Gen.Variant.Kazy.51389_0cfc24405c – Adaware

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Kazy.51389 (B) (Emsisoft), Gen:Variant.Kazy.51389 (AdAware), Trojan.Win32.IEDummy.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan, VirTool

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 0cfc24405ce68891b18ebcc17c7b9d0d

SHA1: a51156cd15312c1782ab3b7b5ed9580ed325186e

SHA256: ec162017a19c3597435086d8ef98ad22a664b11ca3d73e861fe0077392890a65

SSDeep: 6144:2fIi 7pxuqpbLUiCkYufk0CwAZszooW4KycDc66aRTctl5QN4syXe:gqzuE1CXufbCwAu/WnDR1RO8N5T

Size: 356352 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6

Company: no certificate found

Created at: 2015-10-03 06:18:36

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1480
%original file name%.exe:276
attrib.exe:440
Server.exe:216
Server.exe:596
Server.exe:1168
Server.exe:316
Server.exe:1648
Server.exe:1924
Server.exe:1856
Server.exe:1968
Server.exe:1944
Server.exe:956
Server.exe:1112
Server.exe:464
Server.exe:420
Server.exe:1016
Server.exe:1124
Server.exe:1136
Server.exe:1932
Server.exe:1956
Server.exe:1792
Server.exe:1756
Server.exe:1088
Server.exe:1700
Server.exe:1600
Server.exe:1820
Server.exe:1680
Server.exe:2000
Server.exe:1748
Server.exe:1360
Server.exe:1976
Server.exe:2008
Server.exe:800
Server.exe:376

The Trojan injects its code into the following process(es):

Server.exe:252
Server.exe:1960
explorer.exe:1632

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:276 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Win\MSstart.exe (2105 bytes)
%System%\SpyNet\Server.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelfDelete.bat (330 bytes)

The process Server.exe:252 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\SpyNet\logs_VCAQ58cSQ5cAQ\logs_29-10-2015.txt (290 bytes)

The process Server.exe:1960 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

Registry activity

The process %original file name%.exe:1480 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 77 74 33 B9 14 4F 52 30 83 A3 55 AF 18 89 3C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process %original file name%.exe:276 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}]
"StubPath" = "%System%\SpyNet\Server.exe restart"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%\spynet]
"server.exe" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"SelfDelete.bat" = "SelfDelete"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"Server" = "%System%\SpyNet\Server.exe"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE D8 81 06 1B B9 9A 2A 7F 60 BA 36 F2 6A AC 38"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = "C:\Win\MSstart.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Server" = "%System%\SpyNet\Server.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = "C:\Win\MSstart.exe"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe %System%\SpyNet\Server.exe"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Server" = "%System%\SpyNet\Server.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe %System%\SpyNet\Server.exe"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Server" = "%System%\SpyNet\Server.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Server" = "%System%\SpyNet\Server.exe"

The process attrib.exe:440 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 31 D4 42 07 9F 85 89 54 62 0E 0D 8C D9 A6 AA"

The process Server.exe:216 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5C 47 C3 63 66 2B B0 FD 8A 22 C4 2A 13 85 A8 AC"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:596 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 51 B5 D3 98 D4 58 D6 DF 37 1F CB 98 1F AC 5E"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1168 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA 62 6D 60 A5 4F E1 78 A2 E9 D7 CE 21 78 AD F3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:316 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 70 16 FC BD 04 44 91 00 33 EC 63 93 78 B1 1B"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1648 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A 4B 8B 4B C8 DC AE FB 3A FD 87 54 FF FB D0 60"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1924 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 0D EA 8A D6 47 6D 33 A8 8D D3 EA BF 59 61 7C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1856 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B D1 F4 6C BA 56 71 94 D8 9A 86 F2 5F F2 98 A9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:252 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FF 20 95 34 A1 15 F0 F9 A7 A6 12 5D 46 1D B7 61"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
"FakeMessage" = "OK"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer"

The process Server.exe:1968 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CA BD 7C D1 8A 20 32 8C 28 F9 31 60 AD 83 24 D1"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1960 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B 8A 1F F4 77 7B 0A E3 66 7E 53 EA 52 5E 22 69"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer"

The process Server.exe:1944 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 60 F3 95 4F 68 28 12 28 7A 46 3C A5 EA 6F A8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:956 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 DB 41 C8 5D 3C 3E 03 E4 F8 20 36 92 84 F8 8F"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1112 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F 7B 78 C7 C7 1A BE 62 90 BC 21 B8 6B D7 A2 D6"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:464 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 24 76 90 86 D7 97 2B B4 F0 57 5B 0A 1A 62 1F"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:420 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA 93 8F CE E4 5F A9 DE 6D 2C 79 9C 37 FA 34 91"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1016 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 98 DB 64 15 44 E8 4F E6 58 EB 06 B7 C4 29 EB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1124 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 F7 57 98 75 9D 5F 83 07 0E 99 BF D0 FE A3 73"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1136 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 A0 EF 62 7F 24 91 CC 81 0E F1 1B 32 57 B7 48"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1932 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 89 43 C4 2C 9D E9 63 55 BA 35 20 A4 7D 40 1D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1956 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "58 33 7A C3 9E 73 5A 01 28 89 6D F4 E2 A5 5F 7F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1792 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 58 1A DC D1 13 5E 17 A8 53 B9 3C 36 EC 1A 4F"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1756 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE 2B AE 12 87 A4 6F 17 1C 65 E7 3E 42 D2 2E 50"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1088 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC 78 AD A1 DF 0A 12 9F 7F 8B E6 58 EB 01 A1 18"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1700 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 30 6C F6 1A 85 FE 90 CA 24 6B C0 B1 C8 78 8E"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1600 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 30 4D 8A C3 5C 05 10 DE 0B B8 B7 5F DC 8B 3E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1820 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 33 4B 4C AC CD D2 5E 0E 32 3A 63 7E 43 0E 03"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1680 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 85 70 0B 6A 0D 7F C4 E2 1F BC 2A D4 3E 5C D9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:2000 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "26 AD DF 06 AB 14 44 67 63 3C 77 6D EB 4B EF 2F"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1748 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 4B 9E E5 27 37 5C FF 99 44 5F B7 25 97 D0 5E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1360 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 32 7A FB F5 F5 AE F1 2D 43 9E B0 AF 04 26 23"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1976 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 89 2F DF 02 4F C8 9D 7E 6C 55 EC 84 57 4E 98"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:2008 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B 62 16 EF 28 4B B7 E9 F9 80 60 ED 87 18 04 0F"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:800 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 D6 BF ED 21 C5 21 F8 1D F3 95 1F E5 89 D1 5E"

The process Server.exe:376 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 AD 4B 0F FD 96 CB AD BE 55 DB 17 B2 6E 78 FF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1480
%original file name%.exe:276
attrib.exe:440
Server.exe:216
Server.exe:596
Server.exe:1168
Server.exe:316
Server.exe:1648
Server.exe:1924
Server.exe:1856
Server.exe:1968
Server.exe:1944
Server.exe:956
Server.exe:1112
Server.exe:464
Server.exe:420
Server.exe:1016
Server.exe:1124
Server.exe:1136
Server.exe:1932
Server.exe:1956
Server.exe:1792
Server.exe:1756
Server.exe:1088
Server.exe:1700
Server.exe:1600
Server.exe:1820
Server.exe:1680
Server.exe:2000
Server.exe:1748
Server.exe:1360
Server.exe:1976
Server.exe:2008
Server.exe:800
Server.exe:376
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Win\MSstart.exe (2105 bytes)
%System%\SpyNet\Server.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelfDelete.bat (330 bytes)
%System%\SpyNet\logs_VCAQ58cSQ5cAQ\logs_29-10-2015.txt (290 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Server" = "%System%\SpyNet\Server.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Server" = "%System%\SpyNet\Server.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Server" = "%System%\SpyNet\Server.exe"
Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe %System%\SpyNet\Server.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe %System%\SpyNet\Server.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version: 0.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename: z1aca5jg.exe
Internal Name: z1aca5jg.exe
File Version: 0.0.0.0
File Description:
Comments:
Language: English (United States)

Company Name: Product Name: Product Version: 0.0.0.0Legal Copyright: Legal Trademarks: Original Filename: z1aca5jg.exeInternal Name: z1aca5jg.exeFile Version: 0.0.0.0File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	329236	331776	5.45972	b6bd5bba80ceb0f7fd5ef28ee710b4ff
.sdata	344064	100	4096	0.171663	186fe66d870ed38924da9721944f77f6
.rsrc	352256	10488	12288	3.33552	03344fce9d3957f3c396d0dbc9a4baab
.reloc	368640	12	4096	0.011373	3ba79dfa564565ae5a26c6b0dacb8599

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.google.com/	173.194.113.210
www.google.com.ua

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=NG4yVqHaEYrBsAH7rJjIBQ

Content-Length: 262

Date: Thu, 29 Oct 2015 19:06:28 GMT

Server: GFE/2.0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=NG4yVqHaEYrBsAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=NG4yVqHaEYrBsAH7rJjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:06:28 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=NG4yVqHaEYrBsAH7rJjIBQ">here</A>...</BODY></HTML>......

GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=N24yVqDMKorBsAH7rJjIBQ

Content-Length: 262

Date: Thu, 29 Oct 2015 19:06:31 GMT

Server: GFE/2.0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=N24yVqDMKorBsAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=N24yVqDMKorBsAH7rJjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:06:31 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=N24yVqDMKorBsAH7rJjIBQ">here</A>...</BODY></HTML>......

GET / HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Q24yVvHlGorBsAH7rJjIBQ

Content-Length: 262

Date: Thu, 29 Oct 2015 19:06:43 GMT

Server: GFE/2.0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Q24yVvHlGorBsAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Q24yVvHlGorBsAH7rJjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:06:43 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Q24yVvHlGorBsAH7rJjIBQ">here</A>...</BODY></HTML>......

GET / HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=S24yVrncJYvCsAHQ1LGwDw

Content-Length: 262

Date: Thu, 29 Oct 2015 19:06:51 GMT

Server: GFE/2.0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=S24yVrncJYvCsAHQ1LGwDw">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=S24yVrncJYvCsAHQ1LGwDw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:06:51 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=S24yVrncJYvCsAHQ1LGwDw">here</A>...</BODY></HTML>......

GET / HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Tm4yVuGbMIHDsAHqvauoAw

Content-Length: 262

Date: Thu, 29 Oct 2015 19:06:54 GMT

Server: GFE/2.0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Tm4yVuGbMIHDsAHqvauoAw">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Tm4yVuGbMIHDsAHqvauoAw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:06:54 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Tm4yVuGbMIHDsAHqvauoAw">here</A>...</BODY></HTML>......

GET / HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Um4yVvQMisGwAfusmMgF

Content-Length: 260

Date: Thu, 29 Oct 2015 19:06:58 GMT

Server: GFE/2.0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Um4yVvQMisGwAfusmMgF">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Um4yVvQMisGwAfusmMgF..Content-Length: 260..Date: Thu, 29 Oct 2015 19:06:58 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Um4yVvQMisGwAfusmMgF">here</A>...</BODY></HTML>..nt>....

GET / HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=VW4yVp_vB4rBsAH7rJjIBQ

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:01 GMT

Server: GFE/2.0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=VW4yVp_vB4rBsAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=VW4yVp_vB4rBsAH7rJjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:01 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=VW4yVp_vB4rBsAH7rJjIBQ">here</A>...</BODY></HTML>......

GET / HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=WG4yVt-aEcKDsAGtj5eYAw

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:04 GMT

Server: GFE/2.0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=WG4yVt-aEcKDsAGtj5eYAw">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=WG4yVt-aEcKDsAGtj5eYAw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:04 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=WG4yVt-aEcKDsAGtj5eYAw">here</A>...</BODY></HTML>......

GET / HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=W24yVu_9GovCsAHQ1LGwDw

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:07 GMT

Server: GFE/2.0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=W24yVu_9GovCsAHQ1LGwDw">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=W24yVu_9GovCsAHQ1LGwDw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:07 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=W24yVu_9GovCsAHQ1LGwDw">here</A>...</BODY></HTML>......

GET / HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Xm4yVvatIoHDsAHqvauoAw

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:10 GMT

Server: GFE/2.0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Xm4yVvatIoHDsAHqvauoAw">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Xm4yVvatIoHDsAHqvauoAw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:10 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Xm4yVvatIoHDsAHqvauoAw">here</A>...</BODY></HTML>......

GET / HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=YW4yVsDTKIrBsAH7rJjIBQ

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:13 GMT

Server: GFE/2.0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=YW4yVsDTKIrBsAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=YW4yVsDTKIrBsAH7rJjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:13 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=YW4yVsDTKIrBsAH7rJjIBQ">here</A>...</BODY></HTML>......

GET / HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=ZG4yVoTiL4rBsAH7rJjIBQ

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:16 GMT

Server: GFE/2.0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=ZG4yVoTiL4rBsAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=ZG4yVoTiL4rBsAH7rJjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:16 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=ZG4yVoTiL4rBsAH7rJjIBQ">here</A>...</BODY></HTML>......

GET / HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Z24yVueqN4rBsAH7rJjIBQ

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:19 GMT

Server: GFE/2.0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Z24yVueqN4rBsAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Z24yVueqN4rBsAH7rJjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:19 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Z24yVueqN4rBsAH7rJjIBQ">here</A>...</BODY></HTML>......

GET / HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=a24yVqsHi8KwAdDUsbAP

Content-Length: 260

Date: Thu, 29 Oct 2015 19:07:22 GMT

Server: GFE/2.0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=a24yVqsHi8KwAdDUsbAP">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=a24yVqsHi8KwAdDUsbAP..Content-Length: 260..Date: Thu, 29 Oct 2015 19:07:22 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=a24yVqsHi8KwAdDUsbAP">here</A>...</BODY></HTML>..nt>....

GET / HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVq3yGIvCsAHQ1LGwDw

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:26 GMT

Server: GFE/2.0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVq3yGIvCsAHQ1LGwDw">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVq3yGIvCsAHQ1LGwDw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:26 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVq3yGIvCsAHQ1LGwDw">here</A>...</BODY></HTML>......

GET / HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVpiaKorBsAH7rJjIBQ

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:26 GMT

Server: GFE/2.0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVpiaKorBsAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVpiaKorBsAH7rJjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:26 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

iexplore.exe_860:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

explorer.exe_1632:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

BROWSEUI.dll

GDI32.dll

KERNEL32.dll

NTDLL.DLL

msvcrt.dll

ole32.dll

OLEAUT32.dll

SHDOCVW.dll

SHELL32.dll

SHLWAPI.dll

USER32.dll

UxTheme.dll

FTSSh

t0SSh

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system

SShwk

98~%SP

ExplorerStartMsgLoop

PSSh;

6SSSSh

SSSSh

SPSSSShL

u%SSh

t.WWWW

xpsp2res.dll

xpsp3res.dll

tbSSh

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel

kernel32.dll

GetSystemWindowsDirectoryW

NetGetJoinInformation

WINMM.dll

SETUPAPI.dll

WINSTA.dll

OLEACC.dll

USERENV.dll

ntdll.dll

RegEnumKeyExW

RegNotifyChangeKeyValue

RegOpenKeyExA

RegEnumKeyW

RegCloseKey

RegCreateKeyW

RegQueryInfoKeyW

RegOpenKeyExW

RegCreateKeyExW

OffsetViewportOrgEx

GetViewportOrgEx

SetViewportOrgEx

SetProcessShutdownParameters

GetProcessHeap

GetWindowsDirectoryW

CreateIoCompletionPort

ShellExecuteExW

SHRegCloseUSKey

SHRegCreateUSKeyW

AssocQueryKeyW

SHRegOpenUSKeyW

SHDeleteKeyW

TileWindows

ExitWindowsEx

RegisterHotKey

UnregisterHotKey

EnumChildWindows

GetKeyState

GetAsyncKeyState

CascadeWindows

MsgWaitForMultipleObjects

EnumWindows

explorer.pdb

name="Microsoft.Windows.Shell.explorer"

version="5.1.0.0"

Windows Shell

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

]]"```^]]\

3333333330

3333330

333333334

)@. '5 !*

.DEHHF>?/

&$%Uooqkezs

['$$#%&(4

3333333333333333333

33333333333330

7''''))

3'')))33.

222`444(555

%%%{///-

000000000

00000000

`[66...00

0000000

`]66./.000

/./././././././.

66///0000

0000000000000

0000000000

6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001

4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000

) ) ) ) )

|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),,

22222222222

3333333

.SB99;;;99twv}ut{oxt~

.SB;;;:::2:w}{{qddgghg

" """ """ """ """ "" #

""" """ """ "#

.SG>''';;9::p

:5:5:5:5:5:5:5:5:5:5#"

# # # # # # # # # # # # # # # # # # # # # ##$

( # # # # # # # # # # # # # # # # # # # # ###

1232123212321232123

(&(((&(((&(((&(((&((&&)

&(((&(((&(((&()

`,''')))

'4,4'4,4'4,4'4,4'4,4)(

55///0000

5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0

555555555

55555555

5555555

14441444144414441

4343434343434343

5555555555555

5555555555

-,-,-,-,-,-,-,-,-,-,-*.

..............................JFJFJFJFJFJFJFJFJFJFJ.-

{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../

|ujjjjuhF..BBBBBBBBBBBBT

~j|F.BB*BBB*BBB*Bwop

&!!!&!!!&

44466666

44444444416

4446666

66666666

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=

DDDDE%CTDD@

A%US$

%UUUU

%%UUU

33U

""2222!!

!"!"%UUR""

!""!"#2"""

"!!"#3"!"

dnnnnn:n.nfCnmddddd

////;/;;88

;888;;!/

!//!!;;^

:;:!::!!!

.88.88.8

.N.NN.M

::8.8...

:::!;;:!

//!!;888

.8.8.88...

:;!::!!;!//!;

!!;:!!::

.88..8..

!!:::/^!

!;/;!;;;!!!:

.8:!!!!^

!!:;:::..

/:!^^!;{8{../

...:::.-

**6***66*6**6566*5666 ,

6*6666*6*6 655*65

6*65 56*5 55 555 *5 6

555( 55 (5 5(

76 5 66 555*677

6*6 5 5(5 (55( '5((5 (556 ('5

665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU

555(555(5((5(5(5(

5 5 5 5555 (555(555'(((5(5('55(((

((''('5'5(5('('('('('((''('(((@(((('&(((&

%&&%&&&&3>&3&3&33&3&3333&&3>3333

'(3&'&3&

3&33&&((

3323>33>%>3%>3>33>3%3&%

*5'(('((&@3(

,63%3>323>3%>&>33323>>%>

3(3'(((@@'5('@(@(&('(

>2>323%>3

75((((@3&333&3&&&%&3&&3&33>33%3>23%>3

>2%$32%>2>%>2$3>

3&%&&3&33>3>33

3>%>3%&3$23>23$2>2%$>2>

)4433((&(&('*

('((((''(**6(('' *

32323>3>

2$%>22%>%3' (

&(&''((5(5 *

'(&(&((&('''

&&%&3&&%3%

2%>22>22

5''3(((3(('&(&'&

3%%3%3%2#$

22$22$2%$22$2%2%$2%$2$222%$22

&>2$2$2$222$22$%%

:7'((('(3('(3(&(&

222222222222

22222222222222

222222222222222

22$22$22$22$

&(%3%&&&&3&&&3%3

222222222222222222

&&(&3(&(&'('((3'(&&

2222222

22$

&&(3(3('(&'

222"2212

(&(3(3((

((565 ((( 6

333&33(&&

'(('('(('(

'&%%"$

2"2"22"2

2222

"2"22

2%('(3'32222?&'

2"2"2"121212

2"2"2$"?

%%22%2

&3(3(3((&

"2"

1"?((&21

2%""22&&

'&('(3(''

((%%%"

5(3%"%

"2%5*67

))) ))))

""**

#2#---2222-222442-

---(-%

$/222(--444222!

#&-221269924999;

&$-22-($2%

#(2---222622212-

#2221299629968

#&--%#(2##!

-222422422426662-%

"2-##&

!##-#-&%---#---#&-219662%

$&-(151,44.9

&1242662-

-(..19.19

,4492.12

12-$-,-,

-, $$----

#%#-15/-&

-,(,,(,(,

$$11651566/,$&&

,2592&&&-

2466/!$$

""*

) '????[

&&&$-556>>61,,5994511-

$(//$$$(6>6/,$,-$

#$-22692/,,$,-&

-266661..4514#

&,2-&#

&-222,22--#

#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88

&!#&!-##

--//11468>885882&

$266961$&--$&%

,1661,!-((#

&$,4255$,92

&$,44..&

""**""***""

"****

"**""""*""""

&-569./-,16522$

.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\

bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(

.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87

yzyzyzym^Z]WN3 $&$.Wt\

""*"""****""""

"***"**""**

$5612,.2,

&$$,,,5]

