HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Kazy.51389 (B) (Emsisoft), Gen:Variant.Kazy.51389 (AdAware), Trojan.Win32.IEDummy.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan, VirTool
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 0cfc24405ce68891b18ebcc17c7b9d0d
SHA1: a51156cd15312c1782ab3b7b5ed9580ed325186e
SHA256: ec162017a19c3597435086d8ef98ad22a664b11ca3d73e861fe0077392890a65
SSDeep: 6144:2fIi 7pxuqpbLUiCkYufk0CwAZszooW4KycDc66aRTctl5QN4syXe:gqzuE1CXufbCwAu/WnDR1RO8N5T
Size: 356352 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2015-10-03 06:18:36
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1480
%original file name%.exe:276
attrib.exe:440
Server.exe:216
Server.exe:596
Server.exe:1168
Server.exe:316
Server.exe:1648
Server.exe:1924
Server.exe:1856
Server.exe:1968
Server.exe:1944
Server.exe:956
Server.exe:1112
Server.exe:464
Server.exe:420
Server.exe:1016
Server.exe:1124
Server.exe:1136
Server.exe:1932
Server.exe:1956
Server.exe:1792
Server.exe:1756
Server.exe:1088
Server.exe:1700
Server.exe:1600
Server.exe:1820
Server.exe:1680
Server.exe:2000
Server.exe:1748
Server.exe:1360
Server.exe:1976
Server.exe:2008
Server.exe:800
Server.exe:376
The Trojan injects its code into the following process(es):
Server.exe:252
Server.exe:1960
explorer.exe:1632
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:276 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Win\MSstart.exe (2105 bytes)
%System%\SpyNet\Server.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelfDelete.bat (330 bytes)
The process Server.exe:252 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%System%\SpyNet\logs_VCAQ58cSQ5cAQ\logs_29-10-2015.txt (290 bytes)
The process Server.exe:1960 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
Registry activity
The process %original file name%.exe:1480 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 77 74 33 B9 14 4F 52 30 83 A3 55 AF 18 89 3C"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process %original file name%.exe:276 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}]
"StubPath" = "%System%\SpyNet\Server.exe restart"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%\spynet]
"server.exe" = ""
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"SelfDelete.bat" = "SelfDelete"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"Server" = "%System%\SpyNet\Server.exe"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE D8 81 06 1B B9 9A 2A 7F 60 BA 36 F2 6A AC 38"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = "C:\Win\MSstart.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Server" = "%System%\SpyNet\Server.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = "C:\Win\MSstart.exe"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan adds the reference to itself to be executed when a user logs on:
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe %System%\SpyNet\Server.exe"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Server" = "%System%\SpyNet\Server.exe"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan adds the reference to itself to be executed when a user logs on:
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe %System%\SpyNet\Server.exe"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Server" = "%System%\SpyNet\Server.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Server" = "%System%\SpyNet\Server.exe"
The process attrib.exe:440 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 31 D4 42 07 9F 85 89 54 62 0E 0D 8C D9 A6 AA"
The process Server.exe:216 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5C 47 C3 63 66 2B B0 FD 8A 22 C4 2A 13 85 A8 AC"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:596 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 51 B5 D3 98 D4 58 D6 DF 37 1F CB 98 1F AC 5E"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
The process Server.exe:1168 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA 62 6D 60 A5 4F E1 78 A2 E9 D7 CE 21 78 AD F3"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:316 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 70 16 FC BD 04 44 91 00 33 EC 63 93 78 B1 1B"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
The process Server.exe:1648 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A 4B 8B 4B C8 DC AE FB 3A FD 87 54 FF FB D0 60"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:1924 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 0D EA 8A D6 47 6D 33 A8 8D D3 EA BF 59 61 7C"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:1856 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B D1 F4 6C BA 56 71 94 D8 9A 86 F2 5F F2 98 A9"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:252 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FF 20 95 34 A1 15 F0 F9 A7 A6 12 5D 46 1D B7 61"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
"FakeMessage" = "OK"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer"
The process Server.exe:1968 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CA BD 7C D1 8A 20 32 8C 28 F9 31 60 AD 83 24 D1"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
The process Server.exe:1960 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B 8A 1F F4 77 7B 0A E3 66 7E 53 EA 52 5E 22 69"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer"
The process Server.exe:1944 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 60 F3 95 4F 68 28 12 28 7A 46 3C A5 EA 6F A8"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:956 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 DB 41 C8 5D 3C 3E 03 E4 F8 20 36 92 84 F8 8F"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
The process Server.exe:1112 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F 7B 78 C7 C7 1A BE 62 90 BC 21 B8 6B D7 A2 D6"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
The process Server.exe:464 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 24 76 90 86 D7 97 2B B4 F0 57 5B 0A 1A 62 1F"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
The process Server.exe:420 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA 93 8F CE E4 5F A9 DE 6D 2C 79 9C 37 FA 34 91"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:1016 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 98 DB 64 15 44 E8 4F E6 58 EB 06 B7 C4 29 EB"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:1124 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 F7 57 98 75 9D 5F 83 07 0E 99 BF D0 FE A3 73"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:1136 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 A0 EF 62 7F 24 91 CC 81 0E F1 1B 32 57 B7 48"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
The process Server.exe:1932 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 89 43 C4 2C 9D E9 63 55 BA 35 20 A4 7D 40 1D"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:1956 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "58 33 7A C3 9E 73 5A 01 28 89 6D F4 E2 A5 5F 7F"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:1792 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 58 1A DC D1 13 5E 17 A8 53 B9 3C 36 EC 1A 4F"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
The process Server.exe:1756 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE 2B AE 12 87 A4 6F 17 1C 65 E7 3E 42 D2 2E 50"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:1088 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC 78 AD A1 DF 0A 12 9F 7F 8B E6 58 EB 01 A1 18"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
The process Server.exe:1700 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 30 6C F6 1A 85 FE 90 CA 24 6B C0 B1 C8 78 8E"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
The process Server.exe:1600 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 30 4D 8A C3 5C 05 10 DE 0B B8 B7 5F DC 8B 3E"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:1820 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 33 4B 4C AC CD D2 5E 0E 32 3A 63 7E 43 0E 03"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
The process Server.exe:1680 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 85 70 0B 6A 0D 7F C4 E2 1F BC 2A D4 3E 5C D9"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:2000 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "26 AD DF 06 AB 14 44 67 63 3C 77 6D EB 4B EF 2F"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:1748 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 4B 9E E5 27 37 5C FF 99 44 5F B7 25 97 D0 5E"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:1360 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 32 7A FB F5 F5 AE F1 2D 43 9E B0 AF 04 26 23"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:1976 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 89 2F DF 02 4F C8 9D 7E 6C 55 EC 84 57 4E 98"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Server.exe:2008 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B 62 16 EF 28 4B B7 E9 F9 80 60 ED 87 18 04 0F"
[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
The process Server.exe:800 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 D6 BF ED 21 C5 21 F8 1D F3 95 1F E5 89 D1 5E"
The process Server.exe:376 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 AD 4B 0F FD 96 CB AD BE 55 DB 17 B2 6E 78 FF"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1480
%original file name%.exe:276
attrib.exe:440
Server.exe:216
Server.exe:596
Server.exe:1168
Server.exe:316
Server.exe:1648
Server.exe:1924
Server.exe:1856
Server.exe:1968
Server.exe:1944
Server.exe:956
Server.exe:1112
Server.exe:464
Server.exe:420
Server.exe:1016
Server.exe:1124
Server.exe:1136
Server.exe:1932
Server.exe:1956
Server.exe:1792
Server.exe:1756
Server.exe:1088
Server.exe:1700
Server.exe:1600
Server.exe:1820
Server.exe:1680
Server.exe:2000
Server.exe:1748
Server.exe:1360
Server.exe:1976
Server.exe:2008
Server.exe:800
Server.exe:376 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Win\MSstart.exe (2105 bytes)
%System%\SpyNet\Server.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelfDelete.bat (330 bytes)
%System%\SpyNet\logs_VCAQ58cSQ5cAQ\logs_29-10-2015.txt (290 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Server" = "%System%\SpyNet\Server.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Server" = "%System%\SpyNet\Server.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Server" = "%System%\SpyNet\Server.exe" - Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe %System%\SpyNet\Server.exe"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe %System%\SpyNet\Server.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version: 0.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename: z1aca5jg.exe
Internal Name: z1aca5jg.exe
File Version: 0.0.0.0
File Description:
Comments:
Language: English (United States)
Company Name: Product Name: Product Version: 0.0.0.0Legal Copyright: Legal Trademarks: Original Filename: z1aca5jg.exeInternal Name: z1aca5jg.exeFile Version: 0.0.0.0File Description: Comments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 8192 | 329236 | 331776 | 5.45972 | b6bd5bba80ceb0f7fd5ef28ee710b4ff |
.sdata | 344064 | 100 | 4096 | 0.171663 | 186fe66d870ed38924da9721944f77f6 |
.rsrc | 352256 | 10488 | 12288 | 3.33552 | 03344fce9d3957f3c396d0dbc9a4baab |
.reloc | 368640 | 12 | 4096 | 0.011373 | 3ba79dfa564565ae5a26c6b0dacb8599 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://www.google.com/ | 173.194.113.210 |
www.google.com.ua |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET / HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=NG4yVqHaEYrBsAH7rJjIBQ
Content-Length: 262
Date: Thu, 29 Oct 2015 19:06:28 GMT
Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=NG4yVqHaEYrBsAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=NG4yVqHaEYrBsAH7rJjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:06:28 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=NG4yVqHaEYrBsAH7rJjIBQ">here</A>...</BODY></HTML>......
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=N24yVqDMKorBsAH7rJjIBQ
Content-Length: 262
Date: Thu, 29 Oct 2015 19:06:31 GMT
Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=N24yVqDMKorBsAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=N24yVqDMKorBsAH7rJjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:06:31 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=N24yVqDMKorBsAH7rJjIBQ">here</A>...</BODY></HTML>......
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Q24yVvHlGorBsAH7rJjIBQ
Content-Length: 262
Date: Thu, 29 Oct 2015 19:06:43 GMT
Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Q24yVvHlGorBsAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Q24yVvHlGorBsAH7rJjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:06:43 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Q24yVvHlGorBsAH7rJjIBQ">here</A>...</BODY></HTML>......
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=S24yVrncJYvCsAHQ1LGwDw
Content-Length: 262
Date: Thu, 29 Oct 2015 19:06:51 GMT
Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=S24yVrncJYvCsAHQ1LGwDw">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=S24yVrncJYvCsAHQ1LGwDw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:06:51 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=S24yVrncJYvCsAHQ1LGwDw">here</A>...</BODY></HTML>......
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Tm4yVuGbMIHDsAHqvauoAw
Content-Length: 262
Date: Thu, 29 Oct 2015 19:06:54 GMT
Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Tm4yVuGbMIHDsAHqvauoAw">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Tm4yVuGbMIHDsAHqvauoAw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:06:54 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Tm4yVuGbMIHDsAHqvauoAw">here</A>...</BODY></HTML>......
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Um4yVvQMisGwAfusmMgF
Content-Length: 260
Date: Thu, 29 Oct 2015 19:06:58 GMT
Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Um4yVvQMisGwAfusmMgF">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Um4yVvQMisGwAfusmMgF..Content-Length: 260..Date: Thu, 29 Oct 2015 19:06:58 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Um4yVvQMisGwAfusmMgF">here</A>...</BODY></HTML>..nt>....
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=VW4yVp_vB4rBsAH7rJjIBQ
Content-Length: 262
Date: Thu, 29 Oct 2015 19:07:01 GMT
Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=VW4yVp_vB4rBsAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=VW4yVp_vB4rBsAH7rJjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:01 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=VW4yVp_vB4rBsAH7rJjIBQ">here</A>...</BODY></HTML>......
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=WG4yVt-aEcKDsAGtj5eYAw
Content-Length: 262
Date: Thu, 29 Oct 2015 19:07:04 GMT
Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=WG4yVt-aEcKDsAGtj5eYAw">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=WG4yVt-aEcKDsAGtj5eYAw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:04 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=WG4yVt-aEcKDsAGtj5eYAw">here</A>...</BODY></HTML>......
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=W24yVu_9GovCsAHQ1LGwDw
Content-Length: 262
Date: Thu, 29 Oct 2015 19:07:07 GMT
Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=W24yVu_9GovCsAHQ1LGwDw">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=W24yVu_9GovCsAHQ1LGwDw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:07 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=W24yVu_9GovCsAHQ1LGwDw">here</A>...</BODY></HTML>......
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Xm4yVvatIoHDsAHqvauoAw
Content-Length: 262
Date: Thu, 29 Oct 2015 19:07:10 GMT
Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Xm4yVvatIoHDsAHqvauoAw">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Xm4yVvatIoHDsAHqvauoAw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:10 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Xm4yVvatIoHDsAHqvauoAw">here</A>...</BODY></HTML>......
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=YW4yVsDTKIrBsAH7rJjIBQ
Content-Length: 262
Date: Thu, 29 Oct 2015 19:07:13 GMT
Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=YW4yVsDTKIrBsAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=YW4yVsDTKIrBsAH7rJjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:13 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=YW4yVsDTKIrBsAH7rJjIBQ">here</A>...</BODY></HTML>......
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=ZG4yVoTiL4rBsAH7rJjIBQ
Content-Length: 262
Date: Thu, 29 Oct 2015 19:07:16 GMT
Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=ZG4yVoTiL4rBsAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=ZG4yVoTiL4rBsAH7rJjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:16 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=ZG4yVoTiL4rBsAH7rJjIBQ">here</A>...</BODY></HTML>......
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Z24yVueqN4rBsAH7rJjIBQ
Content-Length: 262
Date: Thu, 29 Oct 2015 19:07:19 GMT
Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Z24yVueqN4rBsAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Z24yVueqN4rBsAH7rJjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:19 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Z24yVueqN4rBsAH7rJjIBQ">here</A>...</BODY></HTML>......
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=a24yVqsHi8KwAdDUsbAP
Content-Length: 260
Date: Thu, 29 Oct 2015 19:07:22 GMT
Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=a24yVqsHi8KwAdDUsbAP">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=a24yVqsHi8KwAdDUsbAP..Content-Length: 260..Date: Thu, 29 Oct 2015 19:07:22 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=a24yVqsHi8KwAdDUsbAP">here</A>...</BODY></HTML>..nt>....
