Static | ZeroBOX

PE Compile Time

2022-01-20 08:24:40

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x0000e9e4 0x0000ea00 7.60781700031
.rsrc 0x00012000 0x00000586 0x00000600 4.03427373615
.reloc 0x00014000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x000120a0 0x000002fc LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0001239c 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
IDATx^
o+g?p?
a[>g[m&g
u>ZqR'v
g^O?<#
On=J9w
eZw7V8w
aLz$VWg
g?<[wL
wF&N_pN
~>zG@
H1Pj_2'
~70}6^
~&~}7{
4sl SI
&W|}wa
sF/ngx
yoC~n>cU97!>
w}GU?
;/s_;z
:U)NJm
%[|f}k
7.m~1s
Geh3g;
+>1j/A'
Mg]1Tw
zsypl
WOy0}
w?Nnsu
xP~f_z
W^dWq|
:y@;?+
GWv7>EW\
V>;v\
g{:`=z
^.yZ>
K~t[nvD~
):~jGqF_
|ttDc-
OGuto@K
Y6N^ca9
^}o(;*
O|l!3{g{
v4.0.30319
#Strings
ThreadSafeObjectProvider`1
List`1
kernel32
Microsoft.Win32
ToInt32
cbReserved2
lpReserved2
ToInt16
<Module>
DelegateCreateProcessA
LoadLibraryA
StartHVNC
DESKTOP_JOURNALRECORD
CCHDEVICENAME
CCHFORMNAME
DESKTOP_ENUMERATE
DESKTOP_JOURNALPLAYBACK
DF_ALLOWOTHERACCOUNTHOOK
get_DLL
DESKTOP_HOOKCONTROL
STARTUP_INFORMATION
PROCESS_INFORMATION
System.IO
DESKTOP_SWITCHDESKTOP
SECURITY_ATTRIBUTES
DESKTOP_READOBJECTS
DESKTOP_WRITEOBJECTS
GETBYTT
DESKTOP_CREATEMENU
DESKTOP_CREATEWINDOW
CreateDesktopW
Dispose__Instance__
Create__Instance__
ProjectData
mscorlib
PHVNC.Stub
System.Collections.Generic
Microsoft.VisualBasic
ThreadId
ProcessId
GetProcessById
bytesRead
DelegateResumeThread
thread
get_IsDisposed
m_FormBeingCreated
lpReserved
Synchronized
TargetMethod
method
device
CreateInstance
get_GetInstance
defaultInstance
instance
GetHashCode
deviceMode
get_Message
EndInvoke
BeginInvoke
Hashtable
compatible
ThreadHandle
RuntimeTypeHandle
GetTypeFromHandle
ProcessHandle
bInheritHandle
handle
lpTitle
applicationName
desktopName
get_ProcessName
GetProcessesByName
commandLine
ValueType
GetType
get_Culture
set_Culture
resourceCulture
MethodBase
ConsoleApplicationBase
ApplicationSettingsBase
Dispose
MulticastDelegate
DelegateAsyncState
EditorBrowsableState
SetApartmentState
ThreadStaticAttribute
STAThreadAttribute
CompilerGeneratedAttribute
GuidAttribute
HelpKeywordAttribute
GeneratedCodeAttribute
DebuggerNonUserCodeAttribute
DebuggableAttribute
EditorBrowsableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
StandardModuleAttribute
HideModuleNameAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
dwFillAttribute
DebuggerHiddenAttribute
AssemblyFileVersionAttribute
MyGroupCollectionAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
dLByte
ToByte
m_ThreadStaticValue
GetObjectValue
SetValue
Remove
PHVNC.exe
dwXSize
dwYSize
get_Size
bufferSize
SizeOf
System.Threading
NewLateBinding
System.Runtime.Versioning
GetResourceString
CompareString
ToString
Substring
System.Drawing
get_ExecutablePath
GetFolderPath
get_Length
nLength
length
LoadApi
CreateApi
ForNextCheckObj
ForLoopInitObj
AsyncCallback
DelegateCallback
accessMask
Marshal
System.ComponentModel
kernel32.dll
user32.dll
ForLoopControl
ObjectFlowControl
Program
System
resourceMan
Boolean
hidden
bytesWritten
System.ComponentModel.Design
GetFileNameWithoutExtension
get_Application
MyApplication
processInformation
System.Configuration
System.Globalization
DelegateZwUnmapViewOfSection
