You're 100% sure? I would expect to see registry diffs before/after FileZilla was installed, disassembled code of the subroutine accessing your passwords in the

You're 100% sure? I would expect to see registry diffs before/after FileZilla was installed, disassembled code of the subroutine accessing your passwords in the malicious program, and a network packet capture of your data being sent over the wire.