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVq3yGIvCsAHQ1LGwDw
Content-Length: 262
Date: Thu, 29 Oct 2015 19:07:26 GMT
Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVq3yGIvCsAHQ1LGwDw">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVq3yGIvCsAHQ1LGwDw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:26 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVq3yGIvCsAHQ1LGwDw">here</A>...</BODY></HTML>......
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVpiaKorBsAH7rJjIBQ
Content-Length: 262
Date: Thu, 29 Oct 2015 19:07:26 GMT
Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVpiaKorBsAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVpiaKorBsAH7rJjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:26 GMT..Server: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
iexplore.exe_860:
%?9-*09,*19}*09
%?9-*09,*19}*09
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
SHDOCVW.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
IE-X-X
rsabase.dll
rsabase.dll
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
dw15 -x -s %u
watson.microsoft.com
watson.microsoft.com
IEWatsonURL
IEWatsonURL
%s -h %u
%s -h %u
iedw.exe
iedw.exe
Iexplore.XPExceptionFilter
Iexplore.XPExceptionFilter
jscript.DLL
jscript.DLL
mshtml.dll
mshtml.dll
mlang.dll
mlang.dll
urlmon.dll
urlmon.dll
wininet.dll
wininet.dll
shdocvw.DLL
shdocvw.DLL
browseui.DLL
browseui.DLL
comctl32.DLL
comctl32.DLL
IEXPLORE.EXE
IEXPLORE.EXE
iexplore.pdb
iexplore.pdb
ADVAPI32.dll
ADVAPI32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
IExplorer.EXE
IExplorer.EXE
IIIIIB(II<.fg>
IIIIIB(II<.fg>
7?_____ZZSSH%
7?_____ZZSSH%
)z.UUUUUUUU
)z.UUUUUUUU
,....Qym
,....Qym
````2```
````2```
{.QLQIIIKGKGKGKGKGKG
{.QLQIIIKGKGKGKGKGKG
;33;33;0
;33;33;0
8888880
8888880
8887080
8887080
browseui.dll
browseui.dll
shdocvw.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512
explorer.exe_1632:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
ADVAPI32.dll
ADVAPI32.dll
BROWSEUI.dll
BROWSEUI.dll
GDI32.dll
GDI32.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
msvcrt.dll
msvcrt.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
SHDOCVW.dll
SHDOCVW.dll
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
USER32.dll
USER32.dll
UxTheme.dll
UxTheme.dll
FTSSh
FTSSh
t0SSh
t0SSh
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
SShwk
SShwk
98~%SP
98~%SP
ExplorerStartMsgLoop
ExplorerStartMsgLoop
PSSh;
PSSh;
6SSSSh
6SSSSh
SSSSh
SSSSh
SPSSSShL
SPSSSShL
u%SSh
u%SSh
t.WWWW
t.WWWW
xpsp2res.dll
xpsp2res.dll
xpsp3res.dll
xpsp3res.dll
tbSSh
tbSSh
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel
kernel32.dll
kernel32.dll
GetSystemWindowsDirectoryW
GetSystemWindowsDirectoryW
NetGetJoinInformation
NetGetJoinInformation
WINMM.dll
WINMM.dll
SETUPAPI.dll
SETUPAPI.dll
WINSTA.dll
WINSTA.dll
OLEACC.dll
OLEACC.dll
USERENV.dll
USERENV.dll
ntdll.dll
ntdll.dll
RegEnumKeyExW
RegEnumKeyExW
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegOpenKeyExA
RegOpenKeyExA
RegEnumKeyW
RegEnumKeyW
RegCloseKey
RegCloseKey
RegCreateKeyW
RegCreateKeyW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCreateKeyExW
OffsetViewportOrgEx
OffsetViewportOrgEx
GetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
SetViewportOrgEx
SetProcessShutdownParameters
SetProcessShutdownParameters
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryW
GetWindowsDirectoryW
CreateIoCompletionPort
CreateIoCompletionPort
ShellExecuteExW
ShellExecuteExW
SHRegCloseUSKey
SHRegCloseUSKey
SHRegCreateUSKeyW
SHRegCreateUSKeyW
AssocQueryKeyW
AssocQueryKeyW
SHRegOpenUSKeyW
SHRegOpenUSKeyW
SHDeleteKeyW
SHDeleteKeyW
TileWindows
TileWindows
ExitWindowsEx
ExitWindowsEx
RegisterHotKey
RegisterHotKey
UnregisterHotKey
UnregisterHotKey
EnumChildWindows
EnumChildWindows
GetKeyState
GetKeyState
GetAsyncKeyState
GetAsyncKeyState
CascadeWindows
CascadeWindows
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
EnumWindows
EnumWindows
explorer.pdb
explorer.pdb
name="Microsoft.Windows.Shell.explorer"
name="Microsoft.Windows.Shell.explorer"
version="5.1.0.0"
version="5.1.0.0"
Windows Shell
Windows Shell
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
]]"```^]]\
]]"```^]]\
3333333330
3333333330
3333330
3333330
333333334
333333334
)@. '5 !*
)@. '5 !*
.DEHHF>?/
.DEHHF>?/
2
2
&$%Uooqkezs
&$%Uooqkezs
['$$#%&(4
['$$#%&(4
3333333333333333333
3333333333333333333
33333333333330
33333333333330
7''''))
7''''))
3'')))33.
3'')))33.
222`444(555
222`444(555
%%%{///-
%%%{///-
000000000
000000000
00000000
00000000
`[66...00
`[66...00
0000000
0000000
`]66./.000
`]66./.000
/./././././././.
/./././././././.
66///0000
66///0000
0000000000000
0000000000000
0000000000
0000000000
6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001
6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001
4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000
4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000
:;
:;
) ) ) ) )
) ) ) ) )
|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),,
|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),,
22222222222
22222222222
3333333
3333333
.SB99;;;99twv}ut{oxt~
.SB99;;;99twv}ut{oxt~
.SB;;;:::2:w}{{qddgghg
.SB;;;:::2:w}{{qddgghg
" """ """ """ """ "" #
" """ """ """ """ "" #
""" """ """ "#
""" """ """ "#
.SG>''';;9::p
.SG>''';;9::p
:5:5:5:5:5:5:5:5:5:5#"
:5:5:5:5:5:5:5:5:5:5#"
# # # # # # # # # # # # # # # # # # # # # ##$
# # # # # # # # # # # # # # # # # # # # # ##$
( # # # # # # # # # # # # # # # # # # # # ###
( # # # # # # # # # # # # # # # # # # # # ###
1232123212321232123
1232123212321232123
(&(((&(((&(((&(((&((&&)
(&(((&(((&(((&(((&((&&)
&(((&(((&(((&()
&(((&(((&(((&()
`,''')))
`,''')))
'4,4'4,4'4,4'4,4'4,4)(
'4,4'4,4'4,4'4,4'4,4)(
55///0000
55///0000
5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0
5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0
555555555
555555555
55555555
55555555
5555555
5555555
14441444144414441
14441444144414441
4343434343434343
4343434343434343
5555555555555
5555555555555
5555555555
5555555555
-,-,-,-,-,-,-,-,-,-,-*.
-,-,-,-,-,-,-,-,-,-,-*.
..............................JFJFJFJFJFJFJFJFJFJFJ.-
..............................JFJFJFJFJFJFJFJFJFJFJ.-
{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../
{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../
|ujjjjuhF..BBBBBBBBBBBBT
|ujjjjuhF..BBBBBBBBBBBBT
~j|F.BB*BBB*BBB*Bwop
~j|F.BB*BBB*BBB*Bwop
&!!!&!!!&
&!!!&!!!&
44466666
44466666
44444444416
44444444416
4446666
4446666
66666666
66666666
|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=
|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=
|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=
|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=
DDDDE%CTDD@
DDDDE%CTDD@
A%US$
A%US$
%UUUU
%UUUU
%%UUU
%%UUU
33U
33U
""2222!!
""2222!!
!"!"%UUR""
!"!"%UUR""
!""!"#2"""
!""!"#2"""
"!!"#3"!"
"!!"#3"!"
dnnnnn:n.nfCnmddddd
dnnnnn:n.nfCnmddddd
////;/;;88
////;/;;88
;888;;!/
;888;;!/
!//!!;;^
!//!!;;^
:;:!::!!!
:;:!::!!!
.88.88.8
.88.88.8
.N.NN.M
.N.NN.M
::8.8...
::8.8...
:::!;;:!
:::!;;:!
//!!;888
//!!;888
.8.8.88...
.8.8.88...
:;!::!!;!//!;
:;!::!!;!//!;
!!;:!!::
!!;:!!::
.88..8..
.88..8..
!!:::/^!
!!:::/^!
!;/;!;;;!!!:
!;/;!;;;!!!:
.8:!!!!^
.8:!!!!^
!!:;:::..
!!:;:::..
/:!^^!;{8{../
/:!^^!;{8{../
...:::.-
...:::.-
**6***66*6**6566*5666 ,
**6***66*6**6566*5666 ,
6*6666*6*6 655*65
6*6666*6*6 655*65
6*65 56*5 55 555 *5 6
6*65 56*5 55 555 *5 6
555( 55 (5 5(
555( 55 (5 5(
76 5 66 555*677
76 5 66 555*677
6*6 5 5(5 (55( '5((5 (556 ('5
6*6 5 5(5 (55( '5((5 (556 ('5
665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU
665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU
555(555(5((5(5(5(
555(555(5((5(5(5(
5 5 5 5555 (555(555'(((5(5('55(((
5 5 5 5555 (555(555'(((5(5('55(((
((''('5'5(5('('('('('((''('(((@(((('&(((&
((''('5'5(5('('('('('((''('(((@(((('&(((&
%&&%&&&&3>&3&3&33&3&3333&&3>3333
%&&%&&&&3>&3&3&33&3&3333&&3>3333
'(3&'&3&
'(3&'&3&
3&33&&((
3&33&&((
3323>33>%>3%>3>33>3%3&%
3323>33>%>3%>3>33>3%3&%
*5'(('((&@3(
*5'(('((&@3(
,63%3>323>3%>&>33323>>%>
,63%3>323>3%>&>33323>>%>
3(3'(((@@'5('@(@(&('(
3(3'(((@@'5('@(@(&('(
>2>323%>3
>2>323%>3
75((((@3&333&3&&&%&3&&3&33>33%3>23%>3
75((((@3&333&3&&&%&3&&3&33>33%3>23%>3
>2%$32%>2>%>2$3>
>2%$32%>2>%>2$3>
3&%&&3&33>3>33
3&%&&3&33>3>33
3>%>3%&3$23>23$2>2%$>2>
3>%>3%&3$23>23$2>2%$>2>
)4433((&(&('*
)4433((&(&('*
('((((''(**6(('' *
('((((''(**6(('' *
32323>3>
32323>3>
2$%>22%>%3' (
2$%>22%>%3' (
&(&''((5(5 *
&(&''((5(5 *
'(&(&((&('''
'(&(&((&('''
&&%&3&&%3%
&&%&3&&%3%
2%>22>22
2%>22>22
5''3(((3(('&(&'&
5''3(((3(('&(&'&
3%%3%3%2#$
3%%3%3%2#$
22$22$2%$22$2%2%$2%$2$222%$22
22$22$2%$22$2%2%$2%$2$222%$22
&>2$2$2$222$22$%%
&>2$2$2$222$22$%%
:7'((('(3('(3(&(&
:7'((('(3('(3(&(&
222222222222
222222222222
22222222222222
22222222222222
222222222222222
222222222222222
22$22$22$22$
22$22$22$22$
&(%3%&&&&3&&&3%3
&(%3%&&&&3&&&3%3
222222222222222222
222222222222222222
&&(&3(&(&'('((3'(&&
&&(&3(&(&'('((3'(&&
2222222
2222222
22$
22$
&&(3(3('(&'
&&(3(3('(&'
222"2212
222"2212
22
22
(&(3(3((
(&(3(3((
((565 ((( 6
((565 ((( 6
333&33(&&
333&33(&&
'(('('(('(
'(('('(('(
'&%%"$
'&%%"$
2"2"22"2
2"2"22"2
2222
2222
"2"22
"2"22
2%('(3'32222?&'
2%('(3'32222?&'
2"2"2"121212
2"2"2"121212
2"2"2$"?
2"2"2$"?
%%22%2
%%22%2
&3(3(3((&
&3(3(3((&
"2"
"2"
1"?((&21
1"?((&21
22
22
2%""22&&
2%""22&&
2
2
'&('(3(''
'&('(3(''
((%%%"
((%%%"
5(3%"%
5(3%"%
"2%5*67
"2%5*67
))) ))))
))) ))))
""**
""**
"*
"*
#2#---2222-222442-
#2#---2222-222442-
---(-%
---(-%
$/222(--444222!
$/222(--444222!
#&-221269924999;
#&-221269924999;
&$-22-($2%
&$-22-($2%
#(2---222622212-
#(2---222622212-
#2221299629968
#2221299629968
#&--%#(2##!
#&--%#(2##!
