MalScore
100/100
MalFamily
Malicious

nnewnewcryp.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 47/66 Related 1997
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 662.00 KB (677888 bytes)
Compile time: 2018-01-12 18:15:20
MD5: 0fa8735f4e8ba0015856f25327668279
SHA1: e98b8416018acfbe786e0970f18b4f71f80b929f
SHA256: aae1581c1bd6da477735d05e529eb9bc9809b96c7cd1bc0c8ed8fe39bbe5302e
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 $P`<: .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-07 01:30:03
Last submission: 2018-02-07 01:30:03
Filename detected: - nnewnewcryp.exe (1)
URL file hosting
hXXp://gg.usdipc.com/nnewnewcryp.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-03 07:43:44 [47/66] VirusTotal
PE Sections 4 suspicious
Name VAddress VSize Size MD5 SHA1
$P`<: 0x2000 0x2478 9728 b66fe2929670b8a0c3b39640aa45653f 3031e8c3e3de0bacc6d851e30995ce864bd89517
.text 0x6000 0xa22c8 664576 6760f2bdd29838ca2ab3b4812f1881c7 ebfd66cf37c229b622c4de26c392e5b2f6d80943
.rsrc 0xaa000 0x4e0 1536 be95535d4d79ed33bdbdb23deaf69cd5 c1b8e6d31255eb8f11ac80c06b5c543a9f9638dd
.reloc 0xac000 0xc 512 773d83fe984a1c886b5182abf6b77b44 237d663af90f37757c80137f45d0c707c3bda1cc
0xae000 0x10 512 0cb41b2076cdec3fdfadce68ae437834 a161dc1960126f04cc2c7b86996c6b9c6d57270f
PE Resources
Name Offset Size Language Sublanguage Data
RT_VERSION 0xaa0a0 596 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0xaa2f4 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright:
Assembly Version: 0.0.0.0
InternalName: nnewnewcryp.exe
FileVersion: 0.0.0.0
FileDescription:
Translation: 0x0000 0x04b0
OriginalFilename: nnewnewcryp.exe
ProductVersion: 0.0.0.0
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
mscoree.dll
KERNEL32.dll
IP Found
No IP detected
URL(s)
No URL found
LegalCopyright
Assembly Version
InternalName
9FcAF
FileVersion
VS_VERSION_INFO
VarFileInfo
FileDescription
000004b0
nnewnewcryp.exe
ProductVersion
StringFileInfo
Translation
0.0.0.0
OriginalFilename
NyN N
gO2S
klY't
2/#gw
`lFw
}dWW
Int32
=1}O
)-A "
ETuC
3|+3
('#L"
;y$
y)F{
ub*Q
lq=]p
BfVn
zshp
Z t8%
Hh'[m
)I|,
BI%8
6)|H
L9= [6
UnverifiableCodeAttribute
b/ KA
+J.?P
?)wQ|
M[ \r
SpV
}Bf_
o,e$
u-P%
Ca0e
"RQX
wA B.]
9B&n
.! ]
tiFqi
j`U*
v+;a
TD>O
}Nz:
ATK!
,WW^
N{x,G7
f%u]t
DVsd
LlhM
_1RC\
rgk1
}Fz]
# 7c
H?9eb
,x7|
z$&A
T)Jv
:p{V
~G-
ofS @
re}\
N!N6N
*\xc
mZXV
4QF$
M07^"/
4_^2h
`&aiPK
{R%fz
"+nC
JA`m
}i
WnW/
4r4?f
0^J
Z2|
mls%
ye[-
wdQ!e
; Um&
#OJF
2M/ cea4
&GyJ
B,)E!u
G.y
V7zg>
)-1
7CVr
_PzI
W QU
Ah4|
^ Fs
\71a
cV-:
PxnU
D=dZoF
)nM{{
9Hc]v{
wpJ D
T&mg
Dh v
agqz
/r|J
NHN{N9NbNpN{NVN
rHqMw
N&NRNcN/N9NXN^NNNiN
J?&Q
f/-s3
~n
0VjH
w)B
/o;<
D}^:=Au!
W=3olw
_x<W<S
n:6M
a>9o)
=8:m8
"]9CoDU
%0
k#Dm
XZ:r
Pr#8
\6o|NXh
^-}W
.lNONaN
~w@*8
?_Ul{
9yusO
2cNLNaN<NmN+N
R5"n
E?$6
>kun
wboj3
X;ZHy
r%fx
b9TY
@q\.
