Static | ZeroBOX

PE Compile Time

2023-06-03 07:17:26

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x0000ee64 0x0000f000 5.42546938209
.rsrc 0x00012000 0x000007ff 0x00000800 4.88486615034
.reloc 0x00014000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x000120a0 0x000002cc LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0001236c 0x00000493 LANG_NEUTRAL SUBLANG_NEUTRAL exported SGML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
Action`10
<>c__DisplayClass2_0
<Read>b__0
<>p__0
<>9__2_1
<Read>b__2_1
IEnumerable`1
CallSite`1
List`1
__StaticArrayInitTypeSize=32
Microsoft.Win32
user32
ToUInt32
ReadInt32
ToInt32
SwapInt32
X509Certificate2
<>o__3
WriteUInt64
ToUInt64
GetAsUInt64
SetAsUInt64
ToInt64
SwapInt64
ToUInt16
ToInt16
SwapInt16
HMACSHA256
Sha256
Aes256
aes256
__StaticArrayInitTypeSize=6
get_UTF8
<Module>
MessagePackLib.<PrivateImplementationDetails>
SystemParametersInfoA
1DB2A1F9902B35F8F880EF1692CE9947A193D5A698D8F568BDA721658ED4C58B
ES_SYSTEM_REQUIRED
ES_DISPLAY_REQUIRED
MapNameToOID
_hookID
get_FormatID
EXECUTION_STATE
87639126EA77B358F26532367DBA67C5310EF50A8D9888ED070CD40E1F605A8F
get_ASCII
offlineKL
WHKEYBOARDLL
AppdataL
WM_KEYDOWN
LASTINPUTINFO
System.IO
AppdataR
uptimeToDHMS
ES_CONTINUOUS
get_IV
set_IV
GenerateIV
value__
ReadServertData
mscorlib
System.Collections.Generic
Microsoft.VisualBasic
get_SendSync
LowLevelKeyboardProc
dwThreadId
GetWindowThreadProcessId
lpdwProcessId
GetProcessById
EndRead
BeginRead
idThread
InnerAdd
SHA256Managed
get_Connected
get_IsConnected
set_IsConnected
Received
get_Guid
<SendSync>k__BackingField
<IsConnected>k__BackingField
<KeepAlive>k__BackingField
<HeaderSize>k__BackingField
<Ping>k__BackingField
<ActivatePong>k__BackingField
<Interval>k__BackingField
<Buffer>k__BackingField
<Offset>k__BackingField
<SslClient>k__BackingField
<TcpClient>k__BackingField
InnerAddMapChild
InnerAddArrayChild
Append
RegistryValueKind
CompareMethod
method
Clipboard
Replace
IsNullOrWhiteSpace
CreateInstance
vkCode
wScanCode
keyCode
set_Mode
FileMode
PaddingMode
EnterDebugMode
CryptoStreamMode
CompressionMode
CipherMode
SelectMode
utf8Encode
DeleteSubKeyTree
get_Message
DetectSandboxie
EndInvoke
BeginInvoke
GetEnvironmentVariable
IEnumerable
IDisposable
ToDouble
SwapDouble
get_Handle
RuntimeFieldHandle
GetModuleHandle
RuntimeTypeHandle
GetTypeFromHandle
WaitHandle
WriteSingle
ToSingle
SetAsSingle
DownloadFile
InstallFile
DecodeFromFile
SaveBytesToFile
IsInRole
WindowsBuiltInRole
GetActiveWindowTitle
CurrentActiveWindowTitle
get_MainWindowTitle
get_MainModule
ProcessModule
set_WindowStyle
ProcessWindowStyle
get_Name
get_FileName
set_FileName
GetTempFileName
GetFileName
fileName
lpModuleName
get_MachineName
get_OSFullName
get_FullName
IsValidDomainName
get_UserName
lowerName
get_ProcessName
SetName
CheckHostName
DateTime
GetLastInputTime
dwTime
LastLastIdletime
sumofidletime
WriteLine
get_NewLine
Combine
UriHostNameType
get_ValueType
valueType
MsgPackType
ProtocolType
uMapType
GetType
SocketType
FileShare
System.Core
Serversignature
MethodBase
Dispose