-222422422426662-%
-222422422426662-%
"2-##&
"2-##&
!##-#-&%---#---#&-219662%
!##-#-&%---#---#&-219662%
$&-(151,44.9
$&-(151,44.9
&1242662-
&1242662-
-(..19.19
-(..19.19
,4492.12
,4492.12
12-$-,-,
12-$-,-,
-, $$----
-, $$----
#%#-15/-&
#%#-15/-&
-,(,,(,(,
-,(,,(,(,
$$11651566/,$&&
$$11651566/,$&&
,2592&&&-
,2592&&&-
2466/!$$
2466/!$$
""*
""*
) '????[
) '????[
&&&$-556>>61,,5994511-
&&&$-556>>61,,5994511-
$(//$$$(6>6/,$,-$
$(//$$$(6>6/,$,-$
#$-22692/,,$,-&
#$-22692/,,$,-&
-266661..4514#
-266661..4514#
&,2-&#
&,2-&#
&-222,22--#
&-222,22--#
#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88
#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88
&!#&!-##
&!#&!-##
--//11468>885882&
--//11468>885882&
$266961$&--$&%
$266961$&--$&%
,1661,!-((#
,1661,!-((#
&$,4255$,92
&$,4255$,92
&$,44..&
&$,44..&
""**""***""
""**""***""
"****
"****
"**""""*""""
"**""""*""""
&-569./-,16522$
&-569./-,16522$
.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\
.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\
bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(
bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(
.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87
.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87
yzyzyzym^Z]WN3 $&$.Wt\
yzyzyzym^Z]WN3 $&$.Wt\
""*"""****""""
""*"""****""""
"***"**""**
"***"**""**
$5612,.2,
$5612,.2,
&$$,,,5]
&$$,,,5]
$]t.Ft
$]t.Ft
7%8U8
7%8U8
3 303
3 303
2
8 8$8(8,80848885%5,575{67 7$7(7,70747rundll32.exeSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AdvancedSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPageSoftware\Microsoft\Windows\CurrentVersion\Explorer\Advanced::{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}::{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}::{D20EA4E1-3957-11d2-A40B-0C5020524153}::{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}{208D2C60-3AEA-1069-A2D7-08002B30309D}{20D04FE0-3AEA-1069-A2D8-08002B30309D}Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites{450D8FBA-AD25-11D0-98A8-0800361B1103}CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}Software\Microsoft\Windows\CurrentVersion\RunOnceSoftware\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoadSoftware\Microsoft\Windows\CurrentVersion\Explorer\DontShowMeThisDialogAgainSoftware\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz\\.\WMIDataDeviceSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\Explorer\RunSoftware\Microsoft\Windows NT\CurrentVersion\WindowsExplorerIsShellMutexdesk.cplSoftware\Microsoft\Windows\CurrentVersion\Explorertourstart.exetourstart.exe,0Microsoft.OfferTourWINWORD.EXESoftware\Microsoft\Windows\CurrentVersion\AppletsSoftware\Microsoft\Windows\CurrentVersion\Applets\Tourexplorer.exe,9Microsoft.FixScreenResolutionshell:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociationSoftware\Microsoft\Windows NT\CurrentVersionshell:::{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}Software\Microsoft\Windows\CurrentVersion\Explorer\StartPageSoftware\Microsoft\Windows\CurrentVersion\Policies\ExplorerDDEEXECUTESHORTCIRCUIThttp\shellIEXPLORE.EXESoftware\Microsoft\Windows\CurrentVersion\Explorer\Streams\DesktopSoftware\Microsoft\Windows\CurrentVersion\RunOnceExcomctl32.dllSoftware\Microsoft\Windows\Internet SettingsAutoConfigURLsystem.iniAppEvents\Schemes\Apps\.Default\%s\.currentSoftware\Microsoft\Windows\CurrentVersion\Explorer\TrayNotifyMSShellRunDlgReadyres://mys.dll/mys.hta /explorermshta.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\WelcomeSoftware\Microsoft\Windows\CurrentVersion\Explorer\TipsSOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\MYScys.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\srvWizinstall.exeSOFTWARE\Microsoft\Windows\CurrentVersion\Control PanelOUTLOOK.EXEexplorer.exe,16iernonce.dllWININET.DLLUpdateURLWindowsUpdateHWND%xSoftware\Microsoft\Windows\CurrentVersion\OemStartMenuDatafldrclnr.dll,Wizard_RunDLLiexplore.exewinbrand.dllSoftware\Microsoft\Windows\CurrentVersion\Explorer\Remote\%dshell32.dllnusrmgr.cpl ,initialTask=ChangePictureNewExeNameWindowsediskeer.dlltimedate.cplSoftware\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedMRUSoftware\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSaveMRUSoftware\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRUSoftware\Microsoft\Windows\CurrentVersion\Explorer\RunMRUSoftware\Microsoft\Internet Explorer\TypedURLs%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Calculator.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Games\Solitaire.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Paint.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\WordPad.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Windows Movie Maker.lnk%USERPROFILE%\Start Menu\Programs\Accessories\Tour Windows XP.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Windows Messenger.lnk%USERPROFILE%\Start Menu\Programs\Windows Media Player.lnk%ALLUSERSPROFILE%\Start Menu\Programs\MSN.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Get Online with MSN.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Get Going with Tablet PC.lnk%ALLUSERSPROFILE%\Start Menu\Set Program Access and Defaults.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Windows Journal.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Media Center\Media Center.lnk%USERPROFILE%\Start Menu\Programs\Internet Explorer.lnkSoftware\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanelTSAppCMP.DLLnetapi32.dll%SystemRoot%\system32\restore\rstrui.exeRunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%sRunDLL32.EXE%s%d%sSoftware\Microsoft\Windows\CurrentVersion\Policies\Systemsettings.dllexplorer.exe "explorer.exe /e, "WindowsLogonWindowsLogoff%s %sSoftware\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\CountuAppWiz.Cpl\explorer.exeSoftware\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu::{20D04FE0-3AEA-1069-A2D8-08002B30309D}taskmgr.exeShellExecuteSoftware\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d\WindowsShell.ManifestGet Online with MSN.lnkSet Program Access and Defaults.lnkLink%dOEM%dSoftware\Microsoft\Windows\CurrentVersion\SMDEn::{D20EA4E1-3957-11d2-A40B-0C5020524152}There is a file or folder on your computer called "%s" which could cause certain applications to not function correctly. Renaming it to "%s" would solve this problem. Would you like to rename it now?Ca&scade WindowsTile Windows &HorizontallyTile Windows V&ertically&Windows Security...&Help and Support&Log Off %s...Windows Explorer6.00.2900.5512 (xpsp.080413-2105)EXPLORER.EXEWindowsOperating System6.00.2900.5512Keep the &taskbar on top of other windowsTo remove records of recently accessed documents, programs, and Web sites, click Clear.Windows displays icons for active and urgent notifications, and hides inactive ones. You can change this behavior for items in the list below.Select this option to use the menu style from earlier versions of Windows.6There is not enough memory to complete this operation.8Unable to run command.The folder '%1' has been removed.WMy Computer or Windows Explorer has not been properly initialized yet. Try again later.&Undo %sWindows is running in safe mode.This special diagnostic mode of Windows enables you to fix a problem which may be caused by your network or hardware settings. Make sure these settings are correct in Control Panel, and then try starting Windows again. While in safe mode, some of your devices may not be available.startRThere was an internal error and one of the windows you were using has been closed.Restrictions{This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.&Show Open WindowsWindows was unable to change the display settings for the new configuration. Return the computer to the previous state, shut down Windows, and restart the computer in the desired configuration.There may be a problem with your display settings if you continue. To safely change to a new configuration, you should shut down Windows and restart the computer in the desired configuration. Do you want to continue anyway?This pre-release version of "Internet Explorer 4.0" Desktop/Explorer has expired. Please update to the latest release of "Internet Explorer 4.0" from WWW.MICROSOFT.COMhelpctr.exe>-FromStartHelpTake a tour of Windows XPNOpens a window where you can pick search options and work with search results.aOpens a central location for Help topics, tutorials, troubleshooting, and other support services./Opens a program, folder, document, or Web site.Provides options for closing your programs and logging off, or for leaving your programs running and switching to another user.lProvides options for turning off or restarting your computer, or for activating Stand By or Hibernate modes.RDisconnects your session. You can reconnect to the session when you log on again.&Windows SecurityiOpens the My Documents folder, where you can store letters, reports, notes, and other kinds of documents./Displays recently opened documents and folders.KOpens the My Music folder, where you can store music and other audio files.]Opens the My Pictures folder, where you can store digital photos, images, and graphics files.zGives access to, and information about, the disk drives, cameras, scanners, and other hardware connected to your computer.MGives access to, and information about, folders and files on other computers.8Connects to other computers, networks, and the Internet.explorer.exe_1632_rwx_00C80000_000F0000:`.rsrckernel32.dll$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)oleaut32.dllEVariantBadIndexErrorEInvalidOperationu%CNu%s[%d]EIdCanNotBindPortInRangeEIdInvalidPortRange(,C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pasC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pasWS2_32.DLLMSWSOCK.DLLgetservbyportWSAAsyncGetServByPortWSAJoinLeafWSARecvMsgWSASendMsgWship6.dllFwpuclnt.dllTIdSocketListWindowsTIdStackWindowsUKernel32.dllEIdIPVersionUnsupportedT127.0.0.1C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pasEIdPortRequiredpEIdTCPConnectionErrorEIdObjectTypeNotSupportedftpTransferftpReadyftpAbortedPortTC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pasClientPortMinClientPortMaxPort"EIdTransparentProxyUDPNotSupportedTIdTCPConnectionIdTCPConnectionC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pasTIdTCPClientCustomTIdTCPClientCustomDhIdTCPClientTIdTCPClientBoundPortT%EIdSocksUDPNotSupportedBySOCKSVersionsaUsernamePasswordPassword0.0.0.10.0.0.0BoundPortDefaultPortole32.dllsqlite3_bind_blobsqlite3_bind_textsqlite3_bind_doublesqlite3_bind_intsqlite3_bind_int64sqlite3_bind_nullsqlite3_bind_parameter_indexsqlite3_opensqlite3_closesqlite3_errmsgsqlite3_errcodesqlite3_freesqlite3_prepare_v2sqlite3_column_countsqlite3_column_namesqlite3_column_decltypesqlite3_stepsqlite3_column_blobsqlite3_column_bytessqlite3_column_doublesqlite3_column_textsqlite3_column_typesqlite3_column_int64sqlite3_finalizesqlite3_resetSQL error or missing databaseAn internal logic error in SQLiteOperation terminated by sqlite3_interrupt()Uses OS features not supported on host2nd parameter to sqlite3_bind out of rangesqlite3_step() has another row readysqlite3_step() has finished executingUnknown SQLite Error Code "ESQLiteExceptionTSQLiteDatabaseTSQLiteTableFailed to open database "%s" : %sFailed to open database "%s" : unknown errorError [%d]: %s."%s": %sError executing SQLCould not prepare SQL statementError executing SQL statementSQLite is BusySOFTWARE\Mozilla\Mozilla FirefoxSOFTWARE\Wow6432Node\Mozilla\Mozilla FirefoxSOFTWARE\Mozilla\Mozilla Firefox\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\1234567890.mozsqlite3.dllsqlite3.dllMSVCR100.dllmozglue.dllmozcrt19.dllmozutils.dllnspr4.dllplc4.dllplds4.dllnssutil3.dllnss3.dllPK11_GetInternalKeySlot\Mozilla\Firefox\profiles.ini\Mozilla\Firefox\signons.sqliteSELECT * FROM moz_loginsencryptedPasswordSOFTWARE\Microsoft\Windows\CurrentVersionMicrosoft\Network\Connections\pbk\rasphone.pbkrasapi32.dllrnaph.dllRAS Passwordsadvapi32.dllcrypt32.dlluURLHistoryabe2869f-9b47-4cd9-a358-c22904dba7f7UnitPasswordsWindowsLive:name=*\Mozilla Firefox\softokn3.dlluserenv.dllprofiles.ini\signons3.txt\signons2.txt\signons1.txt\signons.txt\\.\pipe\wzcsvc_wep_keyswinlogon.exeSafariPasswordRecoveryAVURLProtocol_Classic\Apple Computer\Preferences\keychain.plist\Apple\Apple Application Support\CFNetwork.dllhXXp://PTF://*PTF://hXXps://gdiplus.dllGdiplusShutdownEInvalidGraphicOperationWbemScripting.SWbemLocator%s\%sSELECT * FROM %spathToSignedProductExepathToSignedReportingExeWbemScripting.SWbemDateTimeHExecQueryTargetOperatingSystemNumberOfMediaSupportedPowerManagementSupportedSCSIPortSelect * from Win32_KeyboardNumberOfFunctionKeysMaxMemorySupportedMonochromeProtocolSupportedAdminPasswordStatusBootROMSupportedInfraredSupportedKeyboardPasswordStatusPowerOnPasswordStatusSupportContactDescriptionSelect * from Win32_OperatingSystemWindowsDirectorySelect Caption,BuildNumber,CSDVersion from Win32_OperatingSystemTKeyloggerTIdTCPClientNewPlease, send a email to SpyNetCoder ---> spynetcoder@gmail.comTWebcamISO_646.irv:1991ISO_646.basic:1983ISO_646.irv:1983csISO16PortuguesecsISO84Portuguese2windows-936csShiftJISwindows-874ISO-8859-1-Windows-3.0-Latin-1csWindows30Latin1ISO-8859-1-Windows-3.1-Latin-1csWindows31Latin1ISO-8859-2-Windows-Latin-2csWindows31Latin2ISO-8859-9-Windows-Latin-5csWindows31Latin5csMicrosoftPublishingWindows-31JcsWindows31JPTCP154csPTCP154windows-1250windows-1251windows-1252windows-1253windows-1254windows-1255windows-1256windows-1257windows-1258HTTP-EQUIV()@,;:\"./()@,;:\"/[]?=()@,;:\"/[]?={}C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pasC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pasC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pasIdCustomTCPServerTIdCustomTCPServerTIdCustomTCPServerXDefaultPorttEIdTCPServerErrorC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pasEIdTCPNoOnExecuteTIdTCPServerIdTCPServerOnExecuteC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas%s UserCmdDelimiterC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas'TIdCmdTCPServerAfterCommandHandlerEventTIdCmdTCPServer(TIdCmdTCPServerBeforeCommandHandlerEventIdCmdTCPServerDisplays commands that the servers supports.TIdTCPStreamIdRead() method of TIdTCPStream class does not support seekingTIdHTTPProxyTransferModeTIdHTTPProxyServerContextTIdHTTPProxyServerContextlSTOnHTTPContextEventTOnHTTPDocumentTIdHTTPProxyServerOnHTTPBeforeCommandOnHTTPResponse8TOnHTTPDocumentHTTP/1.0HTTP/1.0 200 Connection establishedHNetCfg.NATUPnPStaticPortMappingCollectionPSAPI.dllshlwapi.dllTSendKeySOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SetupApi.dllSetupDiOpenClassRegKeySetupDiOpenClassRegKeyExASetupDiOpenClassRegKeyExWSetupDiCreateDeviceInterfaceRegKeyASetupDiCreateDeviceInterfaceRegKeyWSetupDiOpenDeviceInterfaceRegKeySetupDiDeleteDeviceInterfaceRegKeySetupDiCreateDevRegKeyASetupDiCreateDevRegKeyWSetupDiOpenDevRegKeySetupDiDeleteDevRegKeyCM_DEVCAP_LOCKSUPPORTEDCM_DEVCAP_EJECTSUPPORTEDPDCAP_D0_SUPPORTEDPDCAP_D1_SUPPORTEDPDCAP_D2_SUPPORTEDPDCAP_D3_SUPPORTEDPDCAP_WAKE_FROM_D0_SUPPORTEDPDCAP_WAKE_FROM_D1_SUPPORTEDPDCAP_WAKE_FROM_D2_SUPPORTEDPDCAP_WAKE_FROM_D3_SUPPORTEDPDCAP_WARM_EJECT_SUPPORTEDiphlpapi.dllAllocateAndGetTcpExTableFromStackAllocateAndGetUdpExTableFromStackAllocateAndGetTcpTableFromStackAllocateAndGetUdpTableFromStackSetTcpEntryGetExtendedTcpTableGetExtendedUdpTableTWebcamThreadShell.ApplicationSHFileOperationW\Opera\Opera\wand.dat\Google\Chrome\User Data\Default\Web Data\Google\Chrome\User Data\Default\Login DataTNewFTPThreadUCDO.MessageCDO.ConfigurationhXXp://schemas.microsoft.com/cdo/configuration/smtpusesslhXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticatehXXp://schemas.microsoft.com/cdo/configuration/sendusernamehXXp://schemas.microsoft.com/cdo/configuration/sendpasswordhXXp://schemas.microsoft.com/cdo/configuration/smtpserverhXXp://schemas.microsoft.com/cdo/configuration/sendusinghXXp://schemas.microsoft.com/cdo/configuration/smtpserverportVBoxService.exeSbieDll.dlldbghelp.dllSoftware\Microsoft\Windows\CurrentVersion55274-640-2673064-2395076487-644-3177037-2351076487-337-8429955-22614\\.\SICE\\.\NTICEdrivers\sice.sysdrivers\ntice.sysdrivers\syser.sysdrivers\winice.sysdrivers\sice.vxddrivers\winice.vxdwinice.vxdvmm32\winice.vxdsice.vxdvmm32\sice.vxd\\.\SIWVID\\.\TRW\\.\TWX\\.\ICEEXT1.2.3deflate 1.2.3 Copyright 1995-2005 Jean-loup Gaillyinflate 1.2.3 Copyright 1995-2005 Mark Adler?456789:;!"#$%&'()* ,-./0123com.apple.Safaricom.apple.Safari0123456789ABCDEFKWindows.ScktCompWebcamAPIIdStackWindowsUnitKeyloggerUnitServerPassUnitExecutarComandosUnitSendFTPFilesUnitListarPortasAtivasUsndkey32sUnitWindowsIdTCPStreamIdTCPServer4UnitStartWebcamOperaPasswordsZPasswordRecoveryKuURLHistoryIEpasswordsUnitChromeSQLite3SQLiteTable3UnitFireFox3_5SetNamedPipeHandleStateGetWindowsDirectoryWGetProcessHeapGetCPInfoDisconnectNamedPipeCreatePipeCreateNamedPipeARegOpenKeyExWRegOpenKeyExARegOpenKeyWRegEnumKeyExWRegDeleteKeyWRegCreateKeyExWRegCreateKeyWRegCloseKeyRegEnumKeyExARegQueryInfoKeyACryptImportKeyCryptSetKeyParamCryptDestroyKeyShellExecuteWFindExecutableWSHDeleteKeyWURLDownloadToFileWkeybd_eventVkKeyScanWUnhookWindowsHookExSetWindowsHookExWSetWindowsHookExASetKeyboardStateMsgWaitForMultipleObjectsMapVirtualKeyWMapVirtualKeyAGetKeyboardStateGetKeyboardLayoutGetKeyStateExitWindowsExEnumWindowsGetKeyboardTypeFtpPutFileWFtpSetCurrentDirectoryW.idata.rdataP.relocP.rsrcI.uWPKERNEL32.DLLAVICAP32.DLLgdi32.dllmpr.dllmsacm32.dllntdll.dllpowrprof.dllpstorec.dllshell32.dllURLMON.DLLuser32.dllwininet.dllwinmm.dllwsock32.dllx.htmlSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\RunOnceWin\MSstart.exeSoftware\Microsoft\Windows NT\CurrentVersion\WindowsSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogonexplorer.exe "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Runexplorer.exehXXp://VVV.uol.com.br/hXXp://mail.terra.com.br/hXXps://VVV.google.com/accounts/serviceloginhXXps://my.screenname.aol.com/_cqr/login/login.psphXXp://VVV.lycos.comhXXp://VVV.myspace.comPortugalTurkeyTargetOperatingSystem:NumberOfMediaSupported:PowerManagementSupported:SCSIPort:NumberOfFunctionKeys:Password:MaxMemorySupported:Monochrome:ProtocolSupported:AdminPasswordStatus:BootROMSupported:InfraredSupported:KeyboardPasswordStatus:PowerOnPasswordStatus:SupportContactDescription:WindowsDirectory:[Execute]SpyNetKeyloggerkeyloggerWEBCAMuploadandexecuteuploadandexecuteyes|uploadandexecuteno|*#%"{}|\^[]`:LocalSubNet:Enabled:@xpsperes.dll,-22006SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\ListHKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_CURRENT_CONFIGInvalid Key NameInvalid KeyNamesoftware\microsoft\windows\currentversion\uninstall\webcamstream2|webcam|webcamstream|webcamstop2|webcam|webcamstop|webcamstartwebcamstart2*.jpgkeyloggernewc:\users\rafael\desktop\TESTE\keylogger|mouseloggerbuffer|OPERA|CHROME|keylogger|mouseloggerstart|keylogger|mouseloggerstop|keylogger|keyloggerativar|F|keylogger|keyloggerativar|T|keylogger|keyloggeronlinekey|webcamlist|getpasswords|webcamFirstExecutionSelfDelete.batSOFTWARE\Microsoft\Windows\CurrentVersion\RunSOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceSOFTWARE\Microsoft\Windows NT\CurrentVersion\WindowsSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Runrar.exerarreg.keyfilemanager|fmsendftpyes|filemanager|fmsendftpno|webcamlistdownexecopenwebgetpasswordsgetpasswords|STARTchromepasschromepass|sendkeyswindowHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\listarportaslistarportas|listadeportasativas|listarportasdnslistarportas|finalizarconexao|finalizarprocessoportaslistarportas|finalizarprocessoportas|Y|listarportas|finalizarprocessoportas|N|tecaladoexecutarwebcam2webcamconfigkeylogger|keyloggeronlinestart|keylogger|keyloggeronlinestop|logs_*.txtkeylogger|keylogger|keyloggerativarkeyloggerdesativarkeyloggerbaixarkeylogger|keyloggerbaixar|keylogger|keyloggerbaixar|NOLOGSkeyloggerexcluirkeylogger|keyloggerexcluir|keyloggeronlinestartkeyloggeronlinestopMouseLoggerWindowsfmexecnormalfilemanager|fmexecnormal|fmexechidefilemanager|fmexechide|fmexecparamfilemanager|fmexecparam|F|filemanager|fmexecparam|T|fmsendftpfilemanager|fmsendftp|keysearchLogs_*.txtkeysearch|YESkeysearch|NOkeyboardinfogetcompinfo|getcompinfo|keyboardinfo|ÞFAULTBROWSER%%System%\SpyNet\Server.exe%System%\SpyNet\Unsupported clipboard formatCanvas does not allow drawing Clipboard does not support IconsTransparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.Reply Code is not valid: %sReply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parametersFile "%s" not foundObject type not supported.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.Command not supported.Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.Invalid Port Range (%d - %d)%s is not a valid service.%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.Set Size Exceeded.)UDP is not support in this SOCKS version.Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.Operation already in progress.Socket operation on non-socket.Protocol not supported.Socket type not supported."Operation not supported on socket.Protocol family not supported.0Address family not supported by protocol family.&Error on loading Winsock2 library (%s)Resolving hostname %s.Connecting to %s.Socket Error # %dOperation would block.Operation now in progress.%s.Seek not implemented$Operation not allowed on sorted listProperty %s does not existThread creation error: %sThread Error: %s (%d)Invalid destination array"Character index out of bounds (%d)Start index out of bounds (%d)Invalid count (%d)Invalid destination index (%d)Invalid codepage (%d)-Error on call to Winsock2 library function %sECheckSynchronize called from thread $%x, which is NOT the main threadClass %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicatesCannot create file "%s". %sCannot open file "%s". %s$''%s'' is not a valid component nameInvalid property value List capacity out of bounds (%d)List count out of bounds (%d)List index out of bounds (%d) Out of memory while expanding memory streamError reading %s%s%s: %sAncestor for '%s' not foundCannot assign a %s to a %sInterface not supported%s (%s, line %d)Abstract Error?Access violation at address %p in module '%s'. %s of address %pSystem Error. Code: %d.Invalid variant operationInvalid NULL variant operation%Invalid variant operation (%s%.8x)%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)Operation not supportedExternal exception %xInvalid pointer operationInvalid class typecast0Access violation at address %p. %s of address %pOperation aborted(Exception %s in module %s at %p.Application Error1Format '%s' invalid or incompatible with argumentNo argument for format '%s'"Variant method calls not supported!'%s' is not a valid integer value('%s' is not a valid floating point valueI/O error %dInteger overflow Invalid floating point operationServer.exe_252:`.rsrckernel32.dll$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)oleaut32.dllEVariantBadIndexErrorEInvalidOperationu%CNu%s[%d]EIdCanNotBindPortInRangeEIdInvalidPortRange(,C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pasC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pasWS2_32.DLLMSWSOCK.DLLgetservbyportWSAAsyncGetServByPortWSAJoinLeafWSARecvMsgWSASendMsgWship6.dllFwpuclnt.dllTIdSocketListWindowsTIdStackWindowsUKernel32.dllEIdIPVersionUnsupportedT127.0.0.1C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pasEIdPortRequiredpEIdTCPConnectionErrorEIdObjectTypeNotSupportedftpTransferftpReadyftpAbortedPortTC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pasClientPortMinClientPortMaxPort"EIdTransparentProxyUDPNotSupportedTIdTCPConnectionIdTCPConnectionC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pasTIdTCPClientCustomTIdTCPClientCustomDhIdTCPClientTIdTCPClientBoundPortT%EIdSocksUDPNotSupportedBySOCKSVersionsaUsernamePasswordPassword0.0.0.10.0.0.0BoundPortDefaultPortole32.dllsqlite3_bind_blobsqlite3_bind_textsqlite3_bind_doublesqlite3_bind_intsqlite3_bind_int64sqlite3_bind_nullsqlite3_bind_parameter_indexsqlite3_opensqlite3_closesqlite3_errmsgsqlite3_errcodesqlite3_freesqlite3_prepare_v2sqlite3_column_countsqlite3_column_namesqlite3_column_decltypesqlite3_stepsqlite3_column_blobsqlite3_column_bytessqlite3_column_doublesqlite3_column_textsqlite3_column_typesqlite3_column_int64sqlite3_finalizesqlite3_resetSQL error or missing databaseAn internal logic error in SQLiteOperation terminated by sqlite3_interrupt()Uses OS features not supported on host2nd parameter to sqlite3_bind out of rangesqlite3_step() has another row readysqlite3_step() has finished executingUnknown SQLite Error Code "ESQLiteExceptionTSQLiteDatabaseTSQLiteTableFailed to open database "%s" : %sFailed to open database "%s" : unknown errorError [%d]: %s."%s": %sError executing SQLCould not prepare SQL statementError executing SQL statementSQLite is BusySOFTWARE\Mozilla\Mozilla FirefoxSOFTWARE\Wow6432Node\Mozilla\Mozilla FirefoxSOFTWARE\Mozilla\Mozilla Firefox\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\1234567890.mozsqlite3.dllsqlite3.dllMSVCR100.dllmozglue.dllmozcrt19.dllmozutils.dllnspr4.dllplc4.dllplds4.dllnssutil3.dllnss3.dllPK11_GetInternalKeySlot\Mozilla\Firefox\profiles.ini\Mozilla\Firefox\signons.sqliteSELECT * FROM moz_loginsencryptedPasswordSOFTWARE\Microsoft\Windows\CurrentVersionMicrosoft\Network\Connections\pbk\rasphone.pbkrasapi32.dllrnaph.dllRAS Passwordsadvapi32.dllcrypt32.dlluURLHistoryabe2869f-9b47-4cd9-a358-c22904dba7f7UnitPasswordsWindowsLive:name=*\Mozilla Firefox\softokn3.dlluserenv.dllprofiles.ini\signons3.txt\signons2.txt\signons1.txt\signons.txt\\.\pipe\wzcsvc_wep_keyswinlogon.exeSafariPasswordRecoveryAVURLProtocol_Classic\Apple Computer\Preferences\keychain.plist\Apple\Apple Application Support\CFNetwork.dllhXXp://PTF://*PTF://hXXps://gdiplus.dllGdiplusShutdownEInvalidGraphicOperationWbemScripting.SWbemLocator%s\%sSELECT * FROM %spathToSignedProductExepathToSignedReportingExeWbemScripting.SWbemDateTimeHExecQueryTargetOperatingSystemNumberOfMediaSupportedPowerManagementSupportedSCSIPortSelect * from Win32_KeyboardNumberOfFunctionKeysMaxMemorySupportedMonochromeProtocolSupportedAdminPasswordStatusBootROMSupportedInfraredSupportedKeyboardPasswordStatusPowerOnPasswordStatusSupportContactDescriptionSelect * from Win32_OperatingSystemWindowsDirectorySelect Caption,BuildNumber,CSDVersion from Win32_OperatingSystemTKeyloggerTIdTCPClientNewPlease, send a email to SpyNetCoder ---> spynetcoder@gmail.comTWebcamISO_646.irv:1991ISO_646.basic:1983ISO_646.irv:1983csISO16PortuguesecsISO84Portuguese2windows-936csShiftJISwindows-874ISO-8859-1-Windows-3.0-Latin-1csWindows30Latin1ISO-8859-1-Windows-3.1-Latin-1csWindows31Latin1ISO-8859-2-Windows-Latin-2csWindows31Latin2ISO-8859-9-Windows-Latin-5csWindows31Latin5csMicrosoftPublishingWindows-31JcsWindows31JPTCP154csPTCP154windows-1250windows-1251windows-1252windows-1253windows-1254windows-1255windows-1256windows-1257windows-1258HTTP-EQUIV()@,;:\"./()@,;:\"/[]?=()@,;:\"/[]?={}C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pasC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pasC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pasIdCustomTCPServerTIdCustomTCPServerTIdCustomTCPServerXDefaultPorttEIdTCPServerErrorC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pasEIdTCPNoOnExecuteTIdTCPServerIdTCPServerOnExecuteC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas%s UserCmdDelimiterC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas'TIdCmdTCPServerAfterCommandHandlerEventTIdCmdTCPServer(TIdCmdTCPServerBeforeCommandHandlerEventIdCmdTCPServerDisplays commands that the servers supports.TIdTCPStreamIdRead() method of TIdTCPStream class does not support seekingTIdHTTPProxyTransferModeTIdHTTPProxyServerContextTIdHTTPProxyServerContextlSTOnHTTPContextEventTOnHTTPDocumentTIdHTTPProxyServerOnHTTPBeforeCommandOnHTTPResponse8TOnHTTPDocumentHTTP/1.0HTTP/1.0 200 Connection establishedHNetCfg.NATUPnPStaticPortMappingCollectionPSAPI.dllshlwapi.dllTSendKeySOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SetupApi.dllSetupDiOpenClassRegKeySetupDiOpenClassRegKeyExASetupDiOpenClassRegKeyExWSetupDiCreateDeviceInterfaceRegKeyASetupDiCreateDeviceInterfaceRegKeyWSetupDiOpenDeviceInterfaceRegKeySetupDiDeleteDeviceInterfaceRegKeySetupDiCreateDevRegKeyASetupDiCreateDevRegKeyWSetupDiOpenDevRegKeySetupDiDeleteDevRegKeyCM_DEVCAP_LOCKSUPPORTEDCM_DEVCAP_EJECTSUPPORTEDPDCAP_D0_SUPPORTEDPDCAP_D1_SUPPORTEDPDCAP_D2_SUPPORTEDPDCAP_D3_SUPPORTEDPDCAP_WAKE_FROM_D0_SUPPORTEDPDCAP_WAKE_FROM_D1_SUPPORTEDPDCAP_WAKE_FROM_D2_SUPPORTEDPDCAP_WAKE_FROM_D3_SUPPORTEDPDCAP_WARM_EJECT_SUPPORTEDiphlpapi.dllAllocateAndGetTcpExTableFromStackAllocateAndGetUdpExTableFromStackAllocateAndGetTcpTableFromStackAllocateAndGetUdpTableFromStackSetTcpEntryGetExtendedTcpTableGetExtendedUdpTableTWebcamThreadShell.ApplicationSHFileOperationW\Opera\Opera\wand.dat\Google\Chrome\User Data\Default\Web Data\Google\Chrome\User Data\Default\Login DataTNewFTPThreadUCDO.MessageCDO.ConfigurationhXXp://schemas.microsoft.com/cdo/configuration/smtpusesslhXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticatehXXp://schemas.microsoft.com/cdo/configuration/sendusernamehXXp://schemas.microsoft.com/cdo/configuration/sendpasswordhXXp://schemas.microsoft.com/cdo/configuration/smtpserverhXXp://schemas.microsoft.com/cdo/configuration/sendusinghXXp://schemas.microsoft.com/cdo/configuration/smtpserverportVBoxService.exeSbieDll.dlldbghelp.dllSoftware\Microsoft\Windows\CurrentVersion55274-640-2673064-2395076487-644-3177037-2351076487-337-8429955-22614\\.\SICE\\.\NTICEdrivers\sice.sysdrivers\ntice.sysdrivers\syser.sysdrivers\winice.sysdrivers\sice.vxddrivers\winice.vxdwinice.vxdvmm32\winice.vxdsice.vxdvmm32\sice.vxd\\.\SIWVID\\.\TRW\\.\TWX\\.\ICEEXT1.2.3deflate 1.2.3 Copyright 1995-2005 Jean-loup Gaillyinflate 1.2.3 Copyright 1995-2005 Mark Adler?456789:;!"#$%&'()* ,-./0123com.apple.Safaricom.apple.Safari0123456789ABCDEFKWindows.ScktCompWebcamAPIIdStackWindowsUnitKeyloggerUnitServerPassUnitExecutarComandosUnitSendFTPFilesUnitListarPortasAtivasUsndkey32sUnitWindowsIdTCPStreamIdTCPServer4UnitStartWebcamOperaPasswordsZPasswordRecoveryKuURLHistoryIEpasswordsUnitChromeSQLite3SQLiteTable3UnitFireFox3_5SetNamedPipeHandleStateGetWindowsDirectoryWGetProcessHeapGetCPInfoDisconnectNamedPipeCreatePipeCreateNamedPipeARegOpenKeyExWRegOpenKeyExARegOpenKeyWRegEnumKeyExWRegDeleteKeyWRegCreateKeyExWRegCreateKeyWRegCloseKeyRegEnumKeyExARegQueryInfoKeyACryptImportKeyCryptSetKeyParamCryptDestroyKeyShellExecuteWFindExecutableWSHDeleteKeyWURLDownloadToFileWkeybd_eventVkKeyScanWUnhookWindowsHookExSetWindowsHookExWSetWindowsHookExASetKeyboardStateMsgWaitForMultipleObjectsMapVirtualKeyWMapVirtualKeyAGetKeyboardStateGetKeyboardLayoutGetKeyStateExitWindowsExEnumWindowsGetKeyboardTypeFtpPutFileWFtpSetCurrentDirectoryW.idata.rdataP.relocP.rsrcI.uWPKERNEL32.DLLAVICAP32.DLLgdi32.dllmpr.dllmsacm32.dllntdll.dllpowrprof.dllpstorec.dllshell32.dllURLMON.DLLuser32.dllwininet.dllwinmm.dllwsock32.dllx.htmlSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\RunOnceWin\MSstart.exeSoftware\Microsoft\Windows NT\CurrentVersion\WindowsSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogonexplorer.exe "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Runexplorer.exehXXp://VVV.uol.com.br/hXXp://mail.terra.com.br/hXXps://VVV.google.com/accounts/serviceloginhXXps://my.screenname.aol.com/_cqr/login/login.psphXXp://VVV.lycos.comhXXp://VVV.myspace.comPortugalTurkeyTargetOperatingSystem:NumberOfMediaSupported:PowerManagementSupported:SCSIPort:NumberOfFunctionKeys:Password:MaxMemorySupported:Monochrome:ProtocolSupported:AdminPasswordStatus:BootROMSupported:InfraredSupported:KeyboardPasswordStatus:PowerOnPasswordStatus:SupportContactDescription:WindowsDirectory:[Execute]SpyNetKeyloggerkeyloggerWEBCAMuploadandexecuteuploadandexecuteyes|uploadandexecuteno|*#%"{}|\^[]`:LocalSubNet:Enabled:@xpsperes.dll,-22006SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\ListHKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_CURRENT_CONFIGInvalid Key NameInvalid KeyNamesoftware\microsoft\windows\currentversion\uninstall\webcamstream2|webcam|webcamstream|webcamstop2|webcam|webcamstop|webcamstartwebcamstart2*.jpgkeyloggernewc:\users\rafael\desktop\TESTE\keylogger|mouseloggerbuffer|OPERA|CHROME|keylogger|mouseloggerstart|keylogger|mouseloggerstop|keylogger|keyloggerativar|F|keylogger|keyloggerativar|T|keylogger|keyloggeronlinekey|webcamlist|getpasswords|webcamFirstExecutionSelfDelete.batSOFTWARE\Microsoft\Windows\CurrentVersion\RunSOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceSOFTWARE\Microsoft\Windows NT\CurrentVersion\WindowsSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Runrar.exerarreg.keyfilemanager|fmsendftpyes|filemanager|fmsendftpno|webcamlistdownexecopenwebgetpasswordsgetpasswords|STARTchromepasschromepass|sendkeyswindowHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\listarportaslistarportas|listadeportasativas|listarportasdnslistarportas|finalizarconexao|finalizarprocessoportaslistarportas|finalizarprocessoportas|Y|listarportas|finalizarprocessoportas|N|tecaladoexecutarwebcam2webcamconfigkeylogger|keyloggeronlinestart|keylogger|keyloggeronlinestop|logs_*.txtkeylogger|keylogger|keyloggerativarkeyloggerdesativarkeyloggerbaixarkeylogger|keyloggerbaixar|keylogger|keyloggerbaixar|NOLOGSkeyloggerexcluirkeylogger|keyloggerexcluir|keyloggeronlinestartkeyloggeronlinestopMouseLoggerWindowsfmexecnormalfilemanager|fmexecnormal|fmexechidefilemanager|fmexechide|fmexecparamfilemanager|fmexecparam|F|filemanager|fmexecparam|T|fmsendftpfilemanager|fmsendftp|keysearchLogs_*.txtkeysearch|YESkeysearch|NOkeyboardinfogetcompinfo|getcompinfo|keyboardinfo|ÞFAULTBROWSER%Unsupported clipboard formatCanvas does not allow drawing Clipboard does not support IconsTransparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.Reply Code is not valid: %sReply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parametersFile "%s" not foundObject type not supported.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.Command not supported.Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.Invalid Port Range (%d - %d)%s is not a valid service.%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.Set Size Exceeded.)UDP is not support in this SOCKS version.Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.Operation already in progress.Socket operation on non-socket.Protocol not supported.Socket type not supported."Operation not supported on socket.Protocol family not supported.0Address family not supported by protocol family.&Error on loading Winsock2 library (%s)Resolving hostname %s.Connecting to %s.Socket Error # %dOperation would block.Operation now in progress.%s.Seek not implemented$Operation not allowed on sorted listProperty %s does not existThread creation error: %sThread Error: %s (%d)Invalid destination array"Character index out of bounds (%d)Start index out of bounds (%d)Invalid count (%d)Invalid destination index (%d)Invalid codepage (%d)-Error on call to Winsock2 library function %sECheckSynchronize called from thread $%x, which is NOT the main threadClass %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicatesCannot create file "%s". %sCannot open file "%s". %s$''%s'' is not a valid component nameInvalid property value List capacity out of bounds (%d)List count out of bounds (%d)List index out of bounds (%d) Out of memory while expanding memory streamError reading %s%s%s: %sAncestor for '%s' not foundCannot assign a %s to a %sInterface not supported%s (%s, line %d)Abstract Error?Access violation at address %p in module '%s'. %s of address %pSystem Error. Code: %d.Invalid variant operationInvalid NULL variant operation%Invalid variant operation (%s%.8x)%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)Operation not supportedExternal exception %xInvalid pointer operationInvalid class typecast0Access violation at address %p. %s of address %pOperation aborted(Exception %s in module %s at %p.Application Error1Format '%s' invalid or incompatible with argumentNo argument for format '%s'"Variant method calls not supported!'%s' is not a valid integer value('%s' is not a valid floating point valueI/O error %dInteger overflow Invalid floating point operationServer.exe_252_rwx_00C80000_000F0000:`.rsrckernel32.dll$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)oleaut32.dllEVariantBadIndexErrorEInvalidOperationu%CNu%s[%d]EIdCanNotBindPortInRangeEIdInvalidPortRange(,C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pasC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pasWS2_32.DLLMSWSOCK.DLLgetservbyportWSAAsyncGetServByPortWSAJoinLeafWSARecvMsgWSASendMsgWship6.dllFwpuclnt.dllTIdSocketListWindowsTIdStackWindowsUKernel32.dllEIdIPVersionUnsupportedT127.0.0.1C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pasEIdPortRequiredpEIdTCPConnectionErrorEIdObjectTypeNotSupportedftpTransferftpReadyftpAbortedPortTC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pasClientPortMinClientPortMaxPort"EIdTransparentProxyUDPNotSupportedTIdTCPConnectionIdTCPConnectionC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pasTIdTCPClientCustomTIdTCPClientCustomDhIdTCPClientTIdTCPClientBoundPortT%EIdSocksUDPNotSupportedBySOCKSVersionsaUsernamePasswordPassword0.0.0.10.0.0.0BoundPortDefaultPortole32.dllsqlite3_bind_blobsqlite3_bind_textsqlite3_bind_doublesqlite3_bind_intsqlite3_bind_int64sqlite3_bind_nullsqlite3_bind_parameter_indexsqlite3_opensqlite3_closesqlite3_errmsgsqlite3_errcodesqlite3_freesqlite3_prepare_v2sqlite3_column_countsqlite3_column_namesqlite3_column_decltypesqlite3_stepsqlite3_column_blobsqlite3_column_bytessqlite3_column_doublesqlite3_column_textsqlite3_column_typesqlite3_column_int64sqlite3_finalizesqlite3_resetSQL error or missing databaseAn internal logic error in SQLiteOperation terminated by sqlite3_interrupt()Uses OS features not supported on host2nd parameter to sqlite3_bind out of rangesqlite3_step() has another row readysqlite3_step() has finished executingUnknown SQLite Error Code "ESQLiteExceptionTSQLiteDatabaseTSQLiteTableFailed to open database "%s" : %sFailed to open database "%s" : unknown errorError [%d]: %s."%s": %sError executing SQLCould not prepare SQL statementError executing SQL statementSQLite is BusySOFTWARE\Mozilla\Mozilla FirefoxSOFTWARE\Wow6432Node\Mozilla\Mozilla FirefoxSOFTWARE\Mozilla\Mozilla Firefox\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\1234567890.mozsqlite3.dllsqlite3.dllMSVCR100.dllmozglue.dllmozcrt19.dllmozutils.dllnspr4.dllplc4.dllplds4.dllnssutil3.dllnss3.dllPK11_GetInternalKeySlot\Mozilla\Firefox\profiles.ini\Mozilla\Firefox\signons.sqliteSELECT * FROM moz_loginsencryptedPasswordSOFTWARE\Microsoft\Windows\CurrentVersionMicrosoft\Network\Connections\pbk\rasphone.pbkrasapi32.dllrnaph.dllRAS Passwordsadvapi32.dllcrypt32.dlluURLHistoryabe2869f-9b47-4cd9-a358-c22904dba7f7UnitPasswordsWindowsLive:name=*\Mozilla Firefox\softokn3.dlluserenv.dllprofiles.ini\signons3.txt\signons2.txt\signons1.txt\signons.txt\\.\pipe\wzcsvc_wep_keyswinlogon.exeSafariPasswordRecoveryAVURLProtocol_Classic\Apple Computer\Preferences\keychain.plist\Apple\Apple Application Support\CFNetwork.dllhXXp://PTF://*PTF://hXXps://gdiplus.dllGdiplusShutdownEInvalidGraphicOperationWbemScripting.SWbemLocator%s\%sSELECT * FROM %spathToSignedProductExepathToSignedReportingExeWbemScripting.SWbemDateTimeHExecQueryTargetOperatingSystemNumberOfMediaSupportedPowerManagementSupportedSCSIPortSelect * from Win32_KeyboardNumberOfFunctionKeysMaxMemorySupportedMonochromeProtocolSupportedAdminPasswordStatusBootROMSupportedInfraredSupportedKeyboardPasswordStatusPowerOnPasswordStatusSupportContactDescriptionSelect * from Win32_OperatingSystemWindowsDirectorySelect Caption,BuildNumber,CSDVersion from Win32_OperatingSystemTKeyloggerTIdTCPClientNewPlease, send a email to SpyNetCoder ---> spynetcoder@gmail.comTWebcamISO_646.irv:1991ISO_646.basic:1983ISO_646.irv:1983csISO16PortuguesecsISO84Portuguese2windows-936csShiftJISwindows-874ISO-8859-1-Windows-3.0-Latin-1csWindows30Latin1ISO-8859-1-Windows-3.1-Latin-1csWindows31Latin1ISO-8859-2-Windows-Latin-2csWindows31Latin2ISO-8859-9-Windows-Latin-5csWindows31Latin5csMicrosoftPublishingWindows-31JcsWindows31JPTCP154csPTCP154windows-1250windows-1251windows-1252windows-1253windows-1254windows-1255windows-1256windows-1257windows-1258HTTP-EQUIV()@,;:\"./()@,;:\"/[]?=()@,;:\"/[]?={}C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pasC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pasC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pasIdCustomTCPServerTIdCustomTCPServerTIdCustomTCPServerXDefaultPorttEIdTCPServerErrorC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pasEIdTCPNoOnExecuteTIdTCPServerIdTCPServerOnExecuteC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas%s UserCmdDelimiterC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas'TIdCmdTCPServerAfterCommandHandlerEventTIdCmdTCPServer(TIdCmdTCPServerBeforeCommandHandlerEventIdCmdTCPServerDisplays commands that the servers supports.TIdTCPStreamIdRead() method of TIdTCPStream class does not support seekingTIdHTTPProxyTransferModeTIdHTTPProxyServerContextTIdHTTPProxyServerContextlSTOnHTTPContextEventTOnHTTPDocumentTIdHTTPProxyServerOnHTTPBeforeCommandOnHTTPResponse8TOnHTTPDocumentHTTP/1.0HTTP/1.0 200 Connection establishedHNetCfg.NATUPnPStaticPortMappingCollectionPSAPI.dllshlwapi.dllTSendKeySOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SetupApi.dllSetupDiOpenClassRegKeySetupDiOpenClassRegKeyExASetupDiOpenClassRegKeyExWSetupDiCreateDeviceInterfaceRegKeyASetupDiCreateDeviceInterfaceRegKeyWSetupDiOpenDeviceInterfaceRegKeySetupDiDeleteDeviceInterfaceRegKeySetupDiCreateDevRegKeyASetupDiCreateDevRegKeyWSetupDiOpenDevRegKeySetupDiDeleteDevRegKeyCM_DEVCAP_LOCKSUPPORTEDCM_DEVCAP_EJECTSUPPORTEDPDCAP_D0_SUPPORTEDPDCAP_D1_SUPPORTEDPDCAP_D2_SUPPORTEDPDCAP_D3_SUPPORTEDPDCAP_WAKE_FROM_D0_SUPPORTEDPDCAP_WAKE_FROM_D1_SUPPORTEDPDCAP_WAKE_FROM_D2_SUPPORTEDPDCAP_WAKE_FROM_D3_SUPPORTEDPDCAP_WARM_EJECT_SUPPORTEDiphlpapi.dllAllocateAndGetTcpExTableFromStackAllocateAndGetUdpExTableFromStackAllocateAndGetTcpTableFromStackAllocateAndGetUdpTableFromStackSetTcpEntryGetExtendedTcpTableGetExtendedUdpTableTWebcamThreadShell.ApplicationSHFileOperationW\Opera\Opera\wand.dat\Google\Chrome\User Data\Default\Web Data\Google\Chrome\User Data\Default\Login DataTNewFTPThreadUCDO.MessageCDO.ConfigurationhXXp://schemas.microsoft.com/cdo/configuration/smtpusesslhXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticatehXXp://schemas.microsoft.com/cdo/configuration/sendusernamehXXp://schemas.microsoft.com/cdo/configuration/sendpasswordhXXp://schemas.microsoft.com/cdo/configuration/smtpserverhXXp://schemas.microsoft.com/cdo/configuration/sendusinghXXp://schemas.microsoft.com/cdo/configuration/smtpserverportVBoxService.exeSbieDll.dlldbghelp.dllSoftware\Microsoft\Windows\CurrentVersion55274-640-2673064-2395076487-644-3177037-2351076487-337-8429955-22614\\.\SICE\\.\NTICEdrivers\sice.sysdrivers\ntice.sysdrivers\syser.sysdrivers\winice.sysdrivers\sice.vxddrivers\winice.vxdwinice.vxdvmm32\winice.vxdsice.vxdvmm32\sice.vxd\\.\SIWVID\\.\TRW\\.\TWX\\.\ICEEXT1.2.3deflate 1.2.3 Copyright 1995-2005 Jean-loup Gaillyinflate 1.2.3 Copyright 1995-2005 Mark Adler?456789:;!"#$%&'()* ,-./0123com.apple.Safaricom.apple.Safari0123456789ABCDEFKWindows.ScktCompWebcamAPIIdStackWindowsUnitKeyloggerUnitServerPassUnitExecutarComandosUnitSendFTPFilesUnitListarPortasAtivasUsndkey32sUnitWindowsIdTCPStreamIdTCPServer4UnitStartWebcamOperaPasswordsZPasswordRecoveryKuURLHistoryIEpasswordsUnitChromeSQLite3SQLiteTable3UnitFireFox3_5SetNamedPipeHandleStateGetWindowsDirectoryWGetProcessHeapGetCPInfoDisconnectNamedPipeCreatePipeCreateNamedPipeARegOpenKeyExWRegOpenKeyExARegOpenKeyWRegEnumKeyExWRegDeleteKeyWRegCreateKeyExWRegCreateKeyWRegCloseKeyRegEnumKeyExARegQueryInfoKeyACryptImportKeyCryptSetKeyParamCryptDestroyKeyShellExecuteWFindExecutableWSHDeleteKeyWURLDownloadToFileWkeybd_eventVkKeyScanWUnhookWindowsHookExSetWindowsHookExWSetWindowsHookExASetKeyboardStateMsgWaitForMultipleObjectsMapVirtualKeyWMapVirtualKeyAGetKeyboardStateGetKeyboardLayoutGetKeyStateExitWindowsExEnumWindowsGetKeyboardTypeFtpPutFileWFtpSetCurrentDirectoryW.idata.rdataP.relocP.rsrcI.uWPKERNEL32.DLLAVICAP32.DLLgdi32.dllmpr.dllmsacm32.dllntdll.dllpowrprof.dllpstorec.dllshell32.dllURLMON.DLLuser32.dllwininet.dllwinmm.dllwsock32.dllx.htmlSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\RunOnceWin\MSstart.exeSoftware\Microsoft\Windows NT\CurrentVersion\WindowsSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogonexplorer.exe "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Runexplorer.exehXXp://VVV.uol.com.br/hXXp://mail.terra.com.br/hXXps://VVV.google.com/accounts/serviceloginhXXps://my.screenname.aol.com/_cqr/login/login.psphXXp://VVV.lycos.comhXXp://VVV.myspace.comPortugalTurkeyTargetOperatingSystem:NumberOfMediaSupported:PowerManagementSupported:SCSIPort:NumberOfFunctionKeys:Password:MaxMemorySupported:Monochrome:ProtocolSupported:AdminPasswordStatus:BootROMSupported:InfraredSupported:KeyboardPasswordStatus:PowerOnPasswordStatus:SupportContactDescription:WindowsDirectory:[Execute]SpyNetKeyloggerkeyloggerWEBCAMuploadandexecuteuploadandexecuteyes|uploadandexecuteno|*#%"{}|\^[]`:LocalSubNet:Enabled:@xpsperes.dll,-22006SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\ListHKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_CURRENT_CONFIGInvalid Key NameInvalid KeyNamesoftware\microsoft\windows\currentversion\uninstall\webcamstream2|webcam|webcamstream|webcamstop2|webcam|webcamstop|webcamstartwebcamstart2*.jpgkeyloggernewc:\users\rafael\desktop\TESTE\keylogger|mouseloggerbuffer|OPERA|CHROME|keylogger|mouseloggerstart|keylogger|mouseloggerstop|keylogger|keyloggerativar|F|keylogger|keyloggerativar|T|keylogger|keyloggeronlinekey|webcamlist|getpasswords|webcamFirstExecutionSelfDelete.batSOFTWARE\Microsoft\Windows\CurrentVersion\RunSOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceSOFTWARE\Microsoft\Windows NT\CurrentVersion\WindowsSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Runrar.exerarreg.keyfilemanager|fmsendftpyes|filemanager|fmsendftpno|webcamlistdownexecopenwebgetpasswordsgetpasswords|STARTchromepasschromepass|sendkeyswindowHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\listarportaslistarportas|listadeportasativas|listarportasdnslistarportas|finalizarconexao|finalizarprocessoportaslistarportas|finalizarprocessoportas|Y|listarportas|finalizarprocessoportas|N|tecaladoexecutarwebcam2webcamconfigkeylogger|keyloggeronlinestart|keylogger|keyloggeronlinestop|logs_*.txtkeylogger|keylogger|keyloggerativarkeyloggerdesativarkeyloggerbaixarkeylogger|keyloggerbaixar|keylogger|keyloggerbaixar|NOLOGSkeyloggerexcluirkeylogger|keyloggerexcluir|keyloggeronlinestartkeyloggeronlinestopMouseLoggerWindowsfmexecnormalfilemanager|fmexecnormal|fmexechidefilemanager|fmexechide|fmexecparamfilemanager|fmexecparam|F|filemanager|fmexecparam|T|fmsendftpfilemanager|fmsendftp|keysearchLogs_*.txtkeysearch|YESkeysearch|NOkeyboardinfogetcompinfo|getcompinfo|keyboardinfo|ÞFAULTBROWSER%Unsupported clipboard formatCanvas does not allow drawing Clipboard does not support IconsTransparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.Reply Code is not valid: %sReply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parametersFile "%s" not foundObject type not supported.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.Command not supported.Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.Invalid Port Range (%d - %d)%s is not a valid service.%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.Set Size Exceeded.)UDP is not support in this SOCKS version.Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.Operation already in progress.Socket operation on non-socket.Protocol not supported.Socket type not supported."Operation not supported on socket.Protocol family not supported.0Address family not supported by protocol family.&Error on loading Winsock2 library (%s)Resolving hostname %s.Connecting to %s.Socket Error # %dOperation would block.Operation now in progress.%s.Seek not implemented$Operation not allowed on sorted listProperty %s does not existThread creation error: %sThread Error: %s (%d)Invalid destination array"Character index out of bounds (%d)Start index out of bounds (%d)Invalid count (%d)Invalid destination index (%d)Invalid codepage (%d)-Error on call to Winsock2 library function %sECheckSynchronize called from thread $%x, which is NOT the main threadClass %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicatesCannot create file "%s". %sCannot open file "%s". %s$''%s'' is not a valid component nameInvalid property value List capacity out of bounds (%d)List count out of bounds (%d)List index out of bounds (%d) Out of memory while expanding memory streamError reading %s%s%s: %sAncestor for '%s' not foundCannot assign a %s to a %sInterface not supported%s (%s, line %d)Abstract Error?Access violation at address %p in module '%s'. %s of address %pSystem Error. Code: %d.Invalid variant operationInvalid NULL variant operation%Invalid variant operation (%s%.8x)%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)Operation not supportedExternal exception %xInvalid pointer operationInvalid class typecast0Access violation at address %p. %s of address %pOperation aborted(Exception %s in module %s at %p.Application Error1Format '%s' invalid or incompatible with argumentNo argument for format '%s'"Variant method calls not supported!'%s' is not a valid integer value('%s' is not a valid floating point valueI/O error %dInteger overflow Invalid floating point operationServer.exe_1960:`.rsrckernel32.dll$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)oleaut32.dllEVariantBadIndexErrorEInvalidOperationu%CNu%s[%d]EIdCanNotBindPortInRangeEIdInvalidPortRange(,C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pasC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pasWS2_32.DLLMSWSOCK.DLLgetservbyportWSAAsyncGetServByPortWSAJoinLeafWSARecvMsgWSASendMsgWship6.dllFwpuclnt.dllTIdSocketListWindowsTIdStackWindowsUKernel32.dllEIdIPVersionUnsupportedT127.0.0.1C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pasEIdPortRequiredpEIdTCPConnectionErrorEIdObjectTypeNotSupportedftpTransferftpReadyftpAbortedPortTC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pasClientPortMinClientPortMaxPort"EIdTransparentProxyUDPNotSupportedTIdTCPConnectionIdTCPConnectionC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pasTIdTCPClientCustomTIdTCPClientCustomDhIdTCPClientTIdTCPClientBoundPortT%EIdSocksUDPNotSupportedBySOCKSVersionsaUsernamePasswordPassword0.0.0.10.0.0.0BoundPortDefaultPortole32.dllsqlite3_bind_blobsqlite3_bind_textsqlite3_bind_doublesqlite3_bind_intsqlite3_bind_int64sqlite3_bind_nullsqlite3_bind_parameter_indexsqlite3_opensqlite3_closesqlite3_errmsgsqlite3_errcodesqlite3_freesqlite3_prepare_v2sqlite3_column_countsqlite3_column_namesqlite3_column_decltypesqlite3_stepsqlite3_column_blobsqlite3_column_bytessqlite3_column_doublesqlite3_column_textsqlite3_column_typesqlite3_column_int64sqlite3_finalizesqlite3_resetSQL error or missing databaseAn internal logic error in SQLiteOperation terminated by sqlite3_interrupt()Uses OS features not supported on host2nd parameter to sqlite3_bind out of rangesqlite3_step() has another row readysqlite3_step() has finished executingUnknown SQLite Error Code "ESQLiteExceptionTSQLiteDatabaseTSQLiteTableFailed to open database "%s" : %sFailed to open database "%s" : unknown errorError [%d]: %s."%s": %sError executing SQLCould not prepare SQL statementError executing SQL statementSQLite is BusySOFTWARE\Mozilla\Mozilla FirefoxSOFTWARE\Wow6432Node\Mozilla\Mozilla FirefoxSOFTWARE\Mozilla\Mozilla Firefox\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\1234567890.mozsqlite3.dllsqlite3.dllMSVCR100.dllmozglue.dllmozcrt19.dllmozutils.dllnspr4.dllplc4.dllplds4.dllnssutil3.dllnss3.dllPK11_GetInternalKeySlot\Mozilla\Firefox\profiles.ini\Mozilla\Firefox\signons.sqliteSELECT * FROM moz_loginsencryptedPasswordSOFTWARE\Microsoft\Windows\CurrentVersionMicrosoft\Network\Connections\pbk\rasphone.pbkrasapi32.dllrnaph.dllRAS Passwordsadvapi32.dllcrypt32.dlluURLHistoryabe2869f-9b47-4cd9-a358-c22904dba7f7UnitPasswordsWindowsLive:name=*\Mozilla Firefox\softokn3.dlluserenv.dllprofiles.ini\signons3.txt\signons2.txt\signons1.txt\signons.txt\\.\pipe\wzcsvc_wep_keyswinlogon.exeSafariPasswordRecoveryAVURLProtocol_Classic\Apple Computer\Preferences\keychain.plist\Apple\Apple Application Support\CFNetwork.dllhXXp://PTF://*PTF://hXXps://gdiplus.dllGdiplusShutdownEInvalidGraphicOperationWbemScripting.SWbemLocator%s\%sSELECT * FROM %spathToSignedProductExepathToSignedReportingExeWbemScripting.SWbemDateTimeHExecQueryTargetOperatingSystemNumberOfMediaSupportedPowerManagementSupportedSCSIPortSelect * from Win32_KeyboardNumberOfFunctionKeysMaxMemorySupportedMonochromeProtocolSupportedAdminPasswordStatusBootROMSupportedInfraredSupportedKeyboardPasswordStatusPowerOnPasswordStatusSupportContactDescriptionSelect * from Win32_OperatingSystemWindowsDirectorySelect Caption,BuildNumber,CSDVersion from Win32_OperatingSystemTKeyloggerTIdTCPClientNewPlease, send a email to SpyNetCoder ---> spynetcoder@gmail.comTWebcamISO_646.irv:1991ISO_646.basic:1983ISO_646.irv:1983csISO16PortuguesecsISO84Portuguese2windows-936csShiftJISwindows-874ISO-8859-1-Windows-3.0-Latin-1csWindows30Latin1ISO-8859-1-Windows-3.1-Latin-1csWindows31Latin1ISO-8859-2-Windows-Latin-2csWindows31Latin2ISO-8859-9-Windows-Latin-5csWindows31Latin5csMicrosoftPublishingWindows-31JcsWindows31JPTCP154csPTCP154windows-1250windows-1251windows-1252windows-1253windows-1254windows-1255windows-1256windows-1257windows-1258HTTP-EQUIV()@,;:\"./()@,;:\"/[]?=()@,;:\"/[]?={}C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pasC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pasC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pasIdCustomTCPServerTIdCustomTCPServerTIdCustomTCPServerXDefaultPorttEIdTCPServerErrorC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pasEIdTCPNoOnExecuteTIdTCPServerIdTCPServerOnExecuteC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas%s UserCmdDelimiterC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas'TIdCmdTCPServerAfterCommandHandlerEventTIdCmdTCPServer(TIdCmdTCPServerBeforeCommandHandlerEventIdCmdTCPServerDisplays commands that the servers supports.TIdTCPStreamIdRead() method of TIdTCPStream class does not support seekingTIdHTTPProxyTransferModeTIdHTTPProxyServerContextTIdHTTPProxyServerContextlSTOnHTTPContextEventTOnHTTPDocumentTIdHTTPProxyServerOnHTTPBeforeCommandOnHTTPResponse8TOnHTTPDocumentHTTP/1.0HTTP/1.0 200 Connection establishedHNetCfg.NATUPnPStaticPortMappingCollectionPSAPI.dllshlwapi.dllTSendKeySOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SetupApi.dllSetupDiOpenClassRegKeySetupDiOpenClassRegKeyExASetupDiOpenClassRegKeyExWSetupDiCreateDeviceInterfaceRegKeyASetupDiCreateDeviceInterfaceRegKeyWSetupDiOpenDeviceInterfaceRegKeySetupDiDeleteDeviceInterfaceRegKeySetupDiCreateDevRegKeyASetupDiCreateDevRegKeyWSetupDiOpenDevRegKeySetupDiDeleteDevRegKeyCM_DEVCAP_LOCKSUPPORTEDCM_DEVCAP_EJECTSUPPORTEDPDCAP_D0_SUPPORTEDPDCAP_D1_SUPPORTEDPDCAP_D2_SUPPORTEDPDCAP_D3_SUPPORTEDPDCAP_WAKE_FROM_D0_SUPPORTEDPDCAP_WAKE_FROM_D1_SUPPORTEDPDCAP_WAKE_FROM_D2_SUPPORTEDPDCAP_WAKE_FROM_D3_SUPPORTEDPDCAP_WARM_EJECT_SUPPORTEDiphlpapi.dllAllocateAndGetTcpExTableFromStackAllocateAndGetUdpExTableFromStackAllocateAndGetTcpTableFromStackAllocateAndGetUdpTableFromStackSetTcpEntryGetExtendedTcpTableGetExtendedUdpTableTWebcamThreadShell.ApplicationSHFileOperationW\Opera\Opera\wand.dat\Google\Chrome\User Data\Default\Web Data\Google\Chrome\User Data\Default\Login DataTNewFTPThreadUCDO.MessageCDO.ConfigurationhXXp://schemas.microsoft.com/cdo/configuration/smtpusesslhXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticatehXXp://schemas.microsoft.com/cdo/configuration/sendusernamehXXp://schemas.microsoft.com/cdo/configuration/sendpasswordhXXp://schemas.microsoft.com/cdo/configuration/smtpserverhXXp://schemas.microsoft.com/cdo/configuration/sendusinghXXp://schemas.microsoft.com/cdo/configuration/smtpserverportVBoxService.exeSbieDll.dlldbghelp.dllSoftware\Microsoft\Windows\CurrentVersion55274-640-2673064-2395076487-644-3177037-2351076487-337-8429955-22614\\.\SICE\\.\NTICEdrivers\sice.sysdrivers\ntice.sysdrivers\syser.sysdrivers\winice.sysdrivers\sice.vxddrivers\winice.vxdwinice.vxdvmm32\winice.vxdsice.vxdvmm32\sice.vxd\\.\SIWVID\\.\TRW\\.\TWX\\.\ICEEXT1.2.3deflate 1.2.3 Copyright 1995-2005 Jean-loup Gaillyinflate 1.2.3 Copyright 1995-2005 Mark Adler?456789:;!"#$%&'()* ,-./0123com.apple.Safaricom.apple.Safari0123456789ABCDEFKWindows.ScktCompWebcamAPIIdStackWindowsUnitKeyloggerUnitServerPassUnitExecutarComandosUnitSendFTPFilesUnitListarPortasAtivasUsndkey32sUnitWindowsIdTCPStreamIdTCPServer4UnitStartWebcamOperaPasswordsZPasswordRecoveryKuURLHistoryIEpasswordsUnitChromeSQLite3SQLiteTable3UnitFireFox3_5SetNamedPipeHandleStateGetWindowsDirectoryWGetProcessHeapGetCPInfoDisconnectNamedPipeCreatePipeCreateNamedPipeARegOpenKeyExWRegOpenKeyExARegOpenKeyWRegEnumKeyExWRegDeleteKeyWRegCreateKeyExWRegCreateKeyWRegCloseKeyRegEnumKeyExARegQueryInfoKeyACryptImportKeyCryptSetKeyParamCryptDestroyKeyShellExecuteWFindExecutableWSHDeleteKeyWURLDownloadToFileWkeybd_eventVkKeyScanWUnhookWindowsHookExSetWindowsHookExWSetWindowsHookExASetKeyboardStateMsgWaitForMultipleObjectsMapVirtualKeyWMapVirtualKeyAGetKeyboardStateGetKeyboardLayoutGetKeyStateExitWindowsExEnumWindowsGetKeyboardTypeFtpPutFileWFtpSetCurrentDirectoryW.idata.rdataP.relocP.rsrcI.uWPKERNEL32.DLLAVICAP32.DLLgdi32.dllmpr.dllmsacm32.dllntdll.dllpowrprof.dllpstorec.dllshell32.dllURLMON.DLLuser32.dllwininet.dllwinmm.dllwsock32.dllx.htmlSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\RunOnceWin\MSstart.exeSoftware\Microsoft\Windows NT\CurrentVersion\WindowsSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogonexplorer.exe "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Runexplorer.exehXXp://VVV.uol.com.br/hXXp://mail.terra.com.br/hXXps://VVV.google.com/accounts/serviceloginhXXps://my.screenname.aol.com/_cqr/login/login.psphXXp://VVV.lycos.comhXXp://VVV.myspace.comPortugalTurkeyTargetOperatingSystem:NumberOfMediaSupported:PowerManagementSupported:SCSIPort:NumberOfFunctionKeys:Password:MaxMemorySupported:Monochrome:ProtocolSupported:AdminPasswordStatus:BootROMSupported:InfraredSupported:KeyboardPasswordStatus:PowerOnPasswordStatus:SupportContactDescription:WindowsDirectory:[Execute]SpyNetKeyloggerkeyloggerWEBCAMuploadandexecuteuploadandexecuteyes|uploadandexecuteno|*#%"{}|\^[]`:LocalSubNet:Enabled:@xpsperes.dll,-22006SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\ListHKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_CURRENT_CONFIGInvalid Key NameInvalid KeyNamesoftware\microsoft\windows\currentversion\uninstall\webcamstream2|webcam|webcamstream|webcamstop2|webcam|webcamstop|webcamstartwebcamstart2*.jpgkeyloggernewc:\users\rafael\desktop\TESTE\keylogger|mouseloggerbuffer|OPERA|CHROME|keylogger|mouseloggerstart|keylogger|mouseloggerstop|keylogger|keyloggerativar|F|keylogger|keyloggerativar|T|keylogger|keyloggeronlinekey|webcamlist|getpasswords|webcamFirstExecutionSelfDelete.batSOFTWARE\Microsoft\Windows\CurrentVersion\RunSOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceSOFTWARE\Microsoft\Windows NT\CurrentVersion\WindowsSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Runrar.exerarreg.keyfilemanager|fmsendftpyes|filemanager|fmsendftpno|webcamlistdownexecopenwebgetpasswordsgetpasswords|STARTchromepasschromepass|sendkeyswindowHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\listarportaslistarportas|listadeportasativas|listarportasdnslistarportas|finalizarconexao|finalizarprocessoportaslistarportas|finalizarprocessoportas|Y|listarportas|finalizarprocessoportas|N|tecaladoexecutarwebcam2webcamconfigkeylogger|keyloggeronlinestart|keylogger|keyloggeronlinestop|logs_*.txtkeylogger|keylogger|keyloggerativarkeyloggerdesativarkeyloggerbaixarkeylogger|keyloggerbaixar|keylogger|keyloggerbaixar|NOLOGSkeyloggerexcluirkeylogger|keyloggerexcluir|keyloggeronlinestartkeyloggeronlinestopMouseLoggerWindowsfmexecnormalfilemanager|fmexecnormal|fmexechidefilemanager|fmexechide|fmexecparamfilemanager|fmexecparam|F|filemanager|fmexecparam|T|fmsendftpfilemanager|fmsendftp|keysearchLogs_*.txtkeysearch|YESkeysearch|NOkeyboardinfogetcompinfo|getcompinfo|keyboardinfo|ÞFAULTBROWSER%Unsupported clipboard formatCanvas does not allow drawing Clipboard does not support IconsTransparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.Reply Code is not valid: %sReply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parametersFile "%s" not foundObject type not supported.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.Command not supported.Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.Invalid Port Range (%d - %d)%s is not a valid service.%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.Set Size Exceeded.)UDP is not support in this SOCKS version.Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.Operation already in progress.Socket operation on non-socket.Protocol not supported.Socket type not supported."Operation not supported on socket.Protocol family not supported.0Address family not supported by protocol family.&Error on loading Winsock2 library (%s)Resolving hostname %s.Connecting to %s.Socket Error # %dOperation would block.Operation now in progress.%s.Seek not implemented$Operation not allowed on sorted listProperty %s does not existThread creation error: %sThread Error: %s (%d)Invalid destination array"Character index out of bounds (%d)Start index out of bounds (%d)Invalid count (%d)Invalid destination index (%d)Invalid codepage (%d)-Error on call to Winsock2 library function %sECheckSynchronize called from thread $%x, which is NOT the main threadClass %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicatesCannot create file "%s". %sCannot open file "%s". %s$''%s'' is not a valid component nameInvalid property value List capacity out of bounds (%d)List count out of bounds (%d)List index out of bounds (%d) Out of memory while expanding memory streamError reading %s%s%s: %sAncestor for '%s' not foundCannot assign a %s to a %sInterface not supported%s (%s, line %d)Abstract Error?Access violation at address %p in module '%s'. %s of address %pSystem Error. Code: %d.Invalid variant operationInvalid NULL variant operation%Invalid variant operation (%s%.8x)%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)Operation not supportedExternal exception %xInvalid pointer operationInvalid class typecast0Access violation at address %p. %s of address %pOperation aborted(Exception %s in module %s at %p.Application Error1Format '%s' invalid or incompatible with argumentNo argument for format '%s'"Variant method calls not supported!'%s' is not a valid integer value('%s' is not a valid floating point valueI/O error %dInteger overflow Invalid floating point operationServer.exe_1960_rwx_00C80000_000F0000:`.rsrckernel32.dll$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)oleaut32.dllEVariantBadIndexErrorEInvalidOperationu%CNu%s[%d]EIdCanNotBindPortInRangeEIdInvalidPortRange(,C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pasC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pasWS2_32.DLLMSWSOCK.DLLgetservbyportWSAAsyncGetServByPortWSAJoinLeafWSARecvMsgWSASendMsgWship6.dllFwpuclnt.dllTIdSocketListWindowsTIdStackWindowsUKernel32.dllEIdIPVersionUnsupportedT127.0.0.1C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pasEIdPortRequiredpEIdTCPConnectionErrorEIdObjectTypeNotSupportedftpTransferftpReadyftpAbortedPortTC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pasClientPortMinClientPortMaxPort"EIdTransparentProxyUDPNotSupportedTIdTCPConnectionIdTCPConnectionC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pasTIdTCPClientCustomTIdTCPClientCustomDhIdTCPClientTIdTCPClientBoundPortT%EIdSocksUDPNotSupportedBySOCKSVersionsaUsernamePasswordPassword0.0.0.10.0.0.0BoundPortDefaultPortole32.dllsqlite3_bind_blobsqlite3_bind_textsqlite3_bind_doublesqlite3_bind_intsqlite3_bind_int64sqlite3_bind_nullsqlite3_bind_parameter_indexsqlite3_opensqlite3_closesqlite3_errmsgsqlite3_errcodesqlite3_freesqlite3_prepare_v2sqlite3_column_countsqlite3_column_namesqlite3_column_decltypesqlite3_stepsqlite3_column_blobsqlite3_column_bytessqlite3_column_doublesqlite3_column_textsqlite3_column_typesqlite3_column_int64sqlite3_finalizesqlite3_resetSQL error or missing databaseAn internal logic error in SQLiteOperation terminated by sqlite3_interrupt()Uses OS features not supported on host2nd parameter to sqlite3_bind out of rangesqlite3_step() has another row readysqlite3_step() has finished executingUnknown SQLite Error Code "ESQLiteExceptionTSQLiteDatabaseTSQLiteTableFailed to open database "%s" : %sFailed to open database "%s" : unknown errorError [%d]: %s."%s": %sError executing SQLCould not prepare SQL statementError executing SQL statementSQLite is BusySOFTWARE\Mozilla\Mozilla FirefoxSOFTWARE\Wow6432Node\Mozilla\Mozilla FirefoxSOFTWARE\Mozilla\Mozilla Firefox\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\1234567890.mozsqlite3.dllsqlite3.dllMSVCR100.dllmozglue.dllmozcrt19.dllmozutils.dllnspr4.dllplc4.dllplds4.dllnssutil3.dllnss3.dllPK11_GetInternalKeySlot\Mozilla\Firefox\profiles.ini\Mozilla\Firefox\signons.sqliteSELECT * FROM moz_loginsencryptedPasswordSOFTWARE\Microsoft\Windows\CurrentVersionMicrosoft\Network\Connections\pbk\rasphone.pbkrasapi32.dllrnaph.dllRAS Passwordsadvapi32.dllcrypt32.dlluURLHistoryabe2869f-9b47-4cd9-a358-c22904dba7f7UnitPasswordsWindowsLive:name=*\Mozilla Firefox\softokn3.dlluserenv.dllprofiles.ini\signons3.txt\signons2.txt\signons1.txt\signons.txt\\.\pipe\wzcsvc_wep_keyswinlogon.exeSafariPasswordRecoveryAVURLProtocol_Classic\Apple Computer\Preferences\keychain.plist\Apple\Apple Application Support\CFNetwork.dllhXXp://PTF://*PTF://hXXps://gdiplus.dllGdiplusShutdownEInvalidGraphicOperationWbemScripting.SWbemLocator%s\%sSELECT * FROM %spathToSignedProductExepathToSignedReportingExeWbemScripting.SWbemDateTimeHExecQueryTargetOperatingSystemNumberOfMediaSupportedPowerManagementSupportedSCSIPortSelect * from Win32_KeyboardNumberOfFunctionKeysMaxMemorySupportedMonochromeProtocolSupportedAdminPasswordStatusBootROMSupportedInfraredSupportedKeyboardPasswordStatusPowerOnPasswordStatusSupportContactDescriptionSelect * from Win32_OperatingSystemWindowsDirectorySelect Caption,BuildNumber,CSDVersion from Win32_OperatingSystemTKeyloggerTIdTCPClientNewPlease, send a email to SpyNetCoder ---> spynetcoder@gmail.comTWebcamISO_646.irv:1991ISO_646.basic:1983ISO_646.irv:1983csISO16PortuguesecsISO84Portuguese2windows-936csShiftJISwindows-874ISO-8859-1-Windows-3.0-Latin-1csWindows30Latin1ISO-8859-1-Windows-3.1-Latin-1csWindows31Latin1ISO-8859-2-Windows-Latin-2csWindows31Latin2ISO-8859-9-Windows-Latin-5csWindows31Latin5csMicrosoftPublishingWindows-31JcsWindows31JPTCP154csPTCP154windows-1250windows-1251windows-1252windows-1253windows-1254windows-1255windows-1256windows-1257windows-1258HTTP-EQUIV()@,;:\"./()@,;:\"/[]?=()@,;:\"/[]?={}C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pasC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pasC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pasIdCustomTCPServerTIdCustomTCPServerTIdCustomTCPServerXDefaultPorttEIdTCPServerErrorC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pasEIdTCPNoOnExecuteTIdTCPServerIdTCPServerOnExecuteC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas%s UserCmdDelimiterC:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas'TIdCmdTCPServerAfterCommandHandlerEventTIdCmdTCPServer(TIdCmdTCPServerBeforeCommandHandlerEventIdCmdTCPServerDisplays commands that the servers supports.TIdTCPStreamIdRead() method of TIdTCPStream class does not support seekingTIdHTTPProxyTransferModeTIdHTTPProxyServerContextTIdHTTPProxyServerContextlSTOnHTTPContextEventTOnHTTPDocumentTIdHTTPProxyServerOnHTTPBeforeCommandOnHTTPResponse8TOnHTTPDocumentHTTP/1.0HTTP/1.0 200 Connection establishedHNetCfg.NATUPnPStaticPortMappingCollectionPSAPI.dllshlwapi.dllTSendKeySOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SetupApi.dllSetupDiOpenClassRegKeySetupDiOpenClassRegKeyExASetupDiOpenClassRegKeyExWSetupDiCreateDeviceInterfaceRegKeyASetupDiCreateDeviceInterfaceRegKeyWSetupDiOpenDeviceInterfaceRegKeySetupDiDeleteDeviceInterfaceRegKeySetupDiCreateDevRegKeyASetupDiCreateDevRegKeyWSetupDiOpenDevRegKeySetupDiDeleteDevRegKeyCM_DEVCAP_LOCKSUPPORTEDCM_DEVCAP_EJECTSUPPORTEDPDCAP_D0_SUPPORTEDPDCAP_D1_SUPPORTEDPDCAP_D2_SUPPORTEDPDCAP_D3_SUPPORTEDPDCAP_WAKE_FROM_D0_SUPPORTEDPDCAP_WAKE_FROM_D1_SUPPORTEDPDCAP_WAKE_FROM_D2_SUPPORTEDPDCAP_WAKE_FROM_D3_SUPPORTEDPDCAP_WARM_EJECT_SUPPORTEDiphlpapi.dllAllocateAndGetTcpExTableFromStackAllocateAndGetUdpExTableFromStackAllocateAndGetTcpTableFromStackAllocateAndGetUdpTableFromStackSetTcpEntryGetExtendedTcpTableGetExtendedUdpTableTWebcamThreadShell.ApplicationSHFileOperationW\Opera\Opera\wand.dat\Google\Chrome\User Data\Default\Web Data\Google\Chrome\User Data\Default\Login DataTNewFTPThreadUCDO.MessageCDO.ConfigurationhXXp://schemas.microsoft.com/cdo/configuration/smtpusesslhXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticatehXXp://schemas.microsoft.com/cdo/configuration/sendusernamehXXp://schemas.microsoft.com/cdo/configuration/sendpasswordhXXp://schemas.microsoft.com/cdo/configuration/smtpserverhXXp://schemas.microsoft.com/cdo/configuration/sendusinghXXp://schemas.microsoft.com/cdo/configuration/smtpserverportVBoxService.exeSbieDll.dlldbghelp.dllSoftware\Microsoft\Windows\CurrentVersion55274-640-2673064-2395076487-644-3177037-2351076487-337-8429955-22614\\.\SICE\\.\NTICEdrivers\sice.sysdrivers\ntice.sysdrivers\syser.sysdrivers\winice.sysdrivers\sice.vxddrivers\winice.vxdwinice.vxdvmm32\winice.vxdsice.vxdvmm32\sice.vxd\\.\SIWVID\\.\TRW\\.\TWX\\.\ICEEXT1.2.3deflate 1.2.3 Copyright 1995-2005 Jean-loup Gaillyinflate 1.2.3 Copyright 1995-2005 Mark Adler?456789:;!"#$%&'()* ,-./0123com.apple.Safaricom.apple.Safari0123456789ABCDEFKWindows.ScktCompWebcamAPIIdStackWindowsUnitKeyloggerUnitServerPassUnitExecutarComandosUnitSendFTPFilesUnitListarPortasAtivasUsndkey32sUnitWindowsIdTCPStreamIdTCPServer4UnitStartWebcamOperaPasswordsZPasswordRecoveryKuURLHistoryIEpasswordsUnitChromeSQLite3SQLiteTable3UnitFireFox3_5SetNamedPipeHandleStateGetWindowsDirectoryWGetProcessHeapGetCPInfoDisconnectNamedPipeCreatePipeCreateNamedPipeARegOpenKeyExWRegOpenKeyExARegOpenKeyWRegEnumKeyExWRegDeleteKeyWRegCreateKeyExWRegCreateKeyWRegCloseKeyRegEnumKeyExARegQueryInfoKeyACryptImportKeyCryptSetKeyParamCryptDestroyKeyShellExecuteWFindExecutableWSHDeleteKeyWURLDownloadToFileWkeybd_eventVkKeyScanWUnhookWindowsHookExSetWindowsHookExWSetWindowsHookExASetKeyboardStateMsgWaitForMultipleObjectsMapVirtualKeyWMapVirtualKeyAGetKeyboardStateGetKeyboardLayoutGetKeyStateExitWindowsExEnumWindowsGetKeyboardTypeFtpPutFileWFtpSetCurrentDirectoryW.idata.rdataP.relocP.rsrcI.uWPKERNEL32.DLLAVICAP32.DLLgdi32.dllmpr.dllmsacm32.dllntdll.dllpowrprof.dllpstorec.dllshell32.dllURLMON.DLLuser32.dllwininet.dllwinmm.dllwsock32.dllx.htmlSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\RunOnceWin\MSstart.exeSoftware\Microsoft\Windows NT\CurrentVersion\WindowsSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogonexplorer.exe "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Runexplorer.exehXXp://VVV.uol.com.br/hXXp://mail.terra.com.br/hXXps://VVV.google.com/accounts/serviceloginhXXps://my.screenname.aol.com/_cqr/login/login.psphXXp://VVV.lycos.comhXXp://VVV.myspace.comPortugalTurkeyTargetOperatingSystem:NumberOfMediaSupported:PowerManagementSupported:SCSIPort:NumberOfFunctionKeys:Password:MaxMemorySupported:Monochrome:ProtocolSupported:AdminPasswordStatus:BootROMSupported:InfraredSupported:KeyboardPasswordStatus:PowerOnPasswordStatus:SupportContactDescription:WindowsDirectory:[Execute]SpyNetKeyloggerkeyloggerWEBCAMuploadandexecuteuploadandexecuteyes|uploadandexecuteno|*#%"{}|\^[]`:LocalSubNet:Enabled:@xpsperes.dll,-22006SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\ListHKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_CURRENT_CONFIGInvalid Key NameInvalid KeyNamesoftware\microsoft\windows\currentversion\uninstall\webcamstream2|webcam|webcamstream|webcamstop2|webcam|webcamstop|webcamstartwebcamstart2*.jpgkeyloggernewc:\users\rafael\desktop\TESTE\keylogger|mouseloggerbuffer|OPERA|CHROME|keylogger|mouseloggerstart|keylogger|mouseloggerstop|keylogger|keyloggerativar|F|keylogger|keyloggerativar|T|keylogger|keyloggeronlinekey|webcamlist|getpasswords|webcamFirstExecutionSelfDelete.batSOFTWARE\Microsoft\Windows\CurrentVersion\RunSOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceSOFTWARE\Microsoft\Windows NT\CurrentVersion\WindowsSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Runrar.exerarreg.keyfilemanager|fmsendftpyes|filemanager|fmsendftpno|webcamlistdownexecopenwebgetpasswordsgetpasswords|STARTchromepasschromepass|sendkeyswindowHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\listarportaslistarportas|listadeportasativas|listarportasdnslistarportas|finalizarconexao|finalizarprocessoportaslistarportas|finalizarprocessoportas|Y|listarportas|finalizarprocessoportas|N|tecaladoexecutarwebcam2webcamconfigkeylogger|keyloggeronlinestart|keylogger|keyloggeronlinestop|logs_*.txtkeylogger|keylogger|keyloggerativarkeyloggerdesativarkeyloggerbaixarkeylogger|keyloggerbaixar|keylogger|keyloggerbaixar|NOLOGSkeyloggerexcluirkeylogger|keyloggerexcluir|keyloggeronlinestartkeyloggeronlinestopMouseLoggerWindowsfmexecnormalfilemanager|fmexecnormal|fmexechidefilemanager|fmexechide|fmexecparamfilemanager|fmexecparam|F|filemanager|fmexecparam|T|fmsendftpfilemanager|fmsendftp|keysearchLogs_*.txtkeysearch|YESkeysearch|NOkeyboardinfogetcompinfo|getcompinfo|keyboardinfo|ÞFAULTBROWSER%Unsupported clipboard formatCanvas does not allow drawing Clipboard does not support IconsTransparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.Reply Code is not valid: %sReply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parametersFile "%s" not foundObject type not supported.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.Command not supported.Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.Invalid Port Range (%d - %d)%s is not a valid service.%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.Set Size Exceeded.)UDP is not support in this SOCKS version.Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.Operation already in progress.Socket operation on non-socket.Protocol not supported.Socket type not supported."Operation not supported on socket.Protocol family not supported.0Address family not supported by protocol family.&Error on loading Winsock2 library (%s)Resolving hostname %s.Connecting to %s.Socket Error # %dOperation would block.Operation now in progress.%s.Seek not implemented$Operation not allowed on sorted listProperty %s does not existThread creation error: %sThread Error: %s (%d)Invalid destination array"Character index out of bounds (%d)Start index out of bounds (%d)Invalid count (%d)Invalid destination index (%d)Invalid codepage (%d)-Error on call to Winsock2 library function %sECheckSynchronize called from thread $%x, which is NOT the main threadClass %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicatesCannot create file "%s". %sCannot open file "%s". %s$''%s'' is not a valid component nameInvalid property value List capacity out of bounds (%d)List count out of bounds (%d)List index out of bounds (%d) Out of memory while expanding memory streamError reading %s%s%s: %sAncestor for '%s' not foundCannot assign a %s to a %sInterface not supported%s (%s, line %d)Abstract Error?Access violation at address %p in module '%s'. %s of address %pSystem Error. Code: %d.Invalid variant operationInvalid NULL variant operation%Invalid variant operation (%s%.8x)%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)Operation not supportedExternal exception %xInvalid pointer operationInvalid class typecast0Access violation at address %p. %s of address %pOperation aborted(Exception %s in module %s at %p.Application Error1Format '%s' invalid or incompatible with argumentNo argument for format '%s'"Variant method calls not supported!'%s' is not a valid integer value('%s' is not a valid floating point valueI/O error %dInteger overflow Invalid floating point operation3>