Static | ZeroBOX

PE Compile Time

2062-09-20 22:06:00

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x0003fed4 0x00040000 7.0194044435
.rsrc 0x00042000 0x0005b878 0x0005ba00 3.3883060226
.reloc 0x0009e000 0x0000000c 0x00000200 0.101910425663

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00098528 0x00004228 LANG_NEUTRAL SUBLANG_NEUTRAL dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_ICON 0x00098528 0x00004228 LANG_NEUTRAL SUBLANG_NEUTRAL dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_ICON 0x00098528 0x00004228 LANG_NEUTRAL SUBLANG_NEUTRAL dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_ICON 0x00098528 0x00004228 LANG_NEUTRAL SUBLANG_NEUTRAL dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_ICON 0x00098528 0x00004228 LANG_NEUTRAL SUBLANG_NEUTRAL dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_ICON 0x00098528 0x00004228 LANG_NEUTRAL SUBLANG_NEUTRAL dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_GROUP_ICON 0x0009c750 0x0000005a LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x0009c7ac 0x000003a4 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0009cb50 0x00000d21 LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
"9TDto
:nZa]~
iY>v@e
p Zelq~#
yZr6rk
S g43&
f"PS6/{
"xI\B'
rVeWw:
94}B1M
NI2yAf
5@!%nP^
gH?7d
Ng$S'+e
DR$zG#
fG{fk-6
fMS70A
%EjJ$M
]d^8;
ZBEM-r
d9v Lbk
tsA{J,>
)H44^S
P/|bj]
lj3+
-7pzY;
pRS6Sw
lH_KM8
I5jnAQ
ZDZCS5^
qLAOy>f
%aBx}C
[PS{-rtI
r8t&'?
{f)9Jx
C-JT`r
9I@7~7
vF'Gm)
zfA&N+$
0tIe#_
Kp@]oN
/g|i E
C:$Q/b
Ot;PuE"
vmvvsp
'-]7<.
W3pw&z
hUTsX.3
:0roiB
3(voBg
JN);.0-
?S:<x
=T[9t
vBeA:B
H>*Lz
~D4IO;3
hhQYj3
~Z3||v
mP,pdu
E5YTJp
5tFo}.
Obr39_
lA^NYqfH
J[U{yP!
.dpL>)
1\[8Kc'
go4}kjb
]zn3c,
X9'4v<
#%z!(1o
+twwBJ
u:8&^d
6XqaFH|4A
IrD~X|
>zI,H
|`8*Yq
X&_#(t>
yED!gFnRs
~~:4Ca
5K#?e#
Ji>;{B
rywKF-
:Abfq.B
b@^z1E
Kg0_0Z
d&eKUn
tT61U_
%1Pi"Q'
'{nVCKZ%=
>$l"[{
7>cakj
#4>[gB
:W?m!M!
,lJ,3@NM
je}?g0;J
"\/b:!
[4&$.h
vJKLyA
0S<Zf
C)G<XQ
5*PT0#
#Z%K~y
Ao[-NKNY?
I5}F(7Ad
C4Q*9K|
Qv><.j
tT[,#G
n:8/3G
UKab:[
P_6v|"
>:'k0}
HD#<9]
MAxt#NWn
jn -``
JeH)[8*
vCfs<=$h
eAE$Fl
V+<z>q
:oGv3s5f
~>EC)Bp
2% ryW
,zc^.d
h'qRiu
x|4\}y
vVe(Te)]
w[JJz]
(UjLoN
JuX/>9
$ebK,q
>o[x*x8
G!$,Vp
V-AH'b~
w#cP7$
46ZCb;b
v##D<`
<&w{ZI
;#Aw@+y
2Mz+UE
Y&]pZ-
=eT_k=p7
2sGbdQ
?F,>ye
!h"8}Fz"
)hc7d:
%[oL~/o
2LxfD0
-Zs>Hxsn
eRZ7mb
H&^K0r
l?mJz.
