Trojan.Win32.Inject.tpbc (Kaspersky), GenericInjector.YR, BackdoorCaphaw_QKKBAL.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: a06a37879975b87d4795eb1ebeadd1f3
SHA1: 6881217f75dc0282d0b8532990e3f1d864633848
SHA256: eba0d3108fa62296629c0a211e7461c658a094ca425e3a3133d27696795abceb
SSDeep: 6144:cUS yHo14FSr4T2NJYgu8S88EBj2SQRZ6vwwOYHIEg1y:c 1ycw2NdVqe2SQCvuYHIEg1
Size: 352256 bytes
File type: DLL
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2004-08-22 01:34:03
Analyzed on: WindowsXP SP3 32-bit
Summary: Backdoor. Malware that enables a remote control of victim's machine.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Backdoor creates the following process(es):
regsvr32.exe:128
regsvr32.exe:148
The Backdoor injects its code into the following process(es):
imapi.exe:1320
vmacthlp.exe:896
Explorer.EXE:932
spoolsv.exe:1460
jqs.exe:1628
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process regsvr32.exe:128 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\SaduMogaz\XamaPteq.wcd (2321 bytes)
The process regsvr32.exe:148 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\~00110155.tmp (1694 bytes)
Registry activity
The process regsvr32.exe:128 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 DD 9C A2 C2 00 05 36 8D D2 FB 07 3E 70 7F 40"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
To automatically run itself each time Windows is booted, the Backdoor adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SaduMogaz" = "regsvr32.exe %Documents and Settings%\All Users\Application Data\SaduMogaz\XamaPteq.wcd"
The process regsvr32.exe:148 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 F2 64 C7 B1 27 A0 27 9D E6 A6 DC 69 4A EF AE"
[HKCU\Software\{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}]
"anagdcbpcckmkmpl" = "F5 FA B2 80 BF FD A9 69 C2 D9 7D 40 EA E4 69 DE"
The process imapi.exe:1320 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
The process vmacthlp.exe:896 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKU\.DEFAULT\Software\{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}]
"aealkooihnlm" = "4E CF AB 3C"
Dropped PE files
MD5 | File path |
---|---|
eb19749decd7ef2d44932a216cd12c9a | c:\Documents and Settings\All Users\Application Data\SaduMogaz\XamaPteq.wcd |
eb19749decd7ef2d44932a216cd12c9a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\~00110155.tmp |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
The Backdoor installs the following user-mode hooks in CRYPT32.dll:
PFXImportCertStore
The Backdoor installs the following user-mode hooks in ADVAPI32.dll:
CreateProcessAsUserA
CreateProcessAsUserW
The Backdoor installs the following user-mode hooks in kernel32.dll:
CreateProcessA
CreateProcessW
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
regsvr32.exe:128
regsvr32.exe:148 - Delete the original Backdoor file.
- Delete or disinfect the following files created/modified by the Backdoor:
%Documents and Settings%\All Users\Application Data\SaduMogaz\XamaPteq.wcd (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~00110155.tmp (1694 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SaduMogaz" = "regsvr32.exe %Documents and Settings%\All Users\Application Data\SaduMogaz\XamaPteq.wcd" - Reboot the computer.
Static Analysis
VersionInfo
Company Name: Microsoft Corporation
Product Name: HD Player
Product Version: 5.2.3790.1830
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: UFAT.DLL
Internal Name: UFAT
File Version: 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)
File Description: FAT Utility DLL
Comments:
Language: English (United States)
Company Name: Microsoft CorporationProduct Name: HD Player Product Version: 5.2.3790.1830Legal Copyright: (c) Microsoft Corporation. All rights reserved.Legal Trademarks: Original Filename: UFAT.DLLInternal Name: UFATFile Version: 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)File Description: FAT Utility DLLComments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 318236 | 319488 | 5.40736 | f99671ad4d05c57772fdf0d7d4a2e0f0 |
.rdata | 323584 | 8954 | 12288 | 2.46915 | 99592a630c3fac4b8f9aad7017df7d72 |
.data | 335872 | 11392 | 8192 | 1.7346 | 100e32d6815410bd52639ffcb71048fd |
.rsrc | 348160 | 984 | 4096 | 0.745945 | d91149408ef1cbaa9ce67539094c18d2 |
.reloc | 352256 | 1186 | 4096 | 0.364544 | a9dba3a079c1d2bb30b5c789d8c49335 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Backdoor connects to the servers at the folowing location(s):
Strings from Dumps
Explorer.EXE_932_rwx_02210000_00059000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
HHt.HHt
HHt.HHt
More information: hXXp://VVV.ibsensoftware.com/
More information: hXXp://VVV.ibsensoftware.com/
8HttpAddRequestHeadersA
8HttpAddRequestHeadersA
HttpOpenRequestA
HttpOpenRequestA
HttpOpenRequestW
HttpOpenRequestW
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestA
HttpSendRequestExA
HttpSendRequestExA
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestW
HttpSendRequestW
wininet.dll
wininet.dll
rapport
rapport
ieframe.dll
ieframe.dll
NSPR4.DLL
NSPR4.DLL
nss3.dll
nss3.dll
KERNEL32.DLL
KERNEL32.DLL
\Google\Chrome\User Data\Default\
\Google\Chrome\User Data\Default\
\Mozilla\Firefox\Profiles\
\Mozilla\Firefox\Profiles\
sol_chrome/
sol_chrome/
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\
tor2web.org
tor2web.org
hXXps://%s.%s/favicon.ico
hXXps://%s.%s/favicon.ico
.rdata
.rdata
@http
@http
SELECT url FROM moz_places
SELECT url FROM moz_places
places.sqlite
places.sqlite
ie/history.txt
ie/history.txt
ff/history.txt
ff/history.txt
ff/%u/places.sqlite
ff/%u/places.sqlite
framework_key%
framework_key%
eval('var %s '
eval('var %s '
%s.Key = '%s';
%s.Key = '%s';
%s.Hide('%0.8X%0.8X');
%s.Hide('%0.8X%0.8X');
CertificateAuthority
CertificateAuthority
%s.pfx
%s.pfx
cookies.sqlite
cookies.sqlite
cookies.sqlite-journal
cookies.sqlite-journal
ff/%u/cookies.sqlite
ff/%u/cookies.sqlite
c:\test_x32.dll
c:\test_x32.dll
#dbgmsg
#dbgmsg
[%s - X32 EQ PID: %u TID: %u]
[%s - X32 EQ PID: %u TID: %u]
X-Firefox-Spdy
X-Firefox-Spdy
X-WebKit-CSP
X-WebKit-CSP
hXXps://
hXXps://
HTTP/1.1 200 OK
HTTP/1.1 200 OK
Content-Length: %u
Content-Length: %u
GET /favicon.ico HTTP/1.1
GET /favicon.ico HTTP/1.1
GET /favicon.ico HTTP/1.0
GET /favicon.ico HTTP/1.0
login=%s&pass=%s
login=%s&pass=%s
C:\ProgramData
C:\ProgramData
%Documents and Settings%\All Users\Application Data
%Documents and Settings%\All Users\Application Data
chrome.dll
chrome.dll
127.0.0.1
127.0.0.1
DrWeb
DrWeb
McAfee.com
McAfee.com
Doctor Web
Doctor Web
Common Files\Doctor Web
Common Files\Doctor Web
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\
Content-Disposition: form-data; name="%s"
Content-Disposition: form-data; name="%s"
--%s--
--%s--
Content-Disposition: form-data; name="%s"; filename="%s"
Content-Disposition: form-data; name="%s"; filename="%s"
---------------------------%u%0.4x%0.8x
---------------------------%u%0.4x%0.8x
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
id=%0.8X%0.8X%0.8X%0.4X%0.4X%0.4X&iv=%0.8X&av=%0.8X&uptime=%u
id=%0.8X%0.8X%0.8X%0.4X%0.4X%0.4X&iv=%0.8X&av=%0.8X&uptime=%u
&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s&name=%ws&domain=%ws
&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s&name=%ws&domain=%ws
[VNC] Parse param error: %s
[VNC] Parse param error: %s
\regsvr32.exe
\regsvr32.exe
[VNC] Fail create process: %u
[VNC] Fail create process: %u
[VNC] Fail inject to process: %u
[VNC] Fail inject to process: %u
fv_%u.avi
fv_%u.avi
#FV_%u
#FV_%u
#FV_%s
#FV_%s
pass.txt
pass.txt
cert.pfx
cert.pfx
PFXImportCertStore
PFXImportCertStore
Crypt32.dll
Crypt32.dll
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3-1", false);
user_pref("network.http.spdy.enabled.v3-1", false);
user_pref("layers.acceleration.disabled", true);
user_pref("layers.acceleration.disabled", true);
user_pref("gfx.direct2d.disabled", true);
user_pref("gfx.direct2d.disabled", true);
prefs.js
prefs.js
csrss.exe
csrss.exe
smss.exe
smss.exe
wininit.exe
wininit.exe
services.exe
services.exe
svchost.exe
svchost.exe
lsas.exe
lsas.exe
lsm.exe
lsm.exe
winlogon.exe
winlogon.exe
Dbgview.exe
Dbgview.exe
taskhost.exe
taskhost.exe
HttpEndRequestA
HttpEndRequestA
HttpEndRequestW
HttpEndRequestW
%s%s%u
%s%s%u
ADVAPI32.DLL
ADVAPI32.DLL
Init in Browser = %u
Init in Browser = %u
Init in Shell = %u
Init in Shell = %u
[Socks] Failt connect BC [%s:%u]
[Socks] Failt connect BC [%s:%u]
[Socks] Fail parse param: %s
[Socks] Fail parse param: %s
regsvr32.exe "%s"
regsvr32.exe "%s"
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
#cert
#cert
regsvr32.exe /s /i:"%u" "%s"
regsvr32.exe /s /i:"%u" "%s"
[Pony] Fail Get Pass
[Pony] Fail Get Pass
DL_EXEC LOAD ERROR: %u = %s
DL_EXEC LOAD ERROR: %u = %s
DL_EXEC Status [Pipe]: %u-%u-%u-%u
DL_EXEC Status [Pipe]: %u-%u-%u-%u
DL_EXEC Status[Local]: %u = %u
DL_EXEC Status[Local]: %u = %u
Start Socks addr: %s
Start Socks addr: %s
Start Socks Status[Pipe]: %u-%u-%u
Start Socks Status[Pipe]: %u-%u-%u
Start Socks Status[Local]: %u
Start Socks Status[Local]: %u
Start VNC addr: %s
Start VNC addr: %s
Start VNC Status[Pipe]: %u-%u-%u
Start VNC Status[Pipe]: %u-%u-%u
Start VNC Status[Local]: %u
Start VNC Status[Local]: %u
msvcrt.dll
msvcrt.dll
%0.8X%0.8X%c
%0.8X%0.8X%c
firefox.exe
firefox.exe
explorer.exe
explorer.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
\\.\pipe\
\\.\pipe\
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
hXXp://
hXXp://
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
%Program Files%\Mozilla Firefox\
%Program Files%\Mozilla Firefox\
mozsqlite3.dll
mozsqlite3.dll
sqlite3_open
sqlite3_open
sqlite3_exec
sqlite3_exec
sqlite3_close
sqlite3_close
sqlite3_free
sqlite3_free
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
[BC] Cmd Ver Error
[BC] Cmd Ver Error
[BC] Wait Ping error %u[%u]
[BC] Wait Ping error %u[%u]
[BC] Fail Connect: %u
[BC] Fail Connect: %u
[BC] Fail read cmd
[BC] Fail read cmd
[BC] Cmd need reauth
[BC] Cmd need reauth
[BC] cmd error: %u
[BC] cmd error: %u
[BC] Cmd need disconnect
[BC] Cmd need disconnect
ntdll.dll
ntdll.dll
gdiplus.dll
gdiplus.dll
GdiplusShutdown
GdiplusShutdown
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
account.cfg
account.cfg
account.cfn
account.cfn
Dir #%u
Dir #%u
.oeaccount
.oeaccount
Software\Microsoft\Windows Live Mail
Software\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Mail
\Microsoft\Windows Mail
\Microsoft\Windows Mail
PopPort
PopPort
PopPassword
PopPassword
SmtpServer
SmtpServer
SmtpPort
SmtpPort
SmtpAccount
SmtpAccount
SmtpPassword
SmtpPassword
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
MS IE FTP Passwords
MS IE FTP Passwords
Password
Password
Software\Far\Plugins\FTP\Hosts
Software\Far\Plugins\FTP\Hosts
Software\Far2\Plugins\FTP\Hosts
Software\Far2\Plugins\FTP\Hosts
Software\Far Manager\Plugins\FTP\Hosts
Software\Far Manager\Plugins\FTP\Hosts
Software\Far\SavedDialogHistory\FTPHost
Software\Far\SavedDialogHistory\FTPHost
Software\Far2\SavedDialogHistory\FTPHost
Software\Far2\SavedDialogHistory\FTPHost
Software\Far Manager\SavedDialogHistory\FTPHost
Software\Far Manager\SavedDialogHistory\FTPHost
\win.ini
\win.ini
WS_FTP
WS_FTP
\Ipswitch\WS_FTP
\Ipswitch\WS_FTP
\GlobalSCAPE\CuteFTP
\GlobalSCAPE\CuteFTP
sm.dat
sm.dat
\GlobalSCAPE\CuteFTP Pro
\GlobalSCAPE\CuteFTP Pro
\GlobalSCAPE\CuteFTP Lite
\GlobalSCAPE\CuteFTP Lite
\CuteFTP
\CuteFTP
CUTEFTP
CUTEFTP
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
\Sites.dat
\Sites.dat
\Quick.dat
\Quick.dat
\History.dat
\History.dat
Software\BPFTP\Bullet Proof FTP\Main
Software\BPFTP\Bullet Proof FTP\Main
Software\BulletProof Software\BulletProof FTP Client\Main
Software\BulletProof Software\BulletProof FTP Client\Main
Software\BPFTP\Bullet Proof FTP\Options
Software\BPFTP\Bullet Proof FTP\Options
Software\BulletProof Software\BulletProof FTP Client\Options
Software\BulletProof Software\BulletProof FTP Client\Options
Software\BPFTP
Software\BPFTP
\SmartFTP
\SmartFTP
Favorites.dat
Favorites.dat
History.dat
History.dat
Software\TurboFTP
Software\TurboFTP
\TurboFTP
\TurboFTP
addrbk.dat
addrbk.dat
quick.dat
quick.dat
Port
Port
Login
Login
PasswordType
PasswordType
profiles.xml
profiles.xml
\FTP Explorer
\FTP Explorer
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
Software\FTP Explorer\Profiles
Software\FTP Explorer\Profiles
FtpSite.xml
FtpSite.xml
RushSite.xml
RushSite.xml
\FTPRush
\FTPRush
bitkinex.ds
bitkinex.ds
NDSites.ini
NDSites.ini
Software\LeechFTP
Software\LeechFTP
bookmark.dat
bookmark.dat
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
sites.db
sites.db
servers.xml
servers.xml
\FTPGetter
\FTPGetter
ESTdb2.dat
ESTdb2.dat
\Estsoft\ALFTP
\Estsoft\ALFTP
QData.dat
QData.dat
SM.arch
SM.arch
FTP .Link\shell\open\command
FTP .Link\shell\open\command
NppFTP.xml
NppFTP.xml
Software\MAS-Soft\FTPInfo\Setup
Software\MAS-Soft\FTPInfo\Setup
ServerList.xml
ServerList.xml
\FTPInfo
\FTPInfo
NovaFTP.db
NovaFTP.db
\INSoftware\NovaFTP
\INSoftware\NovaFTP
\sites.xml
\sites.xml
ftplast.osd
ftplast.osd
\SharedSettings.ccs
\SharedSettings.ccs
\SharedSettings.sqlite
\SharedSettings.sqlite
\SharedSettings_1_0_5.ccs
\SharedSettings_1_0_5.ccs
\SharedSettings_1_0_5.sqlite
\SharedSettings_1_0_5.sqlite
\32BitFtp.ini
\32BitFtp.ini
FTPCON
FTPCON
FTP CONTROL
FTP CONTROL
FTPVoyager.ftp
FTPVoyager.ftp
\RhinoSoft.com
\RhinoSoft.com
FTPVoyager.qc
FTPVoyager.qc
FTPVoyager.Archive
FTPVoyager.Archive
SiteInfo.QFP
SiteInfo.QFP
WinFTP
WinFTP
DeluxeFTP
DeluxeFTP
sites.xml
sites.xml
Staff-FTP
Staff-FTP
sites.ini
sites.ini
FreshFTP
FreshFTP
Software\FlashPeak\BlazeFtp\Settings
Software\FlashPeak\BlazeFtp\Settings
LastPassword
LastPassword
LastPort
LastPort
BlazeFtp
BlazeFtp
site.dat
site.dat
\BlazeFtp
\BlazeFtp
GoFTP
GoFTP
Connections.txt
Connections.txt
3D-FTP
3D-FTP
\3D-FTP
\3D-FTP
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
EasyFTP
EasyFTP
FTPNow
FTPNow
FTP Now
FTP Now
FTPShell
FTPShell
ftpshell.fsi
ftpshell.fsi
ftpsite.ini
ftpsite.ini
FTPList.db
FTPList.db
My FTP
My FTP
project.ini
project.ini
Mailbox.ini
Mailbox.ini
FTP Navigator
FTP Navigator
FTP Commander
FTP Commander
ftplist.txt
ftplist.txt
Software\Sota\FFFTP
Software\Sota\FFFTP
Software\Sota\FFFTP\Options
Software\Sota\FFFTP\Options
Software\FTPWare\COREFTP\Sites
Software\FTPWare\COREFTP\Sites
FtpPort
FtpPort
Software\Cryer\WebSitePublisher
Software\Cryer\WebSitePublisher
_Password
_Password
Software\NCH Software\ClassicFTP\FTPAccounts
Software\NCH Software\ClassicFTP\FTPAccounts
FtpPassword
FtpPassword
_FtpPassword
_FtpPassword
FtpServer
FtpServer
FtpUserName
FtpUserName
FtpDirectory
FtpDirectory
Software\FTPClient\Sites
Software\FTPClient\Sites
Software\SoftX.org\FTPClient\Sites
Software\SoftX.org\FTPClient\Sites
PortNumber
PortNumber
PassWord
PassWord
Software\South River Technologies\WebDrive\Connections
Software\South River Technologies\WebDrive\Connections
Software\LinasFTP\Site Manager
Software\LinasFTP\Site Manager
FTP destination password
FTP destination password
FTP destination server
FTP destination server
FTP destination port
FTP destination port
FTP destination user
FTP destination user
FTP destination catalog
FTP destination catalog
FTP profiles
FTP profiles
Msi.dll
Msi.dll
{74FF1730-B1F2-4D88-926B-1568FAE61DB7}
{74FF1730-B1F2-4D88-926B-1568FAE61DB7}
\PocoSystem.ini
\PocoSystem.ini
accounts.ini
accounts.ini
sites.dat
sites.dat
\LeapWare\LeapFTP
\LeapWare\LeapFTP
unleap.exe
unleap.exe
leapftp
leapftp
FtpIniName
FtpIniName
Software\Ghisler\Windows Commander
Software\Ghisler\Windows Commander
wcx_PTF.ini
wcx_PTF.ini
Server.Pass
Server.Pass
Server.Host
Server.Host
Server.User
Server.User
Server.Port
Server.Port
Last Server Pass
Last Server Pass
Last Server Port
Last Server Port
\sitemanager.xml
\sitemanager.xml
\recentservers.xml
\recentservers.xml
\filezilla.xml
\filezilla.xml
"password" : "
"password" : "
"password":"
"password":"
\drives.js
\drives.js
\ExpanDrive\favorites.js
\ExpanDrive\favorites.js
\ExpanDrive\drives.js
\ExpanDrive\drives.js
wiseftpsrvs.ini
wiseftpsrvs.ini
wisePTF.ini
wisePTF.ini
wiseftpsrvs.bin
wiseftpsrvs.bin
SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}
SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}
SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}
SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}
FTP Count
FTP Count
FTP File%u
FTP File%u
Robo-FTP
Robo-FTP
SOFTWARE\%s\FTPServers
SOFTWARE\%s\FTPServers
user.config
user.config
.duck
.duck
SiteServer %u\Host
SiteServer %u\Host
SiteServer %u\WebUrl
SiteServer %u\WebUrl
SiteServer %u\Remote Directory
SiteServer %u\Remote Directory
SiteServer %u-User
SiteServer %u-User
SiteServer %u-User PW
SiteServer %u-User PW
SiteServer %u\SFTP
SiteServer %u\SFTP
Keychain
Keychain
Software\Nico Mak Computing\WinZip\FTP
Software\Nico Mak Computing\WinZip\FTP
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
sqlite3.dll
sqlite3.dll
sqlite3_prepare
sqlite3_prepare
sqlite3_step
sqlite3_step
sqlite3_column_bytes
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_column_blob
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins
PTF://
PTF://
signons.sqlite
signons.sqlite
\profiles.ini
\profiles.ini
PathToExe
PathToExe
\Mozilla\Firefox\
\Mozilla\Firefox\
Firefox
Firefox
Software\Mozilla
Software\Mozilla
fireFTPsites.dat
fireFTPsites.dat
\Mozilla\SeaMonkey\
\Mozilla\SeaMonkey\
SeaMonkey
SeaMonkey
\Mozilla\Profiles\
\Mozilla\Profiles\
Mozilla
Mozilla
password 51:b:
password 51:b:
SMTP Email Address
SMTP Email Address
SMTP Server
SMTP Server
SMTP User Name
SMTP User Name
HTTP User
HTTP User
HTTP Server URL
HTTP Server URL
HTTPMail User Name
HTTPMail User Name
HTTPMail Server
HTTPMail Server
SMTP User
SMTP User
POP3 Port
POP3 Port
SMTP Port
SMTP Port
IMAP Port
IMAP Port
POP3 Password2
POP3 Password2
IMAP Password2
IMAP Password2
NNTP Password2
NNTP Password2
HTTPMail Password2
HTTPMail Password2
SMTP Password2
SMTP Password2
POP3 Password
POP3 Password
IMAP Password
IMAP Password
NNTP Password
NNTP Password
HTTPMail Password
HTTPMail Password
SMTP Password
SMTP Password
{X-X-X-XX-XXXXXX}
{X-X-X-XX-XXXXXX}
inetcomm server passwords
inetcomm server passwords
outlook account manager passwords
outlook account manager passwords
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Pstorec.dll
Pstorec.dll
[VNC] EXEC: %s
[VNC] EXEC: %s
IE WND [%0.8X] ENABLED: %s VISIBLED: %s
IE WND [%0.8X] ENABLED: %s VISIBLED: %s
[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s
[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s
[VDESK] Read CMD %u[%u]
[VDESK] Read CMD %u[%u]
[VDESK] NOT AUTH CMD %u
[VDESK] NOT AUTH CMD %u
GetAsyncKeyState
GetAsyncKeyState
USER32.DLL
USER32.DLL
GetKeyboardState
GetKeyboardState
GetKeyState
GetKeyState
?WINMM.DLL
?WINMM.DLL
?DSOUND.DLL
?DSOUND.DLL
ZwConnectPort
ZwConnectPort
NTDLL.DLL
NTDLL.DLL
[VNC] PROCESS=%s
[VNC] PROCESS=%s
\explorer.exe
\explorer.exe
[VNC] SearchApp Status = %u
[VNC] SearchApp Status = %u
[VNC] FileName = %s
[VNC] FileName = %s
[VNC] CmdLine = %s
[VNC] CmdLine = %s
[VNC] W64 Redir OLD=%u
[VNC] W64 Redir OLD=%u
[VNC] CreateProcess Status = %u (%u)
[VNC] CreateProcess Status = %u (%u)
SysShadow
SysShadow
Chrome_WidgetWin_1
Chrome_WidgetWin_1
Chrome_WidgetWin_0
Chrome_WidgetWin_0
d3d10_1.dll
d3d10_1.dll
d3d10_1core.dll
d3d10_1core.dll
d3d10.dll
d3d10.dll
d3d10core.dll
d3d10core.dll
d2d1.dll
d2d1.dll
OPENGL32.dll
OPENGL32.dll
d3d9.dll
d3d9.dll
d3d11.dll
d3d11.dll
Dxtrans.dll
Dxtrans.dll
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
NETAPI32.dll
NETAPI32.dll
SHDeleteKeyA
SHDeleteKeyA
SHLWAPI.dll
SHLWAPI.dll
DeleteUrlCacheEntry
DeleteUrlCacheEntry
WININET.dll
WININET.dll
WS2_32.dll
WS2_32.dll
MSVCRT.dll
MSVCRT.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
AVIFIL32.dll
AVIFIL32.dll
GetWindowsDirectoryW
GetWindowsDirectoryW
CallNamedPipeA
CallNamedPipeA
ConnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
CreateNamedPipeW
DisconnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
CreateNamedPipeA
GetWindowsDirectoryA
GetWindowsDirectoryA
EnumWindows
EnumWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
SetViewportOrgEx
SetViewportOrgEx
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
RegEnumKeyExA
RegEnumKeyExA
RegCreateKeyA
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyA
RegOpenKeyA
OLEAUT32.dll
OLEAUT32.dll
CertOpenSystemStoreA
CertOpenSystemStoreA
CertDeleteCertificateFromStore
CertDeleteCertificateFromStore
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXExportCertStoreEx
CRYPT32.dll
CRYPT32.dll
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
FindCloseUrlCache
FindCloseUrlCache
FindNextUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryW
COMDLG32.dll
COMDLG32.dll
WININET.DLL
WININET.DLL
1#1,12181
1#1,12181
2#21292>2
2#21292>2
.pdata
.pdata
@.reloc
@.reloc
c:\test_x64.dll
c:\test_x64.dll
[%s - X64 EQ PID: %u TID: %u]
[%s - X64 EQ PID: %u TID: %u]
\SysWOW64\regsvr32.exe
\SysWOW64\regsvr32.exe
[Pony] Fail create process: %u
[Pony] Fail create process: %u
[PONY] Fail inject to process: %u
[PONY] Fail inject to process: %u
lc:\32.dll
lc:\32.dll
32.dll
32.dll
echrome.dll
echrome.dll
regsvr32.exe
regsvr32.exe
%c:\~%0.8x.tmp
%c:\~%0.8x.tmp
iexplore.exe
iexplore.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
\ThemeApiPort
\ThemeApiPort
lc:\64.dll
lc:\64.dll
64.dll
64.dll
Explorer.EXE_932_rwx_02270000_0007E000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
HHt.HHt
HHt.HHt
More information: hXXp://VVV.ibsensoftware.com/
More information: hXXp://VVV.ibsensoftware.com/
8HttpAddRequestHeadersA
8HttpAddRequestHeadersA
HttpOpenRequestA
HttpOpenRequestA
HttpOpenRequestW
HttpOpenRequestW
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestA
HttpSendRequestExA
HttpSendRequestExA
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestW
HttpSendRequestW
wininet.dll
wininet.dll
rapport
rapport
ieframe.dll
ieframe.dll
NSPR4.DLL
NSPR4.DLL
nss3.dll
nss3.dll
KERNEL32.DLL
KERNEL32.DLL
\Google\Chrome\User Data\Default\
\Google\Chrome\User Data\Default\
\Mozilla\Firefox\Profiles\
\Mozilla\Firefox\Profiles\
sol_chrome/
sol_chrome/
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\
tor2web.org
tor2web.org
hXXps://%s.%s/favicon.ico
hXXps://%s.%s/favicon.ico
.rdata
.rdata
@http
@http
SELECT url FROM moz_places
SELECT url FROM moz_places
places.sqlite
places.sqlite
ie/history.txt
ie/history.txt
ff/history.txt
ff/history.txt
ff/%u/places.sqlite
ff/%u/places.sqlite
framework_key%
framework_key%
eval('var %s '
eval('var %s '
%s.Key = '%s';
%s.Key = '%s';
%s.Hide('%0.8X%0.8X');
%s.Hide('%0.8X%0.8X');
CertificateAuthority
CertificateAuthority
%s.pfx
%s.pfx
cookies.sqlite
cookies.sqlite
cookies.sqlite-journal
cookies.sqlite-journal
ff/%u/cookies.sqlite
ff/%u/cookies.sqlite
c:\test_x32.dll
c:\test_x32.dll
#dbgmsg
#dbgmsg
[%s - X32 EQ PID: %u TID: %u]
[%s - X32 EQ PID: %u TID: %u]
X-Firefox-Spdy
X-Firefox-Spdy
X-WebKit-CSP
X-WebKit-CSP
hXXps://
hXXps://
HTTP/1.1 200 OK
HTTP/1.1 200 OK
Content-Length: %u
Content-Length: %u
GET /favicon.ico HTTP/1.1
GET /favicon.ico HTTP/1.1
GET /favicon.ico HTTP/1.0
GET /favicon.ico HTTP/1.0
login=%s&pass=%s
login=%s&pass=%s
C:\ProgramData
C:\ProgramData
%Documents and Settings%\All Users\Application Data
%Documents and Settings%\All Users\Application Data
chrome.dll
chrome.dll
127.0.0.1
127.0.0.1
DrWeb
DrWeb
McAfee.com
McAfee.com
Doctor Web
Doctor Web
Common Files\Doctor Web
Common Files\Doctor Web
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\
Content-Disposition: form-data; name="%s"
Content-Disposition: form-data; name="%s"
--%s--
--%s--
Content-Disposition: form-data; name="%s"; filename="%s"
Content-Disposition: form-data; name="%s"; filename="%s"
---------------------------%u%0.4x%0.8x
---------------------------%u%0.4x%0.8x
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
id=%0.8X%0.8X%0.8X%0.4X%0.4X%0.4X&iv=%0.8X&av=%0.8X&uptime=%u
id=%0.8X%0.8X%0.8X%0.4X%0.4X%0.4X&iv=%0.8X&av=%0.8X&uptime=%u
&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s&name=%ws&domain=%ws
&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s&name=%ws&domain=%ws
[VNC] Parse param error: %s
[VNC] Parse param error: %s
\regsvr32.exe
\regsvr32.exe
[VNC] Fail create process: %u
[VNC] Fail create process: %u
[VNC] Fail inject to process: %u
[VNC] Fail inject to process: %u
fv_%u.avi
fv_%u.avi
#FV_%u
#FV_%u
#FV_%s
#FV_%s
pass.txt
pass.txt
cert.pfx
cert.pfx
PFXImportCertStore
PFXImportCertStore
Crypt32.dll
Crypt32.dll
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3-1", false);
user_pref("network.http.spdy.enabled.v3-1", false);
user_pref("layers.acceleration.disabled", true);
user_pref("layers.acceleration.disabled", true);
user_pref("gfx.direct2d.disabled", true);
user_pref("gfx.direct2d.disabled", true);
prefs.js
prefs.js
csrss.exe
csrss.exe
smss.exe
smss.exe
wininit.exe
wininit.exe
services.exe
services.exe
svchost.exe
svchost.exe
lsas.exe
lsas.exe
lsm.exe
lsm.exe
winlogon.exe
winlogon.exe
Dbgview.exe
Dbgview.exe
taskhost.exe
taskhost.exe
HttpEndRequestA
HttpEndRequestA
HttpEndRequestW
HttpEndRequestW
%s%s%u
%s%s%u
ADVAPI32.DLL
ADVAPI32.DLL
Init in Browser = %u
Init in Browser = %u
Init in Shell = %u
Init in Shell = %u
[Socks] Failt connect BC [%s:%u]
[Socks] Failt connect BC [%s:%u]
[Socks] Fail parse param: %s
[Socks] Fail parse param: %s
regsvr32.exe "%s"
regsvr32.exe "%s"
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
#cert
#cert
regsvr32.exe /s /i:"%u" "%s"
regsvr32.exe /s /i:"%u" "%s"
[Pony] Fail Get Pass
[Pony] Fail Get Pass
DL_EXEC LOAD ERROR: %u = %s
DL_EXEC LOAD ERROR: %u = %s
DL_EXEC Status [Pipe]: %u-%u-%u-%u
DL_EXEC Status [Pipe]: %u-%u-%u-%u
DL_EXEC Status[Local]: %u = %u
DL_EXEC Status[Local]: %u = %u
Start Socks addr: %s
Start Socks addr: %s
Start Socks Status[Pipe]: %u-%u-%u
Start Socks Status[Pipe]: %u-%u-%u
Start Socks Status[Local]: %u
Start Socks Status[Local]: %u
Start VNC addr: %s
Start VNC addr: %s
Start VNC Status[Pipe]: %u-%u-%u
Start VNC Status[Pipe]: %u-%u-%u
Start VNC Status[Local]: %u
Start VNC Status[Local]: %u
msvcrt.dll
msvcrt.dll
%0.8X%0.8X%c
%0.8X%0.8X%c
firefox.exe
firefox.exe
explorer.exe
explorer.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
\\.\pipe\
\\.\pipe\
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
hXXp://
hXXp://
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
%Program Files%\Mozilla Firefox\
%Program Files%\Mozilla Firefox\
mozsqlite3.dll
mozsqlite3.dll
sqlite3_open
sqlite3_open
sqlite3_exec
sqlite3_exec
sqlite3_close
sqlite3_close
sqlite3_free
sqlite3_free
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
[BC] Cmd Ver Error
[BC] Cmd Ver Error
[BC] Wait Ping error %u[%u]
[BC] Wait Ping error %u[%u]
[BC] Fail Connect: %u
[BC] Fail Connect: %u
[BC] Fail read cmd
[BC] Fail read cmd
[BC] Cmd need reauth
[BC] Cmd need reauth
[BC] cmd error: %u
[BC] cmd error: %u
[BC] Cmd need disconnect
[BC] Cmd need disconnect
ntdll.dll
ntdll.dll
gdiplus.dll
gdiplus.dll
GdiplusShutdown
GdiplusShutdown
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
account.cfg
account.cfg
account.cfn
account.cfn
Dir #%u
Dir #%u
.oeaccount
.oeaccount
Software\Microsoft\Windows Live Mail
Software\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Mail
\Microsoft\Windows Mail
\Microsoft\Windows Mail
PopPort
PopPort
PopPassword
PopPassword
SmtpServer
SmtpServer
SmtpPort
SmtpPort
SmtpAccount
SmtpAccount
SmtpPassword
SmtpPassword
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
MS IE FTP Passwords
MS IE FTP Passwords
Password
Password
Software\Far\Plugins\FTP\Hosts
Software\Far\Plugins\FTP\Hosts
Software\Far2\Plugins\FTP\Hosts
Software\Far2\Plugins\FTP\Hosts
Software\Far Manager\Plugins\FTP\Hosts
Software\Far Manager\Plugins\FTP\Hosts
Software\Far\SavedDialogHistory\FTPHost
Software\Far\SavedDialogHistory\FTPHost
Software\Far2\SavedDialogHistory\FTPHost
Software\Far2\SavedDialogHistory\FTPHost
Software\Far Manager\SavedDialogHistory\FTPHost
Software\Far Manager\SavedDialogHistory\FTPHost
\win.ini
\win.ini
WS_FTP
WS_FTP
\Ipswitch\WS_FTP
\Ipswitch\WS_FTP
\GlobalSCAPE\CuteFTP
\GlobalSCAPE\CuteFTP
sm.dat
sm.dat
\GlobalSCAPE\CuteFTP Pro
\GlobalSCAPE\CuteFTP Pro
\GlobalSCAPE\CuteFTP Lite
\GlobalSCAPE\CuteFTP Lite
\CuteFTP
\CuteFTP
CUTEFTP
CUTEFTP
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
\Sites.dat
\Sites.dat
\Quick.dat
\Quick.dat
\History.dat
\History.dat
Software\BPFTP\Bullet Proof FTP\Main
Software\BPFTP\Bullet Proof FTP\Main
Software\BulletProof Software\BulletProof FTP Client\Main
Software\BulletProof Software\BulletProof FTP Client\Main
Software\BPFTP\Bullet Proof FTP\Options
Software\BPFTP\Bullet Proof FTP\Options
Software\BulletProof Software\BulletProof FTP Client\Options
Software\BulletProof Software\BulletProof FTP Client\Options
Software\BPFTP
Software\BPFTP
\SmartFTP
\SmartFTP
Favorites.dat
Favorites.dat
History.dat
History.dat
Software\TurboFTP
Software\TurboFTP
\TurboFTP
\TurboFTP
addrbk.dat
addrbk.dat
quick.dat
quick.dat
Port
Port
Login
Login
PasswordType
PasswordType
profiles.xml
profiles.xml
\FTP Explorer
\FTP Explorer
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
Software\FTP Explorer\Profiles
Software\FTP Explorer\Profiles
FtpSite.xml
FtpSite.xml
RushSite.xml
RushSite.xml
\FTPRush
\FTPRush
bitkinex.ds
bitkinex.ds
NDSites.ini
NDSites.ini
Software\LeechFTP
Software\LeechFTP
bookmark.dat
bookmark.dat
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
sites.db
sites.db
servers.xml
servers.xml
\FTPGetter
\FTPGetter
ESTdb2.dat
ESTdb2.dat
\Estsoft\ALFTP
\Estsoft\ALFTP
QData.dat
QData.dat
SM.arch
SM.arch
FTP .Link\shell\open\command
FTP .Link\shell\open\command
NppFTP.xml
NppFTP.xml
Software\MAS-Soft\FTPInfo\Setup
Software\MAS-Soft\FTPInfo\Setup
ServerList.xml
ServerList.xml
\FTPInfo
\FTPInfo
NovaFTP.db
NovaFTP.db
\INSoftware\NovaFTP
\INSoftware\NovaFTP
\sites.xml
\sites.xml
ftplast.osd
ftplast.osd
\SharedSettings.ccs
\SharedSettings.ccs
\SharedSettings.sqlite
\SharedSettings.sqlite
\SharedSettings_1_0_5.ccs
\SharedSettings_1_0_5.ccs
\SharedSettings_1_0_5.sqlite
\SharedSettings_1_0_5.sqlite
\32BitFtp.ini
\32BitFtp.ini
FTPCON
FTPCON
FTP CONTROL
FTP CONTROL
FTPVoyager.ftp
FTPVoyager.ftp
\RhinoSoft.com
\RhinoSoft.com
FTPVoyager.qc
FTPVoyager.qc
FTPVoyager.Archive
FTPVoyager.Archive
SiteInfo.QFP
SiteInfo.QFP
WinFTP
WinFTP
DeluxeFTP
DeluxeFTP
sites.xml
sites.xml
Staff-FTP
Staff-FTP
sites.ini
sites.ini
FreshFTP
FreshFTP
Software\FlashPeak\BlazeFtp\Settings
Software\FlashPeak\BlazeFtp\Settings
LastPassword
LastPassword
LastPort
LastPort
BlazeFtp
BlazeFtp
site.dat
site.dat
\BlazeFtp
\BlazeFtp
GoFTP
GoFTP
Connections.txt
Connections.txt
3D-FTP
3D-FTP
\3D-FTP
\3D-FTP
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
EasyFTP
EasyFTP
FTPNow
FTPNow
FTP Now
FTP Now
FTPShell
FTPShell
ftpshell.fsi
ftpshell.fsi
ftpsite.ini
ftpsite.ini
FTPList.db
FTPList.db
My FTP
My FTP
project.ini
project.ini
Mailbox.ini
Mailbox.ini
FTP Navigator
FTP Navigator
FTP Commander
FTP Commander
ftplist.txt
ftplist.txt
Software\Sota\FFFTP
Software\Sota\FFFTP
Software\Sota\FFFTP\Options
Software\Sota\FFFTP\Options
Software\FTPWare\COREFTP\Sites
Software\FTPWare\COREFTP\Sites
FtpPort
FtpPort
Software\Cryer\WebSitePublisher
Software\Cryer\WebSitePublisher
_Password
_Password
Software\NCH Software\ClassicFTP\FTPAccounts
Software\NCH Software\ClassicFTP\FTPAccounts
FtpPassword
FtpPassword
_FtpPassword
_FtpPassword
FtpServer
FtpServer
FtpUserName
FtpUserName
FtpDirectory
FtpDirectory
Software\FTPClient\Sites
Software\FTPClient\Sites
Software\SoftX.org\FTPClient\Sites
Software\SoftX.org\FTPClient\Sites
PortNumber
PortNumber
PassWord
PassWord
Software\South River Technologies\WebDrive\Connections
Software\South River Technologies\WebDrive\Connections
Software\LinasFTP\Site Manager
Software\LinasFTP\Site Manager
FTP destination password
FTP destination password
FTP destination server
FTP destination server
FTP destination port
FTP destination port
FTP destination user
FTP destination user
FTP destination catalog
FTP destination catalog
FTP profiles
FTP profiles
Msi.dll
Msi.dll
{74FF1730-B1F2-4D88-926B-1568FAE61DB7}
{74FF1730-B1F2-4D88-926B-1568FAE61DB7}
\PocoSystem.ini
\PocoSystem.ini
accounts.ini
accounts.ini
sites.dat
sites.dat
\LeapWare\LeapFTP
\LeapWare\LeapFTP
unleap.exe
unleap.exe
leapftp
leapftp
FtpIniName
FtpIniName
Software\Ghisler\Windows Commander
Software\Ghisler\Windows Commander
wcx_PTF.ini
wcx_PTF.ini
Server.Pass
Server.Pass
Server.Host
Server.Host
Server.User
Server.User
Server.Port
Server.Port
Last Server Pass
Last Server Pass
Last Server Port
Last Server Port
\sitemanager.xml
\sitemanager.xml
\recentservers.xml
\recentservers.xml
\filezilla.xml
\filezilla.xml
"password" : "
"password" : "
"password":"
"password":"
\drives.js
\drives.js
\ExpanDrive\favorites.js
\ExpanDrive\favorites.js
\ExpanDrive\drives.js
\ExpanDrive\drives.js
wiseftpsrvs.ini
wiseftpsrvs.ini
wisePTF.ini
wisePTF.ini
wiseftpsrvs.bin
wiseftpsrvs.bin
SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}
SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}
SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}
SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}
FTP Count
FTP Count
FTP File%u
FTP File%u
Robo-FTP
Robo-FTP
SOFTWARE\%s\FTPServers
SOFTWARE\%s\FTPServers
user.config
user.config
.duck
.duck
SiteServer %u\Host
SiteServer %u\Host
SiteServer %u\WebUrl
SiteServer %u\WebUrl
SiteServer %u\Remote Directory
SiteServer %u\Remote Directory
SiteServer %u-User
SiteServer %u-User
SiteServer %u-User PW
SiteServer %u-User PW
SiteServer %u\SFTP
SiteServer %u\SFTP
Keychain
Keychain
Software\Nico Mak Computing\WinZip\FTP
Software\Nico Mak Computing\WinZip\FTP
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
sqlite3.dll
sqlite3.dll
sqlite3_prepare
sqlite3_prepare
sqlite3_step
sqlite3_step
sqlite3_column_bytes
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_column_blob
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins
PTF://
PTF://
signons.sqlite
signons.sqlite
\profiles.ini
\profiles.ini
PathToExe
PathToExe
\Mozilla\Firefox\
\Mozilla\Firefox\
Firefox
Firefox
Software\Mozilla
Software\Mozilla
fireFTPsites.dat
fireFTPsites.dat
\Mozilla\SeaMonkey\
\Mozilla\SeaMonkey\
SeaMonkey
SeaMonkey
\Mozilla\Profiles\
\Mozilla\Profiles\
Mozilla
Mozilla
password 51:b:
password 51:b:
SMTP Email Address
SMTP Email Address
SMTP Server
SMTP Server
SMTP User Name
SMTP User Name
HTTP User
HTTP User
HTTP Server URL
HTTP Server URL
HTTPMail User Name
HTTPMail User Name
HTTPMail Server
HTTPMail Server
SMTP User
SMTP User
POP3 Port
POP3 Port
SMTP Port
SMTP Port
IMAP Port
IMAP Port
POP3 Password2
POP3 Password2
IMAP Password2
IMAP Password2
NNTP Password2
NNTP Password2
HTTPMail Password2
HTTPMail Password2
SMTP Password2
SMTP Password2
POP3 Password
POP3 Password
IMAP Password
IMAP Password
NNTP Password
NNTP Password
HTTPMail Password
HTTPMail Password
SMTP Password
SMTP Password
{X-X-X-XX-XXXXXX}
{X-X-X-XX-XXXXXX}
inetcomm server passwords
inetcomm server passwords
outlook account manager passwords
outlook account manager passwords
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Pstorec.dll
Pstorec.dll
[VNC] EXEC: %s
[VNC] EXEC: %s
IE WND [%0.8X] ENABLED: %s VISIBLED: %s
IE WND [%0.8X] ENABLED: %s VISIBLED: %s
[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s
[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s
[VDESK] Read CMD %u[%u]
[VDESK] Read CMD %u[%u]
[VDESK] NOT AUTH CMD %u
[VDESK] NOT AUTH CMD %u
GetAsyncKeyState
GetAsyncKeyState
USER32.DLL
USER32.DLL
GetKeyboardState
GetKeyboardState
GetKeyState
GetKeyState
?WINMM.DLL
?WINMM.DLL
?DSOUND.DLL
?DSOUND.DLL
ZwConnectPort
ZwConnectPort
NTDLL.DLL
NTDLL.DLL
[VNC] PROCESS=%s
[VNC] PROCESS=%s
\explorer.exe
\explorer.exe
[VNC] SearchApp Status = %u
[VNC] SearchApp Status = %u
[VNC] FileName = %s
[VNC] FileName = %s
[VNC] CmdLine = %s
[VNC] CmdLine = %s
[VNC] W64 Redir OLD=%u
[VNC] W64 Redir OLD=%u
[VNC] CreateProcess Status = %u (%u)
[VNC] CreateProcess Status = %u (%u)
SysShadow
SysShadow
Chrome_WidgetWin_1
Chrome_WidgetWin_1
Chrome_WidgetWin_0
Chrome_WidgetWin_0
d3d10_1.dll
d3d10_1.dll
d3d10_1core.dll
d3d10_1core.dll
d3d10.dll
d3d10.dll
d3d10core.dll
d3d10core.dll
d2d1.dll
d2d1.dll
OPENGL32.dll
OPENGL32.dll
d3d9.dll
d3d9.dll
d3d11.dll
d3d11.dll
Dxtrans.dll
Dxtrans.dll
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
NETAPI32.dll
NETAPI32.dll
SHDeleteKeyA
SHDeleteKeyA
SHLWAPI.dll
SHLWAPI.dll
DeleteUrlCacheEntry
DeleteUrlCacheEntry
WININET.dll
WININET.dll
WS2_32.dll
WS2_32.dll
MSVCRT.dll
MSVCRT.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
AVIFIL32.dll
AVIFIL32.dll
GetWindowsDirectoryW
GetWindowsDirectoryW
CallNamedPipeA
CallNamedPipeA
ConnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
CreateNamedPipeW
DisconnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
CreateNamedPipeA
GetWindowsDirectoryA
GetWindowsDirectoryA
EnumWindows
EnumWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
SetViewportOrgEx
SetViewportOrgEx
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
RegEnumKeyExA
RegEnumKeyExA
RegCreateKeyA
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyA
RegOpenKeyA
OLEAUT32.dll
OLEAUT32.dll
CertOpenSystemStoreA
CertOpenSystemStoreA
CertDeleteCertificateFromStore
CertDeleteCertificateFromStore
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXExportCertStoreEx
CRYPT32.dll
CRYPT32.dll
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
FindCloseUrlCache
FindCloseUrlCache
FindNextUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryW
COMDLG32.dll
COMDLG32.dll
WININET.DLL
WININET.DLL
%Documents and Settings%\All Users\Application Data\SaduMogaz\XamaPteq.wcd
%Documents and Settings%\All Users\Application Data\SaduMogaz\XamaPteq.wcd
{4E153850-602D-4819-B83D-3CCD0A1E7351}
{4E153850-602D-4819-B83D-3CCD0A1E7351}
{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}
{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}
{1DB12055-380D-432E-9763-74AF5EF609C7}
{1DB12055-380D-432E-9763-74AF5EF609C7}
\\.\pipe\{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}
\\.\pipe\{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}
D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}
D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}
{7BD47FDD-1028-4944-A268-024C76A61BA9}
{7BD47FDD-1028-4944-A268-024C76A61BA9}
U{4E153850-602D-4819-B83D-3CCD0A1E7351}
U{4E153850-602D-4819-B83D-3CCD0A1E7351}
11166F2F-6DE1-4205-8360-3AB2448931C2
11166F2F-6DE1-4205-8360-3AB2448931C2
1#1,12181
1#1,12181
2#21292>2
2#21292>2
lc:\32.dll
lc:\32.dll
32.dll
32.dll
echrome.dll
echrome.dll
regsvr32.exe
regsvr32.exe
%c:\~%0.8x.tmp
%c:\~%0.8x.tmp
iexplore.exe
iexplore.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
\ThemeApiPort
\ThemeApiPort
imapi.exe_1320_rwx_00A70000_00059000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
HHt.HHt
HHt.HHt
More information: hXXp://VVV.ibsensoftware.com/
More information: hXXp://VVV.ibsensoftware.com/
8HttpAddRequestHeadersA
8HttpAddRequestHeadersA
HttpOpenRequestA
HttpOpenRequestA
HttpOpenRequestW
HttpOpenRequestW
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestA
HttpSendRequestExA
HttpSendRequestExA
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestW
HttpSendRequestW
wininet.dll
wininet.dll
rapport
rapport
ieframe.dll
ieframe.dll
NSPR4.DLL
NSPR4.DLL
nss3.dll
nss3.dll
KERNEL32.DLL
KERNEL32.DLL
\Google\Chrome\User Data\Default\
\Google\Chrome\User Data\Default\
\Mozilla\Firefox\Profiles\
\Mozilla\Firefox\Profiles\
sol_chrome/
sol_chrome/
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\
tor2web.org
tor2web.org
hXXps://%s.%s/favicon.ico
hXXps://%s.%s/favicon.ico
.rdata
.rdata
@http
@http
SELECT url FROM moz_places
SELECT url FROM moz_places
places.sqlite
places.sqlite
ie/history.txt
ie/history.txt
ff/history.txt
ff/history.txt
ff/%u/places.sqlite
ff/%u/places.sqlite
framework_key%
framework_key%
eval('var %s '
eval('var %s '
%s.Key = '%s';
%s.Key = '%s';
%s.Hide('%0.8X%0.8X');
%s.Hide('%0.8X%0.8X');
CertificateAuthority
CertificateAuthority
%s.pfx
%s.pfx
cookies.sqlite
cookies.sqlite
cookies.sqlite-journal
cookies.sqlite-journal
ff/%u/cookies.sqlite
ff/%u/cookies.sqlite
c:\test_x32.dll
c:\test_x32.dll
#dbgmsg
#dbgmsg
[%s - X32 EQ PID: %u TID: %u]
[%s - X32 EQ PID: %u TID: %u]
X-Firefox-Spdy
X-Firefox-Spdy
X-WebKit-CSP
X-WebKit-CSP
hXXps://
hXXps://
HTTP/1.1 200 OK
HTTP/1.1 200 OK
Content-Length: %u
Content-Length: %u
GET /favicon.ico HTTP/1.1
GET /favicon.ico HTTP/1.1
GET /favicon.ico HTTP/1.0
GET /favicon.ico HTTP/1.0
login=%s&pass=%s
login=%s&pass=%s
C:\ProgramData
C:\ProgramData
%Documents and Settings%\All Users\Application Data
%Documents and Settings%\All Users\Application Data
chrome.dll
chrome.dll
127.0.0.1
127.0.0.1
DrWeb
DrWeb
McAfee.com
McAfee.com
Doctor Web
Doctor Web
Common Files\Doctor Web
Common Files\Doctor Web
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\
Content-Disposition: form-data; name="%s"
Content-Disposition: form-data; name="%s"
--%s--
--%s--
Content-Disposition: form-data; name="%s"; filename="%s"
Content-Disposition: form-data; name="%s"; filename="%s"
---------------------------%u%0.4x%0.8x
---------------------------%u%0.4x%0.8x
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
id=%0.8X%0.8X%0.8X%0.4X%0.4X%0.4X&iv=%0.8X&av=%0.8X&uptime=%u
id=%0.8X%0.8X%0.8X%0.4X%0.4X%0.4X&iv=%0.8X&av=%0.8X&uptime=%u
&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s&name=%ws&domain=%ws
&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s&name=%ws&domain=%ws
[VNC] Parse param error: %s
[VNC] Parse param error: %s
\regsvr32.exe
\regsvr32.exe
[VNC] Fail create process: %u
[VNC] Fail create process: %u
[VNC] Fail inject to process: %u
[VNC] Fail inject to process: %u
fv_%u.avi
fv_%u.avi
#FV_%u
#FV_%u
#FV_%s
#FV_%s
pass.txt
pass.txt
cert.pfx
cert.pfx
PFXImportCertStore
PFXImportCertStore
Crypt32.dll
Crypt32.dll
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3-1", false);
user_pref("network.http.spdy.enabled.v3-1", false);
user_pref("layers.acceleration.disabled", true);
user_pref("layers.acceleration.disabled", true);
user_pref("gfx.direct2d.disabled", true);
user_pref("gfx.direct2d.disabled", true);
prefs.js
prefs.js
csrss.exe
csrss.exe
smss.exe
smss.exe
wininit.exe
wininit.exe
services.exe
services.exe
svchost.exe
svchost.exe
lsas.exe
lsas.exe
lsm.exe
lsm.exe
winlogon.exe
winlogon.exe
Dbgview.exe
Dbgview.exe
taskhost.exe
taskhost.exe
HttpEndRequestA
HttpEndRequestA
HttpEndRequestW
HttpEndRequestW
%s%s%u
%s%s%u
ADVAPI32.DLL
ADVAPI32.DLL
Init in Browser = %u
Init in Browser = %u
Init in Shell = %u
Init in Shell = %u
[Socks] Failt connect BC [%s:%u]
[Socks] Failt connect BC [%s:%u]
[Socks] Fail parse param: %s
[Socks] Fail parse param: %s
regsvr32.exe "%s"
regsvr32.exe "%s"
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
#cert
#cert
regsvr32.exe /s /i:"%u" "%s"
regsvr32.exe /s /i:"%u" "%s"
[Pony] Fail Get Pass
[Pony] Fail Get Pass
DL_EXEC LOAD ERROR: %u = %s
DL_EXEC LOAD ERROR: %u = %s
DL_EXEC Status [Pipe]: %u-%u-%u-%u
DL_EXEC Status [Pipe]: %u-%u-%u-%u
DL_EXEC Status[Local]: %u = %u
DL_EXEC Status[Local]: %u = %u
Start Socks addr: %s
Start Socks addr: %s
Start Socks Status[Pipe]: %u-%u-%u
Start Socks Status[Pipe]: %u-%u-%u
Start Socks Status[Local]: %u
Start Socks Status[Local]: %u
Start VNC addr: %s
Start VNC addr: %s
Start VNC Status[Pipe]: %u-%u-%u
Start VNC Status[Pipe]: %u-%u-%u
Start VNC Status[Local]: %u
Start VNC Status[Local]: %u
msvcrt.dll
msvcrt.dll
%0.8X%0.8X%c
%0.8X%0.8X%c
firefox.exe
firefox.exe
explorer.exe
explorer.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
\\.\pipe\
\\.\pipe\
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
hXXp://
hXXp://
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
%Program Files%\Mozilla Firefox\
%Program Files%\Mozilla Firefox\
mozsqlite3.dll
mozsqlite3.dll
sqlite3_open
sqlite3_open
sqlite3_exec
sqlite3_exec
sqlite3_close
sqlite3_close
sqlite3_free
sqlite3_free
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
[BC] Cmd Ver Error
[BC] Cmd Ver Error
[BC] Wait Ping error %u[%u]
[BC] Wait Ping error %u[%u]
[BC] Fail Connect: %u
[BC] Fail Connect: %u
[BC] Fail read cmd
[BC] Fail read cmd
[BC] Cmd need reauth
[BC] Cmd need reauth
[BC] cmd error: %u
[BC] cmd error: %u
[BC] Cmd need disconnect
[BC] Cmd need disconnect
ntdll.dll
ntdll.dll
gdiplus.dll
gdiplus.dll
GdiplusShutdown
GdiplusShutdown
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
account.cfg
account.cfg
account.cfn
account.cfn
Dir #%u
Dir #%u
.oeaccount
.oeaccount
Software\Microsoft\Windows Live Mail
Software\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Mail
\Microsoft\Windows Mail
\Microsoft\Windows Mail
PopPort
PopPort
PopPassword
PopPassword
SmtpServer
SmtpServer
SmtpPort
SmtpPort
SmtpAccount
SmtpAccount
SmtpPassword
SmtpPassword
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
MS IE FTP Passwords
MS IE FTP Passwords
Password
Password
Software\Far\Plugins\FTP\Hosts
Software\Far\Plugins\FTP\Hosts
Software\Far2\Plugins\FTP\Hosts
Software\Far2\Plugins\FTP\Hosts
Software\Far Manager\Plugins\FTP\Hosts
Software\Far Manager\Plugins\FTP\Hosts
Software\Far\SavedDialogHistory\FTPHost
Software\Far\SavedDialogHistory\FTPHost
Software\Far2\SavedDialogHistory\FTPHost
Software\Far2\SavedDialogHistory\FTPHost
Software\Far Manager\SavedDialogHistory\FTPHost
Software\Far Manager\SavedDialogHistory\FTPHost
\win.ini
\win.ini
WS_FTP
WS_FTP
\Ipswitch\WS_FTP
\Ipswitch\WS_FTP
\GlobalSCAPE\CuteFTP
\GlobalSCAPE\CuteFTP
sm.dat
sm.dat
\GlobalSCAPE\CuteFTP Pro
\GlobalSCAPE\CuteFTP Pro
\GlobalSCAPE\CuteFTP Lite
\GlobalSCAPE\CuteFTP Lite
\CuteFTP
\CuteFTP
CUTEFTP
CUTEFTP
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
\Sites.dat
\Sites.dat
\Quick.dat
\Quick.dat
\History.dat
\History.dat
Software\BPFTP\Bullet Proof FTP\Main
Software\BPFTP\Bullet Proof FTP\Main
Software\BulletProof Software\BulletProof FTP Client\Main
Software\BulletProof Software\BulletProof FTP Client\Main
Software\BPFTP\Bullet Proof FTP\Options
Software\BPFTP\Bullet Proof FTP\Options
Software\BulletProof Software\BulletProof FTP Client\Options
Software\BulletProof Software\BulletProof FTP Client\Options
Software\BPFTP
Software\BPFTP
\SmartFTP
\SmartFTP
Favorites.dat
Favorites.dat
History.dat
History.dat
Software\TurboFTP
Software\TurboFTP
\TurboFTP
\TurboFTP
addrbk.dat
addrbk.dat
quick.dat
quick.dat
Port
Port
Login
Login
PasswordType
PasswordType
profiles.xml
profiles.xml
\FTP Explorer
\FTP Explorer
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
Software\FTP Explorer\Profiles
Software\FTP Explorer\Profiles
FtpSite.xml
FtpSite.xml
RushSite.xml
RushSite.xml
\FTPRush
\FTPRush
bitkinex.ds
bitkinex.ds
NDSites.ini
NDSites.ini
Software\LeechFTP
Software\LeechFTP
bookmark.dat
bookmark.dat
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
sites.db
sites.db
servers.xml
servers.xml
\FTPGetter
\FTPGetter
ESTdb2.dat
ESTdb2.dat
\Estsoft\ALFTP
\Estsoft\ALFTP
QData.dat
QData.dat
SM.arch
SM.arch
FTP .Link\shell\open\command
FTP .Link\shell\open\command
NppFTP.xml
NppFTP.xml
Software\MAS-Soft\FTPInfo\Setup
Software\MAS-Soft\FTPInfo\Setup
ServerList.xml
ServerList.xml
\FTPInfo
\FTPInfo
NovaFTP.db
NovaFTP.db
\INSoftware\NovaFTP
\INSoftware\NovaFTP
\sites.xml
\sites.xml
ftplast.osd
ftplast.osd
\SharedSettings.ccs
\SharedSettings.ccs
\SharedSettings.sqlite
\SharedSettings.sqlite
\SharedSettings_1_0_5.ccs
\SharedSettings_1_0_5.ccs
\SharedSettings_1_0_5.sqlite
\SharedSettings_1_0_5.sqlite
\32BitFtp.ini
\32BitFtp.ini
FTPCON
FTPCON
FTP CONTROL
FTP CONTROL
FTPVoyager.ftp
FTPVoyager.ftp
\RhinoSoft.com
\RhinoSoft.com
FTPVoyager.qc
FTPVoyager.qc
FTPVoyager.Archive
FTPVoyager.Archive
SiteInfo.QFP
SiteInfo.QFP
WinFTP
WinFTP
DeluxeFTP
DeluxeFTP
sites.xml
sites.xml
Staff-FTP
Staff-FTP
sites.ini
sites.ini
FreshFTP
FreshFTP
Software\FlashPeak\BlazeFtp\Settings
Software\FlashPeak\BlazeFtp\Settings
LastPassword
LastPassword
LastPort
LastPort
BlazeFtp
BlazeFtp
site.dat
site.dat
\BlazeFtp
\BlazeFtp
GoFTP
GoFTP
Connections.txt
Connections.txt
3D-FTP
3D-FTP
\3D-FTP
\3D-FTP
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
EasyFTP
EasyFTP
FTPNow
FTPNow
FTP Now
FTP Now
FTPShell
FTPShell
ftpshell.fsi
ftpshell.fsi
ftpsite.ini
ftpsite.ini
FTPList.db
FTPList.db
My FTP
My FTP
project.ini
project.ini
Mailbox.ini
Mailbox.ini
FTP Navigator
FTP Navigator
FTP Commander
FTP Commander
ftplist.txt
ftplist.txt
Software\Sota\FFFTP
Software\Sota\FFFTP
Software\Sota\FFFTP\Options
Software\Sota\FFFTP\Options
Software\FTPWare\COREFTP\Sites
Software\FTPWare\COREFTP\Sites
FtpPort
FtpPort
Software\Cryer\WebSitePublisher
Software\Cryer\WebSitePublisher
_Password
_Password
Software\NCH Software\ClassicFTP\FTPAccounts
Software\NCH Software\ClassicFTP\FTPAccounts
FtpPassword
FtpPassword
_FtpPassword
_FtpPassword
FtpServer
FtpServer
FtpUserName
FtpUserName
FtpDirectory
FtpDirectory
Software\FTPClient\Sites
Software\FTPClient\Sites
Software\SoftX.org\FTPClient\Sites
Software\SoftX.org\FTPClient\Sites
PortNumber
PortNumber
PassWord
PassWord
Software\South River Technologies\WebDrive\Connections
Software\South River Technologies\WebDrive\Connections
Software\LinasFTP\Site Manager
Software\LinasFTP\Site Manager
FTP destination password
FTP destination password
FTP destination server
FTP destination server
FTP destination port
FTP destination port
FTP destination user
FTP destination user
FTP destination catalog
FTP destination catalog
FTP profiles
FTP profiles
Msi.dll
Msi.dll
{74FF1730-B1F2-4D88-926B-1568FAE61DB7}
{74FF1730-B1F2-4D88-926B-1568FAE61DB7}
\PocoSystem.ini
\PocoSystem.ini
accounts.ini
accounts.ini
sites.dat
sites.dat
\LeapWare\LeapFTP
\LeapWare\LeapFTP
unleap.exe
unleap.exe
leapftp
leapftp
FtpIniName
FtpIniName
Software\Ghisler\Windows Commander
Software\Ghisler\Windows Commander
wcx_PTF.ini
wcx_PTF.ini
Server.Pass
Server.Pass
Server.Host
Server.Host
Server.User
Server.User
Server.Port
Server.Port
Last Server Pass
Last Server Pass
Last Server Port
Last Server Port
\sitemanager.xml
\sitemanager.xml
\recentservers.xml
\recentservers.xml
\filezilla.xml
\filezilla.xml
"password" : "
"password" : "
"password":"
"password":"
\drives.js
\drives.js
\ExpanDrive\favorites.js
\ExpanDrive\favorites.js
\ExpanDrive\drives.js
\ExpanDrive\drives.js
wiseftpsrvs.ini
wiseftpsrvs.ini
wisePTF.ini
wisePTF.ini
wiseftpsrvs.bin
wiseftpsrvs.bin
SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}
SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}
SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}
SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}
FTP Count
FTP Count
FTP File%u
FTP File%u
Robo-FTP
Robo-FTP
SOFTWARE\%s\FTPServers
SOFTWARE\%s\FTPServers
user.config
user.config
.duck
.duck
SiteServer %u\Host
SiteServer %u\Host
SiteServer %u\WebUrl
SiteServer %u\WebUrl
SiteServer %u\Remote Directory
SiteServer %u\Remote Directory
SiteServer %u-User
SiteServer %u-User
SiteServer %u-User PW
SiteServer %u-User PW
SiteServer %u\SFTP
SiteServer %u\SFTP
Keychain
Keychain
Software\Nico Mak Computing\WinZip\FTP
Software\Nico Mak Computing\WinZip\FTP
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
sqlite3.dll
sqlite3.dll
sqlite3_prepare
sqlite3_prepare
sqlite3_step
sqlite3_step
sqlite3_column_bytes
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_column_blob
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins
PTF://
PTF://
signons.sqlite
signons.sqlite
\profiles.ini
\profiles.ini
PathToExe
PathToExe
\Mozilla\Firefox\
\Mozilla\Firefox\
Firefox
Firefox
Software\Mozilla
Software\Mozilla
fireFTPsites.dat
fireFTPsites.dat
\Mozilla\SeaMonkey\
\Mozilla\SeaMonkey\
SeaMonkey
SeaMonkey
\Mozilla\Profiles\
\Mozilla\Profiles\
Mozilla
Mozilla
password 51:b:
password 51:b:
SMTP Email Address
SMTP Email Address
SMTP Server
SMTP Server
SMTP User Name
SMTP User Name
HTTP User
HTTP User
HTTP Server URL
HTTP Server URL
HTTPMail User Name
HTTPMail User Name
HTTPMail Server
HTTPMail Server
SMTP User
SMTP User
POP3 Port
POP3 Port
SMTP Port
SMTP Port
IMAP Port
IMAP Port
POP3 Password2
POP3 Password2
IMAP Password2
IMAP Password2
NNTP Password2
NNTP Password2
HTTPMail Password2
HTTPMail Password2
SMTP Password2
SMTP Password2
POP3 Password
POP3 Password
IMAP Password
IMAP Password
NNTP Password
NNTP Password
HTTPMail Password
HTTPMail Password
SMTP Password
SMTP Password
{X-X-X-XX-XXXXXX}
{X-X-X-XX-XXXXXX}
inetcomm server passwords
inetcomm server passwords
outlook account manager passwords
outlook account manager passwords
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Pstorec.dll
Pstorec.dll
[VNC] EXEC: %s
[VNC] EXEC: %s
IE WND [%0.8X] ENABLED: %s VISIBLED: %s
IE WND [%0.8X] ENABLED: %s VISIBLED: %s
[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s
[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s
[VDESK] Read CMD %u[%u]
[VDESK] Read CMD %u[%u]
[VDESK] NOT AUTH CMD %u
[VDESK] NOT AUTH CMD %u
GetAsyncKeyState
GetAsyncKeyState
USER32.DLL
USER32.DLL
GetKeyboardState
GetKeyboardState
GetKeyState
GetKeyState
?WINMM.DLL
?WINMM.DLL
?DSOUND.DLL
?DSOUND.DLL
ZwConnectPort
ZwConnectPort
NTDLL.DLL
NTDLL.DLL
[VNC] PROCESS=%s
[VNC] PROCESS=%s
\explorer.exe
\explorer.exe
[VNC] SearchApp Status = %u
[VNC] SearchApp Status = %u
[VNC] FileName = %s
[VNC] FileName = %s
[VNC] CmdLine = %s
[VNC] CmdLine = %s
[VNC] W64 Redir OLD=%u
[VNC] W64 Redir OLD=%u
[VNC] CreateProcess Status = %u (%u)
[VNC] CreateProcess Status = %u (%u)
SysShadow
SysShadow
Chrome_WidgetWin_1
Chrome_WidgetWin_1
Chrome_WidgetWin_0
Chrome_WidgetWin_0
d3d10_1.dll
d3d10_1.dll
d3d10_1core.dll
d3d10_1core.dll
d3d10.dll
d3d10.dll
d3d10core.dll
d3d10core.dll
d2d1.dll
d2d1.dll
OPENGL32.dll
OPENGL32.dll
d3d9.dll
d3d9.dll
d3d11.dll
d3d11.dll
Dxtrans.dll
Dxtrans.dll
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
NETAPI32.dll
NETAPI32.dll
SHDeleteKeyA
SHDeleteKeyA
SHLWAPI.dll
SHLWAPI.dll
DeleteUrlCacheEntry
DeleteUrlCacheEntry
WININET.dll
WININET.dll
WS2_32.dll
WS2_32.dll
MSVCRT.dll
MSVCRT.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
AVIFIL32.dll
AVIFIL32.dll
GetWindowsDirectoryW
GetWindowsDirectoryW
CallNamedPipeA
CallNamedPipeA
ConnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
CreateNamedPipeW
DisconnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
CreateNamedPipeA
GetWindowsDirectoryA
GetWindowsDirectoryA
EnumWindows
EnumWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
SetViewportOrgEx
SetViewportOrgEx
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
RegEnumKeyExA
RegEnumKeyExA
RegCreateKeyA
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyA
RegOpenKeyA
OLEAUT32.dll
OLEAUT32.dll
CertOpenSystemStoreA
CertOpenSystemStoreA
CertDeleteCertificateFromStore
CertDeleteCertificateFromStore
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXExportCertStoreEx
CRYPT32.dll
CRYPT32.dll
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
FindCloseUrlCache
FindCloseUrlCache
FindNextUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryW
COMDLG32.dll
COMDLG32.dll
WININET.DLL
WININET.DLL
1#1,12181
1#1,12181
2#21292>2
2#21292>2
.pdata
.pdata
@.reloc
@.reloc
c:\test_x64.dll
c:\test_x64.dll
[%s - X64 EQ PID: %u TID: %u]
[%s - X64 EQ PID: %u TID: %u]
\SysWOW64\regsvr32.exe
\SysWOW64\regsvr32.exe
[Pony] Fail create process: %u
[Pony] Fail create process: %u
[PONY] Fail inject to process: %u
[PONY] Fail inject to process: %u
lc:\32.dll
lc:\32.dll
32.dll
32.dll
echrome.dll
echrome.dll
regsvr32.exe
regsvr32.exe
%c:\~%0.8x.tmp
%c:\~%0.8x.tmp
iexplore.exe
iexplore.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
\ThemeApiPort
\ThemeApiPort
lc:\64.dll
lc:\64.dll
64.dll
64.dll
imapi.exe_1320_rwx_00AD0000_0007E000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
HHt.HHt
HHt.HHt
More information: hXXp://VVV.ibsensoftware.com/
More information: hXXp://VVV.ibsensoftware.com/
8HttpAddRequestHeadersA
8HttpAddRequestHeadersA
HttpOpenRequestA
HttpOpenRequestA
HttpOpenRequestW
HttpOpenRequestW
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestA
HttpSendRequestExA
HttpSendRequestExA
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestW
HttpSendRequestW
wininet.dll
wininet.dll
rapport
rapport
ieframe.dll
ieframe.dll
NSPR4.DLL
NSPR4.DLL
nss3.dll
nss3.dll
KERNEL32.DLL
KERNEL32.DLL
\Google\Chrome\User Data\Default\
\Google\Chrome\User Data\Default\
\Mozilla\Firefox\Profiles\
\Mozilla\Firefox\Profiles\
sol_chrome/
sol_chrome/
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\
tor2web.org
tor2web.org
hXXps://%s.%s/favicon.ico
hXXps://%s.%s/favicon.ico
.rdata
.rdata
@http
@http
SELECT url FROM moz_places
SELECT url FROM moz_places
places.sqlite
places.sqlite
ie/history.txt
ie/history.txt
ff/history.txt
ff/history.txt
ff/%u/places.sqlite
ff/%u/places.sqlite
framework_key%
framework_key%
eval('var %s '
eval('var %s '
%s.Key = '%s';
%s.Key = '%s';
%s.Hide('%0.8X%0.8X');
%s.Hide('%0.8X%0.8X');
CertificateAuthority
CertificateAuthority
%s.pfx
%s.pfx
cookies.sqlite
cookies.sqlite
cookies.sqlite-journal
cookies.sqlite-journal
ff/%u/cookies.sqlite
ff/%u/cookies.sqlite
c:\test_x32.dll
c:\test_x32.dll
#dbgmsg
#dbgmsg
[%s - X32 EQ PID: %u TID: %u]
[%s - X32 EQ PID: %u TID: %u]
X-Firefox-Spdy
X-Firefox-Spdy
X-WebKit-CSP
X-WebKit-CSP
hXXps://
hXXps://
HTTP/1.1 200 OK
HTTP/1.1 200 OK
Content-Length: %u
Content-Length: %u
GET /favicon.ico HTTP/1.1
GET /favicon.ico HTTP/1.1
GET /favicon.ico HTTP/1.0
GET /favicon.ico HTTP/1.0
login=%s&pass=%s
login=%s&pass=%s
C:\ProgramData
C:\ProgramData
%Documents and Settings%\All Users\Application Data
%Documents and Settings%\All Users\Application Data
chrome.dll
chrome.dll
127.0.0.1
127.0.0.1
DrWeb
DrWeb
McAfee.com
McAfee.com
Doctor Web
Doctor Web
Common Files\Doctor Web
Common Files\Doctor Web
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\
Content-Disposition: form-data; name="%s"
Content-Disposition: form-data; name="%s"
--%s--
--%s--
Content-Disposition: form-data; name="%s"; filename="%s"
Content-Disposition: form-data; name="%s"; filename="%s"
---------------------------%u%0.4x%0.8x
---------------------------%u%0.4x%0.8x
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
id=%0.8X%0.8X%0.8X%0.4X%0.4X%0.4X&iv=%0.8X&av=%0.8X&uptime=%u
id=%0.8X%0.8X%0.8X%0.4X%0.4X%0.4X&iv=%0.8X&av=%0.8X&uptime=%u
&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s&name=%ws&domain=%ws
&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s&name=%ws&domain=%ws
[VNC] Parse param error: %s
[VNC] Parse param error: %s
\regsvr32.exe
\regsvr32.exe
[VNC] Fail create process: %u
[VNC] Fail create process: %u
[VNC] Fail inject to process: %u
[VNC] Fail inject to process: %u
fv_%u.avi
fv_%u.avi
#FV_%u
#FV_%u
#FV_%s
#FV_%s
pass.txt
pass.txt
cert.pfx
cert.pfx
PFXImportCertStore
PFXImportCertStore
Crypt32.dll
Crypt32.dll
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3-1", false);
user_pref("network.http.spdy.enabled.v3-1", false);
user_pref("layers.acceleration.disabled", true);
user_pref("layers.acceleration.disabled", true);
user_pref("gfx.direct2d.disabled", true);
user_pref("gfx.direct2d.disabled", true);
prefs.js
prefs.js
csrss.exe
csrss.exe
smss.exe
smss.exe
wininit.exe
wininit.exe
services.exe
services.exe
svchost.exe
svchost.exe
lsas.exe
lsas.exe
lsm.exe
lsm.exe
winlogon.exe
winlogon.exe
Dbgview.exe
Dbgview.exe
taskhost.exe
taskhost.exe
HttpEndRequestA
HttpEndRequestA
HttpEndRequestW
HttpEndRequestW
%s%s%u
%s%s%u
ADVAPI32.DLL
ADVAPI32.DLL
Init in Browser = %u
Init in Browser = %u
Init in Shell = %u
Init in Shell = %u
[Socks] Failt connect BC [%s:%u]
[Socks] Failt connect BC [%s:%u]
[Socks] Fail parse param: %s
[Socks] Fail parse param: %s
regsvr32.exe "%s"
regsvr32.exe "%s"
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
#cert
#cert
regsvr32.exe /s /i:"%u" "%s"
regsvr32.exe /s /i:"%u" "%s"
[Pony] Fail Get Pass
[Pony] Fail Get Pass
DL_EXEC LOAD ERROR: %u = %s
DL_EXEC LOAD ERROR: %u = %s
DL_EXEC Status [Pipe]: %u-%u-%u-%u
DL_EXEC Status [Pipe]: %u-%u-%u-%u
DL_EXEC Status[Local]: %u = %u
DL_EXEC Status[Local]: %u = %u
Start Socks addr: %s
Start Socks addr: %s
Start Socks Status[Pipe]: %u-%u-%u
Start Socks Status[Pipe]: %u-%u-%u
Start Socks Status[Local]: %u
Start Socks Status[Local]: %u
Start VNC addr: %s
Start VNC addr: %s
Start VNC Status[Pipe]: %u-%u-%u
Start VNC Status[Pipe]: %u-%u-%u
Start VNC Status[Local]: %u
Start VNC Status[Local]: %u
msvcrt.dll
msvcrt.dll
%0.8X%0.8X%c
%0.8X%0.8X%c
firefox.exe
firefox.exe
explorer.exe
explorer.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
\\.\pipe\
\\.\pipe\
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
hXXp://
hXXp://
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
%Program Files%\Mozilla Firefox\
%Program Files%\Mozilla Firefox\
mozsqlite3.dll
mozsqlite3.dll
sqlite3_open
sqlite3_open
sqlite3_exec
sqlite3_exec
sqlite3_close
sqlite3_close
sqlite3_free
sqlite3_free
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
[BC] Cmd Ver Error
[BC] Cmd Ver Error
[BC] Wait Ping error %u[%u]
[BC] Wait Ping error %u[%u]
[BC] Fail Connect: %u
[BC] Fail Connect: %u
[BC] Fail read cmd
[BC] Fail read cmd
[BC] Cmd need reauth
[BC] Cmd need reauth
[BC] cmd error: %u
[BC] cmd error: %u
[BC] Cmd need disconnect
[BC] Cmd need disconnect
ntdll.dll
ntdll.dll
gdiplus.dll
gdiplus.dll
GdiplusShutdown
GdiplusShutdown
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
account.cfg
account.cfg
account.cfn
account.cfn
Dir #%u
Dir #%u
.oeaccount
.oeaccount
Software\Microsoft\Windows Live Mail
Software\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Mail
\Microsoft\Windows Mail
\Microsoft\Windows Mail
PopPort
PopPort
PopPassword
PopPassword
SmtpServer
SmtpServer
SmtpPort
SmtpPort
SmtpAccount
SmtpAccount
SmtpPassword
SmtpPassword
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
MS IE FTP Passwords
MS IE FTP Passwords
Password
Password
Software\Far\Plugins\FTP\Hosts
Software\Far\Plugins\FTP\Hosts
Software\Far2\Plugins\FTP\Hosts
Software\Far2\Plugins\FTP\Hosts
Software\Far Manager\Plugins\FTP\Hosts
Software\Far Manager\Plugins\FTP\Hosts
Software\Far\SavedDialogHistory\FTPHost
Software\Far\SavedDialogHistory\FTPHost
Software\Far2\SavedDialogHistory\FTPHost
Software\Far2\SavedDialogHistory\FTPHost
Software\Far Manager\SavedDialogHistory\FTPHost
Software\Far Manager\SavedDialogHistory\FTPHost
\win.ini
\win.ini
WS_FTP
WS_FTP
\Ipswitch\WS_FTP
\Ipswitch\WS_FTP
\GlobalSCAPE\CuteFTP
\GlobalSCAPE\CuteFTP
sm.dat
sm.dat
\GlobalSCAPE\CuteFTP Pro
\GlobalSCAPE\CuteFTP Pro
\GlobalSCAPE\CuteFTP Lite
\GlobalSCAPE\CuteFTP Lite
\CuteFTP
\CuteFTP
CUTEFTP
CUTEFTP
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
\Sites.dat
\Sites.dat
\Quick.dat
\Quick.dat
\History.dat
\History.dat
Software\BPFTP\Bullet Proof FTP\Main
Software\BPFTP\Bullet Proof FTP\Main
Software\BulletProof Software\BulletProof FTP Client\Main
Software\BulletProof Software\BulletProof FTP Client\Main
Software\BPFTP\Bullet Proof FTP\Options
Software\BPFTP\Bullet Proof FTP\Options
Software\BulletProof Software\BulletProof FTP Client\Options
Software\BulletProof Software\BulletProof FTP Client\Options
Software\BPFTP
Software\BPFTP
\SmartFTP
\SmartFTP
Favorites.dat
Favorites.dat
History.dat
History.dat
Software\TurboFTP
Software\TurboFTP
\TurboFTP
\TurboFTP
addrbk.dat
addrbk.dat
quick.dat
quick.dat
Port
Port
Login
Login
PasswordType
PasswordType
profiles.xml
profiles.xml
\FTP Explorer
\FTP Explorer
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
Software\FTP Explorer\Profiles
Software\FTP Explorer\Profiles
FtpSite.xml
FtpSite.xml
RushSite.xml
RushSite.xml
\FTPRush
\FTPRush
bitkinex.ds
bitkinex.ds
NDSites.ini
NDSites.ini
Software\LeechFTP
Software\LeechFTP
bookmark.dat
bookmark.dat
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
sites.db
sites.db
servers.xml
servers.xml
\FTPGetter
\FTPGetter
ESTdb2.dat
ESTdb2.dat
\Estsoft\ALFTP
\Estsoft\ALFTP
QData.dat
QData.dat
SM.arch
SM.arch
FTP .Link\shell\open\command
FTP .Link\shell\open\command
NppFTP.xml
NppFTP.xml
Software\MAS-Soft\FTPInfo\Setup
Software\MAS-Soft\FTPInfo\Setup
ServerList.xml
ServerList.xml
\FTPInfo
\FTPInfo
NovaFTP.db
NovaFTP.db
\INSoftware\NovaFTP
\INSoftware\NovaFTP
\sites.xml
\sites.xml
ftplast.osd
ftplast.osd
\SharedSettings.ccs
\SharedSettings.ccs
\SharedSettings.sqlite
\SharedSettings.sqlite
\SharedSettings_1_0_5.ccs
\SharedSettings_1_0_5.ccs
\SharedSettings_1_0_5.sqlite
\SharedSettings_1_0_5.sqlite
\32BitFtp.ini
\32BitFtp.ini
FTPCON
FTPCON
FTP CONTROL
FTP CONTROL
FTPVoyager.ftp
FTPVoyager.ftp
\RhinoSoft.com
\RhinoSoft.com
FTPVoyager.qc
FTPVoyager.qc
FTPVoyager.Archive
FTPVoyager.Archive
SiteInfo.QFP
SiteInfo.QFP
WinFTP
WinFTP
DeluxeFTP
DeluxeFTP
sites.xml
sites.xml
Staff-FTP
Staff-FTP
sites.ini
sites.ini
FreshFTP
FreshFTP
Software\FlashPeak\BlazeFtp\Settings
Software\FlashPeak\BlazeFtp\Settings
LastPassword
LastPassword
LastPort
LastPort
BlazeFtp
BlazeFtp
site.dat
site.dat
\BlazeFtp
\BlazeFtp
GoFTP
GoFTP
Connections.txt
Connections.txt
3D-FTP
3D-FTP
\3D-FTP
\3D-FTP
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
EasyFTP
EasyFTP
FTPNow
FTPNow
FTP Now
FTP Now
FTPShell
FTPShell
ftpshell.fsi
ftpshell.fsi
ftpsite.ini
ftpsite.ini
FTPList.db
FTPList.db
My FTP
My FTP
project.ini
project.ini
Mailbox.ini
Mailbox.ini
FTP Navigator
FTP Navigator
FTP Commander
FTP Commander
ftplist.txt
ftplist.txt
Software\Sota\FFFTP
Software\Sota\FFFTP
Software\Sota\FFFTP\Options
Software\Sota\FFFTP\Options
Software\FTPWare\COREFTP\Sites
Software\FTPWare\COREFTP\Sites
FtpPort
FtpPort
Software\Cryer\WebSitePublisher
Software\Cryer\WebSitePublisher
_Password
_Password
Software\NCH Software\ClassicFTP\FTPAccounts
Software\NCH Software\ClassicFTP\FTPAccounts
FtpPassword
FtpPassword
_FtpPassword
_FtpPassword
FtpServer
FtpServer
FtpUserName
FtpUserName
FtpDirectory
FtpDirectory
Software\FTPClient\Sites
Software\FTPClient\Sites
Software\SoftX.org\FTPClient\Sites
Software\SoftX.org\FTPClient\Sites
PortNumber
PortNumber
PassWord
PassWord
Software\South River Technologies\WebDrive\Connections
Software\South River Technologies\WebDrive\Connections
Software\LinasFTP\Site Manager
Software\LinasFTP\Site Manager
FTP destination password
FTP destination password
FTP destination server
FTP destination server
FTP destination port
FTP destination port
FTP destination user
FTP destination user
FTP destination catalog
FTP destination catalog
FTP profiles
FTP profiles
Msi.dll
Msi.dll
{74FF1730-B1F2-4D88-926B-1568FAE61DB7}
{74FF1730-B1F2-4D88-926B-1568FAE61DB7}
\PocoSystem.ini
\PocoSystem.ini
accounts.ini
accounts.ini
sites.dat
sites.dat
\LeapWare\LeapFTP
\LeapWare\LeapFTP
unleap.exe
unleap.exe
leapftp
leapftp
FtpIniName
FtpIniName
Software\Ghisler\Windows Commander
Software\Ghisler\Windows Commander
wcx_PTF.ini
wcx_PTF.ini
Server.Pass
Server.Pass
Server.Host
Server.Host
Server.User
Server.User
Server.Port
Server.Port
Last Server Pass
Last Server Pass
Last Server Port
Last Server Port
\sitemanager.xml
\sitemanager.xml
\recentservers.xml
\recentservers.xml
\filezilla.xml
\filezilla.xml
"password" : "
"password" : "
"password":"
"password":"
\drives.js
\drives.js
\ExpanDrive\favorites.js
\ExpanDrive\favorites.js
\ExpanDrive\drives.js
\ExpanDrive\drives.js
wiseftpsrvs.ini
wiseftpsrvs.ini
wisePTF.ini
wisePTF.ini
wiseftpsrvs.bin
wiseftpsrvs.bin
SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}
SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}
SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}
SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}
FTP Count
FTP Count
FTP File%u
FTP File%u
Robo-FTP
Robo-FTP
SOFTWARE\%s\FTPServers
SOFTWARE\%s\FTPServers
user.config
user.config
.duck
.duck
SiteServer %u\Host
SiteServer %u\Host
SiteServer %u\WebUrl
SiteServer %u\WebUrl
SiteServer %u\Remote Directory
SiteServer %u\Remote Directory
SiteServer %u-User
SiteServer %u-User
SiteServer %u-User PW
SiteServer %u-User PW
SiteServer %u\SFTP
SiteServer %u\SFTP
Keychain
Keychain
Software\Nico Mak Computing\WinZip\FTP
Software\Nico Mak Computing\WinZip\FTP
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
sqlite3.dll
sqlite3.dll
sqlite3_prepare
sqlite3_prepare
sqlite3_step
sqlite3_step
sqlite3_column_bytes
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_column_blob
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins
PTF://
PTF://
signons.sqlite
signons.sqlite
\profiles.ini
\profiles.ini
PathToExe
PathToExe
\Mozilla\Firefox\
\Mozilla\Firefox\
Firefox
Firefox
Software\Mozilla
Software\Mozilla
fireFTPsites.dat
fireFTPsites.dat
\Mozilla\SeaMonkey\
\Mozilla\SeaMonkey\
SeaMonkey
SeaMonkey
\Mozilla\Profiles\
\Mozilla\Profiles\
Mozilla
Mozilla
password 51:b:
password 51:b:
SMTP Email Address
SMTP Email Address
SMTP Server
SMTP Server
SMTP User Name
SMTP User Name
HTTP User
HTTP User
HTTP Server URL
HTTP Server URL
HTTPMail User Name
HTTPMail User Name
HTTPMail Server
HTTPMail Server
SMTP User
SMTP User
POP3 Port
POP3 Port
SMTP Port
SMTP Port
IMAP Port
IMAP Port
POP3 Password2
POP3 Password2
IMAP Password2
IMAP Password2
NNTP Password2
NNTP Password2
HTTPMail Password2
HTTPMail Password2
SMTP Password2
SMTP Password2
POP3 Password
POP3 Password
IMAP Password
IMAP Password
NNTP Password
NNTP Password
HTTPMail Password
HTTPMail Password
SMTP Password
SMTP Password
{X-X-X-XX-XXXXXX}
{X-X-X-XX-XXXXXX}
inetcomm server passwords
inetcomm server passwords
outlook account manager passwords
outlook account manager passwords
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Pstorec.dll
Pstorec.dll
[VNC] EXEC: %s
[VNC] EXEC: %s
IE WND [%0.8X] ENABLED: %s VISIBLED: %s
IE WND [%0.8X] ENABLED: %s VISIBLED: %s
[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s
[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s
[VDESK] Read CMD %u[%u]
[VDESK] Read CMD %u[%u]
[VDESK] NOT AUTH CMD %u
[VDESK] NOT AUTH CMD %u
GetAsyncKeyState
GetAsyncKeyState
USER32.DLL
USER32.DLL
GetKeyboardState
GetKeyboardState
GetKeyState
GetKeyState
?WINMM.DLL
?WINMM.DLL
?DSOUND.DLL
?DSOUND.DLL
ZwConnectPort
ZwConnectPort
NTDLL.DLL
NTDLL.DLL
[VNC] PROCESS=%s
[VNC] PROCESS=%s
\explorer.exe
\explorer.exe
[VNC] SearchApp Status = %u
[VNC] SearchApp Status = %u
[VNC] FileName = %s
[VNC] FileName = %s
[VNC] CmdLine = %s
[VNC] CmdLine = %s
[VNC] W64 Redir OLD=%u
[VNC] W64 Redir OLD=%u
[VNC] CreateProcess Status = %u (%u)
[VNC] CreateProcess Status = %u (%u)
SysShadow
SysShadow
Chrome_WidgetWin_1
Chrome_WidgetWin_1
Chrome_WidgetWin_0
Chrome_WidgetWin_0
d3d10_1.dll
d3d10_1.dll
d3d10_1core.dll
d3d10_1core.dll
d3d10.dll
d3d10.dll
d3d10core.dll
d3d10core.dll
d2d1.dll
d2d1.dll
OPENGL32.dll
OPENGL32.dll
d3d9.dll
d3d9.dll
d3d11.dll
d3d11.dll
Dxtrans.dll
Dxtrans.dll
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
NETAPI32.dll
NETAPI32.dll
SHDeleteKeyA
SHDeleteKeyA
SHLWAPI.dll
SHLWAPI.dll
DeleteUrlCacheEntry
DeleteUrlCacheEntry
WININET.dll
WININET.dll
WS2_32.dll
WS2_32.dll
MSVCRT.dll
MSVCRT.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
AVIFIL32.dll
AVIFIL32.dll
GetWindowsDirectoryW
GetWindowsDirectoryW
CallNamedPipeA
CallNamedPipeA
ConnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
CreateNamedPipeW
DisconnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
CreateNamedPipeA
GetWindowsDirectoryA
GetWindowsDirectoryA
EnumWindows
EnumWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
SetViewportOrgEx
SetViewportOrgEx
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
RegEnumKeyExA
RegEnumKeyExA
RegCreateKeyA
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyA
RegOpenKeyA
OLEAUT32.dll
OLEAUT32.dll
CertOpenSystemStoreA
CertOpenSystemStoreA
CertDeleteCertificateFromStore
CertDeleteCertificateFromStore
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXExportCertStoreEx
CRYPT32.dll
CRYPT32.dll
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
FindCloseUrlCache
FindCloseUrlCache
FindNextUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryW
COMDLG32.dll
COMDLG32.dll
WININET.DLL
WININET.DLL
%Documents and Settings%\All Users\Application Data\SaduMogaz\XamaPteq.wcd
%Documents and Settings%\All Users\Application Data\SaduMogaz\XamaPteq.wcd
{4E153850-602D-4819-B83D-3CCD0A1E7351}
{4E153850-602D-4819-B83D-3CCD0A1E7351}
{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}
{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}
{1DB12055-380D-432E-9763-74AF5EF609C7}
{1DB12055-380D-432E-9763-74AF5EF609C7}
\\.\pipe\{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}
\\.\pipe\{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}
D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}
D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}
{7BD47FDD-1028-4944-A268-024C76A61BA9}
{7BD47FDD-1028-4944-A268-024C76A61BA9}
U{4E153850-602D-4819-B83D-3CCD0A1E7351}
U{4E153850-602D-4819-B83D-3CCD0A1E7351}
11166F2F-6DE1-4205-8360-3AB2448931C2
11166F2F-6DE1-4205-8360-3AB2448931C2
1#1,12181
1#1,12181
2#21292>2
2#21292>2
lc:\32.dll
lc:\32.dll
32.dll
32.dll
echrome.dll
echrome.dll
regsvr32.exe
regsvr32.exe
%c:\~%0.8x.tmp
%c:\~%0.8x.tmp
iexplore.exe
iexplore.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
\ThemeApiPort
\ThemeApiPort
spoolsv.exe_1460_rwx_00EF0000_00059000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
HHt.HHt
HHt.HHt
More information: hXXp://VVV.ibsensoftware.com/
More information: hXXp://VVV.ibsensoftware.com/
8HttpAddRequestHeadersA
8HttpAddRequestHeadersA
HttpOpenRequestA
HttpOpenRequestA
HttpOpenRequestW
HttpOpenRequestW
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestA
HttpSendRequestExA
HttpSendRequestExA
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestW
HttpSendRequestW
wininet.dll
wininet.dll
rapport
rapport
ieframe.dll
ieframe.dll
NSPR4.DLL
NSPR4.DLL
nss3.dll
nss3.dll
KERNEL32.DLL
KERNEL32.DLL
\Google\Chrome\User Data\Default\
\Google\Chrome\User Data\Default\
\Mozilla\Firefox\Profiles\
\Mozilla\Firefox\Profiles\
sol_chrome/
sol_chrome/
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\
tor2web.org
tor2web.org
hXXps://%s.%s/favicon.ico
hXXps://%s.%s/favicon.ico
.rdata
.rdata
@http
@http
SELECT url FROM moz_places
SELECT url FROM moz_places
places.sqlite
places.sqlite
ie/history.txt
ie/history.txt
ff/history.txt
ff/history.txt
ff/%u/places.sqlite
ff/%u/places.sqlite
framework_key%
framework_key%
eval('var %s '
eval('var %s '
%s.Key = '%s';
%s.Key = '%s';
%s.Hide('%0.8X%0.8X');
%s.Hide('%0.8X%0.8X');
CertificateAuthority
CertificateAuthority
%s.pfx
%s.pfx
cookies.sqlite
cookies.sqlite
cookies.sqlite-journal
cookies.sqlite-journal
ff/%u/cookies.sqlite
ff/%u/cookies.sqlite
c:\test_x32.dll
c:\test_x32.dll
#dbgmsg
#dbgmsg
[%s - X32 EQ PID: %u TID: %u]
[%s - X32 EQ PID: %u TID: %u]
X-Firefox-Spdy
X-Firefox-Spdy
X-WebKit-CSP
X-WebKit-CSP
hXXps://
hXXps://
HTTP/1.1 200 OK
HTTP/1.1 200 OK
Content-Length: %u
Content-Length: %u
GET /favicon.ico HTTP/1.1
GET /favicon.ico HTTP/1.1
GET /favicon.ico HTTP/1.0
GET /favicon.ico HTTP/1.0
login=%s&pass=%s
login=%s&pass=%s
C:\ProgramData
C:\ProgramData
%Documents and Settings%\All Users\Application Data
%Documents and Settings%\All Users\Application Data
chrome.dll
chrome.dll
127.0.0.1
127.0.0.1
DrWeb
DrWeb
McAfee.com
McAfee.com
Doctor Web
Doctor Web
Common Files\Doctor Web
Common Files\Doctor Web
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\
Content-Disposition: form-data; name="%s"
Content-Disposition: form-data; name="%s"
--%s--
--%s--
Content-Disposition: form-data; name="%s"; filename="%s"
Content-Disposition: form-data; name="%s"; filename="%s"
---------------------------%u%0.4x%0.8x
---------------------------%u%0.4x%0.8x
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
id=%0.8X%0.8X%0.8X%0.4X%0.4X%0.4X&iv=%0.8X&av=%0.8X&uptime=%u
id=%0.8X%0.8X%0.8X%0.4X%0.4X%0.4X&iv=%0.8X&av=%0.8X&uptime=%u
&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s&name=%ws&domain=%ws
&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s&name=%ws&domain=%ws
[VNC] Parse param error: %s
[VNC] Parse param error: %s
\regsvr32.exe
\regsvr32.exe
[VNC] Fail create process: %u
[VNC] Fail create process: %u
[VNC] Fail inject to process: %u
[VNC] Fail inject to process: %u
fv_%u.avi
fv_%u.avi
#FV_%u
#FV_%u
#FV_%s
#FV_%s
pass.txt
pass.txt
cert.pfx
cert.pfx
PFXImportCertStore
PFXImportCertStore
Crypt32.dll
Crypt32.dll
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3-1", false);
user_pref("network.http.spdy.enabled.v3-1", false);
user_pref("layers.acceleration.disabled", true);
user_pref("layers.acceleration.disabled", true);
user_pref("gfx.direct2d.disabled", true);
user_pref("gfx.direct2d.disabled", true);
prefs.js
prefs.js
csrss.exe
csrss.exe
smss.exe
smss.exe
wininit.exe
wininit.exe
services.exe
services.exe
svchost.exe
svchost.exe
lsas.exe
lsas.exe
lsm.exe
lsm.exe
winlogon.exe
winlogon.exe
Dbgview.exe
Dbgview.exe
taskhost.exe
taskhost.exe
HttpEndRequestA
HttpEndRequestA
HttpEndRequestW
HttpEndRequestW
%s%s%u
%s%s%u
ADVAPI32.DLL
ADVAPI32.DLL
Init in Browser = %u
Init in Browser = %u
Init in Shell = %u
Init in Shell = %u
[Socks] Failt connect BC [%s:%u]
[Socks] Failt connect BC [%s:%u]
[Socks] Fail parse param: %s
[Socks] Fail parse param: %s
regsvr32.exe "%s"
regsvr32.exe "%s"
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
#cert
#cert
regsvr32.exe /s /i:"%u" "%s"
regsvr32.exe /s /i:"%u" "%s"
[Pony] Fail Get Pass
[Pony] Fail Get Pass
DL_EXEC LOAD ERROR: %u = %s
DL_EXEC LOAD ERROR: %u = %s
DL_EXEC Status [Pipe]: %u-%u-%u-%u
DL_EXEC Status [Pipe]: %u-%u-%u-%u
DL_EXEC Status[Local]: %u = %u
DL_EXEC Status[Local]: %u = %u
Start Socks addr: %s
Start Socks addr: %s
Start Socks Status[Pipe]: %u-%u-%u
Start Socks Status[Pipe]: %u-%u-%u
Start Socks Status[Local]: %u
Start Socks Status[Local]: %u
Start VNC addr: %s
Start VNC addr: %s
Start VNC Status[Pipe]: %u-%u-%u
Start VNC Status[Pipe]: %u-%u-%u
Start VNC Status[Local]: %u
Start VNC Status[Local]: %u
msvcrt.dll
msvcrt.dll
%0.8X%0.8X%c
%0.8X%0.8X%c
firefox.exe
firefox.exe
explorer.exe
explorer.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
\\.\pipe\
\\.\pipe\
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
hXXp://
hXXp://
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
%Program Files%\Mozilla Firefox\
%Program Files%\Mozilla Firefox\
mozsqlite3.dll
mozsqlite3.dll
sqlite3_open
sqlite3_open
sqlite3_exec
sqlite3_exec
sqlite3_close
sqlite3_close
sqlite3_free
sqlite3_free
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
[BC] Cmd Ver Error
[BC] Cmd Ver Error
[BC] Wait Ping error %u[%u]
[BC] Wait Ping error %u[%u]
[BC] Fail Connect: %u
[BC] Fail Connect: %u
[BC] Fail read cmd
[BC] Fail read cmd
[BC] Cmd need reauth
[BC] Cmd need reauth
[BC] cmd error: %u
[BC] cmd error: %u
[BC] Cmd need disconnect
[BC] Cmd need disconnect
ntdll.dll
ntdll.dll
gdiplus.dll
gdiplus.dll
GdiplusShutdown
GdiplusShutdown
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
account.cfg
account.cfg
account.cfn
account.cfn
Dir #%u
Dir #%u
.oeaccount
.oeaccount
Software\Microsoft\Windows Live Mail
Software\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Mail
\Microsoft\Windows Mail
\Microsoft\Windows Mail
PopPort
PopPort
PopPassword
PopPassword
SmtpServer
SmtpServer
SmtpPort
SmtpPort
SmtpAccount
SmtpAccount
SmtpPassword
SmtpPassword
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
MS IE FTP Passwords
MS IE FTP Passwords
Password
Password
Software\Far\Plugins\FTP\Hosts
Software\Far\Plugins\FTP\Hosts
Software\Far2\Plugins\FTP\Hosts
Software\Far2\Plugins\FTP\Hosts
Software\Far Manager\Plugins\FTP\Hosts
Software\Far Manager\Plugins\FTP\Hosts
Software\Far\SavedDialogHistory\FTPHost
Software\Far\SavedDialogHistory\FTPHost
Software\Far2\SavedDialogHistory\FTPHost
Software\Far2\SavedDialogHistory\FTPHost
Software\Far Manager\SavedDialogHistory\FTPHost
Software\Far Manager\SavedDialogHistory\FTPHost
\win.ini
\win.ini
WS_FTP
WS_FTP
\Ipswitch\WS_FTP
\Ipswitch\WS_FTP
\GlobalSCAPE\CuteFTP
\GlobalSCAPE\CuteFTP
sm.dat
sm.dat
\GlobalSCAPE\CuteFTP Pro
\GlobalSCAPE\CuteFTP Pro
\GlobalSCAPE\CuteFTP Lite
\GlobalSCAPE\CuteFTP Lite
\CuteFTP
\CuteFTP
CUTEFTP
CUTEFTP
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
\Sites.dat
\Sites.dat
\Quick.dat
\Quick.dat
\History.dat
\History.dat
Software\BPFTP\Bullet Proof FTP\Main
Software\BPFTP\Bullet Proof FTP\Main
Software\BulletProof Software\BulletProof FTP Client\Main
Software\BulletProof Software\BulletProof FTP Client\Main
Software\BPFTP\Bullet Proof FTP\Options
Software\BPFTP\Bullet Proof FTP\Options
Software\BulletProof Software\BulletProof FTP Client\Options
Software\BulletProof Software\BulletProof FTP Client\Options
Software\BPFTP
Software\BPFTP
\SmartFTP
\SmartFTP
Favorites.dat
Favorites.dat
History.dat
History.dat
Software\TurboFTP
Software\TurboFTP
\TurboFTP
\TurboFTP
addrbk.dat
addrbk.dat
quick.dat
quick.dat
Port
Port
Login
Login
PasswordType
PasswordType
profiles.xml
profiles.xml
\FTP Explorer
\FTP Explorer
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
Software\FTP Explorer\Profiles
Software\FTP Explorer\Profiles
FtpSite.xml
FtpSite.xml
RushSite.xml
RushSite.xml
\FTPRush
\FTPRush
bitkinex.ds
bitkinex.ds
NDSites.ini
NDSites.ini
Software\LeechFTP
Software\LeechFTP
bookmark.dat
bookmark.dat
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
sites.db
sites.db
servers.xml
servers.xml
\FTPGetter
\FTPGetter
ESTdb2.dat
ESTdb2.dat
\Estsoft\ALFTP
\Estsoft\ALFTP
QData.dat
QData.dat
SM.arch
SM.arch
FTP .Link\shell\open\command
FTP .Link\shell\open\command
NppFTP.xml
NppFTP.xml
Software\MAS-Soft\FTPInfo\Setup
Software\MAS-Soft\FTPInfo\Setup
ServerList.xml
ServerList.xml
\FTPInfo
\FTPInfo
NovaFTP.db
NovaFTP.db
\INSoftware\NovaFTP
\INSoftware\NovaFTP
\sites.xml
\sites.xml
ftplast.osd
ftplast.osd
\SharedSettings.ccs
\SharedSettings.ccs
\SharedSettings.sqlite
\SharedSettings.sqlite
\SharedSettings_1_0_5.ccs
\SharedSettings_1_0_5.ccs
\SharedSettings_1_0_5.sqlite
\SharedSettings_1_0_5.sqlite
\32BitFtp.ini
\32BitFtp.ini
FTPCON
FTPCON
FTP CONTROL
FTP CONTROL
FTPVoyager.ftp
FTPVoyager.ftp
\RhinoSoft.com
\RhinoSoft.com
FTPVoyager.qc
FTPVoyager.qc
FTPVoyager.Archive
FTPVoyager.Archive
SiteInfo.QFP
SiteInfo.QFP
WinFTP
WinFTP
DeluxeFTP
DeluxeFTP
sites.xml
sites.xml
Staff-FTP
Staff-FTP
sites.ini
sites.ini
FreshFTP
FreshFTP
Software\FlashPeak\BlazeFtp\Settings
Software\FlashPeak\BlazeFtp\Settings
LastPassword
LastPassword
LastPort
LastPort
BlazeFtp
BlazeFtp
site.dat
site.dat
\BlazeFtp
\BlazeFtp
GoFTP
GoFTP
Connections.txt
Connections.txt
3D-FTP
3D-FTP
\3D-FTP
\3D-FTP
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
EasyFTP
EasyFTP
FTPNow
FTPNow
FTP Now
FTP Now
FTPShell
FTPShell
ftpshell.fsi
ftpshell.fsi
ftpsite.ini
ftpsite.ini
FTPList.db
FTPList.db
My FTP
My FTP
project.ini
project.ini
Mailbox.ini
Mailbox.ini
FTP Navigator
FTP Navigator
FTP Commander
FTP Commander
ftplist.txt
ftplist.txt
Software\Sota\FFFTP
Software\Sota\FFFTP
Software\Sota\FFFTP\Options
Software\Sota\FFFTP\Options
Software\FTPWare\COREFTP\Sites
Software\FTPWare\COREFTP\Sites
FtpPort
FtpPort
Software\Cryer\WebSitePublisher
Software\Cryer\WebSitePublisher
_Password
_Password
Software\NCH Software\ClassicFTP\FTPAccounts
Software\NCH Software\ClassicFTP\FTPAccounts
FtpPassword
FtpPassword
_FtpPassword
_FtpPassword
FtpServer
FtpServer
FtpUserName
FtpUserName
FtpDirectory
FtpDirectory
Software\FTPClient\Sites
Software\FTPClient\Sites
Software\SoftX.org\FTPClient\Sites
Software\SoftX.org\FTPClient\Sites
PortNumber
PortNumber
PassWord
PassWord
Software\South River Technologies\WebDrive\Connections
Software\South River Technologies\WebDrive\Connections
Software\LinasFTP\Site Manager
Software\LinasFTP\Site Manager
FTP destination password
FTP destination password
FTP destination server
FTP destination server
FTP destination port
FTP destination port
FTP destination user
FTP destination user
FTP destination catalog
FTP destination catalog
FTP profiles
FTP profiles
Msi.dll
Msi.dll
{74FF1730-B1F2-4D88-926B-1568FAE61DB7}
{74FF1730-B1F2-4D88-926B-1568FAE61DB7}
\PocoSystem.ini
\PocoSystem.ini
accounts.ini
accounts.ini
sites.dat
sites.dat
\LeapWare\LeapFTP
\LeapWare\LeapFTP
unleap.exe
unleap.exe
leapftp
leapftp
FtpIniName
FtpIniName
Software\Ghisler\Windows Commander
Software\Ghisler\Windows Commander
wcx_PTF.ini
wcx_PTF.ini
Server.Pass
Server.Pass
Server.Host
Server.Host
Server.User
Server.User
Server.Port
Server.Port
Last Server Pass
Last Server Pass
Last Server Port
Last Server Port
\sitemanager.xml
\sitemanager.xml
\recentservers.xml
\recentservers.xml
\filezilla.xml
\filezilla.xml
"password" : "
"password" : "
"password":"
"password":"
\drives.js
\drives.js
\ExpanDrive\favorites.js
\ExpanDrive\favorites.js
\ExpanDrive\drives.js
\ExpanDrive\drives.js
wiseftpsrvs.ini
wiseftpsrvs.ini
wisePTF.ini
wisePTF.ini
wiseftpsrvs.bin
wiseftpsrvs.bin
SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}
SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}
SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}
SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}
FTP Count
FTP Count
FTP File%u
FTP File%u
Robo-FTP
Robo-FTP
SOFTWARE\%s\FTPServers
SOFTWARE\%s\FTPServers
user.config
user.config
.duck
.duck
SiteServer %u\Host
SiteServer %u\Host
SiteServer %u\WebUrl
SiteServer %u\WebUrl
SiteServer %u\Remote Directory
SiteServer %u\Remote Directory
SiteServer %u-User
SiteServer %u-User
SiteServer %u-User PW
SiteServer %u-User PW
SiteServer %u\SFTP
SiteServer %u\SFTP
Keychain
Keychain
Software\Nico Mak Computing\WinZip\FTP
Software\Nico Mak Computing\WinZip\FTP
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
sqlite3.dll
sqlite3.dll
sqlite3_prepare
sqlite3_prepare
sqlite3_step
sqlite3_step
sqlite3_column_bytes
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_column_blob
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins
PTF://
PTF://
signons.sqlite
signons.sqlite
\profiles.ini
\profiles.ini
PathToExe
PathToExe
\Mozilla\Firefox\
\Mozilla\Firefox\
Firefox
Firefox
Software\Mozilla
Software\Mozilla
fireFTPsites.dat
fireFTPsites.dat
\Mozilla\SeaMonkey\
\Mozilla\SeaMonkey\
SeaMonkey
SeaMonkey
\Mozilla\Profiles\
\Mozilla\Profiles\
Mozilla
Mozilla
password 51:b:
password 51:b:
SMTP Email Address
SMTP Email Address
SMTP Server
SMTP Server
SMTP User Name
SMTP User Name
HTTP User
HTTP User
HTTP Server URL
HTTP Server URL
HTTPMail User Name
HTTPMail User Name
HTTPMail Server
HTTPMail Server
SMTP User
SMTP User
POP3 Port
POP3 Port
SMTP Port
SMTP Port
IMAP Port
IMAP Port
POP3 Password2
POP3 Password2
IMAP Password2
IMAP Password2
NNTP Password2
NNTP Password2
HTTPMail Password2
HTTPMail Password2
SMTP Password2
SMTP Password2
POP3 Password
POP3 Password
IMAP Password
IMAP Password
NNTP Password
NNTP Password
HTTPMail Password
HTTPMail Password
SMTP Password
SMTP Password
{X-X-X-XX-XXXXXX}
{X-X-X-XX-XXXXXX}
inetcomm server passwords
inetcomm server passwords
outlook account manager passwords
outlook account manager passwords
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Pstorec.dll
Pstorec.dll
[VNC] EXEC: %s
[VNC] EXEC: %s
IE WND [%0.8X] ENABLED: %s VISIBLED: %s
IE WND [%0.8X] ENABLED: %s VISIBLED: %s
[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s
[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s
[VDESK] Read CMD %u[%u]
[VDESK] Read CMD %u[%u]
[VDESK] NOT AUTH CMD %u
[VDESK] NOT AUTH CMD %u
GetAsyncKeyState
GetAsyncKeyState
USER32.DLL
USER32.DLL
GetKeyboardState
GetKeyboardState
GetKeyState
GetKeyState
?WINMM.DLL
?WINMM.DLL
?DSOUND.DLL
?DSOUND.DLL
ZwConnectPort
ZwConnectPort
NTDLL.DLL
NTDLL.DLL
[VNC] PROCESS=%s
[VNC] PROCESS=%s
\explorer.exe
\explorer.exe
[VNC] SearchApp Status = %u
[VNC] SearchApp Status = %u
[VNC] FileName = %s
[VNC] FileName = %s
[VNC] CmdLine = %s
[VNC] CmdLine = %s
[VNC] W64 Redir OLD=%u
[VNC] W64 Redir OLD=%u
[VNC] CreateProcess Status = %u (%u)
[VNC] CreateProcess Status = %u (%u)
SysShadow
SysShadow
Chrome_WidgetWin_1
Chrome_WidgetWin_1
Chrome_WidgetWin_0
Chrome_WidgetWin_0
d3d10_1.dll
d3d10_1.dll
d3d10_1core.dll
d3d10_1core.dll
d3d10.dll
d3d10.dll
d3d10core.dll
d3d10core.dll
d2d1.dll
d2d1.dll
OPENGL32.dll
OPENGL32.dll
d3d9.dll
d3d9.dll
d3d11.dll
d3d11.dll
Dxtrans.dll
Dxtrans.dll
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
NETAPI32.dll
NETAPI32.dll
SHDeleteKeyA
SHDeleteKeyA
SHLWAPI.dll
SHLWAPI.dll
DeleteUrlCacheEntry
DeleteUrlCacheEntry
WININET.dll
WININET.dll
WS2_32.dll
WS2_32.dll
MSVCRT.dll
MSVCRT.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
AVIFIL32.dll
AVIFIL32.dll
GetWindowsDirectoryW
GetWindowsDirectoryW
CallNamedPipeA
CallNamedPipeA
ConnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
CreateNamedPipeW
DisconnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
CreateNamedPipeA
GetWindowsDirectoryA
GetWindowsDirectoryA
EnumWindows
EnumWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
SetViewportOrgEx
SetViewportOrgEx
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
RegEnumKeyExA
RegEnumKeyExA
RegCreateKeyA
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyA
RegOpenKeyA
OLEAUT32.dll
OLEAUT32.dll
CertOpenSystemStoreA
CertOpenSystemStoreA
CertDeleteCertificateFromStore
CertDeleteCertificateFromStore
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXExportCertStoreEx
CRYPT32.dll
CRYPT32.dll
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
FindCloseUrlCache
FindCloseUrlCache
FindNextUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryW
COMDLG32.dll
COMDLG32.dll
WININET.DLL
WININET.DLL
1#1,12181
1#1,12181
2#21292>2
2#21292>2
.pdata
.pdata
@.reloc
@.reloc
c:\test_x64.dll
c:\test_x64.dll
[%s - X64 EQ PID: %u TID: %u]
[%s - X64 EQ PID: %u TID: %u]
\SysWOW64\regsvr32.exe
\SysWOW64\regsvr32.exe
[Pony] Fail create process: %u
[Pony] Fail create process: %u
[PONY] Fail inject to process: %u
[PONY] Fail inject to process: %u
lc:\32.dll
lc:\32.dll
32.dll
32.dll
echrome.dll
echrome.dll
regsvr32.exe
regsvr32.exe
%c:\~%0.8x.tmp
%c:\~%0.8x.tmp
iexplore.exe
iexplore.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
\ThemeApiPort
\ThemeApiPort
lc:\64.dll
lc:\64.dll
64.dll
64.dll
spoolsv.exe_1460_rwx_01360000_0007E000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
HHt.HHt
HHt.HHt
More information: hXXp://VVV.ibsensoftware.com/
More information: hXXp://VVV.ibsensoftware.com/
8HttpAddRequestHeadersA
8HttpAddRequestHeadersA
HttpOpenRequestA
HttpOpenRequestA
HttpOpenRequestW
HttpOpenRequestW
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestA
HttpSendRequestExA
HttpSendRequestExA
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestW
HttpSendRequestW
wininet.dll
wininet.dll
rapport
rapport
ieframe.dll
ieframe.dll
NSPR4.DLL
NSPR4.DLL
nss3.dll
nss3.dll
KERNEL32.DLL
KERNEL32.DLL
\Google\Chrome\User Data\Default\
\Google\Chrome\User Data\Default\
\Mozilla\Firefox\Profiles\
\Mozilla\Firefox\Profiles\
sol_chrome/
sol_chrome/
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\
tor2web.org
tor2web.org
hXXps://%s.%s/favicon.ico
hXXps://%s.%s/favicon.ico
.rdata
.rdata
@http
@http
SELECT url FROM moz_places
SELECT url FROM moz_places
places.sqlite
places.sqlite
ie/history.txt
ie/history.txt
ff/history.txt
ff/history.txt
ff/%u/places.sqlite
ff/%u/places.sqlite
framework_key%
framework_key%
eval('var %s '
eval('var %s '
%s.Key = '%s';
%s.Key = '%s';
%s.Hide('%0.8X%0.8X');
%s.Hide('%0.8X%0.8X');
CertificateAuthority
CertificateAuthority
%s.pfx
%s.pfx
cookies.sqlite
cookies.sqlite
cookies.sqlite-journal
cookies.sqlite-journal
ff/%u/cookies.sqlite
ff/%u/cookies.sqlite
c:\test_x32.dll
c:\test_x32.dll
#dbgmsg
#dbgmsg
[%s - X32 EQ PID: %u TID: %u]
[%s - X32 EQ PID: %u TID: %u]
X-Firefox-Spdy
X-Firefox-Spdy
X-WebKit-CSP
X-WebKit-CSP
hXXps://
hXXps://
HTTP/1.1 200 OK
HTTP/1.1 200 OK
Content-Length: %u
Content-Length: %u
GET /favicon.ico HTTP/1.1
GET /favicon.ico HTTP/1.1
GET /favicon.ico HTTP/1.0
GET /favicon.ico HTTP/1.0
login=%s&pass=%s
login=%s&pass=%s
C:\ProgramData
C:\ProgramData
%Documents and Settings%\All Users\Application Data
%Documents and Settings%\All Users\Application Data
chrome.dll
chrome.dll
127.0.0.1
127.0.0.1
DrWeb
DrWeb
McAfee.com
McAfee.com
Doctor Web
Doctor Web
Common Files\Doctor Web
Common Files\Doctor Web
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\
Content-Disposition: form-data; name="%s"
Content-Disposition: form-data; name="%s"
--%s--
--%s--
Content-Disposition: form-data; name="%s"; filename="%s"
Content-Disposition: form-data; name="%s"; filename="%s"
---------------------------%u%0.4x%0.8x
---------------------------%u%0.4x%0.8x
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
id=%0.8X%0.8X%0.8X%0.4X%0.4X%0.4X&iv=%0.8X&av=%0.8X&uptime=%u
id=%0.8X%0.8X%0.8X%0.4X%0.4X%0.4X&iv=%0.8X&av=%0.8X&uptime=%u
&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s&name=%ws&domain=%ws
&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s&name=%ws&domain=%ws
[VNC] Parse param error: %s
[VNC] Parse param error: %s
\regsvr32.exe
\regsvr32.exe
[VNC] Fail create process: %u
[VNC] Fail create process: %u
[VNC] Fail inject to process: %u
[VNC] Fail inject to process: %u
fv_%u.avi
fv_%u.avi
#FV_%u
#FV_%u
#FV_%s
#FV_%s
pass.txt
pass.txt
cert.pfx
cert.pfx
PFXImportCertStore
PFXImportCertStore
Crypt32.dll
Crypt32.dll
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3-1", false);
user_pref("network.http.spdy.enabled.v3-1", false);
user_pref("layers.acceleration.disabled", true);
user_pref("layers.acceleration.disabled", true);
user_pref("gfx.direct2d.disabled", true);
user_pref("gfx.direct2d.disabled", true);
prefs.js
prefs.js
csrss.exe
csrss.exe
smss.exe
smss.exe
wininit.exe
wininit.exe
services.exe
services.exe
svchost.exe
svchost.exe
lsas.exe
lsas.exe
lsm.exe
lsm.exe
winlogon.exe
winlogon.exe
Dbgview.exe
Dbgview.exe
taskhost.exe
taskhost.exe
HttpEndRequestA
HttpEndRequestA
HttpEndRequestW
HttpEndRequestW
%s%s%u
%s%s%u
ADVAPI32.DLL
ADVAPI32.DLL
Init in Browser = %u
Init in Browser = %u
Init in Shell = %u
Init in Shell = %u
[Socks] Failt connect BC [%s:%u]
[Socks] Failt connect BC [%s:%u]
[Socks] Fail parse param: %s
[Socks] Fail parse param: %s
regsvr32.exe "%s"
regsvr32.exe "%s"
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
#cert
#cert
regsvr32.exe /s /i:"%u" "%s"
regsvr32.exe /s /i:"%u" "%s"
[Pony] Fail Get Pass
[Pony] Fail Get Pass
DL_EXEC LOAD ERROR: %u = %s
DL_EXEC LOAD ERROR: %u = %s
DL_EXEC Status [Pipe]: %u-%u-%u-%u
DL_EXEC Status [Pipe]: %u-%u-%u-%u
DL_EXEC Status[Local]: %u = %u
DL_EXEC Status[Local]: %u = %u
Start Socks addr: %s
Start Socks addr: %s
Start Socks Status[Pipe]: %u-%u-%u
Start Socks Status[Pipe]: %u-%u-%u
Start Socks Status[Local]: %u
Start Socks Status[Local]: %u
Start VNC addr: %s
Start VNC addr: %s
Start VNC Status[Pipe]: %u-%u-%u
Start VNC Status[Pipe]: %u-%u-%u
Start VNC Status[Local]: %u
Start VNC Status[Local]: %u
msvcrt.dll
msvcrt.dll
%0.8X%0.8X%c
%0.8X%0.8X%c
firefox.exe
firefox.exe
explorer.exe
explorer.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
\\.\pipe\
\\.\pipe\
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
hXXp://
hXXp://
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
%Program Files%\Mozilla Firefox\
%Program Files%\Mozilla Firefox\
mozsqlite3.dll
mozsqlite3.dll
sqlite3_open
sqlite3_open
sqlite3_exec
sqlite3_exec
sqlite3_close
sqlite3_close
sqlite3_free
sqlite3_free
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
[BC] Cmd Ver Error
[BC] Cmd Ver Error
[BC] Wait Ping error %u[%u]
[BC] Wait Ping error %u[%u]
[BC] Fail Connect: %u
[BC] Fail Connect: %u
[BC] Fail read cmd
[BC] Fail read cmd
[BC] Cmd need reauth
[BC] Cmd need reauth
[BC] cmd error: %u
[BC] cmd error: %u
[BC] Cmd need disconnect
[BC] Cmd need disconnect
ntdll.dll
ntdll.dll
gdiplus.dll
gdiplus.dll
GdiplusShutdown
GdiplusShutdown
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
account.cfg
account.cfg
account.cfn
account.cfn
Dir #%u
Dir #%u
.oeaccount
.oeaccount
Software\Microsoft\Windows Live Mail
Software\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Mail
\Microsoft\Windows Mail
\Microsoft\Windows Mail
PopPort
PopPort
PopPassword
PopPassword
SmtpServer
SmtpServer
SmtpPort
SmtpPort
SmtpAccount
SmtpAccount
SmtpPassword
SmtpPassword
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
MS IE FTP Passwords
MS IE FTP Passwords
Password
Password
Software\Far\Plugins\FTP\Hosts
Software\Far\Plugins\FTP\Hosts
Software\Far2\Plugins\FTP\Hosts
Software\Far2\Plugins\FTP\Hosts
Software\Far Manager\Plugins\FTP\Hosts
Software\Far Manager\Plugins\FTP\Hosts
Software\Far\SavedDialogHistory\FTPHost
Software\Far\SavedDialogHistory\FTPHost
Software\Far2\SavedDialogHistory\FTPHost
Software\Far2\SavedDialogHistory\FTPHost
Software\Far Manager\SavedDialogHistory\FTPHost
Software\Far Manager\SavedDialogHistory\FTPHost
\win.ini
\win.ini
WS_FTP
WS_FTP
\Ipswitch\WS_FTP
\Ipswitch\WS_FTP
\GlobalSCAPE\CuteFTP
\GlobalSCAPE\CuteFTP
sm.dat
sm.dat
\GlobalSCAPE\CuteFTP Pro
\GlobalSCAPE\CuteFTP Pro
\GlobalSCAPE\CuteFTP Lite
\GlobalSCAPE\CuteFTP Lite
\CuteFTP
\CuteFTP
CUTEFTP
CUTEFTP
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
\Sites.dat
\Sites.dat
\Quick.dat
\Quick.dat
\History.dat
\History.dat
Software\BPFTP\Bullet Proof FTP\Main
Software\BPFTP\Bullet Proof FTP\Main
Software\BulletProof Software\BulletProof FTP Client\Main
Software\BulletProof Software\BulletProof FTP Client\Main
Software\BPFTP\Bullet Proof FTP\Options
Software\BPFTP\Bullet Proof FTP\Options
Software\BulletProof Software\BulletProof FTP Client\Options
Software\BulletProof Software\BulletProof FTP Client\Options
Software\BPFTP
Software\BPFTP
\SmartFTP
\SmartFTP
Favorites.dat
Favorites.dat
History.dat
History.dat
Software\TurboFTP
Software\TurboFTP
\TurboFTP
\TurboFTP
addrbk.dat
addrbk.dat
quick.dat
quick.dat
Port
Port
Login
Login
PasswordType
PasswordType
profiles.xml
profiles.xml
\FTP Explorer
\FTP Explorer
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
Software\FTP Explorer\Profiles
Software\FTP Explorer\Profiles
FtpSite.xml
FtpSite.xml
RushSite.xml
RushSite.xml
\FTPRush
\FTPRush
bitkinex.ds
bitkinex.ds
NDSites.ini
NDSites.ini
Software\LeechFTP
Software\LeechFTP
bookmark.dat
bookmark.dat
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
sites.db
sites.db
servers.xml
servers.xml
\FTPGetter
\FTPGetter
ESTdb2.dat
ESTdb2.dat
\Estsoft\ALFTP
\Estsoft\ALFTP
QData.dat
QData.dat
SM.arch
SM.arch
FTP .Link\shell\open\command
FTP .Link\shell\open\command
NppFTP.xml
NppFTP.xml
Software\MAS-Soft\FTPInfo\Setup
Software\MAS-Soft\FTPInfo\Setup
ServerList.xml
ServerList.xml
\FTPInfo
\FTPInfo
NovaFTP.db
NovaFTP.db
\INSoftware\NovaFTP
\INSoftware\NovaFTP
\sites.xml
\sites.xml
ftplast.osd
ftplast.osd
\SharedSettings.ccs
\SharedSettings.ccs
\SharedSettings.sqlite
\SharedSettings.sqlite
\SharedSettings_1_0_5.ccs
\SharedSettings_1_0_5.ccs
\SharedSettings_1_0_5.sqlite
\SharedSettings_1_0_5.sqlite
\32BitFtp.ini
\32BitFtp.ini
FTPCON
FTPCON
FTP CONTROL
FTP CONTROL
FTPVoyager.ftp
FTPVoyager.ftp
\RhinoSoft.com
\RhinoSoft.com
FTPVoyager.qc
FTPVoyager.qc
FTPVoyager.Archive
FTPVoyager.Archive
SiteInfo.QFP
SiteInfo.QFP
WinFTP
WinFTP
DeluxeFTP
DeluxeFTP
sites.xml
sites.xml
Staff-FTP
Staff-FTP
sites.ini
sites.ini
FreshFTP
FreshFTP
Software\FlashPeak\BlazeFtp\Settings
Software\FlashPeak\BlazeFtp\Settings
LastPassword
LastPassword
LastPort
LastPort
BlazeFtp
BlazeFtp
site.dat
site.dat
\BlazeFtp
\BlazeFtp
GoFTP
GoFTP
Connections.txt
Connections.txt
3D-FTP
3D-FTP
\3D-FTP
\3D-FTP
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
EasyFTP
EasyFTP
FTPNow
FTPNow
FTP Now
FTP Now
FTPShell
FTPShell
ftpshell.fsi
ftpshell.fsi
ftpsite.ini
ftpsite.ini
FTPList.db
FTPList.db
My FTP
My FTP
project.ini
project.ini
Mailbox.ini
Mailbox.ini
FTP Navigator
FTP Navigator
FTP Commander
FTP Commander
ftplist.txt
ftplist.txt
Software\Sota\FFFTP
Software\Sota\FFFTP
Software\Sota\FFFTP\Options
Software\Sota\FFFTP\Options
Software\FTPWare\COREFTP\Sites
Software\FTPWare\COREFTP\Sites
FtpPort
FtpPort
Software\Cryer\WebSitePublisher
Software\Cryer\WebSitePublisher
_Password
_Password
Software\NCH Software\ClassicFTP\FTPAccounts
Software\NCH Software\ClassicFTP\FTPAccounts
FtpPassword
FtpPassword
_FtpPassword
_FtpPassword
FtpServer
FtpServer
FtpUserName
FtpUserName
FtpDirectory
FtpDirectory
Software\FTPClient\Sites
Software\FTPClient\Sites
Software\SoftX.org\FTPClient\Sites
Software\SoftX.org\FTPClient\Sites
PortNumber
PortNumber
PassWord
PassWord
Software\South River Technologies\WebDrive\Connections
Software\South River Technologies\WebDrive\Connections
Software\LinasFTP\Site Manager
Software\LinasFTP\Site Manager
FTP destination password
FTP destination password
FTP destination server
FTP destination server
FTP destination port
FTP destination port
FTP destination user
FTP destination user
FTP destination catalog
FTP destination catalog
FTP profiles
FTP profiles
Msi.dll
Msi.dll
{74FF1730-B1F2-4D88-926B-1568FAE61DB7}
{74FF1730-B1F2-4D88-926B-1568FAE61DB7}
\PocoSystem.ini
\PocoSystem.ini
accounts.ini
accounts.ini
sites.dat
sites.dat
\LeapWare\LeapFTP
\LeapWare\LeapFTP
unleap.exe
unleap.exe
leapftp
leapftp
FtpIniName
FtpIniName
Software\Ghisler\Windows Commander
Software\Ghisler\Windows Commander
wcx_PTF.ini
wcx_PTF.ini
Server.Pass
Server.Pass
Server.Host
Server.Host
Server.User
Server.User
Server.Port
Server.Port
Last Server Pass
Last Server Pass
Last Server Port
Last Server Port
\sitemanager.xml
\sitemanager.xml
\recentservers.xml
\recentservers.xml
\filezilla.xml
\filezilla.xml
"password" : "
"password" : "
"password":"
"password":"
\drives.js
\drives.js
\ExpanDrive\favorites.js
\ExpanDrive\favorites.js
\ExpanDrive\drives.js
\ExpanDrive\drives.js
wiseftpsrvs.ini
wiseftpsrvs.ini
wisePTF.ini
wisePTF.ini
wiseftpsrvs.bin
wiseftpsrvs.bin
SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}
SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}
SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}
SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}
FTP Count
FTP Count
FTP File%u
FTP File%u
Robo-FTP
Robo-FTP
SOFTWARE\%s\FTPServers
SOFTWARE\%s\FTPServers
user.config
user.config
.duck
.duck
SiteServer %u\Host
SiteServer %u\Host
SiteServer %u\WebUrl
SiteServer %u\WebUrl
SiteServer %u\Remote Directory
SiteServer %u\Remote Directory
SiteServer %u-User
SiteServer %u-User
SiteServer %u-User PW
SiteServer %u-User PW
SiteServer %u\SFTP
SiteServer %u\SFTP
Keychain
Keychain
Software\Nico Mak Computing\WinZip\FTP
Software\Nico Mak Computing\WinZip\FTP
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
sqlite3.dll
sqlite3.dll
sqlite3_prepare
sqlite3_prepare
sqlite3_step
sqlite3_step
sqlite3_column_bytes
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_column_blob
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins
PTF://
PTF://
signons.sqlite
signons.sqlite
\profiles.ini
\profiles.ini
PathToExe
PathToExe
\Mozilla\Firefox\
\Mozilla\Firefox\
Firefox
Firefox
Software\Mozilla
Software\Mozilla
fireFTPsites.dat
fireFTPsites.dat
\Mozilla\SeaMonkey\
\Mozilla\SeaMonkey\
SeaMonkey
SeaMonkey
\Mozilla\Profiles\
\Mozilla\Profiles\
Mozilla
Mozilla
password 51:b:
password 51:b:
SMTP Email Address
SMTP Email Address
SMTP Server
SMTP Server
SMTP User Name
SMTP User Name
HTTP User
HTTP User
HTTP Server URL
HTTP Server URL
HTTPMail User Name
HTTPMail User Name
HTTPMail Server
HTTPMail Server
SMTP User
SMTP User
POP3 Port
POP3 Port
SMTP Port
SMTP Port
IMAP Port
IMAP Port
POP3 Password2
POP3 Password2
IMAP Password2
IMAP Password2
NNTP Password2
NNTP Password2
HTTPMail Password2
HTTPMail Password2
SMTP Password2
SMTP Password2
POP3 Password
POP3 Password
IMAP Password
IMAP Password
NNTP Password
NNTP Password
HTTPMail Password
HTTPMail Password
SMTP Password
SMTP Password
{X-X-X-XX-XXXXXX}
{X-X-X-XX-XXXXXX}
inetcomm server passwords
inetcomm server passwords
outlook account manager passwords
outlook account manager passwords
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Pstorec.dll
Pstorec.dll
[VNC] EXEC: %s
[VNC] EXEC: %s
IE WND [%0.8X] ENABLED: %s VISIBLED: %s
IE WND [%0.8X] ENABLED: %s VISIBLED: %s
[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s
[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s
[VDESK] Read CMD %u[%u]
[VDESK] Read CMD %u[%u]
[VDESK] NOT AUTH CMD %u
[VDESK] NOT AUTH CMD %u
GetAsyncKeyState
GetAsyncKeyState
USER32.DLL
USER32.DLL
GetKeyboardState
GetKeyboardState
GetKeyState
GetKeyState
?WINMM.DLL
?WINMM.DLL
?DSOUND.DLL
?DSOUND.DLL
ZwConnectPort
ZwConnectPort
NTDLL.DLL
NTDLL.DLL
[VNC] PROCESS=%s
[VNC] PROCESS=%s
\explorer.exe
\explorer.exe
[VNC] SearchApp Status = %u
[VNC] SearchApp Status = %u
[VNC] FileName = %s
[VNC] FileName = %s
[VNC] CmdLine = %s
[VNC] CmdLine = %s
[VNC] W64 Redir OLD=%u
[VNC] W64 Redir OLD=%u
[VNC] CreateProcess Status = %u (%u)
[VNC] CreateProcess Status = %u (%u)
SysShadow
SysShadow
Chrome_WidgetWin_1
Chrome_WidgetWin_1
Chrome_WidgetWin_0
Chrome_WidgetWin_0
d3d10_1.dll
d3d10_1.dll
d3d10_1core.dll
d3d10_1core.dll
d3d10.dll
d3d10.dll
d3d10core.dll
d3d10core.dll
d2d1.dll
d2d1.dll
OPENGL32.dll
OPENGL32.dll
d3d9.dll
d3d9.dll
d3d11.dll
d3d11.dll
Dxtrans.dll
Dxtrans.dll
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
NETAPI32.dll
NETAPI32.dll
SHDeleteKeyA
SHDeleteKeyA
SHLWAPI.dll
SHLWAPI.dll
DeleteUrlCacheEntry
DeleteUrlCacheEntry
WININET.dll
WININET.dll
WS2_32.dll
WS2_32.dll
MSVCRT.dll
MSVCRT.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
AVIFIL32.dll
AVIFIL32.dll
GetWindowsDirectoryW
GetWindowsDirectoryW
CallNamedPipeA
CallNamedPipeA
ConnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
CreateNamedPipeW
DisconnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
CreateNamedPipeA
GetWindowsDirectoryA
GetWindowsDirectoryA
EnumWindows
EnumWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
SetViewportOrgEx
SetViewportOrgEx
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
RegEnumKeyExA
RegEnumKeyExA
RegCreateKeyA
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyA
RegOpenKeyA
OLEAUT32.dll
OLEAUT32.dll
CertOpenSystemStoreA
CertOpenSystemStoreA
CertDeleteCertificateFromStore
CertDeleteCertificateFromStore
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXExportCertStoreEx
CRYPT32.dll
CRYPT32.dll
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
FindCloseUrlCache
FindCloseUrlCache
FindNextUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryW
COMDLG32.dll
COMDLG32.dll
WININET.DLL
WININET.DLL
%Documents and Settings%\All Users\Application Data\SaduMogaz\XamaPteq.wcd
%Documents and Settings%\All Users\Application Data\SaduMogaz\XamaPteq.wcd
{4E153850-602D-4819-B83D-3CCD0A1E7351}
{4E153850-602D-4819-B83D-3CCD0A1E7351}
{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}
{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}
{1DB12055-380D-432E-9763-74AF5EF609C7}
{1DB12055-380D-432E-9763-74AF5EF609C7}
\\.\pipe\{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}
\\.\pipe\{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}
D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}
D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}
{7BD47FDD-1028-4944-A268-024C76A61BA9}
{7BD47FDD-1028-4944-A268-024C76A61BA9}
U{4E153850-602D-4819-B83D-3CCD0A1E7351}
U{4E153850-602D-4819-B83D-3CCD0A1E7351}
11166F2F-6DE1-4205-8360-3AB2448931C2
11166F2F-6DE1-4205-8360-3AB2448931C2
1#1,12181
1#1,12181
2#21292>2
2#21292>2
lc:\32.dll
lc:\32.dll
32.dll
32.dll
echrome.dll
echrome.dll
regsvr32.exe
regsvr32.exe
%c:\~%0.8x.tmp
%c:\~%0.8x.tmp
iexplore.exe
iexplore.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
\ThemeApiPort
\ThemeApiPort
jqs.exe_1628_rwx_010B0000_00059000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
HHt.HHt
HHt.HHt
More information: hXXp://VVV.ibsensoftware.com/
More information: hXXp://VVV.ibsensoftware.com/
8HttpAddRequestHeadersA
8HttpAddRequestHeadersA
HttpOpenRequestA
HttpOpenRequestA
HttpOpenRequestW
HttpOpenRequestW
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestA
HttpSendRequestExA
HttpSendRequestExA
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestW
HttpSendRequestW
wininet.dll
wininet.dll
rapport
rapport
ieframe.dll
ieframe.dll
NSPR4.DLL
NSPR4.DLL
nss3.dll
nss3.dll
KERNEL32.DLL
KERNEL32.DLL
\Google\Chrome\User Data\Default\
\Google\Chrome\User Data\Default\
\Mozilla\Firefox\Profiles\
\Mozilla\Firefox\Profiles\
sol_chrome/
sol_chrome/
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\
tor2web.org
tor2web.org
hXXps://%s.%s/favicon.ico
hXXps://%s.%s/favicon.ico
.rdata
.rdata
@http
@http
SELECT url FROM moz_places
SELECT url FROM moz_places
places.sqlite
places.sqlite
ie/history.txt
ie/history.txt
ff/history.txt
ff/history.txt
ff/%u/places.sqlite
ff/%u/places.sqlite
framework_key%
framework_key%
eval('var %s '
eval('var %s '
%s.Key = '%s';
%s.Key = '%s';
%s.Hide('%0.8X%0.8X');
%s.Hide('%0.8X%0.8X');
CertificateAuthority
CertificateAuthority
%s.pfx
%s.pfx
cookies.sqlite
cookies.sqlite
cookies.sqlite-journal
cookies.sqlite-journal
ff/%u/cookies.sqlite
ff/%u/cookies.sqlite
c:\test_x32.dll
c:\test_x32.dll
#dbgmsg
#dbgmsg
[%s - X32 EQ PID: %u TID: %u]
[%s - X32 EQ PID: %u TID: %u]
X-Firefox-Spdy
X-Firefox-Spdy
X-WebKit-CSP
X-WebKit-CSP
hXXps://
hXXps://
HTTP/1.1 200 OK
HTTP/1.1 200 OK
Content-Length: %u
Content-Length: %u
GET /favicon.ico HTTP/1.1
GET /favicon.ico HTTP/1.1
GET /favicon.ico HTTP/1.0
GET /favicon.ico HTTP/1.0
login=%s&pass=%s
login=%s&pass=%s
C:\ProgramData
C:\ProgramData
%Documents and Settings%\All Users\Application Data
%Documents and Settings%\All Users\Application Data
chrome.dll
chrome.dll
127.0.0.1
127.0.0.1
DrWeb
DrWeb
McAfee.com
McAfee.com
Doctor Web
Doctor Web
Common Files\Doctor Web
Common Files\Doctor Web
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\
Content-Disposition: form-data; name="%s"
Content-Disposition: form-data; name="%s"
--%s--
--%s--
Content-Disposition: form-data; name="%s"; filename="%s"
Content-Disposition: form-data; name="%s"; filename="%s"
---------------------------%u%0.4x%0.8x
---------------------------%u%0.4x%0.8x
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
id=%0.8X%0.8X%0.8X%0.4X%0.4X%0.4X&iv=%0.8X&av=%0.8X&uptime=%u
id=%0.8X%0.8X%0.8X%0.4X%0.4X%0.4X&iv=%0.8X&av=%0.8X&uptime=%u
&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s&name=%ws&domain=%ws
&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s&name=%ws&domain=%ws
[VNC] Parse param error: %s
[VNC] Parse param error: %s
\regsvr32.exe
\regsvr32.exe
[VNC] Fail create process: %u
[VNC] Fail create process: %u
[VNC] Fail inject to process: %u
[VNC] Fail inject to process: %u
fv_%u.avi
fv_%u.avi
#FV_%u
#FV_%u
#FV_%s
#FV_%s
pass.txt
pass.txt
cert.pfx
cert.pfx
PFXImportCertStore
PFXImportCertStore
Crypt32.dll
Crypt32.dll
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3-1", false);
user_pref("network.http.spdy.enabled.v3-1", false);
user_pref("layers.acceleration.disabled", true);
user_pref("layers.acceleration.disabled", true);
user_pref("gfx.direct2d.disabled", true);
user_pref("gfx.direct2d.disabled", true);
prefs.js
prefs.js
csrss.exe
csrss.exe
smss.exe
smss.exe
wininit.exe
wininit.exe
services.exe
services.exe
svchost.exe
svchost.exe
lsas.exe
lsas.exe
lsm.exe
lsm.exe
winlogon.exe
winlogon.exe
Dbgview.exe
Dbgview.exe
taskhost.exe
taskhost.exe
HttpEndRequestA
HttpEndRequestA
HttpEndRequestW
HttpEndRequestW
%s%s%u
%s%s%u
ADVAPI32.DLL
ADVAPI32.DLL
Init in Browser = %u
Init in Browser = %u
Init in Shell = %u
Init in Shell = %u
[Socks] Failt connect BC [%s:%u]
[Socks] Failt connect BC [%s:%u]
[Socks] Fail parse param: %s
[Socks] Fail parse param: %s
regsvr32.exe "%s"
regsvr32.exe "%s"
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
#cert
#cert
regsvr32.exe /s /i:"%u" "%s"
regsvr32.exe /s /i:"%u" "%s"
[Pony] Fail Get Pass
[Pony] Fail Get Pass
DL_EXEC LOAD ERROR: %u = %s
DL_EXEC LOAD ERROR: %u = %s
DL_EXEC Status [Pipe]: %u-%u-%u-%u
DL_EXEC Status [Pipe]: %u-%u-%u-%u
DL_EXEC Status[Local]: %u = %u
DL_EXEC Status[Local]: %u = %u
Start Socks addr: %s
Start Socks addr: %s
Start Socks Status[Pipe]: %u-%u-%u
Start Socks Status[Pipe]: %u-%u-%u
Start Socks Status[Local]: %u
Start Socks Status[Local]: %u
Start VNC addr: %s
Start VNC addr: %s
Start VNC Status[Pipe]: %u-%u-%u
Start VNC Status[Pipe]: %u-%u-%u
Start VNC Status[Local]: %u
Start VNC Status[Local]: %u
msvcrt.dll
msvcrt.dll
%0.8X%0.8X%c
%0.8X%0.8X%c
firefox.exe
firefox.exe
explorer.exe
explorer.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
\\.\pipe\
\\.\pipe\
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
hXXp://
hXXp://
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
%Program Files%\Mozilla Firefox\
%Program Files%\Mozilla Firefox\
mozsqlite3.dll
mozsqlite3.dll
sqlite3_open
sqlite3_open
sqlite3_exec
sqlite3_exec
sqlite3_close
sqlite3_close
sqlite3_free
sqlite3_free
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
[BC] Cmd Ver Error
[BC] Cmd Ver Error
[BC] Wait Ping error %u[%u]
[BC] Wait Ping error %u[%u]
[BC] Fail Connect: %u
[BC] Fail Connect: %u
[BC] Fail read cmd
[BC] Fail read cmd
[BC] Cmd need reauth
[BC] Cmd need reauth
[BC] cmd error: %u
[BC] cmd error: %u
[BC] Cmd need disconnect
[BC] Cmd need disconnect
ntdll.dll
ntdll.dll
gdiplus.dll
gdiplus.dll
GdiplusShutdown
GdiplusShutdown
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
account.cfg
account.cfg
account.cfn
account.cfn
Dir #%u
Dir #%u
.oeaccount
.oeaccount
Software\Microsoft\Windows Live Mail
Software\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Mail
\Microsoft\Windows Mail
\Microsoft\Windows Mail
PopPort
PopPort
PopPassword
PopPassword
SmtpServer
SmtpServer
SmtpPort
SmtpPort
SmtpAccount
SmtpAccount
SmtpPassword
SmtpPassword
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
MS IE FTP Passwords
MS IE FTP Passwords
Password
Password
Software\Far\Plugins\FTP\Hosts
Software\Far\Plugins\FTP\Hosts
Software\Far2\Plugins\FTP\Hosts
Software\Far2\Plugins\FTP\Hosts
Software\Far Manager\Plugins\FTP\Hosts
Software\Far Manager\Plugins\FTP\Hosts
Software\Far\SavedDialogHistory\FTPHost
Software\Far\SavedDialogHistory\FTPHost
Software\Far2\SavedDialogHistory\FTPHost
Software\Far2\SavedDialogHistory\FTPHost
Software\Far Manager\SavedDialogHistory\FTPHost
Software\Far Manager\SavedDialogHistory\FTPHost
\win.ini
\win.ini
WS_FTP
WS_FTP
\Ipswitch\WS_FTP
\Ipswitch\WS_FTP
\GlobalSCAPE\CuteFTP
\GlobalSCAPE\CuteFTP
sm.dat
sm.dat
\GlobalSCAPE\CuteFTP Pro
\GlobalSCAPE\CuteFTP Pro
\GlobalSCAPE\CuteFTP Lite
\GlobalSCAPE\CuteFTP Lite
\CuteFTP
\CuteFTP
CUTEFTP
CUTEFTP
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
\Sites.dat
\Sites.dat
\Quick.dat
\Quick.dat
\History.dat
\History.dat
Software\BPFTP\Bullet Proof FTP\Main
Software\BPFTP\Bullet Proof FTP\Main
Software\BulletProof Software\BulletProof FTP Client\Main
Software\BulletProof Software\BulletProof FTP Client\Main
Software\BPFTP\Bullet Proof FTP\Options
Software\BPFTP\Bullet Proof FTP\Options
Software\BulletProof Software\BulletProof FTP Client\Options
Software\BulletProof Software\BulletProof FTP Client\Options
Software\BPFTP
Software\BPFTP
\SmartFTP
\SmartFTP
Favorites.dat
Favorites.dat
History.dat
History.dat
Software\TurboFTP
Software\TurboFTP
\TurboFTP
\TurboFTP
addrbk.dat
addrbk.dat
quick.dat
quick.dat
Port
Port
Login
Login
PasswordType
PasswordType
profiles.xml
profiles.xml
\FTP Explorer
\FTP Explorer
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
Software\FTP Explorer\Profiles
Software\FTP Explorer\Profiles
FtpSite.xml
FtpSite.xml
RushSite.xml
RushSite.xml
\FTPRush
\FTPRush
bitkinex.ds
bitkinex.ds
NDSites.ini
NDSites.ini
Software\LeechFTP
Software\LeechFTP
bookmark.dat
bookmark.dat
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
sites.db
sites.db
servers.xml
servers.xml
\FTPGetter
\FTPGetter
ESTdb2.dat
ESTdb2.dat
\Estsoft\ALFTP
\Estsoft\ALFTP
QData.dat
QData.dat
SM.arch
SM.arch
FTP .Link\shell\open\command
FTP .Link\shell\open\command
NppFTP.xml
NppFTP.xml
Software\MAS-Soft\FTPInfo\Setup
Software\MAS-Soft\FTPInfo\Setup
ServerList.xml
ServerList.xml
\FTPInfo
\FTPInfo
NovaFTP.db
NovaFTP.db
\INSoftware\NovaFTP
\INSoftware\NovaFTP
\sites.xml
\sites.xml
ftplast.osd
ftplast.osd
\SharedSettings.ccs
\SharedSettings.ccs
\SharedSettings.sqlite
\SharedSettings.sqlite
\SharedSettings_1_0_5.ccs
\SharedSettings_1_0_5.ccs
\SharedSettings_1_0_5.sqlite
\SharedSettings_1_0_5.sqlite
\32BitFtp.ini
\32BitFtp.ini
FTPCON
FTPCON
FTP CONTROL
FTP CONTROL
FTPVoyager.ftp
FTPVoyager.ftp
\RhinoSoft.com
\RhinoSoft.com
FTPVoyager.qc
FTPVoyager.qc
FTPVoyager.Archive
FTPVoyager.Archive
SiteInfo.QFP
SiteInfo.QFP
WinFTP
WinFTP
DeluxeFTP
DeluxeFTP
sites.xml
sites.xml
Staff-FTP
Staff-FTP
sites.ini
sites.ini
FreshFTP
FreshFTP
Software\FlashPeak\BlazeFtp\Settings
Software\FlashPeak\BlazeFtp\Settings
LastPassword
LastPassword
LastPort
LastPort
BlazeFtp
BlazeFtp
site.dat
site.dat
\BlazeFtp
\BlazeFtp
GoFTP
GoFTP
Connections.txt
Connections.txt
3D-FTP
3D-FTP
\3D-FTP
\3D-FTP
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
EasyFTP
EasyFTP
FTPNow
FTPNow
FTP Now
FTP Now
FTPShell
FTPShell
ftpshell.fsi
ftpshell.fsi
ftpsite.ini
ftpsite.ini
FTPList.db
FTPList.db
My FTP
My FTP
project.ini
project.ini
Mailbox.ini
Mailbox.ini
FTP Navigator
FTP Navigator
FTP Commander
FTP Commander
ftplist.txt
ftplist.txt
Software\Sota\FFFTP
Software\Sota\FFFTP
Software\Sota\FFFTP\Options
Software\Sota\FFFTP\Options
Software\FTPWare\COREFTP\Sites
Software\FTPWare\COREFTP\Sites
FtpPort
FtpPort
Software\Cryer\WebSitePublisher
Software\Cryer\WebSitePublisher
_Password
_Password
Software\NCH Software\ClassicFTP\FTPAccounts
Software\NCH Software\ClassicFTP\FTPAccounts
FtpPassword
FtpPassword
_FtpPassword
_FtpPassword
FtpServer
FtpServer
FtpUserName
FtpUserName
FtpDirectory
FtpDirectory
Software\FTPClient\Sites
Software\FTPClient\Sites
Software\SoftX.org\FTPClient\Sites
Software\SoftX.org\FTPClient\Sites
PortNumber
PortNumber
PassWord
PassWord
Software\South River Technologies\WebDrive\Connections
Software\South River Technologies\WebDrive\Connections
Software\LinasFTP\Site Manager
Software\LinasFTP\Site Manager
FTP destination password
FTP destination password
FTP destination server
FTP destination server
FTP destination port
FTP destination port
FTP destination user
FTP destination user
FTP destination catalog
FTP destination catalog
FTP profiles
FTP profiles
Msi.dll
Msi.dll
{74FF1730-B1F2-4D88-926B-1568FAE61DB7}
{74FF1730-B1F2-4D88-926B-1568FAE61DB7}
\PocoSystem.ini
\PocoSystem.ini
accounts.ini
accounts.ini
sites.dat
sites.dat
\LeapWare\LeapFTP
\LeapWare\LeapFTP
unleap.exe
unleap.exe
leapftp
leapftp
FtpIniName
FtpIniName
Software\Ghisler\Windows Commander
Software\Ghisler\Windows Commander
wcx_PTF.ini
wcx_PTF.ini
Server.Pass
Server.Pass
Server.Host
Server.Host
Server.User
Server.User
Server.Port
Server.Port
Last Server Pass
Last Server Pass
Last Server Port
Last Server Port
\sitemanager.xml
\sitemanager.xml
\recentservers.xml
\recentservers.xml
\filezilla.xml
\filezilla.xml
"password" : "
"password" : "
"password":"
"password":"
\drives.js
\drives.js
\ExpanDrive\favorites.js
\ExpanDrive\favorites.js
\ExpanDrive\drives.js
\ExpanDrive\drives.js
wiseftpsrvs.ini
wiseftpsrvs.ini
wisePTF.ini
wisePTF.ini
wiseftpsrvs.bin
wiseftpsrvs.bin
SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}
SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}
SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}
SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}
FTP Count
FTP Count
FTP File%u
FTP File%u
Robo-FTP
Robo-FTP
SOFTWARE\%s\FTPServers
SOFTWARE\%s\FTPServers
user.config
user.config
.duck
.duck
SiteServer %u\Host
SiteServer %u\Host
SiteServer %u\WebUrl
SiteServer %u\WebUrl
SiteServer %u\Remote Directory
SiteServer %u\Remote Directory
SiteServer %u-User
SiteServer %u-User
SiteServer %u-User PW
SiteServer %u-User PW
SiteServer %u\SFTP
SiteServer %u\SFTP
Keychain
Keychain
Software\Nico Mak Computing\WinZip\FTP
Software\Nico Mak Computing\WinZip\FTP
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
sqlite3.dll
sqlite3.dll
sqlite3_prepare
sqlite3_prepare
sqlite3_step
sqlite3_step
sqlite3_column_bytes
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_column_blob
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins
PTF://
PTF://
signons.sqlite
signons.sqlite
\profiles.ini
\profiles.ini
PathToExe
PathToExe
\Mozilla\Firefox\
\Mozilla\Firefox\
Firefox
Firefox
Software\Mozilla
Software\Mozilla
fireFTPsites.dat
fireFTPsites.dat
\Mozilla\SeaMonkey\
\Mozilla\SeaMonkey\
SeaMonkey
SeaMonkey
\Mozilla\Profiles\
\Mozilla\Profiles\
Mozilla
Mozilla
password 51:b:
password 51:b:
SMTP Email Address
SMTP Email Address
SMTP Server
SMTP Server
SMTP User Name
SMTP User Name
HTTP User
HTTP User
HTTP Server URL
HTTP Server URL
HTTPMail User Name
HTTPMail User Name
HTTPMail Server
HTTPMail Server
SMTP User
SMTP User
POP3 Port
POP3 Port
SMTP Port
SMTP Port
IMAP Port
IMAP Port
POP3 Password2
POP3 Password2
IMAP Password2
IMAP Password2
NNTP Password2
NNTP Password2
HTTPMail Password2
HTTPMail Password2
SMTP Password2
SMTP Password2
POP3 Password
POP3 Password
IMAP Password
IMAP Password
NNTP Password
NNTP Password
HTTPMail Password
HTTPMail Password
SMTP Password
SMTP Password
{X-X-X-XX-XXXXXX}
{X-X-X-XX-XXXXXX}
inetcomm server passwords
inetcomm server passwords
outlook account manager passwords
outlook account manager passwords
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Pstorec.dll
Pstorec.dll
[VNC] EXEC: %s
[VNC] EXEC: %s
IE WND [%0.8X] ENABLED: %s VISIBLED: %s
IE WND [%0.8X] ENABLED: %s VISIBLED: %s
[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s
[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s
[VDESK] Read CMD %u[%u]
[VDESK] Read CMD %u[%u]
[VDESK] NOT AUTH CMD %u
[VDESK] NOT AUTH CMD %u
GetAsyncKeyState
GetAsyncKeyState
USER32.DLL
USER32.DLL
GetKeyboardState
GetKeyboardState
GetKeyState
GetKeyState
?WINMM.DLL
?WINMM.DLL
?DSOUND.DLL
?DSOUND.DLL
ZwConnectPort
ZwConnectPort
NTDLL.DLL
NTDLL.DLL
[VNC] PROCESS=%s
[VNC] PROCESS=%s
\explorer.exe
\explorer.exe
[VNC] SearchApp Status = %u
[VNC] SearchApp Status = %u
[VNC] FileName = %s
[VNC] FileName = %s
[VNC] CmdLine = %s
[VNC] CmdLine = %s
[VNC] W64 Redir OLD=%u
[VNC] W64 Redir OLD=%u
[VNC] CreateProcess Status = %u (%u)
[VNC] CreateProcess Status = %u (%u)
SysShadow
SysShadow
Chrome_WidgetWin_1
Chrome_WidgetWin_1
Chrome_WidgetWin_0
Chrome_WidgetWin_0
d3d10_1.dll
d3d10_1.dll
d3d10_1core.dll
d3d10_1core.dll
d3d10.dll
d3d10.dll
d3d10core.dll
d3d10core.dll
d2d1.dll
d2d1.dll
OPENGL32.dll
OPENGL32.dll
d3d9.dll
d3d9.dll
d3d11.dll
d3d11.dll
Dxtrans.dll
Dxtrans.dll
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
NETAPI32.dll
NETAPI32.dll
SHDeleteKeyA
SHDeleteKeyA
SHLWAPI.dll
SHLWAPI.dll
DeleteUrlCacheEntry
DeleteUrlCacheEntry
WININET.dll
WININET.dll
WS2_32.dll
WS2_32.dll
MSVCRT.dll
MSVCRT.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
AVIFIL32.dll
AVIFIL32.dll
GetWindowsDirectoryW
GetWindowsDirectoryW
CallNamedPipeA
CallNamedPipeA
ConnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
CreateNamedPipeW
DisconnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
CreateNamedPipeA
GetWindowsDirectoryA
GetWindowsDirectoryA
EnumWindows
EnumWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
SetViewportOrgEx
SetViewportOrgEx
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
RegEnumKeyExA
RegEnumKeyExA
RegCreateKeyA
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyA
RegOpenKeyA
OLEAUT32.dll
OLEAUT32.dll
CertOpenSystemStoreA
CertOpenSystemStoreA
CertDeleteCertificateFromStore
CertDeleteCertificateFromStore
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXExportCertStoreEx
CRYPT32.dll
CRYPT32.dll
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
FindCloseUrlCache
FindCloseUrlCache
FindNextUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryW
COMDLG32.dll
COMDLG32.dll
WININET.DLL
WININET.DLL
1#1,12181
1#1,12181
2#21292>2
2#21292>2
.pdata
.pdata
@.reloc
@.reloc
c:\test_x64.dll
c:\test_x64.dll
[%s - X64 EQ PID: %u TID: %u]
[%s - X64 EQ PID: %u TID: %u]
\SysWOW64\regsvr32.exe
\SysWOW64\regsvr32.exe
[Pony] Fail create process: %u
[Pony] Fail create process: %u
[PONY] Fail inject to process: %u
[PONY] Fail inject to process: %u
lc:\32.dll
lc:\32.dll
32.dll
32.dll
echrome.dll
echrome.dll
regsvr32.exe
regsvr32.exe
%c:\~%0.8x.tmp
%c:\~%0.8x.tmp
iexplore.exe
iexplore.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
\ThemeApiPort
\ThemeApiPort
lc:\64.dll
lc:\64.dll
64.dll
64.dll
jqs.exe_1628_rwx_01150000_0007E000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
HHt.HHt
HHt.HHt
More information: hXXp://VVV.ibsensoftware.com/
More information: hXXp://VVV.ibsensoftware.com/
8HttpAddRequestHeadersA
8HttpAddRequestHeadersA
HttpOpenRequestA
HttpOpenRequestA
HttpOpenRequestW
HttpOpenRequestW
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestA
HttpSendRequestExA
HttpSendRequestExA
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestW
HttpSendRequestW
wininet.dll
wininet.dll
rapport
rapport
ieframe.dll
ieframe.dll
NSPR4.DLL
NSPR4.DLL
nss3.dll
nss3.dll
KERNEL32.DLL
KERNEL32.DLL
\Google\Chrome\User Data\Default\
\Google\Chrome\User Data\Default\
\Mozilla\Firefox\Profiles\
\Mozilla\Firefox\Profiles\
sol_chrome/
sol_chrome/
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\
\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\
tor2web.org
tor2web.org
hXXps://%s.%s/favicon.ico
hXXps://%s.%s/favicon.ico
.rdata
.rdata
@http
@http
SELECT url FROM moz_places
SELECT url FROM moz_places
places.sqlite
places.sqlite
ie/history.txt
ie/history.txt
ff/history.txt
ff/history.txt
ff/%u/places.sqlite
ff/%u/places.sqlite
framework_key%
framework_key%
eval('var %s '
eval('var %s '
%s.Key = '%s';
%s.Key = '%s';
%s.Hide('%0.8X%0.8X');
%s.Hide('%0.8X%0.8X');
CertificateAuthority
CertificateAuthority
%s.pfx
%s.pfx
cookies.sqlite
cookies.sqlite
cookies.sqlite-journal
cookies.sqlite-journal
ff/%u/cookies.sqlite
ff/%u/cookies.sqlite
c:\test_x32.dll
c:\test_x32.dll
#dbgmsg
#dbgmsg
[%s - X32 EQ PID: %u TID: %u]
[%s - X32 EQ PID: %u TID: %u]
X-Firefox-Spdy
X-Firefox-Spdy
X-WebKit-CSP
X-WebKit-CSP
hXXps://
hXXps://
HTTP/1.1 200 OK
HTTP/1.1 200 OK
Content-Length: %u
Content-Length: %u
GET /favicon.ico HTTP/1.1
GET /favicon.ico HTTP/1.1
GET /favicon.ico HTTP/1.0
GET /favicon.ico HTTP/1.0
login=%s&pass=%s
login=%s&pass=%s
C:\ProgramData
C:\ProgramData
%Documents and Settings%\All Users\Application Data
%Documents and Settings%\All Users\Application Data
chrome.dll
chrome.dll
127.0.0.1
127.0.0.1
DrWeb
DrWeb
McAfee.com
McAfee.com
Doctor Web
Doctor Web
Common Files\Doctor Web
Common Files\Doctor Web
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\
SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\
Content-Disposition: form-data; name="%s"
Content-Disposition: form-data; name="%s"
--%s--
--%s--
Content-Disposition: form-data; name="%s"; filename="%s"
Content-Disposition: form-data; name="%s"; filename="%s"
---------------------------%u%0.4x%0.8x
---------------------------%u%0.4x%0.8x
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
id=%0.8X%0.8X%0.8X%0.4X%0.4X%0.4X&iv=%0.8X&av=%0.8X&uptime=%u
id=%0.8X%0.8X%0.8X%0.4X%0.4X%0.4X&iv=%0.8X&av=%0.8X&uptime=%u
&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s&name=%ws&domain=%ws
&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s&name=%ws&domain=%ws
[VNC] Parse param error: %s
[VNC] Parse param error: %s
\regsvr32.exe
\regsvr32.exe
[VNC] Fail create process: %u
[VNC] Fail create process: %u
[VNC] Fail inject to process: %u
[VNC] Fail inject to process: %u
fv_%u.avi
fv_%u.avi
#FV_%u
#FV_%u
#FV_%s
#FV_%s
pass.txt
pass.txt
cert.pfx
cert.pfx
PFXImportCertStore
PFXImportCertStore
Crypt32.dll
Crypt32.dll
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3-1", false);
user_pref("network.http.spdy.enabled.v3-1", false);
user_pref("layers.acceleration.disabled", true);
user_pref("layers.acceleration.disabled", true);
user_pref("gfx.direct2d.disabled", true);
user_pref("gfx.direct2d.disabled", true);
prefs.js
prefs.js
csrss.exe
csrss.exe
smss.exe
smss.exe
wininit.exe
wininit.exe
services.exe
services.exe
svchost.exe
svchost.exe
lsas.exe
lsas.exe
lsm.exe
lsm.exe
winlogon.exe
winlogon.exe
Dbgview.exe
Dbgview.exe
taskhost.exe
taskhost.exe
HttpEndRequestA
HttpEndRequestA
HttpEndRequestW
HttpEndRequestW
%s%s%u
%s%s%u
ADVAPI32.DLL
ADVAPI32.DLL
Init in Browser = %u
Init in Browser = %u
Init in Shell = %u
Init in Shell = %u
[Socks] Failt connect BC [%s:%u]
[Socks] Failt connect BC [%s:%u]
[Socks] Fail parse param: %s
[Socks] Fail parse param: %s
regsvr32.exe "%s"
regsvr32.exe "%s"
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
#cert
#cert
regsvr32.exe /s /i:"%u" "%s"
regsvr32.exe /s /i:"%u" "%s"
[Pony] Fail Get Pass
[Pony] Fail Get Pass
DL_EXEC LOAD ERROR: %u = %s
DL_EXEC LOAD ERROR: %u = %s
DL_EXEC Status [Pipe]: %u-%u-%u-%u
DL_EXEC Status [Pipe]: %u-%u-%u-%u
DL_EXEC Status[Local]: %u = %u
DL_EXEC Status[Local]: %u = %u
Start Socks addr: %s
Start Socks addr: %s
Start Socks Status[Pipe]: %u-%u-%u
Start Socks Status[Pipe]: %u-%u-%u
Start Socks Status[Local]: %u
Start Socks Status[Local]: %u
Start VNC addr: %s
Start VNC addr: %s
Start VNC Status[Pipe]: %u-%u-%u
Start VNC Status[Pipe]: %u-%u-%u
Start VNC Status[Local]: %u
Start VNC Status[Local]: %u
msvcrt.dll
msvcrt.dll
%0.8X%0.8X%c
%0.8X%0.8X%c
firefox.exe
firefox.exe
explorer.exe
explorer.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
\\.\pipe\
\\.\pipe\
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
hXXp://
hXXp://
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
%Program Files%\Mozilla Firefox\
%Program Files%\Mozilla Firefox\
mozsqlite3.dll
mozsqlite3.dll
sqlite3_open
sqlite3_open
sqlite3_exec
sqlite3_exec
sqlite3_close
sqlite3_close
sqlite3_free
sqlite3_free
dbghelp.dll
dbghelp.dll
\%u.dmp
\%u.dmp
PID: %u [%0.2u:%0.2u:%0.2u]
PID: %u [%0.2u:%0.2u:%0.2u]
[BC] Cmd Ver Error
[BC] Cmd Ver Error
[BC] Wait Ping error %u[%u]
[BC] Wait Ping error %u[%u]
[BC] Fail Connect: %u
[BC] Fail Connect: %u
[BC] Fail read cmd
[BC] Fail read cmd
[BC] Cmd need reauth
[BC] Cmd need reauth
[BC] cmd error: %u
[BC] cmd error: %u
[BC] Cmd need disconnect
[BC] Cmd need disconnect
ntdll.dll
ntdll.dll
gdiplus.dll
gdiplus.dll
GdiplusShutdown
GdiplusShutdown
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
account.cfg
account.cfg
account.cfn
account.cfn
Dir #%u
Dir #%u
.oeaccount
.oeaccount
Software\Microsoft\Windows Live Mail
Software\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
\Microsoft\Windows Live Mail
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Mail
\Microsoft\Windows Mail
\Microsoft\Windows Mail
PopPort
PopPort
PopPassword
PopPassword
SmtpServer
SmtpServer
SmtpPort
SmtpPort
SmtpAccount
SmtpAccount
SmtpPassword
SmtpPassword
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
MS IE FTP Passwords
MS IE FTP Passwords
Password
Password
Software\Far\Plugins\FTP\Hosts
Software\Far\Plugins\FTP\Hosts
Software\Far2\Plugins\FTP\Hosts
Software\Far2\Plugins\FTP\Hosts
Software\Far Manager\Plugins\FTP\Hosts
Software\Far Manager\Plugins\FTP\Hosts
Software\Far\SavedDialogHistory\FTPHost
Software\Far\SavedDialogHistory\FTPHost
Software\Far2\SavedDialogHistory\FTPHost
Software\Far2\SavedDialogHistory\FTPHost
Software\Far Manager\SavedDialogHistory\FTPHost
Software\Far Manager\SavedDialogHistory\FTPHost
\win.ini
\win.ini
WS_FTP
WS_FTP
\Ipswitch\WS_FTP
\Ipswitch\WS_FTP
\GlobalSCAPE\CuteFTP
\GlobalSCAPE\CuteFTP
sm.dat
sm.dat
\GlobalSCAPE\CuteFTP Pro
\GlobalSCAPE\CuteFTP Pro
\GlobalSCAPE\CuteFTP Lite
\GlobalSCAPE\CuteFTP Lite
\CuteFTP
\CuteFTP
CUTEFTP
CUTEFTP
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar
\Sites.dat
\Sites.dat
\Quick.dat
\Quick.dat
\History.dat
\History.dat
Software\BPFTP\Bullet Proof FTP\Main
Software\BPFTP\Bullet Proof FTP\Main
Software\BulletProof Software\BulletProof FTP Client\Main
Software\BulletProof Software\BulletProof FTP Client\Main
Software\BPFTP\Bullet Proof FTP\Options
Software\BPFTP\Bullet Proof FTP\Options
Software\BulletProof Software\BulletProof FTP Client\Options
Software\BulletProof Software\BulletProof FTP Client\Options
Software\BPFTP
Software\BPFTP
\SmartFTP
\SmartFTP
Favorites.dat
Favorites.dat
History.dat
History.dat
Software\TurboFTP
Software\TurboFTP
\TurboFTP
\TurboFTP
addrbk.dat
addrbk.dat
quick.dat
quick.dat
Port
Port
Login
Login
PasswordType
PasswordType
profiles.xml
profiles.xml
\FTP Explorer
\FTP Explorer
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224
Software\FTP Explorer\Profiles
Software\FTP Explorer\Profiles
FtpSite.xml
FtpSite.xml
RushSite.xml
RushSite.xml
\FTPRush
\FTPRush
bitkinex.ds
bitkinex.ds
NDSites.ini
NDSites.ini
Software\LeechFTP
Software\LeechFTP
bookmark.dat
bookmark.dat
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32
sites.db
sites.db
servers.xml
servers.xml
\FTPGetter
\FTPGetter
ESTdb2.dat
ESTdb2.dat
\Estsoft\ALFTP
\Estsoft\ALFTP
QData.dat
QData.dat
SM.arch
SM.arch
FTP .Link\shell\open\command
FTP .Link\shell\open\command
NppFTP.xml
NppFTP.xml
Software\MAS-Soft\FTPInfo\Setup
Software\MAS-Soft\FTPInfo\Setup
ServerList.xml
ServerList.xml
\FTPInfo
\FTPInfo
NovaFTP.db
NovaFTP.db
\INSoftware\NovaFTP
\INSoftware\NovaFTP
\sites.xml
\sites.xml
ftplast.osd
ftplast.osd
\SharedSettings.ccs
\SharedSettings.ccs
\SharedSettings.sqlite
\SharedSettings.sqlite
\SharedSettings_1_0_5.ccs
\SharedSettings_1_0_5.ccs
\SharedSettings_1_0_5.sqlite
\SharedSettings_1_0_5.sqlite
\32BitFtp.ini
\32BitFtp.ini
FTPCON
FTPCON
FTP CONTROL
FTP CONTROL
FTPVoyager.ftp
FTPVoyager.ftp
\RhinoSoft.com
\RhinoSoft.com
FTPVoyager.qc
FTPVoyager.qc
FTPVoyager.Archive
FTPVoyager.Archive
SiteInfo.QFP
SiteInfo.QFP
WinFTP
WinFTP
DeluxeFTP
DeluxeFTP
sites.xml
sites.xml
Staff-FTP
Staff-FTP
sites.ini
sites.ini
FreshFTP
FreshFTP
Software\FlashPeak\BlazeFtp\Settings
Software\FlashPeak\BlazeFtp\Settings
LastPassword
LastPassword
LastPort
LastPort
BlazeFtp
BlazeFtp
site.dat
site.dat
\BlazeFtp
\BlazeFtp
GoFTP
GoFTP
Connections.txt
Connections.txt
3D-FTP
3D-FTP
\3D-FTP
\3D-FTP
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
EasyFTP
EasyFTP
FTPNow
FTPNow
FTP Now
FTP Now
FTPShell
FTPShell
ftpshell.fsi
ftpshell.fsi
ftpsite.ini
ftpsite.ini
FTPList.db
FTPList.db
My FTP
My FTP
project.ini
project.ini
Mailbox.ini
Mailbox.ini
FTP Navigator
FTP Navigator
FTP Commander
FTP Commander
ftplist.txt
ftplist.txt
Software\Sota\FFFTP
Software\Sota\FFFTP
Software\Sota\FFFTP\Options
Software\Sota\FFFTP\Options
Software\FTPWare\COREFTP\Sites
Software\FTPWare\COREFTP\Sites
FtpPort
FtpPort
Software\Cryer\WebSitePublisher
Software\Cryer\WebSitePublisher
_Password
_Password
Software\NCH Software\ClassicFTP\FTPAccounts
Software\NCH Software\ClassicFTP\FTPAccounts
FtpPassword
FtpPassword
_FtpPassword
_FtpPassword
FtpServer
FtpServer
FtpUserName
FtpUserName
FtpDirectory
FtpDirectory
Software\FTPClient\Sites
Software\FTPClient\Sites
Software\SoftX.org\FTPClient\Sites
Software\SoftX.org\FTPClient\Sites
PortNumber
PortNumber
PassWord
PassWord
Software\South River Technologies\WebDrive\Connections
Software\South River Technologies\WebDrive\Connections
Software\LinasFTP\Site Manager
Software\LinasFTP\Site Manager
FTP destination password
FTP destination password
FTP destination server
FTP destination server
FTP destination port
FTP destination port
FTP destination user
FTP destination user
FTP destination catalog
FTP destination catalog
FTP profiles
FTP profiles
Msi.dll
Msi.dll
{74FF1730-B1F2-4D88-926B-1568FAE61DB7}
{74FF1730-B1F2-4D88-926B-1568FAE61DB7}
\PocoSystem.ini
\PocoSystem.ini
accounts.ini
accounts.ini
sites.dat
sites.dat
\LeapWare\LeapFTP
\LeapWare\LeapFTP
unleap.exe
unleap.exe
leapftp
leapftp
FtpIniName
FtpIniName
Software\Ghisler\Windows Commander
Software\Ghisler\Windows Commander
wcx_PTF.ini
wcx_PTF.ini
Server.Pass
Server.Pass
Server.Host
Server.Host
Server.User
Server.User
Server.Port
Server.Port
Last Server Pass
Last Server Pass
Last Server Port
Last Server Port
\sitemanager.xml
\sitemanager.xml
\recentservers.xml
\recentservers.xml
\filezilla.xml
\filezilla.xml
"password" : "
"password" : "
"password":"
"password":"
\drives.js
\drives.js
\ExpanDrive\favorites.js
\ExpanDrive\favorites.js
\ExpanDrive\drives.js
\ExpanDrive\drives.js
wiseftpsrvs.ini
wiseftpsrvs.ini
wisePTF.ini
wisePTF.ini
wiseftpsrvs.bin
wiseftpsrvs.bin
SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}
SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}
SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}
SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}
FTP Count
FTP Count
FTP File%u
FTP File%u
Robo-FTP
Robo-FTP
SOFTWARE\%s\FTPServers
SOFTWARE\%s\FTPServers
user.config
user.config
.duck
.duck
SiteServer %u\Host
SiteServer %u\Host
SiteServer %u\WebUrl
SiteServer %u\WebUrl
SiteServer %u\Remote Directory
SiteServer %u\Remote Directory
SiteServer %u-User
SiteServer %u-User
SiteServer %u-User PW
SiteServer %u-User PW
SiteServer %u\SFTP
SiteServer %u\SFTP
Keychain
Keychain
Software\Nico Mak Computing\WinZip\FTP
Software\Nico Mak Computing\WinZip\FTP
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
sqlite3.dll
sqlite3.dll
sqlite3_prepare
sqlite3_prepare
sqlite3_step
sqlite3_step
sqlite3_column_bytes
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_column_blob
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins
PTF://
PTF://
signons.sqlite
signons.sqlite
\profiles.ini
\profiles.ini
PathToExe
PathToExe
\Mozilla\Firefox\
\Mozilla\Firefox\
Firefox
Firefox
Software\Mozilla
Software\Mozilla
fireFTPsites.dat
fireFTPsites.dat
\Mozilla\SeaMonkey\
\Mozilla\SeaMonkey\
SeaMonkey
SeaMonkey
\Mozilla\Profiles\
\Mozilla\Profiles\
Mozilla
Mozilla
password 51:b:
password 51:b:
SMTP Email Address
SMTP Email Address
SMTP Server
SMTP Server
SMTP User Name
SMTP User Name
HTTP User
HTTP User
HTTP Server URL
HTTP Server URL
HTTPMail User Name
HTTPMail User Name
HTTPMail Server
HTTPMail Server
SMTP User
SMTP User
POP3 Port
POP3 Port
SMTP Port
SMTP Port
IMAP Port
IMAP Port
POP3 Password2
POP3 Password2
IMAP Password2
IMAP Password2
NNTP Password2
NNTP Password2
HTTPMail Password2
HTTPMail Password2
SMTP Password2
SMTP Password2
POP3 Password
POP3 Password
IMAP Password
IMAP Password
NNTP Password
NNTP Password
HTTPMail Password
HTTPMail Password
SMTP Password
SMTP Password
{X-X-X-XX-XXXXXX}
{X-X-X-XX-XXXXXX}
inetcomm server passwords
inetcomm server passwords
outlook account manager passwords
outlook account manager passwords
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Pstorec.dll
Pstorec.dll
[VNC] EXEC: %s
[VNC] EXEC: %s
IE WND [%0.8X] ENABLED: %s VISIBLED: %s
IE WND [%0.8X] ENABLED: %s VISIBLED: %s
[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s
[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s
[VDESK] Read CMD %u[%u]
[VDESK] Read CMD %u[%u]
[VDESK] NOT AUTH CMD %u
[VDESK] NOT AUTH CMD %u
GetAsyncKeyState
GetAsyncKeyState
USER32.DLL
USER32.DLL
GetKeyboardState
GetKeyboardState
GetKeyState
GetKeyState
?WINMM.DLL
?WINMM.DLL
?DSOUND.DLL
?DSOUND.DLL
ZwConnectPort
ZwConnectPort
NTDLL.DLL
NTDLL.DLL
[VNC] PROCESS=%s
[VNC] PROCESS=%s
\explorer.exe
\explorer.exe
[VNC] SearchApp Status = %u
[VNC] SearchApp Status = %u
[VNC] FileName = %s
[VNC] FileName = %s
[VNC] CmdLine = %s
[VNC] CmdLine = %s
[VNC] W64 Redir OLD=%u
[VNC] W64 Redir OLD=%u
[VNC] CreateProcess Status = %u (%u)
[VNC] CreateProcess Status = %u (%u)
SysShadow
SysShadow
Chrome_WidgetWin_1
Chrome_WidgetWin_1
Chrome_WidgetWin_0
Chrome_WidgetWin_0
d3d10_1.dll
d3d10_1.dll
d3d10_1core.dll
d3d10_1core.dll
d3d10.dll
d3d10.dll
d3d10core.dll
d3d10core.dll
d2d1.dll
d2d1.dll
OPENGL32.dll
OPENGL32.dll
d3d9.dll
d3d9.dll
d3d11.dll
d3d11.dll
Dxtrans.dll
Dxtrans.dll
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
NETAPI32.dll
NETAPI32.dll
SHDeleteKeyA
SHDeleteKeyA
SHLWAPI.dll
SHLWAPI.dll
DeleteUrlCacheEntry
DeleteUrlCacheEntry
WININET.dll
WININET.dll
WS2_32.dll
WS2_32.dll
MSVCRT.dll
MSVCRT.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
AVIFIL32.dll
AVIFIL32.dll
GetWindowsDirectoryW
GetWindowsDirectoryW
CallNamedPipeA
CallNamedPipeA
ConnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
CreateNamedPipeW
DisconnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
CreateNamedPipeA
GetWindowsDirectoryA
GetWindowsDirectoryA
EnumWindows
EnumWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
SetViewportOrgEx
SetViewportOrgEx
CryptImportKey
CryptImportKey
CryptDestroyKey
CryptDestroyKey
RegEnumKeyExA
RegEnumKeyExA
RegCreateKeyA
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyA
RegOpenKeyA
OLEAUT32.dll
OLEAUT32.dll
CertOpenSystemStoreA
CertOpenSystemStoreA
CertDeleteCertificateFromStore
CertDeleteCertificateFromStore
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertCloseStore
CertCloseStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXExportCertStoreEx
CRYPT32.dll
CRYPT32.dll
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
FindCloseUrlCache
FindCloseUrlCache
FindNextUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryW
COMDLG32.dll
COMDLG32.dll
WININET.DLL
WININET.DLL
%Documents and Settings%\All Users\Application Data\SaduMogaz\XamaPteq.wcd
%Documents and Settings%\All Users\Application Data\SaduMogaz\XamaPteq.wcd
{4E153850-602D-4819-B83D-3CCD0A1E7351}
{4E153850-602D-4819-B83D-3CCD0A1E7351}
{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}
{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}
{1DB12055-380D-432E-9763-74AF5EF609C7}
{1DB12055-380D-432E-9763-74AF5EF609C7}
\\.\pipe\{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}
\\.\pipe\{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}
D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}
D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}
{7BD47FDD-1028-4944-A268-024C76A61BA9}
{7BD47FDD-1028-4944-A268-024C76A61BA9}
U{4E153850-602D-4819-B83D-3CCD0A1E7351}
U{4E153850-602D-4819-B83D-3CCD0A1E7351}
11166F2F-6DE1-4205-8360-3AB2448931C2
11166F2F-6DE1-4205-8360-3AB2448931C2
1#1,12181
1#1,12181
2#21292>2
2#21292>2
lc:\32.dll
lc:\32.dll
32.dll
32.dll
echrome.dll
echrome.dll
regsvr32.exe
regsvr32.exe
%c:\~%0.8x.tmp
%c:\~%0.8x.tmp
iexplore.exe
iexplore.exe
chrome.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\KERNEL32.DLL
\System32\kernelbase.dll
\System32\kernelbase.dll
\ThemeApiPort
\ThemeApiPort