StrReverse
X509Certificate
ValidateServerCertificate
certificate
Create
MulticastDelegate
GetKeyboardState
SetThreadExecutionState
SetApartmentState
lpKeyState
GetKeyState
Delete
CallSite
CompilerGeneratedAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
DefaultMemberAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
set_UseShellExecute
ReadByte
WriteByte
DeleteValue
innerValue
GetValue
SetValue
get_KeepAlive
set_KeepAlive
Remove
EX.exe
cbSize
set_BlockSize
get_TotalSize
get_HeaderSize
set_HeaderSize
set_SendBufferSize
set_ReceiveBufferSize
set_KeySize
SizeOf
IndexOf
cchBuff
pwszBuff
lastInputInf
strFlag
CryptoConfig
get_Ping
set_Ping
System.Threading
set_Padding
add_SessionEnding
SystemEvents_SessionEnding
UTF8Encoding
System.Drawing.Imaging
System.Runtime.Versioning
FromBase64String
ToBase64String
ReadString
DownloadString
WriteString
ToString
get_AsString
set_AsString
BytesAsString
GetAsString
SetAsString
GetString
BytesAsHexString
Substring
System.Drawing
get_ActivatePong
set_ActivatePong
set_ErrorDialog
ComputeHash
ComputeStringHash
strToHash
GetHash
VerifyHash
get_ExecutablePath
GetTempPath
GetFolderPath
loggerPath
HmacSha256Length
get_Length
IvLength
AuthKeyLength
EndsWith
fWinIni
msgpackObj
listObj
MessagePackLib.MessagePack
MsgPack
AsyncCallback
HookCallback
RemoteCertificateValidationCallback
TimerCallback
callback
unpack_msgpack
RegistryKeyPermissionCheck
FlushFinalBlock
idHook
SetHook
IsSmallDisk
strVal
RtlSetProcessIsCritical
ProcessCritical
Marshal
NetworkCredential
System.Security.Principal
WindowsPrincipal
AreEqual
get_Interval
set_Interval
Client.Install
kernel32.dll
user32.dll
ntdll.dll
WriteNull
SetAsNull
MutexControl
Encode2Stream
FileStream
NetworkStream
SslStream
DecodeFromStream
CryptoStream
GZipStream
MemoryStream
lParam
uParam
pvParam
wParam
Program
get_Item
get_Is64BitOperatingSystem
Client.Algorithm
SymmetricAlgorithm
AsymmetricAlgorithm
HashAlgorithm
Random
ICryptoTransform
MsgPackEnum
WriteBoolean
ToBoolean
SetAsBoolean
TimeSpan
HwidGen
children
X509Chain
AppDomain
get_CurrentDomain
Pastebin
IsAdmin
GetFileNameWithoutExtension
get_OSVersion
System.IO.Compression
Application
System.Security.Authentication
uAction
System.Reflection
X509CertificateCollection
ManagementObjectCollection
Client.Connection
set_Position
position
CryptographicException
ArgumentNullException
ArgumentException
Unknown
ImageCodecInfo
SendInfo
MethodInfo
FileInfo
DriveInfo
FileSystemInfo
MemberInfo
ComputerInfo
SystemParametersInfo
CSharpArgumentInfo
ProcessStartInfo
GetLastInputInfo
WriteMap
PreventSleep
currentApp
Microsoft.CSharp
NormalStartup
System.Linq
InvokeMember
MD5CryptoServiceProvider
RSACryptoServiceProvider
AesCryptoServiceProvider
StringBuilder
SpecialFolder
InstallFolder
IdSender
sender
Microsoft.CSharp.RuntimeBinder
CallSiteBinder
GetEncoder
get_Buffer
set_Buffer
WriteInteger
get_AsInteger
set_AsInteger
GetAsInteger
SetAsInteger
LimeLogger
DetectDebugger
ManagementObjectSearcher
SessionEndingEventHandler
Client.Helper
ToUpper
DetectManufacturer
CurrentUser
StreamWriter