s>c'u=
`}.mK
zM_:Gk
nL(-Aa
-\=|?p
P1zUK}
r^&SCk
4"40?'1
VV{L}_
+OO7k37
iMj;)V
4Zev#
W+'"bL
$>J%=&
<x9K0x
K b: Q
\~bvk(
[FSY\2
46U-zl
>>8y)f
-H?n"i
w}nM&]
p{+F+p
.c?$4D
=c(n!VN
ddu<=9
cV[JU]ub
&$UH{u
nmTk|`
f#g4:
=GL~|Ay
R!,cEEh
ieeZ;I
[3Rd ]
mkr@7"F=
<@y@e'
|qTSzA
3LYcqD
XGWdm+
Zj3R{8
sEj!^:
|0jHOR@
=vz*4D
FEZw\7
H6^'C}
ZaJ/|#
}xT-jLB.
9Of+xr
+AB\R[
.+Hf1|
{TANhhK(
$F~XH,$
S"vij3
S/j,:jd<:
:h*v?5
&O+7mv
f_)i,1
@V}\uR
f_)i,1
uf^Z ad)ga+
6Qts+
Z?_b`
["Sf%+
Z Ut+@a8s
MEiIZ
a|EZ _P,
Vs%&8o
?4K6Za8L
Z qj"Wa8$
X W[*Ja%
>G9C%+
Z }0'Fa8
lZ 6<9
%AZ I
Ui~a8d
_bj/
_bY*
{7Z Zp
IDV{Z
%=HDZa8%
cj^^%&8
+Z mJG
+G%K85
a;ea8n
Z_bX
" 8(&
.Z K6K
! ;\:ba%
Y_cX*
Z 9Xi(a+
V`;sZ
O/%&8L
BA=WZ
VW!UZ
9|`a8.
iZ mlj$a8-
mDH?Z
j[Z Y
>Z @YK
YX"u(
99sJ
Tq4iZ
]8+Z P
q;F!
Bt]xZ
YU%&8+
,eZz%+
,eZz%&8
vW=y%+
]JYDZa8U
Z[!\%+
2vevZ 6c
AcB%&88
Z y0\Ya8
S5(Z @
T;zw p9
% 8S,Z(
B%Z h.
W4st(
s9M\Z T
aB)9(
PUZa86
+9 ./A
@P@X(+
& %.a583
* %.a58
qDZ PPg-a8
v2.0.50727
#Strings
ShareFolder.exe
mscorlib
SuppressIldasmAttribute
System.Runtime.CompilerServices
<Module>
Assembly
System.Reflection
.cctor
System
RuntimeTypeHandle
MethodInfo
MethodBase
Thread
System.Threading
ParameterizedThreadStart
ResolveEventArgs
ValueType
Object
Stream
System.IO
H~/@LCuMDT4[eU}/CSC!uo(1
System.Windows.Forms
IContainer
System.ComponentModel
TextBox
EventArgs
Dispose
IDisposable
ComponentResourceManager
Control
c>-ZI#<;421k!Q0F_y@)R*!,
UserControl
ContainerControl
AppDomain
ResolveEventHandler
<>9__0_0
AssemblyName
List`1
System.Collections.Generic
RegistryKey
Microsoft.Win32
Environment
SpecialFolder
WebClient
System.Net
DirectoryInfo
RijndaelManaged
System.Security.Cryptography
SymmetricAlgorithm
PaddingMode
CipherMode
ICryptoTransform
MemoryStream
CryptoStream
CryptoStreamMode
Encoding
System.Text
RegistryHive
ProcessStartInfo
System.Diagnostics
Process
RemoteCertificateValidationCallback
System.Net.Security
FileStream
FileMode
Random
<>9__2_0
X509Certificate
System.Security.Cryptography.X509Certificates
X509Chain
SslPolicyErrors
GetProcAddress
kernel32.dll
GetModuleHandle
GetCurrentProcess
IsWow64Process
StringBuilder
SearchOption
FileSystemInfo
BindingFlags
Binder
WebRequest
HttpWebRequest
DecompressionMethods
WebResponse
StreamReader
TextReader
F9y<5-HjZ53zh;F!dlZGR}I#/
ResourceManager
System.Resources
CultureInfo
System.Globalization
Settings
FS__ERmn6TmUMSbD9MDJ.Properties
ApplicationSettingsBase
System.Configuration
SettingsBase
Default
ConfusedByAttribute
Attribute
ShareFolder
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
DebuggableAttribute
DebuggingModes
AssemblyTitleAttribute
AssemblyDescriptionAttribute
AssemblyConfigurationAttribute
AssemblyCompanyAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyTrademarkAttribute
ComVisibleAttribute
System.Runtime.InteropServices
GuidAttribute
AssemblyFileVersionAttribute
NeutralResourcesLanguageAttribute
CompilerGeneratedAttribute
STAThreadAttribute
ReliabilityContractAttribute
System.Runtime.ConstrainedExecution
Consistency
SecurityCriticalAttribute
System.Security
SecuritySafeCriticalAttribute
TypeLibTypeAttribute
DispIdAttribute
TypeLibFuncAttribute
GeneratedCodeAttribute
System.CodeDom.Compiler
DebuggerNonUserCodeAttribute
EditorBrowsableAttribute
EditorBrowsableState
Newtonsoft.Json
JsonPropertyAttribute
NewtonsoftJson.Json
H~/@LCuMDT4\[eU}/CSC!uo(1.resources
QSpgEKcPKJqVnaVYEYYyvrxXTUQoA
F9y<5-HjZ53zh;F!dlZGR}I#/.resources
c>-ZI#<;421k!Q0F_y@)R\*!\,.resources
FS__ERmn6TmUMSbD9MDJ.Resources.Newtonsoft.Json.dll
String
GetTypeFromHandle
GetMethod
Concat
Invoke
Equals
FailFast
set_IsBackground
get_CurrentThread
Debugger
get_IsAttached
IsLogging
get_IsAlive
ReadByte
get_Length
UInt32
RuntimeHelpers
InitializeArray
RuntimeFieldHandle
Buffer
BlockCopy
GetElementType
CreateInstance
get_UTF8
GetString
Intern
get_CurrentDomain
add_AssemblyResolve
get_FullName
get_Name
op_Equality
set_FormBorderStyle
FormBorderStyle
set_Name
System.Drawing
set_AutoScaleDimensions
set_Size
set_Location
Padding
set_Margin
set_TabIndex
TextBoxBase
set_Multiline
set_Text
set_AutoScaleMode
AutoScaleMode
SystemColors
get_MenuText
set_BackColor
EventHandler
add_TextChanged
ResumeLayout
PerformLayout
get_ActiveCaption
set_ForeColor
get_Controls
ControlCollection
set_ClientSize
SuspendLayout
Contains
GetExecutingAssembly
GetManifestResourceNames
GetManifestResourceStream
Registry
CurrentConfig
IEnumerable`1
ToArray
Exception
Enumerator
GetEnumerator
MoveNext
get_Current
Boolean
CurrentUser
ToUpper
ToString
Substring
CreateSubKey
SetValue
NewGuid
OpenSubKey
GetValue
IsNullOrEmpty
System.Text.RegularExpressions
Replace
GetFolderPath
Combine
WriteAllText
Remove
ToLower
DownloadString
get_Chars
Directory
CreateDirectory
set_Padding
set_Mode
set_KeySize
set_BlockSize
Convert
FromBase64String
CreateEncryptor
get_ASCII
GetBytes
FlushFinalBlock
ToBase64String
CreateDecryptor
OpenRemoteBaseKey
GetSubKeyNames
StartsWith
op_Inequality
get_ExitCode
LocalMachine
Win32Exception
GetTempPath
Exists
Insert
IntPtr
get_Size
set_UseShellExecute
set_Verb
ServicePointManager
set_ServerCertificateValidationCallback
DownloadData
GetEnvironmentVariable
GetDirectories
DateTime
get_Now
get_Ticks
NextDouble
ToInt32
ToChar
Append
InvokeMember
GetTypeFromProgID
Activator
Create
set_AutomaticDecompression
set_Method
set_ContentType
set_ContentLength
GetRequestStream
GetResponse
GetResponseStream
ReadToEnd
TimeSpan
get_UtcNow
Subtract
get_TotalSeconds
get_Assembly
Synchronized
JsonConvert
DeserializeObject
ConfuserEx v1.0.0
WrapNonExceptionThrows
FS__ERmn6TmUMSbD9MDJ
Copyright
2021
$97fbee08-e1b4-4ee5-ae2b-937f707009fd
0.0.0.0
$F935DC23-1CF0-11D0-ADB9-00C04FD58A0B
3System.Resources.Tools.StronglyTypedResourceBuilder
15.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
15.9.0.0
ExecParams
country
partnerName
productName
excutionWidget
buyingChannel
discrepancy
PostBackUrl
userId
prices
salesChannel
active
ipLoggerCode
modeUpdater
modePublisher
paramsProduct
ListProductInstall
UrlTrack
trackPostVar
dailycheck
TrackDecrPrmKey
TrackDecrPrmIv
_CorExeMain
mscoree.dll
UNFEUMG~TLH
UMG~UNFE]FF
TLG^TMG
TLG^MMM
ULHuTLG
ULHu`@@
UMH`SLG
RNE;ULG
SLGeTMG
SLGeTLG
RNE;TMG
TLGaTLG
TLGvTLG
SKF_TLG
TMEFTLG
UNFEUMG~TLG
UMG~TLH
UMG~TLG
UNFETLG
TLGv`@@
SKF_MMM
UMG~TMEF]FF
SLFMXOF
UMGZIII
TLH|TLG
UMFBTLG
ULHQTLG
TKGsTLG
SKF_TLG
TMFITLG
TMHjTLG
UMFxTLG
TMHjTLG
TMFITLG
SKF_TLG
TKGsTLF
ULHQULG
UMFBTLH|ULG
TMHjQKF,
UMH<ULH
TLHyTLG
TKG=TLG
UMH<ULH
UMH<TLG
UKHNTLG
UKHNUMG
TLG^TPL
SKF_SLG
TLG^TOM
TLG^TLG
ULGoTNJ
TMIpSQL
TLG^TKG
TLG^QQC
SLGhTLG
SLGhTLG
SKF_TLG
TLG^TKG
TLG^TLG
SKF_QQC
SJF7TLG
SKHGTLG
SKHGTLG
ULHr`@@
SJF7TLH
ULHQ]FF
UMF!SMH
UKFiTLG
TMHjTLG
UMF!TLG
XPH SMH
XPH TLG
TLHCTLG
TLHCTMG
<?xml version="1.0" encoding="utf-8"?>
<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app" />
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<!-- UAC Manifest Options
If you want to change the Windows User Account Control level replace the
requestedExecutionLevel node with one of the following.
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
Specifying requestedExecutionLevel element will disable file and registry virtualization.
Remove this element if your application requires this virtualization for backwards
compatibility.