5,z#
3?A4
thYJ\
eVCq G
aW(D
-%Fy
O,w{
f'.S
ZBqqI
tOq{
s+vL
>o<
$ x
Ty&
%CK_~G
k9Ey
t`[o"
MY/>
9F x
66-}
BF O
k/Pkj]
(H= M
()+>H
JuDW
3Qr$
b\cF
A>*|
NsNqN
57}b@81X
|H)&=y
NU3xG,
g1l
;j@sz
;Y\88
duWzF
sEnq +Z
*Qo,
C?m
_5-#
_3,o
5f-l
yo64
C%@oM
SGEMp
6UQ0
hX h
qL v
"wK_
o7$b
j`v?
(H]U+@!
^vg&
xx,
yArUD
"o`S9C
Q%DTJ
mA#
lV*q
!3A5
r UDY
'1,u^
N*N"N&N
Ek4d
LOI7
ex+=
%#4;-
Or=n
$I"3
/]Y+
]Q.Yx
J:YM
ty2/q
H(bO
a,#EV
qnfW
%"h
,Jv
`u)/
4 G
x## h
!Y~`
W=#[
lx Lv
HRUZj~O
IYUw
/E3G
.Pw?
f(V^
|ga 2jO
da Y[
! =2c
BdI7|
<u
vgWU
' W'vc
Z0 o
OCVar
evd
4ZWL
0*)_|o*
iv sa
~&8:
vm2X
s|rS
ge&&
get_FullyQualifiedName
}'Tk
:X1u
!!>y
'J$" N
oWH5
mB{=
Q/mUT
=j_2
p*4x
K>p#m
(~bR
gX2_L
E xm
P237
FY3}
Zw]u
C2M$
>&t>GvwSS
(w,h
.text
W4 dr=
[=A]Zg
lbYh
7#zW
cuI>
2C; ,\
pt(
qjj0
{MKhB
%}o"
*eS|
j+`[
4!;$
CdF@
+=w
$*y
>:uD
;R ?
d~(|
NIN\NgNSN&N
MgQC|,Q
SYtFG
bU I
sjd
_9DWmp
7j#n
/ o
NPNvNe
Gl,X
y1TU:M
nMb]^u
C M0
'y"@
>]'%+
NfNeN
vH&^
u]^l
C;/_
P8<3=
m_|s
Z4$6
_Sd]
5uer3
oq0u
$2m;`
tj=]
UxIY
tf 8{k
)/iv
6gn5
1sd[
@nIY
43^$
+L b
3XL
%0e
Cf1
Yj;tIY
GUI~@
Rnfb
Vx!?^
GYz
b<a9
5Kv-
7Qp8
#Schema
A!c6
D chZ
7KzY
<x<a
jF"J
Hk2mS
9!][
hW~{?PL
bOHA
j]&T4
w@W
5qg
U;nS
'us!oy
9PA%
jo&O
P*|d
xk=IM
*(NdN.NHN-N
set_IsBackground
H2mq
$b uc=J
#z ,1
&FP%Z
K$m3
QsNVM0'
,"xKc.\
}dI"
y2Y
QqY`
f y1R#|
0,%t
sAu7
id^eI
Jm%d
1a`?
%"-7e
Lk^A
rwQ|X
8xS
|#JL
SNB/-
Zg?b
V ?n\c
2B J
_~]w
:^O,
4u3d
N!N0N
qpN[[# `
&91w
$z,SIeB
c]mQ
d8 r
dl*l
O_+d
1XqJ
1:wB
$1${
c*M"
ZHFt6
lt$u
DI^7&
"J`):
GHB
%VMD
PIV7r\&
qiM$
4)s
+ldo
BQV3
G8Vlev
z?Vy
=s=C
A`L2
cf2pY
-v|W
(-igu
_a/4
iJ4U
hNA
&)S6
E1U%
T3c:E
f$8T
%f9#
a{4<
x;w!
Q 6)QA4I
- &C
1bn#.
+7e
~Kih2{s
vYeZ
\lr)
_'\aE
qk'sZ/
]M,H
3X
y;sc
h\>]
ZuNM
[QJP
q 35
$?+;
+X$
Hm)N
'090}
M f
SE/(u2
YFZh
mO*=L=
v(v6.T
^W=%%
wt8J
eZ<_%b
-iLd
9N/ 7R=15
w,F+
\5jC.(}o
eD
YPZs
v>F>P
`VVx
20l=
Oi==4T
\nhz
Sc/W
@fx$
hx<#6
-@iG
+[wo
H9o!
6ER2
B) 4c
*nR5
Yo)VB
System
&3Z_
^7y$`J7
1;5y
{?N]
c;Rs
C0f%
bEf,{E
\ Bw
^&Z~
U w4
iss)K
W!j??