System.Reflection
TargetInvocationException
InvalidOperationException
get_InnerException
HandleRun
TryRun
MethodInfo
CultureInfo
startupInfo
ParameterInfo
Bitmap
CreateDesktop
lpDesktop
hNewDesktop
m_AppObjectProvider
m_UserObjectProvider
m_ComputerObjectProvider
m_MyWebServicesObjectProvider
m_MyFormsObjectProvider
SpecialFolder
Buffer
buffer
get_ResourceManager
Identifier
System.CodeDom.Compiler
get_User
get_CurrentUser
ToGenericParameter
GetDelegateForFunctionPointer
BitConverter
get_Computer
ServerComputer
MyComputer
hStdError
ClearProjectError
SetProjectError
Activator
.cctor
lpSecurityDescriptor
IntPtr
System.Diagnostics
Microsoft.VisualBasic.Devices
get_WebServices
MyWebServices
Microsoft.VisualBasic.ApplicationServices
System.Runtime.InteropServices
Microsoft.VisualBasic.CompilerServices
System.Runtime.CompilerServices
Microsoft.VisualBasic.MyServices
System.Resources
PHVNC.My.Resources
PHVNC.Resources.resources
DebuggingModes
inheritHandles
GetProcesses
threadAttributes
processAttributes
attributes
GetBytes
creationFlags
dwFlags
get_Settings
MySettings
ReferenceEquals
System.Windows.Forms
get_Forms
MyForms
Conversions
System.Collections
dwXCountChars
dwYCountChars
RuntimeHelpers
GetParameters
Operators
hProcess
process
GetProcAddress
baseAddress
address
Exists
Concat
SubtractObject
GetObject
TargetObject
MyProject
Collect
protect
LateGet
op_Explicit
get_Default
IAsyncResult
DelegateAsyncResult
Environment
environment
Component
get_EntryPoint
ParameterizedThreadStart
ipport
hStdInput
hStdOutput
DelegateWow64GetThreadContext
DelegateGetThreadContext
DelegateWow64SetThreadContext
DelegateSetThreadContext
context
GetConsoleWindow
wShowWindow
nCmdShow
DelegateVirtualAllocEx
PHVNC.My
ToArray
OpenSubKey
ContainsKey
RegistryKey
get_Assembly
BlockCopy
DelegateReadProcessMemory
DelegateWriteProcessMemory
currentDirectory
get_Registry
IsNullOrEmpty
MySettingsProperty
RegistryProxy
WrapNonExceptionThrows
Copyright
2022
$7df2a72a-e9da-4b4f-8a33-10dc02296d22
1.0.0.0
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4
MyTemplate
11.0.0.0
My.Computer
My.Application
My.User
My.Forms
My.WebServices
System.Windows.Forms.Form
Create__Instance__
Dispose__Instance__
My.MyProject.Forms
4System.Web.Services.Protocols.SoapHttpClientProtocol
Create__Instance__
Dispose__Instance__
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
14.0.0.0
My.Settings
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
WinForms_RecursiveFormCreate
WinForms_SeeInnerException
PHVNC.Resources
RemoteDesktop
Windows\explorer.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
GetPixel
185.252.178.121
EOS8IC
U1L0QU
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
cvtres
kernel32
ResumeThread
Wow64SetThreadContext
SetThreadContext
Wow64GetThreadContext
GetThreadContext
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
ZwUnmapViewOfSection
CreateProcessA
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
FileVersion
1.0.0.0
InternalName
PHVNC.exe
LegalCopyright
Copyright
2022
LegalTrademarks
OriginalFilename
PHVNC.exe
ProductName
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
No antivirus signatures available.
No IRMA results available.