpaccount=
esmtppassword=
esmtppassword=
smtphost=
smtphost=
SmtpPassword
SmtpPassword
ESMTPAccountKey
ESMTPAccountKey
c:\Program Files\Foxmail\mail
c:\Program Files\Foxmail\mail
%s\%s\Account.stg
%s\%s\Account.stg
%Program Files%\Foxmail 7.0\Data\AccCfg\Accounts.tdat
%Program Files%\Foxmail 7.0\Data\AccCfg\Accounts.tdat
PopPassword
PopPassword
SmtpAccount
SmtpAccount
SmtpServer
SmtpServer
%s\%s\Accounts
%s\%s\Accounts
%s\%s\Accounts\%s
%s\%s\Accounts\%s
Mozilla Thunderbird
Mozilla Thunderbird
Windows Live Mail
Windows Live Mail
Windows Credential Manager
Windows Credential Manager
Application:%s
Application:%s
Email ID: %s
Email ID: %s
WindowsLive:name=*
WindowsLive:name=*
Software\Microsoft\Windows Live Mail
Software\Microsoft\Windows Live Mail
hXXps://
hXXps://
00000050
00000050
.oeaccount
.oeaccount
Software\Microsoft\IdentityCRL\Creds\%s
Software\Microsoft\IdentityCRL\Creds\%s
ps:password
ps:password
Email Password Recovery Report
Email Password Recovery Report
Produced by EmailPasswordDump v%s from hXXp://VVV.SecurityXploded.com
Produced by EmailPasswordDump v%s from hXXp://VVV.SecurityXploded.com
SOFTWARE\Clients\Mail\Mozilla Thunderbird\shell\open\command
SOFTWARE\Clients\Mail\Mozilla Thunderbird\shell\open\command
kpstorec.dll
kpstorec.dll
220D5CC1-853A-11D0-84BC-00C04FD43F8F
220D5CC1-853A-11D0-84BC-00C04FD43F8F
417e2d75-84bd-11d0-84bb-00c04fd43f8f
417e2d75-84bd-11d0-84bb-00c04fd43f8f
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
IMAP Password
IMAP Password
IMAP Port
IMAP Port
POP3 Password
POP3 Password
POP3 Port
POP3 Port
SMTP User
SMTP User
SMTP Password
SMTP Password
SMTP Server
SMTP Server
SMTP Port
SMTP Port
HTTP User
HTTP User
HTTP Password
HTTP Password
HTTP Server URL
HTTP Server URL
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows Messaging Subsystem\Profiles
%s\%s\%s
%s\%s\%s
%s\%s\%s\%s
%s\%s\%s\%s
SMTP Email Address
SMTP Email Address
IMAP Password2
IMAP Password2
POP3 Password2
POP3 Password2
SMTP User Name
SMTP User Name
SMTP Password2
SMTP Password2
HTTPMail User Name
HTTPMail User Name
HTTPMail Password2
HTTPMail Password2
HTTPMail Server
HTTPMail Server
LDAP Password2
LDAP Password2
Specified master password "%s" is wrong. Please try again with correct password
Specified master password "%s" is wrong. Please try again with correct password
GetWindowsDirectoryA
GetWindowsDirectoryA
RegEnumKeyExA
RegEnumKeyExA
USERENV.dll
USERENV.dll
VERSION.dll
VERSION.dll
RPCRT4.dll
RPCRT4.dll
v2.0.50727
v2.0.50727
Stub.exe
Stub.exe
Microsoft.VisualBasic
Microsoft.VisualBasic
System.Windows.Forms
System.Windows.Forms
System.Drawing
System.Drawing
System.Management
System.Management
System.Xml
System.Xml
tapi32.dll
tapi32.dll
rtm.dll
rtm.dll
user32.dll
user32.dll
ntdll.dll
ntdll.dll
Crypt32.dll
Crypt32.dll
Stub.Form1.resources
Stub.Form1.resources
Stub.Resources.resources
Stub.Resources.resources
Stub.My
Stub.My
WindowsFormsApplicationBase
WindowsFormsApplicationBase
Microsoft.VisualBasic.ApplicationServices
Microsoft.VisualBasic.ApplicationServices
System.Collections.Generic
System.Collections.Generic
.ctor
.ctor
.cctor
.cctor
System.Diagnostics
System.Diagnostics
System.Threading
System.Threading
System.Runtime.CompilerServices
System.Runtime.CompilerServices
System.ComponentModel
System.ComponentModel
System.CodeDom.Compiler
System.CodeDom.Compiler
Microsoft.VisualBasic.Devices
Microsoft.VisualBasic.Devices
m_MyWebServicesObjectProvider
m_MyWebServicesObjectProvider
get_WebServices
get_WebServices
HelpKeywordAttribute
HelpKeywordAttribute
System.ComponentModel.Design
System.ComponentModel.Design
WebServices
WebServices
Microsoft.VisualBasic.CompilerServices
Microsoft.VisualBasic.CompilerServices
System.Collections
System.Collections
System.Reflection
System.Reflection
ContainsKey
ContainsKey
InvalidOperationException
InvalidOperationException
MyWebServices
MyWebServices
System.Runtime.InteropServices
System.Runtime.InteropServices
encryptedpassstring
encryptedpassstring
encryptedsmtpstring
encryptedsmtpstring
portstring
portstring
encryptedftphost
encryptedftphost
encryptedftpuser
encryptedftpuser
encryptedftppass
encryptedftppass
useftp
useftp
websitevisitor
websitevisitor
websiteblocker
websiteblocker
fakeMSGholder
fakeMSGholder
passstring
passstring
smtpstring
smtpstring
ftphost
ftphost
ftpuser
ftpuser
ftppass
ftppass
WM_KEYUP
WM_KEYUP
WM_KEYDOWN
WM_KEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYUP
WM_SYSKEYUP
KeyboardHandle
KeyboardHandle
KeyLog
KeyLog
CleanedPasswordsMAIL
CleanedPasswordsMAIL
CleanedPasswordsWB
CleanedPasswordsWB
System.IO
System.IO
get_ExecutablePath
get_ExecutablePath
WindowsIdentity
WindowsIdentity
System.Security.Principal
System.Security.Principal
set_WindowState
set_WindowState
FormWindowState
FormWindowState
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookEx
SetWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
