Static | ZeroBOX

PE Compile Time

2048-04-25 22:01:52

PDB Path

C:\Users\user\source\repos\AVNC-silent\AVNC-silent\obj\Debug\AVNC-silent.pdb

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x000326c0 0x00032800 7.20906497272
.rsrc 0x00036000 0x000005bc 0x00000600 4.11431849109
.reloc 0x00038000 0x0000000c 0x00000200 0.101910425663

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x00036090 0x0000032c LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x000363cc 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
/xof
Y_c`
Y_c`
v4.0.30319
#Strings
get_Scan0
__StaticArrayInitTypeSize=32
Color32
ToInt32
<Module>
<PrivateImplementationDetails>
B2B2194DBDCAF7C5569C7B843237441528A17136EAAC3805E2D6DD6BD62CDBEA
sendPAGE
ABSOLUTE
get_ASCII
SendMK
sendMouseL
MIDDLEDOWN
LEFTDOWN
RIGHTDOWN
System.IO
clientIP
MIDDLEUP
LEFTUP
RIGHTUP
sendMouseR
sendTEXT
value__
sourceData
BitmapData
dwData
System.Web
FromArgb
mscorlib
listeningThread
DrawImageUnscaled
get_Connected
imagesToSend
method
Replace
ExtractResource
Reduce
get_Stride
FileMode
ImageLockMode
OctreeNode
_previousNode
UrlDecode
Octree
_octree
mainPage
loginPage
sendImage
FromImage
RemoveRange
doStroke
sendKeystroke
EndInvoke
BeginInvoke
IDisposable
get_NextReducible
set_NextReducible
_nextReducible
RuntimeFieldHandle
Rectangle
Console
getTitle
setTitle
resourceName
SocketOptionName
getTime
WriteLine
Combine
ValueType
GetType
Compare
Dispose
refreshRate
validate
MulticastDelegate
get_Palette
set_Palette
ColorPalette
ConstructPalette
GetPalette
palette
CompilerGeneratedAttribute
GuidAttribute
UnverifiableCodeAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
SecurityPermissionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
FlagsAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
getValue
Receive
AVNC-silent.exe
get_Size
imageSize
setImgSize
Palletize
Quantize
sendDrag
doMouseDrag
get_Jpeg
getImg
get_Png
System.Threading
Encoding
System.Drawing.Imaging
startListening
System.Runtime.Versioning
ToBase64String
ToString
GetString
Substring
System.Drawing
onAddLog
ciSizeMismatch
ciPixelMismatch
ComputeHash
loginFilePath
scriptFilePath
outputPath
get_Width
sliceWidth
get_Length
StartsWith
ciCompareOk
AsyncCallback
callback
doMouseClick
original
System.ComponentModel
SocketOptionLevel
compressionlevel
InitialQuantizePixel
user32.dll
GetManifestResourceStream
FileStream
MemoryStream
Program
get_Item
set_Item
System
HashAlgorithm
AVNC_silent.Resources.login.htm
getCheckSum
checksum
captureScreen
CopyFromScreen
get_PrimaryScreen
_green
get_Children
_children
imageCompression
compression
SecurityAction
System.Reflection
SetSocketOption
ArgumentOutOfRangeException
button
ConvertTo
CopyTo
AVNC_silent.Resources.main.ico
dwExtraInfo
Bitmap
Quantize4bpp
extractImageNumber
getNumber
number
MD5CryptoServiceProvider
TcpListener
HTMLWrapper
ToPointer
ImageConverter
TypeConverter
server
OctreeQuantizer
get_Color
AddColor
_previousColor
.cctor
IntPtr
Graphics
System.Diagnostics
get_Bounds
bounds
pieces
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
get_ReducibleNodes
_reducibleNodes
CompareImages
get_Entries
AVNC.Classes
GetBytes
get_Leaves
set_Leaves
SocketFlags
MouseEventFlags
dwFlags
AVNC_silent.Resources.script.js
System.Windows.Forms
System.Security.Permissions
System.Collections
SetCursorPos
RuntimeHelpers
_maxColors
SecondPass
_singlePass
FirstPass
FileAccess
IPAddress
get_Address
System.Net.Sockets
LockBits
UnlockBits
_maxColorBits
colorBits
Exists
TrackPrevious
SendKeys
Concat
ImageFormat
get_PixelFormat
Object
object
System.Net
AcceptSocket
get_Height
sliceHeight
height
SendWait
set_PageUnit
GraphicsUnit
loginPasswordSalt
IAsyncResult
CompareResult
result
AVNC-silent
AVNC_silent
Increment
mouse_event
IPEndPoint
get_RemoteEndPoint
get_Count
_leafCount
_pixelCount
colorCount
generateSnapshot
ThreadStart
Convert
ArrayList
output
System.Text
ReadAllText
GetPaletteIndex
_paletteIndex
startx
InitializeArray
ToArray
System.Security.Cryptography
GetExecutingAssembly
appDirectory
op_Inequality
HttpUtility
System.Security
starty
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
WrapNonExceptionThrows
AVNC-silent
Copyright
2024
$13e9252b-9a59-4352-8727-7240fafdc202
1.0.0.0
.NETFramework,Version=v4.7.2
FrameworkDisplayName
.NET Framework 4.7.2
<html>
<head><title>HVNC</title></head>
<body>
</tr></td></table>
<style>
fieldset {
margin: 20px 0;
padding: 15px 30px;
border: 3px single #878177;
width: 450px;
font:100% verdana,arial,sans-serif;
legend {
padding: 2px 5px;
font:100% verdana,arial,sans-serif;
.style1 {
color: #00CC33
.style2 {
font-family: Geneva, Arial, Helvetica, sans-serif;
font-size: 36px;
.inputStyle {
width:200px;
SCROLLBAR-BASE-COLOR: #fffffff;
SCROLLBAR-ARROW-COLOR: #666666;
border-top-width : 1px;
border-right-width : 1px;
border-bottom-width : 1px;
border-left-width : 1px;
border-style : dotted;
</style>
<script>
function crc32(str){str=this.utf8_encode(str);var table="00000000 77073096 EE0E612C 990951BA 076DC419 706AF48F E963A535 9E6495A3 0EDB8832 79DCB8A4 E0D5E91E 97D2D988 09B64C2B 7EB17CBD E7B82D07 90BF1D91 1DB71064 6AB020F2 F3B97148 84BE41DE 1ADAD47D 6DDDE4EB F4D4B551 83D385C7 136C9856 646BA8C0 FD62F97A 8A65C9EC 14015C4F 63066CD9 FA0F3D63 8D080DF5 3B6E20C8 4C69105E D56041E4 A2677172 3C03E4D1 4B04D447 D20D85FD A50AB56B 35B5A8FA 42B2986C DBBBC9D6 ACBCF940 32D86CE3 45DF5C75 DCD60DCF ABD13D59 26D930AC 51DE003A C8D75180 BFD06116 21B4F4B5 56B3C423 CFBA9599 B8BDA50F 2802B89E 5F058808 C60CD9B2 B10BE924 2F6F7C87 58684C11 C1611DAB B6662D3D 76DC4190 01DB7106 98D220BC EFD5102A 71B18589 06B6B51F 9FBFE4A5 E8B8D433 7807C9A2 0F00F934 9609A88E E10E9818 7F6A0DBB 086D3D2D 91646C97 E6635C01 6B6B51F4 1C6C6162 856530D8 F262004E 6C0695ED 1B01A57B 8208F4C1 F50FC457 65B0D9C6 12B7E950 8BBEB8EA FCB9887C 62DD1DDF 15DA2D49 8CD37CF3 FBD44C65 4DB26158 3AB551CE A3BC0074 D4BB30E2 4ADFA541 3DD895D7 A4D1C46D D3D6F4FB 4369E96A 346ED9FC AD678846 DA60
return crc^(-1);}
function md5(str){var xl;var rotateLeft=function(lValue,iShiftBits){return(lValue<<iShiftBits)|(lValue>>>(32-iShiftBits));};var addUnsigned=function(lX,lY){var lX4,lY4,lX8,lY8,lResult;lX8=(lX&0x80000000);lY8=(lY&0x80000000);lX4=(lX&0x40000000);lY4=(lY&0x40000000);lResult=(lX&0x3FFFFFFF)+(lY&0x3FFFFFFF);if(lX4&lY4){return(lResult^0x80000000^lX8^lY8);}
if(lX4|lY4){if(lResult&0x40000000){return(lResult^0xC0000000^lX8^lY8);}else{return(lResult^0x40000000^lX8^lY8);}}else{return(lResult^lX8^lY8);}};var _F=function(x,y,z){return(x&y)|((~x)&z);};var _G=function(x,y,z){return(x&z)|(y&(~z));};var _H=function(x,y,z){return(x^y^z);};var _I=function(x,y,z){return(y^(x|(~z)));};var _FF=function(a,b,c,d,x,s,ac){a=addUnsigned(a,addUnsigned(addUnsigned(_F(b,c,d),x),ac));return addUnsigned(rotateLeft(a,s),b);};var _GG=function(a,b,c,d,x,s,ac){a=addUnsigned(a,addUnsigned(addUnsigned(_G(b,c,d),x),ac));return addUnsigned(rotateLeft(a,s),b);};var _HH=function(a,b,c,d,x,s,ac){a=addUnsigned(a,addUnsigned(addUnsigned(_H(b,c,d),x),ac));return addUnsigned(rotateLeft(a,s),b);};var _II=function(a,b,c,d,x,s,ac){a=addUnsigned(a,addUnsigned(addUnsigned(_I(b,c,d),x),ac));return addUnsigned(rotateLeft(a,s),b);};var convertToWordArray=function(str){var lWordCount;var lMessageLength=str.length;var lNumberOfWords_temp1=lMessageLength+8;var lNumberOfWords_temp2=(lNumberOfWords_temp1-(lNumberO