P]s]8
Jc `}
DBtKs
/Dp
i
Qzg=
;@9
H1 )n
i{.H
\o%2z
v<y:
N%" m
Pv*tJ
MethodBase
I<Qj
NoNXNTNsN
fru3
e}@a
<`Ld
{*;~.$
eico
l Az
(1_2
c}&1
s1X3
D[m
Ub}h
/qmu,
aUI\
\+~K
`2H_
:&Ak
FOh
VeBH
sZ=
.a9VQ
./j Hw
D^$$"_;&8A3
0" 2
R=*Q u
?T~5
r!hB
:b #C
oq $
J-RrF`
gAi!
d8$w
5 Un{"
*b$r^
::{%Jt.
fffzl
;}<i^
| et
hp8go
{k3s
M:H[
-5)J%
rhQ$Qz
+Z9t
+DSG
|y}D
\RU@
K=aN
6(j@(i
xHq2
2Ex*
?fpV
_:09
mr?N<
+2"A
Fj-~
/"dI
bl~Y
)I4
;yJDGr
N N3NZNQNkN
uQxb
|X D}
(ljR
TH9s
nPb$
, P7
<g/ /
@te6Y [,
MGn
@fcy~
2Auj
X9.66~
@4Yj(?
f"bvw
*7LF9
'@>P
8r@:
SrJ~
N=NjNDNaN:NKN/NRN
Gj8I
*IC!
+;?;
`*C*6F
5 @
Nwig
{"m"
W*e
zf mREh
-dCdL_
? )^
Ts16
F>0@x
p~9q
gX69
_>\j
) )e1d
lW Bn
geUV
NuN.N?N}NQN?NWN
eXSP
E_`p
zui/Z
DvmB
[4tF
Qz\ _
sRZb
O@OS
%tbF
[|?XJ
Nd|f
F LOo
<Pky
@4.=
>|T
(KJUv
__sg
k P!
6SH++
7 chb
x=QRD
NFNHN N2N N!NzN&NqN$NJN
#Be
kx|g
r?UvX
kM"O+d[
g>Mn
>NC.A
)JzL
b;S|
w4LO
; =#
LO=J
BjX+
~:|
hF?J
>@ X&
);ZC
7I|n\
} 1di
xi2G
_':
_uJ:O
o]bk
&|%
`u 4
4.,
rBTF
khsa
flW#
v" &
Zs{-1p
a<uu
ib4g
ZXB:I
^<T
5|60
HPtxeUHJuQdml79
Xh_rs.
1 o(
2{+7
Fy:^4
/2w>/
8PnT
#>{;
8mi}
4R3+G
UR"39N
/$|`b-
g30jjm@
z3;
UH|VJ
tsY@(
e _ j
A6o$E
3S.<_
w|f#
F|D
`d}l
8#E
Ra68
O&%!
o!A`
j0,OqI
U =um
rux
LN+M
G#0BX
YY@b
(hSh
&%DEuoA
ypMY
m N"
8}1k
y*1@
|]}J
NCNpNoN<N
!6OMKp
O"wTh
fmRMl
>^K[
MvxO}
/zu*
dU*kK
jxwb*tI
u.+V
W1C
n<
; "8P
*Dw
eTF"
np6WOQ
3MBG;
WsHp
VLJ*
_Xcx
4L"ga!U
aiRL%
NlNLNrNBNQN;N
s{ug
lQ&rEl
.3Ray
r Lp
NLNuN%NVN
c>n=)
3hNh
8:R+
V,M7u{
)P-t7u
VTe]
vVI.
#j/%Y
ul `
if{]
g&H3
,amU6C
BP
F.\
mX W
Xr9s
PXThy
i%u3
y,S\Q
=\)y
hIC3
=l??^A
@$Ft
3dEB
Ky/Gk"j
l:5
h!6&
EP]\
|%&"
{t/*CK
Udrq
v)D
_a)r
r6<!x
)dcwM^
fn=V
@Vi/
s -r
;Lc#u
SYT*
c`_p
]M*Q
3PM:
jGe>z`Q
;j1$
6)J = B
j5"r3
2qV!
r^1<]
F~>Q+
@y;b
(zy"
KW5[
*Z*vH
Q*yq
+Q<O!
O8J|
fWHv
>]mb
v()?}V
m dw
x@W ~
` K"
8~a=jbZ
iDq
@z&%!D
t4"n$
YELt
`_iRA
'|g?
85fp3\!
M/Jd'V
(kmb
.vUw
'Nt{<
Xojq
3t%K
{.m>
S(}C
EuQ=+u
]J,&3
^|<[
<n :
ACKif
4>-Z
M[He4
MoAg6AVh0oQCwV5pcG
N%NXNjNfN|NxNHNpN NfNYN
h#0/A:dS
hUGH
BNnU5{
\5 6)
.t{xK+
opee
0kv
e=yu
+J "
9)5S{
!p6H
ryE-s
SlI%;
(3J
:J!
'CBW
NnNjN(NANMN;N@N>N
N N[N(NmN
NzLK
-e@J
. .4
#pEb
"QL
mtbe
[:zm
"(.d
3\Iu
\w= 3
0/dc
NJNyN@NMN
]SsBV<[d
,TAP8
LU[d
]SOr
OaFl2
jG(N
JHx.
]7yY
JBB'l
=O?
bQ q
@} <
8L\V
h B>X
B{\Y
?CQ!
Invoke
ojr{
k H>z
00jR
_+n?
Oz9L
.bxkQ
TC?Y
{6~`c
>v)d
p42+9E<
Rr+7O
$ C9o
9xnJ"N{'
C.<$~h?
XUD
zXk('
(9]z
rH{K
g\}"
AS@/
Array
_V=l
*^mI
0#x'
]N$M
Dd'_
1jW9
vuc;
BDUd
YrPl
zUHu
!h fC
wyo
=Z66
8Lo/
{h8gZ
QD:(
H~V@
|nMf
K3U@
{ff<'
= TT
JCm^
yEsU
}sF
6f:&
$|V%6
Fko}160
* N
x'jzA
D(0GN/
<3b7
_qnm
MPm.
Ud aJN
d qg
kMRD
<.!m
R, 4
Y>fkT
AqAk
WwaM
t-qL
B29
-~(y@F
!i B
/R,?\4
8,D'
]]c%N
^wnl~
ZexP
7kf1<
*\aY
NRN$N
mYnR
jJdcf
P@v8
c8> 9
vwg[
}.4c
xFs1
P+Ov
yf+g'
ujl1
}QdA
w Y2P
O(bv
BH|s.
zSXv'=
`1oWp
\Sg/SP
Ez/Q
sF'"
g;=
OXhj
Y7 v
NT53
zT,cO
s/W Q
[`[/c2
'e['_
b^c
+0R]b
HXkz
3qt ?
B0l,
O|6'8
_,~O\
6"]p<
`/XV
hbtz
RuntimeCompatibilityAttribute
>T?
9y%n
*# 0
Yi.3Uc
Wmx q
;PyS5<
6( Z
]c}Q7
F|p@
N|N(N5NpN
Bq)f2
JCl,!
XYCl
JGFQ^
$n#ZE
m_pP
ConfuserEx v1.0.0
<,bO
?Kie
H3(~
mFkv
$1xss
I^ D
Kn{T
VfUikA` 2
UYjV
YO.9
@Bqpf
`pHN
{V7eD
1M+|
kH`
yP(>7
8+H22U
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
'T 7
XIH%
{dbW
c'
GZk%)
i&fuo
kjv=U
ON0V
(OOI~
v R8l
Owss]W
lJ.Fo@]
3<](_N
JPE!
=1gr
jj+k
<]4SR
vaI 4
(Aj|
W@vY
1%4V
vv'U
EJds
+&F[E
"O4zI
)tMo
DB$'.
Pzm?:
$F&X
]S$)
+M;O
c^;F
~9A+F
*Ur<
cG5d $
cs\
E; |d5
.J&9
(wQ
d\4=yj
'P$ |
m]jQ
i$Dt
|%|U
ml_)!
PQ%h
=^E~
2TR>
;vU &
Y#l
s/Tm
/rgF
c)t3E
L;Pr
C@$e`"H
6;Zr&3
_>1#
O}m N
Qn\H
.Thc
N*Ma#
:,4 }
A;4l
#Rbx
)4O%
Dz1F1
GhEZo
bY.^`
@a +
P{qj
0c](
bf+`
OFjc
eSyny
iD2@
.0UX
&o^q
c1d0
d nG8
(Bvz
urtr#t
6(e5
D^mT
U9hb
eXzr&L
RrRq
~f0?
?F?[r=
=JMN
d!-*
J0x0
$|5:
<sO&
jFsb~Xo
4a)n
xV6Q-
wkI>}W
GJXq
4S~z
R|bK1
:7xTv
^ d=
"H$"
AZ7XrMWeTMOYe
zExZ0
i+~G
+d7 ET
.o )7
8V|$U
n0.7
xgXb{W
y;wk
"S2x
n~RK
h#:E
,@X3
hvJi
8[e?Bl
W9x4
x'0vz
P'nZ
v}d E
NeNJN
&=l,
NrYX
Gqu|
C T9
wCsJ/ytEC
]aW#
]3lx
,tiZ
jZ5O
-K.{
a"u.
