Gen.Variant.Kazy.527197_76a0c9f468

Gen:Variant.Kazy.527197 (BitDefender), Trojan.Win32.Generic!BT (VIPRE), Trojan.PWS.Siggen1.29701 (DrWeb), Gen:Variant.Kazy.527197 (B) (Emsisoft), Artemis!76A0C9F4683B (McAfee), Infostealer.Limitail (Symantec), Trojan.MSIL.Injector (Ikarus), Gen:Variant.Kazy.527197 (FSecure), MSIL6.BMVR (AVG), MSIL:GenMalicious-CMO [Trj] (Avast), TSPY_GOLROTED.ADD (TrendMicro), Gen:Variant.Kazy.527197 (AdAware), GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: Trojan, Worm, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

d-d-d d:d:d

d-d-d d:d:d

d:d:d

d:d:d

d-d-d

d-d-d

922337203685477580

922337203685477580

%s\etilqs_

%s\etilqs_

OsError 0x%x (%u)

OsError 0x%x (%u)

invalid page number %d

invalid page number %d

2nd reference to page %d

2nd reference to page %d

Failed to read ptrmap key=%d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

%d of %d pages missing from overflow list starting at %d

failed to get page %d

failed to get page %d

freelist leaf count too big on page %d

freelist leaf count too big on page %d

Page %d:

Page %d:

unable to get the page. error code=%d

unable to get the page. error code=%d

sqlite3BtreeInitPage() returns error code %d

sqlite3BtreeInitPage() returns error code %d

On tree page %d cell %d:

On tree page %d cell %d:

On page %d at right child:

On page %d at right child:

Corruption detected in header on page %d

Corruption detected in header on page %d

Corruption detected in cell %d on page %d

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Multiple uses for byte %d of page %d

Fragmented space is %d byte reported as %d on page %d

Fragmented space is %d byte reported as %d on page %d

Page %d is never used

Page %d is never used

Pointer map page %d is referenced

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

Outstanding page count goes from %d to %d during this analysis

keyinfo(%d

keyinfo(%d

%s(%d)

%s(%d)

%s-mjX

%s-mjX

unable to use function %s in the requested context

unable to use function %s in the requested context

cannot open savepoint - SQL statements in progress

cannot open savepoint - SQL statements in progress

no such savepoint: %s

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_temp_master

sqlite_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s

database table is locked: %s

database table is locked: %s

cannot open virtual table: %s

cannot open virtual table: %s

cannot open view: %s

cannot open view: %s

no such column: "%s"

no such column: "%s"

cannot open indexed column for writing

cannot open indexed column for writing

cannot open value of type %s

cannot open value of type %s

misuse of aliased aggregate %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s.%s

%s: %s.%s

%s: %s.%s

%s: %s

%s: %s

not authorized to use function: %s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

variable number must be between ?1 and ?%d

too many SQL variables

too many SQL variables

too many columns in %s

too many columns in %s

misuse of aggregate: %s()

misuse of aggregate: %s()

%.*s"%w"%s

%.*s"%w"%s

sqlite_rename_table

sqlite_rename_table

sqlite_rename_trigger

sqlite_rename_trigger

%s OR name=%Q

%s OR name=%Q

there is already another table or index with this name: %s

there is already another table or index with this name: %s

sqlite_

sqlite_

table %s may not be altered

table %s may not be altered

view %s may not be altered

view %s may not be altered

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

sqlite_altertab_%s

sqlite_stat1

sqlite_stat1

CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)

CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

SELECT idx, stat FROM %Q.sqlite_stat1

SELECT idx, stat FROM %Q.sqlite_stat1

invalid name: "%s"

invalid name: "%s"

too many attached databases - max %d

too many attached databases - max %d

database %s is already in use

database %s is already in use

unable to open database: %s

unable to open database: %s

no such database: %s

no such database: %s

cannot detach database %s

cannot detach database %s

database %s is locked

database %s is locked

%s %T cannot reference objects in database %s

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

object name reserved for internal use: %s

there is already an index named %s

there is already an index named %s

too many columns on %s

too many columns on %s

duplicate column name: %s

duplicate column name: %s

default value of column [%s] is not constant

default value of column [%s] is not constant

table "%s" has more than one primary key

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

no such collation sequence: %s

no such collation sequence: %s

CREATE %s %.*s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

table %s may not be dropped

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

use DROP VIEW to delete view %s

DELETE FROM %s.sqlite_sequence WHERE name=%Q

DELETE FROM %s.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

foreign key on %s should reference only one column of table %T

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

unknown column "%s" in foreign key definition

indexed columns are not unique

indexed columns are not unique

table %s may not be indexed

table %s may not be indexed

views may not be indexed

views may not be indexed

virtual tables may not be indexed

virtual tables may not be indexed

there is already a table named %s

there is already a table named %s

index %s already exists

index %s already exists

sqlite_autoindex_%s_%d

sqlite_autoindex_%s_%d

table %s has no column named %s

table %s has no column named %s

CREATE%s INDEX %.*s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q

DELETE FROM %Q.%s WHERE name=%Q

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

unable to identify the object to be reindexed

unable to identify the object to be reindexed

table %s may not be modified

table %s may not be modified

cannot modify %s because it is a view

cannot modify %s because it is a view

table %S has %d columns but %d values were supplied

table %S has %d columns but %d values were supplied

%d values for %d columns

%d values for %d columns

table %S has no column named %s

table %S has no column named %s

%s.%s may not be NULL

%s.%s may not be NULL

PRIMARY KEY must be unique

PRIMARY KEY must be unique

sqlite3_extension_init

sqlite3_extension_init

unable to open shared library [%s]

unable to open shared library [%s]

no entry point [%s] in shared library [%s]

no entry point [%s] in shared library [%s]

error during initialization: %s

error during initialization: %s

automatic extension loading failed: %s

automatic extension loading failed: %s

foreign_key_list

foreign_key_list

*** in database %s ***

*** in database %s ***

unsupported encoding: %s

unsupported encoding: %s

malformed database schema (%s)

malformed database schema (%s)

%s - %s

%s - %s

unsupported file format

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s

SELECT name, rootpage, sql FROM '%q'.%s

database schema is locked: %s

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

cannot join using column %s - column not present in both tables

%s.%s

%s.%s

%s:%d

%s:%d

ORDER BY clause should come after %s not before

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

no such index: %s

sqlite_subquery_%p_

sqlite_subquery_%p_

no such table: %s

no such table: %s

sqlite3_get_table() called with two or more incompatible queries

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

no such trigger: %S

-- TRIGGER %s

-- TRIGGER %s

no such column: %s

no such column: %s

PRAGMA vacuum_db.synchronous=OFF

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor failed: %s

vtable constructor did not declare schema: %s

vtable constructor did not declare schema: %s

no such module: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

table %s: xBestIndex returned an invalid plan

at most %d tables in a join

at most %d tables in a join

cannot use index: %s

cannot use index: %s

TABLE %s

TABLE %s

%s AS %s

%s AS %s

%s WITH INDEX %s

%s WITH INDEX %s

%s VIA MULTI-INDEX UNION

%s VIA MULTI-INDEX UNION

%s USING PRIMARY KEY

%s USING PRIMARY KEY

%s VIRTUAL TABLE INDEX %d:%s

%s VIRTUAL TABLE INDEX %d:%s

%s ORDER BY

%s ORDER BY

unable to close due to unfinished backup operation

unable to close due to unfinished backup operation

no such vfs: %s

no such vfs: %s

GetProcessWindowStation

GetProcessWindowStation

operator

operator

GetProcessHeap

GetProcessHeap

KERNEL32.dll

KERNEL32.dll

RegCloseKey

RegCloseKey

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

SHELL32.dll

SHELL32.dll

ole32.dll

ole32.dll

CRYPT32.dll

CRYPT32.dll

GetCPInfo

GetCPInfo

OLEAUT32.dll

OLEAUT32.dll

zcÁ

zcÁ

kernel32.dll

kernel32.dll

\StringFileInfo\xx\%s

\StringFileInfo\xx\%s

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msimn.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msimn.exe

outlook.exe

outlook.exe

msimn.exe

msimn.exe

%Program Files%\Microsoft Office\Office\Outlook.exe

%Program Files%\Microsoft Office\Office\Outlook.exe

Email Password Dump

Email Password Dump

hXXp://securityxploded.com/email-password-dump.php

hXXp://securityxploded.com/email-password-dump.php

EmailPasswordDump

EmailPasswordDump

//Dump all the Email passwords to console

//Dump all the Email passwords to console

//Dump all the Email passwords to a file "c:\passlist.txt"

//Dump all the Email passwords to a file "c:\passlist.txt"

\.purple\accounts.xml

\.purple\accounts.xml

%s\%s

%s\%s

@gmail.com

@gmail.com

@yahoo.com

@yahoo.com

Software\Paltalk\%s

Software\Paltalk\%s

Software\Google\Google Talk\Accounts\%s

Software\Google\Google Talk\Accounts\%s

Microsoft_WinInet_VVV.google.com:443

Microsoft_WinInet_VVV.google.com:443

%sMiranda_Mirror_%d.bin

%sMiranda_Mirror_%d.bin

LoginPassword

LoginPassword

LoginName

LoginName

LoginServer

LoginServer

gmail.com

gmail.com

%s\%s\%s.dat

%s\%s\%s.dat

pop3password=

pop3password=

esmtpaccount=

esmtpaccount=

esmtppassword=

esmtppassword=

smtphost=

smtphost=

SmtpPassword

SmtpPassword

ESMTPAccountKey

ESMTPAccountKey

c:\Program Files\Foxmail\mail

c:\Program Files\Foxmail\mail

%s\%s\Account.stg

%s\%s\Account.stg

%Program Files%\Foxmail 7.0\Data\AccCfg\Accounts.tdat

%Program Files%\Foxmail 7.0\Data\AccCfg\Accounts.tdat

PopPassword

PopPassword

SmtpAccount

SmtpAccount

SmtpServer

SmtpServer

%s\%s\Accounts

%s\%s\Accounts

%s\%s\Accounts\%s

%s\%s\Accounts\%s

Mozilla Thunderbird

Mozilla Thunderbird

Windows Live Mail

Windows Live Mail

Windows Credential Manager

Windows Credential Manager

Application:%s

Application:%s

Email ID: %s

Email ID: %s

WindowsLive:name=*

WindowsLive:name=*

Software\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

hXXps://

hXXps://

00000050

00000050

.oeaccount

.oeaccount

Software\Microsoft\IdentityCRL\Creds\%s

Software\Microsoft\IdentityCRL\Creds\%s

ps:password

ps:password

Email Password Recovery Report

Email Password Recovery Report

Produced by EmailPasswordDump v%s from hXXp://VVV.SecurityXploded.com

Produced by EmailPasswordDump v%s from hXXp://VVV.SecurityXploded.com

SOFTWARE\Clients\Mail\Mozilla Thunderbird\shell\open\command

SOFTWARE\Clients\Mail\Mozilla Thunderbird\shell\open\command

kpstorec.dll

kpstorec.dll

220D5CC1-853A-11D0-84BC-00C04FD43F8F

220D5CC1-853A-11D0-84BC-00C04FD43F8F

417e2d75-84bd-11d0-84bb-00c04fd43f8f

417e2d75-84bd-11d0-84bb-00c04fd43f8f

220D5CD0-853A-11D0-84BC-00C04FD43F8F

220D5CD0-853A-11D0-84BC-00C04FD43F8F

220D5CD1-853A-11D0-84BC-00C04FD43F8F

220D5CD1-853A-11D0-84BC-00C04FD43F8F

IMAP Password

IMAP Password

IMAP Port

IMAP Port

POP3 Password

POP3 Password

POP3 Port

POP3 Port

SMTP User

SMTP User

SMTP Password

SMTP Password

SMTP Server

SMTP Server

SMTP Port

SMTP Port

HTTP User

HTTP User

HTTP Password

HTTP Password

HTTP Server URL

HTTP Server URL

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows Messaging Subsystem\Profiles

%s\%s\%s

%s\%s\%s

%s\%s\%s\%s

%s\%s\%s\%s

SMTP Email Address

SMTP Email Address

IMAP Password2

IMAP Password2

POP3 Password2

POP3 Password2

SMTP User Name

SMTP User Name

SMTP Password2

SMTP Password2

HTTPMail User Name

HTTPMail User Name

HTTPMail Password2

HTTPMail Password2

HTTPMail Server

HTTPMail Server

LDAP Password2

LDAP Password2

Specified master password "%s" is wrong. Please try again with correct password

Specified master password "%s" is wrong. Please try again with correct password

GetWindowsDirectoryA

GetWindowsDirectoryA

RegEnumKeyExA

RegEnumKeyExA

USERENV.dll

USERENV.dll

VERSION.dll

VERSION.dll

RPCRT4.dll

RPCRT4.dll

v2.0.50727

v2.0.50727

Stub.exe

Stub.exe

Microsoft.VisualBasic

Microsoft.VisualBasic

System.Windows.Forms

System.Windows.Forms

System.Drawing

System.Drawing

System.Management

System.Management

System.Xml

System.Xml

tapi32.dll

tapi32.dll

rtm.dll

rtm.dll

user32.dll

user32.dll

ntdll.dll

ntdll.dll

Crypt32.dll

Crypt32.dll

Stub.Form1.resources

Stub.Form1.resources

Stub.Resources.resources

Stub.Resources.resources

Stub.My

Stub.My

WindowsFormsApplicationBase

WindowsFormsApplicationBase

Microsoft.VisualBasic.ApplicationServices

Microsoft.VisualBasic.ApplicationServices

System.Collections.Generic

System.Collections.Generic

.ctor

.ctor

.cctor

.cctor

System.Diagnostics

System.Diagnostics

System.Threading

System.Threading

System.Runtime.CompilerServices

System.Runtime.CompilerServices

System.ComponentModel

System.ComponentModel

System.CodeDom.Compiler

System.CodeDom.Compiler

Microsoft.VisualBasic.Devices

Microsoft.VisualBasic.Devices

m_MyWebServicesObjectProvider

m_MyWebServicesObjectProvider

get_WebServices

get_WebServices

HelpKeywordAttribute

HelpKeywordAttribute

System.ComponentModel.Design

System.ComponentModel.Design

WebServices

WebServices

Microsoft.VisualBasic.CompilerServices

Microsoft.VisualBasic.CompilerServices

System.Collections

System.Collections

System.Reflection

System.Reflection

ContainsKey

ContainsKey

InvalidOperationException

InvalidOperationException

MyWebServices

MyWebServices

System.Runtime.InteropServices

System.Runtime.InteropServices

encryptedpassstring

encryptedpassstring

encryptedsmtpstring

encryptedsmtpstring

portstring

portstring

encryptedftphost

encryptedftphost

encryptedftpuser

encryptedftpuser

encryptedftppass

encryptedftppass

useftp

useftp

websitevisitor

websitevisitor

websiteblocker

websiteblocker

fakeMSGholder

fakeMSGholder

passstring

passstring

smtpstring

smtpstring

ftphost

ftphost

ftpuser

ftpuser

ftppass

ftppass

WM_KEYUP

WM_KEYUP

WM_KEYDOWN

WM_KEYDOWN

WM_SYSKEYDOWN

WM_SYSKEYDOWN

WM_SYSKEYUP

WM_SYSKEYUP

KeyboardHandle

KeyboardHandle

KeyLog

KeyLog

CleanedPasswordsMAIL

CleanedPasswordsMAIL

CleanedPasswordsWB

CleanedPasswordsWB

System.IO

System.IO

get_ExecutablePath

get_ExecutablePath

WindowsIdentity

WindowsIdentity

System.Security.Principal

System.Security.Principal

set_WindowState

set_WindowState

FormWindowState

FormWindowState

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookEx

SetWindowsHookEx

SetWindowsHookExA

SetWindowsHookExA

GetAsyncKeyState

GetAsyncKeyState

vKey

vKey

HookKeyboard

HookKeyboard

UnhookKeyboard

UnhookKeyboard

Operators

Operators

get_Keyboard

get_Keyboard

Keyboard

Keyboard

get_CtrlKeyDown

get_CtrlKeyDown

get_AltKeyDown

get_AltKeyDown

KeyboardCallback

KeyboardCallback

set_UseShellExecute

set_UseShellExecute

Microsoft.VisualBasic.MyServices

Microsoft.VisualBasic.MyServices

System.Collections.ObjectModel

System.Collections.ObjectModel

MsgBox

MsgBox

MsgBoxResult

MsgBoxResult

MsgBoxStyle

MsgBoxStyle

ForceSteamLogin

ForceSteamLogin

System.Net.NetworkInformation

System.Net.NetworkInformation

get_OperationalStatus

get_OperationalStatus

OperationalStatus

OperationalStatus

FakemsgInstall

FakemsgInstall

System.Net.Mail

System.Net.Mail

SmtpClient

SmtpClient

System.Globalization

System.Globalization

set_Port

set_Port

System.Net

System.Net

Microsoft.Win32

Microsoft.Win32

RegistryKey

RegistryKey

OpenSubKey

OpenSubKey

System.Security.Cryptography

System.Security.Cryptography

System.Text

System.Text

set_Key

set_Key

StealPasswords

StealPasswords

stealWebroswers

stealWebroswers

WebClient

WebClient

readweb

readweb

System.IO.Compression

System.IO.Compression

SendLogsFTP

SendLogsFTP

FtpWebRequest

FtpWebRequest

WebRequest

WebRequest

UploadFTP

UploadFTP

secretKey

secretKey

set_KeySize

set_KeySize

get_KeySize

get_KeySize

System.Net.Sockets

System.Net.Sockets

virtualKey

virtualKey

KeyboardHookDelegate

KeyboardHookDelegate

get_Msg

get_Msg

System.Security

System.Security

ProcessHandle

ProcessHandle

Stub.My.Resources

Stub.My.Resources

System.Resources

System.Resources

get_WebBrowserPassView

get_WebBrowserPassView

WebBrowserPassView

WebBrowserPassView

System.Configuration

System.Configuration

GoogleChrome

GoogleChrome

MozillaFirefox

MozillaFirefox

loadCerts

loadCerts

FTPCommander

FTPCommander

System.Text.RegularExpressions

System.Text.RegularExpressions

WindowsKey

WindowsKey

SQLite

SQLite

SQLDataTypeSize

SQLDataTypeSize

sqlite_master_entry

sqlite_master_entry

sql_statement

sql_statement

Passwords

Passwords

PasswordSource

PasswordSource

FtpCommander

FtpCommander

8.0.0.0

8.0.0.0

My.Computer

My.Computer

My.Application

My.Application

My.User

My.User

My.Forms

My.Forms

My.WebServices

My.WebServices

System.Windows.Forms.Form

System.Windows.Forms.Form

My.MyProject.Forms

My.MyProject.Forms

4System.Web.Services.Protocols.SoapHttpClientProtocol

4System.Web.Services.Protocols.SoapHttpClientProtocol

3System.Resources.Tools.StronglyTypedResourceBuilder

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

4.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

12.0.0.0

12.0.0.0

My.Settings

My.Settings

$3e46a124-e015-4b12-9390-f16ac4d7ad53

$3e46a124-e015-4b12-9390-f16ac4d7ad53

1.0.0.0

1.0.0.0

_CorExeMain

_CorExeMain

mscoree.dll

mscoree.dll

{3C374A40-BAE4-11CF-BF7D-00AA006946EE}

{3C374A40-BAE4-11CF-BF7D-00AA006946EE}

{AFA0DC11-C313-11D0-831A-00C04FD5AE38}

{AFA0DC11-C313-11D0-831A-00C04FD5AE38}

hXXp://

hXXp://

Hmscoree.dll

Hmscoree.dll

- CRT not initialized

- CRT not initialized

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- floating point support not loaded

- floating point support not loaded

Fkernel32.dll

Fkernel32.dll

USER32.DLL

USER32.DLL

hXXp://VVV.facebook.com/

hXXp://VVV.facebook.com/

hXXps://VVV.facebook.com/

hXXps://VVV.facebook.com/

hXXp://twitter.com/

hXXp://twitter.com/

hXXps://twitter.com/

hXXps://twitter.com/

hXXps://login.yahoo.com/config/login

hXXps://login.yahoo.com/config/login

hXXps://pinterest.com/login/

hXXps://pinterest.com/login/

hXXp://VVV.linkedin.com/

hXXp://VVV.linkedin.com/

hXXps://my.screenname.aol.com/_cqr/login/login.psp

hXXps://my.screenname.aol.com/_cqr/login/login.psp

hXXps://VVV.amazon.com/ap/signin/190-9059340-4656153

hXXps://VVV.amazon.com/ap/signin/190-9059340-4656153

hXXps://signin.ebay.com/ws/ebayisapi.dll

hXXps://signin.ebay.com/ws/ebayisapi.dll

hXXps://accounts.google.com/servicelogin

hXXps://accounts.google.com/servicelogin

hXXps://VVV.google.com/accounts/servicelogin

hXXps://VVV.google.com/accounts/servicelogin

hXXp://digg.com

hXXp://digg.com

hXXp://VVV.myspace.com

hXXp://VVV.myspace.com

hXXps://myspace.com

hXXps://myspace.com

hXXps://VVV.amazon.com/gp/css/homepage.html

hXXps://VVV.amazon.com/gp/css/homepage.html

hXXp://VVV.stumbleupon.com/sign_up.php

hXXp://VVV.stumbleupon.com/sign_up.php

hXXp://slashdot.org/bookmark.pl

hXXp://slashdot.org/bookmark.pl

hXXp://VVV.reddit.com/login

hXXp://VVV.reddit.com/login

noftp

noftp

MessageBoxIcon.Information

MessageBoxIcon.Information

Disablecmd

Disablecmd

\Windows Update.exe

\Windows Update.exe

\WindowsUpdate.exe

\WindowsUpdate.exe

SysInfo.txt

SysInfo.txt

\pid.txt

\pid.txt

\pidloc.txt

\pidloc.txt

HawkEyeKeylogger

HawkEyeKeylogger

\Mozilla\Firefox\Profiles

\Mozilla\Firefox\Profiles

127.0.0.1

127.0.0.1

\SteamAppData.vdf

\SteamAppData.vdf

\ClientRegistry.blob

\ClientRegistry.blob

MessageBoxIcon.Error

MessageBoxIcon.Error

MessageBoxIcon.Exclamation

MessageBoxIcon.Exclamation

MessageBoxIcon.Question

MessageBoxIcon.Question

Dear HawkEye Customers!

Dear HawkEye Customers!

HawkEye Admin

HawkEye Admin

HawkEye Logger Details

HawkEye Logger Details

Keylogger Enabled:

Keylogger Enabled:

Operating System:

Operating System:

HawkEye_Keylogger_Execution_Confirmed_

HawkEye_Keylogger_Execution_Confirmed_

HawkEye Keylogger | Execution Confirmed |

HawkEye Keylogger | Execution Confirmed |

Dear HawkEye Customer!

This is a notification generated by

Dear HawkEye Customer!

This is a notification generated by

after successful injection of your server.

Best Regards
HawkEye Admin


************************************************************
HawkEye Keylogger's Detail
************************************************************
Server Name:

after successful injection of your server.

Best Regards
HawkEye Admin


************************************************************
HawkEye Keylogger's Detail
************************************************************
Server Name:

Keylogger Enabled:

Keylogger Enabled:

Operating System:

Operating System:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

autorun.inf

autorun.inf

open=Sys.exe

open=Sys.exe

Sys.exe

Sys.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows Update

Windows Update

\bitcoin\wallet.dat

\bitcoin\wallet.dat

_wallet.dat

_wallet.dat

wallet.dat

wallet.dat

Microsoft.NET\Framework\v2.0.50727\vbc.exe

Microsoft.NET\Framework\v2.0.50727\vbc.exe

holdermail.txt"

holdermail.txt"

holdermail.txt

holdermail.txt

Source:{4}{4}{0}{5}Host:{4}{4}{1}{5}Username:{4}{2}{5}Password:{4}{3}{5}{5}

Source:{4}{4}{0}{5}Host:{4}{4}{1}{5}Username:{4}{2}{5}Password:{4}{3}{5}{5}

Operating System Intel Recovery

Operating System Intel Recovery

Operating System Platform:

Operating System Platform:

Operating System Version:

Operating System Version:

HawkEye_Keylogger_Recoveries_

HawkEye_Keylogger_Recoveries_

HawkEye Keylogger | Recoveries |

HawkEye Keylogger | Recoveries |

****************************************************
Operating System Intel Recovery
****************************************************
PC Name:

****************************************************
Operating System Intel Recovery
****************************************************
PC Name:

Operating System Platform:

Operating System Platform:

Operating System Version:

Operating System Version:

C:\Users\

C:\Users\

_Pin0.jpeg

_Pin0.jpeg

_Pin1.jpeg

_Pin1.jpeg

_Pin2.jpeg

_Pin2.jpeg

_Pin3.jpeg

_Pin3.jpeg

_Pin4.jpeg

_Pin4.jpeg

HawkEye Keylogger | RuneScape Recoveries |

HawkEye Keylogger | RuneScape Recoveries |

Dear HawkEye Customer!

Dear HawkEye Customer!

HawkEye Keylogger | BitCoin Recoveries |

HawkEye Keylogger | BitCoin Recoveries |

As you can see, this email has attached file(s) containing the wallet.dat file which holds the users Bitcoin Currency.

As you can see, this email has attached file(s) containing the wallet.dat file which holds the users Bitcoin Currency.

\.minecraft\lastlogin

\.minecraft\lastlogin

HawkEye Keylogger | MineCraft Recoveries |

HawkEye Keylogger | MineCraft Recoveries |

As you can see, this email has the attached file(s) containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.

As you can see, this email has the attached file(s) containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.

HawkEye Keylogger | Keyboard

HawkEye Keylogger | Keyboard

Keyboard Records

Keyboard Records

.jpeg

.jpeg

HawkEye_Keylogger_Keylog_Records_

HawkEye_Keylogger_Keylog_Records_

PTF://

PTF://

HawkEye Keylogger | Keyboard Clipboards Records |

HawkEye Keylogger | Keyboard Clipboards Records |

**************************************
Keyboard Records
**************************************

**************************************
Keyboard Records
**************************************

hXXp://192.99.212.64/WebPanel/log.php?username=

hXXp://192.99.212.64/WebPanel/log.php?username=

hXXp://whatismyipaddress.com/

hXXp://whatismyipaddress.com/

Stub.Resources

Stub.Resources

:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

\Google\Chrome\User Data\Default\Login Data

\Google\Chrome\User Data\Default\Login Data

logins

logins

origin_url

origin_url

password_value

password_value

moz_logins

moz_logins

formSubmitURL

formSubmitURL

encryptedPassword

encryptedPassword

\Mozilla Firefox\

\Mozilla Firefox\

mozglue.dll

mozglue.dll

\sitemanager.xml

\sitemanager.xml

\recentservers.xml

\recentservers.xml

;Server=(?.*?);Port=(?.*?);Password=(?.*?);User=(?.*?);

;Server=(?.*?);Port=(?.*?);Password=(?.*?);User=(?.*?);

port

port

password

password

C:\cftp\Ftplist.txt

C:\cftp\Ftplist.txt

\cftp\Ftplist.txt

\cftp\Ftplist.txt

\FTP Commander Deluxe\Ftplist.txt

\FTP Commander Deluxe\Ftplist.txt

password = (?.*?)

password = (?.*?)

hXXp://dyn.com/dns/

hXXp://dyn.com/dns/

\Dyn\Updater\daemon.cfg

\Dyn\Updater\daemon.cfg

\Dyn\Updater\config.dyndns

\Dyn\Updater\config.dyndns

hXXps://VVV.noip.com/

hXXps://VVV.noip.com/

CKey

CKey

SOFTWARE\Microsoft\Windows NT\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion

Taskhost.exe_1956_rwx_00400000_00122000:

.text

.text

`.rsrc

`.rsrc

@.reloc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

%UUUU3

%UUUU3

tcPW

tcPW

-4-4--567

-4-4--567

%s%2.2X

%s%2.2X

Browser Password Dump

Browser Password Dump

%s v%s by SecurityXploded

%s v%s by SecurityXploded

hXXp://securityxploded.com/browser-password-dump.php

hXXp://securityxploded.com/browser-password-dump.php

BrowserPasswordDump

BrowserPasswordDump

%s.exe [-h | -f ]

%s.exe [-h | -f ]

//Dump login passwords from all the Browsers to console

//Dump login passwords from all the Browsers to console

%s.exe

%s.exe

//Dump login passwords from all the Browsers to a file 'c:\passlist.txt'

//Dump login passwords from all the Browsers to a file 'c:\passlist.txt'

%s.exe -f "c:\passlist.txt"

%s.exe -f "c:\passlist.txt"

%s.exe -h

%s.exe -h

pstorec.dll

pstorec.dll

http:/

http:/

https:/

https:/

abe2869f-9b47-4cd9-a358-c22904dba7f7

abe2869f-9b47-4cd9-a358-c22904dba7f7

hXXps://%s

hXXps://%s

hXXp://%s

hXXp://%s

Cannot close vault. Error (%d)

Cannot close vault. Error (%d)

Web Data

Web Data

Login Data

Login Data

select * from logins where blacklisted_by_user=0;

select * from logins where blacklisted_by_user=0;

\MapleStudio\ChromePlus\User Data\Default\

\MapleStudio\ChromePlus\User Data\Default\

\Google\Chrome SxS\User Data\Default\

\Google\Chrome SxS\User Data\Default\

\Google\Chrome\User Data\Default\

\Google\Chrome\User Data\Default\

Opera\Opera\

Opera\Opera\

Opera\Opera\profile\

Opera\Opera\profile\

wand.dat

wand.dat

account

account

passwords

passwords

data

data

server

server

%s\Safari\Apple Application Support\plutil.exe

%s\Safari\Apple Application Support\plutil.exe

%s\Apple\Apple Application Support\plutil.exe

%s\Apple\Apple Application Support\plutil.exe

%s\%s\keychain.plist

%s\%s\keychain.plist

%skeytest.tmp

%skeytest.tmp

"%s" -convert xml1 -s -o "%s" "%s"

"%s" -convert xml1 -s -o "%s" "%s"

Google Chrome

Google Chrome

Opera Browser

Opera Browser

Firefox

Firefox

Chrome SXS

Chrome SXS

SeaMonkey

SeaMonkey

Browser: %s

Browser: %s

Website: %s

Website: %s

Username: %s

Username: %s

Password: %s

Password: %s

vaultcli.dll

vaultcli.dll

Error: Failed to create file '%s' for writing Password list. Make sure you have specified correct & full file path

Error: Failed to create file '%s' for writing Password list. Make sure you have specified correct & full file path

Browser Password Recovery Report

Browser Password Recovery Report

Website URL

Website URL

Password

Password

Produced by %s from hXXp://VVV.SecurityXploded.com

Produced by %s from hXXp://VVV.SecurityXploded.com

Tip: For more options type %s.exe -h

Tip: For more options type %s.exe -h

This is command-line application. Kindly Run it from the CMD Prompt

This is command-line application. Kindly Run it from the CMD Prompt

Press any key to exit....

Press any key to exit....

SOFTWARE\Clients\StartMenuInternet\SEAMONKEY.EXE\shell\open\command

SOFTWARE\Clients\StartMenuInternet\SEAMONKEY.EXE\shell\open\command

SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command

SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command

Mozilla\SeaMonkey

Mozilla\SeaMonkey

Mozilla\Firefox

Mozilla\Firefox

\profiles.ini

\profiles.ini

select * from moz_logins;

select * from moz_logins;

/signons.txt

/signons.txt

/signons2.txt

/signons2.txt

/signons3.txt

/signons3.txt

\signons.sqlite

\signons.sqlite

nss3.dll

nss3.dll

PK11_GetInternalKeySlot

PK11_GetInternalKeySlot

PK11_CheckUserPassword

PK11_CheckUserPassword

SQLite format 3

SQLite format 3

CREATE TABLE sqlite_master(

CREATE TABLE sqlite_master(

sql text

sql text

CREATE TEMP TABLE sqlite_temp_master(

CREATE TEMP TABLE sqlite_temp_master(

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

3.6.16

3.6.16

sqlite_version

sqlite_version

RowKey

RowKey

SQL logic error or missing database

SQL logic error or missing database

large file support is disabled

large file support is disabled

sqlite_detach

sqlite_detach

sqlite_attach

sqlite_attach

d-d-d d:d:d

d-d-d d:d:d

d:d:d

d:d:d

d-d-d

d-d-d

922337203685477580

922337203685477580

%s\etilqs_

%s\etilqs_

OsError 0x%x (%u)

OsError 0x%x (%u)

invalid page number %d

invalid page number %d

2nd reference to page %d

2nd reference to page %d

Failed to read ptrmap key=%d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

%d of %d pages missing from overflow list starting at %d

failed to get page %d

failed to get page %d

freelist leaf count too big on page %d

freelist leaf count too big on page %d

Page %d:

Page %d:

unable to get the page. error code=%d

unable to get the page. error code=%d

sqlite3BtreeInitPage() returns error code %d

sqlite3BtreeInitPage() returns error code %d

On tree page %d cell %d:

On tree page %d cell %d:

On page %d at right child:

On page %d at right child:

Corruption detected in header on page %d

Corruption detected in header on page %d

Corruption detected in cell %d on page %d

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Multiple uses for byte %d of page %d

Fragmented space is %d byte reported as %d on page %d

Fragmented space is %d byte reported as %d on page %d

Page %d is never used

Page %d is never used

Pointer map page %d is referenced

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

Outstanding page count goes from %d to %d during this analysis

keyinfo(%d

keyinfo(%d

%s(%d)

%s(%d)

%s-mjX

%s-mjX

unable to use function %s in the requested context

unable to use function %s in the requested context

cannot open savepoint - SQL statements in progress

cannot open savepoint - SQL statements in progress

no such savepoint: %s

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_temp_master

sqlite_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s

database table is locked: %s

database table is locked: %s

cannot open virtual table: %s

cannot open virtual table: %s

cannot open view: %s

cannot open view: %s

no such column: "%s"

no such column: "%s"

cannot open indexed column for writing

cannot open indexed column for writing

cannot open value of type %s

cannot open value of type %s

misuse of aliased aggregate %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s.%s

%s: %s.%s

%s: %s.%s

%s: %s

%s: %s

not authorized to use function: %s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

variable number must be between ?1 and ?%d

too many SQL variables

too many SQL variables

too many columns in %s

too many columns in %s

misuse of aggregate: %s()

misuse of aggregate: %s()

%.*s"%w"%s

%.*s"%w"%s

sqlite_rename_table

sqlite_rename_table

sqlite_rename_trigger

sqlite_rename_trigger

%s OR name=%Q

%s OR name=%Q

there is already another table or index with this name: %s

there is already another table or index with this name: %s

sqlite_

sqlite_

table %s may not be altered

table %s may not be altered

view %s may not be altered

view %s may not be altered

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

sqlite_altertab_%s

sqlite_stat1

sqlite_stat1

CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)

CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

SELECT idx, stat FROM %Q.sqlite_stat1

SELECT idx, stat FROM %Q.sqlite_stat1

invalid name: "%s"

invalid name: "%s"

too many attached databases - max %d

too many attached databases - max %d

database %s is already in use

database %s is already in use

unable to open database: %s

unable to open database: %s

no such database: %s

no such database: %s

cannot detach database %s

cannot detach database %s

database %s is locked

database %s is locked

%s %T cannot reference objects in database %s

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

object name reserved for internal use: %s

there is already an index named %s

there is already an index named %s

too many columns on %s

too many columns on %s

duplicate column name: %s

duplicate column name: %s

default value of column [%s] is not constant

default value of column [%s] is not constant

table "%s" has more than one primary key

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

no such collation sequence: %s

no such collation sequence: %s

CREATE %s %.*s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

table %s may not be dropped

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

use DROP VIEW to delete view %s

DELETE FROM %s.sqlite_sequence WHERE name=%Q

DELETE FROM %s.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

foreign key on %s should reference only one column of table %T

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

unknown column "%s" in foreign key definition

indexed columns are not unique

indexed columns are not unique

table %s may not be indexed

table %s may not be indexed

views may not be indexed

views may not be indexed

virtual tables may not be indexed

virtual tables may not be indexed

there is already a table named %s

there is already a table named %s

index %s already exists

index %s already exists

sqlite_autoindex_%s_%d

sqlite_autoindex_%s_%d

table %s has no column named %s

table %s has no column named %s

CREATE%s INDEX %.*s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q

DELETE FROM %Q.%s WHERE name=%Q

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

unable to identify the object to be reindexed

unable to identify the object to be reindexed

table %s may not be modified

table %s may not be modified

cannot modify %s because it is a view

cannot modify %s because it is a view

table %S has %d columns but %d values were supplied

table %S has %d columns but %d values were supplied

%d values for %d columns

%d values for %d columns

table %S has no column named %s

table %S has no column named %s

%s.%s may not be NULL

%s.%s may not be NULL

PRIMARY KEY must be unique

PRIMARY KEY must be unique

sqlite3_extension_init

sqlite3_extension_init

unable to open shared library [%s]

unable to open shared library [%s]

no entry point [%s] in shared library [%s]

no entry point [%s] in shared library [%s]

error during initialization: %s

error during initialization: %s

automatic extension loading failed: %s

automatic extension loading failed: %s

foreign_key_list

foreign_key_list

*** in database %s ***

*** in database %s ***

unsupported encoding: %s

unsupported encoding: %s

malformed database schema (%s)

malformed database schema (%s)

