dpapi 2 Amadey cred64.dll: Reversing the v5.78 Credential-Stealer Plugin (botnet 54e64e) May 2, 2026 Pulsar RAT .NET Reversing: C2 Protocol Recovery, Costura Extraction, and DPAPI Credential Theft Pipeline Apr 6, 2026