Gen.Variant.Razy.70833_a261c5149a – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

schtasks.exe:376
%original file name%.exe:1552

The Trojan injects its code into the following process(es):

RegAsm.exe:1564

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1552 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7 (256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\z532 (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Application Data\nssg.exe (245 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\C86BD7751D53F10F65AAAD66BBDF33C7 (955 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\z532 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (0 bytes)

The process RegAsm.exe:1564 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)

Registry activity

The process schtasks.exe:376 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E5 E9 3A 7C E9 2A 22 C0 98 A8 16 6A 18 8A C3 A6"

The process %original file name%.exe:1552 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 9E 5E 24 BF 2D 22 55 16 5D 0B EE 35 A0 8D FD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"schtasks.exe" = "Schedule Tasks"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43]
"Blob" = "04 00 00 00 01 00 00 00 10 00 00 00 87 CE 0B 7B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"

The process RegAsm.exe:1564 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 05 FD 28 22 76 37 FE B8 1D 8C D7 EF 7A A4 93"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\WinRAR]
"HWID" = "7B 33 41 44 30 42 36 30 38 2D 45 43 36 34 2D 34"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
schtasks.exe:376
%original file name%.exe:1552
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7 (256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\z532 (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Application Data\nssg.exe (245 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\C86BD7751D53F10F65AAAD66BBDF33C7 (955 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	161492	161792	5.02188	fb88b7fe932df84b449740516809e4f0
.rsrc	172032	76608	76800	4.28245	7c779d9f1ff816e04bbc73f0ba948085
.reloc	253952	12	512	0.070639	e6e6da8ab465b097b50955778f9ba8da

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

RegAsm.exe_1564:

.text

`.rdata

@.data

t.hAHA

More information: hXXp://VVV.ibsensoftware.com/

password

12345678

password1

monkey

1234567

123456789

7777777

asshole

mickey

passw0rd

smokey

hockey

11111111

windows

1234567890

hXXp://hurricanspin.ru/cyril-16June-16July/gate.php

hXXp://viiczar.com/html/10.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

kernel32.dll

netapi32.dll

ole32.dll

advapi32.dll

CryptGetUserKey

CryptExportKey

CryptDestroyKey

crypt32.dll

CertOpenSystemStoreA

CertEnumCertificatesInStore

CertCloseStore

CryptAcquireCertificatePrivateKey

msi.dll

pstorec.dll

^shell32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

explorer.exe

POST %s HTTP/1.0

Host: %s

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)

GET %s HTTP/1.0

{X-X-X-XX-XXXXXX}

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

Password

wcx_PTF.ini

FtpIniName

Software\Ghisler\Windows Commander

\Ipswitch\WS_FTP

\win.ini

WS_FTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

\sm.dat

\Sites.dat

\Quick.dat

\History.dat

\sitemanager.xml

\recentservers.xml

\filezilla.xml

Port

Server.Host

Server.User

Server.Pass

Server.Port

Last Server Pass

Last Server Port

FTP Navigator

FTP Commander

ftplist.txt

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

addrbk.dat

quick.dat

\TurboFTP

Software\TurboFTP

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

PasswordType

Login

FtpSite.xml

\sites.xml

\FTPRush

RushSite.xml

FtpPort

Software\Cryer\WebSitePublisher

bitkinex.ds

\drives.js

"password" : "

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpServer

FtpUserName

FtpPassword

_FtpPassword

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

ftplast.osd

\SharedSettings.ccs

\SharedSettings_1_0_5.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.sqlite

