racoon_c2_strings

sgnl_
tlgrm_
ews_
grbr_
dscrd_
%s\tTRUE\t%s\t%s\t%s\t%s\t%s\n
URL:%s\nUSR:%s\nPASS:%s\n
\t\t%d) %s\n"  tabtabd
\tLocale: %s\n
\tOS: %s\n
\tRAM: %d MB\n
\tTime zone: %c%ld minutes from GMT\n
\tDisplay size: %dx%d\n
%d
\tArchitecture: x%d\n
\tCPU: %s (%d cores)\n
\tDisplay Devices:\n%s\n
formhistory.sqlite
*
\
\n
\r
:
%
;
_
|"
\*
logins.json
\\autofill.txt
\\cookies.txt
\\passwords.txt
---
--
*/*
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Content-Type: multipart/form-data; boundary=
Content-Type: text/plain;
User Data
wallets
wlts_
ldr_
scrnsht_
sstmnfo_
token:
nss3.dll
sqlite3.dll
SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion
PATH
Product Name
Web Data
Login Data
sqlite3_prepare_v2
sqlite3_open16
sqlite3_close
sqlite3_step
sqlite3_finalize
sqlite3_column_text16
sqlite_column_bytes16
sqlite_column_blob
SELECT origin_url, username_value, password_value FROM logins
SELECT host_key, path, is_secure , expires_utc, name, encrypted_value FROM cookies
SELECT name, value FROM autofill
 pera
Stable
SELECT host, path, isSecure, expiry, name, value FROM moz_cookies
SELECT fieldname, value FROM moz_formhistory
cookies.sqlite
machineId=
&configId=
\"encrypted_key\":\
stats_version\":\"
Content-Type: application/x-object
Content-Disposition: form-data; name=\"file\"; filename=\"
GET
POST
Low
MachineGuid
image/jpeg
gdiplus.dll
gdi32.dll
GdiplusStartup
GdiDisposeImage
GdiGetImageEncoders
GdiGetImageEncodersSize
GdiCreateBitmapFromHBITMAP
GdipSaveImageToFile
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
GetObjectW
SelectObject
SetStretchBltMode
StretchBlt
SELECT name_on_card, card_number_encrypted, expiration_month, expiration_year FROM credit_cards
Cookies
Network\\Cookies
NUM:%s\nHOLDER:%s\nEXP:%s/%s\n
\\CC.txt
NSS_Init
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_Authenticate
PK11SDR_Decrypt
SECITEM_FreeItem
hostname\":\"
\",\"httpRealm\":
encryptedUsername\":\"
\",\"encryptedPassword\":\"
\",\"guid\":
Profiles
://
ru"
S-1-5-18
v10
/
Default
Profile %d
extensions
xtntns_
prefs.js
storage\\default
ff
MetaMask
.sqlite
\\\"webextension@metamask.io\\\":\\\"
TRUE
FALSE
0x31
explorer.exe
SOFTWARE\\Microsoft\\Cryptography
SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall
DisplayName
DisplayVersion
\t%s %s\n
\\ffcookies.txt
?
Local State
..
.
wallet.dat