%s - %s

%s - %s

unsupported file format

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s

SELECT name, rootpage, sql FROM '%q'.%s

database schema is locked: %s

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

cannot join using column %s - column not present in both tables

%s.%s

%s.%s

%s:%d

%s:%d

ORDER BY clause should come after %s not before

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

no such index: %s

sqlite_subquery_%p_

sqlite_subquery_%p_

no such table: %s

no such table: %s

sqlite3_get_table() called with two or more incompatible queries

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

no such trigger: %S

-- TRIGGER %s

-- TRIGGER %s

no such column: %s

no such column: %s

PRAGMA vacuum_db.synchronous=OFF

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor failed: %s

vtable constructor did not declare schema: %s

vtable constructor did not declare schema: %s

no such module: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

table %s: xBestIndex returned an invalid plan

at most %d tables in a join

at most %d tables in a join

cannot use index: %s

cannot use index: %s

TABLE %s

TABLE %s

%s AS %s

%s AS %s

%s WITH INDEX %s

%s WITH INDEX %s

%s VIA MULTI-INDEX UNION

%s VIA MULTI-INDEX UNION

%s USING PRIMARY KEY

%s USING PRIMARY KEY

%s VIRTUAL TABLE INDEX %d:%s

%s VIRTUAL TABLE INDEX %d:%s

%s ORDER BY

%s ORDER BY

unable to close due to unfinished backup operation

unable to close due to unfinished backup operation

no such vfs: %s

no such vfs: %s

GetProcessWindowStation

GetProcessWindowStation

operator

operator

GetProcessHeap

GetProcessHeap

KERNEL32.dll

KERNEL32.dll

RegCloseKey

RegCloseKey

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

SHELL32.dll

SHELL32.dll

ole32.dll

ole32.dll

CRYPT32.dll

CRYPT32.dll

GetCPInfo

GetCPInfo

OLEAUT32.dll

OLEAUT32.dll

zcÁ

zcÁ

kernel32.dll

kernel32.dll

\StringFileInfo\xx\%s

\StringFileInfo\xx\%s

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msimn.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msimn.exe

outlook.exe

outlook.exe

msimn.exe

msimn.exe

%Program Files%\Microsoft Office\Office\Outlook.exe

%Program Files%\Microsoft Office\Office\Outlook.exe

Email Password Dump

Email Password Dump

hXXp://securityxploded.com/email-password-dump.php

hXXp://securityxploded.com/email-password-dump.php

EmailPasswordDump

EmailPasswordDump

//Dump all the Email passwords to console

//Dump all the Email passwords to console

//Dump all the Email passwords to a file "c:\passlist.txt"

//Dump all the Email passwords to a file "c:\passlist.txt"

\.purple\accounts.xml

\.purple\accounts.xml

%s\%s

%s\%s

@gmail.com

@gmail.com

@yahoo.com

@yahoo.com

Software\Paltalk\%s

Software\Paltalk\%s

Software\Google\Google Talk\Accounts\%s

Software\Google\Google Talk\Accounts\%s

Microsoft_WinInet_VVV.google.com:443

Microsoft_WinInet_VVV.google.com:443

%sMiranda_Mirror_%d.bin

%sMiranda_Mirror_%d.bin

LoginPassword

LoginPassword

LoginName

LoginName

LoginServer

LoginServer

gmail.com

gmail.com

%s\%s\%s.dat

%s\%s\%s.dat

pop3password=

pop3password=

esmtpaccount=

esmtpaccount=

esmtppassword=

esmtppassword=

smtphost=

smtphost=

SmtpPassword

SmtpPassword

ESMTPAccountKey

ESMTPAccountKey

c:\Program Files\Foxmail\mail

c:\Program Files\Foxmail\mail

%s\%s\Account.stg

%s\%s\Account.stg

%Program Files%\Foxmail 7.0\Data\AccCfg\Accounts.tdat

%Program Files%\Foxmail 7.0\Data\AccCfg\Accounts.tdat

PopPassword

PopPassword

SmtpAccount

SmtpAccount

SmtpServer

SmtpServer

%s\%s\Accounts

%s\%s\Accounts

%s\%s\Accounts\%s

%s\%s\Accounts\%s

Mozilla Thunderbird

Mozilla Thunderbird

Windows Live Mail

Windows Live Mail

Windows Credential Manager

Windows Credential Manager

Application:%s

Application:%s

Email ID: %s

Email ID: %s

WindowsLive:name=*

WindowsLive:name=*

Software\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

hXXps://

hXXps://

00000050

00000050

.oeaccount

.oeaccount

Software\Microsoft\IdentityCRL\Creds\%s

Software\Microsoft\IdentityCRL\Creds\%s

ps:password

ps:password

Email Password Recovery Report

Email Password Recovery Report

Produced by EmailPasswordDump v%s from hXXp://VVV.SecurityXploded.com

Produced by EmailPasswordDump v%s from hXXp://VVV.SecurityXploded.com

SOFTWARE\Clients\Mail\Mozilla Thunderbird\shell\open\command

SOFTWARE\Clients\Mail\Mozilla Thunderbird\shell\open\command

kpstorec.dll

kpstorec.dll

220D5CC1-853A-11D0-84BC-00C04FD43F8F

220D5CC1-853A-11D0-84BC-00C04FD43F8F

417e2d75-84bd-11d0-84bb-00c04fd43f8f

417e2d75-84bd-11d0-84bb-00c04fd43f8f

220D5CD0-853A-11D0-84BC-00C04FD43F8F

220D5CD0-853A-11D0-84BC-00C04FD43F8F

220D5CD1-853A-11D0-84BC-00C04FD43F8F

220D5CD1-853A-11D0-84BC-00C04FD43F8F

IMAP Password

IMAP Password

IMAP Port

IMAP Port

POP3 Password

POP3 Password

POP3 Port

POP3 Port

SMTP User

SMTP User

SMTP Password

SMTP Password

SMTP Server

SMTP Server

SMTP Port

SMTP Port

HTTP User

HTTP User

HTTP Password

HTTP Password

HTTP Server URL

HTTP Server URL

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows Messaging Subsystem\Profiles