TextWriter
BitConverter
ToLower
IEnumerator
ManagementObjectEnumerator
System.Collections.IEnumerable.GetEnumerator
Activator
.cctor
Monitor
CreateDecryptor
CreateEncryptor
IntPtr
KillPs
System.Diagnostics
FromSeconds
inSeconds
NativeMethods
GetMethods
Microsoft.VisualBasic.Devices
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
GetDirectories
ExpandEnvironmentVariables
GetTypes
GetProcesses
GetHostAddresses
System.Security.Cryptography.X509Certificates
Walltes
Encode2Bytes
GetUtf8Bytes
utf8Bytes
Rfc2898DeriveBytes
ReadAllBytes
DecodeFromBytes
SwapBytes
LoadFileAsBytes
GetAsBytes
SetAsBytes
GetBytes
rawBytes
BindingFlags
CSharpArgumentInfoFlags
CSharpBinderFlags
esFlags
wFlags
Strings
InitializeSettings
SessionEndingEventArgs
Anti_Analysis
RunAntiAnalysis
ICredentials
set_Credentials
Equals
SslProtocols
ReadTools
WriteTools
BytesTools
System.Windows.Forms
Contains
Plugins
System.Collections
StringSplitOptions
get_Chars
GetImageDecoders
RuntimeHelpers
SslPolicyErrors
sslPolicyErrors
FileAccess
hProcess
GetCurrentProcess
IPAddress
Compress
Decompress
System.Net.Sockets
set_Arguments
SystemEvents
Exists
Antivirus
Concat
ImageFormat
format
WriteFloat
get_AsFloat
set_AsFloat
GetAsFloat
SetAsFloat
LastAct
FindObject
ManagementBaseObject
ForcePathObject
object
Collect
Connect
Reconnect
System.Net
Target
Client.Handle_Packet
KeepAlivePacket
ClientSocket
System.Collections.IEnumerator.Reset
get_Offset
set_Offset
op_Explicit
ClientOnExit
IAsyncResult
result
ToUpperInvariant
WebClient
InitializeClient
get_SslClient
set_SslClient
get_TcpClient
set_TcpClient
AuthenticateAsClient
System.Management
Environment
parent
System.Collections.IEnumerator.Current
System.Collections.IEnumerator.get_Current
GetCurrent
CheckRemoteDebuggerPresent
isDebuggerPresent
get_RemoteEndPoint
get_Count
get_TickCount
get_ProcessorCount
GetPathRoot
Decrypt
Encrypt
ParameterizedThreadStart
Convert
FailFast
ToList
GetKeyboardLayout
System.Collections.IEnumerator.MoveNext
System.Text
ReadAllText
GetText
SetText
GetWindowText
GetForegroundWindow
set_CreateNoWindow
ToUnicodeEx
UnhookWindowsHookEx
SetWindowsHookEx
CallNextHookEx
CloseMutex
CreateMutex
Firefox
WirteArray
InitializeArray
MsgPackArray
ToArray
get_AsArray
refAsArray
get_Key
set_Key
CreateSubKey
DeleteSubKey
OpenSubKey
get_PublicKey
_authKey
MapVirtualKey
masterKey
wVirtKey
RegistryKey
System.Security.Cryptography
Assembly
AddressFamily
BlockCopy
WriteBinary
ToBinary
get_SystemDirectory
SetRegistry
op_Equality
op_Inequality
System.Net.Security
WindowsIdentity
IsNullOrEmpty
WrapNonExceptionThrows
1.0.0.0
.NETFramework,Version=v4.6
FrameworkDisplayName
.NET Framework 4.6
_CorExeMain
mscoree.dll
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!-- Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!-- Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!-- Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<!-- Windows 8.1 -->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!-- Windows 10 -->
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
<asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" >
<asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">
<dpiAware>true</dpiAware>
</asmv3:windowsSettings>
</asmv3:application>
</assembly>
SHA256
lGYhfFYdkdePHHMoVV4ProAEt0UT7lwwx0shRm6IiW9GMJSoPqj1Qvf3szoBtST0rMRyqMkeylMdEZ/P4uCYLA==
j5X+XXnafJ+SGgqxWsmQmKPD4wa/OIvrc+7dsdO4aAyB32JsI3pS5vBViHVyWLqU5GUgkn3E6EpIU4wx8AlzN/lbu8ra7fVI+16yc/b/ik8=
z79rohTZuweAByIHBI5H5FQpDDRWn/f6uHfRxDc6DyMvlcS3mRcrC3M3d/a86F4TfmV7CFgadwJyMONPsPy+Ew==
/1snJ1114o+Lfu5Xp3vg/sFILGCUfKcRtC7wcXXDhcSzmL4Wc1+DwuoJmHOk7rAXZ01ygTH/iE/BXvTZ7wz+1g==
%AppData%
bFZPY0lsQVFzUWh4d0NScDduMmNJV0ZsOW9CUVh0NzM=
apqwYqWSoZl6MCTs/dJst1UMFU/4zzVAPmtH+p8ANHnW6qHYXteJJlmedIhn8dsB/KL2K/McCrnWMwwwNjcyFv62rBzCjQWvPQyBaOKjdR0=
O0qRM2hQnEdBrTh08TkcSuw12yup1Gj7G4wPx1yiqsueV5be4NNyuD/1MeEE3dWr274R8AZ/pQZlt+Ebwii5nPphCrX1FTktxwHU6XHIp/ddT7MAnfkSk9npvoablu42iAhfrt+pD9jtj7hXt96AI9A7ajhjVebRObyql5J49QBJFemlUfvv/dPSeFMjkVSi8G5DUnE0UuI01y62O3+nV6PUG5x597IHjBK2eOSqoMcm97dVq4ilX/fyCqWJrV5iES2UYM6AZo0bl8jfQ01jTi8add6534MO8s2Zg2opuAyLdMKb3IoKXF57m/kQjVgImHwGrALTC1mbyhHamrWnQwEbKtJk/r0H0mbi0hQhfMsT1vN7k8XI5bgqe/wsXQwHj9FRC5LEpVPduF1dsKdD3BEMrjqg5hlgFslUdXEUV7oqmw/Im37dDt+Cbm+g/wG4WZHmf3VQut1ThgSU6mujya2j5wx9rGwLZSNGlXPO9u3LzW5vyWKb4Bl5AXvUaPDMQEK3swrgYJUwQrsIlarGOI1Dnhky7M2VFwk64iSv3bx/3bhfPVn2QDzCxbB72u1ePPbiTOvVeZCie24IpL6iEBin4jajiPMMkCOrl304Wjy6qetsA0N0XDh4PF67AnCFkTazh9+pJqEvnoHvoliU/dEhmd+KZKdj4wwiTVqOwg09cpxz7ZqDl5jc7D9biyKOwcI0+Td5u+mx3iZC84zuvMe9RYqWDTdiz8t74XhxokYvnyObQ5uS6QyZZI2He9vFC2W64pjlASGUiIkGeBa7g5m8kvmEDA/CLF0G9d5jg2/NT8Zkp1PwW4xD2HjkWSnIjPWXJZ89Ay8dzHLv0FCtdEWIBupbje8ODIQoEIH5M5T3wdiLYO5/rVkZBoKIJsA0W7y6GD0W9RzMKuWx+yASoWksO1t9VnzyrxqxCKiulA27r+HJPGiAzKp5CFrHExkdY2oDMVfelRTneOsZ/0lU6MdfaPFQHGLT/zdoSCt7DK3uCV+YhGAGvZx6fYdYgxl3
Ptd6CO8VIYzJZh6sQAi3vxOSrXDD6o5oFKFyqvcKxBqNoi6n/7jCJODr77HFyKs7cQx51cufYVXUwR7HakP4L04XRdibJD3CIVTc8xH+SY3XE7/BFv1ta/KkyIW9FpEdgltNZtBkFCNYq5sJMNhUd4O4MkvnEiwyyzBoPfYLjYh3AAcKL+/7sYu2TbWKZ1/3SqMg3DVD2KsvTaB0mL/WepbZXzU/JsSKQKEjnAK1vJo65yNZTs+nfRdOJfcgNW+r7aVpHpLPltjj5ZCPJ1OudAOBqq4Cs8jawxhMTcYTf2739Ai5ZXfrUNs7J0tbnh0ce1hYokULH5e7OgZ/pXNdWt8EtUeW+Ni3MePIfOGgYU60PGAjxrmLDIwjiAEcbavTqXArRncJ2oqgFsFmzVi4SEqBFKEXEy/5hSy35Zda/whc4goYG0p2uSBGtRBAGETuktrgSjomktC4SZ7gA2JfYduU7ZARC8HhVLhzko/LBTJUGe+IKB+6nm+z56g1Y/tHhjTeTSOhmNL0EnigsFDj5lRG+4xqLrp4TzpMdh3p7ENJnlUxpqSjREAYkYYwDVaIGXz8wcULpslarji/CS9TwQAvBndO8DioGQ2hsXQvazGadR8f8wHs3SFGcGjdqH5MVMjBmCtWAonVFqOcQPUgJ1pOOZahHz+jnyYcESdJil7oA4cHmlm3xlUQppEXxtDRcFNgSrICflg2W2MXXPZP3bTTn1z01zJF0hDSfuSXR/QxfQAVHyq0o4/QgrqUsPLX3PgY3ZoFwCraLop1N5FVvVtC7NvJcJWsJxjsa5kc8v5icxuNA/yv5Kq1hb7MBD7tT1F/jiKdd2QlJHP9eXjJYziW168qUU+iixMVqCpMZ6kkSuaj5izgv7MD9yM25oJqEVNKiuGMLSnURTuhnl7wVtLgN2obZtboAxRkuR1rvoRnW1E3Hjo1wpPm4OqLA0yujvprECe5Wg8JKV7tdrYxKQ==
sftHmE9xWJ4MlO3xnfNgGQTuxAjXwb/CNx7T9MpVuimDCEEWXLkVl8bB+Ih2z9jGKYtHL+jybslY/XhaY8xTJQ==
Q++3Kyy3XB/jyWNvFZ3WZtbdw4iKvx6G0LAv+F6QSsz5ECDR39oDh6RjFuPCmQmQUcrxpigQLRfc2E8R8Nrw9g==
z3OWBuX0wEIxJ3EoZ97N06IEWQ5QQwCgTDPklCDJMwORX/AtbIdFD12tmvNDQVXV22BoBlVPJ3vXHZKsg67Eow==