lWordCount=(lByteCount-(lByteCount%4))/4;lBytePosition=(lByteCount%4)*8;lWordArray[lWordCount]=lWordArray[lWordCount]|(0x80<<lBytePosition);lWordArray[lNumberOfWords-2]=lMessageLength<<3;lWordArray[lNumberOfWords-1]=lMessageLength>>>29;return lWordArray;};var wordToHex=function(lValue){var wordToHexValue="",wordToHexValue_temp="",lByte,lCount;for(lCount=0;lCount<=3;lCount++){lByte=(lValue>>>(lCount*8))&255;wordToHexValue_temp="0"+lByte.toString(16);wordToHexValue=wordToHexValue+wordToHexValue_temp.substr(wordToHexValue_temp.length-2,2);}
return wordToHexValue;};var x=[],k,AA,BB,CC,DD,a,b,c,d,S11=7,S12=12,S13=17,S14=22,S21=5,S22=9,S23=14,S24=20,S31=4,S32=11,S33=16,S34=23,S41=6,S42=10,S43=15,S44=21;str=this.utf8_encode(str);x=convertToWordArray(str);a=0x67452301;b=0xEFCDAB89;c=0x98BADCFE;d=0x10325476;xl=x.length;for(k=0;k<xl;k+=16){AA=a;BB=b;CC=c;DD=d;a=_FF(a,b,c,d,x[k+0],S11,0xD76AA478);d=_FF(d,a,b,c,x[k+1],S12,0xE8C7B756);c=_FF(c,d,a,b,x[k+2],S13,0x242070DB);b=_FF(b,c,d,a,x[k+3],S14,0xC1BDCEEE);a=_FF(a,b,c,d,x[k+4],S11,0xF57C0FAF);d=_FF(d,a,b,c,x[k+5],S12,0x4787C62A);c=_FF(c,d,a,b,x[k+6],S13,0xA8304613);b=_FF(b,c,d,a,x[k+7],S14,0xFD469501);a=_FF(a,b,c,d,x[k+8],S11,0x698098D8);d=_FF(d,a,b,c,x[k+9],S12,0x8B44F7AF);c=_FF(c,d,a,b,x[k+10],S13,0xFFFF5BB1);b=_FF(b,c,d,a,x[k+11],S14,0x895CD7BE);a=_FF(a,b,c,d,x[k+12],S11,0x6B901122);d=_FF(d,a,b,c,x[k+13],S12,0xFD987193);c=_FF(c,d,a,b,x[k+14],S13,0xA679438E);b=_FF(b,c,d,a,x[k+15],S14,0x49B40821);a=_GG(a,b,c,d,x[k+1],S21,0xF61E2562);d=_GG(d,a,b,c,x[k+6],S22,0xC040B340);c=_GG(c,d,a,b,x[k+11],S23,0x265E5A
var temp=wordToHex(a)+wordToHex(b)+wordToHex(c)+wordToHex(d);return temp.toLowerCase();}
function sha1(str){var rotate_left=function(n,s){var t4=(n<<s)|(n>>>(32-s));return t4;};var cvt_hex=function(val){var str="";var i;var v;for(i=7;i>=0;i--){v=(val>>>(i*4))&0x0f;str+=v.toString(16);}
return str;};var blockstart;var i,j;var W=new Array(80);var H0=0x67452301;var H1=0xEFCDAB89;var H2=0x98BADCFE;var H3=0x10325476;var H4=0xC3D2E1F0;var A,B,C,D,E;var temp;str=this.utf8_encode(str);var str_len=str.length;var word_array=[];for(i=0;i<str_len-3;i+=4){j=str.charCodeAt(i)<<24|str.charCodeAt(i+1)<<16|str.charCodeAt(i+2)<<8|str.charCodeAt(i+3);word_array.push(j);}
switch(str_len%4){case 0:i=0x080000000;break;case 1:i=str.charCodeAt(str_len-1)<<24|0x0800000;break;case 2:i=str.charCodeAt(str_len-2)<<24|str.charCodeAt(str_len-1)<<16|0x08000;break;case 3:i=str.charCodeAt(str_len-3)<<24|str.charCodeAt(str_len-2)<<16|str.charCodeAt(str_len-1)<<8|0x80;break;}
word_array.push(i);while((word_array.length%16)!=14){word_array.push(0);}
word_array.push(str_len>>>29);word_array.push((str_len<<3)&0x0ffffffff);for(blockstart=0;blockstart<word_array.length;blockstart+=16){for(i=0;i<16;i++){W[i]=word_array[blockstart+i];}
for(i=16;i<=79;i++){W[i]=rotate_left(W[i-3]^W[i-8]^W[i-14]^W[i-16],1);}
A=H0;B=H1;C=H2;D=H3;E=H4;for(i=0;i<=19;i++){temp=(rotate_left(A,5)+((B&C)|(~B&D))+E+W[i]+0x5A827999)&0x0ffffffff;E=D;D=C;C=rotate_left(B,30);B=A;A=temp;}
for(i=20;i<=39;i++){temp=(rotate_left(A,5)+(B^C^D)+E+W[i]+0x6ED9EBA1)&0x0ffffffff;E=D;D=C;C=rotate_left(B,30);B=A;A=temp;}
for(i=40;i<=59;i++){temp=(rotate_left(A,5)+((B&C)|(B&D)|(C&D))+E+W[i]+0x8F1BBCDC)&0x0ffffffff;E=D;D=C;C=rotate_left(B,30);B=A;A=temp;}
for(i=60;i<=79;i++){temp=(rotate_left(A,5)+(B^C^D)+E+W[i]+0xCA62C1D6)&0x0ffffffff;E=D;D=C;C=rotate_left(B,30);B=A;A=temp;}
H0=(H0+A)&0x0ffffffff;H1=(H1+B)&0x0ffffffff;H2=(H2+C)&0x0ffffffff;H3=(H3+D)&0x0ffffffff;H4=(H4+E)&0x0ffffffff;}
temp=cvt_hex(H0)+cvt_hex(H1)+cvt_hex(H2)+cvt_hex(H3)+cvt_hex(H4);return temp.toLowerCase();}
function utf8_encode(argString){var string=(argString+'').replace(/\r\n/g,"\n").replace(/\r/g,"\n");var utftext="";var start,end;var stringl=0;start=end=0;stringl=string.length;for(var n=0;n<stringl;n++){var c1=string.charCodeAt(n);var enc=null;if(c1<128){end++;}else if((c1>127)&&(c1<2048)){enc=String.fromCharCode((c1>>6)|192)+String.fromCharCode((c1&63)|128);}else{enc=String.fromCharCode((c1>>12)|224)+String.fromCharCode(((c1>>6)&63)|128)+String.fromCharCode((c1&63)|128);}
