MD5: 9a1565879017e0bd425c677245ca125c
SHA1: 41ed3e83b44d711244847405380269156f21e46d
SHA256: 9132188354b7220e23dd8f08e204a01eece9ced6027b75accbd2b59467b0dcf7
SSDeep: 49152:Ikwkn9IMHeafLkNiz4wLZQ9dh2ONcq4J i8Tc4P3BPaPCS:zdnV2iXLZQ9jnNczz8YcxSPC
Size: 2665472 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Xacti, LLC
Created at: 2017-05-14 03:21:25
Analyzed on: Windows7 SP1 32-bit

Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

No specific payload has been found.

Process activity

The Worm creates the following process(es):

%original file name%.exe:4020
zFile.exe:3932

The Worm injects its code into the following process(es):

RegAsm.exe:3996

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:4020 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qDkfu.jOc (2105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autA6BA.tmp (3601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\zFile\zFile.exe (18394 bytes)

The Worm deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autA6BA.tmp (0 bytes)

Registry activity

The process %original file name%.exe:4020 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Worm deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process zFile.exe:3932 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Hide" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\zFile\zFile.exe"

The process RegAsm.exe:3996 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\RegAsm_RASMANCS]
"EnableConsoleTracing" = "0"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\RegAsm_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\RegAsm_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\RegAsm_RASAPI32]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\RegAsm_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\RegAsm_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\RegAsm_RASMANCS]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\RegAsm_RASAPI32]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\RegAsm_RASMANCS]
"MaxFileSize" = "1048576"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://ip-api.com/json/	108.61.123.162
teredo.ipv6.microsoft.com	157.56.120.207
blockcha1n.info	89.35.228.192
dns.msftncsi.com	131.107.255.255

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY External IP Lookup ip-api.com

Traffic

GET /json/ HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0

Host: ip-api.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: application/json; charset=utf-8

Date: Fri, 19 May 2017 22:55:32 GMT

Content-Length: 279
{"as":"AS31561 Pitline Ltd","city":"Kharkiv","country":"Ukraine","coun
tryCode":"UA","isp":"Pitline Ltd","lat":49.9808,"lon":36.2527,"org":"P
itline Ltd","query":"194.242.96.226","region":"63","regionName":"Khark
ivs'ka Oblast'","status":"success","timezone":"Europe/Kiev","zip":""}H
TTP/1.1 200 OK..Access-Control-Allow-Origin: *..Content-Type: applicat
ion/json; charset=utf-8..Date: Fri, 19 May 2017 22:55:32 GMT..Content-
Length: 279..{"as":"AS31561 Pitline Ltd","city":"Kharkiv","country":"U
kraine","countryCode":"UA","isp":"Pitline Ltd","lat":49.9808,"lon":36.
2527,"org":"Pitline Ltd","query":"194.242.96.226","region":"63","regio
nName":"Kharkivs'ka Oblast'","status":"success","timezone":"Europe/Kie
v","zip":""}..

The Worm connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

@.reloc

PSSSSSSh

Gt.Ht$

t.jGZf;

PSSShD

PVSShD

f;Crt

.Jw`8Hw~fHw

?#%X.y

GetProcessWindowStation

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

kernel32.dll

oleaut32.dll

RegDeleteKeyExW

advapi32.dll

Error text not found (please report)

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is compiled without UTF support

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with Unicode property support

\N is not supported in a class

WSOCK32.dll

VERSION.dll

WINMM.dll

COMCTL32.dll

MPR.dll

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

WININET.dll

PSAPI.DLL

IPHLPAPI.DLL

USERENV.dll

UxTheme.dll

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

KERNEL32.dll

OpenWindowStationW

SetProcessWindowStation

CloseWindowStation

MapVirtualKeyW

EnumChildWindows

EnumWindows

VkKeyScanW

GetKeyState

GetKeyboardState

SetKeyboardState

GetAsyncKeyState

keybd_event

EnumThreadWindows

ExitWindowsEx

UnregisterHotKey

RegisterHotKey

GetKeyboardLayoutNameW

USER32.dll

SetViewportOrgEx

GDI32.dll

COMDLG32.dll

RegOpenKeyExW

RegCloseKey

RegCreateKeyExW

RegEnumKeyExW

RegDeleteKeyW

ADVAPI32.dll

ShellExecuteW

SHFileOperationW

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

GetCPInfo

zcÁ

V.Rh@

!$ý

i_.QH{

n(l,%U

$Zx.HT5

4.vUK

z@ú

E.LpJ

.fv<"w*

p.akR

'!.Cq&9p

@rQ.VL&]|

tD.BI/

&U%X8`<e<Ot

'H.nO

k:[.Fcj

S .ic

~_%X(

!X[%C

~5D%D,

b.qadL

h8y%U

9z.uox4MBJ

!;%S&m

.MChZp

:-.Ob

m3.Wdj

Fl%Fn

W.rF7

A.VN^

-N}/8q

.yh|C

K.T%d

.dt"j

Gt%D%m

9s2\.pAJ`eS

GKk%fm@

.As9@

OR%XT

6/%xrJ

4r.Zi-

W.Fg"

K.zI&

:.UX:

40D.bv

4%fZ~

9$p(ûS

.bhbO

HÂM

gkl.ap'

0-1}0n7

?F!70~.Uns

3=hzT

;x.MJ

O%5UYA

)2%uL

% H%x

-ou4}

J0.PRI

.zdYX

/(s/J%U

b,'%u$

V.mng

z.VqI5

.eNh&

.Xrl7R

_%XH-

{Ev.zxN;O

*l.qn

.fNsR

TcPy

B`Ú

>Í.

