MD5: 0cfc24405ce68891b18ebcc17c7b9d0d
SHA1: a51156cd15312c1782ab3b7b5ed9580ed325186e
SHA256: ec162017a19c3597435086d8ef98ad22a664b11ca3d73e861fe0077392890a65
SSDeep: 6144:2fIi 7pxuqpbLUiCkYufk0CwAZszooW4KycDc66aRTctl5QN4syXe:gqzuE1CXufbCwAu/WnDR1RO8N5T
Size: 356352 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2015-10-03 06:18:36
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1480
%original file name%.exe:276
attrib.exe:440
Server.exe:216
Server.exe:596
Server.exe:1168
Server.exe:316
Server.exe:1648
Server.exe:1924
Server.exe:1856
Server.exe:1968
Server.exe:1944
Server.exe:956
Server.exe:1112
Server.exe:464
Server.exe:420
Server.exe:1016
Server.exe:1124
Server.exe:1136
Server.exe:1932
Server.exe:1956
Server.exe:1792
Server.exe:1756
Server.exe:1088
Server.exe:1700
Server.exe:1600
Server.exe:1820
Server.exe:1680
Server.exe:2000
Server.exe:1748
Server.exe:1360
Server.exe:1976
Server.exe:2008
Server.exe:800
Server.exe:376

The Trojan injects its code into the following process(es):

Server.exe:252
Server.exe:1960
explorer.exe:1632

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:276 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Win\MSstart.exe (2105 bytes)
%System%\SpyNet\Server.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelfDelete.bat (330 bytes)

The process Server.exe:252 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\SpyNet\logs_VCAQ58cSQ5cAQ\logs_29-10-2015.txt (290 bytes)

The process Server.exe:1960 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

Registry activity

The process %original file name%.exe:1480 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 77 74 33 B9 14 4F 52 30 83 A3 55 AF 18 89 3C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process %original file name%.exe:276 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}]
"StubPath" = "%System%\SpyNet\Server.exe restart"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%\spynet]
"server.exe" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"SelfDelete.bat" = "SelfDelete"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"Server" = "%System%\SpyNet\Server.exe"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE D8 81 06 1B B9 9A 2A 7F 60 BA 36 F2 6A AC 38"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = "C:\Win\MSstart.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Server" = "%System%\SpyNet\Server.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = "C:\Win\MSstart.exe"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe %System%\SpyNet\Server.exe"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Server" = "%System%\SpyNet\Server.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe %System%\SpyNet\Server.exe"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Server" = "%System%\SpyNet\Server.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Server" = "%System%\SpyNet\Server.exe"

The process attrib.exe:440 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 31 D4 42 07 9F 85 89 54 62 0E 0D 8C D9 A6 AA"

The process Server.exe:216 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5C 47 C3 63 66 2B B0 FD 8A 22 C4 2A 13 85 A8 AC"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:596 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 51 B5 D3 98 D4 58 D6 DF 37 1F CB 98 1F AC 5E"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1168 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA 62 6D 60 A5 4F E1 78 A2 E9 D7 CE 21 78 AD F3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:316 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 70 16 FC BD 04 44 91 00 33 EC 63 93 78 B1 1B"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1648 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A 4B 8B 4B C8 DC AE FB 3A FD 87 54 FF FB D0 60"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1924 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 0D EA 8A D6 47 6D 33 A8 8D D3 EA BF 59 61 7C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1856 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B D1 F4 6C BA 56 71 94 D8 9A 86 F2 5F F2 98 A9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:252 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FF 20 95 34 A1 15 F0 F9 A7 A6 12 5D 46 1D B7 61"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"
"FakeMessage" = "OK"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer"

The process Server.exe:1968 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CA BD 7C D1 8A 20 32 8C 28 F9 31 60 AD 83 24 D1"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1960 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B 8A 1F F4 77 7B 0A E3 66 7E 53 EA 52 5E 22 69"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer"

The process Server.exe:1944 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 60 F3 95 4F 68 28 12 28 7A 46 3C A5 EA 6F A8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:956 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 DB 41 C8 5D 3C 3E 03 E4 F8 20 36 92 84 F8 8F"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1112 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F 7B 78 C7 C7 1A BE 62 90 BC 21 B8 6B D7 A2 D6"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:464 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 24 76 90 86 D7 97 2B B4 F0 57 5B 0A 1A 62 1F"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:420 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA 93 8F CE E4 5F A9 DE 6D 2C 79 9C 37 FA 34 91"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1016 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 98 DB 64 15 44 E8 4F E6 58 EB 06 B7 C4 29 EB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1124 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 F7 57 98 75 9D 5F 83 07 0E 99 BF D0 FE A3 73"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1136 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 A0 EF 62 7F 24 91 CC 81 0E F1 1B 32 57 B7 48"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1932 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 89 43 C4 2C 9D E9 63 55 BA 35 20 A4 7D 40 1D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1956 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "58 33 7A C3 9E 73 5A 01 28 89 6D F4 E2 A5 5F 7F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1792 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 58 1A DC D1 13 5E 17 A8 53 B9 3C 36 EC 1A 4F"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1756 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE 2B AE 12 87 A4 6F 17 1C 65 E7 3E 42 D2 2E 50"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1088 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC 78 AD A1 DF 0A 12 9F 7F 8B E6 58 EB 01 A1 18"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1700 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 30 6C F6 1A 85 FE 90 CA 24 6B C0 B1 C8 78 8E"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1600 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 30 4D 8A C3 5C 05 10 DE 0B B8 B7 5F DC 8B 3E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1820 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 33 4B 4C AC CD D2 5E 0E 32 3A 63 7E 43 0E 03"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:1680 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 85 70 0B 6A 0D 7F C4 E2 1F BC 2A D4 3E 5C D9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:2000 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "26 AD DF 06 AB 14 44 67 63 3C 77 6D EB 4B EF 2F"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1748 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 4B 9E E5 27 37 5C FF 99 44 5F B7 25 97 D0 5E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1360 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 32 7A FB F5 F5 AE F1 2D 43 9E B0 AF 04 26 23"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:1976 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 89 2F DF 02 4F C8 9D 7E 6C 55 EC 84 57 4E 98"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Server.exe:2008 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B 62 16 EF 28 4B B7 E9 F9 80 60 ED 87 18 04 0F"

[HKCU\Software\Microsoft\VCAQ58cSQ5cAQ]
"InstalledServer" = "%System%\SpyNet\Server.exe"

The process Server.exe:800 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 D6 BF ED 21 C5 21 F8 1D F3 95 1F E5 89 D1 5E"

The process Server.exe:376 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 AD 4B 0F FD 96 CB AD BE 55 DB 17 B2 6E 78 FF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version: 0.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename: z1aca5jg.exe
Internal Name: z1aca5jg.exe
File Version: 0.0.0.0
File Description:
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://www.google.com/	173.194.113.210
www.google.com.ua

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=NG4yVqHaEYrBsAH7rJjIBQ

Content-Length: 262

Date: Thu, 29 Oct 2015 19:06:28 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=NG4yVqHaEYrB
sAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=NG4yVqHaEYrBsAH7r
JjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:06:28 GMT..Serve
r: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type"
 content="text/html;charset=utf-8">.<TITLE>302 Moved</TITL
E></HEAD><BODY>.<H1>302 Moved</H1>.The docu
ment has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=
NG4yVqHaEYrBsAH7rJjIBQ">here</A>...</BODY></HTML>
......


GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=N24yVqDMKorBsAH7rJjIBQ

Content-Length: 262

Date: Thu, 29 Oct 2015 19:06:31 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=N24yVqDMKorB
sAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=N24yVqDMKorBsAH7r
JjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:06:31 GMT..Serve
r: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type"
 content="text/html;charset=utf-8">.<TITLE>302 Moved</TITL
E></HEAD><BODY>.<H1>302 Moved</H1>.The docu
ment has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=
N24yVqDMKorBsAH7rJjIBQ">here</A>...</BODY></HTML>
......


GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Q24yVvHlGorBsAH7rJjIBQ

Content-Length: 262

Date: Thu, 29 Oct 2015 19:06:43 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Q24yVvHlGorB
sAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Q24yVvHlGorBsAH7r
JjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:06:43 GMT..Serve
r: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type"
 content="text/html;charset=utf-8">.<TITLE>302 Moved</TITL
E></HEAD><BODY>.<H1>302 Moved</H1>.The docu
ment has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=
Q24yVvHlGorBsAH7rJjIBQ">here</A>...</BODY></HTML>
......


GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=S24yVrncJYvCsAHQ1LGwDw

Content-Length: 262

Date: Thu, 29 Oct 2015 19:06:51 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=S24yVrncJYvC
sAHQ1LGwDw">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=S24yVrncJYvCsAHQ1
LGwDw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:06:51 GMT..Serve
r: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type"
 content="text/html;charset=utf-8">.<TITLE>302 Moved</TITL
E></HEAD><BODY>.<H1>302 Moved</H1>.The docu
ment has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=
S24yVrncJYvCsAHQ1LGwDw">here</A>...</BODY></HTML>
......


GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Tm4yVuGbMIHDsAHqvauoAw

Content-Length: 262

Date: Thu, 29 Oct 2015 19:06:54 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Tm4yVuGbMIHD
sAHqvauoAw">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Tm4yVuGbMIHDsAHqv
auoAw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:06:54 GMT..Serve
r: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type"
 content="text/html;charset=utf-8">.<TITLE>302 Moved</TITL
E></HEAD><BODY>.<H1>302 Moved</H1>.The docu
ment has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=
Tm4yVuGbMIHDsAHqvauoAw">here</A>...</BODY></HTML>
......


GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Um4yVvQMisGwAfusmMgF

Content-Length: 260

Date: Thu, 29 Oct 2015 19:06:58 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Um4yVvQMisGw
AfusmMgF">here</A>...</BODY></HTML>..HTTP/1.1 302
 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8
..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Um4yVvQMisGwAfusmMg
F..Content-Length: 260..Date: Thu, 29 Oct 2015 19:06:58 GMT..Server: G
FE/2.0..<HTML><HEAD><meta http-equiv="content-type" con
tent="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE>
;</HEAD><BODY>.<H1>302 Moved</H1>.The document
 has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Um4y
VvQMisGwAfusmMgF">here</A>...</BODY></HTML>..nt>....


GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=VW4yVp_vB4rBsAH7rJjIBQ

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:01 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=VW4yVp_vB4rB
sAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=VW4yVp_vB4rBsAH7r
JjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:01 GMT..Serve
r: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type"
 content="text/html;charset=utf-8">.<TITLE>302 Moved</TITL
E></HEAD><BODY>.<H1>302 Moved</H1>.The docu
ment has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=
VW4yVp_vB4rBsAH7rJjIBQ">here</A>...</BODY></HTML>
......


GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=WG4yVt-aEcKDsAGtj5eYAw

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:04 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=WG4yVt-aEcKD
sAGtj5eYAw">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=WG4yVt-aEcKDsAGtj
5eYAw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:04 GMT..Serve
r: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type"
 content="text/html;charset=utf-8">.<TITLE>302 Moved</TITL
E></HEAD><BODY>.<H1>302 Moved</H1>.The docu
ment has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=
WG4yVt-aEcKDsAGtj5eYAw">here</A>...</BODY></HTML>
......


GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=W24yVu_9GovCsAHQ1LGwDw

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:07 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=W24yVu_9GovC
sAHQ1LGwDw">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=W24yVu_9GovCsAHQ1
LGwDw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:07 GMT..Serve
r: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type"
 content="text/html;charset=utf-8">.<TITLE>302 Moved</TITL
E></HEAD><BODY>.<H1>302 Moved</H1>.The docu
ment has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=
W24yVu_9GovCsAHQ1LGwDw">here</A>...</BODY></HTML>
......


GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Xm4yVvatIoHDsAHqvauoAw

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:10 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Xm4yVvatIoHD
sAHqvauoAw">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Xm4yVvatIoHDsAHqv
auoAw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:10 GMT..Serve
r: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type"
 content="text/html;charset=utf-8">.<TITLE>302 Moved</TITL
E></HEAD><BODY>.<H1>302 Moved</H1>.The docu
ment has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=
Xm4yVvatIoHDsAHqvauoAw">here</A>...</BODY></HTML>
......


GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=YW4yVsDTKIrBsAH7rJjIBQ

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:13 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=YW4yVsDTKIrB
sAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=YW4yVsDTKIrBsAH7r
JjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:13 GMT..Serve
r: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type"
 content="text/html;charset=utf-8">.<TITLE>302 Moved</TITL
E></HEAD><BODY>.<H1>302 Moved</H1>.The docu
ment has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=
YW4yVsDTKIrBsAH7rJjIBQ">here</A>...</BODY></HTML>
......


GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=ZG4yVoTiL4rBsAH7rJjIBQ

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:16 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=ZG4yVoTiL4rB
sAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=ZG4yVoTiL4rBsAH7r
JjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:16 GMT..Serve
r: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type"
 content="text/html;charset=utf-8">.<TITLE>302 Moved</TITL
E></HEAD><BODY>.<H1>302 Moved</H1>.The docu
ment has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=
ZG4yVoTiL4rBsAH7rJjIBQ">here</A>...</BODY></HTML>
......


GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Z24yVueqN4rBsAH7rJjIBQ

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:19 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Z24yVueqN4rB
sAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Z24yVueqN4rBsAH7r
JjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:19 GMT..Serve
r: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type"
 content="text/html;charset=utf-8">.<TITLE>302 Moved</TITL
E></HEAD><BODY>.<H1>302 Moved</H1>.The docu
ment has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=
Z24yVueqN4rBsAH7rJjIBQ">here</A>...</BODY></HTML>
......


GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=a24yVqsHi8KwAdDUsbAP

Content-Length: 260

Date: Thu, 29 Oct 2015 19:07:22 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=a24yVqsHi8Kw
AdDUsbAP">here</A>...</BODY></HTML>..HTTP/1.1 302
 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8
..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=a24yVqsHi8KwAdDUsbA
P..Content-Length: 260..Date: Thu, 29 Oct 2015 19:07:22 GMT..Server: G
FE/2.0..<HTML><HEAD><meta http-equiv="content-type" con
tent="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE>
;</HEAD><BODY>.<H1>302 Moved</H1>.The document
 has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=a24y
VqsHi8KwAdDUsbAP">here</A>...</BODY></HTML>..nt>....


GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVq3yGIvCsAHQ1LGwDw

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:26 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVq3yGIvC
sAHQ1LGwDw">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVq3yGIvCsAHQ1
LGwDw..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:26 GMT..Serve
r: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type"
 content="text/html;charset=utf-8">.<TITLE>302 Moved</TITL
E></HEAD><BODY>.<H1>302 Moved</H1>.The docu
ment has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=
bm4yVq3yGIvCsAHQ1LGwDw">here</A>...</BODY></HTML>
......


GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVpiaKorBsAH7rJjIBQ

Content-Length: 262

Date: Thu, 29 Oct 2015 19:07:26 GMT

Server: GFE/2.0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVpiaKorB
sAH7rJjIBQ">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=bm4yVpiaKorBsAH7r
JjIBQ..Content-Length: 262..Date: Thu, 29 Oct 2015 19:07:26 GMT..Serve
r: GFE/2.0..<HTML><HEAD><meta http-equiv="content-type"
 content="text/html;charset=utf-8">.<TITLE>302 Moved</TITL
E></HEAD><BODY>.<H1>302 Moved</H1>.The docu
ment has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe..

The Trojan connects to the servers at the folowing location(s):

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.Fg

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

explorer.exe_1632:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

BROWSEUI.dll

GDI32.dll

KERNEL32.dll

NTDLL.DLL

msvcrt.dll

ole32.dll

OLEAUT32.dll

SHDOCVW.dll

SHELL32.dll

SHLWAPI.dll

USER32.dll

UxTheme.dll

FTSSh

t0SSh

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system

SShwk

98~%SP

ExplorerStartMsgLoop

PSSh;

6SSSSh

SSSSh

SPSSSShL

u%SSh

t.WWWW

xpsp2res.dll

xpsp3res.dll

tbSSh

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel

kernel32.dll

GetSystemWindowsDirectoryW

NetGetJoinInformation

WINMM.dll

SETUPAPI.dll

WINSTA.dll

OLEACC.dll

USERENV.dll

ntdll.dll

RegEnumKeyExW

RegNotifyChangeKeyValue

RegOpenKeyExA

RegEnumKeyW

RegCloseKey

RegCreateKeyW

RegQueryInfoKeyW

RegOpenKeyExW

RegCreateKeyExW

OffsetViewportOrgEx

GetViewportOrgEx

SetViewportOrgEx

SetProcessShutdownParameters

GetProcessHeap

GetWindowsDirectoryW

CreateIoCompletionPort

ShellExecuteExW

SHRegCloseUSKey

SHRegCreateUSKeyW

AssocQueryKeyW

SHRegOpenUSKeyW

SHDeleteKeyW

TileWindows

ExitWindowsEx

RegisterHotKey

UnregisterHotKey

EnumChildWindows

GetKeyState

GetAsyncKeyState

CascadeWindows

MsgWaitForMultipleObjects

EnumWindows

explorer.pdb

name="Microsoft.Windows.Shell.explorer"

version="5.1.0.0"

<description>Windows Shell</description>

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

]]"```^]]\

3333333330

3333330

333333334

)@.   '5 !*

.DEHHF>?/

2<===@@=

&$%Uooqkezs

['$$#%&(4

3333333333333333333

33333333333330

7'''')) 

3'')))33.

222`444(555

%%%{///-

000000000

00000000

`[66...00

0000000

`]66./.000

/./././././././.

66///0000

0000000000000

0000000000

6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001

4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000

:;<;:;<;:;<;:;<;:;<0

)   )   )   )   )

|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),, 

22222222222

3333333

.SB99;;;99twv}ut{oxt~

.SB;;;:::2:w}{{qddgghg

" """ """ """ """ "" #

""" """ """ "#

.SG>''';;9::p

:5:5:5:5:5:5:5:5:5:5#"

# # # # # # # # # # # # # # # # # # # # # ##$

( # # # # # # # # # # # # # # # # # # # # ###

1232123212321232123

(&(((&(((&(((&(((&((&&)

&(((&(((&(((&()

`,''')))

'4,4'4,4'4,4'4,4'4,4)(

55///0000

5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0

555555555

55555555

5555555

14441444144414441

4343434343434343

5555555555555

5555555555

-,-,-,-,-,-,-,-,-,-,-*.

..............................JFJFJFJFJFJFJFJFJFJFJ.-

{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../

|ujjjjuhF..BBBBBBBBBBBBT

~j|F.BB*BBB*BBB*Bwop

&!!!&!!!&

44466666

44444444416

4446666

66666666

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= 

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= 

DDDDE%CTDD@

A%US$

%UUUU

%%UUU

33U

""2222!!

!"!"%UUR""

!""!"#2"""

"!!"#3"!"

dnnnnn:n.nfCnmddddd

////;/;;88

;888;;!/

!//!!;;^

:;:!::!!!

.88.88.8

.N.NN.M

::8.8...

:::!;;:!

//!!;888

.8.8.88...

:;!::!!;!//!;

!!;:!!::

.88..8..

!!:::/^!

!;/;!;;;!!!:

.8:!!!!^

!!:;:::..

/:!^^!;{8{../

...:::.-

**6***66*6**6566*5666 ,

6*6666*6*6 655*65

6*65 56*5 55  555 *5  6

555( 55 (5 5(  

76 5   66  555*677

6*6 5 5(5 (55( '5((5 (556 ('5

665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU

555(555(5((5(5(5(

5 5 5 5555 (555(555'(((5(5('55(((

((''('5'5(5('('('('('((''('(((@(((('&(((&

%&&%&&&&3>&3&3&33&3&3333&&3>3333

'(3&'&3&

3&33&&((

3323>33>%>3%>3>33>3%3&%

*5'(('((&@3(

,63%3>323>3%>&>33323>>%>

3(3'(((@@'5('@(@(&('(

>2>323%>3

75((((@3&333&3&&&%&3&&3&33>33%3>23%>3

>2%$32%>2>%>2$3>

3&%&&3&33>3>33

3>%>3%&3$23>23$2>2%$>2>

)4433((&(&('*

('((((''(**6(('' *

32323>3>

2$%>22%>%3' (

&(&''((5(5 *

'(&(&((&('''

&&%&3&&%3%

2%>22>22

5''3(((3(('&(&'&

3%%3%3%2#$

22$22$2%$22$2%2%$2%$2$222%$22

&>2$2$2$222$22$%%

:7'((('(3('(3(&(&

222222222222

22222222222222

222222222222222

22$22$22$22$

&(%3%&&&&3&&&3%3

222222222222222222

&&(&3(&(&'('((3'(&&

2222222

22$<$$2$22$%

&&(3(3('(&'

222"2212

22<2<22"

(&(3(3((

((565 ((( 6

333&33(&&

'(('('(('( 

 '&%%"$

2"2"22"2

2222<2"222

"2"22<2<22

2%('(3'32222?&'

2"2"2"121212<

2"2"2$"?

%%22%2

&3(3(3((&

"2"<"2<2<

<2<"<"<"<

1"?((&21

<?<?22<$2

2%""22&&

2<2$$2222

'&('(3(''

((%%%"

5(3%"%

"2%5*67

))) ))))

""**<****"""

"*<<<<*"

#2#---2222-222442-

--&#-(-%

$/222(--444222!

#&-221269924999;

&$-22-($2%

#(2---222622212-

#2221299629968

#&--%#(2##!

-222422422426662-%

"2-##&

!##-#&#-&&#%---#---#&-219662%

$&-(151,44.9

&1242662-

-(..19.19

,4492.12

12-$-,-,

-, $$----

#%#-15/-&

-,(,,(,(,

$$11651566/,$&&

,2592&&&-

2466/!$$

""*<*"****""

) '????[

&&&$-556>>61,,5994511-

$(//$$$(6>6/,$,-$

#$-22692/,,$,-&

-266661..4514#

&,2-&&##

&-222,22--#

#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88

&!#&!-##

&#--//11468>885882&

$266961$&--$&%

,1661,!-((#

&$,4255$,92

&$,44..&

""**""***""

"****<*<<**"

"**""""*""""

&-569./-,16522$

.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\

bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(

.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87

yzyzyzym^Z]WN3   $&$.Wt\

""*"""****""""

"***"**""**<**"

$5612,.2,

&$$,,,5]

$]t.Ft

7%8U8

3 303<3]3

2<3

8 8$8(8,8084888<8}8

5%5,575{6

<,<0<4<8<

7 7$7(7,70747

rundll32.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

::{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}

::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}

::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}

::{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}

::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}

::{D20EA4E1-3957-11d2-A40B-0C5020524153}

::{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}

{208D2C60-3AEA-1069-A2D7-08002B30309D}

{20D04FE0-3AEA-1069-A2D8-08002B30309D}

Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites

{450D8FBA-AD25-11D0-98A8-0800361B1103}

CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}

Software\Microsoft\Windows\CurrentVersion\RunOnce

Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

Software\Microsoft\Windows\CurrentVersion\Explorer\DontShowMeThisDialogAgain

Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz

\\.\WMIDataDevice

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Software\Microsoft\Windows NT\CurrentVersion\Windows

ExplorerIsShellMutex

desk.cpl

Software\Microsoft\Windows\CurrentVersion\Explorer

tourstart.exe

tourstart.exe,0

Microsoft.OfferTour

WINWORD.EXE

Software\Microsoft\Windows\CurrentVersion\Applets

Software\Microsoft\Windows\CurrentVersion\Applets\Tour

explorer.exe,9

Microsoft.FixScreenResolution

shell:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}

Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation

Software\Microsoft\Windows NT\CurrentVersion

shell:::{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}

Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

DDEEXECUTESHORTCIRCUIT

http\shell

IEXPLORE.EXE

Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop

Software\Microsoft\Windows\CurrentVersion\RunOnceEx

comctl32.dll

Software\Microsoft\Windows\Internet Settings

AutoConfigURL

system.ini

AppEvents\Schemes\Apps\.Default\%s\.current

Software\Microsoft\Windows\CurrentVersion\Explorer\TrayNotify

MSShellRunDlgReady

res://mys.dll/mys.hta /explorer

mshta.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\Welcome

Software\Microsoft\Windows\CurrentVersion\Explorer\Tips

SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\MYS

cys.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\srvWiz

install.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel

OUTLOOK.EXE

explorer.exe,16

iernonce.dll

WININET.DLL

UpdateURL

WindowsUpdate

HWND%x

Software\Microsoft\Windows\CurrentVersion\OemStartMenuData

fldrclnr.dll,Wizard_RunDLL

iexplore.exe

winbrand.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Remote\%d

shell32.dll

nusrmgr.cpl ,initialTask=ChangePicture

NewExeName

Windows

ediskeer.dll

timedate.cpl

Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedMRU

Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSaveMRU

Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU

Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Software\Microsoft\Internet Explorer\TypedURLs

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Calculator.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Games\Solitaire.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Paint.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\WordPad.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Windows Movie Maker.lnk

%USERPROFILE%\Start Menu\Programs\Accessories\Tour Windows XP.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Windows Messenger.lnk

%USERPROFILE%\Start Menu\Programs\Windows Media Player.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\MSN.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Get Online with MSN.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Get Going with Tablet PC.lnk

%ALLUSERSPROFILE%\Start Menu\Set Program Access and Defaults.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Windows Journal.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Media Center\Media Center.lnk

%USERPROFILE%\Start Menu\Programs\Internet Explorer.lnk

Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel

TSAppCMP.DLL

netapi32.dll

%SystemRoot%\system32\restore\rstrui.exe

RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%s

RunDLL32.EXE

%s%d%s

Software\Microsoft\Windows\CurrentVersion\Policies\System

settings.dll

explorer.exe "

explorer.exe /e, "

WindowsLogon

WindowsLogoff

%s %s

Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

uAppWiz.Cpl

\explorer.exe

Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu

::{20D04FE0-3AEA-1069-A2D8-08002B30309D}

taskmgr.exe

ShellExecute

Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d

\WindowsShell.Manifest

Get Online with MSN.lnk

Set Program Access and Defaults.lnk

Link%d

OEM%d

Software\Microsoft\Windows\CurrentVersion\SMDEn

::{D20EA4E1-3957-11d2-A40B-0C5020524152}

There is a file or folder on your computer called "%s" which could cause certain applications to not function correctly. Renaming it to "%s" would solve this problem. Would you like to rename it now?

Ca&scade Windows

Tile Windows &Horizontally

Tile Windows V&ertically

&Windows Security...

&Help and Support

&Log Off %s...

Windows Explorer

6.00.2900.5512 (xpsp.080413-2105)

EXPLORER.EXE

Windows

Operating System

6.00.2900.5512

Keep the &taskbar on top of other windows

To remove records of recently accessed documents, programs, and Web sites, click Clear.

Windows displays icons for active and urgent notifications, and hides inactive ones. You can change this behavior for items in the list below.

Select this option to use the menu style from earlier versions of Windows.

6There is not enough memory to complete this operation.8Unable to run command.

The folder '%1' has been removed.WMy Computer or Windows Explorer has not been properly initialized yet. Try again later.

&Undo %s

Windows is running in safe mode.

This special diagnostic mode of Windows enables you to fix a problem which may be caused by your network or hardware settings. Make sure these settings are correct in Control Panel, and then try starting Windows again. While in safe mode, some of your devices may not be available.

startRThere was an internal error and one of the windows you were using has been closed.

Restrictions{This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.

&Show Open Windows

Windows was unable to change the display settings for the new configuration. Return the computer to the previous state, shut down Windows, and restart the computer in the desired configuration.

There may be a problem with your display settings if you continue. To safely change to a new configuration, you should shut down Windows and restart the computer in the desired configuration. Do you want to continue anyway?

This pre-release version of "Internet Explorer 4.0" Desktop/Explorer has expired. Please update to the latest release of "Internet Explorer 4.0" from WWW.MICROSOFT.COM

helpctr.exe>-FromStartHelp

Take a tour of Windows XP

NOpens a window where you can pick search options and work with search results.aOpens a central location for Help topics, tutorials, troubleshooting, and other support services.

/Opens a program, folder, document, or Web site.

Provides options for closing your programs and logging off, or for leaving your programs running and switching to another user.lProvides options for turning off or restarting your computer, or for activating Stand By or Hibernate modes.RDisconnects your session. You can reconnect to the session when you log on again.

&Windows Security

iOpens the My Documents folder, where you can store letters, reports, notes, and other kinds of documents./Displays recently opened documents and folders.KOpens the My Music folder, where you can store music and other audio files.]Opens the My Pictures folder, where you can store digital photos, images, and graphics files.zGives access to, and information about, the disk drives, cameras, scanners, and other hardware connected to your computer.MGives access to, and information about, folders and files on other computers.8Connects to other computers, networks, and the Internet.

explorer.exe_1632_rwx_00C80000_000F0000:

`.rsrc

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

EInvalidOperation

u%CNu

%s[%d]

EIdCanNotBindPortInRange

EIdInvalidPortRange(,

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pas

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pas

WS2_32.DLL

MSWSOCK.DLL

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WSARecvMsg

WSASendMsg

Wship6.dll

Fwpuclnt.dll

TIdSocketListWindows

TIdStackWindowsU

Kernel32.dll

EIdIPVersionUnsupportedT

127.0.0.1

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pas

EIdPortRequiredp

EIdTCPConnectionError

EIdObjectTypeNotSupported

ftpTransfer

ftpReady

ftpAborted

PortT

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pas

ClientPortMin

ClientPortMax

Port

"EIdTransparentProxyUDPNotSupported

TIdTCPConnection

IdTCPConnection

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pas

TIdTCPClientCustom

TIdTCPClientCustomDh

IdTCPClient

TIdTCPClient

BoundPortT

%EIdSocksUDPNotSupportedBySOCKSVersion

saUsernamePassword

Password

0.0.0.1

0.0.0.0

BoundPort

DefaultPort

ole32.dll

sqlite3_bind_blob

sqlite3_bind_text

sqlite3_bind_double

sqlite3_bind_int

sqlite3_bind_int64

sqlite3_bind_null

sqlite3_bind_parameter_index

sqlite3_open

sqlite3_close

sqlite3_errmsg

sqlite3_errcode

sqlite3_free

sqlite3_prepare_v2

sqlite3_column_count

sqlite3_column_name

sqlite3_column_decltype

sqlite3_step

sqlite3_column_blob

sqlite3_column_bytes

sqlite3_column_double

sqlite3_column_text

sqlite3_column_type

sqlite3_column_int64

sqlite3_finalize

sqlite3_reset

SQL error or missing database

An internal logic error in SQLite

Operation terminated by sqlite3_interrupt()

Uses OS features not supported on host

2nd parameter to sqlite3_bind out of range

sqlite3_step() has another row ready

sqlite3_step() has finished executing

Unknown SQLite Error Code "

ESQLiteException

TSQLiteDatabase

TSQLiteTable

Failed to open database "%s" : %s

Failed to open database "%s" : unknown error

Error [%d]: %s.

"%s": %s

Error executing SQL

Could not prepare SQL statement

Error executing SQL statement

SQLite is Busy

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox\

SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\

1234567890.

mozsqlite3.dll

sqlite3.dll

MSVCR100.dll

mozglue.dll

mozcrt19.dll

mozutils.dll

nspr4.dll

plc4.dll

plds4.dll

nssutil3.dll

nss3.dll

PK11_GetInternalKeySlot

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

signons.sqlite

SELECT * FROM moz_logins

encryptedPassword

SOFTWARE\Microsoft\Windows\CurrentVersion

Microsoft\Network\Connections\pbk\rasphone.pbk

rasapi32.dll

rnaph.dll

RAS Passwords

advapi32.dll

crypt32.dll

uURLHistory

abe2869f-9b47-4cd9-a358-c22904dba7f7

UnitPasswords

WindowsLive:name=*

\Mozilla Firefox\

softokn3.dll

userenv.dll

profiles.ini

\signons3.txt

\signons2.txt

\signons1.txt

\signons.txt

\\.\pipe\wzcsvc_wep_keys

winlogon.exe

SafariPasswordRecovery

AVURLProtocol_Classic

\Apple Computer\Preferences\keychain.plist

\Apple\Apple Application Support\CFNetwork.dll

hXXp://

PTF://

*PTF://

hXXps://

gdiplus.dll

GdiplusShutdown

EInvalidGraphicOperation

WbemScripting.SWbemLocator

%s\%s

SELECT * FROM %s

pathToSignedProductExe

pathToSignedReportingExe

WbemScripting.SWbemDateTime

HExecQuery

TargetOperatingSystem

NumberOfMediaSupported

PowerManagementSupported

SCSIPort

Select * from Win32_Keyboard

NumberOfFunctionKeys

MaxMemorySupported

Monochrome

ProtocolSupported

AdminPasswordStatus

BootROMSupported

InfraredSupported

KeyboardPasswordStatus

PowerOnPasswordStatus

SupportContactDescription

Select * from Win32_OperatingSystem

WindowsDirectory

Select Caption,BuildNumber,CSDVersion from Win32_OperatingSystem

TKeylogger

TIdTCPClientNew

Please, send a email to SpyNetCoder ---> [email protected]

TWebcam

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.irv:1983

csISO16Portuguese

csISO84Portuguese2

windows-936

csShiftJIS

windows-874

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csMicrosoftPublishing

Windows-31J

csWindows31J

PTCP154

csPTCP154

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

HTTP-EQUIV

()<>@,;:\"./

()<>@,;:\"/[]?=

()<>@,;:\"/[]?={}

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pas

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pas

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pas

IdCustomTCPServer

TIdCustomTCPServer

TIdCustomTCPServerX

DefaultPortt

EIdTCPServerError

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pas

EIdTCPNoOnExecute

TIdTCPServer

IdTCPServer

OnExecute

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas

%s User

CmdDelimiter

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas

'TIdCmdTCPServerAfterCommandHandlerEvent

TIdCmdTCPServer

(TIdCmdTCPServerBeforeCommandHandlerEvent

IdCmdTCPServer

Displays commands that the servers supports.

TIdTCPStream

IdRead() method of TIdTCPStream class does not support seeking

TIdHTTPProxyTransferMode

TIdHTTPProxyServerContext

TIdHTTPProxyServerContextlS

TOnHTTPContextEvent

TOnHTTPDocument

TIdHTTPProxyServer

OnHTTPBeforeCommand

OnHTTPResponse8T

OnHTTPDocument

HTTP/1.0

HTTP/1.0 200 Connection established

HNetCfg.NATUPnP

StaticPortMappingCollection

PSAPI.dll

shlwapi.dll

TSendKey

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

SetupApi.dll

SetupDiOpenClassRegKey

SetupDiOpenClassRegKeyExA

SetupDiOpenClassRegKeyExW

SetupDiCreateDeviceInterfaceRegKeyA

SetupDiCreateDeviceInterfaceRegKeyW

SetupDiOpenDeviceInterfaceRegKey

SetupDiDeleteDeviceInterfaceRegKey

SetupDiCreateDevRegKeyA

SetupDiCreateDevRegKeyW

SetupDiOpenDevRegKey

SetupDiDeleteDevRegKey

CM_DEVCAP_LOCKSUPPORTED

CM_DEVCAP_EJECTSUPPORTED

PDCAP_D0_SUPPORTED

PDCAP_D1_SUPPORTED

PDCAP_D2_SUPPORTED

PDCAP_D3_SUPPORTED

PDCAP_WAKE_FROM_D0_SUPPORTED

PDCAP_WAKE_FROM_D1_SUPPORTED

PDCAP_WAKE_FROM_D2_SUPPORTED

PDCAP_WAKE_FROM_D3_SUPPORTED

PDCAP_WARM_EJECT_SUPPORTED

iphlpapi.dll

AllocateAndGetTcpExTableFromStack

AllocateAndGetUdpExTableFromStack

AllocateAndGetTcpTableFromStack

AllocateAndGetUdpTableFromStack

SetTcpEntry

GetExtendedTcpTable

GetExtendedUdpTable

TWebcamThread

Shell.Application

SHFileOperationW

\Opera\Opera\wand.dat

\Google\Chrome\User Data\Default\Web Data

\Google\Chrome\User Data\Default\Login Data

TNewFTPThreadU

CDO.Message

CDO.Configuration

hXXp://schemas.microsoft.com/cdo/configuration/smtpusessl

hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate

hXXp://schemas.microsoft.com/cdo/configuration/sendusername

hXXp://schemas.microsoft.com/cdo/configuration/sendpassword

hXXp://schemas.microsoft.com/cdo/configuration/smtpserver

hXXp://schemas.microsoft.com/cdo/configuration/sendusing

hXXp://schemas.microsoft.com/cdo/configuration/smtpserverport

VBoxService.exe

SbieDll.dll

dbghelp.dll

Software\Microsoft\Windows\CurrentVersion

55274-640-2673064-23950

76487-644-3177037-23510

76487-337-8429955-22614

\\.\SICE

\\.\NTICE

drivers\sice.sys

drivers\ntice.sys

drivers\syser.sys

drivers\winice.sys

drivers\sice.vxd

drivers\winice.vxd

winice.vxd

vmm32\winice.vxd

sice.vxd

vmm32\sice.vxd

\\.\SIWVID

\\.\TRW

\\.\TWX

\\.\ICEEXT

1.2.3

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

?456789:;<=

!"#$%&'()* ,-./0123

com.apple.Safari

com.apple.Safari0123456789ABCDEF

KWindows

.ScktComp

WebcamAPI

IdStackWindows

UnitKeylogger

UnitServerPass

UnitExecutarComandos

UnitSendFTPFiles

UnitListarPortasAtivas

Usndkey32

sUnitWindows

IdTCPStream

 IdTCPServer

4UnitStartWebcam

OperaPasswords

ZPasswordRecovery

KuURLHistory

IEpasswords

UnitChrome

SQLite3

SQLiteTable3

UnitFireFox3_5

SetNamedPipeHandleState

GetWindowsDirectoryW

GetProcessHeap

GetCPInfo

DisconnectNamedPipe

CreatePipe

CreateNamedPipeA

RegOpenKeyExW

RegOpenKeyExA

RegOpenKeyW

RegEnumKeyExW

RegDeleteKeyW

RegCreateKeyExW

RegCreateKeyW

RegCloseKey

RegEnumKeyExA

RegQueryInfoKeyA

CryptImportKey

CryptSetKeyParam

CryptDestroyKey

ShellExecuteW

FindExecutableW

SHDeleteKeyW

URLDownloadToFileW

keybd_event

VkKeyScanW

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExA

SetKeyboardState

MsgWaitForMultipleObjects

MapVirtualKeyW

MapVirtualKeyA

GetKeyboardState

GetKeyboardLayout

GetKeyState

ExitWindowsEx

EnumWindows

GetKeyboardType

FtpPutFileW

FtpSetCurrentDirectoryW

.idata

.rdata

P.reloc

P.rsrc

I.uWP

KERNEL32.DLL

AVICAP32.DLL

gdi32.dll

mpr.dll

msacm32.dll

ntdll.dll

powrprof.dll

pstorec.dll

shell32.dll

URLMON.DLL

user32.dll

wininet.dll

winmm.dll

wsock32.dll

x.html

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\RunOnce

Win\MSstart.exe

Software\Microsoft\Windows NT\CurrentVersion\Windows

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe "

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

explorer.exe

hXXp://VVV.uol.com.br/

hXXp://mail.terra.com.br/

hXXps://VVV.google.com/accounts/servicelogin

hXXps://my.screenname.aol.com/_cqr/login/login.psp

hXXp://VVV.lycos.com

hXXp://VVV.myspace.com

Portugal

Turkey

TargetOperatingSystem:

NumberOfMediaSupported:

PowerManagementSupported:

SCSIPort:

NumberOfFunctionKeys:

Password:

MaxMemorySupported:

Monochrome:

ProtocolSupported:

AdminPasswordStatus:

BootROMSupported:

InfraredSupported:

KeyboardPasswordStatus:

PowerOnPasswordStatus:

SupportContactDescription:

WindowsDirectory:

[Execute]

SpyNetKeylogger

keylogger

WEBCAM

uploadandexecute

uploadandexecuteyes|

uploadandexecuteno|

*<>#%"{}|\^[]`

:LocalSubNet:Enabled:@xpsperes.dll,-22006

SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_CURRENT_CONFIG

Invalid Key Name

Invalid KeyName

software\microsoft\windows\currentversion\uninstall\

webcamstream2|

webcam|webcamstream|

webcamstop2|

webcam|webcamstop|

webcamstart

webcamstart2

*.jpg

keyloggernew

c:\users\rafael\desktop\TESTE\

keylogger|mouseloggerbuffer|

OPERA|

CHROME|

keylogger|mouseloggerstart|

keylogger|mouseloggerstop|

keylogger|keyloggerativar|F|

keylogger|keyloggerativar|T|

keylogger|keyloggeronlinekey|

webcamlist|

getpasswords|

webcam

FirstExecution

SelfDelete.bat

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

rar.exe

rarreg.key

filemanager|fmsendftpyes|

filemanager|fmsendftpno|

webcamlist

downexec

openweb

getpasswords

getpasswords|START

chromepass

chromepass|

sendkeyswindow

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\

listarportas

listarportas|listadeportasativas|

listarportasdns

listarportas|finalizarconexao|

finalizarprocessoportas

listarportas|finalizarprocessoportas|Y|

listarportas|finalizarprocessoportas|N|

tecaladoexecutar

webcam2

webcamconfig

keylogger|keyloggeronlinestart|

keylogger|keyloggeronlinestop|

logs_*.txt

keylogger|keylogger|

keyloggerativar

keyloggerdesativar

keyloggerbaixar

keylogger|keyloggerbaixar|

keylogger|keyloggerbaixar|NOLOGS

keyloggerexcluir

keylogger|keyloggerexcluir|

keyloggeronlinestart

keyloggeronlinestop

MouseLoggerWindows

fmexecnormal

filemanager|fmexecnormal|

fmexechide

filemanager|fmexechide|

fmexecparam

filemanager|fmexecparam|F|

filemanager|fmexecparam|T|

fmsendftp

filemanager|fmsendftp|

keysearch

Logs_*.txt

keysearch|YES

keysearch|NO

keyboardinfo

getcompinfo|getcompinfo|keyboardinfo|

ÞFAULTBROWSER%

%System%\SpyNet\Server.exe

%System%\SpyNet\

Unsupported clipboard format

Canvas does not allow drawing Clipboard does not support Icons

Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.

Reply Code is not valid: %s

Reply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

File "%s" not found

Object type not supported.

5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Command not supported.

Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)

Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

Invalid Port Range (%d - %d)

%s is not a valid service.

%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.

Set Size Exceeded.)UDP is not support in this SOCKS version.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

Socket Error # %d

Operation would block.

Operation now in progress.

%s.Seek not implemented$Operation not allowed on sorted list

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Invalid destination array"Character index out of bounds (%d)

Start index out of bounds (%d)

Invalid count (%d)

Invalid destination index (%d)

Invalid codepage (%d)-Error on call to Winsock2 library function %s

ECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s$''%s'' is not a valid component name

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Ancestor for '%s' not found

Cannot assign a %s to a %s

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value

I/O error %d

Integer overflow Invalid floating point operation

Server.exe_252:

`.rsrc

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

EInvalidOperation

u%CNu

%s[%d]

EIdCanNotBindPortInRange

EIdInvalidPortRange(,

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pas

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pas

WS2_32.DLL

MSWSOCK.DLL

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WSARecvMsg

WSASendMsg

Wship6.dll

Fwpuclnt.dll

TIdSocketListWindows

TIdStackWindowsU

Kernel32.dll

EIdIPVersionUnsupportedT

127.0.0.1

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pas

EIdPortRequiredp

EIdTCPConnectionError

EIdObjectTypeNotSupported

ftpTransfer

ftpReady

ftpAborted

PortT

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pas

ClientPortMin

ClientPortMax

Port

"EIdTransparentProxyUDPNotSupported

TIdTCPConnection

IdTCPConnection

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pas

TIdTCPClientCustom

TIdTCPClientCustomDh

IdTCPClient

TIdTCPClient

BoundPortT

%EIdSocksUDPNotSupportedBySOCKSVersion

saUsernamePassword

Password

0.0.0.1

0.0.0.0

BoundPort

DefaultPort

ole32.dll

sqlite3_bind_blob

sqlite3_bind_text

sqlite3_bind_double

sqlite3_bind_int

sqlite3_bind_int64

sqlite3_bind_null

sqlite3_bind_parameter_index

sqlite3_open

sqlite3_close

sqlite3_errmsg

sqlite3_errcode

sqlite3_free

sqlite3_prepare_v2

sqlite3_column_count

sqlite3_column_name

sqlite3_column_decltype

sqlite3_step

sqlite3_column_blob

sqlite3_column_bytes

sqlite3_column_double

sqlite3_column_text

sqlite3_column_type

sqlite3_column_int64

sqlite3_finalize

sqlite3_reset

SQL error or missing database

An internal logic error in SQLite

Operation terminated by sqlite3_interrupt()

Uses OS features not supported on host

2nd parameter to sqlite3_bind out of range

sqlite3_step() has another row ready

sqlite3_step() has finished executing

Unknown SQLite Error Code "

ESQLiteException

TSQLiteDatabase

TSQLiteTable

Failed to open database "%s" : %s

Failed to open database "%s" : unknown error

Error [%d]: %s.

"%s": %s

Error executing SQL

Could not prepare SQL statement

Error executing SQL statement

SQLite is Busy

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox\

SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\

1234567890.

mozsqlite3.dll

sqlite3.dll

MSVCR100.dll

mozglue.dll

mozcrt19.dll

mozutils.dll

nspr4.dll

plc4.dll

plds4.dll

nssutil3.dll

nss3.dll

PK11_GetInternalKeySlot

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

signons.sqlite

SELECT * FROM moz_logins

encryptedPassword

SOFTWARE\Microsoft\Windows\CurrentVersion

Microsoft\Network\Connections\pbk\rasphone.pbk

rasapi32.dll

rnaph.dll

RAS Passwords

advapi32.dll

crypt32.dll

uURLHistory

abe2869f-9b47-4cd9-a358-c22904dba7f7

UnitPasswords

WindowsLive:name=*

\Mozilla Firefox\

softokn3.dll

userenv.dll

profiles.ini

\signons3.txt

\signons2.txt

\signons1.txt

\signons.txt

\\.\pipe\wzcsvc_wep_keys

winlogon.exe

SafariPasswordRecovery

AVURLProtocol_Classic

\Apple Computer\Preferences\keychain.plist

\Apple\Apple Application Support\CFNetwork.dll

hXXp://

PTF://

*PTF://

hXXps://

gdiplus.dll

GdiplusShutdown

EInvalidGraphicOperation

WbemScripting.SWbemLocator

%s\%s

SELECT * FROM %s

pathToSignedProductExe

pathToSignedReportingExe

WbemScripting.SWbemDateTime

HExecQuery

TargetOperatingSystem

NumberOfMediaSupported

PowerManagementSupported

SCSIPort

Select * from Win32_Keyboard

NumberOfFunctionKeys

MaxMemorySupported

Monochrome

ProtocolSupported

AdminPasswordStatus

BootROMSupported

InfraredSupported

KeyboardPasswordStatus

PowerOnPasswordStatus

SupportContactDescription

Select * from Win32_OperatingSystem

WindowsDirectory

Select Caption,BuildNumber,CSDVersion from Win32_OperatingSystem

TKeylogger

TIdTCPClientNew

Please, send a email to SpyNetCoder ---> [email protected]

TWebcam

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.irv:1983

csISO16Portuguese

csISO84Portuguese2

windows-936

csShiftJIS

windows-874

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csMicrosoftPublishing

Windows-31J

csWindows31J

PTCP154

csPTCP154

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

HTTP-EQUIV

()<>@,;:\"./

()<>@,;:\"/[]?=

()<>@,;:\"/[]?={}

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pas

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pas

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pas

IdCustomTCPServer

TIdCustomTCPServer

TIdCustomTCPServerX

DefaultPortt

EIdTCPServerError

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pas

EIdTCPNoOnExecute

TIdTCPServer

IdTCPServer

OnExecute

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas

%s User

CmdDelimiter

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas

'TIdCmdTCPServerAfterCommandHandlerEvent

TIdCmdTCPServer

(TIdCmdTCPServerBeforeCommandHandlerEvent

IdCmdTCPServer

Displays commands that the servers supports.