Uq:
]FqN
N\NnNcN
N_B@
l6h4y
NJN?NCN
f %1
<5Nzu
?AKJ/E=
Bn9~
rv'j
8O2"?
|ATI7
J-1wk
( ?x
?9zq4
( c{
i.7G0oR {
N"NEN
+,!S
Read
*r|%
`2_?)+G1T
k&IA
R@b4k
[{06%
ZP#q
w?T Mv
b/_0
[.GS
< })>
(m(z
Xlgty
`dwT
~Bm`
NQN NMN
5T=B
4ry
.8M
Bht[
ccT;
`l!l
.DP
&w`=
uwO<x
pL`d
&]:WR
A}!se
kkC4D
@tB`x
lOt$c1
see%[
XaK
2<>_)
IO<w
|"TLY
lB-'T
$G8={
mA_)R
Q/.(
07;j
)8 8zz
UO6y
_<e8+
Xc"x
,7Ds
fn=is
aH\
&8Tt
(p]z
+# 7
5:O w
5;%*
Q;Y'Al0
Guig
:L!(
u|I
\>/2
kC".
+1Ne
]d&*
"zz}4
- ~
GetProperties
w>5v
T,~
C,vi
?k,N"
N|NMN
NSNQN
lWn
RuntimeTypeHandle
;4HY[
_2Vi
CES^Y>
s|Lg
^@cM
[Py%6
) ]p
;Dw
'-2C"
3_!{
W|QD
aje""
YTq S
/H;+
B/?;
Ubyw
)]2x
%" E
B\k*
j] ,
p.v!
d28Op
XJQ5
V_So{
pArX
S~]kj{
,s3I8
l|r
U]%d
C-w'
yCII
#f)4
3Eae
G~`X
0kWt
4@vCx@
2k<
r</U"@
V `n]
$W {
90.^#
e,W(
Je<v
s >gu
b !B<W
_hFQ
SpdW|%
g P
? "1
$C54-
SbV-
O7|t\
?D4O
Kp[*>
uCOo1
uI%AH
5C0'dZ
_</f s
/kqs]<m
3rI=
95@
=#g6
j U
n&~[
?cLo
1H$p
mA5`U
UwVc*
DaYFf
iv>u
=B'P
&;uLT
%P.;
f< ?
3 ~ot
FF)]1
NV[-6
@\;%K
a&d_
|Z&[
aNsE
0G?
Bt&1
L'kB
qZ~m`
NcNWN[NYN
+mD.
!This program cannot be run in DOS mode. $
N1N NmN
- ?F@
[t7A
nzel
otqu
\6WU
,',g
a"X^
Uj\a
a3)@
xol|
+E5{
n/9&
Px:d
p5k9
L "xr
MO1]#
Cl=;
Hz O
+Q@*
dYAR
Bk>':XS
2Vj)
}z$F3
C>WN
Cb"p
`9>:
FA hX
g[a
\E= O
qv!E"
GBGs
a5}K
q.jdj
)"Qq
phFV,
es&l>H
DlDUh9T
3<&^
o;.jg
_;[v
{}4e
ss}j@/
K nR
q}^-
p<QzS
:^u1
( ~B
7],a%
!-NU]
@Sd|<
BA#6@
Xf k
C2.f
${I!
kXKAB
~g/j
j#C2
}d2.c
>rN/N
x#xsU
8 '+
++xu
MpN1
r\@BZ
QT=X[
') 3
NVN`N
5}7Q
NvNCN#NvN
=o@nN{G
\f b
<i_H 4 {
COeH
F[oa
$F\a
Wgim
Mm'&
wA/^
NwN NcN
|GQVH
49"K
Xu.%
X E,F(
t\/@ 3
}'2P1
3r;S
AK{
?79N
&84B0
)J97\
,ZTX
zeAG!v
{,$
dT z
ZI|$
YI P
gj^jtw
|9fa
aES$>
^#G
-0a) Z
e\ O
N*N`N]NAN1NhN\N]NZN NwNZNSN>N{NNN)NANvNZN
(>=}
g'*`D7
BlockCopy
x#6
J - C3
W9z"
3:GL
_M_ja
By.)
KvQV
CHU3 WV
0bN>y
2y4K
L 0el
JoPT4
Gt+{
motn
)y]V
Q` Z
^_!2
RnmFL
B"]S
O$"h
B1gd
qbf>h
6as> b~
dGR
K;|A
fb{1
dH4t/M
%|{a
?Vhfn1
2 *u
NrNNN
~^3 |
V*q6
I&#
DPM
eO{c
k :{"
P#!&7
qU8WB
/NvUWJ
j'O5
K:!PE
B!Wc
_ #.0
&-SH'
TbBF
fqGb
wl2*
pv-O
MethodInfo
}#@m
1a'Pl
g<:Ann
sK O
dfE~q,&
ep"Xet
CompilationRelaxationsAttribute
fP`g
z;|?