$]t.Ft

7%8U8

3 303

8 8$8(8,80848885%5,575{6
7 7$7(7,70747
rundll32.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
::{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}
::{D20EA4E1-3957-11d2-A40B-0C5020524153}
::{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}
{208D2C60-3AEA-1069-A2D7-08002B30309D}
{20D04FE0-3AEA-1069-A2D8-08002B30309D}
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites
{450D8FBA-AD25-11D0-98A8-0800361B1103}
CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
Software\Microsoft\Windows\CurrentVersion\Explorer\DontShowMeThisDialogAgain
Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz
\\.\WMIDataDevice
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows NT\CurrentVersion\Windows
ExplorerIsShellMutex
desk.cpl
Software\Microsoft\Windows\CurrentVersion\Explorer
tourstart.exe
tourstart.exe,0
Microsoft.OfferTour
WINWORD.EXE
Software\Microsoft\Windows\CurrentVersion\Applets
Software\Microsoft\Windows\CurrentVersion\Applets\Tour
explorer.exe,9
Microsoft.FixScreenResolution
shell:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation
Software\Microsoft\Windows NT\CurrentVersion
shell:::{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
DDEEXECUTESHORTCIRCUIT
http\shell
IEXPLORE.EXE
Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop
Software\Microsoft\Windows\CurrentVersion\RunOnceEx
comctl32.dll
Software\Microsoft\Windows\Internet Settings
AutoConfigURL
system.ini
AppEvents\Schemes\Apps\.Default\%s\.current
Software\Microsoft\Windows\CurrentVersion\Explorer\TrayNotify
MSShellRunDlgReady
res://mys.dll/mys.hta /explorer
mshta.exe
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\Welcome
Software\Microsoft\Windows\CurrentVersion\Explorer\Tips
SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\MYS
cys.exe
SOFTWARE\Microsoft\Windows NT\CurrentVersion\srvWiz
install.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel
OUTLOOK.EXE
explorer.exe,16
iernonce.dll
WININET.DLL
UpdateURL
WindowsUpdate
HWND%x
Software\Microsoft\Windows\CurrentVersion\OemStartMenuData
fldrclnr.dll,Wizard_RunDLL
iexplore.exe
winbrand.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\Remote\%d
shell32.dll
nusrmgr.cpl ,initialTask=ChangePicture
NewExeName
Windows
ediskeer.dll
timedate.cpl
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSaveMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU
Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
Software\Microsoft\Internet Explorer\TypedURLs
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Calculator.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Games\Solitaire.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Paint.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\WordPad.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Windows Movie Maker.lnk
%USERPROFILE%\Start Menu\Programs\Accessories\Tour Windows XP.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Windows Messenger.lnk
%USERPROFILE%\Start Menu\Programs\Windows Media Player.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\MSN.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Get Online with MSN.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Get Going with Tablet PC.lnk
%ALLUSERSPROFILE%\Start Menu\Set Program Access and Defaults.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Windows Journal.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Media Center\Media Center.lnk
%USERPROFILE%\Start Menu\Programs\Internet Explorer.lnk
Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
TSAppCMP.DLL
netapi32.dll
%SystemRoot%\system32\restore\rstrui.exe
RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%s
RunDLL32.EXE
%s%d%s
Software\Microsoft\Windows\CurrentVersion\Policies\System
settings.dll
explorer.exe "
explorer.exe /e, "
WindowsLogon
WindowsLogoff
%s %s
Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
uAppWiz.Cpl
\explorer.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu
::{20D04FE0-3AEA-1069-A2D8-08002B30309D}
taskmgr.exe
ShellExecute
Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d
\WindowsShell.Manifest
Get Online with MSN.lnk
Set Program Access and Defaults.lnk
Link%d
OEM%d
Software\Microsoft\Windows\CurrentVersion\SMDEn
::{D20EA4E1-3957-11d2-A40B-0C5020524152}
There is a file or folder on your computer called "%s" which could cause certain applications to not function correctly. Renaming it to "%s" would solve this problem. Would you like to rename it now?
Ca&scade Windows
Tile Windows &Horizontally
Tile Windows V&ertically
&Windows Security...
&Help and Support
&Log Off %s...
Windows Explorer
6.00.2900.5512 (xpsp.080413-2105)
EXPLORER.EXE
Windows
Operating System
6.00.2900.5512
Keep the &taskbar on top of other windows
To remove records of recently accessed documents, programs, and Web sites, click Clear.
Windows displays icons for active and urgent notifications, and hides inactive ones. You can change this behavior for items in the list below.
Select this option to use the menu style from earlier versions of Windows.
6There is not enough memory to complete this operation.8Unable to run command.
The folder '%1' has been removed.WMy Computer or Windows Explorer has not been properly initialized yet. Try again later.
&Undo %s
Windows is running in safe mode.
This special diagnostic mode of Windows enables you to fix a problem which may be caused by your network or hardware settings. Make sure these settings are correct in Control Panel, and then try starting Windows again. While in safe mode, some of your devices may not be available.
startRThere was an internal error and one of the windows you were using has been closed.
Restrictions{This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.
&Show Open Windows
Windows was unable to change the display settings for the new configuration. Return the computer to the previous state, shut down Windows, and restart the computer in the desired configuration.
There may be a problem with your display settings if you continue. To safely change to a new configuration, you should shut down Windows and restart the computer in the desired configuration. Do you want to continue anyway?
This pre-release version of "Internet Explorer 4.0" Desktop/Explorer has expired. Please update to the latest release of "Internet Explorer 4.0" from WWW.MICROSOFT.COM
helpctr.exe>-FromStartHelp
Take a tour of Windows XP
NOpens a window where you can pick search options and work with search results.aOpens a central location for Help topics, tutorials, troubleshooting, and other support services.
/Opens a program, folder, document, or Web site.
Provides options for closing your programs and logging off, or for leaving your programs running and switching to another user.lProvides options for turning off or restarting your computer, or for activating Stand By or Hibernate modes.RDisconnects your session. You can reconnect to the session when you log on again.
&Windows Security
iOpens the My Documents folder, where you can store letters, reports, notes, and other kinds of documents./Displays recently opened documents and folders.KOpens the My Music folder, where you can store music and other audio files.]Opens the My Pictures folder, where you can store digital photos, images, and graphics files.zGives access to, and information about, the disk drives, cameras, scanners, and other hardware connected to your computer.MGives access to, and information about, folders and files on other computers.8Connects to other computers, networks, and the Internet.
explorer.exe_1632_rwx_00C80000_000F0000:`.rsrc
kernel32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
EInvalidOperation
u%CNu
%s[%d]
EIdCanNotBindPortInRange
EIdInvalidPortRange(,
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pas
WS2_32.DLL
MSWSOCK.DLL
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WSARecvMsg
WSASendMsg
Wship6.dll
Fwpuclnt.dll
TIdSocketListWindows
TIdStackWindowsU
Kernel32.dll
EIdIPVersionUnsupportedT
127.0.0.1
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pas
EIdPortRequiredp
EIdTCPConnectionError
EIdObjectTypeNotSupported
ftpTransfer
ftpReady
ftpAborted
PortT
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pas
ClientPortMin
ClientPortMax
Port
"EIdTransparentProxyUDPNotSupported
TIdTCPConnection
IdTCPConnection
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pas
TIdTCPClientCustom
TIdTCPClientCustomDh
IdTCPClient
TIdTCPClient
BoundPortT
%EIdSocksUDPNotSupportedBySOCKSVersion
saUsernamePassword
Password
0.0.0.1
0.0.0.0
BoundPort
DefaultPort
ole32.dll
sqlite3_bind_blob
sqlite3_bind_text
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_index
sqlite3_open
sqlite3_close
sqlite3_errmsg
sqlite3_errcode
sqlite3_free
sqlite3_prepare_v2
sqlite3_column_count
sqlite3_column_name
sqlite3_column_decltype
sqlite3_step
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_double
sqlite3_column_text
sqlite3_column_type
sqlite3_column_int64
sqlite3_finalize
sqlite3_reset
SQL error or missing database
An internal logic error in SQLite
Operation terminated by sqlite3_interrupt()
Uses OS features not supported on host
2nd parameter to sqlite3_bind out of range
sqlite3_step() has another row ready
sqlite3_step() has finished executing
Unknown SQLite Error Code "
ESQLiteException
TSQLiteDatabase
TSQLiteTable
Failed to open database "%s" : %s
Failed to open database "%s" : unknown error
Error [%d]: %s.
"%s": %s
Error executing SQL
Could not prepare SQL statement
Error executing SQL statement
SQLite is Busy
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox\
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\
1234567890.
mozsqlite3.dll
sqlite3.dll
MSVCR100.dll
mozglue.dll
mozcrt19.dll
mozutils.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
nss3.dll
PK11_GetInternalKeySlot
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
signons.sqlite
SELECT * FROM moz_logins
encryptedPassword
SOFTWARE\Microsoft\Windows\CurrentVersion
Microsoft\Network\Connections\pbk\rasphone.pbk
rasapi32.dll
rnaph.dll
RAS Passwords
advapi32.dll
crypt32.dll
uURLHistory
abe2869f-9b47-4cd9-a358-c22904dba7f7
UnitPasswords
WindowsLive:name=*
\Mozilla Firefox\
softokn3.dll
userenv.dll
profiles.ini
\signons3.txt
\signons2.txt
\signons1.txt
\signons.txt
\\.\pipe\wzcsvc_wep_keys
winlogon.exe
SafariPasswordRecovery
AVURLProtocol_Classic
\Apple Computer\Preferences\keychain.plist
\Apple\Apple Application Support\CFNetwork.dll
hXXp://
PTF://
*PTF://
hXXps://
gdiplus.dll
GdiplusShutdown
EInvalidGraphicOperation
WbemScripting.SWbemLocator
%s\%s
SELECT * FROM %s
pathToSignedProductExe
pathToSignedReportingExe
WbemScripting.SWbemDateTime
HExecQuery
TargetOperatingSystem
NumberOfMediaSupported
PowerManagementSupported
SCSIPort
Select * from Win32_Keyboard
NumberOfFunctionKeys