if(enc!==null){if(end>start){utftext+=string.substring(start,end);}
utftext+=enc;start=end=n+1;}}
if(end>start){utftext+=string.substring(start,string.length);}
return utftext;}
</script>
<script>
function go()
document.cookie = "login="+sha1(document.myForm.password.value+A-VNCloginPasswordSalt)+":"+document.myForm.compression.value+":"+document.myForm.rate.value+":"+document.myForm.size.value;
document.myForm.password.value = "";
window.location = "AVNC";
</script>
<center>
<span class="style2"><b><span class="style1">H</span> - VNC</b></span><br>
<fieldset>
<legend><b>Login</b></legend>
<form name="myForm" action="AVNC" onSubmit="javascript:go();">
<table cellpadding="5">
<tr><td valign="top">Password: </td><td><p>
<input name="password" type="password" class="inputStyle">
<br /></td>
<tr><td valign="top">Image Compression:</td>
<select name="compression" class="inputStyle">
<option value="0">JPEG (lossy)</option>
<option value="1">PNG-24bit (lossless - best)</option>
<option value="2">PNG-8bit (256 colors)</option>
<option value="3" selected="selected">PNG-6bit (64 colors)</option>
<option value="4">PNG-4bit (16 colors - ugly)</option>
</select>
<tr><td valign="top">Image Size:</td>
<select name="size" class="inputStyle">
<option value="0">128x128</option>
<option value="1">256x256</option>
<option value="2">384x384</option>
<option value="3" selected="selected">512x512</option>
<option value="4">640x640</option>
<option value="5">Single Image</option>
</select>
<td>Refresh Rate:</td>
<td><select name="rate" class="inputStyle">
<option value="0">None</option>
<option value="1">1</option>
<option value="2">2</option>
<option value="3" selected="selected">3</option>
<option value="4">4</option>
<option value="5">5</option>
</select></td>
</table><br><br>
<input type="button" value="Login" onClick="go();" class="inputStyle">
</form>
<br><br>
</fieldset>
</center>
</body>
</html>
h&"c1Q
1A6&2cQ
11#b61E1
!)2;FR
()2;Q_`
()2;Q_a
()2;Q_`
STUVWXYZ[\]^_
GHIJKLMNOP;QR
<=>?@ABCDE2;F
3456789:()2;
*+,-./01 ()2
"#$%&'
!)2;FR
()2;Q_`
()2;Q_a
()2;Q_`
STUVWXYZ[\]^_
GHIJKLMNOP;QR
<=>?@ABCDE2;F
3456789:()2;
*+,-./01 ()2
"#$%&'
A''777
1"r'rw7xs
r{#2r71
11!2'#7"wQ
AAT'""r'
CC2s7s
>IR[ep
$,4=>IR[ey
#+,4=>IR[ey
#+,4=>IR[ey
#+,4=>IR[ey
#+,4=>IR[ey
qrsiVMtuNalvwxR[ey
fghiVMjkNalmnoIR[ep
\]^VM_`Nabcd=>IR[e
STUVMCDNWXYZ4=>IR[
JKLMCDNOPQ+,4=>IR
?@ABCDEFGH#+,4=>I
56789:;<
#+,4=>
-./0123
%&'()*
>IR[ep
$,4=>IR[ey
#+,4=>IR[ey
#+,4=>IR[ey
#+,4=>IR[ey
#+,4=>IR[ey
qrsiVMtuNalvwxR[ey
fghiVMjkNalmnoIR[ep
\]^VM_`Nabcd=>IR[e
STUVMCDNWXYZ4=>IR[
JKLMCDNOPQ+,4=>IR
?@ABCDEFGH#+,4=>I
56789:;<
#+,4=>
-./0123
%&'()*
D&&FFFFFF
&&&&FFkdkd
4SB&"bbb&&FdQQ
T1D&"&)rb&
1E1&"b
$B"kaQ!Q
d$rfAR
C&&&DC
A!4bfA!1
ddAQAA1A
A5&DAC
!CT!1DAQA1
6=FQ^_gpw
).56=FQ^_gpw
#().56=FQ^_gpw
"#().56=FQ^_gpw
"#().56=FQ^_gpw
"#().56=FQ^_gpw
"#().56=FQ^_gpw
r1H80%&3D[eu
Q^_gpw
xyrz{k|}~Yl
FQ^_gpw
qrstkVWXYlc[uv6=FQ^_gpw
hi1jkVWXYlmeno56=FQ^_gp
`1abVWXYcdef).56=FQ^_g
STHUVWXYZ[\]().56=FQ^_
GHIJKLMNOP"#().56=FQR
>?8@ABCDE
"#().56=F
7829:3;<
"#().56=
/01234
"#().56
*+%&,-
6=FQ^_gpw
).56=FQ^_gpw
#().56=FQ^_gpw
"#().56=FQ^_gpw
"#().56=FQ^_gpw
"#().56=FQ^_gpw
"#().56=FQ^_gpw
r1H80%&3D[eu
Q^_gpw
xyrz{k|}~Yl
FQ^_gpw
qrstkVWXYlc[uv6=FQ^_gpw
hi1jkVWXYlmeno56=FQ^_gp
`1abVWXYcdef).56=FQ^_g
STHUVWXYZ[\]().56=FQ^_
GHIJKLMNOP"#().56=FQR
>?8@ABCDE
"#().56=F
7829:3;<
"#().56=
/01234
"#().56
*+%&,-
"bcccccbf66
6"bbccchcf666
A1Rbc&&&6&66
!5A1&"bb&&"bbbbbhc1
QA!A&&"
&"b6+b&&
Q5"b&"
b&&&f1
&&"hh1
T&6++b#
b&&6c1
E!A1"b&&"b&"b#ha
!A#cb+b#c&"fc3
t51R&"b
E1A42cb
CAA1E!
2c&#r&c!
&6""fc5
Q14566&&&3
1CA5!R
CA1A2&641
ACA14S
5!ACCA3$
!A15!R
TToopo~
===STTTopp~~
8====STTTop~~
==STTTopp~
====STTTo
#(((-228=
==STTooop~
#(((--28=
==SSToo
#((--22
=SSTToop~~~
##(--228=
==SSTTop~~
##(((-228=
=SSTTTo
#((2-228
Tooop~~
r\V?:5%+I;Jbmv
5%+0;JYmv
Tooop~
{hijkltXH
SSSTTopo~~
{{hijkltXH
=SSTTTop~~~
{hijkltXH
==STTTop~~
rAh{hijkltX
28====STTTopp~
xyr\z{hijkltX%mv|}228====STTTopo~
qr\Vshijkltubmvw(-228====STTTopo
ef\VghijklX+bmn(((-2288===STTTop
[\FEX]^_`aJbcd#(((-2288===STTT
.UVEAWNOXIJYZ#(((-228====STT
LF?:MNOP;JQR#(((-228====ST
DE:FGHI;JK
#(((-228====
>?:5@A&;BC
#(((-228===
9:55+0;<
#(((-228==
.345%+067
#(((-228
./%%&01
#(((-2
#(((-
#((
f]]RIIj
f]]RIIYu
f^_TPRr
g^^PGHb
g^^PGHb
g^^PGHb
g^^PGHb
g^^PGHb
g^^PGHb
g^^PGHb
;UUJ-U
1151511
Q12bbb2bc&66666vcfvcv6
"c&f66666666&6v&vfvv1Q
!bbc#&#cccccggbgcggfc
&2bfcfbf6ccf6gfvcf6s
E!!Bbc"
""b&"bbb&&66vv!
&(b&&"&&"bbfg
Q4QCA!"bb(h(b&#2bbb&"ggb
Q2c&""b(b
b&"bbcfq
"bbb&vv1
&6""&(b
""bcf6Q
2bbhh&"#
&&&&6gc
QCQ2cc"&(&&"bbb"gf3
C1CC&&"h"b"&""bf6v
&&"&v35
"b&cfc
c&&&";
5"&c"(b3
c&b&&;
T442c&
b"jf3Q
515!62bb;
CCcc&3
4141CECQ!
f6"33&6f
CC4141CC1142f6&&663
14T4SE1QEA
"cc""f6!
&66&6v
E1!&62ccc
S2f6663S
1CA4114
S&6v311QC
666cQCA5
bc!CQ1
5CQ&254
!E!E14
1CT15CR
!A15!A
LLLppv
LLLLLpp
666KLLLLLpppv
;;666KLLLLLpppvv
%;666666KLKLLppppvv
%%%%;66666KKLKppppv
%%%%%%;666KKKLKKLpLpv
%%%%%%%;;;666KLLLLppppvvv
%%%%%%;;;;6K6KKLKLLppvv
%%%%%;;;;;66KKLKLLppppvvv
%%%%%;;;66666KKLLLpppvv
%%%;;;;66KKKKKLLLLpp
%%%%;;;6;66KKKLLLLppp
%%%%;;;66KKKLLLLLppv
%;%;;;;;666KLLppLppv
rr=E]88,'##099RYYt~~
r\=E]8/,'#409RRYtt~~
rr\=E88/,,#4099RRYt~~
BhhhGPHOOzzA{n^XXXQQ
yyhhhGPOOzz
yyhhGGPHOzzz
LLLpppv
LLLLppv
yyhijklmOz
KKKLLLppvv
yyhijklmOOz
KKLLLLppppv
yhhijklmOzz
6K6KLKLLLppp
yhijklmOzzz
;666KKKLLLpppv
rr=GyyhijklmOz
;;;6KKKLLLLppppv
rr=ByyhijklmOOz{0Yt~
;;;;6K6KLKLLLpppv
}rr=EHyhijklmOzzrYYt~
%;;6;;666LKLLLLppp
wxr=]FyhijklmOz{9YYt|%%%%;6;666KKLKLLLppvvv
qr\E]AhsjklmOO\RYYtu%%%%%;;;;666LLKLLpLpvv
!g=]E\hijklmOn9RYYo
%%%%%%;6;;666LLLKLLLp
[\E]8^_`abcO]dRYef
%%%%%;6;;666KLLLLLL
W=E8EGGGHHX99RYZ
%%%%%%;6;;666KLLLLL
TEE8/BGGPH899RUV
%%%%%;6;6666KLLLL
MNE888OPHQ099RS
%%%%%;;;6666KLL
DE8//FGH'099IJ
%%%%%;;66666KL
@8/,'AB4099C
%%%%%%;66666
<8,'='409>?
%%%%%%;6666
78/'#409:
%%%%%%%;6;6
23/'#405
%%%%%%%66
./,##01
%%%%%%%
*+,##-
%%%%%%
&'#()
ku}bs}x
sijcZ[TKLKKN
sijcZ[TKLE==t
sijcZ[TKLJIL~
jqx`owv
ulld[\SJKD?@
ulld[\SJKD?@
ulld[\SJKD?@
ulld[\SJKD?@
ulld[\SJKD?@
ulld[\SJKD?@
ulld[\SJKD?@
ulld[\SJKD?@
ulld[\SJKD?@
ulld[\SJKD?@
#1wB7@<7
u@2;&?jE
aFSJBh
l,"1Tz
3`EqUB
lj1Lzw
Z}e\wj
2xd<tr> S
`f(pDHq
A(S`[4gvtu
*+Ry}v
kP1.y>(
GDX@eD
?TEgR|
5xGcp+T
dBUU0T
.4A.8vNsQ
b=BWQv
7;=7KwH-}u
X9/4<P
)\@VU~
|-3`iu
ei-{k$
sS:oRI
7n=^~;
LAXZPH
%9&DA[g
DO MKF
c nA2<p=l
Y9k Y&#
5V{G1P
F8L<e
$-UFnT
66,4_ .R
Q6K79HT
Ra&F*ZG
__Y;p"SFKtx<"?
[sF?@F
Hu30[HZ
AF0<a20
>D+b& c
h I1v0V
l\YZzc
oy&"P_
wU=7@
{M@!(
I>}II8Yo
G"g`Oj
@O]Pz%1
u{.b]<ev
%;{m:YJ
MHCJ.C
^-fS}T
7!8I"h4
/4|X+M`
Gc~n>`
x7W)?>
9CPKJF
zy)#`I
ZzqIoHw
Voix~`
yq*py9-
=`?9}k
CQex'7
e Hh3P
wek0nO@j
KS||1?
=dsfi
R/Q|.$
S/O[|%
1nn_hu
hGpGd5
U5NnqQ
@;XEP5r
hiV~rMw
T2caeL&
8eFfr.
bNWcoi\
Cd{xS!
[\4m=7
g%,~i`>t
~@^:={d
&`aK?C
F02|*
var rrate = $RRATE;
var keyrate = 250;
var mouseX = 0, mouseY = 0, mouseB = 0;
var dragStartX = 0, dragStartY = 0, dragStartB = 0;
var dragEndX = 0, dragEndY = 0, dragEndB = 0;
var freshener = 0;
var keybuff = "";
var keyb = setInterval("SendKeys();",keyrate);
var focusrrate = rrate;
var currentRefreshInterval
console.log(keyb);
// This handles the WhatsNew / Refresh Rate for us... setInterval will keep calling the function at the interval. In this case, its "whatsNew"...
if (rrate>0) currentRefreshInterval = setInterval("whatsNew();", rrate*200);
if (document.all) // for IE
document.onmousedown = mouseDown;
document.onmouseup = mouseUp;
window.onblur = windowBlurHandler;
window.onfocus = windowFocusHandler;
else // for FF
document.onmousedown = mouseDown;
document.onmouseup = mouseUp;
document.onclick = FFClick;
window.onblur = windowBlurHandler;
window.onfocus = windowFocusHandler;
if(window.addEventListener)
window.addEventListener("keypress", keyPressHandler, true);
window.addEventListener("keyup", keyUpHandler, true);
window.addEventListener("keydown", keyDownHandler, true);
if (document.addEventListener)
document.addEventListener("keypress", keyPressHandler, true);
document.addEventListener("keyup", keyUpHandler, true);
document.addEventListener("keydown", keyDownHandler, true);
document.onkeypress = keyPressHandler;
document.onkeyup = keyUpHandler;
document.onkeydown = keyDownHandler;
//document.onblur = windowBlurHandler;
//document.onfocus = windowFocusHandler;
function FFClick(e)
e.preventDefault();
e.stopPropagation();
return false;
function mouseDown(e)
if (!e)
e = window.event; // compatibility fix for IE
if(e.pageX){ // not IE (Firefox / Opera / Etc)
mouseX = e.pageX;
mouseY = e.pageY;
mouseB = e.which;
if(mouseB == 3)
mouseB = 2;
else{ // IE
mouseX = e.clientX + document.body.scrollLeft + document.documentElement.scrollLeft -2; // IE still offsets by 2 even though the CSS is pixel specific.
mouseY = e.clientY + document.body.scrollTop + document.documentElement.scrollTop -2;
mouseB = e.button;
dragStartX = mouseX;
dragStartY = mouseY;
dragStartB = mouseB;
if (e.preventDefault) e.preventDefault();
function mouseUp(e)
if (!e) e = window.event; // compatibility fix for IE
if(e.pageX) { // not IE (Firefox / Opera / Etc)
mouseX = e.pageX;
mouseY = e.pageY;
mouseB = e.which;
if(mouseB == 3)
mouseB = 2; // compatibility fix for FireFox
} else { // IE
mouseX = e.clientX + document.body.scrollLeft + document.documentElement.scrollLeft -2; // IE still offsets by 2 even though the CSS is pixel specific.
mouseY = e.clientY + document.body.scrollTop + document.documentElement.scrollTop -2;
mouseB = e.button;
dragEndX = mouseX;
dragEndY = mouseY;
dragEndB = mouseB;
if(dragEndX == dragStartX && dragEndY == dragStartY) // no movement - its a single click, not a drag.
send("sendClick "+mouseX+" "+mouseY+" "+mouseB);
send("sendDrag "+dragStartX+" "+dragEndX+" "+dragStartY+" "+dragEndY+" "+mouseB);
//function keyboardHandler(e)
send("sendStroke "+e.which);
return false;
function keyUpHandler(e)
if (!e)
e = window.event; // compatibility fix for IE
if (e.stopPropagation)
e.stopPropagation();
e.cancelBubble = true;
if (e.preventDefault)
e.preventDefault();
e.returnValue = false;
return false;
function windowBlurHandler(e)
if(rrate == focusrrate)
rrate = rrate * 20;
if (rrate>0)
clearInterval(currentRefreshInterval);
currentRefreshInterval = setInterval("whatsNew();", rrate*200);
console.log("Window Blurred - Interval lowered... " + currentRefreshInterval);
return false;
function windowFocusHandler(e)
rrate = focusrrate;
if(currentRefreshInterval) clearInterval(currentRefreshInterval);
if (rrate>0) currentRefreshInterval = setInterval("whatsNew();", rrate*200);
console.log("Window Focused - Interval increased... " + currentRefreshInterval);
return false;
function keyPressHandler(e)
if (!e)
e = window.event; // compatibility fix for IE
if (e.stopPropagation)
e.stopPropagation();
e.cancelBubble = true;
if (e.preventDefault)
e.preventDefault();
e.returnValue = false;
return false;
function keyDownHandler(e)
if (!e)
e = window.event; // compatibility fix for IE
var kc = "";
if (e.shiftKey) kc=kc+"%2B"; //URLencoded
if (e.ctrlKey) kc=kc+"%5E";
if (e.altKey) kc=kc+"%25";
var keyCode = e.charCode? e.charCode : e.keyCode // ie or fx or anything else...
