PrivateLoader main component strings

0x1000144e: 10
0x10001662: Snowman+under_a_sn0wdrift_forgot_the_Snow_Maiden
0x10011ff1: CBC
0x1001fe6d: SOFTWARE\LilFreske
0x1002037a: SOFTWARE\LilFreske
0x10020777: Installed
0x1002169f: .
0x10021a17: .dll
0x10021fdf: #
0x100223fd: IsWow64Process
0x10022545: GetModuleHandleA
0x1002268d: LoadLibraryA
0x100227c9: SetPriorityClass
0x1002290e: Sleep
0x10022a06: GetTempPathA
0x10022afe: CreateProcessA
0x10022c46: GetFileAttributesA
0x10022dde: CreateDirectoryA
0x10022f26: CreateThread
0x1002301e: CloseHandle
0x10023116: VirtualAlloc
0x1002320e: VirtualFree
0x10023306: OpenProcess
0x1002344e: TerminateProcess
0x10023596: GetUserGeoID
0x1002369a: ntdll.dll
0x100237dd: NtQuerySystemInformation
0x10023928: RtlGetVersion
0x10023a2f: Shell32.dll
0x10023b3b: Shell32.dll
0x10023c33: Shell32.dll
0x10023d26: ShellExecuteA
0x10023e71: SHGetFolderPathA
0x10023fc7: Advapi32.dll
0x100240d3: Advapi32.dll
0x100241cc: Advapi32.dll
0x100242bf: RegOpenKeyExA
0x100243ba: RegSetValueExA
0x100244b5: RegCloseKey
0x100245b0: RegCreateKeyExA
0x100246ab: RegDeleteKeyA
0x100247a6: RegDeleteValueA
0x100248d6: RegQueryValueExA
0x10024a1e: RegEnumKeyExA
0x10024b4e: ConvertSidToStringSidA
0x10024ccb: LookupAccountNameA
0x10024e1f: WINHTTP.dll
0x10024f2b: WINHTTP.dll
0x10025023: wininet.dll
0x1002512f: wininet.dll
0x1002528e: GetComputerNameA
0x10025417: VerSetConditionMask
0x100255ac: VerifyVersionInfoW
0x100256f4: GetGeoInfoA
0x1002583c: GetCurrentProcess
0x10025984: GetVersionExA
0x10025acc: MultiByteToWideChar
0x10025c64: WideCharToMultiByte
0x10025dfc: GetCurrentProcessId
0x10025f94: CreateToolhelp32Snapshot
0x100260dc: Process32First
0x100261d4: Process32Next
0x10026301: Wow64DisableWow64FsRedirection
0x1002647b: Wow64RevertWow64FsRedirection
0x100265cc: User32.dll
0x100266d7: User32.dll
0x100267ca: CharToOemA
0x10026a2f: null
0x1002777c: //Adobe Films
0x10027b62: SOFTWARE\Policies\Microsoft\Windows Defender
0x100280a5: DisableAntiSpyware
0x10028626: DisableRoutinelyTakingAction
0x10028f19: SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
0x100294c1: DisableBehaviorMonitoring
0x100299a1: DisableOnAccessProtection
0x10029c97: DisableScanOnRealtimeEnable
0x1002a0f2: DisableRealtimeMonitoring
0x1002a6dd: DisableIOAVProtection
0x1002aab0: DisableRawWriteNotification
0x1002c2cb: Windows Server 2016
0x1002c5e5: Windows Server 2012 R2
0x1002c8fe: Windows Server 2012
0x1002cbf4: Windows Server 2008 R2
0x1002cf95: Windows Server 2008
0x1002d0d9: Windows Server
0x1002d47f: Windows 10
0x1002d79d: Windows 8.1
0x1002da11: Windows 8
0x1002dc9d: Windows 7
0x1002df1c: Windows Vista
0x1002e018: Windows XP
0x1002e173:  (x64)
0x1002e228:  (x32)
0x1002e52d: rb
0x1002ede3: explorer.exe
0x1002efc8: pid
0x1002f0bf: path
0x1002f2a2: md5
0x1002f391: current
0x1002f4dd: children
0x1002f61b: children
0x1002fdec: SOFTWARE\Classes\ms-settings\Shell\Open\command
0x100302be: DelegateExecute
0x10030941: \ComputerDefaults.exe
0x10030aa5: rb
0x10030c63: open
0x10031136: SOFTWARE\Classes
0x1003156b: ms-settings\Shell\Open\command
0x10031723: ms-settings\Shell\Open
0x100318db: ms-settings\Shell
0x10031a42: ms-settings
0x100322c6: CBC
0x10032641: data=
0x100328e2: /base/api/getData.php
0x100329f4: http://
0x10033631: |
0x100336f0: |
0x100337af: GetLinks|
0x10033a48: Error!
0x10033d71: id
0x100340bb: url
0x10034405: args
0x1003475e: type
0x100348a6: onlyType
0x10034fd3: |
0x10035092: |
0x10035151: GetExtensions|
0x10035429: Error!
0x10035836: id
0x10035948: ext_url
0x10035c92: cfg_url
0x10036652: ipinfo.io/widget
0x10036a76: country
0x10036b9e: country
0x10036ca8: company
0x10036de8: company
0x10036ec8: name
0x10037003: Google LLC
0x1003715b: company
0x1003723b: name
0x1003757c: db-ip.com
0x10037740: data-api-key="
0x100378e2: /self
0x10037a06: api.db-ip.com/v2/
0x10037eb0: countryCode
0x10037fd8: countryCode
0x100380e2: organization
0x10038211: Google LLC
0x10038351: organization
0x10038809: www.maxmind.com/geoip/v2.1/city/me
0x10038aac: country
0x10038bd4: country
0x10038d14: country
0x10038df4: iso_code
0x10038f40: country
0x10039020: iso_code
0x10039136: traits
0x10039276: traits
0x10039356: organization
0x10039491: Google LLC
0x100395ea: traits
0x100396ca: organization
0x100399bc: GetIP
0x10039abc: IP:
0x10039bb9: IP:
0x1003a09b: api.ipgeolocation.io/ipgeo?include=hostname&ip=
0x1003a433: country_code2
0x1003a55b: country_code2
0x1003a665: organization
0x1003a794: Google LLC
0x1003a8d8: organization
0x1003d464: rb
0x1003da18: wb
0x1003f5d7: Guest Profile
0x1003f716: System Profile
0x1004021a: \Google\Chrome\Application
0x1004044a:  (x86)\Google\Chrome\Application
0x1004066d: \Google\Chrome\Application
0x1004083d:  (x86)\Google\Chrome\Application
0x10040b93: SOFTWARE\Google\Chrome\BLBeacon
0x10040e7a: version
0x10040fcd: \resources.pak
0x100410b9: \
0x100413fd: SOFTWARE\Google\Chrome\PreferenceMACs
0x100416c5: \Google\Chrome\User Data\
0x10041992: \Secure Preferences
0x10041f0a: filter_browsers
0x1004205d: filter_browsers
0x10042227: chrome
0x10042318: browser
0x1004257b: filter_browsers
0x1004274c: use_open_browser
0x10042938: use_open_browser
0x10042b1b: use_open_browser
0x10042cec: extensions
0x10042dcc: settings
0x10042f38: extensions
0x10043018: settings
0x1004311c: install_time
0x100432ef: extensions
0x100433cf: settings
0x100434d3: path
0x100435d7: \Extensions\
0x10043717: \/
0x100439ae: extensions
0x10043a8e: settings
0x10043bc4: \u003C
0x10043cb6: <
0x10043e51: protection
0x10043f31: macs
0x1004401d: extensions
0x10044109: settings
0x100442a4: extensions.settings.
0x100444cf: protection
0x100445af: macs
0x1004469b: protection
0x1004477b: super_mac
0x10044941: chrome.exe
0x10044ff4: extensions
0x100450d4: settings
0x10045228: extensions.settings.
0x100453e0: ChromeRegistryHashStoreValidationSeed
0x10045873: \extensions.settings
0x10045a58: SOFTWARE\Google\Chrome\PreferenceMACs\
0x10046881: \chrome.exe
0x10047039: \Microsoft\Edge\Application
0x10047259:  (x86)\Microsoft\Edge\Application
0x1004747c: \Microsoft\Edge\Application
0x1004764c:  (x86)\Microsoft\Edge\Application
0x10047acf: SOFTWARE\Microsoft\Edge\BLBeacon
0x10047e06: version
0x10048077: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x1004833f: \Microsoft\Edge\User Data\
0x10048521: \Secure Preferences
0x10048a84: filter_browsers
0x10048bd7: filter_browsers
0x10048da1: edge
0x10048e92: browser
0x100490ea: filter_browsers
0x100492bb: use_open_browser
0x100494a7: use_open_browser
0x1004968a: use_open_browser
0x1004985b: extensions
0x1004993b: settings
0x10049aa7: extensions
0x10049b87: settings
0x10049c8b: install_time
0x10049e5e: extensions
0x10049f3e: settings
0x1004a042: path
0x1004a146: \Extensions\
0x1004a286: \/
0x1004a51d: extensions
0x1004a5fd: settings
0x1004a733: \u003C
0x1004a825: <
0x1004a9c0: protection
0x1004aaa0: macs
0x1004ab8c: extensions
0x1004ac78: settings
0x1004ae13: extensions.settings.
0x1004b03e: protection
0x1004b11e: macs
0x1004b20a: protection
0x1004b2ea: super_mac
0x1004b4b0: msedge.exe
0x1004bb63: extensions
0x1004bc43: settings
0x1004bd97: extensions.settings.
0x1004bf4f: ChromeRegistryHashStoreValidationSeed
0x1004c285: \extensions.settings
0x1004c46a: SOFTWARE\Microsoft\Edge\PreferenceMACs\
0x1004ce8e: \msedge.exe
0x1004d2bd: \Roaming
0x1004d3ba: \Roaming
0x1004d4cf: \atomic
0x1004d615: \Atomic Wallet
0x1004d7ab: \com.liberty.jaxx
0x1004d941: \Electrum
0x1004da87: \Exodus
0x1004dbcd: \MultiDoge
0x1004dd13: \Exodus
0x1004de59: \Monero
0x1004df9f: \binance.chain
0x1004e0e5: \Binance
0x1004e22b: \Metamask
0x1004e55b: SOFTWARE\Google\Chrome\PreferenceMACs
0x1004e7b8: \Google\Chrome\User Data\
0x1004ea3a: \Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
0x1004ed76: \Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
0x1004f0b2: \Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
0x1004f3ee: \Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
0x1004f72a: \Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
0x1004fa66: \Local Extension Settings\fhilaheimglignddkjgofkcbgekhenbh
0x1004fda2: \Local Extension Settings\mgffkfbidihjpoaomajlbgchddlicgpn
0x100500de: \Local Extension Settings\aodkkagnadcbobfpggfnjeongemjbjca
0x1005041a: \Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
0x10050756: \Local Extension Settings\fmblappgoiilbgafhjklehhfifbdocee
0x10050a92: \Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieaf
0x10050dce: \Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
0x1005110a: \Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
0x100513d9: robinhood.com
0x100514e8: yobit.net
0x100515f7: zb.com
0x10051706: binance.com
0x10051815: huobi.com
0x10051924: okex.com
0x10051a33: hitbtc.com
0x10051b42: bitfinex.com
0x10051c51: kraken.com
0x10051d60: bitstamp.net
0x10051e6f: payoneer.com
0x10051f7e: bittrex.com
0x100520dd: bittrex.zendesk.com
0x1005223c: gate.io
0x1005234b: exmo.com
0x1005245a: yobit.io
0x10052569: bitflyer.com
0x10052678: poloniex.com
0x10052787: kucoin.com
0x10052896: coinone.co.kr
0x100529f5: localbitcoins.com
0x10052b54: korbit.co.kr
0x10052c63: cex.io
0x10052d72: luno.com
0x10052e81: bitkonan.com
0x10052f90: jubi.com
0x1005309f: koinex.in
0x100531ae: koineks.com
0x100532bd: kuna.io
0x100533cc: koinim.com
0x100534db: kiwi-coin.com
0x100535ea: leoxchange.com
0x100536f9: lykke.com
0x10053808: localtrade.cc
0x10053917: magnr.com
0x10053a26: lbank.info
0x10053b35: itbit.com
0x10053c44: gemini.com
0x10053d53: gdax.com
0x10053e62: gatehub.net
0x10053fc1: satoshitango.com
0x10054120: foxbit.com.br
0x1005422f: flowbtc.com.br
0x1005433e: exx.com
0x1005444d: exrates.me
0x100545ac: excambriorex.com
0x1005470b: ezbtc.ca
0x1005486a: infinitycoin.exchange
0x100549c9: tdax.com
0x10054ad8: stex.com
0x10054be7: vbtc.exchange
0x10054d46: coinmarketcap.com
0x10054ea5: vwlpro.com
0x10054fb4: nocks.com
0x100550c3: nlexch.com
0x10055222: novaexchange.com
0x10055381: mynxt.info
0x10055490: nzbcx.com
0x1005559f: nevbit.com
0x100556ae: mixcoins.com
0x100557bd: mr.exchange
0x100558cc: neraex.pro
0x100559db: dsx.uk
0x10055aea: okcoin.com
0x10055bf9: liquid.com
0x10055d08: quoine.com
0x10055e17: quadrigacx.com
0x10055f26: rightbtc.com
0x10056035: rippex.net
0x10056144: ripplefox.com
0x10056253: qryptos.com
0x10056362: ore.bz
0x10056471: openledger.info
0x10056580: omnidex.io
0x1005668f: paribu.com
0x1005679e: paymium.com
0x100568ad: dcexchange.ru
0x100569bc: dcexe.com
0x10056acb: bitmex.com
0x10056bda: funpay.ru
0x10056ce9: bitmaszyna.pl
0x10056df8: bitonic.nl
0x10056f07: bitpanda.com
0x10057066: bitsblockchain.net
0x100571c5: bitmarket.net
0x100572d4: bitlish.com
0x100573e3: bitfex.trade
0x100574f2: blockchain.com
0x10057601: blockchain.info
0x10057710: cryptofresh.com
0x1005781f: btcmarkets.net
0x1005792e: braziliex.com
0x10057a8d: btc-trade.com.ua
0x10057bec: btc-alpha.com
0x10057cfb: bitspark.io
0x10057e0a: bitso.com
0x10057f69: bittylicious.com
0x10058118: altcointrader.co.za
0x100582c7: arenabitcoin.com
0x10058426: allcoin.com
0x10058535: 796.com
0x10058644: abucoins.com
0x10058753: aidosmarket.com
0x100588b2: bitcointrade.com
0x10058a61: bitcointoyou.com
0x10058bc0: bitbanktrade.jp
0x10058ccf: big.one
0x10058dde: bcex.ca
0x10058eed: bitconnect.co
0x10058ffc: coinsbank.com
0x1005910b: coinsecure.in
0x1005921a: coinsquare.com
0x10059329: coinspot.io
0x10059488: coinsmarkets.com
0x10059637: crypto-bridge.org
0x10059796: dcex.com
0x100598a5: dabtc.com
0x100599b4: decentrex.com
0x10059ac3: deribit.com
0x10059bd2: dgtmarket.com
0x10059ce1: btcturk.com
0x10059df0: btcxindia.com
0x10059eff: bt.cx
0x1005a00e: bitstarcoin.com
0x1005a11d: coincheck.com
0x1005a22c: coinmate.io
0x1005a33b: coingi.com
0x1005a44a: coinnest.co.kr
0x1005a559: coinrail.co.kr
0x1005a668: coinpit.io
0x1005a777: coingather.com
0x1005a886: coinfloor.co.uk
0x1005a995: coinegg.com
0x1005aaa4: coincorner.com
0x1005abb3: coinexchange.io
0x1005ad12: pancakeswap.finance
0x1005ae71: coinbase.com
0x1005af80: livecoin.net
0x1005b08f: mercatox.com
0x1005b1ee: cryptobridge.freshdesk.com
0x1005b34d: volabit.com
0x1005b45c: tradeogre.com
0x1005b56b: bitkub.com
0x1005b67a: uphold.com
0x1005b7d9: wallet.uphold.com
0x1005b988: login.blockchain.com
0x1005bae7: tidex.com
0x1005bbf6: coinome.com
0x1005bd55: coinpayments.net
0x1005beb4: bitmax.io
0x1005bfc3: bitbank.cc
0x1005c122: independentreserve.com
0x1005c281: bitmart.com
0x1005c390: cryptopia.co.nz
0x1005c49f: cryptonator.com
0x1005c5ae: advcash.com
0x1005c70d: my.dogechain.info
0x1005c86c: spectrocoin.com
0x1005c97b: exir.io
0x1005ca8a: exir.tech
0x1005cb99: coinbene.com
0x1005cca8: bitforex.com
0x1005cdb7: gopax.co.kr
0x1005cec6: catex.io
0x1005cfd5: vindax.com
0x1005d0e4: coineal.com
0x1005d1f3: maicoin.com
0x1005d302: finexbox.com
0x1005d411: etherflyer.com
0x1005d520: bx.in.th
0x1005d62f: bitopro.com
0x1005d73e: citex.co.kr
0x1005d84d: coinzo.com
0x1005d95c: atomars.com
0x1005da6b: coinfinit.com
0x1005db7a: bitker.com
0x1005dc89: dobitrade.com
0x1005dd98: btcexa.com
0x1005dea7: satowallet.com
0x1005dfb6: cpdax.com
0x1005e0c5: trade.io
0x1005e1d4: btcnext.io
0x1005e2e3: exmarkets.com
0x1005e442: btc-exchange.com
0x1005e5a1: chaoex.com
0x1005e6b0: jex.com
0x1005e80f: therocktrading.com
0x1005e96e: gdac.com
0x1005eacd: southxchange.com
0x1005ec2c: tokens.net
0x1005ed3b: fexpro.net
0x1005ee4a: btcbox.co.jp
0x1005ef59: coinmex.com
0x1005f068: cryptology.com
0x1005f177: cointiger.com
0x1005f286: cashierest.com
0x1005f395: coinbit.co.kr
0x1005f4a4: mxc.com
0x1005f5b3: bilaxy.com
0x1005f6c2: coinall.com
0x1005f7d1: coindeal.com
0x1005f8e0: omgfin.com
0x1005f9ef: oceanex.pro
0x1005fafe: bithumb.com
0x1005fc0d: ftx.com
0x1005fd1c: shortex.net
0x1005fe2b: coin.z.com
0x1005ff3a: fcoin.com
0x10060049: fatbtc.com
0x100601a8: tokenize.exchange
0x10060307: simex.global
0x10060466: instantbitex.com
0x100607af: SOFTWARE\Google\Chrome\PreferenceMACs
0x100609e9: \Google\Chrome\User Data\
0x10060b7b: \Login Data
0x10060dfb: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x10061035: \Microsoft\Edge\User Data\
0x100611c7: \Login Data
0x100614a6: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x10061780: \BraveSoftware\Brave-Browser\User Data\
0x10061962: \Login Data
0x10061bfc: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x10061e36: \CryptoTab Browser\User Data\
0x10061fc8: \Login Data
0x10062329: \Roaming
0x10062426: \Roaming
0x1006257f: \Opera Software\Opera Stable
0x100626e8: \Login Data
0x10062999: binance.com
0x10062aa8: ascendex.com
0x10062bb7: kraken.com
0x10062cc6: huobi.com
0x10062dd5: coinbase.com
0x10062ee4: kucoin.com
0x10062ff3: hitbtc.com
0x10063102: gate.io
0x10063211: crypto.com
0x10063320: mercatox.com
0x1006342f: coins.ph
0x1006353e: coins.th
0x1006364d: poloniex.com
0x1006375c: bittrex.com
0x1006386b: bitpanda.com
0x1006397a: exmo.com
0x10063a89: dogechain.info
0x10063b98: luno.com
0x10063ca7: bitkub.com
0x10063db6: blockchain.com
0x10063ec5: livecoin.net
0x10064024: miningpoolhub.com
0x10064183: bitfinex.com
0x1006447c: SOFTWARE\Google\Chrome\PreferenceMACs
0x100646d9: \Google\Chrome\User Data\
0x1006486b: \Login Data
0x10064b75: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x10064dd2: \Microsoft\Edge\User Data\
0x10064f64: \Login Data
0x100652c9: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x100655c6: \BraveSoftware\Brave-Browser\User Data\
0x100657a8: \Login Data
0x10065ac8: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x10065d25: \CryptoTab Browser\User Data\
0x10065eb7: \Login Data
0x1006629e: \Roaming
0x1006639b: \Roaming
0x10066500: \Opera Software\Opera Stable
0x10066669: \Login Data
0x10066959: yobit.net
0x10066a68: yobit.io
0x10066b77: zb.com
0x10066c86: okex.com
0x10066d95: bitstamp.net
0x10066ea4: bitflyer.com
0x10066fb3: coinone.co.kr
0x10067112: localbitcoins.com
0x10067271: korbit.co.kr
0x10067380: bitmex.com
0x100674df: cryptobridge.freshdesk.com
0x1006763e: volabit.com
0x1006774d: tradeogre.com
0x1006785c: uphold.com
0x1006796b: tidex.com
0x10067a7a: coinome.com
0x10067b89: bitso.com
0x10067ce8: coinpayments.net
0x10067e47: coinexchange.io
0x10067f56: bitmax.io
0x10068065: btc-alpha.com
0x10068174: bitbank.cc
0x100682d3: independentreserve.com
0x10068432: bitmart.com
0x10068541: exmo.com
0x10068650: cex.io
0x1006875f: coinbase.com
0x1006886e: cryptopia.co.nz
0x1006897d: cryptonator.com
0x10068a8c: advcash.com
0x10068b9b: spectrocoin.com
0x10068caa: exir.io
0x10068db9: exir.tech
0x10068ec8: coinbene.com
0x10068fd7: bitforex.com
0x100690e6: gopax.co.kr
0x100691f5: catex.io
0x10069304: vindax.com
0x10069413: coineal.com
0x10069522: maicoin.com
0x10069631: finexbox.com
0x10069740: etherflyer.com
0x1006984f: bx.in.th
0x1006995e: bitopro.com
0x10069a6d: lbank.info
0x10069b7c: citex.co.kr
0x10069c8b: coinzo.com
0x10069d9a: atomars.com
0x10069ea9: coinfinit.com
0x10069fb8: bitker.com
0x1006a117: btc-trade.com.ua
0x1006a276: dobitrade.com
0x1006a385: btcexa.com
0x1006a494: satowallet.com
0x1006a5a3: cpdax.com
0x1006a6b2: trade.io
0x1006a7c1: btcnext.io
0x1006a8d0: exmarkets.com
0x1006a9df: localtrade.cc
0x1006ab3e: btc-exchange.com
0x1006ac9d: chaoex.com
0x1006adac: jex.com
0x1006af0b: therocktrading.com
0x1006b06a: gdac.com
0x1006b1c9: southxchange.com
0x1006b328: tokens.net
0x1006b437: fexpro.net
0x1006b546: btcbox.co.jp
0x1006b655: coinmex.com
0x1006b764: cryptology.com
0x1006b873: kuna.io
0x1006b982: cointiger.com
0x1006ba91: cashierest.com
0x1006bba0: liquid.com
0x1006bcaf: coinbit.co.kr
0x1006bdbe: mxc.com
0x1006becd: bilaxy.com
0x1006bfdc: coinall.com
0x1006c0eb: coindeal.com
0x1006c1fa: omgfin.com
0x1006c309: stex.com
0x1006c418: oceanex.pro
0x1006c527: bithumb.com
0x1006c636: ftx.com
0x1006c745: shortex.net
0x1006c854: coin.z.com
0x1006c963: fcoin.com
0x1006ca72: fatbtc.com
0x1006cbd1: tokenize.exchange
0x1006cd30: simex.global
0x1006ce8f: instantbitex.com
0x1006cfee: btcmarkets.net
0x1006d2e7: SOFTWARE\Google\Chrome\PreferenceMACs
0x1006d521: \Google\Chrome\User Data\
0x1006d6b3: \Login Data
0x1006d933: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x1006db6d: \Microsoft\Edge\User Data\
0x1006dcff: \Login Data
0x1006dfde: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x1006e2b8: \BraveSoftware\Brave-Browser\User Data\
0x1006e49a: \Login Data
0x1006e734: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x1006e96e: \CryptoTab Browser\User Data\
0x1006eb00: \Login Data
0x1006ee61: \Roaming
0x1006ef5e: \Roaming
0x1006f0b7: \Opera Software\Opera Stable
0x1006f220: \Login Data
0x1006f4c9: binance.com
0x1006f7c4: SOFTWARE\Google\Chrome\PreferenceMACs
0x1006fa21: \Google\Chrome\User Data\
0x1006fbb3: \Login Data
0x1006fecc: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x10070129: \Microsoft\Edge\User Data\
0x100702bb: \Login Data
0x1007062f: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x1007092c: \BraveSoftware\Brave-Browser\User Data\
0x10070b0e: \Login Data
0x10070e2e: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x1007108b: \CryptoTab Browser\User Data\
0x1007121d: \Login Data
0x10071604: \Roaming
0x10071701: \Roaming
0x10071866: \Opera Software\Opera Stable
0x100719cf: \Login Data
0x10071cf9: etrade.com
0x10071e08: schwab.com
0x10071f17: fidelity.com
0x10072026: chase.com
0x10072185: morganstanley.com
0x100722e4: citi.com
0x100723f3: robinhood.com
0x10072502: navyfederal.org
0x10072611: ally.com
0x10072770: schoolsfirstfcu.org
0x100728cf: redfcu.org
0x100729de: mtb.com
0x10072aed: 53.com
0x10072bfc: easternbank.com
0x10072d5b: bankofamerica.com
0x10072eba: santander.com
0x10072fc9: marcus.com
0x100730d8: schools.org
0x100731e7: cu.com
0x100732f6: usaa.com
0x100735ef: SOFTWARE\Google\Chrome\PreferenceMACs
0x1007384c: \Google\Chrome\User Data\
0x100739de: \Login Data
0x10073ce8: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x10073f45: \Microsoft\Edge\User Data\
0x100740d7: \Login Data
0x1007443c: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x10074739: \BraveSoftware\Brave-Browser\User Data\
0x1007491b: \Login Data
0x10074c3b: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x10074e98: \CryptoTab Browser\User Data\
0x1007502a: \Login Data
0x10075411: \Roaming
0x1007550e: \Roaming
0x10075673: \Opera Software\Opera Stable
0x100757dc: \Login Data
0x10075b09: ncsecu.org
0x10075c18: penfed.org
0x10075d27: becu.org
0x10075e86: schoolsfirstfcu.org
0x10076035: firsttechfed.com
0x10076194: golden1.com
0x100762f3: alliantcreditunion.org
0x100764a2: americafirst.com
0x10076651: suncoastcreditunion.com
0x100767b0: secumd.org
0x100768bf: safecu.org
0x100769ce: missionfed.com
0x10076add: greendot.com
0x10076c3c: firsttechfed.com
0x10076deb: americafirst.com
0x10076f4a: rbfcu.org
0x10077059: macu.com
0x10077168: dcu.org
0x10077277: ssfcu.org
0x10077386: bethpagefcu.com
0x10077495: starone.org
0x100775a4: alaskausa.org
0x100776b3: sdccu.com
0x10077812: aacreditunion.org
0x10077971: lmcu.org
0x10077a80: teachersfcu.org
0x10077b8f: patelco.org
0x10077c9e: esl.org
0x10077dad: onpointcu.com
0x10077f0c: logixbanking.com
0x1007806b: psecu.com
0x100781ca: deltacommunitycu.com
0x10078329: ent.com
0x10078438: cefcu.com
0x10078547: greenstate.org
0x10078656: unfcu.org
0x10078765: pffcu.org
0x100788c4: wingsfinancial.com
0x10078a73: iccu.comdesertfinancial.com
0x10078bd2: iccu.com
0x10078d31: desertfinancial.com
0x10078e90: hvfcu.org
0x10078f9f: wpcu.coop
0x100790ae: redwoodcu.org
0x100791bd: tcunet.com
0x100792cc: wsecu.org
0x1007942b: joviafinancial.com
0x1007958a: coastal24.com
0x10079699: myeecu.org
0x100797f8: gecreditunion.org
0x10079957: nymcu.org
0x10079a66: affinityfcu.com
0x10079b75: towerfcu.org
0x10079c84: safecu.org
0x10079d93: ccu.com
0x10079ef2: communityamerica.com
0x1007a051: langleyfcu.org
0x1007a160: credithuman.com
0x1007a26f: techcu.com
0x1007a37e: gecu.com
0x1007a48d: kfcu.org
0x1007a59c: applefcu.org
0x1007a6ab: nasafcu.com
0x1007a7ba: sfcu.org
0x1007a8c9: genisyscu.org
0x1007a9d8: unifyfcu.com
0x1007aae7: apcocu.org
0x1007ac46: firstcommunity.com
0x1007ada5: unitedfcu.com
0x1007aeb4: fairwinds.org
0x1007afc3: ufcu.org
0x1007b0d2: wescom.org
0x1007b1e1: missionfed.com
0x1007b2f0: bcu.org
0x1007b3ff: vacu.org
0x1007b55e: citadelbanking.com
0x1007b6bd: servicecu.org
0x1007b81c: summitcreditunion.com
0x1007b97b: secumd.org
0x1007ba8a: gesa.com
0x1007bb99: chevronfcu.org
0x1007bca8: traviscu.org
0x1007bdb7: uwcu.org
0x1007bf16: communityfirstcu.org
0x1007c075: ecu.org
0x1007c184: sccu.com
0x1007c293: bfsfcu.org
0x1007c3a2: bellco.org
0x1007c501: dfcufinancial.com
0x1007c660: msufcu.org
0x1007c76f: members1st.org
0x1007c87e: landmarkcu.com
0x1007c98d: kinecta.org
0x1007ca9c: midflorida.com
0x1007cbab: visionsfcu.org
0x1007ccba: veridiancu.org
0x1007ce19: statefarmfcu.com
0x1007cf78: tinkerfcu.org
0x1007d087: sefcu.com
0x1007d1e6: americanheritagecu.org
0x1007d345: robinsfcu.org
0x1007d454: canvas.org
0x1007d5b3: growfinancial.org
0x1007d712: truliantfcu.org
0x1007d821: fairwinds.org
0x1007d930: ascend.org
0x1007da3f: foundersfcu.com
0x1007db4e: calcoastcu.org
0x1007dc5d: ucu.org
0x1007dd6c: connexuscu.org
0x1007de7b: slfcu.org
0x1007df8a: numericacu.com
0x1007e099: eecu.org
0x1007e1a8: georgiasown.org
0x1007e2b7: nusenda.org
0x1007e416: tvacreditunion.com
0x1007e575: pcu.org
0x1007e684: msgcu.org
0x1007e7e3: nuvisionfederal.com
0x1007e992: trumarkonline.org
0x1007eaf1: navigantcu.org
0x1007ec00: ornlfcu.com
0x1007ed0f: jscfcu.org
0x1007ee1e: lgfcu.org
0x1007ef7d: elevationscu.com
0x1007f12c: gtefinancial.org
0x1007f28b: chartway.com
0x1007f39a: ecu.com
0x1007f4a9: sdfcu.org
0x1007f5b8: apcu.com
0x1007f6c7: schools.org
0x1007f7d6: metrocu.org
0x1007f8e5: campuscu.com
0x1007f9f4: adviacu.org
0x1007fb03: psfcu.com
0x1007fc12: andrewsfcu.org
0x1007fd21: eglinfcu.org
0x1007fe30: imcu.com
0x1007ff8f: americaneagle.org
0x100800ee: ttcu.com
0x100801fd: vantagewest.org
0x1008030c: empowerfcu.com
0x1008041b: rfcu.com
0x1008052a: capcomfcu.org
0x10080689: arizonafederal.org
0x10080838: csecreditunion.com
0x100809e7: communityfirstfl.org
0x10080b46: bayportcu.org
0x10080c55: gwcu.org
0x10080d64: wecu.com
