rat gh0st strings unpacked mod

SELECT DATETIME(moz_historyvisits.visit_date/1000000, "unixepoch", "localtime"),moz_places.title,moz_places.url
FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id ORDER By
moz_historyvisits.visit_date DESC LIMIT 0, 10000
%TEMP%\\curbuf.dat
/c %WINDIR%\\system32\\timeout.exe 3 & del "
SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch") , urls.title , urls.url FROM urls, visits
WHERE urls.id = visits.url ORDER By visits.visit_time DESC LIMIT 0, 10000
http://ip-api.com/json
https://dotbit.me/a/
InternetCrackUrlA
content-length:
GetKeyboardType
PasswordsList.txt
gethostbyname
Connection: close
uIE7_decodeU
uFileFinderU
UHJvY2Vzc29yTmFtZVN0cmluZw==
Process32FirstW
Software\\Martin Prikryl\\WinSCP 2\\Sessions\\
GetCurrentProcessId
Process32NextW
GlobalUnlock
Browsers\\Cookies
PVAULT_CRED8
SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion
InternetExplorer
CreateEnvironmentBlock
AllocateAndInitializeSid
InternetOpenA
CryptGetHashParam
CryptDestroyHash
GlobalMemoryStatus
Windows :
WTSGetActiveConsoleSessionId
%APPDATA%\\Skype
GetSystemInfo
GetProcAddress
Software\\Valve\\Steam
CryptCreateHash
SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==
.address.txt
outlookDecrU
Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)
axx.trustbro.ru
\\places.sqlite
Browsers\\History
SOFTWARE\\Microsoft\\Cryptography
%appdata%\\Telegram Desktop\\tdata\\
Computer(Username) :
%APPDATA%\\.purple\\accounts.xml
\\accounts.xml
SOFTWARE\\Borland\\Delphi\\RTL
"countryCode":"
353E77DF-928B-4941-A631-512662F0785A3061-4E40-BBC2-3A27F641D32B-54FF-44D7-85F3-D950F519F12F
MozillaBased
D877F783D5*,map*
Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90
a2VybmVsMzIuZGxs
%PROGRAMDATA%\\
RGlzcGxheU5hbWU=
uProgAndProc
RGlzcGxheVZlcnNpb24=
\\Config\\*.vdf
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
UHJvY2VzczMyTmV4dFc=
UHJvY2VzczMyRmlyc3RX
U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==
U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs