Static | ZeroBOX

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00002000	0x00560e64	0x00561000	3.99230024117
.rsrc	0x00564000	0x000005ca	0x00000600	4.12270608786
.reloc	0x00566000	0x0000000c	0x00000200	0.101910425663

Name	Offset	Size	Language	Sub-language	File type
RT_VERSION	0x005640a0	0x00000340	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_MANIFEST	0x005643e0	0x000001ea	LANG_NEUTRAL	SUBLANG_NEUTRAL	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

!This program cannot be run in DOS mode.

`.rsrc

@.reloc

*"((B

r@]+p(

r`~7p(\

r4QEp(\

rpQEp(

@8j/T

r`~7p(\

rpQEp(

_b_,

lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

PADPADP

lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

PADPADP

v4.0.30319

#Strings

<>c__DisplayClass0_0

<>9__1_0

<GetSSL>b__1_0

<>c__DisplayClass1_0

<>c__DisplayClass2_0

<>9__33_0

<Random>b__33_0

<Replace>b__0

<Get>b__0

<ScreenShot>b__0

<GetClipboardText>b__0

<Run>d__0

<ScreenShot>d__0

<>c__DisplayClass0_1

<Get>b__1

<Replace>d__1

<>u__1

Func`1

IEnumerable`1

IOrderedEnumerable`1

Task`1

Action`1

TaskAwaiter`1

List`1

<>7__wrap1

CS$<>8__locals1

ToInt32

<>c__DisplayClass0_2

<client>5__2

<screenshot>5__2

<Get>b__2

<>u__2

Func`2

KeyValuePair`2

Dictionary`2

<graphics>5__3

<client>5__3

<Get>b__3

Build3

GetTickCount64

<ms>5__4

<client>5__5

<GetIP>d__36

get_UTF8

WatchUSB

WM_DEVICECHANGE

DEV_BROADCAST_VOLUME

FormBUF

STRING

Stub.TelegramAPI

DBT_DEVICEARRIVAL

GetSSL

autoRun_COM

System.IO

userIP

StartUP

INTEGER

CF_UNICODETEXT

value__

GetClipboardData

LocalAppData

COMStartupLib

mscorlib

Addbkb

System.Collections.Generic

ReadAsStringAsync

GetStringAsync

DownloadDataTaskAsync

GetAsync

PostAsync

WndProc

<<ScreenShot>b__0>d

GetHardwareId

chatId

Thread

FormBUF_Load

add_Load

GetStringDownload

AwaitUnsafeOnCompleted

get_IsCompleted

dwReserved

dbcv_reserved

Synchronized

<Rnd>k__BackingField

<WorkFile>k__BackingField

<Value>k__BackingField

<WorkPatch>k__BackingField

<FullPathLnk>k__BackingField

<CurrentProcess>k__BackingField

DeleteSourceAndBuild

piShowCmd

GetShowCmd

SetShowCmd

get_Rnd

CloseClipboard

OpenClipboard

EmptyClipboard

clippboard

FileReplace

defaultInstance

WshHide

get_StatusCode

HttpStatusCode

get_IsSuccessStatusCode

set_AutoScaleMode

FileMode

FromImage

HttpResponseMessage

message

GetUserDefaultUILanguage

IsClipboardFormatAvailable

IEnumerable

IDisposable

get_Handle

RuntimeTypeHandle

GetTypeFromHandle

WaitHandle

Rectangle

get_WorkFile

pathToFile

IPersistFile

pszFile

get_UserProfile

IsInRole

WindowsBuiltInRole

Console

get_MainModule

ProcessModule

set_WindowStyle

ProcessWindowStyle

get_Name

set_Name

get_FileName

set_FileName

lpFileName

GetTempFileName

GetFileName

taskName

get_FullName

get_UserName

cchMaxName

pszName

DateTime

GetLastWriteTime

WriteLine

Combine

IAsyncStateMachine

SetStateMachine

stateMachine

ComInterfaceType

ValueType

SecurityProtocolType

dbcv_devicetype

System.Core

PtrToStructure

get_Culture

set_Culture

resourceCulture

Capture

ApplicationSettingsBase

Dispose

Reverse

X509Certificate

ValidateRemoteCertificate

Create

Delegate

EditorBrowsableState

SetApartmentState

<>1__state

sourcefileDelete

STAThreadAttribute

CompilerGeneratedAttribute

GuidAttribute

GeneratedCodeAttribute

DebuggerNonUserCodeAttribute

DebuggableAttribute

EditorBrowsableAttribute

ComVisibleAttribute

AssemblyTitleAttribute

AsyncStateMachineAttribute

InterfaceTypeAttribute

AssemblyTrademarkAttribute

TargetFrameworkAttribute

DebuggerHiddenAttribute

AssemblyFileVersionAttribute

AssemblyConfigurationAttribute

AssemblyDescriptionAttribute

CompilationRelaxationsAttribute

AssemblyProductAttribute

AssemblyCopyrightAttribute

AssemblyCompanyAttribute

RuntimeCompatibilityAttribute

set_UseShellExecute

get_Value

returnValue

TryGetValue

regxvalue

Stub.Help.Native

Resolve

Build3.exe

get_Size

set_ClientSize

dbcv_size

SizeOf

updatedBuf

HasFlag

Config

get_Png

System.Threading

ThenByDescending

OrderByDescending

Encoding

System.Drawing.Imaging

System.Runtime.Versioning

ReverseString

ToString

disposing

System.Drawing

set_ErrorDialog

get_Msg

ForEach

get_WorkPatch

Refresh

ProDataPath

get_ExecutablePath

filePath

SetRelativePath

cchIconPath

pszIconPath

GetTempPath

get_DesktopPath

get_StartupPath

GetFolderPath

GetPath

SetPath

cchMaxPath

MyPath

AssemblyPath

get_Width

get_Length

length

PtrToStringUni

RemoteCertificateValidationCallback

get_ServerCertificateValidationCallback

set_ServerCertificateValidationCallback

TimerCallback

AdminCheck

GlobalLock

GlobalUnlock

get_FullPathLnk

IShellLink

GetDriveLetterFromMask

get_Task

StartScheduledTask

dbcv_unitmask

Marshal

System.Security.Principal

WindowsPrincipal

pszPathRel

System.ComponentModel

Parallel

Install

install

kernel32.dll

user32.dll

set_SecurityProtocol

ContainerControl

loaderFileUrl

apiUrl

FileStream

MemoryStream

get_LParam

get_WParam

Program

get_Item

System

lengthRandom

charsRandom

LastCharFitNum

FirstNum

resourceMan

ToBoolean

TimeSpan

CopyFromScreen

get_PrimaryScreen

botToken

X509Chain

piIcon

GetFileNameWithoutExtension

buildVersion

RegisterDeviceNotification

UnregisterDeviceNotification

Application

get_Location

GetIconLocation

SetIconLocation

AntiEmulation

System.Configuration

System.Globalization

Action

op_Subtraction

System.Reflection

MatchCollection

ManagementObjectCollection

Stub.Protection

SearchOption

SetException

OutOfMemoryException

GetDescription

SetDescription

StringComparison

pattern

FileInfo

CultureInfo

DriveInfo

FileSystemInfo

ProcessStartInfo

DirectoryInfo

Bitmap

get_ip

Stub.Help

System.Net.Http

Stub.Startup

COMStartup

AddToStartup

System.Linq

fileReplacer

Loader

loader

AsyncVoidMethodBuilder

AsyncTaskMethodBuilder

StringBuilder

<>t__builder

SpecialFolder

sender

get_ResourceManager

ServicePointManager

ManagementObjectSearcher

USBWatcher

RemoveZoneIdentifier

EventHandler

System.CodeDom.Compiler

autoRun_Scheduler

ZoneIDCleaner

AddClipboardFormatListener

IContainer

hWndNewOwner

ClipboardHelper

StringHelper

ToUpper

TaskAwaiter

GetAwaiter

StreamWriter

TextWriter

NotificationFilter

get_DocDir

GetSysDir

sysDir

pszDir

intIgnor

IEnumerator

GetEnumerator

IsUserAdministrator

.cctor

Monitor

IntPtr

Graphics

System.Diagnostics

FromMilliseconds

dwMilliseconds

get_Bounds

NativeMethods

System.Runtime.InteropServices

System.Runtime.CompilerServices

System.Resources

Stub.FormBUF.resources

Stub.Properties.Resources.resources

DebuggingModes

Matches

directories

Stub.Properties

GetFiles

CopyFiles

Stub.Help.Modules

ShortcutWindowStyles

System.Runtime.InteropServices.ComTypes

GetProcesses

addresses

System.Security.Cryptography.X509Certificates

get_Attributes

set_Attributes

GetFileAttributes

SetFileAttributes

dwFileAttributes

GetAttributes

SetAttributes

AddMinutes

get_TotalMinutes

AddBytes

ReadAllBytes

WriteAllBytes

NextBytes

GetDrives

fFlags

Settings

EventArgs

pszArgs

<>4__this

System.Threading.Tasks

Equals

System.Windows.Forms

Contains

set_AutoScaleDimensions

System.Text.RegularExpressions

tgNotifications

System.Collections

searchFilesPatterns

get_Chars

SslPolicyErrors

errors

get_TotalHours

get_Success

get_CurrentProcess

GetCurrentProcess

originalAddress

set_Arguments

CreateTaskArguments

GetArguments

SetArguments

arguments

components

DoEvents

Exists

WshMinimizedFocus

WshMaximizedFocus

WshNormalFocus

WshMinimizedNoFocus

WshNormalNoFocus

Concat

Repeat

TaskCreat

ImageFormat

uFormat

format

ManagementBaseObject

ManagementObject

Select

System.Net

api_get

GetBestWallet

get_Height

get_Default

FirstOrDefault

ParallelLoopResult

GetResult

SetResult

WebClient

HttpClient

hRecipient

System.Management

Environment

SendDocument

InitializeComponent

get_Current

GetCurrent

get_Content

MultipartFormDataContent

StringContent

HttpContent

ByteArrayContent

ScreenShot

descript

ThreadStart

Convert

GetIDList

SetIDList

SuspendLayout

ResumeLayout

set_RedirectStandardOutput

MoveNext

System.Text

set_Text

GetClipboardText

ReadAllText

WriteAllText

ContainsText

GetText

SetText

get_Now

set_CreateNoWindow

CloseMutEx

CreateMutEx

ToArray

ToCharArray

get_Key

GetHotkey

SetHotkey

pwHotkey

get_Assembly

GetExecutingAssembly

CreateDirectory

GetWorkingDirectory

SetWorkingDirectory

op_Equality

op_Inequality

System.Net.Security

WindowsIdentity

IsNullOrEmpty

WrapNonExceptionThrows

2024

$57E49C7E-C361-4A7F-8890-D665B3B9CB4F

1.0.0.0

.NETFramework,Version=v4.5

FrameworkDisplayName

.NET Framework 4.5

Stub.Install+<Run>d__0

3System.Resources.Tools.StronglyTypedResourceBuilder

17.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

17.11.0.0

.Stub.TelegramAPI.SendDocument+<ScreenShot>d__0

FStub.TelegramAPI.SendDocument+<>c__DisplayClass0_0+<<ScreenShot>b__0>d

$000214F9-0000-0000-C000-000000000046

$00021401-0000-0000-C000-000000000046

#Stub.Help.FileReplace+<Replace>d__1

#Stub.Help.StringHelper+<GetIP>d__36

-Stub.Help.Modules.GetStringDownload+<Run>d__0

"Stub.Help.Modules.Loader+<Run>d__0

_CorExeMain

mscoree.dll

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

</requestedPrivileges>

</security>

</trustInfo>

</assembly>

))))+)Q

#"$"%"'&)(+*

750000

*.txt,*.sql,*.py,*.js,*.php,*.db,*.log,*.logs,*.ch,*.html,*.cs,*.c,*.cpp,*.xml,*.bat,*.cmd