0x10081060: SOFTWARE\Google\Chrome\PreferenceMACs
0x1008129a: \Google\Chrome\User Data\
0x1008142c: \Login Data
0x100816ac: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x100818e6: \Microsoft\Edge\User Data\
0x10081a78: \Login Data
0x10081d57: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x10082031: \BraveSoftware\Brave-Browser\User Data\
0x10082213: \Login Data
0x100824ad: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x100826e7: \CryptoTab Browser\User Data\
0x10082879: \Login Data
0x10082bda: \Roaming
0x10082cd7: \Roaming
0x10082e30: \Opera Software\Opera Stable
0x10082f99: \Login Data
0x10083249: stgeorge.com.au
0x10083358: imb.com.au
0x10083467: ing.com.au
0x100835c6: bankofmelbourne.com.au
0x10083775: regionalaustraliabank.com
0x100838d4: suncorp.com.au
0x10083a33: regionalaustraliabank.com.au
0x10083d7e: SOFTWARE\Google\Chrome\PreferenceMACs
0x10083fdb: \Google\Chrome\User Data\
0x1008416d: \Login Data
0x10084486: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x100846e3: \Microsoft\Edge\User Data\
0x10084875: \Login Data
0x10084bda: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x10084ed7: \BraveSoftware\Brave-Browser\User Data\
0x100850b9: \Login Data
0x100853d9: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x10085636: \CryptoTab Browser\User Data\
0x100857c8: \Login Data
0x10085baf: \Roaming
0x10085cac: \Roaming
0x10085e11: \Opera Software\Opera Stable
0x10085f7a: \Login Data
0x100862f9: neofinancial.com
0x10086458: bmo.com
0x100865b7: rbcroyalbank.com
0x10086903: SOFTWARE\Google\Chrome\PreferenceMACs
0x10086b60: \Google\Chrome\User Data\
0x10086cf2: \Login Data
0x1008700b: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x10087268: \Microsoft\Edge\User Data\
0x100873fa: \Login Data
0x1008776e: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x10087a6b: \BraveSoftware\Brave-Browser\User Data\
0x10087c4d: \Login Data
0x10087f6d: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x100881ca: \CryptoTab Browser\User Data\
0x1008835c: \Login Data
0x10088743: \Roaming
0x10088840: \Roaming
0x100889a5: \Opera Software\Opera Stable
0x10088b0e: \Login Data
0x10088e39: usaa.com
0x10089134: SOFTWARE\Google\Chrome\PreferenceMACs
0x10089391: \Google\Chrome\User Data\
0x10089523: \Login Data
0x1008983c: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x10089a99: \Microsoft\Edge\User Data\
0x10089c2b: \Login Data
0x10089f9f: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x1008a29c: \BraveSoftware\Brave-Browser\User Data\
0x1008a47e: \Login Data
0x1008a79e: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x1008a9fb: \CryptoTab Browser\User Data\
0x1008ab8d: \Login Data
0x1008af74: \Roaming
0x1008b071: \Roaming
0x1008b1d6: \Opera Software\Opera Stable
0x1008b33f: \Login Data
0x1008b669: robinhood.com
0x1008b778: navyfederal.org
0x1008ba71: SOFTWARE\Google\Chrome\PreferenceMACs
0x1008bcce: \Google\Chrome\User Data\
0x1008be60: \Login Data
0x1008c179: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x1008c3d6: \Microsoft\Edge\User Data\
0x1008c568: \Login Data
0x1008c8dc: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x1008cbd9: \BraveSoftware\Brave-Browser\User Data\
0x1008cdbb: \Login Data
0x1008d0db: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x1008d338: \CryptoTab Browser\User Data\
0x1008d4ca: \Login Data
0x1008d8b1: \Roaming
0x1008d9ae: \Roaming
0x1008db13: \Opera Software\Opera Stable
0x1008dc7c: \Login Data
0x1008dfa9: tboholidays.com
0x1008e0b8: 24x7rooms.com
0x1008e1c7: adonis.com
0x1008e2d6: abreuonline.com
0x1008e3e5: almundo.com.ar
0x1008e4f4: bonotel.com
0x1008e603: bookohotel.com
0x1008e712: didatravel.com
0x1008e821: dotwconnect.com
0x1008e930: eetglobal.com
0x1008ea3f: escalabeds.com
0x1008eb9e: fastpayhotels.com
0x1008ecfd: getaroom.com
0x1008ee0c: goglobal.travel
0x1008ef1b: hoteldo.com.mx
0x1008f02a: hotelspro.com
0x1008f139: jumbonline.com
0x1008f248: kaluahtours.com
0x1008f357: lci-euro.com
0x1008f4b6: lotsofhotels.com
0x1008f615: mikinet.co.uk
0x1008f724: misterroom.com
0x1008f833: nexustours.com
0x1008f992: olympiaeurope.com
0x1008faf1: paximum.com
0x1008fc00: restel.es
0x1008fd0f: rezserver.com
0x1008fe1e: rezlive.com
0x1008ff2d: sunhotels.com
0x1009003c: totalstay.com
0x1009014b: travco.co.uk
0x1009025a: travellanda.com
0x10090369: smyrooms.com
0x10090478: welcomebeds.com
0x10090587: yalago.com
0x10090696: hotelbeds.com
0x10090992: SOFTWARE\Google\Chrome\PreferenceMACs
0x10090bef: \Google\Chrome\User Data\
0x10090d81: \Login Data
0x1009108b: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x100912e8: \Microsoft\Edge\User Data\
0x1009147a: \Login Data
0x100917df: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x10091adc: \BraveSoftware\Brave-Browser\User Data\
0x10091cbe: \Login Data
0x10091fde: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x1009223b: \CryptoTab Browser\User Data\
0x100923cd: \Login Data
0x100927b4: \Roaming
0x100928b1: \Roaming
0x10092a16: \Opera Software\Opera Stable
0x10092b7f: \Login Data
0x10092eb9: mercadolibre.com.mx
0x10093018: hsbc.com.mx
0x10093127: bbvanetcash.mx
0x10093286: scotiabank.com.mx
0x10093435: santander.com.mx
0x10093594: bbva.mx
0x10093890: SOFTWARE\Google\Chrome\PreferenceMACs
0x10093aed: \Google\Chrome\User Data\
0x10093c7f: \Login Data
0x10093f98: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x100941f5: \Microsoft\Edge\User Data\
0x10094387: \Login Data
0x100946ec: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x100949e9: \BraveSoftware\Brave-Browser\User Data\
0x10094bcb: \Login Data
0x10094eeb: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x10095148: \CryptoTab Browser\User Data\
0x100952da: \Login Data
0x100956c1: \Roaming
0x100957be: \Roaming
0x10095923: \Opera Software\Opera Stable
0x10095a8c: \Login Data
0x10095db9: opensea.io
0x10095f18: plantvsundead.com
0x100960c7: axieinfinity.com
0x10096226: cryptocars.me
0x10096335: bombcrypto.io
0x10096444: cryptoplanes.me
0x10096553: cryptozoon.io
0x1009684e: SOFTWARE\Google\Chrome\PreferenceMACs
0x10096aab: \Google\Chrome\User Data\
0x10096c3d: \Login Data
0x10096f56: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x100971b3: \Microsoft\Edge\User Data\
0x10097345: \Login Data
0x100976aa: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x100979a7: \BraveSoftware\Brave-Browser\User Data\
0x10097b89: \Login Data
0x10097ea9: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x10098106: \CryptoTab Browser\User Data\
0x10098298: \Login Data
0x1009867f: \Roaming
0x1009877c: \Roaming
0x100988e1: \Opera Software\Opera Stable
0x10098a4a: \Login Data
0x10098d79: bankalhabib.com
0x10099074: SOFTWARE\Google\Chrome\PreferenceMACs
0x100992d1: \Google\Chrome\User Data\
0x10099463: \Login Data
0x1009977c: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x100999d9: \Microsoft\Edge\User Data\
0x10099b6b: \Login Data
0x10099edf: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x1009a1dc: \BraveSoftware\Brave-Browser\User Data\
0x1009a3be: \Login Data
0x1009a6de: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x1009a93b: \CryptoTab Browser\User Data\
0x1009aacd: \Login Data
0x1009aeb4: \Roaming
0x1009afb1: \Roaming
0x1009b116: \Opera Software\Opera Stable
0x1009b27f: \Login Data
0x1009b5a9: ruralvia.com
0x1009b6b8: ruralvia.es
0x1009b817: bankinterconsumerfinance.com
0x1009bb63: SOFTWARE\Google\Chrome\PreferenceMACs
0x1009bdc0: \Google\Chrome\User Data\
0x1009bf52: \Login Data
0x1009c26b: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x1009c4c8: \Microsoft\Edge\User Data\
0x1009c65a: \Login Data
0x1009c9ce: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x1009cccb: \BraveSoftware\Brave-Browser\User Data\
0x1009cead: \Login Data
0x1009d1cd: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x1009d42a: \CryptoTab Browser\User Data\
0x1009d5bc: \Login Data
0x1009d9a3: \Roaming
0x1009daa0: \Roaming
0x1009dc05: \Opera Software\Opera Stable
0x1009dd6e: \Login Data
0x1009e099: amazon.it
0x1009e1a8: amazon.ca
0x1009e2b7: amazon.de
0x1009e5b3: SOFTWARE\Google\Chrome\PreferenceMACs
0x1009e810: \Google\Chrome\User Data\
0x1009e9a2: \Login Data
0x1009ecbb: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x1009ef18: \Microsoft\Edge\User Data\
0x1009f0aa: \Login Data
0x1009f41e: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x1009f71b: \BraveSoftware\Brave-Browser\User Data\
0x1009f8fd: \Login Data
0x1009fc1d: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x1009fe7a: \CryptoTab Browser\User Data\
0x100a000c: \Login Data
0x100a03f3: \Roaming
0x100a04f0: \Roaming
0x100a0655: \Opera Software\Opera Stable
0x100a07be: \Login Data
0x100a0ae9: amazon.com
0x100a0bf8: netspend.com
0x100a0d07: online.citi.com
0x100a1003: SOFTWARE\Google\Chrome\PreferenceMACs
0x100a1260: \Google\Chrome\User Data\
0x100a13f2: \Login Data
0x100a170b: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x100a1968: \Microsoft\Edge\User Data\
0x100a1afa: \Login Data
0x100a1e6e: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x100a216b: \BraveSoftware\Brave-Browser\User Data\
0x100a234d: \Login Data
0x100a266d: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x100a28ca: \CryptoTab Browser\User Data\
0x100a2a5c: \Login Data
0x100a2e43: \Roaming
0x100a2f40: \Roaming
0x100a30a5: \Opera Software\Opera Stable
0x100a320e: \Login Data
0x100a3539: cloud.ibm.com
0x100a3648: ca.ovh.com
0x100a37a7: account.alibabacloud.com
0x100a3956: cloud.huawei.com
0x100a3b05: cloud.tencent.com
0x100a3c64: vultr.com
0x100a3d73: aws.amazon.com
0x100a3ed2: portal.azure.com
0x100a4081: digitalocean.com
0x100a4230: console.scaleway.com
0x100a438f: hetzner.com
0x100a449e: linode.com
0x100a45ad: oracle.com
0x100a46bc: rackspace.com
0x100a47cb: phoenixnap.com
0x100a48da: leaseweb.com
0x100a49e9: sso.ctl.io
0x100a4af8: ctl.io
0x100a4c07: lumen.com
0x100a4f02: SOFTWARE\Google\Chrome\PreferenceMACs
0x100a515f: \Google\Chrome\User Data\
0x100a52f1: \Login Data
0x100a55fb: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x100a5858: \Microsoft\Edge\User Data\
0x100a59ea: \Login Data
0x100a5d4f: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x100a604c: \BraveSoftware\Brave-Browser\User Data\
0x100a622e: \Login Data
0x100a654e: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x100a67ab: \CryptoTab Browser\User Data\
0x100a693d: \Login Data
0x100a6d24: \Roaming
0x100a6e21: \Roaming
0x100a6f86: \Opera Software\Opera Stable
0x100a70ef: \Login Data
0x100a7419: paypal.com
0x100a7714: SOFTWARE\Google\Chrome\PreferenceMACs
0x100a7971: \Google\Chrome\User Data\
0x100a7b03: \Login Data
0x100a7e1c: SOFTWARE\Microsoft\Edge\PreferenceMACs
0x100a8079: \Microsoft\Edge\User Data\
0x100a820b: \Login Data
0x100a857f: SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
0x100a887c: \BraveSoftware\Brave-Browser\User Data\
0x100a8a5e: \Login Data
0x100a8d7e: SOFTWARE\CryptoTab Browser\PreferenceMACs
0x100a8fdb: \CryptoTab Browser\User Data\
0x100a916d: \Login Data
0x100a9554: \Roaming
0x100a9651: \Roaming
0x100a97b6: \Opera Software\Opera Stable
0x100a991f: \Login Data
0x100a9c3b: WW_P_7
0x100a9d35: WW_P_8
0x100a9e32: -1
0x100aa05c: https://
0x100aa702: rb
0x100ab899: wb
0x100abed3: .exe
0x100ac33a: open
0x100acaa7: WW_P_
0x100acbc8: WW_P_1
0x100accda: WW_P_7
0x100acdec: WW_P_8
0x100acfb0: |
0x100ad084: AddLoggerStat|
0x100ad1fe: links
0x100ad2f4: extensions
0x100ad3f6: EU
0x100ad566: ezstat.ru/1BfPg7
0x100ad6b4: USA_1
0x100ad824: iplis.ru/1BX4j7.png
0x100ad9bd: iplis.ru/1BV4j7.mp4
0x100adb0b: USA_2
0x100adc7b: iplis.ru/1BC4j7.mp3
0x100ade14: iplis.ru/1BV4j7.mp4
0x100adfad: iplis.ru/1cC8u7.mp3
0x100ae146: iplis.ru/1G8Fx7.mp3
0x100ae294: WW_1
0x100ae404: iplis.ru/1BNhx7.mp3
0x100ae59d: iplis.ru/1G8Fx7.mp3
0x100ae6e6: US
0x100ae856: iplis.ru/1pRXr7.txt
0x100ae9ef: iplis.ru/1BV4j7.mp4
0x100aeb3d: WW_2
0x100aecad: SetIncrement|ww_starts
0x100aedfd: false
0x100aef68: iplis.ru/1S2Qs7.mp3
0x100af101: iplis.ru/1G8Fx7.mp3
0x100af24a: US
0x100af3ba: iplis.ru/1pRXr7.txt
0x100af553: iplis.ru/1BV4j7.mp4
0x100af6ac: WW_3
0x100af81c: SetIncrement|ww_starts
0x100af96c: false
0x100afad7: iplis.ru/1S3fd7.mp3
0x100afc70: iplis.ru/1G8Fx7.mp3
0x100afdb9: US
0x100aff29: iplis.ru/1pRXr7.txt
0x100b00c2: iplis.ru/1BV4j7.mp4
0x100b021b: WW_4
0x100b038b: SetIncrement|ww_starts
0x100b04db: false
0x100b0646: iplis.ru/17VHv7.mp3
0x100b07df: iplis.ru/1G8Fx7.mp3
0x100b0928: US
0x100b0a98: iplis.ru/1pRXr7.txt
0x100b0c31: iplis.ru/1BV4j7.mp4
0x100b0d8a: WW_5
0x100b0efa: iplis.ru/1GLDc7.mp3
0x100b1093: iplis.ru/1G8Fx7.mp3
0x100b11dc: US
0x100b134c: iplis.ru/1pRXr7.txt
0x100b14e5: iplis.ru/1BV4j7.mp4
0x100b1633: WW_6
0x100b17a3: SetIncrement|ww_starts
0x100b18f3: false
0x100b1a5e: iplis.ru/1xDsk7.mp3
0x100b1bf7: iplis.ru/1G8Fx7.mp3
0x100b1d40: US
0x100b1eb0: iplis.ru/1pRXr7.txt
0x100b2049: iplis.ru/1BV4j7.mp4
0x100b21a2: WW_7
0x100b2312: SetIncrement|ww_starts
0x100b2462: false
0x100b25cd: iplis.ru/1xFsk7.mp3
0x100b275a: iplis.ru/1G8Fx7.mp3
0x100b28a0: US
0x100b29f5: iplis.ru/1pRXr7.txt
0x100b2b8b: iplis.ru/1BV4j7.mp4
0x100b2ce4: WW_OPERA
0x100b2e54: SetIncrement|ww_starts
0x100b2fa4: false
0x100b310f: iplis.ru/1GCuv7.pdf
0x100b32a8: iplis.ru/1G8Fx7.mp3
0x100b33f1: US
0x100b3561: iplis.ru/1pRXr7.txt
0x100b36fa: iplis.ru/1BV4j7.mp4
0x100b3853: WW_8
0x100b39c3: iplis.ru/1lmex.mp3
0x100b3b5c: iplis.ru/1G8Fx7.mp3
0x100b3ca5: US
0x100b3e15: iplis.ru/1pRXr7.txt
0x100b3fae: iplis.ru/1BV4j7.mp4
0x100b40fc: WW_9
0x100b426c: SetIncrement|ww_starts
0x100b43bc: false
0x100b4527: iplis.ru/1Gemv7.mp3
0x100b46c0: iplis.ru/1G8Fx7.mp3
0x100b4809: US
0x100b4979: iplis.ru/1pRXr7.txt
0x100b4b12: iplis.ru/1BV4j7.mp4
0x100b4c6b: WW_10
0x100b4ddb: SetIncrement|ww_starts
0x100b4f2b: false
0x100b5096: iplis.ru/1Gymv7.mp3
0x100b522f: iplis.ru/1G8Fx7.mp3
0x100b5378: US
0x100b54e8: iplis.ru/1pRXr7.txt
0x100b5681: iplis.ru/1BV4j7.mp4
0x100b57da: WW_11
0x100b594a: SetIncrement|ww_starts
0x100b5a9a: false
0x100b5c05: iplis.ru/1tqHh7.mp3
0x100b5d9e: iplis.ru/1G8Fx7.mp3
0x100b5ee7: US
0x100b6057: iplis.ru/1pRXr7.txt
0x100b61f0: iplis.ru/1BV4j7.mp4
0x100b6349: WW_12
0x100b649e: iplis.ru/1aFYp7.mp3
0x100b6634: iplis.ru/1G8Fx7.mp3
0x100b677d: US
0x100b68ed: iplis.ru/1pRXr7.txt
0x100b6a86: iplis.ru/1BV4j7.mp4
0x100b6bd4: WW_13
0x100b6d44: iplis.ru/1cC8u7.mp3
0x100b6edd: iplis.ru/1G8Fx7.mp3
0x100b7026: US
0x100b7196: iplis.ru/1pRXr7.txt
0x100b732f: iplis.ru/1BV4j7.mp4
0x100b747d: WW_14
0x100b75ed: iplis.ru/1cN8u7.mp3
0x100b773b: WW_15
0x100b7890: SetIncrement|ww_starts
0x100b79dd: false
0x100b7b48: iplis.ru/1kicy7.mp3
0x100b7ce1: iplis.ru/1G8Fx7.mp3
0x100b7e2a: US
0x100b7f9a: iplis.ru/1pRXr7.txt
0x100b8133: iplis.ru/1BV4j7.mp4
0x100b828c: WW_P_1
0x100b83fc: iplis.ru/1BMhx7.mp3
0x100b854a: WW_16
0x100b86ba: SetIncrement|ww_starts
0x100b880a: false
0x100b8975: iplis.ru/1edLy7.png
0x100b8b0e: iplis.ru/1G8Fx7.mp3
0x100b8c57: US
0x100b8dc7: iplis.ru/1pRXr7.txt
0x100b8f60: iplis.ru/1BV4j7.mp4
0x100b90b9: WW_17
0x100b9229: iplis.ru/1nGPt7.png
0x100b93c2: iplis.ru/1G8Fx7.mp3
0x100b950b: US
0x100b967b: iplis.ru/1pRXr7.txt
0x100b9814: iplis.ru/1BV4j7.mp4
0x100b9962: WW_P_2
0x100b9ad2: iplis.ru/1Bshv7.mp3
0x100b9c20: WW_P_3
0x100b9d90: iplis.ru/1Lgnh7.mp3
0x100b9ede: WW_P_4
0x100ba04e: iplis.ru/1vt8c7.mp3
0x100ba19c: WW_P_5
0x100ba30c: iplis.ru/1IcfD.mp3
0x100ba461: WW_P_6
0x100ba573: WW_P_7
0x100ba735: iplis.ru/1eXqs7.mp3
0x100ba883: WW_P_8
0x100ba9f3: iplis.ru/1Unzy7.mp3
0x100bab41: WW_18
0x100bacb1: iplis.ru/12hYs7.mp3
0x100bae4a: iplis.ru/1G8Fx7.mp3
0x100baf93: US
0x100bb103: iplis.ru/1pRXr7.txt
0x100bb29c: iplis.ru/1BV4j7.mp4
0x100bb3ea: WW_19
0x100bb55a: SetIncrement|ww_starts
0x100bb6aa: false
0x100bb815: iplis.ru/12d8d7.mp3
0x100bb9ae: iplis.ru/1G8Fx7.mp3
0x100bbaf7: US
0x100bbc67: iplis.ru/1pRXr7.txt
0x100bbe00: iplis.ru/1BV4j7.mp4
0x100bbf59: WW_20
0x100bc0c9: iplis.ru/1Uvgu7.mp3
0x100bc262: iplis.ru/1G8Fx7.mp3
0x100bc3ab: US
0x100bc51b: iplis.ru/1pRXr7.txt
0x100bc6b4: iplis.ru/1BV4j7.mp4
0x100bc802: WW_21
0x100bc972: SetIncrement|ww_starts
0x100bcac2: false
0x100bcc2d: iplis.ru/1jvTz7.mp3
0x100bcdc6: iplis.ru/1G8Fx7.mp3
0x100bcf0f: US
0x100bd07f: iplis.ru/1pRXr7.txt
0x100bd218: iplis.ru/1BV4j7.mp4
0x100bd431: ids
0x100bd581: browsers
0x100bd76f: id
0x100bd890: extensions
0x100bda02: Chrome:
0x100bdb47: browser
0x100bdc56: browsers
0x100bddc6: Edge:
0x100bdefc: browser
0x100bdff6: browsers
0x100be122: os_country_code
0x100be1d8: country
0x100be33a: os
0x100be486: ip_country
0x100be5d4: AddExtensionStat|
0x100be85e: .exe
0x100be933: \
0x100bf4e3: \
0x100bf71f: https://
0x100bfa12: https://
0x100c0423: open
0x100c0941: open
0x100c0b95: links
0x100c0ce5: extensions
0x100c0e7c: net_country_code
0x100c101f: os_country_code
0x100c1512: wininet.dll
0x100c1732: WW_P_
0x100c1853: WW_P_1
0x100c1a26: WW_P_1
0x100c1b38: WW_20
0x100c1e26: http://45.144.225.57/download/NiceProcessX64.bmp
0x100c1fed: -1
0x100c226b: http://45.144.225.57/download/NiceProcessX32.bmp
0x100c2432: -1
0x100c2552: WW_20
0x100c26c2: iplis.ru/1Uvgu7.mp3
0x100c281b: WW_P_8
0x100c2b22: https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
0x100c2dee: -1
0x100c2fba: WW_P_7
0x100c3181: https://c.xyzgamec.com/userdown/2202/random.exe
0x100c330d: -1
0x100c357b: http://193.56.146.76/Proxytest.exe
0x100c3707: -1
0x100c39c5: http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
0x100c3ba1: -1
0x100c3e0f: http://91.241.19.125/pub.php?pub=one
0x100c3f9b: -1
0x100c4259: http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
0x100c4435: -1
0x100c46a3: http://luminati-china.xyz/aman/casper2.exe
0x100c482f: -1
0x100c4b3d: https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
0x100c4d69: -1
0x100c4fd7: http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
0x100c5163: -1
0x100c54c1: https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
0x100c573d: 1916
0x100c5a0d: https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
0x100c5c89: 468
0x100c5f59: https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
0x100c61d5: 1920
0x100c63b5: http://185.215.113.208/ferrari.exe
0x100c6541: 1750
0x100c680a: https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
0x100c6ac4: 1927
0x100c6d94: https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
0x100c7010: 1929
0x100c72e0: https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
0x100c755c: 1946
0x100c782c: https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
0x100c7aa8: 1985
0x100c7be6: WW_P_6
0x100c7dad: https://c.xyzgamec.com/userdown/2202/random.exe
0x100c7f39: -1
0x100c8119: http://mnbuiy.pw/adsli/note8876.exe
0x100c82a5: -1
0x100c84d5: http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
0x100c86b1: -1
0x100c8891: http://91.241.19.125/pub.php?pub=one
0x100c8a1d: -1
0x100c8bad: http://sarfoods.com/index.php
0x100c8ce9: -1
0x100c8ec9: http://luminati-china.xyz/aman/casper2.exe
0x100c9055: -1
0x100c9285: https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
0x100c9461: -1
0x100c9641: http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
0x100c97cd: -1
0x100c990b: WW_P_5
0x100c9bcf: https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
0x100c9e4b: -1
0x100ca120: https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
0x100ca39c: -1
0x100ca4da: WW_P_4
0x100ca791: https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
0x100caa0d: -1
0x100cacdd: https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
0x100caf59: -1
0x100cb097: WW_P_3
0x100cb34e: https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp
0x100cb5ca: -1
0x100cb708: WW_P_2
0x100cb87f: https://iplogger.org/2BTmf7
0x100cb9bb: -1
0x100cbb4b: https://iplogger.org/2BAmf7
0x100cbc87: -1
0x100cbe17: https://iplogger.org/2BDmf7
0x100cbf53: -1
0x100cc0e3: https://iplogger.org/2BFmf7
0x100cc21f: -1
0x100cc3af: https://iplogger.org/2s2pg6
0x100cc4eb: -1
0x100cc67b: https://iplogger.org/2s3pg6
0x100cc7b7: -1
0x100cc947: https://iplogger.org/2s4pg6
0x100cca83: -1
0x100ccc13: https://iplogger.org/2s5pg6
0x100ccd4f: -1
0x100ccedf: https://iplogger.org/2s6pg6
0x100cd01b: -1
0x100cd1ab: https://iplogger.org/2s7pg6
0x100cd2e7: -1
0x100cd462: WW_20
0x100cd629: http://185.215.113.208/ferrari4.exe
0x100cd7b5: -1
0x100cdb76: id
0x100cdca0: cold
0x100cddba: browser
0x100cdec1: crypto_wallets
0x100cdfcb: links
0x100ce364: id
0x100ce47b: domain
0x100ce582: bank_wallets
0x100ce68c: links
0x100cea27: id
0x100ceb3e: domain
0x100cec45: cu_bank_wallets
0x100ced4f: links
0x100cf0e8: id
0x100cf1ff: domain
0x100cf306: shop_wallets
0x100cf410: links
0x100cf7ab: id
0x100cf8c2: domain
0x100cf9c9: bank_au_wallets
0x100cfad3: links
0x100cfe6f: id
0x100cff86: domain
0x100d0090: amazon_eu
0x100d019a: links
0x100d0538: id
0x100d064f: domain
0x100d0759: webhosts
0x100d0863: links
0x100d0bff: id
0x100d0d16: domain
0x100d0e20: paypal
0x100d0f2a: links
0x100d12c8: id
0x100d13df: domain
0x100d14e9: bank_ca_wallets
0x100d15f3: links
0x100d1995: id
0x100d1abf: cold
0x100d1bdc: browser
0x100d1ce6: crypto_wallets
0x100d1df0: links
0x100d218c: id
0x100d22a3: browser
0x100d23ad: crypto_wallets
0x100d24b7: links
0x100d2855: id
0x100d296c: domain
0x100d2a76: bank_wallets
0x100d2b80: links
0x100d2f1c: id
0x100d3033: domain
0x100d313d: bank_wallets
0x100d3247: links
0x100d35e5: id
0x100d36fc: domain
0x100d3806: browser_vbmt
0x100d3910: links
0x100d3cac: id
0x100d3dc3: domain
0x100d3ecd: bank_wallets
0x100d3fd7: links
0x100d437f: id
0x100d4496: domain
0x100d45a0: bank_wallets
0x100d46aa: links
0x100d4a15: id
0x100d4b2c: browser
0x100d4c36: crypto_wallets
0x100d4d40: links
0x100d50de: id
0x100d51f5: domain
0x100d52ff: bank_wallets
0x100d5409: links
0x100d57a5: id
0x100d58bc: domain
0x100d59c6: bank_wallets
0x100d5ad0: links
0x100d5d5a: GetCryptoSleeping
0x100d5ebd: _
0x100d6f48: -1
0x100d7077: id
0x100d7181: links
0x100d7eeb: EU
0x100d804e: USA_1
0x100d81b1: USA_2
0x100d8313: WW_1
0x100d8476: WW_2
0x100d85d9: WW_3
0x100d873b: WW_4
0x100d889e: WW_5
0x100d8a01: WW_6
0x100d8b63: WW_7
0x100d8cc6: WW_OPERA
0x100d8e29: WW_8
0x100d8f8b: WW_9
0x100d90ee: WW_10
0x100d9251: WW_11
0x100d93b3: WW_12
0x100d9516: WW_13
0x100d9679: WW_14
0x100d97db: WW_15
0x100d993e: WW_P_1
0x100d9aa1: WW_16
0x100d9c03: WW_17
0x100d9d66: WW_P_2
0x100d9ec9: WW_P_3
0x100da02b: WW_P_4
0x100da18e: WW_P_5
0x100da2f1: WW_P_6
0x100da453: WW_P_7
0x100da5b6: WW_P_8
0x100da719: WW_18
0x100da87b: WW_19
0x100da9de: WW_20
0x100dab41: WW_21
0x100dac97: WW_4
0x100dada9: WW_19
0x100db331: US
0x100db490: USA_2
0x100dba4d: WW_P_
0x100dbb6e: WW_P_1
0x100dc22d: |
0x100dc351: IsUseDominationProject|
0x100dc579: cryptoWallets
0x100dc659: browser
0x100dc745: status
0x100dc8b2: cryptoWallets
0x100dc992: cold
0x100dca7e: status
0x100dcbd4: bankWallets
0x100dccb4: status
0x100dce0a: cuBankWallets
0x100dceea: status
0x100dd040: shops
0x100dd120: status
0x100dd276: bankAUWallets
0x100dd356: status
0x100dd4ac: amazon_eu
0x100dd58c: status
0x100dd6e2: webhosts
0x100dd7c2: status
0x100dd918: paypal
0x100dd9f8: status
0x100ddb4e: bankCAWallets
0x100ddc2e: status
0x100dddb9: cryptoWallets_part1
0x100ddee6: status
0x100de071: cryptoWallets_part2
0x100de19e: status
0x100de344: bankWallets_part1
0x100de474: status
0x100de5ff: bankWallets_part2
0x100de72c: status
0x100de882: VBMT
0x100de962: status
0x100deab8: bankMXWallets
0x100deb98: status
0x100decee: cryptoGames
0x100dedce: status
0x100def24: bankPKWallets
0x100df004: status
0x100df15a: bankESWallets
0x100df23a: status
0x100df61f: SetLoaderAnalyze|
0x100df83c: SetIncrement|not_elevated
0x100fb1d4: .
0x100fb2fc: .dll
0x100fb422: #
0x100fb8d7: WinHttpConnect
0x100fb9ab: Winhttp.dll
0x100fbb06: WinHttpQueryHeaders
0x100fbc27: Winhttp.dll
0x100fbd4d: WinHttpOpen
0x100fbe21: Winhttp.dll
0x100fbf8b: WinHttpOpenRequest
0x100fc0ac: Winhttp.dll
0x100fc222: WinHttpQueryDataAvailable
0x100fc346: Winhttp.dll
0x100fc4bc: WinHttpSendRequest
0x100fc5e0: Winhttp.dll
0x100fc73b: WinHttpReceiveResponse
0x100fc85c: Winhttp.dll
0x100fc982: WinHttpReadData
0x100fca56: Winhttp.dll
0x100fcbb1: WinHttpCloseHandle
0x100fccd2: Winhttp.dll
0x100fcfd2: http://
0x100fd0b1: /
0x100fd253: ?
0x100fe1e7: HEAD
0x100fe74e: wb
0x100feca9: InternetOpenA
0x100fedd4: InternetSetOptionA
0x100fef5b: HttpOpenRequestA
0x100ff0ee: InternetConnectA
0x100ff284: InternetOpenUrlA
0x100ff3ca: HttpQueryInfoA
0x100ff510: InternetQueryOptionA
0x100ff6a6: HttpSendRequestA
0x100ff821: InternetReadFile
0x100ff999: InternetCloseHandle