leapftp

unleap.exe

sites.dat

sites.ini

\LeapWare\LeapFTP

PortNumber

\32BitFtp.ini

NDSites.ini

PassWord

Software\South River Technologies\WebDrive\Connections

FTP CONTROL

FTPCON

hXXp://

hXXps://

PTF://

opera

wand.dat

_Software\Opera Software

Opera.HTML\shell\open\command

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

wiseftpsrvs.ini

wisePTF.ini

FTPVoyager.ftp

FTPVoyager.qc

\RhinoSoft.com

nss3.dll

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3_open

sqlite3_close

sqlite3_prepare

sqlite3_step

sqlite3_column_bytes

sqlite3_column_blob

mozsqlite3.dll

profiles.ini

PathToExe

prefs.js

signons.sqlite

signons.txt

signons2.txt

signons3.txt

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

Firefox

\Mozilla\Firefox\

Software\Mozilla

fireFTPsites.dat

SeaMonkey

\Mozilla\SeaMonkey\

Mozilla

\Mozilla\Profiles\

Software\LeechFTP

bookmark.dat

SiteInfo.QFP

WinFTP

sites.db

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

servers.xml

\FTPGetter

ESTdb2.dat

QData.dat

\Estsoft\ALFTP

MS IE FTP Passwords

SiteServer %d\Host

SiteServer %d\WebUrl

SiteServer %d\Remote Directory

SiteServer %d-User

SiteServer %d-User PW

%s\Keychain

SiteServer %d\SFTP

DeluxeFTP

sites.xml

Web Data

Login Data

SQLite format 3

logins

origin_url

password_value

\Google\Chrome

\ChromePlus

Software\ChromePlus

\Nichrome

Staff-FTP

SM.arch

FreshFTP

BlazeFtp

site.dat

LastPassword

LastPort

Software\FlashPeak\BlazeFtp\Settings

\BlazeFtp

FTP .Link\shell\open\command

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

password 51:b:

FTP Now

FTPNow

SOFTWARE\Robo-FTP 3.7\Scripts

SOFTWARE\Robo-FTP 3.7\FTPServers

FTP Count

FTP File%d

2.5.29.37

Software\LinasFTP\Site Manager

.duck

user.config

NppFTP.xml

FTP destination server

FTP destination user

FTP destination password

FTP destination port

FTP destination catalog

FTP profiles

FTPShell

ftpshell.fsi

Software\MAS-Soft\FTPInfo\Setup

\FTPInfo

ServerList.xml

ftpsite.ini

FTPList.db

\MapleStudio\ChromePlus

Software\Nico Mak Computing\WinZip\FTP

My FTP

project.ini

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

NovaFTP.db

\INSoftware\NovaFTP

.oeaccount

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Mail

Software\Microsoft\Windows Mail

Mailbox.ini

\PocoSystem.ini

accounts.ini

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

account.cfg

account.cfn

Dir #%d

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTP Password

SMTP Password

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

inetcomm server passwords

outlook account manager passwords

STATUS-IMPORT-OK

%d.exe

%d.bat

ShellExecuteA

shell32.dll

;3 #>6.&

'2, / 0&7!4-)1#

GetWindowsDirectoryA

user32.dll

RegOpenKeyExA

RegCloseKey

RegOpenKeyA

RegEnumKeyExA

RegCreateKeyA

InternetCrackUrlA

InternetCreateUrlA

wininet.dll

shlwapi.dll

wsock32.dll

userenv.dll

2hXXp://VVV.facebook.com/

xthpt/:w/wwf.cabeoo.koc/m

RegAsm.exe_1564_rwx_00400000_00019000:

.text

`.rdata

@.data

t.hAHA

More information: hXXp://VVV.ibsensoftware.com/

password

12345678

password1

monkey

1234567

123456789

7777777

asshole

mickey

passw0rd

smokey

hockey

11111111

windows

1234567890

hXXp://hurricanspin.ru/cyril-16June-16July/gate.php

hXXp://viiczar.com/html/10.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

kernel32.dll

netapi32.dll

ole32.dll

advapi32.dll

CryptGetUserKey

CryptExportKey

CryptDestroyKey

crypt32.dll

CertOpenSystemStoreA

CertEnumCertificatesInStore

CertCloseStore

CryptAcquireCertificatePrivateKey

msi.dll

pstorec.dll

^shell32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

explorer.exe

POST %s HTTP/1.0

Host: %s

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)