MaxMemorySupported
Monochrome
ProtocolSupported
AdminPasswordStatus
BootROMSupported
InfraredSupported
KeyboardPasswordStatus
PowerOnPasswordStatus
SupportContactDescription
Select * from Win32_OperatingSystem
WindowsDirectory
Select Caption,BuildNumber,CSDVersion from Win32_OperatingSystem
TKeylogger
TIdTCPClientNew
Please, send a email to SpyNetCoder ---> spynetcoder@gmail.com
TWebcam
ISO_646.irv:1991
ISO_646.basic:1983
ISO_646.irv:1983
csISO16Portuguese
csISO84Portuguese2
windows-936
csShiftJIS
windows-874
ISO-8859-1-Windows-3.0-Latin-1
csWindows30Latin1
ISO-8859-1-Windows-3.1-Latin-1
csWindows31Latin1
ISO-8859-2-Windows-Latin-2
csWindows31Latin2
ISO-8859-9-Windows-Latin-5
csWindows31Latin5
csMicrosoftPublishing
Windows-31J
csWindows31J
PTCP154
csPTCP154
windows-1250
windows-1251
windows-1252
windows-1253
windows-1254
windows-1255
windows-1256
windows-1257
windows-1258
HTTP-EQUIV
()@,;:\"./
()@,;:\"/[]?=
()@,;:\"/[]?={}
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pas
IdCustomTCPServer
TIdCustomTCPServer
TIdCustomTCPServerX
DefaultPortt
EIdTCPServerError
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pas
EIdTCPNoOnExecute
TIdTCPServer
IdTCPServer
OnExecute
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas
%s User
CmdDelimiter
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas
'TIdCmdTCPServerAfterCommandHandlerEvent
TIdCmdTCPServer
(TIdCmdTCPServerBeforeCommandHandlerEvent
IdCmdTCPServer
Displays commands that the servers supports.
TIdTCPStream
IdRead() method of TIdTCPStream class does not support seeking
TIdHTTPProxyTransferMode
TIdHTTPProxyServerContext
TIdHTTPProxyServerContextlS
TOnHTTPContextEvent
TOnHTTPDocument
TIdHTTPProxyServer
OnHTTPBeforeCommand
OnHTTPResponse8T
OnHTTPDocument
HTTP/1.0
HTTP/1.0 200 Connection established
HNetCfg.NATUPnP
StaticPortMappingCollection
PSAPI.dll
shlwapi.dll
TSendKey
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
AllocateAndGetTcpTableFromStack
AllocateAndGetUdpTableFromStack
SetTcpEntry
GetExtendedTcpTable
GetExtendedUdpTable
TWebcamThread
Shell.Application
SHFileOperationW
\Opera\Opera\wand.dat
\Google\Chrome\User Data\Default\Web Data
\Google\Chrome\User Data\Default\Login Data
TNewFTPThreadU
CDO.Message
CDO.Configuration
hXXp://schemas.microsoft.com/cdo/configuration/smtpusessl
hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate
hXXp://schemas.microsoft.com/cdo/configuration/sendusername
hXXp://schemas.microsoft.com/cdo/configuration/sendpassword
hXXp://schemas.microsoft.com/cdo/configuration/smtpserver
hXXp://schemas.microsoft.com/cdo/configuration/sendusing
hXXp://schemas.microsoft.com/cdo/configuration/smtpserverport
VBoxService.exe
SbieDll.dll
dbghelp.dll
Software\Microsoft\Windows\CurrentVersion
55274-640-2673064-23950
76487-644-3177037-23510
76487-337-8429955-22614
\\.\SICE
\\.\NTICE
drivers\sice.sys
drivers\ntice.sys
drivers\syser.sys
drivers\winice.sys
drivers\sice.vxd
drivers\winice.vxd
winice.vxd
vmm32\winice.vxd
sice.vxd
vmm32\sice.vxd
\\.\SIWVID
\\.\TRW
\\.\TWX
\\.\ICEEXT
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
?456789:;!"#$%&'()* ,-./0123
com.apple.Safari
com.apple.Safari0123456789ABCDEF
KWindows
.ScktComp
WebcamAPI
IdStackWindows
UnitKeylogger
UnitServerPass
UnitExecutarComandos
UnitSendFTPFiles
UnitListarPortasAtivas
Usndkey32
sUnitWindows
IdTCPStream
 IdTCPServer
4UnitStartWebcam
OperaPasswords
ZPasswordRecovery
KuURLHistory
IEpasswords
UnitChrome
SQLite3
SQLiteTable3
UnitFireFox3_5
SetNamedPipeHandleState
GetWindowsDirectoryW
GetProcessHeap
GetCPInfo
DisconnectNamedPipe
CreatePipe
CreateNamedPipeA
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyW
RegCloseKey
RegEnumKeyExA
RegQueryInfoKeyA
CryptImportKey
CryptSetKeyParam
CryptDestroyKey
ShellExecuteW
FindExecutableW
SHDeleteKeyW
URLDownloadToFileW
keybd_event
VkKeyScanW
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExA
SetKeyboardState
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyA
GetKeyboardState
GetKeyboardLayout
GetKeyState
ExitWindowsEx
EnumWindows
GetKeyboardType
FtpPutFileW
FtpSetCurrentDirectoryW
.idata
.rdata
P.reloc
P.rsrc
I.uWP
KERNEL32.DLL
AVICAP32.DLL
gdi32.dll
mpr.dll
msacm32.dll
ntdll.dll
powrprof.dll
pstorec.dll
shell32.dll
URLMON.DLL
user32.dll
wininet.dll
winmm.dll
wsock32.dll
x.html
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\RunOnce
Win\MSstart.exe
Software\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe "
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
explorer.exe
hXXp://VVV.uol.com.br/
hXXp://mail.terra.com.br/
hXXps://VVV.google.com/accounts/servicelogin
hXXps://my.screenname.aol.com/_cqr/login/login.psp
hXXp://VVV.lycos.com
hXXp://VVV.myspace.com
Portugal
Turkey
TargetOperatingSystem:
NumberOfMediaSupported:
PowerManagementSupported:
SCSIPort:
NumberOfFunctionKeys:
Password:
MaxMemorySupported:
Monochrome:
ProtocolSupported:
AdminPasswordStatus:
BootROMSupported:
InfraredSupported:
KeyboardPasswordStatus:
PowerOnPasswordStatus:
SupportContactDescription:
WindowsDirectory:
[Execute]
SpyNetKeylogger
keylogger
WEBCAM
uploadandexecute
uploadandexecuteyes|
uploadandexecuteno|
*#%"{}|\^[]`
:LocalSubNet:Enabled:@xpsperes.dll,-22006
SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG
Invalid Key Name
Invalid KeyName
software\microsoft\windows\currentversion\uninstall\
webcamstream2|
webcam|webcamstream|
webcamstop2|
webcam|webcamstop|
webcamstart
webcamstart2
*.jpg
keyloggernew
c:\users\rafael\desktop\TESTE\
keylogger|mouseloggerbuffer|
OPERA|
CHROME|
keylogger|mouseloggerstart|
keylogger|mouseloggerstop|
keylogger|keyloggerativar|F|
keylogger|keyloggerativar|T|
keylogger|keyloggeronlinekey|
webcamlist|
getpasswords|
webcam
FirstExecution
SelfDelete.bat
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
rar.exe
rarreg.key
filemanager|fmsendftpyes|
filemanager|fmsendftpno|
webcamlist
downexec
openweb
getpasswords
getpasswords|START
chromepass
chromepass|
sendkeyswindow
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
listarportas
listarportas|listadeportasativas|
listarportasdns
listarportas|finalizarconexao|
finalizarprocessoportas
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
tecaladoexecutar
webcam2
webcamconfig
keylogger|keyloggeronlinestart|
keylogger|keyloggeronlinestop|
logs_*.txt
keylogger|keylogger|
keyloggerativar
keyloggerdesativar
keyloggerbaixar
keylogger|keyloggerbaixar|
keylogger|keyloggerbaixar|NOLOGS
keyloggerexcluir
keylogger|keyloggerexcluir|
keyloggeronlinestart
keyloggeronlinestop
MouseLoggerWindows
fmexecnormal
filemanager|fmexecnormal|
fmexechide
filemanager|fmexechide|
fmexecparam
filemanager|fmexecparam|F|
filemanager|fmexecparam|T|
fmsendftp
filemanager|fmsendftp|
keysearch
Logs_*.txt
keysearch|YES
keysearch|NO
keyboardinfo
getcompinfo|getcompinfo|keyboardinfo|
ÃžFAULTBROWSER%
%System%\SpyNet\Server.exe
%System%\SpyNet\
Unsupported clipboard format
Canvas does not allow drawing Clipboard does not support Icons
Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.
Reply Code is not valid: %s
Reply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
File "%s" not found
Object type not supported.
5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Command not supported.
Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)
Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
Invalid Port Range (%d - %d)
%s is not a valid service.
%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.
Set Size Exceeded.)UDP is not support in this SOCKS version.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation already in progress.
Socket operation on non-socket.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
Socket Error # %d
Operation would block.
Operation now in progress.
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Invalid destination array"Character index out of bounds (%d)
Start index out of bounds (%d)
Invalid count (%d)
Invalid destination index (%d)
Invalid codepage (%d)-Error on call to Winsock2 library function %s
ECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Ancestor for '%s' not found
Cannot assign a %s to a %s
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value('%s' is not a valid floating point value
I/O error %d
Integer overflow Invalid floating point operation
Server.exe_252:`.rsrc
kernel32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
EInvalidOperation
u%CNu
%s[%d]
EIdCanNotBindPortInRange
EIdInvalidPortRange(,
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pas
WS2_32.DLL
MSWSOCK.DLL
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WSARecvMsg
WSASendMsg
Wship6.dll
Fwpuclnt.dll
TIdSocketListWindows
TIdStackWindowsU
Kernel32.dll
EIdIPVersionUnsupportedT
127.0.0.1
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pas
EIdPortRequiredp
EIdTCPConnectionError
EIdObjectTypeNotSupported
ftpTransfer
ftpReady
ftpAborted
PortT
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pas
ClientPortMin
ClientPortMax
Port
"EIdTransparentProxyUDPNotSupported
TIdTCPConnection
IdTCPConnection
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pas
TIdTCPClientCustom
TIdTCPClientCustomDh
IdTCPClient
TIdTCPClient
BoundPortT
%EIdSocksUDPNotSupportedBySOCKSVersion
saUsernamePassword
Password
0.0.0.1
0.0.0.0
BoundPort
DefaultPort
ole32.dll
sqlite3_bind_blob
sqlite3_bind_text
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_index
sqlite3_open
sqlite3_close
sqlite3_errmsg
sqlite3_errcode
sqlite3_free
sqlite3_prepare_v2
sqlite3_column_count
sqlite3_column_name
sqlite3_column_decltype
sqlite3_step
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_double
sqlite3_column_text
sqlite3_column_type
sqlite3_column_int64
sqlite3_finalize
sqlite3_reset
SQL error or missing database
An internal logic error in SQLite
Operation terminated by sqlite3_interrupt()
Uses OS features not supported on host
2nd parameter to sqlite3_bind out of range
sqlite3_step() has another row ready
sqlite3_step() has finished executing
Unknown SQLite Error Code "
ESQLiteException
TSQLiteDatabase
TSQLiteTable
Failed to open database "%s" : %s
Failed to open database "%s" : unknown error
Error [%d]: %s.
"%s": %s
Error executing SQL
Could not prepare SQL statement
Error executing SQL statement
SQLite is Busy
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox\
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\
1234567890.
mozsqlite3.dll
sqlite3.dll
MSVCR100.dll
mozglue.dll
mozcrt19.dll
mozutils.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
nss3.dll
PK11_GetInternalKeySlot
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
signons.sqlite
SELECT * FROM moz_logins
encryptedPassword
SOFTWARE\Microsoft\Windows\CurrentVersion
Microsoft\Network\Connections\pbk\rasphone.pbk
rasapi32.dll
rnaph.dll
RAS Passwords
advapi32.dll
crypt32.dll
uURLHistory
abe2869f-9b47-4cd9-a358-c22904dba7f7