,RS
CBWX
7Uo{
MemoryStream
JIDf
*DT
O [
$B.:
dq _'v$
T$RU
t7L@
t_
Del
9EKm
w'eUqb
P$r K
%hNUf
N7#0
(3[y
jVp+
>bFO
tX6?
o)pQ
zMA>
{j~_
P02`!
GSL z8z
b+b;
x!SH
`/qq
ba`8
1@$v
j!{ve
0.b-4
|:Qv
be(d
Y7s7c
,7F]
(|{Ml?
jl$4
CI;}
NoNYN-N NpN N
AXZ)
lYc
{H5lt
uV&5NK
cT6Q
:eo4
C 5g(`@l
4H;y
)aL+
'9$h
I9Rh
RwWvs
$'X`V
aAx-
f,ja
>W]cu
mmN-
eN7Ls+}C
N,yy|YT
iJwB
RFB'
D m!x@
6ydX
t9\yl
vn>F
T.dc4

N[B/
[Y,>Tm/
MtAC
|+|ti"
"=>(
;9Yq7
tPHe
(SV'
>{(b
p;d3;
'II^
+b?h
~wr!/
>N|R
$ _:
DcZbL
Concat
A:kG
94Ot
5Ico
\ 8'
fIFH`n
{:e0
9`!~k
I N)
3zsV
[4is
0rJ
1!z
JqwN
C7v4!P
Zu<p
Ywf
-QkS|
2,dbE[@I
bGU,
sR%
7'N
Hb8J`oB
!5[6g
P `EHv
T7X`a
dW6q
|\i0-
HeHT'zV1
HLPx
=t:x\
wkq.
`|J!
!-*F
Fkk*F[V
System.Text
!1i-3$
KW^
s6v
f#b.
Y<!T
<~:R
rg)4
\i#eNP?
\IJs
*"Y@
=<Q1
Q0,/,
HO0
=V
a!C9
tQV
}bxh
E--Z
%\L:
uh#=
)2Vg
SEdte:
x&P!
&q}9]py
D.>]
oh|+
2vuWm#
h} T
J *GgI
chN!p
]]6U
U':x
#G9&o
M*o>Z
I~/k
c\)U
jIW[
XDSKt
5^}xS9
34pw s
f&Ej
H]hft
UqOb
5U`4
1}eB
P8g5
T0dU
d"P2
k;n/Q
&]`tHX&
EXD&
eage!
a~3-e
Mm1Ir
r `LU
oV7@$
t!z5vw_$
r>$W
)/'
GEg`Q"B
I\{}q
6{-.
UfL~
%[Fk
;$6{
ec|&
_CorExeMain
hCS
5X>6
CB~ z[
brm0v
$=U
I~t- O
u-FK
x00o
}8`'
y0bV%pw
-]2.7
Il^{
OqS^
Z2gl
L8tq
46#
@hP!$P
P%Dk
9Vj p
[L>Vf
Pq>A7O2
CXd)
B50S
K X#lz:
pU/U
DRM
kDN}
d+W
`rfa=
aH&}
bjy[l
8Z*lB
3;'V
m @
Xl39
%0r+
:k`*
$fK=
Jq$
kO)*
:iNy
oFd{v
i# y)
H~71
}Yq*
cZ O
[,B\
N;[t
XkQ'v
~)/wU
}BS`S
SDl(c c
xh)09
Kmk7
Qw$\
}lx>v
sS;OIW
J{&1W
hq
U2n$\,^
h;W
$-U.y
_NT9
NHDMqbR9NFMwFqzAl
H /R
ah)\
NsN>N-NbN
%hg
|,axT
&k6k
z CMy
`<in
(c/vz
N5NrN
ShK8
sBjuD7dNqGDx
]#5L
xuY[
$`6^,Pt
x8A%Z
0i=f
3^e^
rG !
:YBGA
jco`W
~Q*
3d :n
mjFQ+
_ tL
LMwE
SO'9N
}{1U
?\k3
cn&f
N%o]h
BoW>
:\VO!
fs d
z']z(x
%5?N
(84
b!IJ
$Q,18
AKU|
ho&h?)p
<>-~
1=
f 7K(
@MEE
QY!i77
:'WK=
qdg{
MFpy9
sX3Zd
oNq-
Y?Mw@JH
~ze;1
GkjjA
vt$D+
f73*M
)CED
2d/z
sBg~
98:"^
/'>_
NVNdNSN5NHN
6BQW-
62: 0x
.Rgl
h\Cb
6~Uj
EqOVc
@K,K1
}B R&
Jl$g
5u}5
X '
N*jk
c7.f
boz
w>76L
~,pZ
uQH~D
."'