%s\%s\%s

%s\%s\%s

%s\%s\%s\%s

%s\%s\%s\%s

SMTP Email Address

SMTP Email Address

IMAP Password2

IMAP Password2

POP3 Password2

POP3 Password2

SMTP User Name

SMTP User Name

SMTP Password2

SMTP Password2

HTTPMail User Name

HTTPMail User Name

HTTPMail Password2

HTTPMail Password2

HTTPMail Server

HTTPMail Server

LDAP Password2

LDAP Password2

Specified master password "%s" is wrong. Please try again with correct password

Specified master password "%s" is wrong. Please try again with correct password

GetWindowsDirectoryA

GetWindowsDirectoryA

RegEnumKeyExA

RegEnumKeyExA

USERENV.dll

USERENV.dll

VERSION.dll

VERSION.dll

RPCRT4.dll

RPCRT4.dll

v2.0.50727

v2.0.50727

Stub.exe

Stub.exe

Microsoft.VisualBasic

Microsoft.VisualBasic

System.Windows.Forms

System.Windows.Forms

System.Drawing

System.Drawing

System.Management

System.Management

System.Xml

System.Xml

tapi32.dll

tapi32.dll

rtm.dll

rtm.dll

user32.dll

user32.dll

ntdll.dll

ntdll.dll

Crypt32.dll

Crypt32.dll

Stub.Form1.resources

Stub.Form1.resources

Stub.Resources.resources

Stub.Resources.resources

Stub.My

Stub.My

WindowsFormsApplicationBase

WindowsFormsApplicationBase

Microsoft.VisualBasic.ApplicationServices

Microsoft.VisualBasic.ApplicationServices

System.Collections.Generic

System.Collections.Generic

.ctor

.ctor

.cctor

.cctor

System.Diagnostics

System.Diagnostics

System.Threading

System.Threading

System.Runtime.CompilerServices

System.Runtime.CompilerServices

System.ComponentModel

System.ComponentModel

System.CodeDom.Compiler

System.CodeDom.Compiler

Microsoft.VisualBasic.Devices

Microsoft.VisualBasic.Devices

m_MyWebServicesObjectProvider

m_MyWebServicesObjectProvider

get_WebServices

get_WebServices

HelpKeywordAttribute

HelpKeywordAttribute

System.ComponentModel.Design

System.ComponentModel.Design

WebServices

WebServices

Microsoft.VisualBasic.CompilerServices

Microsoft.VisualBasic.CompilerServices

System.Collections

System.Collections

System.Reflection

System.Reflection

ContainsKey

ContainsKey

InvalidOperationException

InvalidOperationException

MyWebServices

MyWebServices

System.Runtime.InteropServices

System.Runtime.InteropServices

encryptedpassstring

encryptedpassstring

encryptedsmtpstring

encryptedsmtpstring

portstring

portstring

encryptedftphost

encryptedftphost

encryptedftpuser

encryptedftpuser

encryptedftppass

encryptedftppass

useftp

useftp

websitevisitor

websitevisitor

websiteblocker

websiteblocker

fakeMSGholder

fakeMSGholder

passstring

passstring

smtpstring

smtpstring

ftphost

ftphost

ftpuser

ftpuser

ftppass

ftppass

WM_KEYUP

WM_KEYUP

WM_KEYDOWN

WM_KEYDOWN

WM_SYSKEYDOWN

WM_SYSKEYDOWN

WM_SYSKEYUP

WM_SYSKEYUP

KeyboardHandle

KeyboardHandle

KeyLog

KeyLog

CleanedPasswordsMAIL

CleanedPasswordsMAIL

CleanedPasswordsWB

CleanedPasswordsWB

System.IO

System.IO

get_ExecutablePath

get_ExecutablePath

WindowsIdentity

WindowsIdentity

System.Security.Principal

System.Security.Principal

set_WindowState

set_WindowState

FormWindowState

FormWindowState

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookEx

SetWindowsHookEx

SetWindowsHookExA

SetWindowsHookExA

GetAsyncKeyState

GetAsyncKeyState

vKey

vKey

HookKeyboard

HookKeyboard

UnhookKeyboard

UnhookKeyboard

Operators

Operators

get_Keyboard

get_Keyboard

Keyboard

Keyboard

get_CtrlKeyDown

get_CtrlKeyDown

get_AltKeyDown

get_AltKeyDown

KeyboardCallback

KeyboardCallback

set_UseShellExecute

set_UseShellExecute

Microsoft.VisualBasic.MyServices

Microsoft.VisualBasic.MyServices

System.Collections.ObjectModel

System.Collections.ObjectModel

MsgBox

MsgBox

MsgBoxResult

MsgBoxResult

MsgBoxStyle

MsgBoxStyle

ForceSteamLogin

ForceSteamLogin

System.Net.NetworkInformation

System.Net.NetworkInformation

get_OperationalStatus

get_OperationalStatus

OperationalStatus

OperationalStatus

FakemsgInstall

FakemsgInstall

System.Net.Mail

System.Net.Mail

SmtpClient

SmtpClient

System.Globalization

System.Globalization

set_Port

set_Port

System.Net

System.Net

Microsoft.Win32

Microsoft.Win32

RegistryKey

RegistryKey

OpenSubKey

OpenSubKey

System.Security.Cryptography

System.Security.Cryptography

System.Text

System.Text

set_Key

set_Key

StealPasswords

StealPasswords

stealWebroswers

stealWebroswers

WebClient

WebClient

readweb

readweb

System.IO.Compression

System.IO.Compression

SendLogsFTP

SendLogsFTP

FtpWebRequest

FtpWebRequest

WebRequest

WebRequest

UploadFTP

UploadFTP

secretKey

secretKey

set_KeySize

set_KeySize

get_KeySize

get_KeySize

System.Net.Sockets

System.Net.Sockets

virtualKey

virtualKey

KeyboardHookDelegate

KeyboardHookDelegate

get_Msg

get_Msg

System.Security

System.Security

ProcessHandle

ProcessHandle

Stub.My.Resources

Stub.My.Resources

System.Resources

System.Resources

get_WebBrowserPassView

get_WebBrowserPassView

WebBrowserPassView

WebBrowserPassView

System.Configuration

System.Configuration

GoogleChrome

GoogleChrome

MozillaFirefox

MozillaFirefox

loadCerts

loadCerts

FTPCommander

FTPCommander

System.Text.RegularExpressions

System.Text.RegularExpressions

WindowsKey

WindowsKey

SQLite

SQLite

SQLDataTypeSize

SQLDataTypeSize

sqlite_master_entry

sqlite_master_entry

sql_statement

sql_statement

Passwords

Passwords

PasswordSource

PasswordSource

FtpCommander

FtpCommander

8.0.0.0

8.0.0.0

My.Computer

My.Computer

My.Application

My.Application

My.User

My.User

My.Forms

My.Forms

My.WebServices

My.WebServices

System.Windows.Forms.Form

System.Windows.Forms.Form

My.MyProject.Forms

My.MyProject.Forms

4System.Web.Services.Protocols.SoapHttpClientProtocol

4System.Web.Services.Protocols.SoapHttpClientProtocol

3System.Resources.Tools.StronglyTypedResourceBuilder

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

4.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

12.0.0.0

12.0.0.0

My.Settings

My.Settings

$3e46a124-e015-4b12-9390-f16ac4d7ad53

$3e46a124-e015-4b12-9390-f16ac4d7ad53

1.0.0.0

1.0.0.0

_CorExeMain

_CorExeMain

mscoree.dll

mscoree.dll

{3C374A40-BAE4-11CF-BF7D-00AA006946EE}

{3C374A40-BAE4-11CF-BF7D-00AA006946EE}

{AFA0DC11-C313-11D0-831A-00C04FD5AE38}

{AFA0DC11-C313-11D0-831A-00C04FD5AE38}

hXXp://

hXXp://

Hmscoree.dll

Hmscoree.dll

- CRT not initialized

- CRT not initialized

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- floating point support not loaded