if (keyCode)
switch (keyCode) //keycode converter http://msdn.microsoft.com/en-us/library/system.windows.forms.sendkeys.aspx
case 16:
case 17:
case 18:
kc="";
break; //ignore ctrl, shift and alt
case 8:
kc=kc+"{BACKSPACE}";
break;
case 9:
kc=kc+"{TAB}";
break;
case 13:
kc=kc+"{ENTER}";
break;
case 19:
kc=kc+"{BREAK}";
break;
case 20:
kc=kc+"{CAPSLOCK}";
break;
case 27:
kc=kc+"{ESC}";
break;
case 33:
kc=kc+"{PGUP}";
break;
case 34:
kc=kc+"{PGDN}";
break;
case 35:
kc=kc+"{END}";
break;
case 36:
kc=kc+"{HOME}";
break;
case 37:
kc=kc+"{LEFT}";
break;
case 38:
kc=kc+"{UP}";
break;
case 39:
kc=kc+"{RIGHT}";
break;
case 40:
kc=kc+"{DOWN}";
break;
case 45:
kc=kc+"{INSERT}";
break;
case 46:
kc=kc+"{DELETE}";
break;
case 106:
kc=kc+"{MULTIPLY}";
break;
case 107:
kc=kc+"{ADD}";
break;
case 109:
kc=kc+"{SUBTRACT}";
break;
case 111:
kc=kc+"{DIVIDE}";
break;
case 112:
kc=kc+"{F1}";
break;
case 113:
kc=kc+"{F2}";
break;
case 114:
kc=kc+"{F3}";
break;
case 115:
kc=kc+"{F4}";
break;
case 116:
kc=kc+"{F5}";
break;
case 117:
kc=kc+"{F6}";
break;
case 118:
kc=kc+"{F7}";
break;
case 119:
kc=kc+"{F8}";
break;
case 120:
kc=kc+"{F9}";
break;
case 121:
kc=kc+"{F10}";
break;
case 122:
kc=kc+"{F11}";
break;
case 123:
kc=kc+"{F12}";
break;
case 144:
kc=kc+"{NUMLOCK}";
break;
case 145:
kc=kc+"{SCROLLLOCK}";
break;
case 32:
kc=kc+"%20";
break;
case 186:
kc=kc+"{;}"
break;
case 187:
kc=kc+"{=}"
break;
case 188:
kc=kc+"{,}"
break;
case 189:
kc=kc+"{-}"
break;
case 190:
kc=kc+"{.}"
break;
case 191:
kc=kc+"{/}"
break;
case 219:
kc=kc+"{[}"
break;
case 220:
case 221:
kc=kc+"{]}"
break;
case 222:
kc=kc+"{'}"
break;
default:
kc=kc+"{"+String.fromCharCode(keyCode).toLowerCase()+"}";
break;
if (kc && kc != "") keybuff = keybuff + kc; // otherwise, add a comma before adding your key to the buffer
//else keybuff = keybuff + "," + kc;
//if (kc) send("sendStroke " + kc);
if (e.stopPropagation)
e.stopPropagation();
e.cancelBubble = true;
if (e.preventDefault)
e.preventDefault();
e.returnValue = false;
if(!(typeof keyb == "undefined")){clearTimeout(keyb);} // if there's a timeout set on SendKeys, clear it...
keyb = setTimeout("SendKeys()",keyrate) // set new timeout to 250ms
return false;
function SendKeys()
if (keybuff)
document.getElementById("painting").innerHTML=keybuff; // debug only
send("sendStroke " + keybuff);
keybuff = "";
function send(req)
var xhr = window.XMLHttpRequest ? new XMLHttpRequest() : new ActiveXObject("MSXML2.XMLHTTP.3.0");
xhr.onreadystatechange = function ()
if((xhr.readyState==4) && (xhr.responseText.indexOf("IMGS")>=0))
newImages(xhr.responseText);
xhr.open("GET", req, true);
xhr.send(null);
This function updates new images.
I use the dummy variable 'd' in the source of the image to
prevent browsers from loading from the cache.
function newImages(str)
//alert(len(str));
var newStr = str.split('\n');
// new functionality - use client-side caching for speedup. imagenum is folder, imagechk is filename
// actually imagenum is tied to location, imagechk is tied to the checksum.