UnitPasswords
WindowsLive:name=*
\Mozilla Firefox\
softokn3.dll
userenv.dll
profiles.ini
\signons3.txt
\signons2.txt
\signons1.txt
\signons.txt
\\.\pipe\wzcsvc_wep_keys
winlogon.exe
SafariPasswordRecovery
AVURLProtocol_Classic
\Apple Computer\Preferences\keychain.plist
\Apple\Apple Application Support\CFNetwork.dll
hXXp://
PTF://
*PTF://
hXXps://
gdiplus.dll
GdiplusShutdown
EInvalidGraphicOperation
WbemScripting.SWbemLocator
%s\%s
SELECT * FROM %s
pathToSignedProductExe
pathToSignedReportingExe
WbemScripting.SWbemDateTime
HExecQuery
TargetOperatingSystem
NumberOfMediaSupported
PowerManagementSupported
SCSIPort
Select * from Win32_Keyboard
NumberOfFunctionKeys
MaxMemorySupported
Monochrome
ProtocolSupported
AdminPasswordStatus
BootROMSupported
InfraredSupported
KeyboardPasswordStatus
PowerOnPasswordStatus
SupportContactDescription
Select * from Win32_OperatingSystem
WindowsDirectory
Select Caption,BuildNumber,CSDVersion from Win32_OperatingSystem
TKeylogger
TIdTCPClientNew
Please, send a email to SpyNetCoder ---> spynetcoder@gmail.com
TWebcam
ISO_646.irv:1991
ISO_646.basic:1983
ISO_646.irv:1983
csISO16Portuguese
csISO84Portuguese2
windows-936
csShiftJIS
windows-874
ISO-8859-1-Windows-3.0-Latin-1
csWindows30Latin1
ISO-8859-1-Windows-3.1-Latin-1
csWindows31Latin1
ISO-8859-2-Windows-Latin-2
csWindows31Latin2
ISO-8859-9-Windows-Latin-5
csWindows31Latin5
csMicrosoftPublishing
Windows-31J
csWindows31J
PTCP154
csPTCP154
windows-1250
windows-1251
windows-1252
windows-1253
windows-1254
windows-1255
windows-1256
windows-1257
windows-1258
HTTP-EQUIV
()@,;:\"./
()@,;:\"/[]?=
()@,;:\"/[]?={}
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pas
IdCustomTCPServer
TIdCustomTCPServer
TIdCustomTCPServerX
DefaultPortt
EIdTCPServerError
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pas
EIdTCPNoOnExecute
TIdTCPServer
IdTCPServer
OnExecute
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas
%s User
CmdDelimiter
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas
'TIdCmdTCPServerAfterCommandHandlerEvent
TIdCmdTCPServer
(TIdCmdTCPServerBeforeCommandHandlerEvent
IdCmdTCPServer
Displays commands that the servers supports.
TIdTCPStream
IdRead() method of TIdTCPStream class does not support seeking
TIdHTTPProxyTransferMode
TIdHTTPProxyServerContext
TIdHTTPProxyServerContextlS
TOnHTTPContextEvent
TOnHTTPDocument
TIdHTTPProxyServer
OnHTTPBeforeCommand
OnHTTPResponse8T
OnHTTPDocument
HTTP/1.0
HTTP/1.0 200 Connection established
HNetCfg.NATUPnP
StaticPortMappingCollection
PSAPI.dll
shlwapi.dll
TSendKey
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
AllocateAndGetTcpTableFromStack
AllocateAndGetUdpTableFromStack
SetTcpEntry
GetExtendedTcpTable
GetExtendedUdpTable
TWebcamThread
Shell.Application
SHFileOperationW
\Opera\Opera\wand.dat
\Google\Chrome\User Data\Default\Web Data
\Google\Chrome\User Data\Default\Login Data
TNewFTPThreadU
CDO.Message
CDO.Configuration
hXXp://schemas.microsoft.com/cdo/configuration/smtpusessl
hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate
hXXp://schemas.microsoft.com/cdo/configuration/sendusername
hXXp://schemas.microsoft.com/cdo/configuration/sendpassword
hXXp://schemas.microsoft.com/cdo/configuration/smtpserver
hXXp://schemas.microsoft.com/cdo/configuration/sendusing
hXXp://schemas.microsoft.com/cdo/configuration/smtpserverport
VBoxService.exe
SbieDll.dll
dbghelp.dll
Software\Microsoft\Windows\CurrentVersion
55274-640-2673064-23950
76487-644-3177037-23510
76487-337-8429955-22614
\\.\SICE
\\.\NTICE
drivers\sice.sys
drivers\ntice.sys
drivers\syser.sys
drivers\winice.sys
drivers\sice.vxd
drivers\winice.vxd
winice.vxd
vmm32\winice.vxd
sice.vxd
vmm32\sice.vxd
\\.\SIWVID
\\.\TRW
\\.\TWX
\\.\ICEEXT
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
?456789:;!"#$%&'()* ,-./0123
com.apple.Safari
com.apple.Safari0123456789ABCDEF
KWindows
.ScktComp
WebcamAPI
IdStackWindows
UnitKeylogger
UnitServerPass
UnitExecutarComandos
UnitSendFTPFiles
UnitListarPortasAtivas
Usndkey32
sUnitWindows
IdTCPStream
 IdTCPServer
4UnitStartWebcam
OperaPasswords
ZPasswordRecovery
KuURLHistory
IEpasswords
UnitChrome
SQLite3
SQLiteTable3
UnitFireFox3_5
SetNamedPipeHandleState
GetWindowsDirectoryW
GetProcessHeap
GetCPInfo
DisconnectNamedPipe
CreatePipe
CreateNamedPipeA
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyW
RegCloseKey
RegEnumKeyExA
RegQueryInfoKeyA
CryptImportKey
CryptSetKeyParam
CryptDestroyKey
ShellExecuteW
FindExecutableW
SHDeleteKeyW
URLDownloadToFileW
keybd_event
VkKeyScanW
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExA
SetKeyboardState
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyA
GetKeyboardState
GetKeyboardLayout
GetKeyState
ExitWindowsEx
EnumWindows
GetKeyboardType
FtpPutFileW
FtpSetCurrentDirectoryW
.idata
.rdata
P.reloc
P.rsrc
I.uWP
KERNEL32.DLL
AVICAP32.DLL
gdi32.dll
mpr.dll
msacm32.dll
ntdll.dll
powrprof.dll
pstorec.dll
shell32.dll
URLMON.DLL
user32.dll
wininet.dll
winmm.dll
wsock32.dll
x.html
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\RunOnce
Win\MSstart.exe
Software\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe "
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
explorer.exe
hXXp://VVV.uol.com.br/
hXXp://mail.terra.com.br/
hXXps://VVV.google.com/accounts/servicelogin
hXXps://my.screenname.aol.com/_cqr/login/login.psp
hXXp://VVV.lycos.com
hXXp://VVV.myspace.com
Portugal
Turkey
TargetOperatingSystem:
NumberOfMediaSupported:
PowerManagementSupported:
SCSIPort:
NumberOfFunctionKeys:
Password:
MaxMemorySupported:
Monochrome:
ProtocolSupported:
AdminPasswordStatus:
BootROMSupported:
InfraredSupported:
KeyboardPasswordStatus:
PowerOnPasswordStatus:
SupportContactDescription:
WindowsDirectory:
[Execute]
SpyNetKeylogger
keylogger
WEBCAM
uploadandexecute
uploadandexecuteyes|
uploadandexecuteno|
*#%"{}|\^[]`
:LocalSubNet:Enabled:@xpsperes.dll,-22006
SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG
Invalid Key Name
Invalid KeyName
software\microsoft\windows\currentversion\uninstall\
webcamstream2|
webcam|webcamstream|
webcamstop2|
webcam|webcamstop|
webcamstart
webcamstart2
*.jpg
keyloggernew
c:\users\rafael\desktop\TESTE\
keylogger|mouseloggerbuffer|
OPERA|
CHROME|
keylogger|mouseloggerstart|
keylogger|mouseloggerstop|
keylogger|keyloggerativar|F|
keylogger|keyloggerativar|T|
keylogger|keyloggeronlinekey|
webcamlist|
getpasswords|
webcam
FirstExecution
SelfDelete.bat
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
rar.exe
rarreg.key
filemanager|fmsendftpyes|
filemanager|fmsendftpno|
webcamlist
downexec
openweb
getpasswords
getpasswords|START
chromepass
chromepass|
sendkeyswindow
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
listarportas
listarportas|listadeportasativas|
listarportasdns
listarportas|finalizarconexao|
finalizarprocessoportas
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
tecaladoexecutar
webcam2
webcamconfig
keylogger|keyloggeronlinestart|
keylogger|keyloggeronlinestop|
logs_*.txt
keylogger|keylogger|
keyloggerativar
keyloggerdesativar
keyloggerbaixar
keylogger|keyloggerbaixar|
keylogger|keyloggerbaixar|NOLOGS
keyloggerexcluir
keylogger|keyloggerexcluir|
keyloggeronlinestart
keyloggeronlinestop
MouseLoggerWindows
fmexecnormal
filemanager|fmexecnormal|
fmexechide
filemanager|fmexechide|
fmexecparam
filemanager|fmexecparam|F|
filemanager|fmexecparam|T|
fmsendftp
filemanager|fmsendftp|
keysearch
Logs_*.txt
keysearch|YES
keysearch|NO
keyboardinfo
getcompinfo|getcompinfo|keyboardinfo|
ÃžFAULTBROWSER%
Unsupported clipboard format
Canvas does not allow drawing Clipboard does not support Icons
Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.
Reply Code is not valid: %s
Reply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
File "%s" not found
Object type not supported.
5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Command not supported.
Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)
Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
Invalid Port Range (%d - %d)
%s is not a valid service.
%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.
Set Size Exceeded.)UDP is not support in this SOCKS version.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation already in progress.
Socket operation on non-socket.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
Socket Error # %d
Operation would block.
Operation now in progress.
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Invalid destination array"Character index out of bounds (%d)
Start index out of bounds (%d)
Invalid count (%d)
Invalid destination index (%d)
Invalid codepage (%d)-Error on call to Winsock2 library function %s
ECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Ancestor for '%s' not found
Cannot assign a %s to a %s
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value('%s' is not a valid floating point value
I/O error %d
Integer overflow Invalid floating point operation
Server.exe_252_rwx_00C80000_000F0000:`.rsrc
kernel32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
EInvalidOperation
u%CNu
%s[%d]
EIdCanNotBindPortInRange
EIdInvalidPortRange(,
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pas
WS2_32.DLL
MSWSOCK.DLL
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WSARecvMsg
WSASendMsg
Wship6.dll
Fwpuclnt.dll
TIdSocketListWindows
TIdStackWindowsU
Kernel32.dll
EIdIPVersionUnsupportedT
127.0.0.1
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pas
EIdPortRequiredp
EIdTCPConnectionError
EIdObjectTypeNotSupported
ftpTransfer
ftpReady
ftpAborted
PortT
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pas
ClientPortMin
ClientPortMax
Port
"EIdTransparentProxyUDPNotSupported
TIdTCPConnection
IdTCPConnection
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pas
TIdTCPClientCustom
TIdTCPClientCustomDh
IdTCPClient
TIdTCPClient
BoundPortT
%EIdSocksUDPNotSupportedBySOCKSVersion
saUsernamePassword
Password
0.0.0.1
0.0.0.0
BoundPort
DefaultPort
ole32.dll
sqlite3_bind_blob
sqlite3_bind_text
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_index
sqlite3_open
sqlite3_close
sqlite3_errmsg
sqlite3_errcode
sqlite3_free
sqlite3_prepare_v2
sqlite3_column_count
sqlite3_column_name
sqlite3_column_decltype
sqlite3_step
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_double
sqlite3_column_text
sqlite3_column_type
sqlite3_column_int64
sqlite3_finalize
sqlite3_reset
SQL error or missing database
An internal logic error in SQLite
Operation terminated by sqlite3_interrupt()
Uses OS features not supported on host
2nd parameter to sqlite3_bind out of range
sqlite3_step() has another row ready
sqlite3_step() has finished executing
Unknown SQLite Error Code "
ESQLiteException
TSQLiteDatabase
TSQLiteTable
Failed to open database "%s" : %s
Failed to open database "%s" : unknown error
Error [%d]: %s.
"%s": %s
Error executing SQL
Could not prepare SQL statement
Error executing SQL statement
SQLite is Busy
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox\
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\
1234567890.
mozsqlite3.dll
sqlite3.dll
MSVCR100.dll
mozglue.dll
mozcrt19.dll
mozutils.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
nss3.dll
PK11_GetInternalKeySlot
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
signons.sqlite
SELECT * FROM moz_logins
encryptedPassword
SOFTWARE\Microsoft\Windows\CurrentVersion
Microsoft\Network\Connections\pbk\rasphone.pbk
rasapi32.dll
rnaph.dll
RAS Passwords
advapi32.dll
crypt32.dll
uURLHistory
abe2869f-9b47-4cd9-a358-c22904dba7f7
UnitPasswords
WindowsLive:name=*
\Mozilla Firefox\
softokn3.dll
userenv.dll
profiles.ini
\signons3.txt
\signons2.txt
\signons1.txt
\signons.txt
\\.\pipe\wzcsvc_wep_keys
winlogon.exe
SafariPasswordRecovery
AVURLProtocol_Classic
\Apple Computer\Preferences\keychain.plist
\Apple\Apple Application Support\CFNetwork.dll
hXXp://
PTF://
*PTF://
hXXps://
gdiplus.dll
GdiplusShutdown
EInvalidGraphicOperation
WbemScripting.SWbemLocator
%s\%s
SELECT * FROM %s
pathToSignedProductExe
pathToSignedReportingExe
WbemScripting.SWbemDateTime
HExecQuery
TargetOperatingSystem
NumberOfMediaSupported
PowerManagementSupported
SCSIPort
Select * from Win32_Keyboard
NumberOfFunctionKeys
MaxMemorySupported
Monochrome
ProtocolSupported
AdminPasswordStatus
BootROMSupported
InfraredSupported
KeyboardPasswordStatus
PowerOnPasswordStatus
SupportContactDescription
Select * from Win32_OperatingSystem
WindowsDirectory
Select Caption,BuildNumber,CSDVersion from Win32_OperatingSystem
TKeylogger
TIdTCPClientNew
Please, send a email to SpyNetCoder ---> spynetcoder@gmail.com
TWebcam
ISO_646.irv:1991
ISO_646.basic:1983
ISO_646.irv:1983
csISO16Portuguese
csISO84Portuguese2
windows-936
csShiftJIS
windows-874
ISO-8859-1-Windows-3.0-Latin-1
csWindows30Latin1
ISO-8859-1-Windows-3.1-Latin-1
csWindows31Latin1
ISO-8859-2-Windows-Latin-2
csWindows31Latin2
ISO-8859-9-Windows-Latin-5
csWindows31Latin5
csMicrosoftPublishing
Windows-31J
csWindows31J
PTCP154
csPTCP154
windows-1250
windows-1251
windows-1252
windows-1253
windows-1254
windows-1255
windows-1256
windows-1257
windows-1258
HTTP-EQUIV
()@,;:\"./
()@,;:\"/[]?=
()@,;:\"/[]?={}
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pas
IdCustomTCPServer
TIdCustomTCPServer
TIdCustomTCPServerX
DefaultPortt
EIdTCPServerError
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pas
EIdTCPNoOnExecute
TIdTCPServer
IdTCPServer
OnExecute
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas
%s User
CmdDelimiter
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas
'TIdCmdTCPServerAfterCommandHandlerEvent
TIdCmdTCPServer
(TIdCmdTCPServerBeforeCommandHandlerEvent
IdCmdTCPServer
Displays commands that the servers supports.
TIdTCPStream
IdRead() method of TIdTCPStream class does not support seeking
TIdHTTPProxyTransferMode
TIdHTTPProxyServerContext
TIdHTTPProxyServerContextlS
TOnHTTPContextEvent
TOnHTTPDocument
TIdHTTPProxyServer
OnHTTPBeforeCommand
OnHTTPResponse8T
OnHTTPDocument
HTTP/1.0
HTTP/1.0 200 Connection established
HNetCfg.NATUPnP
StaticPortMappingCollection
PSAPI.dll
shlwapi.dll
TSendKey
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
AllocateAndGetTcpTableFromStack
AllocateAndGetUdpTableFromStack
SetTcpEntry
GetExtendedTcpTable
GetExtendedUdpTable
TWebcamThread
Shell.Application
SHFileOperationW
\Opera\Opera\wand.dat
\Google\Chrome\User Data\Default\Web Data
\Google\Chrome\User Data\Default\Login Data
TNewFTPThreadU
CDO.Message
CDO.Configuration
hXXp://schemas.microsoft.com/cdo/configuration/smtpusessl
hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate
hXXp://schemas.microsoft.com/cdo/configuration/sendusername
hXXp://schemas.microsoft.com/cdo/configuration/sendpassword
hXXp://schemas.microsoft.com/cdo/configuration/smtpserver
hXXp://schemas.microsoft.com/cdo/configuration/sendusing
hXXp://schemas.microsoft.com/cdo/configuration/smtpserverport
VBoxService.exe
SbieDll.dll
dbghelp.dll
Software\Microsoft\Windows\CurrentVersion
55274-640-2673064-23950
76487-644-3177037-23510
76487-337-8429955-22614
\\.\SICE
\\.\NTICE
drivers\sice.sys
drivers\ntice.sys
drivers\syser.sys
drivers\winice.sys
drivers\sice.vxd
drivers\winice.vxd
winice.vxd
vmm32\winice.vxd
sice.vxd
vmm32\sice.vxd
\\.\SIWVID
\\.\TRW
\\.\TWX
\\.\ICEEXT
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
?456789:;!"#$%&'()* ,-./0123
com.apple.Safari
com.apple.Safari0123456789ABCDEF
KWindows
.ScktComp
WebcamAPI
IdStackWindows
UnitKeylogger
UnitServerPass
UnitExecutarComandos
UnitSendFTPFiles
UnitListarPortasAtivas
Usndkey32
sUnitWindows
IdTCPStream
 IdTCPServer
4UnitStartWebcam
OperaPasswords
ZPasswordRecovery
KuURLHistory
IEpasswords
UnitChrome
SQLite3
SQLiteTable3
UnitFireFox3_5
SetNamedPipeHandleState
GetWindowsDirectoryW
GetProcessHeap
GetCPInfo
DisconnectNamedPipe
CreatePipe
CreateNamedPipeA
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyW
RegCloseKey
RegEnumKeyExA
RegQueryInfoKeyA
CryptImportKey
CryptSetKeyParam
CryptDestroyKey
ShellExecuteW
FindExecutableW
SHDeleteKeyW
URLDownloadToFileW
keybd_event
VkKeyScanW
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExA
SetKeyboardState
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyA
GetKeyboardState
GetKeyboardLayout
GetKeyState
ExitWindowsEx
EnumWindows
GetKeyboardType
FtpPutFileW
FtpSetCurrentDirectoryW
.idata
.rdata
P.reloc
P.rsrc
I.uWP
KERNEL32.DLL
AVICAP32.DLL
gdi32.dll
mpr.dll
msacm32.dll
ntdll.dll
powrprof.dll
pstorec.dll
shell32.dll
URLMON.DLL
user32.dll
wininet.dll
winmm.dll
wsock32.dll
x.html
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\RunOnce
Win\MSstart.exe
Software\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe "
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
explorer.exe
hXXp://VVV.uol.com.br/
hXXp://mail.terra.com.br/
hXXps://VVV.google.com/accounts/servicelogin
hXXps://my.screenname.aol.com/_cqr/login/login.psp
hXXp://VVV.lycos.com
hXXp://VVV.myspace.com
Portugal
Turkey
TargetOperatingSystem:
NumberOfMediaSupported:
PowerManagementSupported:
SCSIPort:
NumberOfFunctionKeys:
Password:
MaxMemorySupported:
Monochrome:
ProtocolSupported:
AdminPasswordStatus:
BootROMSupported:
InfraredSupported:
KeyboardPasswordStatus:
PowerOnPasswordStatus:
SupportContactDescription:
WindowsDirectory:
[Execute]
SpyNetKeylogger
keylogger
WEBCAM
uploadandexecute
uploadandexecuteyes|
uploadandexecuteno|
*#%"{}|\^[]`
:LocalSubNet:Enabled:@xpsperes.dll,-22006
SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG
Invalid Key Name
Invalid KeyName
software\microsoft\windows\currentversion\uninstall\
webcamstream2|
webcam|webcamstream|
webcamstop2|
webcam|webcamstop|
webcamstart
webcamstart2
*.jpg
keyloggernew
c:\users\rafael\desktop\TESTE\
keylogger|mouseloggerbuffer|
OPERA|
CHROME|
keylogger|mouseloggerstart|
keylogger|mouseloggerstop|
keylogger|keyloggerativar|F|
keylogger|keyloggerativar|T|
keylogger|keyloggeronlinekey|
webcamlist|
getpasswords|
webcam
FirstExecution
SelfDelete.bat
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
rar.exe
rarreg.key
filemanager|fmsendftpyes|
filemanager|fmsendftpno|
webcamlist
downexec
openweb
getpasswords
getpasswords|START
chromepass
chromepass|
sendkeyswindow
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
listarportas
listarportas|listadeportasativas|
listarportasdns
listarportas|finalizarconexao|
finalizarprocessoportas
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
tecaladoexecutar
webcam2
webcamconfig
keylogger|keyloggeronlinestart|
keylogger|keyloggeronlinestop|
logs_*.txt
keylogger|keylogger|
keyloggerativar
keyloggerdesativar
keyloggerbaixar
keylogger|keyloggerbaixar|
keylogger|keyloggerbaixar|NOLOGS
keyloggerexcluir
keylogger|keyloggerexcluir|
keyloggeronlinestart
keyloggeronlinestop
MouseLoggerWindows
fmexecnormal
filemanager|fmexecnormal|
fmexechide
filemanager|fmexechide|
fmexecparam
filemanager|fmexecparam|F|
filemanager|fmexecparam|T|
fmsendftp
filemanager|fmsendftp|
keysearch
Logs_*.txt
keysearch|YES
keysearch|NO
keyboardinfo
getcompinfo|getcompinfo|keyboardinfo|
ÃžFAULTBROWSER%
Unsupported clipboard format
Canvas does not allow drawing Clipboard does not support Icons
Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.
Reply Code is not valid: %s
Reply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
File "%s" not found
Object type not supported.
5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Command not supported.
Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)
Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
Invalid Port Range (%d - %d)
%s is not a valid service.
%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.
Set Size Exceeded.)UDP is not support in this SOCKS version.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation already in progress.
Socket operation on non-socket.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
Socket Error # %d
Operation would block.
Operation now in progress.
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Invalid destination array"Character index out of bounds (%d)
Start index out of bounds (%d)
Invalid count (%d)
Invalid destination index (%d)
Invalid codepage (%d)-Error on call to Winsock2 library function %s
ECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Ancestor for '%s' not found
Cannot assign a %s to a %s
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value('%s' is not a valid floating point value
I/O error %d
Integer overflow Invalid floating point operation
Server.exe_1960:`.rsrc
kernel32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
EInvalidOperation
u%CNu
%s[%d]
EIdCanNotBindPortInRange
EIdInvalidPortRange(,
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pas
WS2_32.DLL
MSWSOCK.DLL
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WSARecvMsg
WSASendMsg
Wship6.dll
Fwpuclnt.dll
TIdSocketListWindows
TIdStackWindowsU
Kernel32.dll
EIdIPVersionUnsupportedT
127.0.0.1
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pas
EIdPortRequiredp
EIdTCPConnectionError
EIdObjectTypeNotSupported
ftpTransfer
ftpReady
ftpAborted
PortT
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pas
ClientPortMin
ClientPortMax
Port
"EIdTransparentProxyUDPNotSupported
TIdTCPConnection
IdTCPConnection
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pas
TIdTCPClientCustom
TIdTCPClientCustomDh
IdTCPClient
TIdTCPClient
BoundPortT
%EIdSocksUDPNotSupportedBySOCKSVersion
saUsernamePassword
Password
0.0.0.1
0.0.0.0
BoundPort
DefaultPort
ole32.dll
sqlite3_bind_blob
sqlite3_bind_text
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_index
sqlite3_open
sqlite3_close
sqlite3_errmsg
sqlite3_errcode
sqlite3_free
sqlite3_prepare_v2
sqlite3_column_count
sqlite3_column_name
sqlite3_column_decltype
sqlite3_step
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_double
sqlite3_column_text
sqlite3_column_type
sqlite3_column_int64
sqlite3_finalize
sqlite3_reset
SQL error or missing database
An internal logic error in SQLite
Operation terminated by sqlite3_interrupt()
Uses OS features not supported on host
2nd parameter to sqlite3_bind out of range
sqlite3_step() has another row ready
sqlite3_step() has finished executing
Unknown SQLite Error Code "
ESQLiteException
TSQLiteDatabase
TSQLiteTable
Failed to open database "%s" : %s
Failed to open database "%s" : unknown error
Error [%d]: %s.
"%s": %s
Error executing SQL
Could not prepare SQL statement
Error executing SQL statement
SQLite is Busy
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox\
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\
1234567890.
mozsqlite3.dll
sqlite3.dll
MSVCR100.dll
mozglue.dll
mozcrt19.dll
mozutils.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
nss3.dll
PK11_GetInternalKeySlot
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
signons.sqlite
SELECT * FROM moz_logins
encryptedPassword
SOFTWARE\Microsoft\Windows\CurrentVersion
Microsoft\Network\Connections\pbk\rasphone.pbk
rasapi32.dll
rnaph.dll
RAS Passwords
advapi32.dll
crypt32.dll
uURLHistory
abe2869f-9b47-4cd9-a358-c22904dba7f7
UnitPasswords
WindowsLive:name=*
\Mozilla Firefox\
softokn3.dll
userenv.dll
profiles.ini
\signons3.txt
\signons2.txt
\signons1.txt
\signons.txt
\\.\pipe\wzcsvc_wep_keys
winlogon.exe
SafariPasswordRecovery
AVURLProtocol_Classic
\Apple Computer\Preferences\keychain.plist
\Apple\Apple Application Support\CFNetwork.dll
hXXp://
PTF://
*PTF://
hXXps://
gdiplus.dll
GdiplusShutdown
EInvalidGraphicOperation
WbemScripting.SWbemLocator
%s\%s
SELECT * FROM %s
pathToSignedProductExe
pathToSignedReportingExe
WbemScripting.SWbemDateTime
HExecQuery
TargetOperatingSystem
NumberOfMediaSupported
PowerManagementSupported
SCSIPort
Select * from Win32_Keyboard
NumberOfFunctionKeys
MaxMemorySupported
Monochrome
ProtocolSupported
AdminPasswordStatus
BootROMSupported
InfraredSupported
KeyboardPasswordStatus
PowerOnPasswordStatus
SupportContactDescription
Select * from Win32_OperatingSystem
WindowsDirectory
Select Caption,BuildNumber,CSDVersion from Win32_OperatingSystem
TKeylogger
TIdTCPClientNew
Please, send a email to SpyNetCoder ---> spynetcoder@gmail.com
TWebcam
ISO_646.irv:1991
ISO_646.basic:1983
ISO_646.irv:1983
csISO16Portuguese
csISO84Portuguese2
windows-936
csShiftJIS
windows-874
ISO-8859-1-Windows-3.0-Latin-1
csWindows30Latin1
ISO-8859-1-Windows-3.1-Latin-1
csWindows31Latin1
ISO-8859-2-Windows-Latin-2
csWindows31Latin2
ISO-8859-9-Windows-Latin-5
csWindows31Latin5
csMicrosoftPublishing
Windows-31J
csWindows31J
PTCP154
csPTCP154
windows-1250
windows-1251
windows-1252
windows-1253
windows-1254
windows-1255
windows-1256
windows-1257
windows-1258
HTTP-EQUIV
()@,;:\"./
()@,;:\"/[]?=
()@,;:\"/[]?={}
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pas
IdCustomTCPServer
TIdCustomTCPServer
TIdCustomTCPServerX
DefaultPortt
EIdTCPServerError
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pas
EIdTCPNoOnExecute
TIdTCPServer
IdTCPServer
OnExecute
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas
%s User
CmdDelimiter
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas
'TIdCmdTCPServerAfterCommandHandlerEvent
TIdCmdTCPServer
(TIdCmdTCPServerBeforeCommandHandlerEvent
IdCmdTCPServer
Displays commands that the servers supports.
TIdTCPStream
IdRead() method of TIdTCPStream class does not support seeking
TIdHTTPProxyTransferMode
TIdHTTPProxyServerContext
TIdHTTPProxyServerContextlS
TOnHTTPContextEvent
TOnHTTPDocument
TIdHTTPProxyServer
OnHTTPBeforeCommand
OnHTTPResponse8T
OnHTTPDocument
HTTP/1.0
HTTP/1.0 200 Connection established
HNetCfg.NATUPnP
StaticPortMappingCollection
PSAPI.dll
shlwapi.dll
TSendKey
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
AllocateAndGetTcpTableFromStack
AllocateAndGetUdpTableFromStack
SetTcpEntry
GetExtendedTcpTable
GetExtendedUdpTable
TWebcamThread
Shell.Application
SHFileOperationW
\Opera\Opera\wand.dat
\Google\Chrome\User Data\Default\Web Data
\Google\Chrome\User Data\Default\Login Data
TNewFTPThreadU
CDO.Message
CDO.Configuration
hXXp://schemas.microsoft.com/cdo/configuration/smtpusessl
hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate
hXXp://schemas.microsoft.com/cdo/configuration/sendusername
hXXp://schemas.microsoft.com/cdo/configuration/sendpassword
hXXp://schemas.microsoft.com/cdo/configuration/smtpserver
hXXp://schemas.microsoft.com/cdo/configuration/sendusing
hXXp://schemas.microsoft.com/cdo/configuration/smtpserverport
VBoxService.exe
SbieDll.dll
dbghelp.dll
Software\Microsoft\Windows\CurrentVersion
55274-640-2673064-23950
76487-644-3177037-23510
76487-337-8429955-22614
\\.\SICE
\\.\NTICE
drivers\sice.sys
drivers\ntice.sys
drivers\syser.sys
drivers\winice.sys
drivers\sice.vxd
drivers\winice.vxd
winice.vxd
vmm32\winice.vxd
sice.vxd
vmm32\sice.vxd
\\.\SIWVID
\\.\TRW
\\.\TWX
\\.\ICEEXT
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
?456789:;!"#$%&'()* ,-./0123
com.apple.Safari
com.apple.Safari0123456789ABCDEF
KWindows
.ScktComp
WebcamAPI
IdStackWindows
UnitKeylogger
UnitServerPass
UnitExecutarComandos
UnitSendFTPFiles
UnitListarPortasAtivas
Usndkey32
sUnitWindows
IdTCPStream
 IdTCPServer
4UnitStartWebcam
OperaPasswords
ZPasswordRecovery
KuURLHistory
IEpasswords
UnitChrome
SQLite3
SQLiteTable3
UnitFireFox3_5
SetNamedPipeHandleState
GetWindowsDirectoryW
GetProcessHeap
GetCPInfo
DisconnectNamedPipe
CreatePipe
CreateNamedPipeA
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyW
RegCloseKey
RegEnumKeyExA
RegQueryInfoKeyA
CryptImportKey
CryptSetKeyParam
CryptDestroyKey
ShellExecuteW
FindExecutableW
SHDeleteKeyW
URLDownloadToFileW
keybd_event
VkKeyScanW
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExA
SetKeyboardState
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyA
GetKeyboardState
GetKeyboardLayout
GetKeyState
ExitWindowsEx
EnumWindows
GetKeyboardType
FtpPutFileW
FtpSetCurrentDirectoryW
.idata
.rdata
P.reloc
P.rsrc
I.uWP
KERNEL32.DLL
AVICAP32.DLL
gdi32.dll
mpr.dll
msacm32.dll
ntdll.dll
powrprof.dll
pstorec.dll
shell32.dll
URLMON.DLL
user32.dll
wininet.dll
winmm.dll
wsock32.dll
x.html
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\RunOnce
Win\MSstart.exe
Software\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe "
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
explorer.exe
hXXp://VVV.uol.com.br/
hXXp://mail.terra.com.br/
hXXps://VVV.google.com/accounts/servicelogin
hXXps://my.screenname.aol.com/_cqr/login/login.psp
hXXp://VVV.lycos.com
hXXp://VVV.myspace.com
Portugal
Turkey
TargetOperatingSystem:
NumberOfMediaSupported:
PowerManagementSupported:
SCSIPort:
NumberOfFunctionKeys:
Password:
MaxMemorySupported:
Monochrome:
ProtocolSupported:
AdminPasswordStatus:
BootROMSupported:
InfraredSupported:
KeyboardPasswordStatus:
PowerOnPasswordStatus:
SupportContactDescription:
WindowsDirectory:
[Execute]
SpyNetKeylogger
keylogger
WEBCAM
uploadandexecute
uploadandexecuteyes|
uploadandexecuteno|
*#%"{}|\^[]`
:LocalSubNet:Enabled:@xpsperes.dll,-22006
SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG
Invalid Key Name
Invalid KeyName
software\microsoft\windows\currentversion\uninstall\
webcamstream2|
webcam|webcamstream|
webcamstop2|
webcam|webcamstop|
webcamstart
webcamstart2
*.jpg
keyloggernew
c:\users\rafael\desktop\TESTE\
keylogger|mouseloggerbuffer|
OPERA|
CHROME|
keylogger|mouseloggerstart|
keylogger|mouseloggerstop|
keylogger|keyloggerativar|F|
keylogger|keyloggerativar|T|
keylogger|keyloggeronlinekey|
webcamlist|
getpasswords|
webcam
FirstExecution
SelfDelete.bat
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
rar.exe
rarreg.key
filemanager|fmsendftpyes|
filemanager|fmsendftpno|
webcamlist
downexec
openweb
getpasswords
getpasswords|START
chromepass
chromepass|
sendkeyswindow
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
listarportas
listarportas|listadeportasativas|
listarportasdns
listarportas|finalizarconexao|
finalizarprocessoportas
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
tecaladoexecutar
webcam2
webcamconfig
keylogger|keyloggeronlinestart|
keylogger|keyloggeronlinestop|
logs_*.txt
keylogger|keylogger|
keyloggerativar
keyloggerdesativar
keyloggerbaixar
keylogger|keyloggerbaixar|
keylogger|keyloggerbaixar|NOLOGS
keyloggerexcluir
keylogger|keyloggerexcluir|
keyloggeronlinestart
keyloggeronlinestop
MouseLoggerWindows
fmexecnormal
filemanager|fmexecnormal|
fmexechide
filemanager|fmexechide|
fmexecparam
filemanager|fmexecparam|F|
filemanager|fmexecparam|T|
fmsendftp
filemanager|fmsendftp|
keysearch
Logs_*.txt
keysearch|YES
keysearch|NO
keyboardinfo
getcompinfo|getcompinfo|keyboardinfo|
ÃžFAULTBROWSER%
Unsupported clipboard format
Canvas does not allow drawing Clipboard does not support Icons
Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.
Reply Code is not valid: %s
Reply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
File "%s" not found
Object type not supported.
5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Command not supported.
Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)
Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
Invalid Port Range (%d - %d)
%s is not a valid service.
%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.
Set Size Exceeded.)UDP is not support in this SOCKS version.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation already in progress.
Socket operation on non-socket.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
Socket Error # %d
Operation would block.
Operation now in progress.
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Invalid destination array"Character index out of bounds (%d)
Start index out of bounds (%d)
Invalid count (%d)
Invalid destination index (%d)
Invalid codepage (%d)-Error on call to Winsock2 library function %s
ECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Ancestor for '%s' not found
Cannot assign a %s to a %s
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value('%s' is not a valid floating point value
I/O error %d
Integer overflow Invalid floating point operation
Server.exe_1960_rwx_00C80000_000F0000:`.rsrc
kernel32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
EInvalidOperation
u%CNu
%s[%d]
EIdCanNotBindPortInRange
EIdInvalidPortRange(,
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pas
WS2_32.DLL
MSWSOCK.DLL
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WSARecvMsg
WSASendMsg
Wship6.dll
Fwpuclnt.dll
TIdSocketListWindows
TIdStackWindowsU
Kernel32.dll
EIdIPVersionUnsupportedT
127.0.0.1
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pas
EIdPortRequiredp
EIdTCPConnectionError
EIdObjectTypeNotSupported
ftpTransfer
ftpReady
ftpAborted
PortT
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pas
