Trojan.GenericKD.2182622_b1f71f2424

by malwarelabrobot on March 17th, 2015 in Malware Descriptions.

Trojan.MSIL.Kryptik.clv (Kaspersky), Trojan.GenericKD.2182622 (B) (Emsisoft), Trojan.GenericKD.2182622 (AdAware), GenericAutorunWorm.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, WormAutorun


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: b1f71f242489b282d8dbc2634cc70340
SHA1: 8c98ed4990a0ed48a12b90c47f2c00b722245fa1
SHA256: 474fd209cd31c2e8ce7e9688253c0f85ceddd127206423f83376b9642a49df94
SSDeep: 24576:PjICAOwBqdgEEKCqeE2OVhM e3QJ5rdGRR50uDJ0gIjFr7Hly/cmjGakvvZdb3T/:LICp25hOVhrkJQ8CaHqXPZu0dw8
Size: 1744560 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: StdLib
Created at: 2015-02-23 08:58:13
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour Description
WormAutorun A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Trojan creates the following process(es):

vbc.exe:2168
vbc.exe:2500
%original file name%.exe:856

The Trojan injects its code into the following process(es):

%original file name%.exe:1140

Mutexes

The following mutexes were created/opened:

ShimCacheMutex
RasPbFile

File activity

The process vbc.exe:2168 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (400 bytes)

The process vbc.exe:2500 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (399 bytes)

The process %original file name%.exe:856 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\C0AF5F80AA0D55CA55AD4471DD73D761 (793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\140B4CDED8ED877CDC65B54BA965BD39 (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\140B4CDED8ED877CDC65B54BA965BD39 (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\0AE1A896B17983DA2D3F15114E2248F0 (7 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\C0AF5F80AA0D55CA55AD4471DD73D761 (168 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\0AE1A896B17983DA2D3F15114E2248F0 (184 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (0 bytes)

The process %original file name%.exe:1140 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\pid.txt (4 bytes)
%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe (11518 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (656 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (39 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (0 bytes)

Registry activity

The process vbc.exe:2168 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 46 54 CC F8 4A 35 2B 62 28 10 68 ED C4 78 E0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process vbc.exe:2500 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "76 8A F7 74 CA AC 7B 13 C9 37 81 33 CD F2 84 E5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process %original file name%.exe:856 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 9E 5F AB 29 26 9C F5 D8 5D 1F 9E ED 6E 9D 06"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F]
"Blob" = "19 00 00 00 01 00 00 00 10 00 00 00 6D 00 C0 25"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F"

The process %original file name%.exe:1140 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\b1f71f242489b282d8dbc2634cc70340\DEBUG]
"Trace Level" = ""

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB D1 41 B2 24 0A 1C D9 B8 FC C4 AE 12 BA 35 7F"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Update" = "%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\b1f71f242489b282d8dbc2634cc70340\DEBUG]
"Trace Level"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description: SSH, Telnet and Rlogin client
Comments:
Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 8192 1734772 1735168 4.04154 65c2aac9aa9f30b952965e0703f31a5e
.rsrc 1744896 2360 2560 3.54763 b81e00ade0bf54d96e708e8a47450b86
.reloc 1753088 12 512 0.070639 90bebabdc542bfd46bf35c38fc7d3685

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://www.startssl.com/sfsca.crt 192.116.242.20
hxxp://a767.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt
hxxp://a767.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://www.startssl.com/sfsca.crl 192.116.242.20
hxxp://a1603.g1.akamai.net/sfsca.crl
hxxp://a1603.g1.akamai.net/crtc2-crl.crl
hxxp://whatismyipaddress.com/ 66.171.248.172
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt 194.146.191.105
hxxp://crl.startssl.com/crtc2-crl.crl 194.146.191.113
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab 194.146.191.105
hxxp://crl.startssl.com/sfsca.crl 194.146.191.113
mail.frezija.lt 5.199.161.25


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /sfsca.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: VVV.startssl.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache


HTTP/1.1 301 Moved Permanently
Date: Mon, 16 Mar 2015 06:33:43 GMT
Server: Apache/2.2.3 (StartCom)
Location: hXXp://crl.startssl.com/sfsca.crl
Cache-Control: max-age=3600
Expires: Mon, 16 Mar 2015 07:33:43 GMT
Content-Length: 324
Connection: close
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>301 Moved Permanently</title>.</head
><body>.<h1>Moved Permanently</h1>.<p>The d
ocument has moved <a href="hXXp://crl.startssl.com/sfsca.crl">he
re</a>.</p>.<hr>.<address>Apache/2.2.3 (StartC
om) Server at VVV.startssl.com Port 80</address>.</body>&l
t;/html>...



GET / HTTP/1.1
Host: whatismyipaddress.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 16 Mar 2015 06:33:47 GMT
Server: Apache/2.2.26 (Unix) DAV/2 PHP/5.4.30 mod_ssl/2.2.26 OpenSSL/0.9.8zc
Set-Cookie: pt=b7ed52fc979c579a2bae260856828015; expires=Tue, 17-Mar-2015 06:33:47 GMT
Cache-Control: max-age=15
MS-Author-Via: DAV
Vary: Accept-Encoding
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
20b2..<!doctype html>.<html lang="en">.<head>..<m
eta charset="windows-1252">..<meta name="robots" content="noarch
ive">..<title>What Is My IP Address? IP Address Tools and Mor
e</title>..<meta name="description" content="IP address looku
p, location, proxy detection, email tracing, IP hiding tips, blacklist
 check, speed test, and forums.  Find, get, and show my IP address."&g
t;..<meta name="keywords" content="my ip ,ip, address, adress, my, 
what, is, find, get, show, locate, change, location, how, do, i, ip ad
dress, proxy, server, anonymous, hide, conceal, stealth, surf, web, an
onymizer, anonymize, changer, privacy, geolocation, geolocate, lookup,
 look up, locate, trace, track, email, source, headers">..<meta 
property="fb:admins" content="607824267"/>..<link rel="shortcut 
icon" href="hXXp://cdn.whatismyipaddress.com/favicon.ico">..<lin
k rel="stylesheet" type="text/css" href="hXXp://cdn.whatismyipaddress.
com/css/myip_v4_3.css">..<link rel="publisher" href="hXXps://plu
s.google.com/ whatismyipaddress">..<link rel="canonical" href="h
ttp://whatismyipaddress.com">..<link rel="alternate" hreflang="f
r" href="hXXp://whatismyipaddress.com/fr/mon-ip">..<link rel="al
ternate" hreflang="de" href="hXXp://whatismyipaddress.com/de/meine-ip"
>..<link rel="alternate" hreflang="es" href="hXXp://whatismyipad
dress.com/es/mi-ip">..<link rel="alternate" hreflang="tr" href="
hXXp://whatismyipaddress.com/tr/ip-im">..<link rel="alternat
<<< skipped >>>