if(newStr.length != 1)
for(var i=1; i<newStr.length; i++)
stri = newStr[i];
slashchar = stri.indexOf('/');
imagenum = stri.substr(0,slashchar);
imagechk = stri.substr(slashchar+1, stri.length);
document.getElementById(imagenum).src = imagenum + '/' + imagechk;
function whatsNew()
send("whatsNew");
C:\Users\user\source\repos\AVNC-silent\AVNC-silent\obj\Debug\AVNC-silent.pdb
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
GlobalSign nv-sa1)0'
GlobalSign Code Signing Root R450
200728000000Z
300728000000Z0\1
GlobalSign nv-sa1200
)GlobalSign GCC R45 EV CodeSigning CA 20200
-http://ocsp.globalsign.com/codesigningrootr450F
:http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
0http://crl.globalsign.com/codesigningrootr45.crl0U
&https://www.globalsign.com/repository/0
wF*=#}(s
GlobalSign nv-sa1200
)GlobalSign GCC R45 EV CodeSigning CA 20200
240126092810Z
250126092810Z0
Private Organization1
91440605MACRJLFMXL1
Guangdong1
Foshan1
Guangdong1
Foshan1B0@
9Room 502, No.22, Jiangbu Road, Dali Town, Nanhai District1B0@
9Inoellact EloubantTech Optimization Information Co., Ltd.1B0@
9Inoellact EloubantTech Optimization Information Co., Ltd.0
o^Q%Rv
@http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
3http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
&https://www.globalsign.com/repository/0
6http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
GlobalSign nv-sa1200
)GlobalSign GCC R45 EV CodeSigning CA 2020
20240620113721Z0
GlobalSign nv-sa1301
*Globalsign TSA for CodeSign1 - R6 - 202311
GlobalSign nv-sa110/
(GlobalSign Timestamping CA - SHA384 - G40
231107171340Z
341209171340Z0]1
GlobalSign nv-sa1301
*Globalsign TSA for CodeSign1 - R6 - 2023110
j~`7Is
]6=c4!K
&https://www.globalsign.com/repository/0
-http://ocsp.globalsign.com/ca/gstsacasha384g40C
7http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
0http://crl.globalsign.com/ca/gstsacasha384g4.crl0
qpa2|Fn
TI;!Q=
.@]|Gt0
GlobalSign Root CA - R61
GlobalSign1
GlobalSign0
180620000000Z
341210000000Z0[1
GlobalSign nv-sa110/
(GlobalSign Timestamping CA - SHA384 - G40
a:c|9#ymt
"http://ocsp2.globalsign.com/rootr606
%http://crl.globalsign.com/root-r6.crl0G
&https://www.globalsign.com/repository/0
$KtZ}r
GlobalSign Root CA - R61
GlobalSign1
GlobalSign0
141210000000Z
341210000000Z0L1 0
GlobalSign Root CA - R61
GlobalSign1
GlobalSign0
PmBf/M
'YLv9[
GlobalSign nv-sa110/
(GlobalSign Timestamping CA - SHA384 - G4
GlobalSign nv-sa110/
(GlobalSign Timestamping CA - SHA384 - G4
&;2AB
AVNC_silent.Resources.login.htm
AVNC_silent.Resources.script.js
Resource
not found in assembly.
image{0:000}
A-VNCloginPasswordSalt
<script>{0}</script>
$RRATE
{0}<image src='image{1}' id='image{1}'>
{0:000}
Get /favicon.ico
GET /
Wrong password...
GET /sendClick
GET /sendDrag
GET /sendStroke
GET /whatsNew
GET /AVNC
GET /image
Error, try again
Unknown request...
C:\Users\Public\
login.htm
script.js
HTTP/1.0 200 OK
Content-Type: text/plain
HTTP/1.0 500 ERROR
Content-Type: text/plain
<html>
<head><title>{0}</title><meta http-equiv="imagetoolbar" content="no" /></head>
<body oncontextmenu="return false;"><div style='position: absolute; top: 0; left: 0; width:{1};'>
</div>
</body>
</html>
HTTP/1.0 200 OK
Content-Type: text/html
image/jpeg
image/png
HTTP/1.0 200 OK
Content-Type: {0}
Accept-Ranges: none
Cache-Control: max-age=3600
maxColors
The number of colors should be less than 256
maxColorBits
This should be between 1 and 8
Didn't expect this!
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
AVNC-silent
FileVersion
1.0.0.0
InternalName
AVNC-silent.exe
LegalCopyright
Copyright
2024
LegalTrademarks
OriginalFilename
AVNC-silent.exe
ProductName
AVNC-silent
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
Antivirus Signature
Bkav Clean
Lionic Clean
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh Clean
ALYac Clean
Cylance Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
Alibaba TrojanSpy:MSIL/Bobik.a84428e4
K7GW Clean
Cybereason Clean
huorong Clean
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec Trojan.Gen.MBT
Elastic Clean
ESET-NOD32 Clean
APEX Clean
Avast Win32:DangerousSig [Trj]
Cynet Clean
Kaspersky HEUR:Trojan-Spy.MSIL.Bobik.gen
BitDefender Clean
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Clean
Tencent Clean
TACHYON Clean
Sophos Mal/BadCert-Gen
F-Secure Clean
DrWeb Trojan.Packed2.46718
VIPRE Clean
TrendMicro Clean
McAfeeD ti!0D1E3C8752B0
Trapmine Clean
FireEye Clean
Emsisoft MalCert-S.RR (A)
Ikarus Clean
GData Clean
Jiangmin Clean
Webroot Clean
Varist Clean
Avira Clean
Antiy-AVL Clean
Kingsoft MSIL.Trojan-Spy.Bobik.gen
Gridinsoft Trojan.Win32.CoinMiner.dd!c
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-Spy.MSIL.Bobik.gen
Microsoft Clean
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!2DE7D28D6A79
MAX Clean
VBA32 Clean
Malwarebytes Trojan.FakeSig
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.MalCert!1.F53B (CLASSIC)
Yandex Clean
SentinelOne Clean
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Clean
AVG Win32:DangerousSig [Trj]
DeepInstinct MALICIOUS
CrowdStrike Clean
alibabacloud Clean
No IRMA results available.