When HawkEye is executed, in line 34, byte[] byte_ = gclass.method_0()["0", GClass30.GEnum3.RCDATA].Byte_0;it reads the encrypted configuration from the RCDATA resource and in line 33,byte[] byte_2 = GClass29.smethod_12(byte_, GClass12.string_0);and then decrypts this data with the Rijndael algorithm you can see below in the RijndaelManaged function to initialize the HawkEye configuration settings.The decrypted configuration shows us the account used for exfiltration:The main loop of HawkEye has the following functions:This shows the rich feature set of HawkEye