GET /sfsca.crt HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: VVV.startssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 16 Mar 2015 06:33:42 GMT
Server: Apache/2.2.3 (StartCom)
Last-Modified: Thu, 30 Nov 2006 01:24:01 GMT
ETag: "33d800-7cd-bcfd4e40"
Accept-Ranges: bytes
Content-Length: 1997
Cache-Control: max-age=2592000, must-revalidate
Expires: Wed, 15 Apr 2015 06:32:27 GMT
Age: 77
Connection: close
Content-Type: application/x509-ca-cert
0...0...........0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.
1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certi
fication Authority0...060917194636Z..360917194636Z0}1.0...U....IL1.0..
.U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..
U... StartCom Certification Authority0.."0...*.H.............0........
.....lF|x..{.3..rb..6 "$^..w.C...d...6.8.#.nm.<.r.....=.3 ./....AYg
...}..t..yL.7z.9.RY...FC......q.ub4.,......4.....R=.3..M..;JK..&/....r
5w.<]...&..6v\..t.%.......x.-...0.-ry.F..*.....I...........cS..b...
:..f..kt.. .v>.m..D.sb.;...SV%lQ......v.m.....=f..V...H.:K..XP.8u.[
.C......lMp[)e...]...1........{.n.'f..H.nB.?.!>{..p.c..l.T.\%z.....
..,~.^.MXn........2.......n..6I..Hi...M...i......y"H..{i.p..z7....vOW.
........`.g:........r".................\R<...*s......`.z/...n.&0...
..W..=.. ..v.... ...*r..3.].K....t.RK........R0..N0...U....0....0...U.
.......0...U......N....@[..i.0.4hC.A..0d..U...]0[0,.*.(.&hXXp://cert.s
tartcom.org/sfsca-crl.crl0 .).'.%hXXp://crl.startcom.org/sfsca-crl.crl
0..]..U. ...T0..P0..L.. ......7...0..;0/.. ........#hXXp://cert.startc
om.org/policy.pdf05.. ........)hXXp://cert.startcom.org/intermediate.p
df0.... .......0..0'. Start Commercial (StartCom) Ltd.0.......Limited 
Liability, read the section *Legal Limitations* of the StartCom Certif
ication Authority Policy available at hXXp://cert.startcom.org/policy.
pdf0...`.H...B........08..`.H...B... .)StartCom Free SSL Certification
 Authority0...*.H..............l..f.4...^}....N8.^..%.K.2..;.=.D.[
<<< skipped >>>


GET /sfsca.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.startssl.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache


HTTP/1.1 200 OK
Server: Apache/2.2.3 (StartCom)
Last-Modified: Mon, 16 Mar 2015 05:49:09 GMT
ETag: "5bd2c4-319-5116168a99f40"
Accept-Ranges: bytes
Content-Length: 793
Content-Type: application/pkcs7-crl
Cache-Control: must-revalidate, max-age=129600
Date: Mon, 16 Mar 2015 06:33:42 GMT
Connection: keep-alive
0...0..0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..
."Secure Digital Certificate Signing1)0'..U... StartCom Certification 
Authority..150204005149Z..160204005149Z0P0.../..110319055235Z0...0..11
0319055246Z0...1..110401065531Z0...2..110401065546Z0...*.H............
.6Sx...nz]#..D8%.R...zUk.q..1...d.:}R.%..?..%....!..y..6....T j ..T...
MV..y[x.Q..*.k<.IG...^.....q9....\[email protected]..[........x..4......Y..g
..m...-_s...N.....,....s.r.....&t..[E.Y..E....Zw....f...`....}2.... J.
d".po<...#.......@..[q../,...UQ..E'..].. .i..4...0.....2...."&...be
.}.Kb:...b....`.Q.&.....4..).....BA..Z)M........pMs..X.QgDn........}..
.).].%.m.9..s...NSNp6!.pT..`q...|.b...9V.....[..Q..v1,[@......wrX..r..
].....D.h.7.j....@....#..*.H9..Z.7.....%...g....? .....,..sF..2u.UW...
..QA...) .hZ.v........N......HTTP/1.1 200 OK..Server: Apache/2.2.3 (St
artCom)..Last-Modified: Mon, 16 Mar 2015 05:49:09 GMT..ETag: "5bd2c4-3
19-5116168a99f40"..Accept-Ranges: bytes..Content-Length: 793..Content-
Type: application/pkcs7-crl..Cache-Control: must-revalidate, max-age=1
29600..Date: Mon, 16 Mar 2015 06:33:42 GMT..Connection: keep-alive..0.
..0..0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."
Secure Digital Certificate Signing1)0'..U... StartCom Certification Au
thority..150204005149Z..160204005149Z0P0.../..110319055235Z0...0..1103
19055246Z0...1..110401065531Z0...2..110401065546Z0...*.H.............6
Sx...nz]#..D8%.R...zUk.q..1...d.:}R.%..?..%....!..y..6....T j ..T...MV
..y[x.Q..*.k<.IG...^.....q9....\[email protected]..[........x..4......Y.
<<< skipped >>>

GET /crtc2-crl.crl HTTP/1.1


Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.startssl.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache


HTTP/1.1 200 OK
Server: Apache/2.2.3 (StartCom)
Last-Modified: Mon, 16 Mar 2015 06:09:07 GMT
ETag: "5bd217-1d87-51161b011a6c0"
Accept-Ranges: bytes
Content-Length: 7559
Content-Type: application/pkcs7-crl
Cache-Control: must-revalidate, max-age=129600
Date: Mon, 16 Mar 2015 06:33:42 GMT
Connection: keep-alive
0...0..k0...*.H........0..1.0...U....IL1.0...U....StartCom Ltd.1 0)..U
..."Secure Digital Certificate Signing1806..U.../StartCom Class 2 Prim
ary Intermediate Object CA..150316040118Z..150318040118Z0...0.......11
0426144123Z0....#..121011154918Z0....'..130115123251Z0....0..110513055
152Z0....5..110514221542Z0....<..120202190303Z0....?..110612164411Z
0....H..110524174533Z0....M..110525135627Z0....Q..110526122223Z0....X.
.110528132951Z0....j..120521121756Z0....k..130131212953Z0....m..110606
150725Z0....{..110626121016Z0.......110626164106Z0.......110630125628Z
0.......110715041302Z0.......120906180517Z0.......120223174425Z0......
.110729115950Z0.......110728073104Z0.......110820070200Z0.......110827
205122Z0.......120603111003Z0.......111103054758Z0.......120309112446Z
0.......110902055536Z0.......130128152836Z0.......111204194653Z0......
.110918192658Z0....'..110928203537Z0....0..111001160758Z0....:..111005
000857Z0....G..111010163704Z0....J..111010063053Z0....Q..111012170744Z
0....T..111013193603Z0....f..130307214128Z0....o..130722075734Z0....v.
.111101212259Z0.......111117230515Z0.......120624221138Z0.......111117
183940Z0.......111120051327Z0.......120321203417Z0.......130716141444Z
0.......111127231344Z0.......120428103802Z0.......120106143551Z0......
.131011093051Z0.......120125144515Z0.......120125134731Z0.......120125
223201Z0.......120131140451Z0....2..120209143717Z0....E..120416205239Z
0....J..120608093908Z0....O..120313125510Z0....T..120228105714Z0....[.
.120228174821Z0....`..120522140615Z0....h..120306062015Z0....j..12
<<< skipped >>>


GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: VVV.download.windowsupdate.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache


HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Fri, 20 Feb 2015 20:14:50 GMT
Accept-Ranges: bytes
ETag: "05934e1494dd01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 18
Cache-Control: max-age=13816
Date: Mon, 16 Mar 2015 06:33:41 GMT
Connection: keep-alive
X-CCC: GR
X-CID: 2
1401D04D49E16F8687....


GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1


Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: VVV.download.windowsupdate.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Tue, 24 Feb 2015 00:36:45 GMT
Accept-Ranges: bytes
ETag: "804c50f7c94fd01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 49859
Cache-Control: max-age=6840
Date: Mon, 16 Mar 2015 06:33:41 GMT
Connection: keep-alive
X-CCC: GR
X-CID: 2
MSCF............,...................I.......#.........WFw. .authroot.s
tl.....08..CK...<.......m..dK.......D.d'....fW...RJe.).."...n.Ie.,E
.RH...L....\...z.^...p.<g.9...~...=.d/.. ...H....8f|&x.N.d..p(....(
[email protected](.p`d. .....D.....g%.j..w.DF..GW .....*.@6....#.8....
v..=T..^.G.G.!.A........_...r..3n...G.g\_.r.....Au..sw.3.....G.f. ..0.
.0.^.R".K|.....y...l..1.......t.(...0Y......4.,......x..ENY.`d..O.....
!..9A~....^[email protected][email protected].).|.H.
..A.[.Q. D`.}YQvx.B`b.=....,X...-.5S..N..=x.....C.Mj^.H....5b...5.....
...I...`..... ..l.n.:.....j...u2gA.hx.`%K.bw...\!o.........R....=..*..
.w..J....q.?^.PuA..W...>.._..O......9|.../......m.E.u.d...J2.U.e?..
..}h.S.zC^...<.c)...^c.b}.2..'X567.!.h. ......5.......S*.z%..%..e..
.R...C#p..k.[...3...jI.<.Z.GX.u.- ....ut{.&>...:.......f...f.)y.
....5.../R.b.......r.!.4.-a.....!...P......Q'7.0.%[.~m_..v....;..:.X..
~...,.......O....u|T.L....w....)5.bBs..W..r..u.......W......'G......y.
..h.. %. z?..............f.Nx./c...R...`..y.>....'......l=.O..#....
..... ..P..Q.......3.............M......%...v.:(...u..zU......G_.<u
e...F.....6Xo......P.......@L#........4<....K.g:...3o.N..:..zb...5.
.,.5...C... .4..`Q0.....$9./.$1....WL)$.0F......^..k..D.*.#.L3. (}.,,.
kd.<W.....[,.....Y.n.b.....4.Y)...c.g..`.y.........X..I? '.{Cb.GDh.
d..F..2B...sT.^..!.L..}.P....C...?.......~.....d....5.j...1.y9^_K..g..
pX.......^z.e)....yc......?..o...e......KJ..H.O..m......B27....?.~m ..
[email protected](....f1...h.0.u4..(.........2b`....]..H.Ja..
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_1140:

.text
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
`.rdata
@.data
.rsrc
%UUUU3
tcPW
-4-4--567
%s%2.2X
Browser Password Dump
%s v%s by SecurityXploded
hXXp://securityxploded.com/browser-password-dump.php
BrowserPasswordDump
%s.exe [-h | -f <output_file_name>]
//Dump login passwords from all the Browsers to console
%s.exe
//Dump login passwords from all the Browsers to a file 'c:\passlist.txt'
%s.exe -f "c:\passlist.txt"
%s.exe -h
pstorec.dll
http:/
https:/
abe2869f-9b47-4cd9-a358-c22904dba7f7
hXXps://%s
hXXp://%s
Cannot close vault. Error (%d)
Web Data
Login Data
select * from logins where blacklisted_by_user=0;
\MapleStudio\ChromePlus\User Data\Default\
\Google\Chrome SxS\User Data\Default\
\Google\Chrome\User Data\Default\
Opera\Opera\
Opera\Opera\profile\
wand.dat
<key>account</key>
passwords
<key>data</key>
<key>server</key>
%s\Safari\Apple Application Support\plutil.exe
%s\Apple\Apple Application Support\plutil.exe
%s\%s\keychain.plist
%skeytest.tmp
"%s" -convert xml1 -s -o "%s" "%s"
Google Chrome
Opera Browser
Firefox
Chrome SXS
SeaMonkey
Browser: %s
Website: %s
Username: %s
Password: %s
vaultcli.dll
Error: Failed to create file '%s' for writing Password list. Make sure you have specified correct & full file path
Browser Password Recovery Report
Website URL
Password
Produced by %s from hXXp://VVV.SecurityXploded.com
Tip: For more options type %s.exe -h
This is command-line application. Kindly Run it from the CMD Prompt
Press any key to exit....
SOFTWARE\Clients\StartMenuInternet\SEAMONKEY.EXE\shell\open\command
SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command
Mozilla\SeaMonkey
Mozilla\Firefox
\profiles.ini
select * from moz_logins;
/signons.txt
/signons2.txt
/signons3.txt
\signons.sqlite
nss3.dll
PK11_GetInternalKeySlot
PK11_CheckUserPassword
SQLite format 3
CREATE TABLE sqlite_master(
sql text
CREATE TEMP TABLE sqlite_temp_master(
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
3.6.16
sqlite_version
RowKey
SQL logic error or missing database
large file support is disabled
sqlite_detach
sqlite_attach
d-d-d d:d:d
d:d:d
d-d-d
922337203685477580
%s\etilqs_
OsError 0x%x (%u)
invalid page number %d
2nd reference to page %d
Failed to read ptrmap key=%d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
%d of %d pages missing from overflow list starting at %d
failed to get page %d
freelist leaf count too big on page %d
Page %d:
unable to get the page. error code=%d
sqlite3BtreeInitPage() returns error code %d
On tree page %d cell %d:
On page %d at right child:
Corruption detected in header on page %d
Corruption detected in cell %d on page %d
Multiple uses for byte %d of page %d
Fragmented space is %d byte reported as %d on page %d
Page %d is never used
Pointer map page %d is referenced
Outstanding page count goes from %d to %d during this analysis
keyinfo(%d
%s(%d)
%s-mjX
unable to use function %s in the requested context
cannot open savepoint - SQL statements in progress
no such savepoint: %s
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_temp_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s
database table is locked: %s
cannot open virtual table: %s
cannot open view: %s
no such column: "%s"
cannot open indexed column for writing
cannot open value of type %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s
%s: %s
not authorized to use function: %s
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
too many SQL variables
too many columns in %s
misuse of aggregate: %s()
%.*s"%w"%s
sqlite_rename_table
sqlite_rename_trigger
%s OR name=%Q
there is already another table or index with this name: %s
sqlite_
table %s may not be altered
view %s may not be altered
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
sqlite_sequence
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_stat1
CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
SELECT idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
too many attached databases - max %d
database %s is already in use
unable to open database: %s
no such database: %s
cannot detach database %s
database %s is locked
%s %T cannot reference objects in database %s
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
there is already an index named %s
too many columns on %s
duplicate column name: %s
default value of column [%s] is not constant
table "%s" has more than one primary key
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
no such collation sequence: %s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE TABLE %Q.sqlite_sequence(name,seq)
view %s is circularly defined
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
indexed columns are not unique
table %s may not be indexed
views may not be indexed
virtual tables may not be indexed
there is already a table named %s
index %s already exists
sqlite_autoindex_%s_%d
table %s has no column named %s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
unable to identify the object to be reindexed
table %s may not be modified
cannot modify %s because it is a view
table %S has %d columns but %d values were supplied
%d values for %d columns
table %S has no column named %s
%s.%s may not be NULL
PRIMARY KEY must be unique
sqlite3_extension_init
unable to open shared library [%s]
no entry point [%s] in shared library [%s]
error during initialization: %s
automatic extension loading failed: %s
foreign_key_list
*** in database %s ***
unsupported encoding: %s
malformed database schema (%s)
%s - %s
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s
database schema is locked: %s
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
%s.%s
%s:%d
ORDER BY clause should come after %s not before
LIMIT clause should come after %s not before
SELECTs to the left and right of %s do not have the same number of result columns
no such index: %s
sqlite_subquery_%p_
no such table: %s
sqlite3_get_table() called with two or more incompatible queries
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
-- TRIGGER %s
no such column: %s
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor did not declare schema: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
cannot use index: %s
TABLE %s
%s AS %s
%s WITH INDEX %s
%s VIA MULTI-INDEX UNION
%s USING PRIMARY KEY
%s VIRTUAL TABLE INDEX %d:%s
%s ORDER BY
unable to close due to unfinished backup operation
no such vfs: %s
GetProcessWindowStation
operator
GetProcessHeap
KERNEL32.dll
RegCloseKey
RegOpenKeyExA
ADVAPI32.dll
SHELL32.dll
ole32.dll
CRYPT32.dll
GetCPInfo
OLEAUT32.dll
zcÁ
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
kernel32.dll
\StringFileInfo\xx\%s
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msimn.exe
outlook.exe
msimn.exe
%Program Files%\Microsoft Office\Office\Outlook.exe
Email Password Dump
hXXp://securityxploded.com/email-password-dump.php
EmailPasswordDump
//Dump all the Email passwords to console
//Dump all the Email passwords to a file "c:\passlist.txt"
\.purple\accounts.xml
<password>
</password>
%s\%s
@gmail.com
@yahoo.com
Software\Paltalk\%s
Software\Google\Google Talk\Accounts\%s
Microsoft_WinInet_VVV.google.com:443
%sMiranda_Mirror_%d.bin
LoginPassword
LoginName
LoginServer
gmail.com
%s\%s\%s.dat
pop3password=
esmtpaccount=
esmtppassword=
smtphost=
SmtpPassword
ESMTPAccountKey
c:\Program Files\Foxmail\mail
%s\%s\Account.stg
%Program Files%\Foxmail 7.0\Data\AccCfg\Accounts.tdat
PopPassword
SmtpAccount
SmtpServer
%s\%s\Accounts
%s\%s\Accounts\%s
Mozilla Thunderbird
Windows Live Mail
Windows Credential Manager
Application:%s
Email ID: %s
WindowsLive:name=*
Software\Microsoft\Windows Live Mail
<SMTP_Email_Address