ClientPortMin
ClientPortMax
Port
"EIdTransparentProxyUDPNotSupported
TIdTCPConnection
IdTCPConnection
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pas
TIdTCPClientCustom
TIdTCPClientCustomDh
IdTCPClient
TIdTCPClient
BoundPortT
%EIdSocksUDPNotSupportedBySOCKSVersion
saUsernamePassword
Password
0.0.0.1
0.0.0.0
BoundPort
DefaultPort
ole32.dll
sqlite3_bind_blob
sqlite3_bind_text
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_index
sqlite3_open
sqlite3_close
sqlite3_errmsg
sqlite3_errcode
sqlite3_free
sqlite3_prepare_v2
sqlite3_column_count
sqlite3_column_name
sqlite3_column_decltype
sqlite3_step
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_double
sqlite3_column_text
sqlite3_column_type
sqlite3_column_int64
sqlite3_finalize
sqlite3_reset
SQL error or missing database
An internal logic error in SQLite
Operation terminated by sqlite3_interrupt()
Uses OS features not supported on host
2nd parameter to sqlite3_bind out of range
sqlite3_step() has another row ready
sqlite3_step() has finished executing
Unknown SQLite Error Code "
ESQLiteException
TSQLiteDatabase
TSQLiteTable
Failed to open database "%s" : %s
Failed to open database "%s" : unknown error
Error [%d]: %s.
"%s": %s
Error executing SQL
Could not prepare SQL statement
Error executing SQL statement
SQLite is Busy
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox\
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\
1234567890.
mozsqlite3.dll
sqlite3.dll
MSVCR100.dll
mozglue.dll
mozcrt19.dll
mozutils.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
nss3.dll
PK11_GetInternalKeySlot
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
signons.sqlite
SELECT * FROM moz_logins
encryptedPassword
SOFTWARE\Microsoft\Windows\CurrentVersion
Microsoft\Network\Connections\pbk\rasphone.pbk
rasapi32.dll
rnaph.dll
RAS Passwords
advapi32.dll
crypt32.dll
uURLHistory
abe2869f-9b47-4cd9-a358-c22904dba7f7
UnitPasswords
WindowsLive:name=*
\Mozilla Firefox\
softokn3.dll
userenv.dll
profiles.ini
\signons3.txt
\signons2.txt
\signons1.txt
\signons.txt
\\.\pipe\wzcsvc_wep_keys
winlogon.exe
SafariPasswordRecovery
AVURLProtocol_Classic
\Apple Computer\Preferences\keychain.plist
\Apple\Apple Application Support\CFNetwork.dll
hXXp://
PTF://
*PTF://
hXXps://
gdiplus.dll
GdiplusShutdown
EInvalidGraphicOperation
WbemScripting.SWbemLocator
%s\%s
SELECT * FROM %s
pathToSignedProductExe
pathToSignedReportingExe
WbemScripting.SWbemDateTime
HExecQuery
TargetOperatingSystem
NumberOfMediaSupported
PowerManagementSupported
SCSIPort
Select * from Win32_Keyboard
NumberOfFunctionKeys
MaxMemorySupported
Monochrome
ProtocolSupported
AdminPasswordStatus
BootROMSupported
InfraredSupported
KeyboardPasswordStatus
PowerOnPasswordStatus
SupportContactDescription
Select * from Win32_OperatingSystem
WindowsDirectory
Select Caption,BuildNumber,CSDVersion from Win32_OperatingSystem
TKeylogger
TIdTCPClientNew
Please, send a email to SpyNetCoder ---> spynetcoder@gmail.com
TWebcam
ISO_646.irv:1991
ISO_646.basic:1983
ISO_646.irv:1983
csISO16Portuguese
csISO84Portuguese2
windows-936
csShiftJIS
windows-874
ISO-8859-1-Windows-3.0-Latin-1
csWindows30Latin1
ISO-8859-1-Windows-3.1-Latin-1
csWindows31Latin1
ISO-8859-2-Windows-Latin-2
csWindows31Latin2
ISO-8859-9-Windows-Latin-5
csWindows31Latin5
csMicrosoftPublishing
Windows-31J
csWindows31J
PTCP154
csPTCP154
windows-1250
windows-1251
windows-1252
windows-1253
windows-1254
windows-1255
windows-1256
windows-1257
windows-1258
HTTP-EQUIV
()@,;:\"./
()@,;:\"/[]?=
()@,;:\"/[]?={}
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pas
IdCustomTCPServer
TIdCustomTCPServer
TIdCustomTCPServerX
DefaultPortt
EIdTCPServerError
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pas
EIdTCPNoOnExecute
TIdTCPServer
IdTCPServer
OnExecute
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas
%s User
CmdDelimiter
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas
'TIdCmdTCPServerAfterCommandHandlerEvent
TIdCmdTCPServer
(TIdCmdTCPServerBeforeCommandHandlerEvent
IdCmdTCPServer
Displays commands that the servers supports.
TIdTCPStream
IdRead() method of TIdTCPStream class does not support seeking
TIdHTTPProxyTransferMode
TIdHTTPProxyServerContext
TIdHTTPProxyServerContextlS
TOnHTTPContextEvent
TOnHTTPDocument
TIdHTTPProxyServer
OnHTTPBeforeCommand
OnHTTPResponse8T
OnHTTPDocument
HTTP/1.0
HTTP/1.0 200 Connection established
HNetCfg.NATUPnP
StaticPortMappingCollection
PSAPI.dll
shlwapi.dll
TSendKey
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
AllocateAndGetTcpTableFromStack
AllocateAndGetUdpTableFromStack
SetTcpEntry
GetExtendedTcpTable
GetExtendedUdpTable
TWebcamThread
Shell.Application
SHFileOperationW
\Opera\Opera\wand.dat
\Google\Chrome\User Data\Default\Web Data
\Google\Chrome\User Data\Default\Login Data
TNewFTPThreadU
CDO.Message
CDO.Configuration
hXXp://schemas.microsoft.com/cdo/configuration/smtpusessl
hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate
hXXp://schemas.microsoft.com/cdo/configuration/sendusername
hXXp://schemas.microsoft.com/cdo/configuration/sendpassword
hXXp://schemas.microsoft.com/cdo/configuration/smtpserver
hXXp://schemas.microsoft.com/cdo/configuration/sendusing
hXXp://schemas.microsoft.com/cdo/configuration/smtpserverport
VBoxService.exe
SbieDll.dll
dbghelp.dll
Software\Microsoft\Windows\CurrentVersion
55274-640-2673064-23950
76487-644-3177037-23510
76487-337-8429955-22614
\\.\SICE
\\.\NTICE
drivers\sice.sys
drivers\ntice.sys
drivers\syser.sys
drivers\winice.sys
drivers\sice.vxd
drivers\winice.vxd
winice.vxd
vmm32\winice.vxd
sice.vxd
vmm32\sice.vxd
\\.\SIWVID
\\.\TRW
\\.\TWX
\\.\ICEEXT
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
?456789:;!"#$%&'()* ,-./0123
com.apple.Safari
com.apple.Safari0123456789ABCDEF
KWindows
.ScktComp
WebcamAPI
IdStackWindows
UnitKeylogger
UnitServerPass
UnitExecutarComandos
UnitSendFTPFiles
UnitListarPortasAtivas
Usndkey32
sUnitWindows
IdTCPStream
 IdTCPServer
4UnitStartWebcam
OperaPasswords
ZPasswordRecovery
KuURLHistory
IEpasswords
UnitChrome
SQLite3
SQLiteTable3
UnitFireFox3_5
SetNamedPipeHandleState
GetWindowsDirectoryW
GetProcessHeap
GetCPInfo
DisconnectNamedPipe
CreatePipe
CreateNamedPipeA
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyW
RegCloseKey
RegEnumKeyExA
RegQueryInfoKeyA
CryptImportKey
CryptSetKeyParam
CryptDestroyKey
ShellExecuteW
FindExecutableW
SHDeleteKeyW
URLDownloadToFileW
keybd_event
VkKeyScanW
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExA
SetKeyboardState
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyA
GetKeyboardState
GetKeyboardLayout
GetKeyState
ExitWindowsEx
EnumWindows
GetKeyboardType
FtpPutFileW
FtpSetCurrentDirectoryW
.idata
.rdata
P.reloc
P.rsrc
I.uWP
KERNEL32.DLL
AVICAP32.DLL
gdi32.dll
mpr.dll
msacm32.dll
ntdll.dll
powrprof.dll
pstorec.dll
shell32.dll
URLMON.DLL
user32.dll
wininet.dll
winmm.dll
wsock32.dll
x.html
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\RunOnce
Win\MSstart.exe
Software\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe "
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
explorer.exe
hXXp://VVV.uol.com.br/
hXXp://mail.terra.com.br/
hXXps://VVV.google.com/accounts/servicelogin
hXXps://my.screenname.aol.com/_cqr/login/login.psp
hXXp://VVV.lycos.com
hXXp://VVV.myspace.com
Portugal
Turkey
TargetOperatingSystem:
NumberOfMediaSupported:
PowerManagementSupported:
SCSIPort:
NumberOfFunctionKeys:
Password:
MaxMemorySupported:
Monochrome:
ProtocolSupported:
AdminPasswordStatus:
BootROMSupported:
InfraredSupported:
KeyboardPasswordStatus:
PowerOnPasswordStatus:
SupportContactDescription:
WindowsDirectory:
[Execute]
SpyNetKeylogger
keylogger
WEBCAM
uploadandexecute
uploadandexecuteyes|
uploadandexecuteno|
*#%"{}|\^[]`
:LocalSubNet:Enabled:@xpsperes.dll,-22006
SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG
Invalid Key Name
Invalid KeyName
software\microsoft\windows\currentversion\uninstall\
webcamstream2|
webcam|webcamstream|
webcamstop2|
webcam|webcamstop|
webcamstart
webcamstart2
*.jpg
keyloggernew
c:\users\rafael\desktop\TESTE\
keylogger|mouseloggerbuffer|
OPERA|
CHROME|
keylogger|mouseloggerstart|
keylogger|mouseloggerstop|
keylogger|keyloggerativar|F|
keylogger|keyloggerativar|T|
keylogger|keyloggeronlinekey|
webcamlist|
getpasswords|
webcam
FirstExecution
SelfDelete.bat
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
rar.exe
rarreg.key
filemanager|fmsendftpyes|
filemanager|fmsendftpno|
webcamlist
downexec
openweb
getpasswords
getpasswords|START
chromepass
chromepass|
sendkeyswindow
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
listarportas
listarportas|listadeportasativas|
listarportasdns
listarportas|finalizarconexao|
finalizarprocessoportas
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
tecaladoexecutar
webcam2
webcamconfig
keylogger|keyloggeronlinestart|
keylogger|keyloggeronlinestop|
logs_*.txt
keylogger|keylogger|
keyloggerativar
keyloggerdesativar
keyloggerbaixar
keylogger|keyloggerbaixar|
keylogger|keyloggerbaixar|NOLOGS
keyloggerexcluir
keylogger|keyloggerexcluir|
keyloggeronlinestart
keyloggeronlinestop
MouseLoggerWindows
fmexecnormal
filemanager|fmexecnormal|
fmexechide
filemanager|fmexechide|
fmexecparam
filemanager|fmexecparam|F|
filemanager|fmexecparam|T|
fmsendftp
filemanager|fmsendftp|
keysearch
Logs_*.txt
keysearch|YES
keysearch|NO
keyboardinfo
getcompinfo|getcompinfo|keyboardinfo|
ÃžFAULTBROWSER%
Unsupported clipboard format
Canvas does not allow drawing Clipboard does not support Icons
Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.
Reply Code is not valid: %s
Reply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
File "%s" not found
Object type not supported.
5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Command not supported.
Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)
Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
Invalid Port Range (%d - %d)
%s is not a valid service.
%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.
Set Size Exceeded.)UDP is not support in this SOCKS version.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation already in progress.
Socket operation on non-socket.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
Socket Error # %d
Operation would block.
Operation now in progress.
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Invalid destination array"Character index out of bounds (%d)
Start index out of bounds (%d)
Invalid count (%d)
Invalid destination index (%d)
Invalid codepage (%d)-Error on call to Winsock2 library function %s
ECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Ancestor for '%s' not found
Cannot assign a %s to a %s
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value('%s' is not a valid floating point value
I/O error %d
Integer overflow Invalid floating point operation
3>