GET %s HTTP/1.0

{X-X-X-XX-XXXXXX}

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

Password

wcx_PTF.ini

FtpIniName

Software\Ghisler\Windows Commander

\Ipswitch\WS_FTP

\win.ini

WS_FTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

\sm.dat

\Sites.dat

\Quick.dat

\History.dat

\sitemanager.xml

\recentservers.xml

\filezilla.xml

Port

Server.Host

Server.User

Server.Pass

Server.Port

Last Server Pass

Last Server Port

FTP Navigator

FTP Commander

ftplist.txt

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

addrbk.dat

quick.dat

\TurboFTP

Software\TurboFTP

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

PasswordType

Login

FtpSite.xml

\sites.xml

\FTPRush

RushSite.xml

FtpPort

Software\Cryer\WebSitePublisher

bitkinex.ds

\drives.js

"password" : "

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpServer

FtpUserName

FtpPassword

_FtpPassword

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

ftplast.osd

\SharedSettings.ccs

\SharedSettings_1_0_5.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.sqlite

leapftp

unleap.exe

sites.dat

sites.ini

\LeapWare\LeapFTP

PortNumber

\32BitFtp.ini

NDSites.ini

PassWord

Software\South River Technologies\WebDrive\Connections

FTP CONTROL

FTPCON

hXXp://

hXXps://

PTF://

opera

wand.dat

_Software\Opera Software

Opera.HTML\shell\open\command

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

wiseftpsrvs.ini

wisePTF.ini

FTPVoyager.ftp

FTPVoyager.qc

\RhinoSoft.com

nss3.dll

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3_open

sqlite3_close

sqlite3_prepare

sqlite3_step

sqlite3_column_bytes

sqlite3_column_blob

mozsqlite3.dll

profiles.ini

PathToExe

prefs.js

signons.sqlite

signons.txt

signons2.txt

signons3.txt

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

Firefox

\Mozilla\Firefox\

Software\Mozilla

fireFTPsites.dat

SeaMonkey

\Mozilla\SeaMonkey\

Mozilla

\Mozilla\Profiles\

Software\LeechFTP

bookmark.dat

SiteInfo.QFP

WinFTP

sites.db

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

servers.xml

\FTPGetter

ESTdb2.dat

QData.dat

\Estsoft\ALFTP

MS IE FTP Passwords

SiteServer %d\Host

SiteServer %d\WebUrl

SiteServer %d\Remote Directory

SiteServer %d-User

SiteServer %d-User PW

%s\Keychain

SiteServer %d\SFTP

DeluxeFTP

sites.xml

Web Data

Login Data

SQLite format 3

logins

origin_url

password_value

\Google\Chrome

\ChromePlus

Software\ChromePlus

\Nichrome

Staff-FTP

SM.arch

FreshFTP

BlazeFtp

site.dat

LastPassword

LastPort

Software\FlashPeak\BlazeFtp\Settings

\BlazeFtp

FTP .Link\shell\open\command

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

password 51:b:

FTP Now

FTPNow

SOFTWARE\Robo-FTP 3.7\Scripts

SOFTWARE\Robo-FTP 3.7\FTPServers

FTP Count

FTP File%d

2.5.29.37

Software\LinasFTP\Site Manager

.duck

user.config

NppFTP.xml

FTP destination server

FTP destination user

FTP destination password

FTP destination port

FTP destination catalog

FTP profiles

FTPShell

ftpshell.fsi

Software\MAS-Soft\FTPInfo\Setup

\FTPInfo

ServerList.xml

ftpsite.ini

FTPList.db

\MapleStudio\ChromePlus

Software\Nico Mak Computing\WinZip\FTP

My FTP

project.ini

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

NovaFTP.db

\INSoftware\NovaFTP

.oeaccount

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Mail

Software\Microsoft\Windows Mail

Mailbox.ini

\PocoSystem.ini

accounts.ini

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

account.cfg

account.cfn

Dir #%d

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTP Password

SMTP Password

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

inetcomm server passwords

outlook account manager passwords

STATUS-IMPORT-OK

%d.exe

%d.bat

ShellExecuteA

shell32.dll

;3 #>6.&

'2, / 0&7!4-)1#

GetWindowsDirectoryA

user32.dll

RegOpenKeyExA

RegCloseKey

RegOpenKeyA

RegEnumKeyExA

RegCreateKeyA

InternetCrackUrlA

InternetCreateUrlA

wininet.dll

shlwapi.dll

wsock32.dll

userenv.dll

2hXXp://VVV.facebook.com/

xthpt/:w/wwf.cabeoo.koc/m

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps