<------------------- Decoded Base64 ------------------> firefox.exe SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\ SOFTWARE\Mozilla\Mozilla Firefox SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe %appdata%\Mozilla\Firefox\Profiles\ MozillaFireFox CurrentVersion Install_Directory nss3.dll thunderbird.exe SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\ SOFTWARE\Mozilla\Mozilla Thunderbird SOFTWARE\Classes\ThunderbirdEML\DefaultIcon %appdata%\Thunderbird\Profiles\ ThunderBird SELECT host, path, isSecure, expiry, name, value FROM moz_cookies SELECT fieldname, value FROM moz_formhistory NSS_Init PK11_GetInternalKeySlot PK11_Authenticate PK11SDR_Decrypt NSS_Shutdown PK11_FreeSlot logins.json logins hostname timesUsed encryptedUsername encryptedPassword cookies.sqlite formhistory.sqlite %LOCALAPPDATA%\Google\Chrome\User Data\ %LOCALAPPDATA%\Google\Chrome SxS\User Data\ %LOCALAPPDATA%\Xpom\User Data\ %LOCALAPPDATA%\Yandex\YandexBrowser\User Data\ %LOCALAPPDATA%\Comodo\Dragon\User Data\ %LOCALAPPDATA%\Amigo\User Data\ %LOCALAPPDATA%\Orbitum\User Data\ %LOCALAPPDATA%\Bromium\User Data\ %LOCALAPPDATA%\Chromium\User Data\ %LOCALAPPDATA%\Nichrome\User Data\ %LOCALAPPDATA%\RockMelt\User Data\ %LOCALAPPDATA%\360Browser\Browser\User Data\ %LOCALAPPDATA%\Vivaldi\User Data\ %APPDATA%\Opera Software\ %LOCALAPPDATA%\Go!\User Data\ %LOCALAPPDATA%\Sputnik\Sputnik\User Data\ %LOCALAPPDATA%\Kometa\User Data\ %LOCALAPPDATA%\uCozMedia\Uran\User Data\ %LOCALAPPDATA%\QIP Surf\User Data\ %LOCALAPPDATA%\Epic Privacy Browser\User Data\ %APPDATA%\brave\ %LOCALAPPDATA%\CocCoc\Browser\User Data\ %LOCALAPPDATA%\CentBrowser\User Data\ %LOCALAPPDATA%\7Star\7Star\User Data\ %LOCALAPPDATA%\Elements Browser\User Data\ %LOCALAPPDATA%\TorBro\Profile\ %LOCALAPPDATA%\Suhba\User Data\ %LOCALAPPDATA%\Safer Technologies\Secure Browser\User Data\ %LOCALAPPDATA%\Rafotech\Mustang\User Data\ %LOCALAPPDATA%\Superbird\User Data\ %LOCALAPPDATA%\Chedot\User Data\ %LOCALAPPDATA%\Torch\User Data\ GoogleChrome GoogleChrome64 InternetMailRu YandexBrowser ComodoDragon Amigo Orbitum Bromium Chromium Nichrome RockMelt 360Browser Vivaldi Opera GoBrowser Sputnik Kometa Uran QIPSurf Epic Brave CocCoc CentBrowser 7Star ElementsBrowser TorBro Suhba SaferBrowser Mustang Superbird Chedot Torch Login Data Web Data SELECT origin_url, username_value, password_value FROM logins SELECT host_key, name, encrypted_value, value, path, secure, (expires_utc/1000000)-11644473600 FROM cookies SELECT host_key, name, name, value, path, secure, expires_utc FROM cookies SELECT name, value FROM autofill SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted value FROM credit_cards %APPDATA%\Microsoft\Windows\Cookies\ %APPDATA%\Microsoft\Windows\Cookies\Low\ %LOCALAPPDATA%\Microsoft\Windows\INetCache\ %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\INetCookies\ %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\ %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\Cookies\ %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cookies\ InternetExplorer InternetExplorerLow InternetExplorerINetCache MicrosoftEdge_AC_INetCookies MicrosoftEdge_AC_001 MicrosoftEdge_AC_002 MicrosoftEdge_AC Software\Microsoft\Internet Explorer Software\Microsoft\Internet Explorer\IntelliForms\Storage2 Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook POP3 IMAP SMTP HTTP %appdata%\Waterfox\Profiles\ Waterfox %appdata%\Comodo\IceDragon\Profiles\ IceDragon %appdata%\8pecxstudios\Cyberfox\Profiles\ Cyberfox sqlite3_open sqlite3_close sqlite3_prepare_v2 sqlite3_step sqlite3_column_text sqlite3_column_bytes sqlite3_finalize %APPDATA%\filezilla\recentservers.xml FileZilla ole32.dll CLSIDFromString {4BF4C442-9B8A-41A0-B380-DD4A704DDB28} {3CCD5499-87A8-4B10-A215-608888DD3B55} vaultcli.dll VaultOpenVault VaultEnumerateItems VaultGetItem MicrosoftEdge Browsers\AutoComplete CookieList.txt SELECT host_key, name, encrypted_value, value, path, is_secure, (expires_utc/1000000)-11644473600 FROM cookies %appdata%\Moonchild Productions\Pale Moon\Profiles\ PaleMoon %appdata%\Electrum\wallets\ \Electrum %appdata%\Electrum-LTC\wallets\ \Electrum-LTC %appdata%\ElectrumG\wallets\ \ElectrumG %appdata%\Electrum-btcp\wallets\ \Electrum-btcp %APPDATA%\Ethereum\keystore\ \Ethereum %APPDATA%\Exodus\ \Exodus \Exodus Eden *.json,*.seco %APPDATA%\Jaxx\Local Storage\ \Jaxx\Local Storage\ %APPDATA%\MultiBitHD\ \MultiBitHD mbhd.wallet.aes,mbhd.checkpoints,mbhd.spvchain,mbhd.yaml .wallet wallets\.wallet wallet.dat wallets\wallet.dat electrum.dat wallets\electrum.dat Software\monero-project\monero-core wallet_path Bitcoin\Bitcoin-Qt BitcoinGold\BitcoinGold-Qt BitCore\BitCore-Qt Litecoin\Litecoin-Qt BitcoinABC\BitcoinABC-Qt %APPDATA%\Exodus Eden\ %Appdata%\Psi+\profiles\ %Appdata%\Psi\profiles\ <------------ Encoded Strings ------------> ZmlyZWZveC5leGUNClNPRlRXQVJFXFdvdzY0MzJOb2RlXE1vemlsbGFcTW96aWxsYSBGaXJlZm94XA0KU09GVFdBUkVcTW96aWxsYVxNb3ppbGxhIEZpcmVmb3gNClNPRlRXQVJFXENsaWVudHNcU3RhcnRNZW51SW50ZXJuZXRcRklSRUZPWC5FWEVcc2hlbGxcb3Blblxjb21tYW5kDQpTT0ZUV0FSRVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxBcHAgUGF0aHNcZmlyZWZveC5leGUNCiVhcHBkYXRhJVxNb3ppbGxhXEZpcmVmb3hcUHJvZmlsZXNcDQpNb3ppbGxhRmlyZUZveA0KQ3VycmVudFZlcnNpb24NCkluc3RhbGxfRGlyZWN0b3J5DQpuc3MzLmRsbA0KdGh1bmRlcmJpcmQuZXhlDQpTT0ZUV0FSRVxXb3c2NDMyTm9kZVxNb3ppbGxhXE1vemlsbGEgVGh1bmRlcmJpcmRcDQpTT0ZUV0FSRVxNb3ppbGxhXE1vemlsbGEgVGh1bmRlcmJpcmQNClNPRlRXQVJFXENsYXNzZXNcVGh1bmRlcmJpcmRFTUxcRGVmYXVsdEljb24NCiVhcHBkYXRhJVxUaHVuZGVyYmlyZFxQcm9maWxlc1wNClRodW5kZXJCaXJkDQpTRUxFQ1QgaG9zdCwgcGF0aCwgaXNTZWN1cmUsIGV4cGlyeSwgbmFtZSwgdmFsdWUgRlJPTSBtb3pfY29va2llcw0KU0VMRUNUIGZpZWxkbmFtZSwgdmFsdWUgRlJPTSBtb3pfZm9ybWhpc3RvcnkNCk5TU19Jbml0DQpQSzExX0dldEludGVybmFsS2V5U2xvdA0KUEsxMV9BdXRoZW50aWNhdGUNClBLMTFTRFJfRGVjcnlwdA0KTlNTX1NodXRkb3duDQpQSzExX0ZyZWVTbG90DQpsb2dpbnMuanNvbg0KbG9naW5zDQpob3N0bmFtZQ0KdGltZXNVc2VkDQplbmNyeXB0ZWRVc2VybmFtZQ0KZW5jcnlwdGVkUGFzc3dvcmQNCmNvb2tpZXMuc3FsaXRlDQpmb3JtaGlzdG9yeS5zcWxpdGUNCiVMT0NBTEFQUERBVEElXEdvb2dsZVxDaHJvbWVcVXNlciBEYXRhXA0KJUxPQ0FMQVBQREFUQSVcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhXA0KJUxPQ0FMQVBQREFUQSVcWHBvbVxVc2VyIERhdGFcDQolTE9DQUxBUFBEQVRBJVxZYW5kZXhcWWFuZGV4QnJvd3NlclxVc2VyIERhdGFcDQolTE9DQUxBUFBEQVRBJVxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YVwNCiVMT0NBTEFQUERBVEElXEFtaWdvXFVzZXIgRGF0YVwNCiVMT0NBTEFQUERBVEElXE9yYml0dW1cVXNlciBEYXRhXA0KJUxPQ0FMQVBQREFUQSVcQnJvbWl1bVxVc2VyIERhdGFcDQolTE9DQUxBUFBEQVRBJVxDaHJvbWl1bVxVc2VyIERhdGFcDQolTE9DQUxBUFBEQVRBJVxOaWNocm9tZVxVc2VyIERhdGFcDQolTE9DQUxBUFBEQVRBJVxSb2NrTWVsdFxVc2VyIERhdGFcDQolTE9DQUxBUFBEQVRBJVwzNjBCcm93c2VyXEJyb3dzZXJcVXNlciBEYXRhXA0KJUxPQ0FMQVBQREFUQSVcVml2YWxkaVxVc2VyIERhdGFcDQolQVBQREFUQSVcT3BlcmEgU29mdHdhcmVcDQolTE9DQUxBUFBEQVRBJVxHbyFcVXNlciBEYXRhXA0KJUxPQ0FMQVBQREFUQSVcU3B1dG5pa1xTcHV0bmlrXFVzZXIgRGF0YVwNCiVMT0NBTEFQUERBVEElXEtvbWV0YVxVc2VyIERhdGFcDQolTE9DQUxBUFBEQVRBJVx1Q296TWVkaWFcVXJhblxVc2VyIERhdGFcDQolTE9DQUxBUFBEQVRBJVxRSVAgU3VyZlxVc2VyIERhdGFcDQolTE9DQUxBUFBEQVRBJVxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGFcDQolQVBQREFUQSVcYnJhdmVcDQolTE9DQUxBUFBEQVRBJVxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGFcDQolTE9DQUxBUFBEQVRBJVxDZW50QnJvd3NlclxVc2VyIERhdGFcDQolTE9DQUxBUFBEQVRBJVw3U3Rhclw3U3RhclxVc2VyIERhdGFcDQolTE9DQUxBUFBEQVRBJVxFbGVtZW50cyBCcm93c2VyXFVzZXIgRGF0YVwNCiVMT0NBTEFQUERBVEElXFRvckJyb1xQcm9maWxlXA0KJUxPQ0FMQVBQREFUQSVcU3VoYmFcVXNlciBEYXRhXA0KJUxPQ0FMQVBQREFUQSVcU2FmZXIgVGVjaG5vbG9naWVzXFNlY3VyZSBCcm93c2VyXFVzZXIgRGF0YVwNCiVMT0NBTEFQUERBVEElXFJhZm90ZWNoXE11c3RhbmdcVXNlciBEYXRhXA0KJUxPQ0FMQVBQREFUQSVcU3VwZXJiaXJkXFVzZXIgRGF0YVwNCiVMT0NBTEFQUERBVEElXENoZWRvdFxVc2VyIERhdGFcDQolTE9DQUxBUFBEQVRBJVxUb3JjaFxVc2VyIERhdGFcDQpHb29nbGVDaHJvbWUNCkdvb2dsZUNocm9tZTY0DQpJbnRlcm5ldE1haWxSdQ0KWWFuZGV4QnJvd3Nlcg0KQ29tb2RvRHJhZ29uDQpBbWlnbw0KT3JiaXR1bQ0KQnJvbWl1bQ0KQ2hyb21pdW0NCk5pY2hyb21lDQpSb2NrTWVsdA0KMzYwQnJvd3Nlcg0KVml2YWxkaQ0KT3BlcmENCkdvQnJvd3Nlcg0KU3B1dG5paw0KS29tZXRhDQpVcmFuDQpRSVBTdXJmDQpFcGljDQpCcmF2ZQ0KQ29jQ29jDQpDZW50QnJvd3Nlcg0KN1N0YXINCkVsZW1lbnRzQnJvd3Nlcg0KVG9yQnJvDQpTdWhiYQ0KU2FmZXJCcm93c2VyDQpNdXN0YW5nDQpTdXBlcmJpcmQNCkNoZWRvdA0KVG9yY2gNCkxvZ2luIERhdGENCldlYiBEYXRhDQpTRUxFQ1Qgb3JpZ2luX3VybCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX3ZhbHVlIEZST00gbG9naW5zDQpTRUxFQ1QgaG9zdF9rZXksIG5hbWUsIGVuY3J5cHRlZF92YWx1ZSwgdmFsdWUsIHBhdGgsIHNlY3VyZSwgKGV4cGlyZXNfdXRjLzEwMDAwMDApLTExNjQ0NDczNjAwIEZST00gY29va2llcw0KU0VMRUNUIGhvc3Rfa2V5LCBuYW1lLCBuYW1lLCB2YWx1ZSwgcGF0aCwgc2VjdXJlLCBleHBpcmVzX3V0YyBGUk9NIGNvb2tpZXMNClNFTEVDVCBuYW1lLCB2YWx1ZSBGUk9NIGF1dG9maWxsDQpTRUxFQ1QgbmFtZV9vbl9jYXJkLCBleHBpcmF0aW9uX21vbnRoLCBleHBpcmF0aW9uX3llYXIsIGNhcmRfbnVtYmVyX2VuY3J5cHRlZCB2YWx1ZSBGUk9NIGNyZWRpdF9jYXJkcw0KJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXENvb2tpZXNcDQolQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcQ29va2llc1xMb3dcDQolTE9DQUxBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xJTmV0Q2FjaGVcDQolTE9DQUxBUFBEQVRBJVxQYWNrYWdlc1xNaWNyb3NvZnQuTWljcm9zb2Z0RWRnZV84d2VreWIzZDhiYndlXEFDXElOZXRDb29raWVzXA0KJUxPQ0FMQVBQREFUQSVcUGFja2FnZXNcTWljcm9zb2Z0Lk1pY3Jvc29mdEVkZ2VfOHdla3liM2Q4YmJ3ZVxBQ1wjITAwMVxNaWNyb3NvZnRFZGdlXENvb2tpZXNcDQolTE9DQUxBUFBEQVRBJVxQYWNrYWdlc1xNaWNyb3NvZnQuTWljcm9zb2Z0RWRnZV84d2VreWIzZDhiYndlXEFDXCMhMDAyXE1pY3Jvc29mdEVkZ2VcQ29va2llc1wNCiVMT0NBTEFQUERBVEElXFBhY2thZ2VzXE1pY3Jvc29mdC5NaWNyb3NvZnRFZGdlXzh3ZWt5YjNkOGJid2VcQUNcTWljcm9zb2Z0RWRnZVxDb29raWVzXA0KSW50ZXJuZXRFeHBsb3Jlcg0KSW50ZXJuZXRFeHBsb3Jlckxvdw0KSW50ZXJuZXRFeHBsb3JlcklOZXRDYWNoZQ0KTWljcm9zb2Z0RWRnZV9BQ19JTmV0Q29va2llcw0KTWljcm9zb2Z0RWRnZV9BQ18wMDENCk1pY3Jvc29mdEVkZ2VfQUNfMDAyDQpNaWNyb3NvZnRFZGdlX0FDDQpTb2Z0d2FyZVxNaWNyb3NvZnRcSW50ZXJuZXQgRXhwbG9yZXINClNvZnR3YXJlXE1pY3Jvc29mdFxJbnRlcm5ldCBFeHBsb3JlclxJbnRlbGxpRm9ybXNcU3RvcmFnZTINClNvZnR3YXJlXE1pY3Jvc29mdFxXaW5kb3dzIE5UXEN1cnJlbnRWZXJzaW9uXFdpbmRvd3MgTWVzc2FnaW5nIFN1YnN5c3RlbVxQcm9maWxlc1xPdXRsb29rDQpTb2Z0d2FyZVxNaWNyb3NvZnRcT2ZmaWNlXDE1LjBcT3V0bG9va1xQcm9maWxlc1xPdXRsb29rDQpTb2Z0d2FyZVxNaWNyb3NvZnRcT2ZmaWNlXDE2LjBcT3V0bG9va1xQcm9maWxlc1xPdXRsb29rDQpQT1AzDQpJTUFQDQpTTVRQDQpIVFRQDQolYXBwZGF0YSVcV2F0ZXJmb3hcUHJvZmlsZXNcDQpXYXRlcmZveA0KJWFwcGRhdGElXENvbW9kb1xJY2VEcmFnb25cUHJvZmlsZXNcDQpJY2VEcmFnb24NCiVhcHBkYXRhJVw4cGVjeHN0dWRpb3NcQ3liZXJmb3hcUHJvZmlsZXNcDQpDeWJlcmZveA0Kc3FsaXRlM19vcGVuDQpzcWxpdGUzX2Nsb3NlDQpzcWxpdGUzX3ByZXBhcmVfdjINCnNxbGl0ZTNfc3RlcA0Kc3FsaXRlM19jb2x1bW5fdGV4dA0Kc3FsaXRlM19jb2x1bW5fYnl0ZXMNCnNxbGl0ZTNfZmluYWxpemUNCiVBUFBEQVRBJVxmaWxlemlsbGFccmVjZW50c2VydmVycy54bWwNCjxSZWNlbnRTZXJ2ZXJzPg0KPC9SZWNlbnRTZXJ2ZXJzPg0KPFNlcnZlcj4NCjwvU2VydmVyPg0KPEhvc3Q+DQo8L0hvc3Q+DQo8UG9ydD4NCjwvUG9ydD4NCjxVc2VyPg0KPC9Vc2VyPg0KPFBhc3M+DQo8L1Bhc3M+DQo8UGFzcyBlbmNvZGluZz0iYmFzZTY0Ij4NCkZpbGVaaWxsYQ0Kb2xlMzIuZGxsDQpDTFNJREZyb21TdHJpbmcNCns0QkY0QzQ0Mi05QjhBLTQxQTAtQjM4MC1ERDRBNzA0RERCMjh9DQp7M0NDRDU0OTktODdBOC00QjEwLUEyMTUtNjA4ODg4REQzQjU1fQ0KdmF1bHRjbGkuZGxsDQpWYXVsdE9wZW5WYXVsdA0KVmF1bHRFbnVtZXJhdGVJdGVtcw0KVmF1bHRHZXRJdGVtDQpNaWNyb3NvZnRFZGdlDQpCcm93c2Vyc1xBdXRvQ29tcGxldGUNCkNvb2tpZUxpc3QudHh0DQpTRUxFQ1QgaG9zdF9rZXksIG5hbWUsIGVuY3J5cHRlZF92YWx1ZSwgdmFsdWUsIHBhdGgsIGlzX3NlY3VyZSwgKGV4cGlyZXNfdXRjLzEwMDAwMDApLTExNjQ0NDczNjAwIEZST00gY29va2llcw0KJWFwcGRhdGElXE1vb25jaGlsZCBQcm9kdWN0aW9uc1xQYWxlIE1vb25cUHJvZmlsZXNcDQpQYWxlTW9vbg0KJWFwcGRhdGElXEVsZWN0cnVtXHdhbGxldHNcDQpcRWxlY3RydW0NCiVhcHBkYXRhJVxFbGVjdHJ1bS1MVENcd2FsbGV0c1wNClxFbGVjdHJ1bS1MVEMNCiVhcHBkYXRhJVxFbGVjdHJ1bUdcd2FsbGV0c1wNClxFbGVjdHJ1bUcNCiVhcHBkYXRhJVxFbGVjdHJ1bS1idGNwXHdhbGxldHNcDQpcRWxlY3RydW0tYnRjcA0KJUFQUERBVEElXEV0aGVyZXVtXGtleXN0b3JlXA0KXEV0aGVyZXVtDQolQVBQREFUQSVcRXhvZHVzXA0KXEV4b2R1cw0KXEV4b2R1cyBFZGVuDQoqLmpzb24sKi5zZWNvDQolQVBQREFUQSVcSmF4eFxMb2NhbCBTdG9yYWdlXA0KXEpheHhcTG9jYWwgU3RvcmFnZVwNCiVBUFBEQVRBJVxNdWx0aUJpdEhEXA0KXE11bHRpQml0SEQNCm1iaGQud2FsbGV0LmFlcyxtYmhkLmNoZWNrcG9pbnRzLG1iaGQuc3B2Y2hhaW4sbWJoZC55YW1sDQoud2FsbGV0DQp3YWxsZXRzXC53YWxsZXQNCndhbGxldC5kYXQNCndhbGxldHNcd2FsbGV0LmRhdA0KZWxlY3RydW0uZGF0DQp3YWxsZXRzXGVsZWN0cnVtLmRhdA0KU29mdHdhcmVcbW9uZXJvLXByb2plY3RcbW9uZXJvLWNvcmUNCndhbGxldF9wYXRoDQpCaXRjb2luXEJpdGNvaW4tUXQNCkJpdGNvaW5Hb2xkXEJpdGNvaW5Hb2xkLVF0DQpCaXRDb3JlXEJpdENvcmUtUXQNCkxpdGVjb2luXExpdGVjb2luLVF0DQpCaXRjb2luQUJDXEJpdGNvaW5BQkMtUXQNCiVBUFBEQVRBJVxFeG9kdXMgRWRlblwNCiVBcHBkYXRhJVxQc2krXHByb2ZpbGVzXA0KJUFwcGRhdGElXFBzaVxwcm9maWxlc1wNCjxyb3N0ZXItY2FjaGU+DQo8L3Jvc3Rlci1jYWNoZT4NCjxqaWQgdHlwZT0iUVN0cmluZyI+DQo8cGFzc3dvcmQgdHlwZT0iUVN0cmluZyI+DQo8L3Bhc3N3b3JkPg==