- floating point support not loaded

Fkernel32.dll

Fkernel32.dll

USER32.DLL

USER32.DLL

hXXp://VVV.facebook.com/

hXXp://VVV.facebook.com/

hXXps://VVV.facebook.com/

hXXps://VVV.facebook.com/

hXXp://twitter.com/

hXXp://twitter.com/

hXXps://twitter.com/

hXXps://twitter.com/

hXXps://login.yahoo.com/config/login

hXXps://login.yahoo.com/config/login

hXXps://pinterest.com/login/

hXXps://pinterest.com/login/

hXXp://VVV.linkedin.com/

hXXp://VVV.linkedin.com/

hXXps://my.screenname.aol.com/_cqr/login/login.psp

hXXps://my.screenname.aol.com/_cqr/login/login.psp

hXXps://VVV.amazon.com/ap/signin/190-9059340-4656153

hXXps://VVV.amazon.com/ap/signin/190-9059340-4656153

hXXps://signin.ebay.com/ws/ebayisapi.dll

hXXps://signin.ebay.com/ws/ebayisapi.dll

hXXps://accounts.google.com/servicelogin

hXXps://accounts.google.com/servicelogin

hXXps://VVV.google.com/accounts/servicelogin

hXXps://VVV.google.com/accounts/servicelogin

hXXp://digg.com

hXXp://digg.com

hXXp://VVV.myspace.com

hXXp://VVV.myspace.com

hXXps://myspace.com

hXXps://myspace.com

hXXps://VVV.amazon.com/gp/css/homepage.html

hXXps://VVV.amazon.com/gp/css/homepage.html

hXXp://VVV.stumbleupon.com/sign_up.php

hXXp://VVV.stumbleupon.com/sign_up.php

hXXp://slashdot.org/bookmark.pl

hXXp://slashdot.org/bookmark.pl

hXXp://VVV.reddit.com/login

hXXp://VVV.reddit.com/login

noftp

noftp

MessageBoxIcon.Information

MessageBoxIcon.Information

Disablecmd

Disablecmd

\Windows Update.exe

\Windows Update.exe

\WindowsUpdate.exe

\WindowsUpdate.exe

SysInfo.txt

SysInfo.txt

\pid.txt

\pid.txt

\pidloc.txt

\pidloc.txt

HawkEyeKeylogger

HawkEyeKeylogger

\Mozilla\Firefox\Profiles

\Mozilla\Firefox\Profiles

127.0.0.1

127.0.0.1

\SteamAppData.vdf

\SteamAppData.vdf

\ClientRegistry.blob

\ClientRegistry.blob

MessageBoxIcon.Error

MessageBoxIcon.Error

MessageBoxIcon.Exclamation

MessageBoxIcon.Exclamation

MessageBoxIcon.Question

MessageBoxIcon.Question

Dear HawkEye Customers!

Dear HawkEye Customers!

HawkEye Admin

HawkEye Admin

HawkEye Logger Details

HawkEye Logger Details

Keylogger Enabled:

Keylogger Enabled:

Operating System:

Operating System:

HawkEye_Keylogger_Execution_Confirmed_

HawkEye_Keylogger_Execution_Confirmed_

HawkEye Keylogger | Execution Confirmed |

HawkEye Keylogger | Execution Confirmed |

Dear HawkEye Customer!

This is a notification generated by

Dear HawkEye Customer!

This is a notification generated by

after successful injection of your server.

Best Regards
HawkEye Admin


************************************************************
HawkEye Keylogger's Detail
************************************************************
Server Name:

after successful injection of your server.

Best Regards
HawkEye Admin


************************************************************
HawkEye Keylogger's Detail
************************************************************
Server Name:

Keylogger Enabled:

Keylogger Enabled:

Operating System:

Operating System:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

autorun.inf

autorun.inf

open=Sys.exe

open=Sys.exe

Sys.exe

Sys.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows Update

Windows Update

\bitcoin\wallet.dat

\bitcoin\wallet.dat

_wallet.dat

_wallet.dat

wallet.dat

wallet.dat

Microsoft.NET\Framework\v2.0.50727\vbc.exe

Microsoft.NET\Framework\v2.0.50727\vbc.exe

holdermail.txt"

holdermail.txt"

holdermail.txt

holdermail.txt

Source:{4}{4}{0}{5}Host:{4}{4}{1}{5}Username:{4}{2}{5}Password:{4}{3}{5}{5}

Source:{4}{4}{0}{5}Host:{4}{4}{1}{5}Username:{4}{2}{5}Password:{4}{3}{5}{5}

Operating System Intel Recovery

Operating System Intel Recovery

Operating System Platform:

Operating System Platform:

Operating System Version:

Operating System Version:

HawkEye_Keylogger_Recoveries_

HawkEye_Keylogger_Recoveries_

HawkEye Keylogger | Recoveries |

HawkEye Keylogger | Recoveries |

****************************************************
Operating System Intel Recovery
****************************************************
PC Name:

****************************************************
Operating System Intel Recovery
****************************************************
PC Name:

Operating System Platform:

Operating System Platform:

Operating System Version:

Operating System Version:

C:\Users\

C:\Users\

_Pin0.jpeg

_Pin0.jpeg

_Pin1.jpeg

_Pin1.jpeg

_Pin2.jpeg

_Pin2.jpeg

_Pin3.jpeg

_Pin3.jpeg

_Pin4.jpeg

_Pin4.jpeg

HawkEye Keylogger | RuneScape Recoveries |

HawkEye Keylogger | RuneScape Recoveries |

Dear HawkEye Customer!

Dear HawkEye Customer!

HawkEye Keylogger | BitCoin Recoveries |

HawkEye Keylogger | BitCoin Recoveries |

As you can see, this email has attached file(s) containing the wallet.dat file which holds the users Bitcoin Currency.

As you can see, this email has attached file(s) containing the wallet.dat file which holds the users Bitcoin Currency.

\.minecraft\lastlogin

\.minecraft\lastlogin

HawkEye Keylogger | MineCraft Recoveries |

HawkEye Keylogger | MineCraft Recoveries |

As you can see, this email has the attached file(s) containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.

As you can see, this email has the attached file(s) containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.

HawkEye Keylogger | Keyboard

HawkEye Keylogger | Keyboard

Keyboard Records

Keyboard Records

.jpeg

.jpeg

HawkEye_Keylogger_Keylog_Records_

HawkEye_Keylogger_Keylog_Records_

PTF://

PTF://

HawkEye Keylogger | Keyboard Clipboards Records |

HawkEye Keylogger | Keyboard Clipboards Records |

**************************************
Keyboard Records
**************************************

**************************************
Keyboard Records
**************************************

hXXp://192.99.212.64/WebPanel/log.php?username=

hXXp://192.99.212.64/WebPanel/log.php?username=

hXXp://whatismyipaddress.com/

hXXp://whatismyipaddress.com/

Stub.Resources

Stub.Resources

:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

\Google\Chrome\User Data\Default\Login Data

\Google\Chrome\User Data\Default\Login Data

logins

logins

origin_url

origin_url

password_value

password_value

moz_logins

moz_logins

formSubmitURL

formSubmitURL

encryptedPassword

encryptedPassword

\Mozilla Firefox\

\Mozilla Firefox\

mozglue.dll

mozglue.dll

\sitemanager.xml

\sitemanager.xml

\recentservers.xml

\recentservers.xml

;Server=(?.*?);Port=(?.*?);Password=(?.*?);User=(?.*?);

;Server=(?.*?);Port=(?.*?);Password=(?.*?);User=(?.*?);

port

port

password

password

C:\cftp\Ftplist.txt

C:\cftp\Ftplist.txt

\cftp\Ftplist.txt

\cftp\Ftplist.txt

\FTP Commander Deluxe\Ftplist.txt

\FTP Commander Deluxe\Ftplist.txt

password = (?.*?)

password = (?.*?)

hXXp://dyn.com/dns/

hXXp://dyn.com/dns/

\Dyn\Updater\daemon.cfg

\Dyn\Updater\daemon.cfg

\Dyn\Updater\config.dyndns

\Dyn\Updater\config.dyndns

hXXps://VVV.noip.com/

hXXps://VVV.noip.com/

CKey

CKey

SOFTWARE\Microsoft\Windows NT\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion

Taskhost.exe_1956_rwx_675A6000_00003000:

.Qg

.Qg

*Rg`.Rg|)RgL Rg

*Rg`.Rg|)RgL Rg