$5%xW

[4 %c

.GmLUr

%s ]~

.Ud_a

_uR.PMk

JC.Xj

vPm%cwB

A_42%d

VY%S_

FsshL3

F<vCrT

.pI[ O

}.GhU

f.IP|;

L&.Uvd

%sR5x

]aB

 }vml@%SP

H)PM%C

)-.NV

pb2Æ

f#C.nv

^@f0]Y.Gf

.pM$_V

Gg.jj

v"=%6S

T%F{j=

 u.Yc

bÝ7

18 %s

!/J%X

.lnQY

.PP/I

fb%UT

 .uDh

7J.UiK

.HpZ(

O %dz

T.qf?L

!.kx?

j,.jc

I.zBQ

Kx.ETBs

%sZ.{

X#Kj.px

gL %.isY

[.Xoe

@-.cm

J%c-Rm

g.QrVM

%x,kg9

NQ.cR

*.aRP

s9.pC

?1A%uM

V%s$r4

.av,(

A@}>.quOh

r*.ui

P.ckj

H.QOX

B:.Um$

_$?%4U

c.fC'iX'

6`S.WF

Zl.BQ

8-'\8-,#

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"/>

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>

2 3(393@3

5"5(5,52565<5@5

5W5C5V5_5r5

9’9S9x9

9 9$9(9,9094989<9@9

1/2g2

: :$:(:,:0:4:8:<:@:

7-747v7}7

< <$<<<@<

mscoree.dll

combase.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

USER32.DLL

>>>AUTOIT NO CMDEXECUTE<<<

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

APPSKEY

789:;<=>?

FTPSETPROXY

GUICTRLRECVMSG

GUICTRLSENDMSG

GUIGETMSG

GUIREGISTERMSG

HOTKEYSET

HTTPSETPROXY

HTTPSETUSERAGENT

ISKEYWORD

MSGBOX

REGENUMKEY

SHELLEXECUTE

SHELLEXECUTEWAIT

TCPACCEPT

TCPCLOSESOCKET

TCPCONNECT

TCPLISTEN

TCPNAMETOIP

TCPRECV

TCPSEND

TCPSHUTDOWN

TCPSTARTUP

TRAYGETMSG

UDPBIND

UDPCLOSESOCKET

UDPOPEN

UDPRECV

UDPSEND

UDPSHUTDOWN

UDPSTARTUP

SendKeyDelay

SendKeyDownDelay

TCPTimeout

WINDOWSDIR

AUTOITEXE

HOTKEYPRESSED

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

"%s" (%d) : ==> %s:

\??\%s

GUI_RUNDEFMSG

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AUTOIT.ERROR

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

3, 3, 10, 2

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

C:\Users\"%CurrentUserName%"\AppData\Roaming\zFile\zFile.exe

UC:\Users\"%CurrentUserName%"\AppData\Roaming\zFile\zFile.exe

AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.

Missing operator in expression."Unbalanced brackets in expression.

Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.#Variable subscript badly formatted.*Subscript used on non-accessible variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.

0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.

Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.

Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.

3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.

Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

RegAsm.exe_3996:

.text

`.rsrc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPADi

QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

System.Drawing.Bitmap

v4.0.30319

.!///:/_/

Client.exe

System.Core

System.Windows.Forms

System.Drawing

System.Runtime.Serialization

System.Xml

System.Management

System.Security

Microsoft.VisualBasic

user32.dll

kernel32.dll

gdi32.dll

msvcrt.dll

advapi32.dll

shlwapi.dll

Kernel32.dll

shell32.dll

iphlpapi.dll

ole32.dll

ntdll.dll

oleaut32.dll

xClient.Properties.Resources.resources

.ctor

System.Diagnostics

set_WindowStyle

ProcessWindowStyle

set_UseShellExecute

System.IO

System.Threading

.cctor

System.Runtime.CompilerServices

System.Resources

System.Globalization

System.Reflection

System.ComponentModel

System.CodeDom.Compiler

System.Configuration

System.Net.Sockets

get_Port

set_Port

System.Net

Port

xClient.Core.ReverseProxy.Packets

<Port>k__BackingField

port

<LocalPort>k__BackingField

get_LocalPort

set_LocalPort

localPort

LocalPort

add_KeyDown

KeyEventHandler

remove_KeyDown

add_KeyPress

KeyPressEventHandler

remove_KeyPress

add_KeyUp

remove_KeyUp

IKeyboardMouseEvents

xClient.Core.MouseKeyHook

KeyEventArgs

Keys

keyData

isKeyDown

isKeyUp

get_IsKeyDown

set_IsKeyDown

get_IsKeyUp

set_IsKeyUp

System.Runtime.InteropServices

vKey

IsKeyDown

IsKeyUp

KeyPressEventArgs

keyChar

System.Collections.Generic

System.Collections

System.IDisposable.Dispose

System.Collections.Generic.IEnumerator<xClient.Core.MouseKeyHook.KeyPressEventArgsExt>.get_Current