dsu7aWsXOoxpAsT9jatYvAyRZxv3gaFJ9pIFv/bxH4+bWTXDcJbj99ABQ6yEF8vVf/c6xElTUwKWdfhpu8IGsg==
5QgUtFj2F5hgN7y43YMDVMpxGeRP7vvAR/SIapa6TiTmsE+JLliienAXQQvb9wOniy0Jg56Zr+F7rcI9L/+c+A==
Packet
Message
LastTime
/c schtasks /create /f /sc onlogon /rl highest /tn "
" /tr '"
"' & exit
\nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
@echo off
timeout 3 > NUL
START "" "
" /f /q
Select * from Win32_ComputerSystem
Manufacturer
microsoft corporation
VIRTUAL
vmware
VirtualBox
SbieDll.dll
Err HWID
ClientInfo
Microsoft
Performance
Pastebin
Antivirus
Meta_Firefox
MetaFirefox
\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Meta_Chrome
MetaChrome
\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Meta_Brave
MetaBrave
\Microsoft\Edge\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Meta_Edge
MetaEdge
\Opera Software\Opera Stable\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
\Opera Stable\Local Extension Settings\djclckkglechooblngghdinmeemkbgci
Meta_Opera
MetaOpera
\Opera Software\Opera GX Stable\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
\Opera Software\Opera GX Stable\Local Extension Settings\chrome-extension://djclckkglechooblngghdinmeemkbgci
Meta_OperaGX
MetaOperaGX
\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Phantom_Chrome
PhantomChrome
\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Phantom_Brave
PhantomBrave
\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Binance_Chrome
BinanceChrome
\Microsoft\Edge\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Binance_Edge
BinanceEdge
\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
TronLinkChrome
Exodus_Chrome
\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
BitKeep_Chrome
BitKeepChrome
\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Coinbase_Chrome
CoinbaseChrome
\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Ronin_Chrome
RoninChrome
\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Trust_Chrome
TrustChrome
\Google\Chrome\User Data\Default\Local Extension Settings\jkjgekcefbkpogohigkgooodolhdgcda
BitPay_Chrome
BitPayChrome
\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
F2a_Chrome
F2aChrome
\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
F2a_Brave
F2aBrave
\Microsoft\Edge\User Data\Default\Local Extension Settings\ocglkepbibnalbgmbachknglpdipeoio
F2a_Edge
F2aEdge
\Ergo Wallet
Ergo_Wallet
ErgoWallet
\Ledger Live
Ledger_Live
LedgerLive
\atomic
Atomic
\Exodus
Exodus
\Electrum
Electrum
\Coinomi
Coinomi
\Binance
Binance
\Bitcoin
Bitcoin_Core
Bitcoin Core
BoolWallets
\Mozilla\Firefox\Profiles
-release
\extensions\webextension@metamask.io.xpi
Return
Escape
LControlKey
RControlKey
RShiftKey
LShiftKey
Capital
[SPACE]
[ENTER]
[CTRL]
[Shift]
[Back]
[CAPSLOCK: OFF]
[CAPSLOCK: ON]
\Log.tmp
\root\SecurityCenter2
Select * from AntivirusProduct
displayName
Software\
plugin
savePlugin
gettxt
passload
DicordTokens
WebBrowserPass
anydesk
getscreen
WDExclusion
weburl
killps
ResetScale
KillProxy
backproxy
uacoff
Wallets
Chrome
ResetHosts
sendPlugin
Hashes
AllInOne
Password
Tokens
AVRemoval.Class1
Reset Scale succeeded!
BackProxy.Class1
wallets
\drivers\etc
\hosts.backup
\hosts
127.0.0.1
Blocked!
cmd.exe
/c taskkill.exe /im chrome.exe /f
Reset Hosts succeeded!
Plugin.Plugin
Msgpack
Received
masterKey can not be null or empty.
input can not be null.
Invalid message authentication code (MAC).
{0:D3}
{0:X2}
(never used) type $c1
(ext8,ext16,ex32) type $c7,$c8,$c9
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
FileVersion
1.0.0.0
InternalName
Stub.exe
LegalCopyright
LegalTrademarks
OriginalFilename
Stub.exe
ProductName
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
Antivirus Signature
Bkav W32.AIDetectMalware.CS
Elastic Windows.Generic.Threat
ClamAV Win.Packed.Razy-9625918-0
CMC Clean
CAT-QuickHeal Backdoor.MsilFC.S14901152
Skyhigh BehavesLike.Win32.Fareit.km
ALYac Generic.AsyncRAT.Marte.B.F8C834DF
Cylance unsafe
Zillya Clean
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Trojan.Win32.MSIL_Heur.B
Paloalto Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of MSIL/AsyncRAT.A
APEX Malicious
Avast Win32:DropperX-gen [Drp]
Cynet Clean
Kaspersky HEUR:Backdoor.MSIL.Crysan.gen
BitDefender Generic.AsyncRAT.Marte.B.F8C834DF
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Generic.AsyncRAT.Marte.B.F8C834DF
Tencent Clean
TACHYON Clean
Sophos Troj/AsyncRat-B
F-Secure Trojan.TR/Dropper.Gen
DrWeb BackDoor.AsyncRATNET.2
VIPRE Generic.AsyncRAT.Marte.B.F8C834DF
TrendMicro Clean
Trapmine Clean
FireEye Generic.mg.446035c77554b107
Emsisoft Generic.AsyncRAT.Marte.B.F8C834DF (B)
SentinelOne Static AI - Malicious PE
GData MSIL.Backdoor.DCRat.D
Jiangmin Trojan.Banker.MSIL.hol
Webroot Clean
Varist W32/Samas.B.gen!Eldorado
Avira TR/Dropper.Gen
Antiy-AVL Clean
Kingsoft malware.kb.c.1000
Gridinsoft Clean
Xcitium Clean
Arcabit Generic.AsyncRAT.Marte.B.F8C834DF
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Backdoor.MSIL.Crysan.gen
Microsoft Backdoor:MSIL/AsyncRat.AD!MTB
Google Detected
AhnLab-V3 Malware/Win32.RL_Generic.C4267562
Acronis Clean
McAfee PWS-FCQR!446035C77554
MAX malware (ai score=80)
VBA32 OScope.Backdoor.MSIL.Crysan
Malwarebytes Generic.Malware.AI.DDS
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.AntiVM!1.CF63 (CLASSIC)
Yandex Clean
Ikarus Backdoor.AsyncRat
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Agent.CFQ!tr
BitDefenderTheta Gen:NN.ZemsilF.36802.dm0@a4D6Ied
AVG Win32:DropperX-gen [Drp]
DeepInstinct MALICIOUS
alibabacloud Backdoor[rat]:MSIL/Agenttesla.Stub.LQL!MTB
No IRMA results available.