)N{>
#j=/E
FA^.
^D6
2nUD
NJN;N N NXNZN
A$j!Ei
%y;=9
o@t /^W
{X0D
e?Yp
^,sj7BMW
;J)_
mId{
^TXE
A: :L
*Iqg
< {X
PP5]
B4I~
(h4r]X
, YS
Y[/vu
w_Zk
P#M&
2Ts!
~o:p
V3df
6h&d
{[+r
K@}sn3
E >5;
l;5
/t?+:(
XQDNd S6alb
Q;4
_5Lv
g4,Bst<
:)=hM
oe %
%avo
l6m@0K
gj>i
]va6c
HY, c-
L v
C6|
9,p
kwg'l
"!a
z$|q&y
0by=
|`yQ
&79?I
L;sS
ZDca?
R&vJ
#Lq:F
A3ES
uKj,
~x1
ii, T\
: *8
k"~
DU%Q;F
(AFuvY
h|TL
f)N3N
* J
7N \
y v'
J )R
PM^2
<n(x
Aapk
U TiY
N5NoN-N
Hl$4
+Cp
k]":
?,/M
l|!A
P=_O
A:<e
:n@+
N>NIN$N
3_BC
G ld
%5ND
'KqZ2
BW-_M
cl\tJ
fGW
;{/uu t.
Q(a
1)+S
IZ[(
'pRh>+/I
%QR'
hN^:N
eOZO
!M`WP
e6Kt
e:3
+'5+
K(UQ
r%HK
N+N-NRN3"
Hy >I
0?4@
I8Sx
(JO[
dr,q
D$.Q
tkA ~
30cc
N C7
|!ZC
X\v5
@}p[ja
1%W`
()b
;z}4d
S:K^O
t2iowj
c%M^
{k;nZ
=I l
b;tVA
SW W
'W`
W(@:+
&Ir+
.zut>
NkNvNwNRN[N!
hSvU
wU-J
Aak\
*o[m:
amjH
p+b2
??Wo
EaY`
$E
1]xT
Mcimk
A./c}
Kf 6
(*`r
"mO7;rr
`@!)xn
2@&U
4&6r
N12M
8L=4
p aM
Qd lo
'EIy*
'xPj
+\fE
F B@
R:a<J
)2^2
/F]n
s6Z|}[
?%99^
>Y.2
T8=nu\;
M>\7
4!J L
BBmvh
Gl:
*Uxl
_2qu
RXIZ-rA
D@lP
(H%V
LS!X
f<U(
~JdK
E"W
3vty
Yf-T
tEyI
Bl`SA
!NYU<s
YQ_P
NUN3N/N%N&N/N5N^NSN
3&2X
3%Uqr9
Y1T}5
< cj
St[4
w+=
c[,f
ZuyXH
.l9*
F=FTI
K+qk`
:J8b
y5k
>dLY
dd*:"
t,Y2
;H:Y
N!NjN+N-NGN'NFNuN
_]Y<
gul7#\
j(a5,
S[ .D{
$p5,(
*AgaBi
b0k;
T?{W
c! e
}[e(
Rowi
kJ&K
K b
;Wk,
~o_x
!3t]\
TIPE
R2 Wf}I<
F"Nl
+8D|K=
7+]X
'uCv
.| ,
1vMP$
nd A
L"W_}
E)\B
T6HMNQXvTWV5oZ
Mz7i
N]NKN~N
GZ^y
q0e"1
H K0
dNYP
6dbz
-*8,B
$4[A
tY'5
>x]|
.~=w
cpPG
b}r1V
]#J[
$^ 37I
UT{K
i\r3HTK
G 2o
P( j
f%S/
r%R
U1B
O[=n
4z[G
PX\"`
r%C
',(h
<Ki>
c}`X
{$Zb
N)N~N
qT-`
]beK
o/qQ
Ey;,
Q3~)
j;9:
Fwhq
8DKzR
>;"
b43,
6WpB@
*LoZ
S)a@
V=~`k
I(vI
D7!65%
eua
"nZJ
}q \
LX?o
&jPA
fR)P
q'H`
agIu"p
k#Z@c'
h VD
Ja}H}
XZuh
G 8w
iMR`
<&+&
]AEg
7VN:
]F{
{qGl
^9U0
+y^%
hz q
v"]_
7c7
J8}
qScqX
FF`!T"W
L^1C
^_=s
jgo
INzJm
+tQG
S`pt
]o:]
}Kz_
}%Aj2 %q
g7y&!