NotSupportedException

System.Collections.IEnumerator.Reset

System.Collections.IEnumerator.get_Current

System.Collections.Generic.IEnumerable<xClient.Core.MouseKeyHook.KeyPressEventArgsExt>.GetEnumerator

System.Collections.IEnumerable.GetEnumerator

System.Collections.Generic.IEnumerator<xClient.Core.MouseKeyHook.KeyPressEventArgsExt>.Current

System.Collections.IEnumerator.Current

<virtualKeyCode>5__1

<keyboardHookStruct>5__4

isMouseKeyDown

isMouseKeyUp

get_IsMouseKeyDown

set_IsMouseKeyDown

get_IsMouseKeyUp

set_IsMouseKeyUp

IsMouseKeyDown

IsMouseKeyUp

SetWindowsHookEx

UnhookWindowsHookEx

Microsoft.Win32.SafeHandles

xClient.Core.MouseKeyHook.WinApi

virtualKeyCode

System.Text

uVirtKey

lpbKeyState

lpwTransKey

wVirtKey

lpKeyState

pbKeyState

GetKeyboardState

GetKeyState

MapVirtualKeyEx

GetKeyboardLayout

CreateKeyListener

xClient.Core.MouseKeyHook.Implementation

m_KeyListenerCache

GetKeyListener

KeyDown

KeyPress

KeyUp

keyboardStateNative

keys

KeyListener

InvokeKeyDown

InvokeKeyPress

InvokeKeyUp

hotkeys

add_OnHotKeysDownHold

remove_OnHotKeysDownHold

add_OnHotKeysUp

remove_OnHotKeysUp

add_OnHotKeysDownOnce

remove_OnHotKeysDownOnce

hotKeyDelegate

ContainsKey

KeyValuePair`2

get_Key

anyKeyInTheExclusiveOrSet

orKeySet

get_KeyCode

HotKeys

HotKeysActivated

get_OSSupportsIPv6

keybd_event

wMsg

EnumDesktopWindows

xClient.Core.Utilities

System.Drawing.Imaging

InvalidOperationException

Keylogger

System.Timers

_pressedKeys

_pressedKeyChars

_ignoreSpecialKeys

OnKeyDown

get_KeyChar

OnKeyPress

OnKeyUp

HighlightSpecialKeys

xClient.Core.Registry

REGISTRY_KEY_CREATE_ERROR

REGISTRY_KEY_DELETE_ERROR

REGISTRY_KEY_RENAME_ERROR

RegistryKey

Microsoft.Win32

CreateRegistryKey

errorMsg

DeleteRegistryKey

RenameRegistryKey

keyPath

GetWritableRegistryKey

rootKeyName

rootKey

GetSubKeyNames

get_SubKeyCount

ProcessKey

keyName

subkeycount

OpenBaseKey

GetRootKey

subkeyFullPath

GetRootKeys

<Key>k__BackingField

<HasSubKeys>k__BackingField

set_Key

get_HasSubKeys

set_HasSubKeys

HasSubKeys

System.Security.Cryptography

get_HostKey

set_HostKey

get_HttpOnly

set_HttpOnly

HostKey

HttpOnly

System.Runtime.Serialization.Json

Microsoft.VisualBasic.CompilerServices

firefoxProfilePath

firefoxPath

OpenSubKey

loadCerts

get_httpRealm

set_httpRealm

get_formSubmitURL

set_formSubmitURL

get_passwordField

set_passwordField

get_encryptedPassword

set_encryptedPassword

get_timePasswordChanged

set_timePasswordChanged

httpRealm

formSubmitURL

passwordField

encryptedPassword

timePasswordChanged

get_logins

set_logins

logins

get_Password

set_Password

Password

System.Linq

urlHash

wstrURL

hKey

ExplorerUrlHistory

xClient.Core.Recovery.Browsers

urlHistory

_urlHistoryList

pocsUrl

QueryUrl

STATURLEnumerator

_staturl

GetUrlHistory

pszUrl

UrlCanonicalize

System.Runtime.InteropServices.ComTypes

System.Collections.IComparer.Compare

UrlString

AddUrl

DeleteUrl

lpSTATURL

get_EnumUrls

EnumUrls

IUrlHistoryStg2

AddUrlAndNotify

keyf

DoWebcamStop

xClient.Core.Packets.ServerPackets

<KeyPath>k__BackingField

get_KeyPath

set_KeyPath

KeyPath

<RemotePort>k__BackingField

get_RemotePort

set_RemotePort

localport

remoteport

RemotePort

DoCreateRegistryKey

DoDeleteRegistryKey

<KeyName>k__BackingField

get_KeyName

set_KeyName

KeyName

DoKeyboardEvent

<KeyDown>k__BackingField

get_KeyDown

set_KeyDown

keyDown

DoLoadRegistryKey

<RootKeyName>k__BackingField

get_RootKeyName

set_RootKeyName

RootKeyName

DoRenameRegistryKey

<OldKeyName>k__BackingField

<NewKeyName>k__BackingField

get_OldKeyName

set_OldKeyName

get_NewKeyName

set_NewKeyName

oldKeyName

newKeyName

OldKeyName

NewKeyName

GetWebcam

<Webcam>k__BackingField

get_Webcam

set_Webcam

webcam

Webcam

GetWebcams

GetPasswords

GetKeyloggerLogs

DoShellExecute

<DownloadURL>k__BackingField

get_DownloadURL

set_DownloadURL

downloadurl

DownloadURL

DoUploadAndExecute

DoVisitWebsite

<URL>k__BackingField

get_URL

set_URL

DoDownloadAndExecute

xClient.Core.Packets.ClientPackets

<ErrorMsg>k__BackingField

get_ErrorMsg

set_ErrorMsg

ErrorMsg

<LocalPorts>k__BackingField

<RemotePorts>k__BackingField

get_LocalPorts

set_LocalPorts

get_RemotePorts

set_RemotePorts

localports

remoteports

LocalPorts

RemotePorts

GetCreateRegistryKeyResponse

GetDeleteRegistryKeyResponse

GetWebcamResponse

GetWebcamsResponse

<Webcams>k__BackingField

get_Webcams

set_Webcams

webcams

Webcams

GetPasswordsResponse

<Passwords>k__BackingField

get_Passwords

set_Passwords

Passwords

GetRegistryKeysResponse

<RootKey>k__BackingField

get_RootKey

set_RootKey

RootKey

GetRenameRegistryKeyResponse

GetKeyloggerLogsResponse

DoShellExecuteResponse

<OperatingSystem>k__BackingField

get_OperatingSystem

set_OperatingSystem

operatingsystem

OperatingSystem

OpenReadonlySubKeySafe

OpenWritableSubKeySafe

CreateSubKey

CreateSubKeySafe

DeleteSubKeyTree

DeleteSubKeyTreeSafe

RenameSubKeySafe

CopyKey

sourceKey

destKey

ContainsSubKey

GetFormattedKeyValues

keyVal

<GetFormattedKeyValues>d__15

<>3__key

System.Collections.Generic.IEnumerator<System.String>.get_Current

System.Collections.Generic.IEnumerable<System.String>.GetEnumerator

System.Collections.Generic.IEnumerator<System.String>.Current

authKey

set_KeySize

xClient.Core.Compression

xClient.Core.NetSerializer

System.Reflection.Emit

<>9__1_0

<>9__1_1

<>9__8_0

<>9__8_1

<>9__8_2

<.ctor>b__8_0

<.ctor>b__8_1

<.ctor>b__8_2

xClient.Core.NetSerializer.TypeSerializers

System.Collections.Generic.IEnumerator<System.Type>.get_Current

System.Collections.Generic.IEnumerable<System.Type>.GetEnumerator

System.Collections.Generic.IEnumerator<System.Type>.Current

<>9__3_0

<>9__4_0

GetSupportedTypes

WindowsIdentity

System.Security.Principal

WindowsPrincipal

WindowsBuiltInRole

System.Text.RegularExpressions

get_Is64BitOperatingSystem

System.Net.NetworkInformation

get_OperationalStatus

OperationalStatus

IsModifierKeysSet

pressedKeys

IsModifierKey

ContainsKeyChar

IsExcludedKey

HttpWebResponse

WebRequest

HttpWebRequest

IWebProxy

WebResponse

get_ExecutablePath

pTcpTable

GetExtendedTcpTable

pTcprow

SetTcpEntry

WebClient

formattedKeyValue

AForge.Video.DirectShow

Join

JoinFilterGraph

ShouldOperationContinue

lMsg

AForge.Video.DirectShow.Internals

TKey

System.Runtime.Versioning

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

12.0.0.0

$3C374A42-BAE4-11CF-BF7D-00AA006946EE

$3C374A41-BAE4-11CF-BF7D-00AA006946EE

$AFA0DC11-C313-11D0-831A-00C04FD5AE38

$3C374A40-BAE4-11CF-BF7D-00AA006946EE

2No longer supported. Use AverageFrameRate instead.

$C6E13370-30AC-11d0-A18C-00A0C9118956

$C6E13380-30AC-11D0-A18C-00A0C9118956

$C6E13340-30AC-11d0-A18C-00A0C9118956

$6A2E0670-28E4-11D0-A18c-00A0C9118956

$56A86895-0AD4-11CE-B03A-0020AF0BA770

$93E5A4E0-2D50-11d2-ABFA-00A0C9C6E38D

$29840822-5B84-11D0-BD3B-00A0C911CE86

$56A86893-0AD4-11CE-B03A-0020AF0BA770

$56A86892-0AD4-11CE-B03A-0020AF0BA770

$56A8689F-0AD4-11CE-B03A-0020AF0BA770

$36B73882-C2C8-11CF-8B46-00805F6CEF60

$56A868A9-0AD4-11CE-B03A-0020AF0BA770

$56A868B1-0AD4-11CE-B03A-0020AF0BA770

$56a868c0-0ad4-11ce-b03a-0020af0ba770

$56A86891-0AD4-11CE-B03A-0020AF0BA770

$55272A00-42CB-11CE-8135-00AA004BB851

$56a86897-0ad4-11ce-b03a-0020af0ba770

$6B652FFF-11FE-4FCE-92AD-0266B5D7C78F

$0579154A-2B53-4994-B0D0-E773148EFF85

$B196B28B-BAB4-101A-B69C-00AA00341D07

Client.Tests

1.3.0.0

).NETFramework,Version=v4.0,Profile=Client

.NET Framework 4 Client Profile

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

_CorExeMain

mscoree.dll

<requestedExecutionLevel level="asInvoker" uiAccess="false" />

<!-- Windows Vista -->

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<!-- Windows 7 -->

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<!-- Windows 8 -->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

<!-- Windows 8.1 -->

<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>

<!-- Windows 10 -->

<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>

<asmv3:windowsSettings xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">

</asmv3:windowsSettings>

xClient.Properties.Resources

<meta http-equiv='Content-Type' content='text/html; charset=utf-8' />Log created on

dd.MM.yyyy HH:mm

New Key #{0}

Cannot create key: Error writing to the registry

Cannot delete key: Error writing to the registry

Cannot rename key: Error writing to the registry

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_CURRENT_CONFIG

Invalid rootkey, could not be found.

Unable to open root registry key, you do not have the needed permissions.

Could not open root registry keys, you may not have the needed permission

({0}:{1})

({0}:{1}:{2})

origin_url

password_value

host_key

httponly

Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7}

SQLite format 3

Not a valid SQLite 3 Database File

Auto-vacuum capable database is not supported

Google\Chrome\User Data\Default\Login Data

Chrome

Google\Chrome\User Data\Default\Cookies

Firefox is not installed, or the install path could not be located

Firefox does not have any profiles, has it ever been launched?

logins.json

Firefox does not have any logins.json file

cookies.sqlite

Firefox does not have any cookie file

Firefox

\firefox.exe

35.0.0

\msvcr100.dll

\msvcp100.dll

\msvcr120.dll

\msvcp120.dll

\mozglue.dll

\nss3.dll

\Mozilla\Firefox\Profiles

Firefox Application Data folder does not exist!

No Firefox profiles could be found

No Firefox logins.json was found

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox

No installs of firefox recorded in its key.

PK11_GetInternalKeySlot

User: {0}{3}Pass: {1}{3}Host: {2}

Opera Software\Opera Stable\Login Data

Opera

Opera Software\Opera Stable\Cookies

Yandex\YandexBrowser\User Data\Default\Login Data

{0}\FileZilla\recentservers.xml

{0}\FileZilla\sitemanager.xml

PublicKeyFile

PortNumber

[PRIVATE KEY LOCATION: "{0}"]

{0}||{1}

Key can not be empty.

C# version only supports level 1 and 3

Multi-dim arrays not supported: {0}

Cannot serialize {0}: ISerializable not supported

Software\Microsoft\Windows\CurrentVersion\Run

:Zone.Identifier

(.{2})(.{2})(.{2})(.{2})(.{2})(.{2})

$1:$2:$3:$4:$5:$6

00:00:00:00:00:00

Mono.Runtime

SELECT Caption FROM Win32_OperatingSystem

^.*(?=Windows)

SELECT * FROM Win32_OperatingSystem WHERE Primary='true'

ControlKey

hXXp://ip-api.com/json/

Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0

hXXp://freegeoip.net/xml/

hXXp://api.ipify.org/

No executable file

hXXp://

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A

Visited Website

{0}{4}{1}{4}{2}{4}{3}

{0} [{1}, {2}]

{0} ({1}) [{2}, {3}]

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce

Only on 64-bit systems supported

URL=file:///

desktop.ini

This video device does not report capabilities.

Unsupported format found.

The video source does not support configuration property page.

Crossbar configuration is not supported by currently running video source.

The video source does not support camera control.

RegAsm.exe_3996_rwx_00070000_0005E000:

.text

`.rsrc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPADi

QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

System.Drawing.Bitmap

v4.0.30319

.!///:/_/

Client.exe

System.Core

System.Windows.Forms

System.Drawing

System.Runtime.Serialization

System.Xml

System.Management

System.Security

Microsoft.VisualBasic

user32.dll

kernel32.dll

gdi32.dll

msvcrt.dll

advapi32.dll

shlwapi.dll

Kernel32.dll

shell32.dll

iphlpapi.dll

ole32.dll

ntdll.dll

oleaut32.dll

xClient.Properties.Resources.resources

.ctor

System.Diagnostics

set_WindowStyle

ProcessWindowStyle

set_UseShellExecute

System.IO

System.Threading

.cctor

System.Runtime.CompilerServices

System.Resources

System.Globalization

System.Reflection

System.ComponentModel

System.CodeDom.Compiler

System.Configuration

System.Net.Sockets

get_Port

set_Port

System.Net

Port

xClient.Core.ReverseProxy.Packets

<Port>k__BackingField

port

<LocalPort>k__BackingField

get_LocalPort

set_LocalPort

localPort

LocalPort

add_KeyDown

KeyEventHandler

remove_KeyDown

add_KeyPress

KeyPressEventHandler

remove_KeyPress

add_KeyUp

remove_KeyUp

IKeyboardMouseEvents

xClient.Core.MouseKeyHook

KeyEventArgs

Keys

keyData

isKeyDown

isKeyUp

get_IsKeyDown

set_IsKeyDown

get_IsKeyUp

set_IsKeyUp

System.Runtime.InteropServices

vKey

IsKeyDown

IsKeyUp

KeyPressEventArgs

keyChar

System.Collections.Generic

System.Collections

System.IDisposable.Dispose

System.Collections.Generic.IEnumerator<xClient.Core.MouseKeyHook.KeyPressEventArgsExt>.get_Current

NotSupportedException

System.Collections.IEnumerator.Reset

System.Collections.IEnumerator.get_Current

System.Collections.Generic.IEnumerable<xClient.Core.MouseKeyHook.KeyPressEventArgsExt>.GetEnumerator

System.Collections.IEnumerable.GetEnumerator

System.Collections.Generic.IEnumerator<xClient.Core.MouseKeyHook.KeyPressEventArgsExt>.Current

System.Collections.IEnumerator.Current

<virtualKeyCode>5__1

<keyboardHookStruct>5__4

isMouseKeyDown

isMouseKeyUp

get_IsMouseKeyDown

set_IsMouseKeyDown

get_IsMouseKeyUp

set_IsMouseKeyUp

IsMouseKeyDown

IsMouseKeyUp

SetWindowsHookEx

UnhookWindowsHookEx

Microsoft.Win32.SafeHandles

xClient.Core.MouseKeyHook.WinApi

virtualKeyCode

System.Text

uVirtKey

lpbKeyState

lpwTransKey

wVirtKey

lpKeyState

pbKeyState

GetKeyboardState

GetKeyState

MapVirtualKeyEx

GetKeyboardLayout

CreateKeyListener

xClient.Core.MouseKeyHook.Implementation

m_KeyListenerCache

GetKeyListener

KeyDown

KeyPress

KeyUp

keyboardStateNative

keys

KeyListener

InvokeKeyDown

InvokeKeyPress

InvokeKeyUp

hotkeys

add_OnHotKeysDownHold

remove_OnHotKeysDownHold

add_OnHotKeysUp

remove_OnHotKeysUp

add_OnHotKeysDownOnce

remove_OnHotKeysDownOnce

hotKeyDelegate

ContainsKey

KeyValuePair`2

get_Key

anyKeyInTheExclusiveOrSet

orKeySet

get_KeyCode

HotKeys

HotKeysActivated

get_OSSupportsIPv6

keybd_event

wMsg

EnumDesktopWindows

xClient.Core.Utilities

System.Drawing.Imaging

InvalidOperationException

Keylogger

System.Timers

_pressedKeys

_pressedKeyChars

_ignoreSpecialKeys

OnKeyDown

get_KeyChar

OnKeyPress

OnKeyUp

HighlightSpecialKeys

xClient.Core.Registry

REGISTRY_KEY_CREATE_ERROR

REGISTRY_KEY_DELETE_ERROR

REGISTRY_KEY_RENAME_ERROR

RegistryKey

Microsoft.Win32

CreateRegistryKey

errorMsg

DeleteRegistryKey

RenameRegistryKey

keyPath

GetWritableRegistryKey

rootKeyName

rootKey

GetSubKeyNames

get_SubKeyCount

ProcessKey

keyName

subkeycount

OpenBaseKey

GetRootKey

subkeyFullPath

GetRootKeys

<Key>k__BackingField

<HasSubKeys>k__BackingField

set_Key

get_HasSubKeys

set_HasSubKeys

HasSubKeys

System.Security.Cryptography

get_HostKey

set_HostKey

get_HttpOnly

set_HttpOnly

HostKey

HttpOnly

System.Runtime.Serialization.Json

Microsoft.VisualBasic.CompilerServices

firefoxProfilePath

firefoxPath

OpenSubKey

loadCerts

get_httpRealm

set_httpRealm

get_formSubmitURL

set_formSubmitURL

get_passwordField

set_passwordField

get_encryptedPassword

set_encryptedPassword

get_timePasswordChanged

set_timePasswordChanged

httpRealm

formSubmitURL

passwordField

encryptedPassword

timePasswordChanged

get_logins

set_logins

logins

get_Password

set_Password

Password

System.Linq

urlHash

wstrURL

hKey

ExplorerUrlHistory

xClient.Core.Recovery.Browsers

urlHistory

_urlHistoryList

pocsUrl

QueryUrl

STATURLEnumerator

_staturl

GetUrlHistory

pszUrl

UrlCanonicalize

System.Runtime.InteropServices.ComTypes

System.Collections.IComparer.Compare

UrlString

AddUrl

DeleteUrl

lpSTATURL

get_EnumUrls

EnumUrls

IUrlHistoryStg2

AddUrlAndNotify

keyf

DoWebcamStop

xClient.Core.Packets.ServerPackets

<KeyPath>k__BackingField

get_KeyPath

set_KeyPath

KeyPath

<RemotePort>k__BackingField

get_RemotePort

set_RemotePort

localport

remoteport

RemotePort

DoCreateRegistryKey

DoDeleteRegistryKey

<KeyName>k__BackingField

get_KeyName

set_KeyName

KeyName

DoKeyboardEvent

<KeyDown>k__BackingField

get_KeyDown

set_KeyDown

keyDown

DoLoadRegistryKey

<RootKeyName>k__BackingField

get_RootKeyName

set_RootKeyName

RootKeyName

DoRenameRegistryKey

<OldKeyName>k__BackingField

<NewKeyName>k__BackingField

get_OldKeyName

set_OldKeyName

get_NewKeyName

set_NewKeyName

oldKeyName

newKeyName

OldKeyName

NewKeyName

GetWebcam

<Webcam>k__BackingField

get_Webcam

set_Webcam

webcam

Webcam

GetWebcams

GetPasswords

GetKeyloggerLogs

DoShellExecute

<DownloadURL>k__BackingField

get_DownloadURL

set_DownloadURL

downloadurl

DownloadURL

DoUploadAndExecute

DoVisitWebsite

<URL>k__BackingField

get_URL

set_URL

DoDownloadAndExecute

xClient.Core.Packets.ClientPackets

<ErrorMsg>k__BackingField

get_ErrorMsg

set_ErrorMsg

ErrorMsg

<LocalPorts>k__BackingField

<RemotePorts>k__BackingField

get_LocalPorts

set_LocalPorts

get_RemotePorts

set_RemotePorts

localports

remoteports

LocalPorts

RemotePorts

GetCreateRegistryKeyResponse

GetDeleteRegistryKeyResponse

GetWebcamResponse

GetWebcamsResponse

<Webcams>k__BackingField

get_Webcams

set_Webcams

webcams

Webcams

GetPasswordsResponse

<Passwords>k__BackingField

get_Passwords

set_Passwords

Passwords

GetRegistryKeysResponse

<RootKey>k__BackingField

get_RootKey

set_RootKey

RootKey

GetRenameRegistryKeyResponse

GetKeyloggerLogsResponse

DoShellExecuteResponse

<OperatingSystem>k__BackingField

get_OperatingSystem

set_OperatingSystem

operatingsystem

OperatingSystem

OpenReadonlySubKeySafe

OpenWritableSubKeySafe

CreateSubKey

CreateSubKeySafe

DeleteSubKeyTree

DeleteSubKeyTreeSafe

RenameSubKeySafe

CopyKey

sourceKey

destKey

ContainsSubKey

GetFormattedKeyValues

keyVal

<GetFormattedKeyValues>d__15

<>3__key

System.Collections.Generic.IEnumerator<System.String>.get_Current

System.Collections.Generic.IEnumerable<System.String>.GetEnumerator

System.Collections.Generic.IEnumerator<System.String>.Current

authKey

set_KeySize

xClient.Core.Compression

xClient.Core.NetSerializer

System.Reflection.Emit

<>9__1_0

<>9__1_1

<>9__8_0

<>9__8_1

<>9__8_2

<.ctor>b__8_0

<.ctor>b__8_1

<.ctor>b__8_2

xClient.Core.NetSerializer.TypeSerializers

System.Collections.Generic.IEnumerator<System.Type>.get_Current

System.Collections.Generic.IEnumerable<System.Type>.GetEnumerator

System.Collections.Generic.IEnumerator<System.Type>.Current

<>9__3_0

<>9__4_0

GetSupportedTypes

WindowsIdentity

System.Security.Principal

WindowsPrincipal

WindowsBuiltInRole

System.Text.RegularExpressions

get_Is64BitOperatingSystem

System.Net.NetworkInformation

get_OperationalStatus

OperationalStatus

IsModifierKeysSet

pressedKeys

IsModifierKey

ContainsKeyChar

IsExcludedKey

HttpWebResponse

WebRequest

HttpWebRequest

IWebProxy

WebResponse

get_ExecutablePath

pTcpTable

GetExtendedTcpTable

pTcprow

SetTcpEntry

WebClient

formattedKeyValue

AForge.Video.DirectShow

Join

JoinFilterGraph

ShouldOperationContinue

lMsg

AForge.Video.DirectShow.Internals

TKey

System.Runtime.Versioning

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

12.0.0.0

$3C374A42-BAE4-11CF-BF7D-00AA006946EE

$3C374A41-BAE4-11CF-BF7D-00AA006946EE

$AFA0DC11-C313-11D0-831A-00C04FD5AE38

$3C374A40-BAE4-11CF-BF7D-00AA006946EE

2No longer supported. Use AverageFrameRate instead.

$C6E13370-30AC-11d0-A18C-00A0C9118956

$C6E13380-30AC-11D0-A18C-00A0C9118956

$C6E13340-30AC-11d0-A18C-00A0C9118956

$6A2E0670-28E4-11D0-A18c-00A0C9118956

$56A86895-0AD4-11CE-B03A-0020AF0BA770

$93E5A4E0-2D50-11d2-ABFA-00A0C9C6E38D

$29840822-5B84-11D0-BD3B-00A0C911CE86

$56A86893-0AD4-11CE-B03A-0020AF0BA770

$56A86892-0AD4-11CE-B03A-0020AF0BA770

$56A8689F-0AD4-11CE-B03A-0020AF0BA770

$36B73882-C2C8-11CF-8B46-00805F6CEF60

$56A868A9-0AD4-11CE-B03A-0020AF0BA770

$56A868B1-0AD4-11CE-B03A-0020AF0BA770

$56a868c0-0ad4-11ce-b03a-0020af0ba770

$56A86891-0AD4-11CE-B03A-0020AF0BA770

$55272A00-42CB-11CE-8135-00AA004BB851

$56a86897-0ad4-11ce-b03a-0020af0ba770

$6B652FFF-11FE-4FCE-92AD-0266B5D7C78F

$0579154A-2B53-4994-B0D0-E773148EFF85

$B196B28B-BAB4-101A-B69C-00AA00341D07

Client.Tests

1.3.0.0

).NETFramework,Version=v4.0,Profile=Client

.NET Framework 4 Client Profile

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

_CorExeMain

mscoree.dll

<requestedExecutionLevel level="asInvoker" uiAccess="false" />

<!-- Windows Vista -->

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<!-- Windows 7 -->

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<!-- Windows 8 -->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

<!-- Windows 8.1 -->

<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>

<!-- Windows 10 -->

<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>

<asmv3:windowsSettings xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">

</asmv3:windowsSettings>

xClient.Properties.Resources

<meta http-equiv='Content-Type' content='text/html; charset=utf-8' />Log created on

dd.MM.yyyy HH:mm

New Key #{0}

Cannot create key: Error writing to the registry

Cannot delete key: Error writing to the registry

Cannot rename key: Error writing to the registry

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_CURRENT_CONFIG

Invalid rootkey, could not be found.

Unable to open root registry key, you do not have the needed permissions.

Could not open root registry keys, you may not have the needed permission

({0}:{1})

({0}:{1}:{2})

origin_url

password_value

host_key

httponly

Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7}

SQLite format 3

Not a valid SQLite 3 Database File

Auto-vacuum capable database is not supported

Google\Chrome\User Data\Default\Login Data

Chrome

Google\Chrome\User Data\Default\Cookies

Firefox is not installed, or the install path could not be located

Firefox does not have any profiles, has it ever been launched?

logins.json

Firefox does not have any logins.json file

cookies.sqlite

Firefox does not have any cookie file

Firefox

\firefox.exe

35.0.0

\msvcr100.dll

\msvcp100.dll

\msvcr120.dll

\msvcp120.dll

\mozglue.dll

\nss3.dll

\Mozilla\Firefox\Profiles

Firefox Application Data folder does not exist!

No Firefox profiles could be found

No Firefox logins.json was found

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox

No installs of firefox recorded in its key.

PK11_GetInternalKeySlot

User: {0}{3}Pass: {1}{3}Host: {2}

Opera Software\Opera Stable\Login Data

Opera

Opera Software\Opera Stable\Cookies

Yandex\YandexBrowser\User Data\Default\Login Data

{0}\FileZilla\recentservers.xml

{0}\FileZilla\sitemanager.xml

PublicKeyFile

PortNumber

[PRIVATE KEY LOCATION: "{0}"]

{0}||{1}

Key can not be empty.

C# version only supports level 1 and 3

Multi-dim arrays not supported: {0}

Cannot serialize {0}: ISerializable not supported

Software\Microsoft\Windows\CurrentVersion\Run

:Zone.Identifier

(.{2})(.{2})(.{2})(.{2})(.{2})(.{2})

$1:$2:$3:$4:$5:$6

00:00:00:00:00:00

Mono.Runtime

SELECT Caption FROM Win32_OperatingSystem

^.*(?=Windows)

SELECT * FROM Win32_OperatingSystem WHERE Primary='true'

ControlKey

hXXp://ip-api.com/json/

Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0

hXXp://freegeoip.net/xml/

hXXp://api.ipify.org/

No executable file

hXXp://

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A

Visited Website

{0}{4}{1}{4}{2}{4}{3}

{0} [{1}, {2}]

{0} ({1}) [{2}, {3}]

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce

Only on 64-bit systems supported

URL=file:///

desktop.ini

This video device does not report capabilities.

Unsupported format found.

The video source does not support configuration property page.

Crossbar configuration is not supported by currently running video source.

The video source does not support camera control.

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:4020
   zFile.exe:3932
   

2. Delete the original Worm file.
   
3. Delete or disinfect the following files created/modified by the Worm:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\qDkfu.jOc (2105 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autA6BA.tmp (3601 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\zFile\zFile.exe (18394 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Hide" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\zFile\zFile.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.