<POP3_Port
<POP3_Password2
<IMAP_Port
<IMAP_Password2
<HTTPMail_Server
<HTTPMail_User_Name
<HTTPMail_Password2
<SMTP_Server
<SMTP_Port
<SMTP_User_Name
<SMTP_Password2
hXXps://
00000050
.oeaccount
Software\Microsoft\IdentityCRL\Creds\%s
ps:password
Email Password Recovery Report
Produced by EmailPasswordDump v%s from hXXp://VVV.SecurityXploded.com
SOFTWARE\Clients\Mail\Mozilla Thunderbird\shell\open\command
kpstorec.dll
220D5CC1-853A-11D0-84BC-00C04FD43F8F
417e2d75-84bd-11d0-84bb-00c04fd43f8f
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
IMAP Password
IMAP Port
POP3 Password
POP3 Port
SMTP User
SMTP Password
SMTP Server
SMTP Port
HTTP User
HTTP Password
HTTP Server URL
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows Messaging Subsystem\Profiles
%s\%s\%s
%s\%s\%s\%s
SMTP Email Address
IMAP Password2
POP3 Password2
SMTP User Name
SMTP Password2
HTTPMail User Name
HTTPMail Password2
HTTPMail Server
LDAP Password2
Specified master password "%s" is wrong. Please try again with correct password
GetWindowsDirectoryA
RegEnumKeyExA
USERENV.dll
VERSION.dll
RPCRT4.dll
v2.0.50727
Stub.exe
Microsoft.VisualBasic
System.Windows.Forms
System.Drawing
System.Management
System.Xml
tapi32.dll
rtm.dll
user32.dll
ntdll.dll
Crypt32.dll
Stub.Form1.resources
Stub.Resources.resources
Stub.My
WindowsFormsApplicationBase
Microsoft.VisualBasic.ApplicationServices
System.Collections.Generic
.ctor
.cctor
System.Diagnostics
System.Threading
System.Runtime.CompilerServices
System.ComponentModel
System.CodeDom.Compiler
Microsoft.VisualBasic.Devices
m_MyWebServicesObjectProvider
get_WebServices
HelpKeywordAttribute
System.ComponentModel.Design
WebServices
Microsoft.VisualBasic.CompilerServices
System.Collections
System.Reflection
ContainsKey
InvalidOperationException
MyWebServices
System.Runtime.InteropServices
encryptedpassstring
encryptedsmtpstring
portstring
encryptedftphost
encryptedftpuser
encryptedftppass
useftp
websitevisitor
websiteblocker
fakeMSGholder
passstring
smtpstring
ftphost
ftpuser
ftppass
WM_KEYUP
WM_KEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYUP
KeyboardHandle
KeyLog
CleanedPasswordsMAIL
CleanedPasswordsWB
System.IO
get_ExecutablePath
WindowsIdentity
System.Security.Principal
set_WindowState
FormWindowState
UnhookWindowsHookEx
SetWindowsHookEx
SetWindowsHookExA
GetAsyncKeyState
vKey
HookKeyboard
UnhookKeyboard
Operators
get_Keyboard
Keyboard
get_CtrlKeyDown
get_AltKeyDown
KeyboardCallback
set_UseShellExecute
Microsoft.VisualBasic.MyServices
System.Collections.ObjectModel
MsgBox
MsgBoxResult
MsgBoxStyle
ForceSteamLogin
System.Net.NetworkInformation
get_OperationalStatus
OperationalStatus
FakemsgInstall
System.Net.Mail
SmtpClient
System.Globalization
set_Port
System.Net
Microsoft.Win32
RegistryKey
OpenSubKey
System.Security.Cryptography
System.Text
set_Key
StealPasswords
stealWebroswers
WebClient
readweb
System.IO.Compression
SendLogsFTP
FtpWebRequest
WebRequest
UploadFTP
secretKey
set_KeySize
get_KeySize
System.Net.Sockets
virtualKey
KeyboardHookDelegate
get_Msg
System.Security
ProcessHandle
Stub.My.Resources
System.Resources
get_WebBrowserPassView
WebBrowserPassView
System.Configuration
GoogleChrome
MozillaFirefox
loadCerts
FTPCommander
System.Text.RegularExpressions
WindowsKey
SQLite
SQLDataTypeSize
sqlite_master_entry
sql_statement
Passwords
PasswordSource
FtpCommander
8.0.0.0
My.Computer
My.Application
My.User
My.Forms
My.WebServices
System.Windows.Forms.Form
My.MyProject.Forms
4System.Web.Services.Protocols.SoapHttpClientProtocol
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
12.0.0.0
My.Settings
$3e46a124-e015-4b12-9390-f16ac4d7ad53
1.0.0.0
_CorExeMain
mscoree.dll
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
{3C374A40-BAE4-11CF-BF7D-00AA006946EE}
{AFA0DC11-C313-11D0-831A-00C04FD5AE38}
hXXp://
Hmscoree.dll
- CRT not initialized
- Attempt to initialize the CRT more than once.
- floating point support not loaded
Fkernel32.dll
USER32.DLL
hXXp://VVV.facebook.com/
hXXps://VVV.facebook.com/
hXXp://twitter.com/
hXXps://twitter.com/
hXXps://login.yahoo.com/config/login
hXXps://pinterest.com/login/
hXXp://VVV.linkedin.com/
hXXps://my.screenname.aol.com/_cqr/login/login.psp
hXXps://VVV.amazon.com/ap/signin/190-9059340-4656153
hXXps://signin.ebay.com/ws/ebayisapi.dll
hXXps://accounts.google.com/servicelogin
hXXps://VVV.google.com/accounts/servicelogin
hXXp://digg.com
hXXp://VVV.myspace.com
hXXps://myspace.com
hXXps://VVV.amazon.com/gp/css/homepage.html
hXXp://VVV.stumbleupon.com/sign_up.php
hXXp://slashdot.org/bookmark.pl
hXXp://VVV.reddit.com/login
1200000
noftp
MessageBoxIcon.Information
Disablecmd
\Windows Update.exe
\WindowsUpdate.exe
SysInfo.txt
\pid.txt
\pidloc.txt
HawkEyeKeylogger
\Mozilla\Firefox\Profiles
127.0.0.1
\SteamAppData.vdf
\ClientRegistry.blob
MessageBoxIcon.Error
MessageBoxIcon.Exclamation
MessageBoxIcon.Question
Dear HawkEye Customers!
HawkEye Admin
HawkEye Logger Details
Keylogger Enabled:
Operating System:
HawkEye_Keylogger_Execution_Confirmed_
HawkEye Keylogger | Execution Confirmed |
<b>Dear HawkEye Customer!</b><br><br>This is a notification generated by
after successful injection of your server.<br><br><b>Best Regards<br>HawkEye Admin<br><br><br>************************************************************<br>HawkEye Keylogger's Detail<br>************************************************************<br>Server Name: </b>
<br><b>Keylogger Enabled: </b>
<br><b>Operating System: </b>
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
autorun.inf
open=Sys.exe
Sys.exe
Software\Microsoft\Windows\CurrentVersion\Run
Windows Update
\bitcoin\wallet.dat
_wallet.dat
wallet.dat
Microsoft.NET\Framework\v2.0.50727\vbc.exe
holdermail.txt"
holdermail.txt
Source:{4}{4}{0}{5}Host:{4}{4}{1}{5}Username:{4}{2}{5}Password:{4}{3}{5}{5}
Operating System Intel Recovery
Operating System Platform:
Operating System Version:
HawkEye_Keylogger_Recoveries_
HawkEye Keylogger | Recoveries |
<b>****************************************************<br>Operating System Intel Recovery<br>****************************************************<br>PC Name: </b>
<br><b>Operating System Platform: </b>
<br><b>Operating System Version: </b>
C:\Users\
_Pin0.jpeg
_Pin1.jpeg
_Pin2.jpeg
_Pin3.jpeg
_Pin4.jpeg
HawkEye Keylogger | RuneScape Recoveries |
Dear HawkEye Customer!
HawkEye Keylogger | BitCoin Recoveries |
As you can see, this email has attached file(s) containing the wallet.dat file which holds the users Bitcoin Currency.
\.minecraft\lastlogin
HawkEye Keylogger | MineCraft Recoveries |
As you can see, this email has the attached file(s) containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.
HawkEye Keylogger | Keyboard
Keyboard Records
.jpeg
HawkEye_Keylogger_Keylog_Records_
PTF://
HawkEye Keylogger | Keyboard <> Clipboards Records |
<br><b>**************************************<br>Keyboard Records<br>**************************************</b>
hXXp://192.99.212.64/WebPanel/log.php?username=
hXXp://whatismyipaddress.com/
Stub.Resources
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
\Google\Chrome\User Data\Default\Login Data
logins
origin_url
password_value
moz_logins
formSubmitURL
encryptedPassword
\Mozilla Firefox\
mozglue.dll
\sitemanager.xml
\recentservers.xml
;Server=(?<server>.*?);Port=(?<port>.*?);Password=(?<password>.*?);User=(?<username>.*?);
port
password
C:\cftp\Ftplist.txt
\cftp\Ftplist.txt
\FTP Commander Deluxe\Ftplist.txt
password = (?<password>.*?)
hXXp://dyn.com/dns/
\Dyn\Updater\daemon.cfg
\Dyn\Updater\config.dyndns
hXXps://VVV.noip.com/
CKey
SOFTWARE\Microsoft\Windows NT\CurrentVersion

%original file name%.exe_1140_rwx_00400000_00122000:

.text
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
`.rdata
@.data
.rsrc
%UUUU3
tcPW
-4-4--567
%s%2.2X
Browser Password Dump
%s v%s by SecurityXploded
hXXp://securityxploded.com/browser-password-dump.php
BrowserPasswordDump
%s.exe [-h | -f <output_file_name>]
//Dump login passwords from all the Browsers to console
%s.exe
//Dump login passwords from all the Browsers to a file 'c:\passlist.txt'
%s.exe -f "c:\passlist.txt"
%s.exe -h
pstorec.dll
http:/
https:/
abe2869f-9b47-4cd9-a358-c22904dba7f7
hXXps://%s
hXXp://%s
Cannot close vault. Error (%d)
Web Data
Login Data
select * from logins where blacklisted_by_user=0;
\MapleStudio\ChromePlus\User Data\Default\
\Google\Chrome SxS\User Data\Default\
\Google\Chrome\User Data\Default\
Opera\Opera\
Opera\Opera\profile\
wand.dat
<key>account</key>
passwords
<key>data</key>
<key>server</key>
%s\Safari\Apple Application Support\plutil.exe
%s\Apple\Apple Application Support\plutil.exe
%s\%s\keychain.plist
%skeytest.tmp
"%s" -convert xml1 -s -o "%s" "%s"
Google Chrome
Opera Browser
Firefox
Chrome SXS
SeaMonkey
Browser: %s
Website: %s
Username: %s
Password: %s
vaultcli.dll
Error: Failed to create file '%s' for writing Password list. Make sure you have specified correct & full file path
Browser Password Recovery Report
Website URL
Password
Produced by %s from hXXp://VVV.SecurityXploded.com
Tip: For more options type %s.exe -h
This is command-line application. Kindly Run it from the CMD Prompt
Press any key to exit....
SOFTWARE\Clients\StartMenuInternet\SEAMONKEY.EXE\shell\open\command
SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command
Mozilla\SeaMonkey
Mozilla\Firefox
\profiles.ini
select * from moz_logins;
/signons.txt
/signons2.txt
/signons3.txt
\signons.sqlite
nss3.dll
PK11_GetInternalKeySlot
PK11_CheckUserPassword
SQLite format 3
CREATE TABLE sqlite_master(
sql text
CREATE TEMP TABLE sqlite_temp_master(
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
3.6.16
sqlite_version
RowKey
SQL logic error or missing database
large file support is disabled
sqlite_detach
sqlite_attach
d-d-d d:d:d
d:d:d
d-d-d
922337203685477580
%s\etilqs_
OsError 0x%x (%u)
invalid page number %d
2nd reference to page %d
Failed to read ptrmap key=%d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
%d of %d pages missing from overflow list starting at %d
failed to get page %d
freelist leaf count too big on page %d
Page %d:
unable to get the page. error code=%d
sqlite3BtreeInitPage() returns error code %d
On tree page %d cell %d:
On page %d at right child:
Corruption detected in header on page %d
Corruption detected in cell %d on page %d
Multiple uses for byte %d of page %d
Fragmented space is %d byte reported as %d on page %d
Page %d is never used
Pointer map page %d is referenced
Outstanding page count goes from %d to %d during this analysis
keyinfo(%d
%s(%d)
%s-mjX
unable to use function %s in the requested context
cannot open savepoint - SQL statements in progress
no such savepoint: %s
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_temp_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s
database table is locked: %s
cannot open virtual table: %s
cannot open view: %s
no such column: "%s"
cannot open indexed column for writing
cannot open value of type %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s
%s: %s
not authorized to use function: %s
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
too many SQL variables
too many columns in %s
misuse of aggregate: %s()
%.*s"%w"%s
sqlite_rename_table
sqlite_rename_trigger
%s OR name=%Q
there is already another table or index with this name: %s
sqlite_
table %s may not be altered
view %s may not be altered
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
sqlite_sequence
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_stat1
CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
SELECT idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
too many attached databases - max %d
database %s is already in use
unable to open database: %s
no such database: %s
cannot detach database %s
database %s is locked
%s %T cannot reference objects in database %s
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
there is already an index named %s
too many columns on %s
duplicate column name: %s
default value of column [%s] is not constant
table "%s" has more than one primary key
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
no such collation sequence: %s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE TABLE %Q.sqlite_sequence(name,seq)
view %s is circularly defined
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
indexed columns are not unique
table %s may not be indexed
views may not be indexed
virtual tables may not be indexed
there is already a table named %s
index %s already exists
sqlite_autoindex_%s_%d
table %s has no column named %s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
unable to identify the object to be reindexed
table %s may not be modified
cannot modify %s because it is a view
table %S has %d columns but %d values were supplied
%d values for %d columns
table %S has no column named %s
%s.%s may not be NULL
PRIMARY KEY must be unique
sqlite3_extension_init
unable to open shared library [%s]
no entry point [%s] in shared library [%s]
error during initialization: %s
automatic extension loading failed: %s
foreign_key_list
*** in database %s ***
unsupported encoding: %s
malformed database schema (%s)
%s - %s
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s
database schema is locked: %s
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
%s.%s
%s:%d
ORDER BY clause should come after %s not before
LIMIT clause should come after %s not before
SELECTs to the left and right of %s do not have the same number of result columns
no such index: %s
sqlite_subquery_%p_
no such table: %s
sqlite3_get_table() called with two or more incompatible queries
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
-- TRIGGER %s
no such column: %s
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor did not declare schema: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
cannot use index: %s
TABLE %s
%s AS %s
%s WITH INDEX %s
%s VIA MULTI-INDEX UNION
%s USING PRIMARY KEY
%s VIRTUAL TABLE INDEX %d:%s
%s ORDER BY
unable to close due to unfinished backup operation
no such vfs: %s
GetProcessWindowStation
operator
GetProcessHeap
KERNEL32.dll
RegCloseKey
RegOpenKeyExA
ADVAPI32.dll
SHELL32.dll
ole32.dll
CRYPT32.dll
GetCPInfo
OLEAUT32.dll
zcÁ
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
kernel32.dll
\StringFileInfo\xx\%s
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msimn.exe
outlook.exe
msimn.exe
%Program Files%\Microsoft Office\Office\Outlook.exe
Email Password Dump
hXXp://securityxploded.com/email-password-dump.php
EmailPasswordDump
//Dump all the Email passwords to console
//Dump all the Email passwords to a file "c:\passlist.txt"
\.purple\accounts.xml
<password>
</password>
%s\%s
@gmail.com
@yahoo.com
Software\Paltalk\%s
Software\Google\Google Talk\Accounts\%s
Microsoft_WinInet_VVV.google.com:443
%sMiranda_Mirror_%d.bin
LoginPassword
LoginName
LoginServer
gmail.com
%s\%s\%s.dat
pop3password=
esmtpaccount=
esmtppassword=
smtphost=
SmtpPassword
ESMTPAccountKey
c:\Program Files\Foxmail\mail
%s\%s\Account.stg
%Program Files%\Foxmail 7.0\Data\AccCfg\Accounts.tdat
PopPassword
SmtpAccount
SmtpServer
%s\%s\Accounts
%s\%s\Accounts\%s
Mozilla Thunderbird
Windows Live Mail
Windows Credential Manager
Application:%s
Email ID: %s
WindowsLive:name=*
Software\Microsoft\Windows Live Mail
<SMTP_Email_Address
<POP3_Port
<POP3_Password2
<IMAP_Port
<IMAP_Password2
<HTTPMail_Server
<HTTPMail_User_Name
<HTTPMail_Password2
<SMTP_Server
<SMTP_Port
<SMTP_User_Name
<SMTP_Password2
hXXps://
00000050
.oeaccount
Software\Microsoft\IdentityCRL\Creds\%s
ps:password
Email Password Recovery Report
Produced by EmailPasswordDump v%s from hXXp://VVV.SecurityXploded.com
SOFTWARE\Clients\Mail\Mozilla Thunderbird\shell\open\command
kpstorec.dll
220D5CC1-853A-11D0-84BC-00C04FD43F8F
417e2d75-84bd-11d0-84bb-00c04fd43f8f
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
IMAP Password
IMAP Port
POP3 Password
POP3 Port
SMTP User
SMTP Password
SMTP Server
SMTP Port
HTTP User
HTTP Password
HTTP Server URL
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows Messaging Subsystem\Profiles
%s\%s\%s
%s\%s\%s\%s
SMTP Email Address
IMAP Password2
POP3 Password2
SMTP User Name
SMTP Password2
HTTPMail User Name
HTTPMail Password2
HTTPMail Server
LDAP Password2
Specified master password "%s" is wrong. Please try again with correct password
GetWindowsDirectoryA
RegEnumKeyExA
USERENV.dll
VERSION.dll
RPCRT4.dll
v2.0.50727
Stub.exe
Microsoft.VisualBasic
System.Windows.Forms
System.Drawing
System.Management
System.Xml
tapi32.dll
rtm.dll
user32.dll
ntdll.dll
Crypt32.dll
Stub.Form1.resources
Stub.Resources.resources
Stub.My
WindowsFormsApplicationBase
Microsoft.VisualBasic.ApplicationServices
System.Collections.Generic
.ctor
.cctor
System.Diagnostics
System.Threading
System.Runtime.CompilerServices
System.ComponentModel
System.CodeDom.Compiler
Microsoft.VisualBasic.Devices
m_MyWebServicesObjectProvider
get_WebServices
HelpKeywordAttribute
System.ComponentModel.Design
WebServices
Microsoft.VisualBasic.CompilerServices
System.Collections
System.Reflection
ContainsKey
InvalidOperationException
MyWebServices
System.Runtime.InteropServices
encryptedpassstring
encryptedsmtpstring
portstring
encryptedftphost
encryptedftpuser
encryptedftppass
useftp
websitevisitor
websiteblocker
fakeMSGholder
passstring
smtpstring
ftphost
ftpuser
ftppass
WM_KEYUP
WM_KEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYUP
KeyboardHandle
KeyLog
CleanedPasswordsMAIL
CleanedPasswordsWB
System.IO
get_ExecutablePath
WindowsIdentity
System.Security.Principal
set_WindowState
FormWindowState
UnhookWindowsHookEx
SetWindowsHookEx
SetWindowsHookExA
GetAsyncKeyState
vKey
HookKeyboard
UnhookKeyboard
Operators
get_Keyboard
Keyboard
get_CtrlKeyDown
get_AltKeyDown
KeyboardCallback
set_UseShellExecute
Microsoft.VisualBasic.MyServices
System.Collections.ObjectModel
MsgBox
MsgBoxResult
MsgBoxStyle
ForceSteamLogin
System.Net.NetworkInformation
get_OperationalStatus
OperationalStatus
FakemsgInstall
System.Net.Mail
SmtpClient
System.Globalization
set_Port
System.Net
Microsoft.Win32
RegistryKey
OpenSubKey
System.Security.Cryptography
System.Text
set_Key
StealPasswords
stealWebroswers
WebClient
readweb
System.IO.Compression
SendLogsFTP
FtpWebRequest
WebRequest
UploadFTP
secretKey
set_KeySize
get_KeySize
System.Net.Sockets
virtualKey
KeyboardHookDelegate
get_Msg
System.Security
ProcessHandle
Stub.My.Resources
System.Resources
get_WebBrowserPassView
WebBrowserPassView
System.Configuration
GoogleChrome
MozillaFirefox
loadCerts
FTPCommander
System.Text.RegularExpressions
WindowsKey
SQLite
SQLDataTypeSize
sqlite_master_entry
sql_statement
Passwords
PasswordSource
FtpCommander
8.0.0.0
My.Computer
My.Application
My.User
My.Forms
My.WebServices
System.Windows.Forms.Form
My.MyProject.Forms
4System.Web.Services.Protocols.SoapHttpClientProtocol
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
12.0.0.0
My.Settings
$3e46a124-e015-4b12-9390-f16ac4d7ad53
1.0.0.0
_CorExeMain
mscoree.dll
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
{3C374A40-BAE4-11CF-BF7D-00AA006946EE}
{AFA0DC11-C313-11D0-831A-00C04FD5AE38}
hXXp://
Hmscoree.dll
- CRT not initialized
- Attempt to initialize the CRT more than once.
- floating point support not loaded
Fkernel32.dll
USER32.DLL
hXXp://VVV.facebook.com/
hXXps://VVV.facebook.com/
hXXp://twitter.com/
hXXps://twitter.com/
hXXps://login.yahoo.com/config/login
hXXps://pinterest.com/login/
hXXp://VVV.linkedin.com/
hXXps://my.screenname.aol.com/_cqr/login/login.psp
hXXps://VVV.amazon.com/ap/signin/190-9059340-4656153
hXXps://signin.ebay.com/ws/ebayisapi.dll
hXXps://accounts.google.com/servicelogin
hXXps://VVV.google.com/accounts/servicelogin
hXXp://digg.com
hXXp://VVV.myspace.com
hXXps://myspace.com
hXXps://VVV.amazon.com/gp/css/homepage.html
hXXp://VVV.stumbleupon.com/sign_up.php
hXXp://slashdot.org/bookmark.pl
hXXp://VVV.reddit.com/login
1200000
noftp
MessageBoxIcon.Information
Disablecmd
\Windows Update.exe
\WindowsUpdate.exe
SysInfo.txt
\pid.txt
\pidloc.txt
HawkEyeKeylogger
\Mozilla\Firefox\Profiles
127.0.0.1
\SteamAppData.vdf
\ClientRegistry.blob
MessageBoxIcon.Error
MessageBoxIcon.Exclamation
MessageBoxIcon.Question
Dear HawkEye Customers!
HawkEye Admin
HawkEye Logger Details
Keylogger Enabled:
Operating System:
HawkEye_Keylogger_Execution_Confirmed_
HawkEye Keylogger | Execution Confirmed |
<b>Dear HawkEye Customer!</b><br><br>This is a notification generated by
after successful injection of your server.<br><br><b>Best Regards<br>HawkEye Admin<br><br><br>************************************************************<br>HawkEye Keylogger's Detail<br>************************************************************<br>Server Name: </b>
<br><b>Keylogger Enabled: </b>
<br><b>Operating System: </b>
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
autorun.inf
open=Sys.exe
Sys.exe
Software\Microsoft\Windows\CurrentVersion\Run
Windows Update
\bitcoin\wallet.dat
_wallet.dat
wallet.dat
Microsoft.NET\Framework\v2.0.50727\vbc.exe
holdermail.txt"
holdermail.txt
Source:{4}{4}{0}{5}Host:{4}{4}{1}{5}Username:{4}{2}{5}Password:{4}{3}{5}{5}
Operating System Intel Recovery
Operating System Platform:
Operating System Version:
HawkEye_Keylogger_Recoveries_
HawkEye Keylogger | Recoveries |
<b>****************************************************<br>Operating System Intel Recovery<br>****************************************************<br>PC Name: </b>
<br><b>Operating System Platform: </b>
<br><b>Operating System Version: </b>
C:\Users\
_Pin0.jpeg
_Pin1.jpeg
_Pin2.jpeg
_Pin3.jpeg
_Pin4.jpeg
HawkEye Keylogger | RuneScape Recoveries |
Dear HawkEye Customer!
HawkEye Keylogger | BitCoin Recoveries |
As you can see, this email has attached file(s) containing the wallet.dat file which holds the users Bitcoin Currency.
\.minecraft\lastlogin
HawkEye Keylogger | MineCraft Recoveries |
As you can see, this email has the attached file(s) containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.
HawkEye Keylogger | Keyboard
Keyboard Records
.jpeg
HawkEye_Keylogger_Keylog_Records_
PTF://
HawkEye Keylogger | Keyboard <> Clipboards Records |
<br><b>**************************************<br>Keyboard Records<br>**************************************</b>
hXXp://192.99.212.64/WebPanel/log.php?username=
hXXp://whatismyipaddress.com/
Stub.Resources
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
\Google\Chrome\User Data\Default\Login Data
logins
origin_url
password_value
moz_logins
formSubmitURL
encryptedPassword
\Mozilla Firefox\
mozglue.dll
\sitemanager.xml
\recentservers.xml
;Server=(?<server>.*?);Port=(?<port>.*?);Password=(?<password>.*?);User=(?<username>.*?);
port
password
C:\cftp\Ftplist.txt
\cftp\Ftplist.txt
\FTP Commander Deluxe\Ftplist.txt
password = (?<password>.*?)
hXXp://dyn.com/dns/
\Dyn\Updater\daemon.cfg
\Dyn\Updater\config.dyndns
hXXps://VVV.noip.com/
CKey
SOFTWARE\Microsoft\Windows NT\CurrentVersion

%original file name%.exe_1140_rwx_675A6000_00003000:

.Qg<-Qg
*Rg`.Rg|)RgL Rg


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    vbc.exe:2168
    vbc.exe:2500
    %original file name%.exe:856

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (400 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\C0AF5F80AA0D55CA55AD4471DD73D761 (793 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (2712 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (49 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\140B4CDED8ED877CDC65B54BA965BD39 (1 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (54 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\140B4CDED8ED877CDC65B54BA965BD39 (168 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\0AE1A896B17983DA2D3F15114E2248F0 (7 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\C0AF5F80AA0D55CA55AD4471DD73D761 (168 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (49 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\0AE1A896B17983DA2D3F15114E2248F0 (184 bytes)
    %Documents and Settings%\%current user%\Application Data\pid.txt (4 bytes)
    %Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe (11518 bytes)
    %System%\wbem\Logs\wbemprox.log (150 bytes)
    %Documents and Settings%\%current user%\Application Data\pidloc.txt (39 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Windows Update" = "%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  7. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now