GetAsyncKeyState
GetAsyncKeyState
vKey
vKey
HookKeyboard
HookKeyboard
UnhookKeyboard
UnhookKeyboard
Operators
Operators
get_Keyboard
get_Keyboard
Keyboard
Keyboard
get_CtrlKeyDown
get_CtrlKeyDown
get_AltKeyDown
get_AltKeyDown
KeyboardCallback
KeyboardCallback
set_UseShellExecute
set_UseShellExecute
Microsoft.VisualBasic.MyServices
Microsoft.VisualBasic.MyServices
System.Collections.ObjectModel
System.Collections.ObjectModel
MsgBox
MsgBox
MsgBoxResult
MsgBoxResult
MsgBoxStyle
MsgBoxStyle
ForceSteamLogin
ForceSteamLogin
System.Net.NetworkInformation
System.Net.NetworkInformation
get_OperationalStatus
get_OperationalStatus
OperationalStatus
OperationalStatus
FakemsgInstall
FakemsgInstall
System.Net.Mail
System.Net.Mail
SmtpClient
SmtpClient
System.Globalization
System.Globalization
set_Port
set_Port
System.Net
System.Net
Microsoft.Win32
Microsoft.Win32
RegistryKey
RegistryKey
OpenSubKey
OpenSubKey
System.Security.Cryptography
System.Security.Cryptography
System.Text
System.Text
set_Key
set_Key
StealPasswords
StealPasswords
stealWebroswers
stealWebroswers
WebClient
WebClient
readweb
readweb
System.IO.Compression
System.IO.Compression
SendLogsFTP
SendLogsFTP
FtpWebRequest
FtpWebRequest
WebRequest
WebRequest
UploadFTP
UploadFTP
secretKey
secretKey
set_KeySize
set_KeySize
get_KeySize
get_KeySize
System.Net.Sockets
System.Net.Sockets
virtualKey
virtualKey
KeyboardHookDelegate
KeyboardHookDelegate
get_Msg
get_Msg
System.Security
System.Security
ProcessHandle
ProcessHandle
Stub.My.Resources
Stub.My.Resources
System.Resources
System.Resources
get_WebBrowserPassView
get_WebBrowserPassView
WebBrowserPassView
WebBrowserPassView
System.Configuration
System.Configuration
GoogleChrome
GoogleChrome
MozillaFirefox
MozillaFirefox
loadCerts
loadCerts
FTPCommander
FTPCommander
System.Text.RegularExpressions
System.Text.RegularExpressions
WindowsKey
WindowsKey
SQLite
SQLite
SQLDataTypeSize
SQLDataTypeSize
sqlite_master_entry
sqlite_master_entry
sql_statement
sql_statement
Passwords
Passwords
PasswordSource
PasswordSource
FtpCommander
FtpCommander
8.0.0.0
8.0.0.0
My.Computer
My.Computer
My.Application
My.Application
My.User
My.User
My.Forms
My.Forms
My.WebServices
My.WebServices
System.Windows.Forms.Form
System.Windows.Forms.Form
My.MyProject.Forms
My.MyProject.Forms
4System.Web.Services.Protocols.SoapHttpClientProtocol
4System.Web.Services.Protocols.SoapHttpClientProtocol
3System.Resources.Tools.StronglyTypedResourceBuilder
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
12.0.0.0
12.0.0.0
My.Settings
My.Settings
$3e46a124-e015-4b12-9390-f16ac4d7ad53
$3e46a124-e015-4b12-9390-f16ac4d7ad53
1.0.0.0
1.0.0.0
_CorExeMain
_CorExeMain
mscoree.dll
mscoree.dll
{3C374A40-BAE4-11CF-BF7D-00AA006946EE}
{3C374A40-BAE4-11CF-BF7D-00AA006946EE}
{AFA0DC11-C313-11D0-831A-00C04FD5AE38}
{AFA0DC11-C313-11D0-831A-00C04FD5AE38}
hXXp://
hXXp://
Hmscoree.dll
Hmscoree.dll
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- floating point support not loaded
- floating point support not loaded
Fkernel32.dll
Fkernel32.dll
USER32.DLL
USER32.DLL
hXXp://VVV.facebook.com/
hXXp://VVV.facebook.com/
hXXps://VVV.facebook.com/
hXXps://VVV.facebook.com/
hXXp://twitter.com/
hXXp://twitter.com/
hXXps://twitter.com/
hXXps://twitter.com/
hXXps://login.yahoo.com/config/login
hXXps://login.yahoo.com/config/login
hXXps://pinterest.com/login/
hXXps://pinterest.com/login/
hXXp://VVV.linkedin.com/
hXXp://VVV.linkedin.com/
hXXps://my.screenname.aol.com/_cqr/login/login.psp
hXXps://my.screenname.aol.com/_cqr/login/login.psp
hXXps://VVV.amazon.com/ap/signin/190-9059340-4656153
hXXps://VVV.amazon.com/ap/signin/190-9059340-4656153
hXXps://signin.ebay.com/ws/ebayisapi.dll
hXXps://signin.ebay.com/ws/ebayisapi.dll
hXXps://accounts.google.com/servicelogin
hXXps://accounts.google.com/servicelogin
hXXps://VVV.google.com/accounts/servicelogin
hXXps://VVV.google.com/accounts/servicelogin
hXXp://digg.com
hXXp://digg.com
hXXp://VVV.myspace.com
hXXp://VVV.myspace.com
hXXps://myspace.com
hXXps://myspace.com
hXXps://VVV.amazon.com/gp/css/homepage.html
hXXps://VVV.amazon.com/gp/css/homepage.html
hXXp://VVV.stumbleupon.com/sign_up.php
hXXp://VVV.stumbleupon.com/sign_up.php
hXXp://slashdot.org/bookmark.pl
hXXp://slashdot.org/bookmark.pl
hXXp://VVV.reddit.com/login
hXXp://VVV.reddit.com/login
noftp
noftp
MessageBoxIcon.Information
MessageBoxIcon.Information
Disablecmd
Disablecmd
\Windows Update.exe
\Windows Update.exe
\WindowsUpdate.exe
\WindowsUpdate.exe
SysInfo.txt
SysInfo.txt
\pid.txt
\pid.txt
\pidloc.txt
\pidloc.txt
HawkEyeKeylogger
HawkEyeKeylogger
\Mozilla\Firefox\Profiles
\Mozilla\Firefox\Profiles
127.0.0.1
127.0.0.1
\SteamAppData.vdf
\SteamAppData.vdf
\ClientRegistry.blob
\ClientRegistry.blob
MessageBoxIcon.Error
MessageBoxIcon.Error
MessageBoxIcon.Exclamation
MessageBoxIcon.Exclamation
MessageBoxIcon.Question
MessageBoxIcon.Question
Dear HawkEye Customers!