-->
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
</requestedPrivileges>
<applicationRequestMinimum>
<defaultAssemblyRequest permissionSetReference="Custom" />
<PermissionSet Unrestricted="true" ID="Custom" SameSite="site" />
</applicationRequestMinimum>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!-- A list of the Windows versions that this application has been tested on
and is designed to work with. Uncomment the appropriate elements
and Windows will automatically select the most compatible environment. -->
<!-- Windows Vista -->
<!--<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" />-->
<!-- Windows 7 -->
<!--<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" />-->
<!-- Windows 8 -->
<!--<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}" />-->
<!-- Windows 8.1 -->
<!--<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}" />-->
<!-- Windows 10 -->
<!--<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" />-->
</application>
</compatibility>
<!-- Indicates that the application is DPI-aware and will not be automatically scaled by Windows at higher
DPIs. Windows Presentation Foundation (WPF) applications are automatically DPI-aware and do not need
to opt in. Windows Forms applications targeting .NET Framework 4.6 that opt into this setting, should
also set the 'EnableWindowsFormsHighDpiAutoResizing' setting to 'true' in their app.config. -->
<!--
<application xmlns="urn:schemas-microsoft-com:asm.v3">
<windowsSettings>
<dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
</windowsSettings>
</application>
<!-- Enable themes for Windows common controls and dialogs (Windows XP and later) -->
<!--
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="*"
publicKeyToken="6595b64144ccf1df"
language="*"
/>
</dependentAssembly>
</dependency>
</assembly>
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
FS__ERmn6TmUMSbD9MDJ
CompanyName
FS__ERmn6TmUMSbD9MDJ
FileDescription
FS__ERmn6TmUMSbD9MDJ
FileVersion
0.0.0.0
InternalName
ShareFolder.exe
LegalCopyright
Copyright
2021
LegalTrademarks
OriginalFilename
ShareFolder.exe
ProductName
FS__ERmn6TmUMSbD9MDJ
ProductVersion
0.0.0.0
Assembly Version
0.0.0.0
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Tedy.10857
FireEye Generic.mg.48b0a9eff9c4934c
CAT-QuickHeal Clean
ALYac Gen:Variant.Tedy.10857
Cylance Unsafe
VIPRE Clean
Sangfor Clean
K7AntiVirus Adware ( 005684bb1 )
BitDefender Gen:Variant.Tedy.10857
K7GW Adware ( 005684bb1 )
Cybereason malicious.031a93
Baidu Clean
Cyren W32/MSIL_CsdiMonetize.A.ge!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Adware.CsdiMonetize.BC
APEX Malicious
Paloalto Clean
ClamAV Clean
Kaspersky not-a-virus:UDS:AdWare.MSIL.Csdi.gen
Alibaba AdWare:MSIL/CsdiMonetize.9d0db5a3
NANO-Antivirus Clean
ViRobot Clean
Tencent Msil.Adware.Csdi.Pezo
Ad-Aware Gen:Variant.Tedy.10857
TACHYON Clean
Sophos Generic PUA IP (PUA)
Comodo Clean
F-Secure Heuristic.HEUR/AGEN.1143836
DrWeb Adware.WizzMonetize.1
Zillya Clean
TrendMicro Trojan.MSIL.BULZ.USMANKC21
McAfee-GW-Edition RDN/Generic PUP.z
CMC Clean
Emsisoft Gen:Variant.Tedy.10857 (B)
SentinelOne Static AI - Malicious PE
GData Gen:Variant.Tedy.10857
Jiangmin Clean
Webroot W32.Adware.Gen
Avira HEUR/AGEN.1143836
Antiy-AVL GrayWare[AdWare]/MSIL.Csdi
Kingsoft Clean
Gridinsoft Ransom.Win32.Sabsik.sa
Arcabit Trojan.Tedy.D2A69
SUPERAntiSpyware Clean
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 99)
AhnLab-V3 Adware/Win.Generic.R448657
Acronis Clean
McAfee RDN/Generic PUP.z
MAX malware (ai score=100)
VBA32 TScope.Trojan.MSIL
Malwarebytes Adware.Csdimonetize
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall Trojan.MSIL.BULZ.USMANKC21
Rising Clean
Yandex PUA.Csdi!29vHQ+uNAqw
Ikarus Clean
MaxSecure Trojan.Malware.300983.susgen
Fortinet Adware/CsdiMonetize
BitDefenderTheta Gen:NN.ZemsilF.34266.Mm0@aGmn46e
AVG Win32:MalwareX-gen [Trj]
Avast Win32:MalwareX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.