https://pastebin.com/raw/WYRpG349

6588481952

Visual_Studio

RuntimeBrokers.exe

4iiZ3Vc8R7LsSPLJ

b\}43,52{]9-1Z-PN-JH-Az-mk-a[]3[b\

b\}43,52{]9-1Z-PN-JH-Az-mk-a[]1[b\

b\}14,53{]9-0Z-PN-JH-Az-a[]1cb[b\

bc1qdwka99wwlmnw3d04av4w4xjegt2650hu5jphqq|bc1qywgpeqqrrfc8r4mkjqa95tsqqj5p8llaqxf5xn|bc1qvha6y28cdfqwznpnk9nh7tynzf8x6asn97u302|bc1qqr3c9j3cy6vm6y69sqwnw8h8xc6gsxa7vdnuhf|bc1q29c6dggmjzw75hzpfyaye2fm423fu2jgl2wuah|bc1qdlk7yn49xhkwr8np7j9vxe6wutntn8vruvzthr|bc1qtlwmt5a950m3kllcxtqks58tceanx572uuk82d|bc1qa52n345hgqf9e5t45wq6t23cl5k7tgqx9fs036|bc1qqaqs0jcylwplrw2t4jxkrahkfz2x6qshn4u0ma|bc1q8tamhytxldwm8l3wpdkxzsl65lgp03v3vn0s0u|bc1qfq2uz0qscdmunw8y7p0k64shax7wmwstsju0jy|bc1qgju29yfmj2mjnmv6hdswmenwftfnx63zhfzwqs|bc1qlgp8nnl030k53m5pjfu3shq7626s0722mncz4w|bc1qka3xatwe50fsrn6ezh0rz3ecdkcyxf6hmzuvzt|bc1q8ckmqc2n4q05qcqt92v4rvsazxqk7pgpn75kr8|bc1qf3alkmupffchsujf9utzp7yqnamx9k6ra9dvuu|bc1qjgrgt7f0cace96hjtf24f6t4p3yxf4egvl9kxj|bc1q8gejdqmpfc4ul3av9nvs2rlfdyhwj4t38rlgat|bc1q3djj6drur2m0cj5j0cggu4ul2e5y4wru02l3ds|bc1q6z2ws7j9uvjf27jgtpgyaxxk53y30jve24474q|bc1qyzj54dwlvffw47gkpzqn2hw47sk6wcc0ncn2ry|bc1q8at047zumq9j37rstfpc7g5d02xf7hdhngrppg|bc1q3gp7x7rtuxwuucf6d9rhahehyh9m0mq6zsum4s|bc1q2dpzjgt4zef3mejff7wvys249csez83

b\}04{]9-0F-Af-a[x0b\

0x2E8F611f91cedC0f4Ac6ABC0979A331ADe90AaB4|0x591C2c96AF528Faed1717266159A43d8fb0edDc2|0xD1dD1de65df23515eB711b132426Db3D18220E37|0xd0eE6710dd42081252dec41ffcE3974b48181733|0x1F9357007fA67a1743D4B8CFac95bC45c2Ad9b7e|0x22e10e6C6ef533e04A4A0f53e024e3692B7b9e75|0x91a0F7E6d2594Bfc4AfA1Cce94992C5D51d3a9CF|0xABE7dB850129ddFf18dcbF675Eb93A2fE38B2e8a|0x6637Ef5AbCee99109356BBBb7Da4B7CEFB053C79|0x1FaA2d63482944095528e7c0CC05743C176878Cf|0xBB5634C0c44Fa892fF0a38e91d4530c845aaE305|0x9b5Ae540bDd5F15E964612Ab442447475B7b31cb|0xddF47A2EdB540b8514A3efeA7A78E154b253825a|0xC97C5c1AD4E5516e9C5b272909465D845c77a044|0x46456899D890C4f42582c0ecE8fa173BfaBB4cC6|0x7D99d8B99724FC29fF69a68cF280522dDC36130c|0x57d80205C951B57Dbc2a37DFa6919f86d82c4791|0xb9F1B66e624b09c02b48E9AD3ecE9794de6Efd5c|0x64e86D7A3116E2c0cFE31eBa7CeA73cEA7cb8f34|0xb6aeF748ab70986BB5b8285597b1f56143eD4028|0x88e5f2944CE2c0B51E164AB1BF1d88D7c35257F0|0xc9C6087A3c0Ea1aD81D1A90940A1259F621Dd198|0x1d5845e5014733fDC31C1Bb23013da81608D6010|0x883fdae87ac347Ee3C1241ee12982fd3D

b\}39{]z-mk-aZ-PN-JH-A9-1[]BA9-0[]4[b\

49yDebXjUyjZE18mHwatsb4eeTAtvMhQhQXMgPQq6mweYNLe8uWHzE74hSu6oaNgtofntPTDWFVHz4z2Ss7p3GuAPBEyH7R

b\}39{]z-mk-aZ-PN-JH-A9-1[]BA9-0[]8[b\

b\}55{]Z-Az-a9-0[Gb\

GAWG6EA6D2WEV3O2JTK7YXUTVK2IAWZXBH3KRRFE5QOZOYCZQTOU42P6|GB2IUWHALII4HABHGAVKF4XXCMIHUG6KLUDK5HZTF7BKSNIXJNLUGLXG|GAP4IEQ4V7D6T6LYM5KQKLDKQ53JSUFCCAZCKBYOOO4XFWHJLMNWSYIW|GAMUEMKXP3WTI7GXYGBPRCQGRFW55EG7DOA3SIS2PLWYBQXYNL3HNPOE|GBO27Q5ZPKB6NHEXJEQQRGKD45S7PFKJHNXPERTJO5PIS6J7QRAJY4RU|GD7IXBJNBLA5N2JWBLDX3UWSIGKRV2K6XWMA6UWYAQEHRJEUQIA5GZY6|GCDUSMNSZM7OHKE6D7FWKHKCLZD34TNGDW6DREGIONDGWZ3CIZARKPDS|GALZD4K2VRHCW7GHQN36GESDATM66QAWD2WJIB73HH5DWPBMTBERQC7H|GBLUISAA4247GCO5WV3HUKK7IU36GDAQ4RJWZANSHY2ZACQMQUNCO2YO|GBFMLDLCI4QBSNXE6B3ZLHV2PHZRDBAMNMZTNC3OFGYNXG6N577RZAZ7|GCJUVVB4T6PG7PT32T7XZXCCBWT3XPAIFVKM3ZNDDXRLEHMKEOSAAWDZ|GCXGLBXCAD5NFOADOAN2ISR3PG4JUFEUSOZ2P4DS34JIMJJFSQW2KGF7|GAGVDHRS4BQENQ5HM4ZKYUNJTSZCJTY2PCVF45OEDFKFHIJ63PUWN5OL|GAE56KEO5PJZO54ZVQCOJMQ52GVWX67CW3N2UXBERNLNSTCNVA72MCMY|GDXRDJV52LX72ABPH5VVSUJCXS3ECLQKA2XFUKUPC4KNGIOZMSWLQIXB|GC2LSDAJN43GWKGB24Q5KAYNFKXTQYA43DXCJKPSHKHOKPXMQ44UG2LB|GCX7KL5PTH4MVXFYUGK2QQ372BXR6UM6YYZ5LWCI7HGYWQ54KQWIRVKV|GAIK3RO7G26FBJWCL3XYUCKGZ27XWZJXVPZS7NWA5CLXP6REO5DDKHS

b\}43,42{]Z-Az-a9-0[rb\

b\}33,62{]9-1Z-PN-JH-Az-mk-a[Lb\

b\}33,62{]9-1Z-PN-JH-Az-mk-a[Mb\

b\}68,6{]9-0z-a[q1ctlb\

ltc1q6uywa7k2hfx6c80ew66dqsdly5r25ngg05qle6|ltc1q6ppxc6jxahes252dda6nq6levm8zvz3sc0kyvn|ltc1qk6yjk25p2fywguspwzdya62y8angm4x5fm2zjc|ltc1qn096t33m9usfvz6cfe4c9q4qh0mhn059lrqtj4|ltc1qcc34ldcg93nvfcv68x8d57du9a6zm9s3a4vvq6|ltc1qxrq66zjm0ukm0l4rstzvasac0h8lcftep6hc9m|ltc1qhk6qrqr2hcasg0qgua7wvm40e2f4c4t7znelh9|ltc1qxmn2fl6v0440yxywn4xj4afgw9gfu7ryfranc5|ltc1q022nwm7lzqnudrcws2yspwh6mev7e76f4jkg7l|ltc1qndnc3m8av2fc0rm48twycfwwl5yl4ekhyt4p5z|ltc1qpwz07yhp9uh6k6fd8d8f3mhkyp4yv72fwlma5t|ltc1qnvfyjqjcc6zw8e9py7qcqxjvsrecj660t6l0t4|ltc1qfxac56vjpz09x6y93678tk2v3q486z3mksq48p|ltc1qqkmdt2jyy8g6me230s8scx4ygwyj9l8m0u7vn6|ltc1q8jpptgtueuneww70u02dfcmwd46rhgx7zr55js|ltc1qhg7ypgyqwuum69e54jw86tddmvphaaegynp2rv|ltc1qwrdrzljllz8lcek2j24x0mez07ndpp49ueneg8|ltc1qjqs7ezl357dqhh4gtsddygmnz3g9hsna3aup0n|ltc1qkzyslfjsy6upyn0skvx8s98yh7w0027uq4qa38|ltc1qusvyzr8pa8uqsgmsgx4ewqxfufl88s07t3f57k|ltc1qv2rsqrk4uqv3r8cpureadxa0y6yaa7g4dm75z8|ltc1q2azddw6k8s4vgse3yqgyw8zy68dfqh03l6ufy4|ltc1q4k9aq96l0mg4wcsmpu2w9z2hpas3eld5yd7j3e|ltc1qgwyqafn

b\}33{]Z-Az-a9-0[]NA[b\

ANK3YeLTMDEMuKK9vvzD3HVQtLzQzijF95

b\}14{]9-0z-a[)p|q(?):hsacnioctib(b\

bitcoincash:qqusg5fgp6vxal0nyngkdrp3632uwr9xcgy7gu4jud|bitcoincash:qrrezw8drk5snznzhs9wgfkcdu3tpddzeqkfehzkv8|bitcoincash:qz8nnc2rngmr6kwenr4c8ux920j0wkhgd5kl5ml4hc|bitcoincash:qphlhl8zzlqsd8eqt6qaxnz4qag890dz8sz0thymml|bitcoincash:qq487mfjpul7vt9d3uks7zc2u62dpkd9jym23767w4|bitcoincash:qrjhc5ydcecxa03xxg50x9uh8hr69rurxucfj86e7n|bitcoincash:qqc4e3e32ejwwg67r6953q6lx9lvu990yyzuvy35dt|bitcoincash:qpqsgjen6rlgd3hy64zt3xrer7z9gmpdngjafyxt77|bitcoincash:qr620kd3rjreucvvk7xeyyahutvqm7eldgnvd48hqz|bitcoincash:qz4fs77chm59slgmdnxjfene5kuhzj4njgf88a6plp|bitcoincash:qpttgzlg72pmwuz3v5pcn8ms5qwc7nsvkqhpdx58vm|bitcoincash:qzxfxp98386jt4am6d3wxllhah8kqa8d4utvp3cln3|bitcoincash:qz8prhpg2n5j3u89csavj222n33u2sd5d53htnc3gx|bitcoincash:qpv5jv2ss6fktzsqc7rj9gdym2drnq7e8vj6rpflsa|bitcoincash:qqzcy4a37nqnt7ud8r9fd5306mjlsjg7mquuj8cez4|bitcoincash:qz6e09fp0xkt05hnmswgszwnekwz66hkqvssk5qy5y|bitcoincash:qqa862p6xycyv9kq7rt9xs5u077csjvqug0zr0zy5l|bitcoincash:qrfjamsppnw3x07vdwy6ey0ap9wfkwr2nsg9c848tj|bitcoincash:qpxmaczge8hdvw3tg25vqy

b\}33{]z-mk-aZ-PN-JH-A9-1[Xb\

b\}33{]9-1Z-PN-JH-Az-mk-a[Db\

b\}33,82{]9-0Z-Az-a[Tb\

b\}33{]z-A9-0[1tb\

b\}93{]9-0z-a[bnbb\

bnb1dwle4z49exm0nfm3ee725zd7f8wsd9ymaye5n8

b\}84,64{]-_9-0z-aZ-A[)QE|QU(b\

UQCiWrUSVzvBm2PKRETJEh2WPCv27yxqMO4dvM4LKwoJlgs0

b\}44{]z-mk-aZ-PN-JH-A9-1[b\

B6Jq8fLg7ZN7jcPF9npBsSHu66gAKbm1Dysgoe91HcwH

b\}74{]z-mk-aZ-PN-JH-A9-1[1b\

14hmKiWQE7CtD8nLgfk43yt8HXU6jbENigjqFA99qMHgJNJu

b\}83{]9-0z-a[1xava-Xb\

<code>

</code>

Detected:

<code>

</code>

Successfully Replaced:

<code>

</code>

FormBUF

%@%e%c%h%o% %o%f%f%

%t%i%m%e%o%u%t% %6% %>% %N%U%L%

" /f /q

Online

<code>

Stub.Properties.Resources

c%h%a%t%_%i%d%

p%a%r%s%e%_%m%o%d%e%

%c%a%p%t%i%o%n%

document

%S%c%r%%e%e%n%.%p%%n%g%

%t%o%b%/%g%r%o%.%m%a%r%g%e%l%e%t%.%i%p%a%/%/%:%s%p%t%t%h

/sendDocument

/create /tn

/tr "

" /st

/du 23:59 /sc daily /ri 1 /f

schtasks.exe

abcdefghijklmnopqrstuvwxyz

0123456789

https://ipinfo.io/ip

https://api.ipify.org/

SELECT ProcessorId FROM Win32_Processor

SELECT Signature FROM Win32_DiskDrive

ProcessorId

Signature

HWID - NA

b\}39{]z-mk-aZ-PN-JH-A9-1[]BA9-0[]84[b\

b\}33,62{]9-1Z-PN-JH-Az-mk-a[]ML[b\

b\$}33{]9-1Z-PN-JH-Az-mk-a[Db\

b\}84{]_-9-0Z-Az-a[b\

b\}33,1{]9-1z-mk-aZ-PN-JH-A[b\

VS_VERSION_INFO

StringFileInfo

000004B0

Comments

CompanyName

FileDescription

RuntimeBrokers

FileVersion

1.0.0.0

InternalName

RuntimeBroker.exe

LegalCopyright

2024

LegalTrademarks

OriginalFilename

RuntimeBroker.exe

ProductName

RuntimeBroker

ProductVersion

1.0.0.0

Assembly Version

1.0.0.0

VarFileInfo

Translation

Antivirus	Signature
Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
ClamAV	Clean
CMC	Clean
CAT-QuickHeal	Clean
Skyhigh	Clean
ALYac	IL:Trojan.MSILZilla.140723
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
Alibaba	Clean
K7GW	Trojan ( 004d94d21 )
K7AntiVirus	Trojan ( 004d94d21 )
huorong	Clean
Baidu	Clean
VirIT	Clean
Paloalto	Clean
Symantec	ML.Attribute.HighConfidence
tehtris	Clean
ESET-NOD32	a variant of MSIL/ClipBanker.AJD
APEX	Malicious
Avast	MalwareX-gen [Trj]
Cynet	Clean
Kaspersky	Clean
BitDefender	IL:Trojan.MSILZilla.140723
NANO-Antivirus	Clean
ViRobot	Clean
MicroWorld-eScan	IL:Trojan.MSILZilla.140723
Tencent	Msil.Trojan-Spy.Bobik.Htgl
Sophos	Mal/Generic-S
F-Secure	Clean
DrWeb	Clean
Zillya	Clean
TrendMicro	Clean
McAfeeD	Real Protect-LS!6FEE6BF0DEC8
Trapmine	Clean
CTX	exe.trojan.msilzilla
Emsisoft	IL:Trojan.MSILZilla.140723 (B)
Ikarus	Clean
FireEye	Generic.mg.6fee6bf0dec81ae4
Jiangmin	Clean
Webroot	Clean
Varist	Clean
Avira	Clean
Fortinet	MSIL/ClipBanker.U!tr
Antiy-AVL	Clean
Kingsoft	Clean
Gridinsoft	Clean
Xcitium	Clean
Arcabit	IL:Trojan.MSILZilla.D225B3
SUPERAntiSpyware	Clean
ZoneAlarm	Clean
Microsoft	Program:Win32/Wacapew.C!ml
Google	Clean
AhnLab-V3	Trojan/Win.Generic.C5654148
Acronis	Clean
McAfee	Clean
TACHYON	Clean
VBA32	Downloader.MSIL.Pabin.Heur
Malwarebytes	Clean
Panda	Clean
Zoner	Clean
TrendMicro-HouseCall	Clean
Rising	Spyware.Bobik!8.108FF (CLOUD)
Yandex	Clean
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
GData	IL:Trojan.MSILZilla.140723
AVG	MalwareX-gen [Trj]
DeepInstinct	MALICIOUS
alibabacloud	Trojan:MSIL/ClipBanker_AGen.U

Static Analysis

PE Compile Time

PE Imphash

Sections

Resources

Imports