Dear HawkEye Customers!
HawkEye Admin
HawkEye Admin
HawkEye Logger Details
HawkEye Logger Details
Keylogger Enabled:
Keylogger Enabled:
Operating System:
Operating System:
HawkEye_Keylogger_Execution_Confirmed_
HawkEye_Keylogger_Execution_Confirmed_
HawkEye Keylogger | Execution Confirmed |
HawkEye Keylogger | Execution Confirmed |
Dear HawkEye Customer!
This is a notification generated by
Dear HawkEye Customer!
This is a notification generated by
after successful injection of your server.
Best Regards
HawkEye Admin
************************************************************
HawkEye Keylogger's Detail
************************************************************
Server Name:
after successful injection of your server.
Best Regards
HawkEye Admin
************************************************************
HawkEye Keylogger's Detail
************************************************************
Server Name:
Keylogger Enabled:
Keylogger Enabled:
Operating System:
Operating System:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
autorun.inf
autorun.inf
open=Sys.exe
open=Sys.exe
Sys.exe
Sys.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Windows Update
Windows Update
\bitcoin\wallet.dat
\bitcoin\wallet.dat
_wallet.dat
_wallet.dat
wallet.dat
wallet.dat
Microsoft.NET\Framework\v2.0.50727\vbc.exe
Microsoft.NET\Framework\v2.0.50727\vbc.exe
holdermail.txt"
holdermail.txt"
holdermail.txt
holdermail.txt
Source:{4}{4}{0}{5}Host:{4}{4}{1}{5}Username:{4}{2}{5}Password:{4}{3}{5}{5}
Source:{4}{4}{0}{5}Host:{4}{4}{1}{5}Username:{4}{2}{5}Password:{4}{3}{5}{5}
Operating System Intel Recovery
Operating System Intel Recovery
Operating System Platform:
Operating System Platform:
Operating System Version:
Operating System Version:
HawkEye_Keylogger_Recoveries_
HawkEye_Keylogger_Recoveries_
HawkEye Keylogger | Recoveries |
HawkEye Keylogger | Recoveries |
****************************************************
Operating System Intel Recovery
****************************************************
PC Name:
****************************************************
Operating System Intel Recovery
****************************************************
PC Name:
Operating System Platform:
Operating System Platform:
Operating System Version:
Operating System Version:
C:\Users\
C:\Users\
_Pin0.jpeg
_Pin0.jpeg
_Pin1.jpeg
_Pin1.jpeg
_Pin2.jpeg
_Pin2.jpeg
_Pin3.jpeg
_Pin3.jpeg
_Pin4.jpeg
_Pin4.jpeg
HawkEye Keylogger | RuneScape Recoveries |
HawkEye Keylogger | RuneScape Recoveries |
Dear HawkEye Customer!
Dear HawkEye Customer!
HawkEye Keylogger | BitCoin Recoveries |
HawkEye Keylogger | BitCoin Recoveries |
As you can see, this email has attached file(s) containing the wallet.dat file which holds the users Bitcoin Currency.
As you can see, this email has attached file(s) containing the wallet.dat file which holds the users Bitcoin Currency.
\.minecraft\lastlogin
\.minecraft\lastlogin
HawkEye Keylogger | MineCraft Recoveries |
HawkEye Keylogger | MineCraft Recoveries |
As you can see, this email has the attached file(s) containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.
As you can see, this email has the attached file(s) containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.
HawkEye Keylogger | Keyboard
HawkEye Keylogger | Keyboard
Keyboard Records
Keyboard Records
.jpeg
.jpeg
HawkEye_Keylogger_Keylog_Records_
HawkEye_Keylogger_Keylog_Records_
PTF://
PTF://
HawkEye Keylogger | Keyboard Clipboards Records |
HawkEye Keylogger | Keyboard Clipboards Records |
**************************************
Keyboard Records
**************************************
**************************************
Keyboard Records
**************************************
hXXp://192.99.212.64/WebPanel/log.php?username=
hXXp://192.99.212.64/WebPanel/log.php?username=
hXXp://whatismyipaddress.com/
hXXp://whatismyipaddress.com/
Stub.Resources
Stub.Resources
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
\Google\Chrome\User Data\Default\Login Data
\Google\Chrome\User Data\Default\Login Data
logins
logins
origin_url
origin_url
password_value
password_value
moz_logins
moz_logins
formSubmitURL
formSubmitURL
encryptedPassword
encryptedPassword
\Mozilla Firefox\
\Mozilla Firefox\
mozglue.dll
mozglue.dll
\sitemanager.xml
\sitemanager.xml
\recentservers.xml
\recentservers.xml
;Server=(?.*?);Port=(?.*?);Password=(?.*?);User=(?.*?);
;Server=(?.*?);Port=(?.*?);Password=(?.*?);User=(?.*?);
port
port
password
password
C:\cftp\Ftplist.txt
C:\cftp\Ftplist.txt
\cftp\Ftplist.txt
\cftp\Ftplist.txt
\FTP Commander Deluxe\Ftplist.txt
\FTP Commander Deluxe\Ftplist.txt
password = (?.*?)
password = (?.*?)
hXXp://dyn.com/dns/
hXXp://dyn.com/dns/
\Dyn\Updater\daemon.cfg
\Dyn\Updater\daemon.cfg
\Dyn\Updater\config.dyndns
\Dyn\Updater\config.dyndns
hXXps://VVV.noip.com/
hXXps://VVV.noip.com/
CKey
CKey
SOFTWARE\Microsoft\Windows NT\CurrentVersion
SOFTWARE\Microsoft\Windows NT\CurrentVersion
RegSvcs.exe_528_rwx_00400000_00122000:
.text
.text
`.rsrc
`.rsrc
@.reloc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
%UUUU3
%UUUU3
tcPW
tcPW
-4-4--567
-4-4--567
%s%2.2X
%s%2.2X
Browser Password Dump
Browser Password Dump
%s v%s by SecurityXploded
%s v%s by SecurityXploded
hXXp://securityxploded.com/browser-password-dump.php
hXXp://securityxploded.com/browser-password-dump.php
BrowserPasswordDump
BrowserPasswordDump
%s.exe [-h | -f ]
%s.exe [-h | -f ]
//Dump login passwords from all the Browsers to console
//Dump login passwords from all the Browsers to console
%s.exe
%s.exe
//Dump login passwords from all the Browsers to a file 'c:\passlist.txt'
//Dump login passwords from all the Browsers to a file 'c:\passlist.txt'
%s.exe -f "c:\passlist.txt"
%s.exe -f "c:\passlist.txt"
%s.exe -h
%s.exe -h
pstorec.dll
pstorec.dll
http:/
http:/
https:/
https:/
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
hXXps://%s
hXXps://%s
hXXp://%s
hXXp://%s
Cannot close vault. Error (%d)
Cannot close vault. Error (%d)
Web Data
Web Data
Login Data
Login Data
select * from logins where blacklisted_by_user=0;
select * from logins where blacklisted_by_user=0;
\MapleStudio\ChromePlus\User Data\Default\
\MapleStudio\ChromePlus\User Data\Default\
\Google\Chrome SxS\User Data\Default\
\Google\Chrome SxS\User Data\Default\
\Google\Chrome\User Data\Default\
\Google\Chrome\User Data\Default\
Opera\Opera\
Opera\Opera\
Opera\Opera\profile\
Opera\Opera\profile\
wand.dat
wand.dat
account
account
passwords
passwords
data
data
server
server
%s\Safari\Apple Application Support\plutil.exe
%s\Safari\Apple Application Support\plutil.exe
%s\Apple\Apple Application Support\plutil.exe
%s\Apple\Apple Application Support\plutil.exe
%s\%s\keychain.plist
%s\%s\keychain.plist
%skeytest.tmp
%skeytest.tmp
"%s" -convert xml1 -s -o "%s" "%s"
"%s" -convert xml1 -s -o "%s" "%s"
Google Chrome
Google Chrome
Opera Browser
Opera Browser
Firefox
Firefox
Chrome SXS
Chrome SXS
SeaMonkey
SeaMonkey
Browser: %s
Browser: %s
Website: %s
Website: %s
Username: %s
Username: %s
Password: %s
Password: %s
vaultcli.dll
vaultcli.dll
Error: Failed to create file '%s' for writing Password list. Make sure you have specified correct & full file path
Error: Failed to create file '%s' for writing Password list. Make sure you have specified correct & full file path
Browser Password Recovery Report
Browser Password Recovery Report
Website URL
Website URL
Password
Password
Produced by %s from hXXp://VVV.SecurityXploded.com
Produced by %s from hXXp://VVV.SecurityXploded.com
Tip: For more options type %s.exe -h
Tip: For more options type %s.exe -h
This is command-line application. Kindly Run it from the CMD Prompt
This is command-line application. Kindly Run it from the CMD Prompt
Press any key to exit....
Press any key to exit....
SOFTWARE\Clients\StartMenuInternet\SEAMONKEY.EXE\shell\open\command
SOFTWARE\Clients\StartMenuInternet\SEAMONKEY.EXE\shell\open\command
SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command
SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command
Mozilla\SeaMonkey
Mozilla\SeaMonkey
Mozilla\Firefox
Mozilla\Firefox
\profiles.ini
\profiles.ini
select * from moz_logins;
select * from moz_logins;
/signons.txt
/signons.txt
/signons2.txt
/signons2.txt
/signons3.txt
/signons3.txt
\signons.sqlite
\signons.sqlite
nss3.dll
nss3.dll
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
PK11_CheckUserPassword
PK11_CheckUserPassword
SQLite format 3
SQLite format 3
CREATE TABLE sqlite_master(
CREATE TABLE sqlite_master(
sql text
sql text
CREATE TEMP TABLE sqlite_temp_master(
CREATE TEMP TABLE sqlite_temp_master(
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
3.6.16
3.6.16
sqlite_version
sqlite_version
RowKey
RowKey
SQL logic error or missing database
SQL logic error or missing database
large file support is disabled
large file support is disabled
sqlite_detach
sqlite_detach
sqlite_attach
sqlite_attach
d-d-d d:d:d
d-d-d d:d:d
d:d:d
d:d:d
d-d-d
d-d-d
922337203685477580
922337203685477580
%s\etilqs_
%s\etilqs_
OsError 0x%x (%u)
OsError 0x%x (%u)
invalid page number %d
invalid page number %d
2nd reference to page %d
2nd reference to page %d
Failed to read ptrmap key=%d
Failed to read ptrmap key=%d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
%d of %d pages missing from overflow list starting at %d
%d of %d pages missing from overflow list starting at %d
failed to get page %d
failed to get page %d
freelist leaf count too big on page %d
freelist leaf count too big on page %d
Page %d:
Page %d:
unable to get the page. error code=%d
unable to get the page. error code=%d
sqlite3BtreeInitPage() returns error code %d
sqlite3BtreeInitPage() returns error code %d
On tree page %d cell %d:
On tree page %d cell %d:
On page %d at right child:
On page %d at right child:
Corruption detected in header on page %d
Corruption detected in header on page %d
Corruption detected in cell %d on page %d
Corruption detected in cell %d on page %d
Multiple uses for byte %d of page %d
Multiple uses for byte %d of page %d
Fragmented space is %d byte reported as %d on page %d
Fragmented space is %d byte reported as %d on page %d
Page %d is never used
Page %d is never used
Pointer map page %d is referenced
Pointer map page %d is referenced
Outstanding page count goes from %d to %d during this analysis
Outstanding page count goes from %d to %d during this analysis
keyinfo(%d
keyinfo(%d
%s(%d)
%s(%d)
%s-mjX
%s-mjX
unable to use function %s in the requested context
unable to use function %s in the requested context
cannot open savepoint - SQL statements in progress
cannot open savepoint - SQL statements in progress
no such savepoint: %s
no such savepoint: %s
cannot %s savepoint - SQL statements in progress
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_temp_master
sqlite_temp_master
sqlite_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s
database table is locked: %s
database table is locked: %s
cannot open virtual table: %s
cannot open virtual table: %s
cannot open view: %s
cannot open view: %s
no such column: "%s"
no such column: "%s"
cannot open indexed column for writing
cannot open indexed column for writing
cannot open value of type %s
cannot open value of type %s
misuse of aliased aggregate %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s.%s
%s: %s.%s
%s: %s.%s
%s: %s
%s: %s
not authorized to use function: %s
not authorized to use function: %s
%r %s BY term out of range - should be between 1 and %d
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
variable number must be between ?1 and ?%d
too many SQL variables
too many SQL variables
too many columns in %s
too many columns in %s
misuse of aggregate: %s()
misuse of aggregate: %s()
%.*s"%w"%s
%.*s"%w"%s
sqlite_rename_table
sqlite_rename_table
sqlite_rename_trigger
sqlite_rename_trigger
%s OR name=%Q
%s OR name=%Q
there is already another table or index with this name: %s
there is already another table or index with this name: %s
sqlite_
sqlite_
table %s may not be altered
table %s may not be altered
view %s may not be altered
view %s may not be altered
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
sqlite_sequence
sqlite_sequence
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_altertab_%s
sqlite_stat1
sqlite_stat1
CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)
CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
SELECT idx, stat FROM %Q.sqlite_stat1
SELECT idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
invalid name: "%s"
too many attached databases - max %d
too many attached databases - max %d
database %s is already in use
database %s is already in use
unable to open database: %s
unable to open database: %s
no such database: %s
no such database: %s
cannot detach database %s
cannot detach database %s
database %s is locked
database %s is locked
%s %T cannot reference objects in database %s
%s %T cannot reference objects in database %s
access to %s.%s.%s is prohibited
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
object name reserved for internal use: %s
there is already an index named %s
there is already an index named %s
too many columns on %s
too many columns on %s
duplicate column name: %s
duplicate column name: %s
default value of column [%s] is not constant
default value of column [%s] is not constant
table "%s" has more than one primary key
table "%s" has more than one primary key
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
no such collation sequence: %s
no such collation sequence: %s
CREATE %s %.*s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE TABLE %Q.sqlite_sequence(name,seq)
CREATE TABLE %Q.sqlite_sequence(name,seq)
view %s is circularly defined
view %s is circularly defined
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
table %s may not be dropped
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
use DROP VIEW to delete view %s
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
foreign key on %s should reference only one column of table %T
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
unknown column "%s" in foreign key definition
indexed columns are not unique
indexed columns are not unique
table %s may not be indexed
table %s may not be indexed
views may not be indexed
views may not be indexed
virtual tables may not be indexed
virtual tables may not be indexed
there is already a table named %s
there is already a table named %s
index %s already exists
index %s already exists
sqlite_autoindex_%s_%d
sqlite_autoindex_%s_%d
table %s has no column named %s
table %s has no column named %s
CREATE%s INDEX %.*s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q
DELETE FROM %Q.%s WHERE name=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
unable to identify the object to be reindexed
unable to identify the object to be reindexed
table %s may not be modified
table %s may not be modified
cannot modify %s because it is a view
cannot modify %s because it is a view
table %S has %d columns but %d values were supplied
table %S has %d columns but %d values were supplied
%d values for %d columns
%d values for %d columns
table %S has no column named %s
table %S has no column named %s
%s.%s may not be NULL
%s.%s may not be NULL
PRIMARY KEY must be unique
PRIMARY KEY must be unique
sqlite3_extension_init
sqlite3_extension_init
unable to open shared library [%s]
unable to open shared library [%s]
no entry point [%s] in shared library [%s]
no entry point [%s] in shared library [%s]
error during initialization: %s
error during initialization: %s
automatic extension loading failed: %s
automatic extension loading failed: %s
foreign_key_list
foreign_key_list
*** in database %s ***
*** in database %s ***
unsupported encoding: %s
unsupported encoding: %s
malformed database schema (%s)
malformed database schema (%s)
%s - %s
%s - %s
unsupported file format
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s
SELECT name, rootpage, sql FROM '%q'.%s
database schema is locked: %s
database schema is locked: %s
unknown or unsupported join type: %T %T%s%T
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
cannot join using column %s - column not present in both tables
%s.%s
%s.%s
%s:%d
%s:%d
ORDER BY clause should come after %s not before
ORDER BY clause should come after %s not before
LIMIT clause should come after %s not before
LIMIT clause should come after %s not before
SELECTs to the left and right of %s do not have the same number of result columns
SELECTs to the left and right of %s do not have the same number of result columns
no such index: %s
no such index: %s
sqlite_subquery_%p_
sqlite_subquery_%p_
no such table: %s
no such table: %s
sqlite3_get_table() called with two or more incompatible queries
sqlite3_get_table() called with two or more incompatible queries
cannot create %s trigger on view: %S
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
no such trigger: %S
-- TRIGGER %s
-- TRIGGER %s
no such column: %s
no such column: %s
PRAGMA vacuum_db.synchronous=OFF
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor failed: %s
vtable constructor did not declare schema: %s
vtable constructor did not declare schema: %s
no such module: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
at most %d tables in a join
cannot use index: %s
cannot use index: %s
TABLE %s
TABLE %s
%s AS %s
%s AS %s
%s WITH INDEX %s
%s WITH INDEX %s
%s VIA MULTI-INDEX UNION
%s VIA MULTI-INDEX UNION
%s USING PRIMARY KEY
%s USING PRIMARY KEY
%s VIRTUAL TABLE INDEX %d:%s
%s VIRTUAL TABLE INDEX %d:%s
%s ORDER BY
%s ORDER BY
unable to close due to unfinished backup operation
unable to close due to unfinished backup operation
no such vfs: %s
no such vfs: %s
GetProcessWindowStation
GetProcessWindowStation
operator
operator
GetProcessHeap
GetProcessHeap
KERNEL32.dll
KERNEL32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
CRYPT32.dll
CRYPT32.dll
GetCPInfo
GetCPInfo
OLEAUT32.dll
OLEAUT32.dll
zcÃ
zcÃ
kernel32.dll
kernel32.dll
\StringFileInfo\xx\%s
\StringFileInfo\xx\%s
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msimn.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msimn.exe
outlook.exe
outlook.exe
msimn.exe
msimn.exe
%Program Files%\Microsoft Office\Office\Outlook.exe
%Program Files%\Microsoft Office\Office\Outlook.exe
Email Password Dump
Email Password Dump
hXXp://securityxploded.com/email-password-dump.php
hXXp://securityxploded.com/email-password-dump.php
EmailPasswordDump
EmailPasswordDump
//Dump all the Email passwords to console
//Dump all the Email passwords to console
//Dump all the Email passwords to a file "c:\passlist.txt"
//Dump all the Email passwords to a file "c:\passlist.txt"
\.purple\accounts.xml
\.purple\accounts.xml
%s\%s
%s\%s
@gmail.com
@gmail.com
@yahoo.com
@yahoo.com
Software\Paltalk\%s
Software\Paltalk\%s
Software\Google\Google Talk\Accounts\%s
Software\Google\Google Talk\Accounts\%s
Microsoft_WinInet_VVV.google.com:443
Microsoft_WinInet_VVV.google.com:443
%sMiranda_Mirror_%d.bin
%sMiranda_Mirror_%d.bin
LoginPassword
LoginPassword
LoginName
LoginName
LoginServer
LoginServer
gmail.com
gmail.com
%s\%s\%s.dat
%s\%s\%s.dat
pop3password=
pop3password=
esmtpaccount=
esmtpaccount=
esmtppassword=
esmtppassword=
smtphost=
smtphost=
SmtpPassword
SmtpPassword
ESMTPAccountKey
ESMTPAccountKey
c:\Program Files\Foxmail\mail
c:\Program Files\Foxmail\mail
%s\%s\Account.stg
%s\%s\Account.stg
%Program Files%\Foxmail 7.0\Data\AccCfg\Accounts.tdat
%Program Files%\Foxmail 7.0\Data\AccCfg\Accounts.tdat
PopPassword
PopPassword
SmtpAccount
SmtpAccount
SmtpServer
SmtpServer
%s\%s\Accounts
%s\%s\Accounts
%s\%s\Accounts\%s
%s\%s\Accounts\%s
Mozilla Thunderbird
Mozilla Thunderbird
Windows Live Mail
Windows Live Mail
Windows Credential Manager
Windows Credential Manager
Application:%s
Application:%s
Email ID: %s
Email ID: %s
WindowsLive:name=*
WindowsLive:name=*
Software\Microsoft\Windows Live Mail
Software\Microsoft\Windows Live Mail
hXXps://
hXXps://
00000050
00000050
.oeaccount
.oeaccount
Software\Microsoft\IdentityCRL\Creds\%s
Software\Microsoft\IdentityCRL\Creds\%s
ps:password
ps:password
Email Password Recovery Report
Email Password Recovery Report
Produced by EmailPasswordDump v%s from hXXp://VVV.SecurityXploded.com
Produced by EmailPasswordDump v%s from hXXp://VVV.SecurityXploded.com
SOFTWARE\Clients\Mail\Mozilla Thunderbird\shell\open\command
SOFTWARE\Clients\Mail\Mozilla Thunderbird\shell\open\command
kpstorec.dll
kpstorec.dll
220D5CC1-853A-11D0-84BC-00C04FD43F8F
220D5CC1-853A-11D0-84BC-00C04FD43F8F
417e2d75-84bd-11d0-84bb-00c04fd43f8f
417e2d75-84bd-11d0-84bb-00c04fd43f8f
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
IMAP Password
IMAP Password
IMAP Port
IMAP Port
POP3 Password
POP3 Password
POP3 Port
POP3 Port
SMTP User
SMTP User
SMTP Password
SMTP Password
SMTP Server
SMTP Server
SMTP Port
SMTP Port
HTTP User
HTTP User
HTTP Password
HTTP Password
HTTP Server URL
HTTP Server URL
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows Messaging Subsystem\Profiles
%s\%s\%s
%s\%s\%s
%s\%s\%s\%s
%s\%s\%s\%s
SMTP Email Address
SMTP Email Address
IMAP Password2
IMAP Password2
POP3 Password2
POP3 Password2
SMTP User Name
SMTP User Name
SMTP Password2
SMTP Password2
HTTPMail User Name
HTTPMail User Name
HTTPMail Password2
HTTPMail Password2
HTTPMail Server
HTTPMail Server
LDAP Password2
LDAP Password2
Specified master password "%s" is wrong. Please try again with correct password
Specified master password "%s" is wrong. Please try again with correct password
GetWindowsDirectoryA
GetWindowsDirectoryA
RegEnumKeyExA
RegEnumKeyExA
USERENV.dll
USERENV.dll
VERSION.dll
VERSION.dll
RPCRT4.dll
RPCRT4.dll
v2.0.50727
v2.0.50727
Stub.exe
Stub.exe
Microsoft.VisualBasic
Microsoft.VisualBasic
System.Windows.Forms
System.Windows.Forms
System.Drawing
System.Drawing
System.Management
System.Management
System.Xml
System.Xml
tapi32.dll
tapi32.dll
rtm.dll
rtm.dll
user32.dll
user32.dll
ntdll.dll
ntdll.dll
Crypt32.dll
Crypt32.dll
Stub.Form1.resources
Stub.Form1.resources
Stub.Resources.resources
Stub.Resources.resources
Stub.My
Stub.My
WindowsFormsApplicationBase
WindowsFormsApplicationBase
Microsoft.VisualBasic.ApplicationServices
Microsoft.VisualBasic.ApplicationServices
System.Collections.Generic
System.Collections.Generic
.ctor
.ctor
.cctor
.cctor
System.Diagnostics
System.Diagnostics
System.Threading
System.Threading
System.Runtime.CompilerServices
System.Runtime.CompilerServices
System.ComponentModel
System.ComponentModel
System.CodeDom.Compiler
System.CodeDom.Compiler
Microsoft.VisualBasic.Devices
Microsoft.VisualBasic.Devices
m_MyWebServicesObjectProvider
m_MyWebServicesObjectProvider
get_WebServices
get_WebServices
HelpKeywordAttribute
HelpKeywordAttribute
System.ComponentModel.Design
System.ComponentModel.Design
WebServices
WebServices
Microsoft.VisualBasic.CompilerServices
Microsoft.VisualBasic.CompilerServices
System.Collections
System.Collections
System.Reflection
System.Reflection
ContainsKey
ContainsKey
InvalidOperationException
InvalidOperationException
MyWebServices
MyWebServices
System.Runtime.InteropServices
System.Runtime.InteropServices
encryptedpassstring
encryptedpassstring
encryptedsmtpstring
encryptedsmtpstring
portstring
portstring
encryptedftphost
encryptedftphost
encryptedftpuser
encryptedftpuser
encryptedftppass
encryptedftppass
useftp
useftp
websitevisitor
websitevisitor
websiteblocker
websiteblocker
fakeMSGholder
fakeMSGholder
passstring
passstring
smtpstring
smtpstring
ftphost
ftphost
ftpuser
ftpuser
ftppass
ftppass
WM_KEYUP
WM_KEYUP
WM_KEYDOWN
WM_KEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYUP
WM_SYSKEYUP
KeyboardHandle
KeyboardHandle
KeyLog
KeyLog
CleanedPasswordsMAIL
CleanedPasswordsMAIL
CleanedPasswordsWB
CleanedPasswordsWB
System.IO
System.IO
get_ExecutablePath
get_ExecutablePath
WindowsIdentity
WindowsIdentity
System.Security.Principal
System.Security.Principal
set_WindowState
set_WindowState
FormWindowState
FormWindowState
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookEx
SetWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
GetAsyncKeyState
GetAsyncKeyState
vKey
vKey
HookKeyboard
HookKeyboard
UnhookKeyboard
UnhookKeyboard
Operators
Operators
get_Keyboard
get_Keyboard
Keyboard
Keyboard
get_CtrlKeyDown
get_CtrlKeyDown
get_AltKeyDown
get_AltKeyDown
KeyboardCallback
KeyboardCallback
set_UseShellExecute
set_UseShellExecute
Microsoft.VisualBasic.MyServices
Microsoft.VisualBasic.MyServices
System.Collections.ObjectModel
System.Collections.ObjectModel
MsgBox
MsgBox
MsgBoxResult
MsgBoxResult
MsgBoxStyle
MsgBoxStyle
ForceSteamLogin
ForceSteamLogin
System.Net.NetworkInformation
System.Net.NetworkInformation
get_OperationalStatus
get_OperationalStatus
OperationalStatus
OperationalStatus
FakemsgInstall
FakemsgInstall
System.Net.Mail
System.Net.Mail
SmtpClient
SmtpClient
System.Globalization
System.Globalization
set_Port
set_Port
System.Net
System.Net
Microsoft.Win32
Microsoft.Win32
RegistryKey
RegistryKey
OpenSubKey
OpenSubKey
System.Security.Cryptography
System.Security.Cryptography
System.Text
System.Text
set_Key
set_Key
StealPasswords
StealPasswords
stealWebroswers
stealWebroswers
WebClient
WebClient
readweb
readweb
System.IO.Compression
System.IO.Compression
SendLogsFTP
SendLogsFTP
FtpWebRequest
FtpWebRequest
WebRequest
WebRequest
UploadFTP
UploadFTP
secretKey
secretKey
set_KeySize
set_KeySize
get_KeySize
get_KeySize
System.Net.Sockets
System.Net.Sockets
virtualKey
virtualKey
KeyboardHookDelegate
KeyboardHookDelegate
get_Msg
get_Msg
System.Security
System.Security
ProcessHandle
ProcessHandle
Stub.My.Resources
Stub.My.Resources
System.Resources
System.Resources
get_WebBrowserPassView
get_WebBrowserPassView
WebBrowserPassView
WebBrowserPassView
System.Configuration
System.Configuration
GoogleChrome
GoogleChrome
MozillaFirefox
MozillaFirefox
loadCerts
loadCerts
FTPCommander
FTPCommander
System.Text.RegularExpressions
System.Text.RegularExpressions
WindowsKey
WindowsKey
SQLite
SQLite
SQLDataTypeSize
SQLDataTypeSize
sqlite_master_entry
sqlite_master_entry
sql_statement
sql_statement
Passwords
Passwords
PasswordSource
PasswordSource
FtpCommander
FtpCommander
8.0.0.0
8.0.0.0
My.Computer
My.Computer
My.Application
My.Application
My.User
My.User
My.Forms
My.Forms
My.WebServices
My.WebServices
System.Windows.Forms.Form
System.Windows.Forms.Form
My.MyProject.Forms
My.MyProject.Forms
4System.Web.Services.Protocols.SoapHttpClientProtocol
4System.Web.Services.Protocols.SoapHttpClientProtocol
3System.Resources.Tools.StronglyTypedResourceBuilder
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
12.0.0.0
12.0.0.0
My.Settings
My.Settings
$3e46a124-e015-4b12-9390-f16ac4d7ad53
$3e46a124-e015-4b12-9390-f16ac4d7ad53
1.0.0.0
1.0.0.0
_CorExeMain
_CorExeMain
mscoree.dll
mscoree.dll
{3C374A40-BAE4-11CF-BF7D-00AA006946EE}
{3C374A40-BAE4-11CF-BF7D-00AA006946EE}
{AFA0DC11-C313-11D0-831A-00C04FD5AE38}
{AFA0DC11-C313-11D0-831A-00C04FD5AE38}
hXXp://
hXXp://
Hmscoree.dll
Hmscoree.dll
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- floating point support not loaded
- floating point support not loaded
Fkernel32.dll
Fkernel32.dll
USER32.DLL
USER32.DLL
hXXp://VVV.facebook.com/
hXXp://VVV.facebook.com/
hXXps://VVV.facebook.com/
hXXps://VVV.facebook.com/
hXXp://twitter.com/
hXXp://twitter.com/
hXXps://twitter.com/
hXXps://twitter.com/
hXXps://login.yahoo.com/config/login
hXXps://login.yahoo.com/config/login
hXXps://pinterest.com/login/
hXXps://pinterest.com/login/
hXXp://VVV.linkedin.com/
hXXp://VVV.linkedin.com/
hXXps://my.screenname.aol.com/_cqr/login/login.psp
hXXps://my.screenname.aol.com/_cqr/login/login.psp
hXXps://VVV.amazon.com/ap/signin/190-9059340-4656153
hXXps://VVV.amazon.com/ap/signin/190-9059340-4656153
hXXps://signin.ebay.com/ws/ebayisapi.dll
hXXps://signin.ebay.com/ws/ebayisapi.dll
hXXps://accounts.google.com/servicelogin
hXXps://accounts.google.com/servicelogin
hXXps://VVV.google.com/accounts/servicelogin
hXXps://VVV.google.com/accounts/servicelogin
hXXp://digg.com
hXXp://digg.com
hXXp://VVV.myspace.com
hXXp://VVV.myspace.com
hXXps://myspace.com
hXXps://myspace.com
hXXps://VVV.amazon.com/gp/css/homepage.html
hXXps://VVV.amazon.com/gp/css/homepage.html
hXXp://VVV.stumbleupon.com/sign_up.php
hXXp://VVV.stumbleupon.com/sign_up.php
hXXp://slashdot.org/bookmark.pl
hXXp://slashdot.org/bookmark.pl
hXXp://VVV.reddit.com/login
hXXp://VVV.reddit.com/login
noftp
noftp
MessageBoxIcon.Information
MessageBoxIcon.Information
Disablecmd
Disablecmd
\Windows Update.exe
\Windows Update.exe
\WindowsUpdate.exe
\WindowsUpdate.exe
SysInfo.txt
SysInfo.txt
\pid.txt
\pid.txt
\pidloc.txt
\pidloc.txt
HawkEyeKeylogger
HawkEyeKeylogger
\Mozilla\Firefox\Profiles
\Mozilla\Firefox\Profiles
127.0.0.1
127.0.0.1
\SteamAppData.vdf
\SteamAppData.vdf
\ClientRegistry.blob
\ClientRegistry.blob
MessageBoxIcon.Error
MessageBoxIcon.Error
MessageBoxIcon.Exclamation
MessageBoxIcon.Exclamation
MessageBoxIcon.Question
MessageBoxIcon.Question
Dear HawkEye Customers!
Dear HawkEye Customers!
HawkEye Admin
HawkEye Admin
HawkEye Logger Details
HawkEye Logger Details
Keylogger Enabled:
Keylogger Enabled:
Operating System:
Operating System:
HawkEye_Keylogger_Execution_Confirmed_
HawkEye_Keylogger_Execution_Confirmed_
HawkEye Keylogger | Execution Confirmed |
HawkEye Keylogger | Execution Confirmed |
Dear HawkEye Customer!
This is a notification generated by
Dear HawkEye Customer!
This is a notification generated by
after successful injection of your server.
Best Regards
HawkEye Admin
************************************************************
HawkEye Keylogger's Detail
************************************************************
Server Name:
after successful injection of your server.
Best Regards
HawkEye Admin
************************************************************
HawkEye Keylogger's Detail
************************************************************
Server Name:
Keylogger Enabled:
Keylogger Enabled:
Operating System:
Operating System:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
autorun.inf
autorun.inf
open=Sys.exe
open=Sys.exe
Sys.exe
Sys.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Windows Update
Windows Update
\bitcoin\wallet.dat
\bitcoin\wallet.dat
_wallet.dat
_wallet.dat
wallet.dat
wallet.dat
Microsoft.NET\Framework\v2.0.50727\vbc.exe
Microsoft.NET\Framework\v2.0.50727\vbc.exe
holdermail.txt"
holdermail.txt"
holdermail.txt
holdermail.txt
Source:{4}{4}{0}{5}Host:{4}{4}{1}{5}Username:{4}{2}{5}Password:{4}{3}{5}{5}
Source:{4}{4}{0}{5}Host:{4}{4}{1}{5}Username:{4}{2}{5}Password:{4}{3}{5}{5}
Operating System Intel Recovery
Operating System Intel Recovery
Operating System Platform:
Operating System Platform:
Operating System Version:
Operating System Version:
HawkEye_Keylogger_Recoveries_
HawkEye_Keylogger_Recoveries_
HawkEye Keylogger | Recoveries |
HawkEye Keylogger | Recoveries |
****************************************************
Operating System Intel Recovery
****************************************************
PC Name:
****************************************************
Operating System Intel Recovery
****************************************************
PC Name:
Operating System Platform:
Operating System Platform:
Operating System Version:
Operating System Version:
C:\Users\
C:\Users\
_Pin0.jpeg
_Pin0.jpeg
_Pin1.jpeg
_Pin1.jpeg
_Pin2.jpeg
_Pin2.jpeg
_Pin3.jpeg
_Pin3.jpeg
_Pin4.jpeg
_Pin4.jpeg
HawkEye Keylogger | RuneScape Recoveries |
HawkEye Keylogger | RuneScape Recoveries |
Dear HawkEye Customer!
Dear HawkEye Customer!
HawkEye Keylogger | BitCoin Recoveries |
HawkEye Keylogger | BitCoin Recoveries |
As you can see, this email has attached file(s) containing the wallet.dat file which holds the users Bitcoin Currency.
As you can see, this email has attached file(s) containing the wallet.dat file which holds the users Bitcoin Currency.
\.minecraft\lastlogin
\.minecraft\lastlogin
HawkEye Keylogger | MineCraft Recoveries |
HawkEye Keylogger | MineCraft Recoveries |
As you can see, this email has the attached file(s) containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.
As you can see, this email has the attached file(s) containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.
HawkEye Keylogger | Keyboard
HawkEye Keylogger | Keyboard
Keyboard Records
Keyboard Records
.jpeg
.jpeg
HawkEye_Keylogger_Keylog_Records_
HawkEye_Keylogger_Keylog_Records_
PTF://
PTF://
HawkEye Keylogger | Keyboard Clipboards Records |
HawkEye Keylogger | Keyboard Clipboards Records |
**************************************
Keyboard Records
**************************************
**************************************
Keyboard Records
**************************************
hXXp://192.99.212.64/WebPanel/log.php?username=
hXXp://192.99.212.64/WebPanel/log.php?username=
hXXp://whatismyipaddress.com/
hXXp://whatismyipaddress.com/
Stub.Resources
Stub.Resources
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
\Google\Chrome\User Data\Default\Login Data
\Google\Chrome\User Data\Default\Login Data
logins
logins
origin_url
origin_url
password_value
password_value
moz_logins
moz_logins
formSubmitURL
formSubmitURL
encryptedPassword
encryptedPassword
\Mozilla Firefox\
\Mozilla Firefox\
mozglue.dll
mozglue.dll
\sitemanager.xml
\sitemanager.xml
\recentservers.xml
\recentservers.xml
;Server=(?.*?);Port=(?.*?);Password=(?.*?);User=(?.*?);
;Server=(?.*?);Port=(?.*?);Password=(?.*?);User=(?.*?);
port
port
password
password
C:\cftp\Ftplist.txt
C:\cftp\Ftplist.txt
\cftp\Ftplist.txt
\cftp\Ftplist.txt
\FTP Commander Deluxe\Ftplist.txt
\FTP Commander Deluxe\Ftplist.txt
password = (?.*?)
password = (?.*?)
hXXp://dyn.com/dns/
hXXp://dyn.com/dns/
\Dyn\Updater\daemon.cfg
\Dyn\Updater\daemon.cfg
\Dyn\Updater\config.dyndns
\Dyn\Updater\config.dyndns
hXXps://VVV.noip.com/
hXXps://VVV.noip.com/
CKey
CKey
SOFTWARE\Microsoft\Windows NT\CurrentVersion
SOFTWARE\Microsoft\Windows NT\CurrentVersion
RegSvcs.exe_528_rwx_675A6000_00003000:
.Qg
.Qg
*Rg`.Rg|)RgL Rg
*Rg`.Rg|)RgL Rg