TIdTCPStream

IdRead() method of TIdTCPStream class does not support seeking

TIdHTTPProxyTransferMode

TIdHTTPProxyServerContext

TIdHTTPProxyServerContextlS

TOnHTTPContextEvent

TOnHTTPDocument

TIdHTTPProxyServer

OnHTTPBeforeCommand

OnHTTPResponse8T

OnHTTPDocument

HTTP/1.0

HTTP/1.0 200 Connection established

HNetCfg.NATUPnP

StaticPortMappingCollection

PSAPI.dll

shlwapi.dll

TSendKey

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

SetupApi.dll

SetupDiOpenClassRegKey

SetupDiOpenClassRegKeyExA

SetupDiOpenClassRegKeyExW

SetupDiCreateDeviceInterfaceRegKeyA

SetupDiCreateDeviceInterfaceRegKeyW

SetupDiOpenDeviceInterfaceRegKey

SetupDiDeleteDeviceInterfaceRegKey

SetupDiCreateDevRegKeyA

SetupDiCreateDevRegKeyW

SetupDiOpenDevRegKey

SetupDiDeleteDevRegKey

CM_DEVCAP_LOCKSUPPORTED

CM_DEVCAP_EJECTSUPPORTED

PDCAP_D0_SUPPORTED

PDCAP_D1_SUPPORTED

PDCAP_D2_SUPPORTED

PDCAP_D3_SUPPORTED

PDCAP_WAKE_FROM_D0_SUPPORTED

PDCAP_WAKE_FROM_D1_SUPPORTED

PDCAP_WAKE_FROM_D2_SUPPORTED

PDCAP_WAKE_FROM_D3_SUPPORTED

PDCAP_WARM_EJECT_SUPPORTED

iphlpapi.dll

AllocateAndGetTcpExTableFromStack

AllocateAndGetUdpExTableFromStack

AllocateAndGetTcpTableFromStack

AllocateAndGetUdpTableFromStack

SetTcpEntry

GetExtendedTcpTable

GetExtendedUdpTable

TWebcamThread

Shell.Application

SHFileOperationW

\Opera\Opera\wand.dat

\Google\Chrome\User Data\Default\Web Data

\Google\Chrome\User Data\Default\Login Data

TNewFTPThreadU

CDO.Message

CDO.Configuration

hXXp://schemas.microsoft.com/cdo/configuration/smtpusessl

hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate

hXXp://schemas.microsoft.com/cdo/configuration/sendusername

hXXp://schemas.microsoft.com/cdo/configuration/sendpassword

hXXp://schemas.microsoft.com/cdo/configuration/smtpserver

hXXp://schemas.microsoft.com/cdo/configuration/sendusing

hXXp://schemas.microsoft.com/cdo/configuration/smtpserverport

VBoxService.exe

SbieDll.dll

dbghelp.dll

Software\Microsoft\Windows\CurrentVersion

55274-640-2673064-23950

76487-644-3177037-23510

76487-337-8429955-22614

\\.\SICE

\\.\NTICE

drivers\sice.sys

drivers\ntice.sys

drivers\syser.sys

drivers\winice.sys

drivers\sice.vxd

drivers\winice.vxd

winice.vxd

vmm32\winice.vxd

sice.vxd

vmm32\sice.vxd

\\.\SIWVID

\\.\TRW

\\.\TWX

\\.\ICEEXT

1.2.3

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

?456789:;<=

!"#$%&'()* ,-./0123

com.apple.Safari

com.apple.Safari0123456789ABCDEF

KWindows

.ScktComp

WebcamAPI

IdStackWindows

UnitKeylogger

UnitServerPass

UnitExecutarComandos

UnitSendFTPFiles

UnitListarPortasAtivas

Usndkey32

sUnitWindows

IdTCPStream

 IdTCPServer

4UnitStartWebcam

OperaPasswords

ZPasswordRecovery

KuURLHistory

IEpasswords

UnitChrome

SQLite3

SQLiteTable3

UnitFireFox3_5

SetNamedPipeHandleState

GetWindowsDirectoryW

GetProcessHeap

GetCPInfo

DisconnectNamedPipe

CreatePipe

CreateNamedPipeA

RegOpenKeyExW

RegOpenKeyExA

RegOpenKeyW

RegEnumKeyExW

RegDeleteKeyW

RegCreateKeyExW

RegCreateKeyW

RegCloseKey

RegEnumKeyExA

RegQueryInfoKeyA

CryptImportKey

CryptSetKeyParam

CryptDestroyKey

ShellExecuteW

FindExecutableW

SHDeleteKeyW

URLDownloadToFileW

keybd_event

VkKeyScanW

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExA

SetKeyboardState

MsgWaitForMultipleObjects

MapVirtualKeyW

MapVirtualKeyA

GetKeyboardState

GetKeyboardLayout

GetKeyState

ExitWindowsEx

EnumWindows

GetKeyboardType

FtpPutFileW

FtpSetCurrentDirectoryW

.idata

.rdata

P.reloc

P.rsrc

I.uWP

KERNEL32.DLL

AVICAP32.DLL

gdi32.dll

mpr.dll

msacm32.dll

ntdll.dll

powrprof.dll

pstorec.dll

shell32.dll

URLMON.DLL

user32.dll

wininet.dll

winmm.dll

wsock32.dll

x.html

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\RunOnce

Win\MSstart.exe

Software\Microsoft\Windows NT\CurrentVersion\Windows

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe "

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

explorer.exe

hXXp://VVV.uol.com.br/

hXXp://mail.terra.com.br/

hXXps://VVV.google.com/accounts/servicelogin

hXXps://my.screenname.aol.com/_cqr/login/login.psp

hXXp://VVV.lycos.com

hXXp://VVV.myspace.com

Portugal

Turkey

TargetOperatingSystem:

NumberOfMediaSupported:

PowerManagementSupported:

SCSIPort:

NumberOfFunctionKeys:

Password:

MaxMemorySupported:

Monochrome:

ProtocolSupported:

AdminPasswordStatus:

BootROMSupported:

InfraredSupported:

KeyboardPasswordStatus:

PowerOnPasswordStatus:

SupportContactDescription:

WindowsDirectory:

[Execute]

SpyNetKeylogger

keylogger

WEBCAM

uploadandexecute

uploadandexecuteyes|

uploadandexecuteno|

*<>#%"{}|\^[]`

:LocalSubNet:Enabled:@xpsperes.dll,-22006

SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_CURRENT_CONFIG

Invalid Key Name

Invalid KeyName

software\microsoft\windows\currentversion\uninstall\

webcamstream2|

webcam|webcamstream|

webcamstop2|

webcam|webcamstop|

webcamstart

webcamstart2

*.jpg

keyloggernew

c:\users\rafael\desktop\TESTE\

keylogger|mouseloggerbuffer|

OPERA|

CHROME|

keylogger|mouseloggerstart|

keylogger|mouseloggerstop|

keylogger|keyloggerativar|F|

keylogger|keyloggerativar|T|

keylogger|keyloggeronlinekey|

webcamlist|

getpasswords|

webcam

FirstExecution

SelfDelete.bat

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

rar.exe

rarreg.key

filemanager|fmsendftpyes|

filemanager|fmsendftpno|

webcamlist

downexec

openweb

getpasswords

getpasswords|START

chromepass

chromepass|

sendkeyswindow

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\

listarportas

listarportas|listadeportasativas|

listarportasdns

listarportas|finalizarconexao|

finalizarprocessoportas

listarportas|finalizarprocessoportas|Y|

listarportas|finalizarprocessoportas|N|

tecaladoexecutar

webcam2

webcamconfig

keylogger|keyloggeronlinestart|

keylogger|keyloggeronlinestop|

logs_*.txt

keylogger|keylogger|

keyloggerativar

keyloggerdesativar

keyloggerbaixar

keylogger|keyloggerbaixar|

keylogger|keyloggerbaixar|NOLOGS

keyloggerexcluir

keylogger|keyloggerexcluir|

keyloggeronlinestart

keyloggeronlinestop

MouseLoggerWindows

fmexecnormal

filemanager|fmexecnormal|

fmexechide

filemanager|fmexechide|

fmexecparam

filemanager|fmexecparam|F|

filemanager|fmexecparam|T|

fmsendftp

filemanager|fmsendftp|

keysearch

Logs_*.txt

keysearch|YES

keysearch|NO

keyboardinfo

getcompinfo|getcompinfo|keyboardinfo|

ÞFAULTBROWSER%

Unsupported clipboard format

Canvas does not allow drawing Clipboard does not support Icons

Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.

Reply Code is not valid: %s

Reply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

File "%s" not found

Object type not supported.

5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Command not supported.

Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)

Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

Invalid Port Range (%d - %d)

%s is not a valid service.

%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.

Set Size Exceeded.)UDP is not support in this SOCKS version.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

Socket Error # %d

Operation would block.

Operation now in progress.

%s.Seek not implemented$Operation not allowed on sorted list

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Invalid destination array"Character index out of bounds (%d)

Start index out of bounds (%d)

Invalid count (%d)

Invalid destination index (%d)

Invalid codepage (%d)-Error on call to Winsock2 library function %s

ECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s$''%s'' is not a valid component name

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Ancestor for '%s' not found

Cannot assign a %s to a %s

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value

I/O error %d

Integer overflow Invalid floating point operation

Server.exe_252_rwx_00C80000_000F0000:

`.rsrc

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

EInvalidOperation

u%CNu

%s[%d]

EIdCanNotBindPortInRange

EIdInvalidPortRange(,

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pas

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pas

WS2_32.DLL

MSWSOCK.DLL

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WSARecvMsg

WSASendMsg

Wship6.dll

Fwpuclnt.dll

TIdSocketListWindows

TIdStackWindowsU

Kernel32.dll

EIdIPVersionUnsupportedT

127.0.0.1

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pas

EIdPortRequiredp

EIdTCPConnectionError

EIdObjectTypeNotSupported

ftpTransfer

ftpReady

ftpAborted

PortT

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pas

ClientPortMin

ClientPortMax

Port

"EIdTransparentProxyUDPNotSupported

TIdTCPConnection

IdTCPConnection

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pas

TIdTCPClientCustom

TIdTCPClientCustomDh

IdTCPClient

TIdTCPClient

BoundPortT

%EIdSocksUDPNotSupportedBySOCKSVersion

saUsernamePassword

Password

0.0.0.1

0.0.0.0

BoundPort

DefaultPort

ole32.dll

sqlite3_bind_blob

sqlite3_bind_text

sqlite3_bind_double

sqlite3_bind_int

sqlite3_bind_int64

sqlite3_bind_null

sqlite3_bind_parameter_index

sqlite3_open

sqlite3_close

sqlite3_errmsg

sqlite3_errcode

sqlite3_free

sqlite3_prepare_v2

sqlite3_column_count

sqlite3_column_name

sqlite3_column_decltype

sqlite3_step

sqlite3_column_blob

sqlite3_column_bytes

sqlite3_column_double

sqlite3_column_text

sqlite3_column_type

sqlite3_column_int64

sqlite3_finalize

sqlite3_reset

SQL error or missing database

An internal logic error in SQLite

Operation terminated by sqlite3_interrupt()

Uses OS features not supported on host

2nd parameter to sqlite3_bind out of range

sqlite3_step() has another row ready

sqlite3_step() has finished executing

Unknown SQLite Error Code "

ESQLiteException

TSQLiteDatabase

TSQLiteTable

Failed to open database "%s" : %s

Failed to open database "%s" : unknown error

Error [%d]: %s.

"%s": %s

Error executing SQL

Could not prepare SQL statement

Error executing SQL statement

SQLite is Busy

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox\

SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\

1234567890.

mozsqlite3.dll

sqlite3.dll

MSVCR100.dll

mozglue.dll

mozcrt19.dll

mozutils.dll

nspr4.dll

plc4.dll

plds4.dll

nssutil3.dll

nss3.dll

PK11_GetInternalKeySlot

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

signons.sqlite

SELECT * FROM moz_logins

encryptedPassword

SOFTWARE\Microsoft\Windows\CurrentVersion

Microsoft\Network\Connections\pbk\rasphone.pbk

rasapi32.dll

rnaph.dll

RAS Passwords

advapi32.dll

crypt32.dll

uURLHistory

abe2869f-9b47-4cd9-a358-c22904dba7f7

UnitPasswords

WindowsLive:name=*

\Mozilla Firefox\

softokn3.dll

userenv.dll

profiles.ini

\signons3.txt

\signons2.txt

\signons1.txt

\signons.txt

\\.\pipe\wzcsvc_wep_keys

winlogon.exe

SafariPasswordRecovery

AVURLProtocol_Classic

\Apple Computer\Preferences\keychain.plist

\Apple\Apple Application Support\CFNetwork.dll

hXXp://

PTF://

*PTF://

hXXps://

gdiplus.dll

GdiplusShutdown

EInvalidGraphicOperation

WbemScripting.SWbemLocator

%s\%s

SELECT * FROM %s

pathToSignedProductExe

pathToSignedReportingExe

WbemScripting.SWbemDateTime

HExecQuery

TargetOperatingSystem

NumberOfMediaSupported

PowerManagementSupported

SCSIPort

Select * from Win32_Keyboard

NumberOfFunctionKeys

MaxMemorySupported

Monochrome

ProtocolSupported

AdminPasswordStatus

BootROMSupported

InfraredSupported

KeyboardPasswordStatus

PowerOnPasswordStatus

SupportContactDescription

Select * from Win32_OperatingSystem

WindowsDirectory

Select Caption,BuildNumber,CSDVersion from Win32_OperatingSystem

TKeylogger

TIdTCPClientNew

Please, send a email to SpyNetCoder ---> [email protected]

TWebcam

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.irv:1983

csISO16Portuguese

csISO84Portuguese2

windows-936

csShiftJIS

windows-874

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csMicrosoftPublishing

Windows-31J

csWindows31J

PTCP154

csPTCP154

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

HTTP-EQUIV

()<>@,;:\"./

()<>@,;:\"/[]?=

()<>@,;:\"/[]?={}

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pas

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pas

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pas

IdCustomTCPServer

TIdCustomTCPServer

TIdCustomTCPServerX

DefaultPortt

EIdTCPServerError

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pas

EIdTCPNoOnExecute

TIdTCPServer

IdTCPServer

OnExecute

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas

%s User

CmdDelimiter

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas

'TIdCmdTCPServerAfterCommandHandlerEvent

TIdCmdTCPServer

(TIdCmdTCPServerBeforeCommandHandlerEvent

IdCmdTCPServer

Displays commands that the servers supports.

TIdTCPStream

IdRead() method of TIdTCPStream class does not support seeking

TIdHTTPProxyTransferMode

TIdHTTPProxyServerContext

TIdHTTPProxyServerContextlS

TOnHTTPContextEvent

TOnHTTPDocument

TIdHTTPProxyServer

OnHTTPBeforeCommand

OnHTTPResponse8T

OnHTTPDocument

HTTP/1.0

HTTP/1.0 200 Connection established

HNetCfg.NATUPnP

StaticPortMappingCollection

PSAPI.dll

shlwapi.dll

TSendKey

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

SetupApi.dll

SetupDiOpenClassRegKey

SetupDiOpenClassRegKeyExA

SetupDiOpenClassRegKeyExW

SetupDiCreateDeviceInterfaceRegKeyA

SetupDiCreateDeviceInterfaceRegKeyW

SetupDiOpenDeviceInterfaceRegKey

SetupDiDeleteDeviceInterfaceRegKey

SetupDiCreateDevRegKeyA

SetupDiCreateDevRegKeyW

SetupDiOpenDevRegKey

SetupDiDeleteDevRegKey

CM_DEVCAP_LOCKSUPPORTED

CM_DEVCAP_EJECTSUPPORTED

PDCAP_D0_SUPPORTED

PDCAP_D1_SUPPORTED

PDCAP_D2_SUPPORTED

PDCAP_D3_SUPPORTED

PDCAP_WAKE_FROM_D0_SUPPORTED

PDCAP_WAKE_FROM_D1_SUPPORTED

PDCAP_WAKE_FROM_D2_SUPPORTED

PDCAP_WAKE_FROM_D3_SUPPORTED

PDCAP_WARM_EJECT_SUPPORTED

iphlpapi.dll

AllocateAndGetTcpExTableFromStack

AllocateAndGetUdpExTableFromStack

AllocateAndGetTcpTableFromStack

AllocateAndGetUdpTableFromStack

SetTcpEntry

GetExtendedTcpTable

GetExtendedUdpTable

TWebcamThread

Shell.Application

SHFileOperationW

\Opera\Opera\wand.dat

\Google\Chrome\User Data\Default\Web Data

\Google\Chrome\User Data\Default\Login Data

TNewFTPThreadU

CDO.Message

CDO.Configuration

hXXp://schemas.microsoft.com/cdo/configuration/smtpusessl

hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate

hXXp://schemas.microsoft.com/cdo/configuration/sendusername

hXXp://schemas.microsoft.com/cdo/configuration/sendpassword

hXXp://schemas.microsoft.com/cdo/configuration/smtpserver

hXXp://schemas.microsoft.com/cdo/configuration/sendusing

hXXp://schemas.microsoft.com/cdo/configuration/smtpserverport

VBoxService.exe

SbieDll.dll

dbghelp.dll

Software\Microsoft\Windows\CurrentVersion

55274-640-2673064-23950

76487-644-3177037-23510

76487-337-8429955-22614

\\.\SICE

\\.\NTICE

drivers\sice.sys

drivers\ntice.sys

drivers\syser.sys

drivers\winice.sys

drivers\sice.vxd

drivers\winice.vxd

winice.vxd

vmm32\winice.vxd

sice.vxd

vmm32\sice.vxd

\\.\SIWVID

\\.\TRW

\\.\TWX

\\.\ICEEXT

1.2.3

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

?456789:;<=

!"#$%&'()* ,-./0123

com.apple.Safari

com.apple.Safari0123456789ABCDEF

KWindows

.ScktComp

WebcamAPI

IdStackWindows

UnitKeylogger

UnitServerPass

UnitExecutarComandos

UnitSendFTPFiles

UnitListarPortasAtivas

Usndkey32

sUnitWindows

IdTCPStream

 IdTCPServer

4UnitStartWebcam

OperaPasswords

ZPasswordRecovery

KuURLHistory

IEpasswords

UnitChrome

SQLite3

SQLiteTable3

UnitFireFox3_5

SetNamedPipeHandleState

GetWindowsDirectoryW

GetProcessHeap

GetCPInfo

DisconnectNamedPipe

CreatePipe

CreateNamedPipeA

RegOpenKeyExW

RegOpenKeyExA

RegOpenKeyW

RegEnumKeyExW

RegDeleteKeyW

RegCreateKeyExW

RegCreateKeyW

RegCloseKey

RegEnumKeyExA

RegQueryInfoKeyA

CryptImportKey

CryptSetKeyParam

CryptDestroyKey

ShellExecuteW

FindExecutableW

SHDeleteKeyW

URLDownloadToFileW

keybd_event

VkKeyScanW

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExA

SetKeyboardState

MsgWaitForMultipleObjects

MapVirtualKeyW

MapVirtualKeyA

GetKeyboardState

GetKeyboardLayout

GetKeyState

ExitWindowsEx

EnumWindows

GetKeyboardType

FtpPutFileW

FtpSetCurrentDirectoryW

.idata

.rdata

P.reloc

P.rsrc

I.uWP

KERNEL32.DLL

AVICAP32.DLL

gdi32.dll

mpr.dll

msacm32.dll

ntdll.dll

powrprof.dll

pstorec.dll

shell32.dll

URLMON.DLL

user32.dll

wininet.dll

winmm.dll

wsock32.dll

x.html

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\RunOnce

Win\MSstart.exe

Software\Microsoft\Windows NT\CurrentVersion\Windows

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe "

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

explorer.exe

hXXp://VVV.uol.com.br/

hXXp://mail.terra.com.br/

hXXps://VVV.google.com/accounts/servicelogin

hXXps://my.screenname.aol.com/_cqr/login/login.psp

hXXp://VVV.lycos.com

hXXp://VVV.myspace.com

Portugal

Turkey

TargetOperatingSystem:

NumberOfMediaSupported:

PowerManagementSupported:

SCSIPort:

NumberOfFunctionKeys:

Password:

MaxMemorySupported:

Monochrome:

ProtocolSupported:

AdminPasswordStatus:

BootROMSupported:

InfraredSupported:

KeyboardPasswordStatus:

PowerOnPasswordStatus:

SupportContactDescription:

WindowsDirectory:

[Execute]

SpyNetKeylogger

keylogger

WEBCAM

uploadandexecute

uploadandexecuteyes|

uploadandexecuteno|

*<>#%"{}|\^[]`

:LocalSubNet:Enabled:@xpsperes.dll,-22006

SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_CURRENT_CONFIG

Invalid Key Name

Invalid KeyName

software\microsoft\windows\currentversion\uninstall\

webcamstream2|

webcam|webcamstream|

webcamstop2|

webcam|webcamstop|

webcamstart

webcamstart2

*.jpg

keyloggernew

c:\users\rafael\desktop\TESTE\

keylogger|mouseloggerbuffer|

OPERA|

CHROME|

keylogger|mouseloggerstart|

keylogger|mouseloggerstop|

keylogger|keyloggerativar|F|

keylogger|keyloggerativar|T|

keylogger|keyloggeronlinekey|

webcamlist|

getpasswords|

webcam

FirstExecution

SelfDelete.bat

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

rar.exe

rarreg.key

filemanager|fmsendftpyes|

filemanager|fmsendftpno|

webcamlist

downexec

openweb

getpasswords

getpasswords|START

chromepass

chromepass|

sendkeyswindow

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\

listarportas

listarportas|listadeportasativas|

listarportasdns

listarportas|finalizarconexao|

finalizarprocessoportas

listarportas|finalizarprocessoportas|Y|

listarportas|finalizarprocessoportas|N|

tecaladoexecutar

webcam2

webcamconfig

keylogger|keyloggeronlinestart|

keylogger|keyloggeronlinestop|

logs_*.txt

keylogger|keylogger|

keyloggerativar

keyloggerdesativar

keyloggerbaixar

keylogger|keyloggerbaixar|

keylogger|keyloggerbaixar|NOLOGS

keyloggerexcluir

keylogger|keyloggerexcluir|

keyloggeronlinestart

keyloggeronlinestop

MouseLoggerWindows

fmexecnormal

filemanager|fmexecnormal|

fmexechide

filemanager|fmexechide|

fmexecparam

filemanager|fmexecparam|F|

filemanager|fmexecparam|T|

fmsendftp

filemanager|fmsendftp|

keysearch

Logs_*.txt

keysearch|YES

keysearch|NO

keyboardinfo

getcompinfo|getcompinfo|keyboardinfo|

ÞFAULTBROWSER%

Unsupported clipboard format

Canvas does not allow drawing Clipboard does not support Icons

Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.

Reply Code is not valid: %s

Reply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

File "%s" not found

Object type not supported.

5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Command not supported.

Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)

Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

Invalid Port Range (%d - %d)

%s is not a valid service.

%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.

Set Size Exceeded.)UDP is not support in this SOCKS version.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

Socket Error # %d

Operation would block.

Operation now in progress.

%s.Seek not implemented$Operation not allowed on sorted list

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Invalid destination array"Character index out of bounds (%d)

Start index out of bounds (%d)

Invalid count (%d)

Invalid destination index (%d)

Invalid codepage (%d)-Error on call to Winsock2 library function %s

ECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s$''%s'' is not a valid component name

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Ancestor for '%s' not found

Cannot assign a %s to a %s

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value

I/O error %d

Integer overflow Invalid floating point operation

Server.exe_1960:

`.rsrc

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

EInvalidOperation

u%CNu

%s[%d]

EIdCanNotBindPortInRange

EIdInvalidPortRange(,

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pas

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pas

WS2_32.DLL

MSWSOCK.DLL

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WSARecvMsg

WSASendMsg

Wship6.dll

Fwpuclnt.dll

TIdSocketListWindows

TIdStackWindowsU

Kernel32.dll

EIdIPVersionUnsupportedT

127.0.0.1

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pas

EIdPortRequiredp

EIdTCPConnectionError

EIdObjectTypeNotSupported

ftpTransfer

ftpReady

ftpAborted

PortT

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pas

ClientPortMin

ClientPortMax

Port

"EIdTransparentProxyUDPNotSupported

TIdTCPConnection

IdTCPConnection

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pas

TIdTCPClientCustom

TIdTCPClientCustomDh

IdTCPClient

TIdTCPClient

BoundPortT

%EIdSocksUDPNotSupportedBySOCKSVersion

saUsernamePassword

Password

0.0.0.1

0.0.0.0

BoundPort

DefaultPort

ole32.dll

sqlite3_bind_blob

sqlite3_bind_text

sqlite3_bind_double

sqlite3_bind_int

sqlite3_bind_int64

sqlite3_bind_null

sqlite3_bind_parameter_index

sqlite3_open

sqlite3_close

sqlite3_errmsg

sqlite3_errcode

sqlite3_free

sqlite3_prepare_v2

sqlite3_column_count

sqlite3_column_name

sqlite3_column_decltype

sqlite3_step

sqlite3_column_blob

sqlite3_column_bytes

sqlite3_column_double

sqlite3_column_text

sqlite3_column_type

sqlite3_column_int64

sqlite3_finalize

sqlite3_reset

SQL error or missing database

An internal logic error in SQLite

Operation terminated by sqlite3_interrupt()

Uses OS features not supported on host

2nd parameter to sqlite3_bind out of range

sqlite3_step() has another row ready

sqlite3_step() has finished executing

Unknown SQLite Error Code "

ESQLiteException

TSQLiteDatabase

TSQLiteTable

Failed to open database "%s" : %s

Failed to open database "%s" : unknown error

Error [%d]: %s.

"%s": %s

Error executing SQL

Could not prepare SQL statement

Error executing SQL statement

SQLite is Busy

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox\

SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\

1234567890.

mozsqlite3.dll

sqlite3.dll

MSVCR100.dll

mozglue.dll

mozcrt19.dll

mozutils.dll

nspr4.dll

plc4.dll

plds4.dll

nssutil3.dll

nss3.dll

PK11_GetInternalKeySlot

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

signons.sqlite

SELECT * FROM moz_logins

encryptedPassword

SOFTWARE\Microsoft\Windows\CurrentVersion

Microsoft\Network\Connections\pbk\rasphone.pbk

rasapi32.dll

rnaph.dll

RAS Passwords

advapi32.dll

crypt32.dll

uURLHistory

abe2869f-9b47-4cd9-a358-c22904dba7f7

UnitPasswords

WindowsLive:name=*

\Mozilla Firefox\

softokn3.dll

userenv.dll

profiles.ini

\signons3.txt

\signons2.txt

\signons1.txt

\signons.txt

\\.\pipe\wzcsvc_wep_keys

winlogon.exe

SafariPasswordRecovery

AVURLProtocol_Classic

\Apple Computer\Preferences\keychain.plist

\Apple\Apple Application Support\CFNetwork.dll

hXXp://

PTF://

*PTF://

hXXps://

gdiplus.dll

GdiplusShutdown

EInvalidGraphicOperation

WbemScripting.SWbemLocator

%s\%s

SELECT * FROM %s

pathToSignedProductExe

pathToSignedReportingExe

WbemScripting.SWbemDateTime

HExecQuery

TargetOperatingSystem

NumberOfMediaSupported

PowerManagementSupported

SCSIPort

Select * from Win32_Keyboard

NumberOfFunctionKeys

MaxMemorySupported

Monochrome

ProtocolSupported

AdminPasswordStatus

BootROMSupported

InfraredSupported

KeyboardPasswordStatus

PowerOnPasswordStatus

SupportContactDescription

Select * from Win32_OperatingSystem

WindowsDirectory

Select Caption,BuildNumber,CSDVersion from Win32_OperatingSystem

TKeylogger

TIdTCPClientNew

Please, send a email to SpyNetCoder ---> [email protected]

TWebcam

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.irv:1983

csISO16Portuguese

csISO84Portuguese2

windows-936

csShiftJIS

windows-874

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csMicrosoftPublishing

Windows-31J

csWindows31J

PTCP154

csPTCP154

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

HTTP-EQUIV

()<>@,;:\"./

()<>@,;:\"/[]?=

()<>@,;:\"/[]?={}

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pas

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pas

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pas

IdCustomTCPServer

TIdCustomTCPServer

TIdCustomTCPServerX

DefaultPortt

EIdTCPServerError

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pas

EIdTCPNoOnExecute

TIdTCPServer

IdTCPServer

OnExecute

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas

%s User

CmdDelimiter

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas

'TIdCmdTCPServerAfterCommandHandlerEvent

TIdCmdTCPServer

(TIdCmdTCPServerBeforeCommandHandlerEvent

IdCmdTCPServer

Displays commands that the servers supports.

TIdTCPStream

IdRead() method of TIdTCPStream class does not support seeking

TIdHTTPProxyTransferMode

TIdHTTPProxyServerContext

TIdHTTPProxyServerContextlS

TOnHTTPContextEvent

TOnHTTPDocument

TIdHTTPProxyServer

OnHTTPBeforeCommand

OnHTTPResponse8T

OnHTTPDocument

HTTP/1.0

HTTP/1.0 200 Connection established

HNetCfg.NATUPnP

StaticPortMappingCollection

PSAPI.dll

shlwapi.dll

TSendKey

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

SetupApi.dll

SetupDiOpenClassRegKey

SetupDiOpenClassRegKeyExA

SetupDiOpenClassRegKeyExW

SetupDiCreateDeviceInterfaceRegKeyA

SetupDiCreateDeviceInterfaceRegKeyW

SetupDiOpenDeviceInterfaceRegKey

SetupDiDeleteDeviceInterfaceRegKey

SetupDiCreateDevRegKeyA

SetupDiCreateDevRegKeyW

SetupDiOpenDevRegKey

SetupDiDeleteDevRegKey

CM_DEVCAP_LOCKSUPPORTED

CM_DEVCAP_EJECTSUPPORTED

PDCAP_D0_SUPPORTED

PDCAP_D1_SUPPORTED

PDCAP_D2_SUPPORTED

PDCAP_D3_SUPPORTED

PDCAP_WAKE_FROM_D0_SUPPORTED

PDCAP_WAKE_FROM_D1_SUPPORTED

PDCAP_WAKE_FROM_D2_SUPPORTED

PDCAP_WAKE_FROM_D3_SUPPORTED

PDCAP_WARM_EJECT_SUPPORTED

iphlpapi.dll

AllocateAndGetTcpExTableFromStack

AllocateAndGetUdpExTableFromStack

AllocateAndGetTcpTableFromStack

AllocateAndGetUdpTableFromStack

SetTcpEntry

GetExtendedTcpTable

GetExtendedUdpTable

TWebcamThread

Shell.Application

SHFileOperationW

\Opera\Opera\wand.dat

\Google\Chrome\User Data\Default\Web Data

\Google\Chrome\User Data\Default\Login Data

TNewFTPThreadU

CDO.Message

CDO.Configuration

hXXp://schemas.microsoft.com/cdo/configuration/smtpusessl

hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate

hXXp://schemas.microsoft.com/cdo/configuration/sendusername

hXXp://schemas.microsoft.com/cdo/configuration/sendpassword

hXXp://schemas.microsoft.com/cdo/configuration/smtpserver

hXXp://schemas.microsoft.com/cdo/configuration/sendusing

hXXp://schemas.microsoft.com/cdo/configuration/smtpserverport

VBoxService.exe

SbieDll.dll

dbghelp.dll

Software\Microsoft\Windows\CurrentVersion

55274-640-2673064-23950

76487-644-3177037-23510

76487-337-8429955-22614

\\.\SICE

\\.\NTICE

drivers\sice.sys

drivers\ntice.sys

drivers\syser.sys

drivers\winice.sys

drivers\sice.vxd

drivers\winice.vxd

winice.vxd

vmm32\winice.vxd

sice.vxd

vmm32\sice.vxd

\\.\SIWVID

\\.\TRW

\\.\TWX

\\.\ICEEXT

1.2.3

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

?456789:;<=

!"#$%&'()* ,-./0123

com.apple.Safari

com.apple.Safari0123456789ABCDEF

KWindows

.ScktComp

WebcamAPI

IdStackWindows

UnitKeylogger

UnitServerPass

UnitExecutarComandos

UnitSendFTPFiles

UnitListarPortasAtivas

Usndkey32

sUnitWindows

IdTCPStream

 IdTCPServer

4UnitStartWebcam

OperaPasswords

ZPasswordRecovery

KuURLHistory

IEpasswords

UnitChrome

SQLite3

SQLiteTable3

UnitFireFox3_5

SetNamedPipeHandleState

GetWindowsDirectoryW

GetProcessHeap

GetCPInfo

DisconnectNamedPipe

CreatePipe

CreateNamedPipeA

RegOpenKeyExW

RegOpenKeyExA

RegOpenKeyW

RegEnumKeyExW

RegDeleteKeyW

RegCreateKeyExW

RegCreateKeyW

RegCloseKey

RegEnumKeyExA

RegQueryInfoKeyA

CryptImportKey

CryptSetKeyParam

CryptDestroyKey

ShellExecuteW

FindExecutableW

SHDeleteKeyW

URLDownloadToFileW

keybd_event

VkKeyScanW

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExA

SetKeyboardState

MsgWaitForMultipleObjects

MapVirtualKeyW

MapVirtualKeyA

GetKeyboardState

GetKeyboardLayout

GetKeyState

ExitWindowsEx

EnumWindows

GetKeyboardType

FtpPutFileW

FtpSetCurrentDirectoryW

.idata

.rdata

P.reloc

P.rsrc

I.uWP

KERNEL32.DLL

AVICAP32.DLL

gdi32.dll

mpr.dll

msacm32.dll

ntdll.dll

powrprof.dll

pstorec.dll

shell32.dll

URLMON.DLL

user32.dll

wininet.dll

winmm.dll

wsock32.dll

x.html

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\RunOnce

Win\MSstart.exe

Software\Microsoft\Windows NT\CurrentVersion\Windows

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe "

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

explorer.exe

hXXp://VVV.uol.com.br/

hXXp://mail.terra.com.br/

hXXps://VVV.google.com/accounts/servicelogin

hXXps://my.screenname.aol.com/_cqr/login/login.psp

hXXp://VVV.lycos.com

hXXp://VVV.myspace.com

Portugal

Turkey

TargetOperatingSystem:

NumberOfMediaSupported:

PowerManagementSupported:

SCSIPort:

NumberOfFunctionKeys:

Password:

MaxMemorySupported:

Monochrome:

ProtocolSupported:

AdminPasswordStatus:

BootROMSupported:

InfraredSupported:

KeyboardPasswordStatus:

PowerOnPasswordStatus:

SupportContactDescription:

WindowsDirectory:

[Execute]

SpyNetKeylogger

keylogger

WEBCAM

uploadandexecute

uploadandexecuteyes|

uploadandexecuteno|

*<>#%"{}|\^[]`

:LocalSubNet:Enabled:@xpsperes.dll,-22006

SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_CURRENT_CONFIG

Invalid Key Name

Invalid KeyName

software\microsoft\windows\currentversion\uninstall\

webcamstream2|

webcam|webcamstream|

webcamstop2|

webcam|webcamstop|

webcamstart

webcamstart2

*.jpg

keyloggernew

c:\users\rafael\desktop\TESTE\

keylogger|mouseloggerbuffer|

OPERA|

CHROME|

keylogger|mouseloggerstart|

keylogger|mouseloggerstop|

keylogger|keyloggerativar|F|

keylogger|keyloggerativar|T|

keylogger|keyloggeronlinekey|

webcamlist|

getpasswords|

webcam

FirstExecution

SelfDelete.bat

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

rar.exe

rarreg.key

filemanager|fmsendftpyes|

filemanager|fmsendftpno|

webcamlist

downexec

openweb

getpasswords

getpasswords|START

chromepass

chromepass|

sendkeyswindow

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\

listarportas

listarportas|listadeportasativas|

listarportasdns

listarportas|finalizarconexao|

finalizarprocessoportas

listarportas|finalizarprocessoportas|Y|

listarportas|finalizarprocessoportas|N|

tecaladoexecutar

webcam2

webcamconfig

keylogger|keyloggeronlinestart|

keylogger|keyloggeronlinestop|

logs_*.txt

keylogger|keylogger|

keyloggerativar

keyloggerdesativar

keyloggerbaixar

keylogger|keyloggerbaixar|

keylogger|keyloggerbaixar|NOLOGS

keyloggerexcluir

keylogger|keyloggerexcluir|

keyloggeronlinestart

keyloggeronlinestop

MouseLoggerWindows

fmexecnormal

filemanager|fmexecnormal|

fmexechide

filemanager|fmexechide|

fmexecparam

filemanager|fmexecparam|F|

filemanager|fmexecparam|T|

fmsendftp

filemanager|fmsendftp|

keysearch

Logs_*.txt

keysearch|YES

keysearch|NO

keyboardinfo

getcompinfo|getcompinfo|keyboardinfo|

ÞFAULTBROWSER%

Unsupported clipboard format

Canvas does not allow drawing Clipboard does not support Icons

Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.

Reply Code is not valid: %s

Reply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

File "%s" not found

Object type not supported.

5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Command not supported.

Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)

Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

Invalid Port Range (%d - %d)

%s is not a valid service.

%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.

Set Size Exceeded.)UDP is not support in this SOCKS version.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

Socket Error # %d

Operation would block.

Operation now in progress.

%s.Seek not implemented$Operation not allowed on sorted list

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Invalid destination array"Character index out of bounds (%d)

Start index out of bounds (%d)

Invalid count (%d)

Invalid destination index (%d)

Invalid codepage (%d)-Error on call to Winsock2 library function %s

ECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s$''%s'' is not a valid component name

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Ancestor for '%s' not found

Cannot assign a %s to a %s

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value

I/O error %d

Integer overflow Invalid floating point operation

Server.exe_1960_rwx_00C80000_000F0000:

`.rsrc

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

EInvalidOperation

u%CNu

%s[%d]

EIdCanNotBindPortInRange

EIdInvalidPortRange(,

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pas

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pas

WS2_32.DLL

MSWSOCK.DLL

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WSARecvMsg

WSASendMsg

Wship6.dll

Fwpuclnt.dll

TIdSocketListWindows

TIdStackWindowsU

Kernel32.dll

EIdIPVersionUnsupportedT

127.0.0.1

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pas

EIdPortRequiredp

EIdTCPConnectionError

EIdObjectTypeNotSupported

ftpTransfer

ftpReady

ftpAborted

PortT

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pas

ClientPortMin

ClientPortMax

Port

"EIdTransparentProxyUDPNotSupported

TIdTCPConnection

IdTCPConnection

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pas

TIdTCPClientCustom

TIdTCPClientCustomDh

IdTCPClient

TIdTCPClient

BoundPortT

%EIdSocksUDPNotSupportedBySOCKSVersion

saUsernamePassword

Password

0.0.0.1

0.0.0.0

BoundPort

DefaultPort

ole32.dll

sqlite3_bind_blob

sqlite3_bind_text

sqlite3_bind_double

sqlite3_bind_int

sqlite3_bind_int64

sqlite3_bind_null

sqlite3_bind_parameter_index

sqlite3_open

sqlite3_close

sqlite3_errmsg

sqlite3_errcode

sqlite3_free

sqlite3_prepare_v2

sqlite3_column_count

sqlite3_column_name

sqlite3_column_decltype

sqlite3_step

sqlite3_column_blob

sqlite3_column_bytes

sqlite3_column_double

sqlite3_column_text

sqlite3_column_type

sqlite3_column_int64

sqlite3_finalize

sqlite3_reset

SQL error or missing database

An internal logic error in SQLite

Operation terminated by sqlite3_interrupt()

Uses OS features not supported on host

2nd parameter to sqlite3_bind out of range

sqlite3_step() has another row ready

sqlite3_step() has finished executing

Unknown SQLite Error Code "

ESQLiteException

TSQLiteDatabase

TSQLiteTable

Failed to open database "%s" : %s

Failed to open database "%s" : unknown error

Error [%d]: %s.

"%s": %s

Error executing SQL

Could not prepare SQL statement

Error executing SQL statement

SQLite is Busy

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox\

SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\

1234567890.

mozsqlite3.dll

sqlite3.dll

MSVCR100.dll

mozglue.dll

mozcrt19.dll

mozutils.dll

nspr4.dll

plc4.dll

plds4.dll

nssutil3.dll

nss3.dll

PK11_GetInternalKeySlot

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

signons.sqlite

SELECT * FROM moz_logins

encryptedPassword

SOFTWARE\Microsoft\Windows\CurrentVersion

Microsoft\Network\Connections\pbk\rasphone.pbk

rasapi32.dll

rnaph.dll

RAS Passwords

advapi32.dll

crypt32.dll

uURLHistory

abe2869f-9b47-4cd9-a358-c22904dba7f7

UnitPasswords

WindowsLive:name=*

\Mozilla Firefox\

softokn3.dll

userenv.dll

profiles.ini

\signons3.txt

\signons2.txt

\signons1.txt

\signons.txt

\\.\pipe\wzcsvc_wep_keys

winlogon.exe

SafariPasswordRecovery

AVURLProtocol_Classic

\Apple Computer\Preferences\keychain.plist

\Apple\Apple Application Support\CFNetwork.dll

hXXp://

PTF://

*PTF://

hXXps://

gdiplus.dll

GdiplusShutdown

EInvalidGraphicOperation

WbemScripting.SWbemLocator

%s\%s

SELECT * FROM %s

pathToSignedProductExe

pathToSignedReportingExe

WbemScripting.SWbemDateTime

HExecQuery

TargetOperatingSystem

NumberOfMediaSupported

PowerManagementSupported

SCSIPort

Select * from Win32_Keyboard

NumberOfFunctionKeys

MaxMemorySupported

Monochrome

ProtocolSupported

AdminPasswordStatus

BootROMSupported

InfraredSupported

KeyboardPasswordStatus

PowerOnPasswordStatus

SupportContactDescription

Select * from Win32_OperatingSystem

WindowsDirectory

Select Caption,BuildNumber,CSDVersion from Win32_OperatingSystem

TKeylogger

TIdTCPClientNew

Please, send a email to SpyNetCoder ---> [email protected]

TWebcam

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.irv:1983

csISO16Portuguese

csISO84Portuguese2

windows-936

csShiftJIS

windows-874

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csMicrosoftPublishing

Windows-31J

csWindows31J

PTCP154

csPTCP154

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

HTTP-EQUIV

()<>@,;:\"./

()<>@,;:\"/[]?=

()<>@,;:\"/[]?={}

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pas

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pas

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pas

IdCustomTCPServer

TIdCustomTCPServer

TIdCustomTCPServerX

DefaultPortt

EIdTCPServerError

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pas

EIdTCPNoOnExecute

TIdTCPServer

IdTCPServer

OnExecute

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas

%s User

CmdDelimiter

C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas

'TIdCmdTCPServerAfterCommandHandlerEvent

TIdCmdTCPServer

(TIdCmdTCPServerBeforeCommandHandlerEvent

IdCmdTCPServer

Displays commands that the servers supports.

TIdTCPStream

IdRead() method of TIdTCPStream class does not support seeking

TIdHTTPProxyTransferMode

TIdHTTPProxyServerContext

TIdHTTPProxyServerContextlS

TOnHTTPContextEvent

TOnHTTPDocument

TIdHTTPProxyServer

OnHTTPBeforeCommand

OnHTTPResponse8T

OnHTTPDocument

HTTP/1.0

HTTP/1.0 200 Connection established

HNetCfg.NATUPnP

StaticPortMappingCollection

PSAPI.dll

shlwapi.dll

TSendKey

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

SetupApi.dll

SetupDiOpenClassRegKey

SetupDiOpenClassRegKeyExA

SetupDiOpenClassRegKeyExW

SetupDiCreateDeviceInterfaceRegKeyA

SetupDiCreateDeviceInterfaceRegKeyW

SetupDiOpenDeviceInterfaceRegKey

SetupDiDeleteDeviceInterfaceRegKey

SetupDiCreateDevRegKeyA

SetupDiCreateDevRegKeyW

SetupDiOpenDevRegKey

SetupDiDeleteDevRegKey

CM_DEVCAP_LOCKSUPPORTED

CM_DEVCAP_EJECTSUPPORTED

PDCAP_D0_SUPPORTED

PDCAP_D1_SUPPORTED

PDCAP_D2_SUPPORTED

PDCAP_D3_SUPPORTED

PDCAP_WAKE_FROM_D0_SUPPORTED

PDCAP_WAKE_FROM_D1_SUPPORTED

PDCAP_WAKE_FROM_D2_SUPPORTED

PDCAP_WAKE_FROM_D3_SUPPORTED

PDCAP_WARM_EJECT_SUPPORTED

iphlpapi.dll

AllocateAndGetTcpExTableFromStack

AllocateAndGetUdpExTableFromStack

AllocateAndGetTcpTableFromStack

AllocateAndGetUdpTableFromStack

SetTcpEntry

GetExtendedTcpTable

GetExtendedUdpTable

TWebcamThread

Shell.Application

SHFileOperationW

\Opera\Opera\wand.dat

\Google\Chrome\User Data\Default\Web Data

\Google\Chrome\User Data\Default\Login Data

TNewFTPThreadU

CDO.Message

CDO.Configuration

hXXp://schemas.microsoft.com/cdo/configuration/smtpusessl

hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate

hXXp://schemas.microsoft.com/cdo/configuration/sendusername

hXXp://schemas.microsoft.com/cdo/configuration/sendpassword

hXXp://schemas.microsoft.com/cdo/configuration/smtpserver

hXXp://schemas.microsoft.com/cdo/configuration/sendusing

hXXp://schemas.microsoft.com/cdo/configuration/smtpserverport

VBoxService.exe

SbieDll.dll

dbghelp.dll

Software\Microsoft\Windows\CurrentVersion

55274-640-2673064-23950

76487-644-3177037-23510

76487-337-8429955-22614

\\.\SICE

\\.\NTICE

drivers\sice.sys

drivers\ntice.sys

drivers\syser.sys

drivers\winice.sys

drivers\sice.vxd

drivers\winice.vxd

winice.vxd

vmm32\winice.vxd

sice.vxd

vmm32\sice.vxd

\\.\SIWVID

\\.\TRW

\\.\TWX

\\.\ICEEXT

1.2.3

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

?456789:;<=

!"#$%&'()* ,-./0123

com.apple.Safari

com.apple.Safari0123456789ABCDEF

KWindows

.ScktComp

WebcamAPI

IdStackWindows

UnitKeylogger

UnitServerPass

UnitExecutarComandos

UnitSendFTPFiles

UnitListarPortasAtivas

Usndkey32

sUnitWindows

IdTCPStream

 IdTCPServer

4UnitStartWebcam

OperaPasswords

ZPasswordRecovery

KuURLHistory

IEpasswords

UnitChrome

SQLite3

SQLiteTable3

UnitFireFox3_5

SetNamedPipeHandleState

GetWindowsDirectoryW

GetProcessHeap

GetCPInfo

DisconnectNamedPipe

CreatePipe

CreateNamedPipeA

RegOpenKeyExW

RegOpenKeyExA

RegOpenKeyW

RegEnumKeyExW

RegDeleteKeyW

RegCreateKeyExW

RegCreateKeyW

RegCloseKey

RegEnumKeyExA

RegQueryInfoKeyA

CryptImportKey

CryptSetKeyParam

CryptDestroyKey

ShellExecuteW

FindExecutableW

SHDeleteKeyW

URLDownloadToFileW

keybd_event

VkKeyScanW

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExA

SetKeyboardState

MsgWaitForMultipleObjects

MapVirtualKeyW

MapVirtualKeyA

GetKeyboardState

GetKeyboardLayout

GetKeyState

ExitWindowsEx

EnumWindows

GetKeyboardType

FtpPutFileW

FtpSetCurrentDirectoryW

.idata

.rdata

P.reloc

P.rsrc

I.uWP

KERNEL32.DLL

AVICAP32.DLL

gdi32.dll

mpr.dll

msacm32.dll

ntdll.dll

powrprof.dll

pstorec.dll

shell32.dll

URLMON.DLL

user32.dll

wininet.dll

winmm.dll

wsock32.dll

x.html

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\RunOnce

Win\MSstart.exe

Software\Microsoft\Windows NT\CurrentVersion\Windows

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe "

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

explorer.exe

hXXp://VVV.uol.com.br/

hXXp://mail.terra.com.br/

hXXps://VVV.google.com/accounts/servicelogin

hXXps://my.screenname.aol.com/_cqr/login/login.psp

hXXp://VVV.lycos.com

hXXp://VVV.myspace.com

Portugal

Turkey

TargetOperatingSystem:

NumberOfMediaSupported:

PowerManagementSupported:

SCSIPort:

NumberOfFunctionKeys:

Password:

MaxMemorySupported:

Monochrome:

ProtocolSupported:

AdminPasswordStatus:

BootROMSupported:

InfraredSupported:

KeyboardPasswordStatus:

PowerOnPasswordStatus:

SupportContactDescription:

WindowsDirectory:

[Execute]

SpyNetKeylogger

keylogger

WEBCAM

uploadandexecute

uploadandexecuteyes|

uploadandexecuteno|

*<>#%"{}|\^[]`

:LocalSubNet:Enabled:@xpsperes.dll,-22006

SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_CURRENT_CONFIG

Invalid Key Name

Invalid KeyName

software\microsoft\windows\currentversion\uninstall\

webcamstream2|

webcam|webcamstream|

webcamstop2|

webcam|webcamstop|

webcamstart

webcamstart2

*.jpg

keyloggernew

c:\users\rafael\desktop\TESTE\

keylogger|mouseloggerbuffer|

OPERA|

CHROME|

keylogger|mouseloggerstart|

keylogger|mouseloggerstop|

keylogger|keyloggerativar|F|

keylogger|keyloggerativar|T|

keylogger|keyloggeronlinekey|

webcamlist|

getpasswords|

webcam

FirstExecution

SelfDelete.bat

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

rar.exe

rarreg.key

filemanager|fmsendftpyes|

filemanager|fmsendftpno|

webcamlist

downexec

openweb

getpasswords

getpasswords|START

chromepass

chromepass|

sendkeyswindow

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\

listarportas

listarportas|listadeportasativas|

listarportasdns

listarportas|finalizarconexao|

finalizarprocessoportas

listarportas|finalizarprocessoportas|Y|

listarportas|finalizarprocessoportas|N|

tecaladoexecutar

webcam2

webcamconfig

keylogger|keyloggeronlinestart|

keylogger|keyloggeronlinestop|

logs_*.txt

keylogger|keylogger|

keyloggerativar

keyloggerdesativar

keyloggerbaixar

keylogger|keyloggerbaixar|

keylogger|keyloggerbaixar|NOLOGS

keyloggerexcluir

keylogger|keyloggerexcluir|

keyloggeronlinestart

keyloggeronlinestop

MouseLoggerWindows

fmexecnormal

filemanager|fmexecnormal|

fmexechide

filemanager|fmexechide|

fmexecparam

filemanager|fmexecparam|F|

filemanager|fmexecparam|T|

fmsendftp

filemanager|fmsendftp|

keysearch

Logs_*.txt

keysearch|YES

keysearch|NO

keyboardinfo

getcompinfo|getcompinfo|keyboardinfo|

ÞFAULTBROWSER%

Unsupported clipboard format

Canvas does not allow drawing Clipboard does not support Icons

Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.

Reply Code is not valid: %s

Reply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

File "%s" not found

Object type not supported.

5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Command not supported.

Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)

Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

Invalid Port Range (%d - %d)

%s is not a valid service.

%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.

Set Size Exceeded.)UDP is not support in this SOCKS version.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

Socket Error # %d

Operation would block.

Operation now in progress.

%s.Seek not implemented$Operation not allowed on sorted list

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Invalid destination array"Character index out of bounds (%d)

Start index out of bounds (%d)

Invalid count (%d)

Invalid destination index (%d)

Invalid codepage (%d)-Error on call to Winsock2 library function %s

ECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s$''%s'' is not a valid component name

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Ancestor for '%s' not found

Cannot assign a %s to a %s

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value

I/O error %d

Integer overflow Invalid floating point operation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1480
   %original file name%.exe:276
   attrib.exe:440
   Server.exe:216
   Server.exe:596
   Server.exe:1168
   Server.exe:316
   Server.exe:1648
   Server.exe:1924
   Server.exe:1856
   Server.exe:1968
   Server.exe:1944
   Server.exe:956
   Server.exe:1112
   Server.exe:464
   Server.exe:420
   Server.exe:1016
   Server.exe:1124
   Server.exe:1136
   Server.exe:1932
   Server.exe:1956
   Server.exe:1792
   Server.exe:1756
   Server.exe:1088
   Server.exe:1700
   Server.exe:1600
   Server.exe:1820
   Server.exe:1680
   Server.exe:2000
   Server.exe:1748
   Server.exe:1360
   Server.exe:1976
   Server.exe:2008
   Server.exe:800
   Server.exe:376
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Win\MSstart.exe (2105 bytes)
   %System%\SpyNet\Server.exe (2105 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\SelfDelete.bat (330 bytes)
   %System%\SpyNet\logs_VCAQ58cSQ5cAQ\logs_29-10-2015.txt (290 bytes)
   

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Server" = "%System%\SpyNet\Server.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
   "Server" = "%System%\SpyNet\Server.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Server" = "%System%\SpyNet\Server.exe"

5. Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
   "Shell" = "explorer.exe %System%\SpyNet\Server.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   "Shell" = "explorer.exe %System%\SpyNet\Server.exe"

6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.