7VNy
"Zjb
?eG ^P
&NP*
c !jzG
9!!>
AbH L
LBgh
O8}
Wc2X
O3 Y8
ek9*hTP|4
?; v
lJz[
Ghle
VK6aqy
&/`zZ+
qqYud
V/&'
\ $n
w~ot
.fb
j?%`
\IS_
w. d
w(k"N
LC Q
]Ndj
}\0h
O8
Oje3
Aj$r&
a(jTu
mxQ#
*V;p
4cR t)?z
N)NDN-NHNfNMN
69wXYp
^T%h
`B/W
' 3b
8'L*
5U{z
NW_n
MG+:C
<G"d
;5ZI
e5pc
Gg!|Q
WNAE
D{lN\
cHC
,1(s)
f<%Z
%K}
'Tg>
e0#wnj
GJuE
]~<k
#GUID
;(\G
C7}`y}
LQ&<w
[C~![.
89~1
dekVC
`1>Q2
B0,8
Wu.g
]_`7
b\`T
G%JdEi
$b#?
fJ[<
TK}$
"%D4Fq
ohLG
5q "
kv}v
l:B(
:<F
-xq8^
=$>@
51r?
%I!
k&nQ
Fw %#
NbN6NjN
i=cl w
:d|z
1bTz
qfj7
WP)X%
X|wt
HCT;*
oEO=
@b]Zy
C+*^
z7J;?G '
mscorlib
eO\w
|DFV
!*=
~xI*
u2jL
uo3#P"1DcL
XZV9
VA}8
WTP x=
|], F
+0J<
pieY
#vOQ
N-NQNWNqN]NIN&N
#.Ngf
9YdGr
D~cG9_
b,Ka
aJY;
Z0A/
a8Ni
8Z H
5-w#
N#N!N N`NyNkNtNqNwNWNQN:NENiN0N?NfN{N N
7<\0
B[G
HsLr@
bW'$
xdR[
E', [
RtWu
4DE`
Q&wT
]. w
e>Z o
YD=%
A2"E
ny=~
[n zx6
nar
PpD3
Ar[s.
)uX-W
BCH?
/<h3s
au(i
Lx]*
C SCO
E3
FYh!
je|<
A{nPE
?F 9
)*=e
8'S0
\ J5x
N3N$N4N1N6N%N:N
Qf12
[x7{
p_U4t
PLA&I
xJ9p
DF@]
O g|
\System.String[], mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089PA
kL YT`
6!NgNiNlNRN0N
y^*@!
8<}
15U!
I p0L"
Mk$y:
2|nM
_f5
j?Z<i
re3g
iBo +
J%h)
2$9!
(f?+$
Mp q
=\ jU
V\Fk
e,P ?
[LS%:x
hW\H
XbJ<*
d!e
HP`f
\-Km\y
W8WD;
{ohO|`
.)\bZ
3G<c.
;:6c-
gwsmxeMzqt
w:d0
Vk4a"/v
8/?( g;/,&
!i$M
<|sDM)
y:?K
u K#
0&{y
c~u<p[
Lw6j
r!/
&7WK
Yt!Z
B0 N
,@O#\]y
Y lJ8lF8^
p"a n.
6Z z
mcuA x
'I}:
3X7(?
mB/5
~?Jc
N$NtNiNYN
Jp(~!
=TDu
1edT>
VeFt:
]P";#
jPn
wd)z
2#j_
&!k8j
giicZ?
/<4#
<^#[u
M n`
,pWs
HZzg
gU<
&72iDB
?],g
NlNENON
qh0c
J ObT
7\~Q
NpNENON
NJN|NENpN8NkN
*L0E
U3
3 KWQ
@GxDz
4vE
3_}4
?%.I
PzxuW
CvdS
NHCe
@ Y?
BUy2lp=-W
N N8N@N N^N
M$7}5
w&,
q3ORr
@ttP
!M;y
;8HYV
'b39"
<KXvw
d.7(
$5QH
cS5
vne?)
k o#
<K<^
s[x%
tB%#E
A,Xe
;w4S
y+*\
P( a
d 7j
8._Q
yW~4
O}?E q
bSaF
*-3&
9{|^
BA0,
3OGm*
;-Yn
3eF9
c,3`
B\p*d
y@tM
Marshal
x/1l[
R`iIy
9f^
a{{:
T0EM
k?&ny
Z6oc
6m~Ln
0^_q
Hl)F
8q~Z
{ %3
K,61
a`-/
glh`
TlBB
:@MN
[ 1ki
=MF
1P[SC
l{W$.G5$
.<Q0
ozf#
lqAbp
Z7 W
H=0? 3
@HR)iQ
+%.4
#m KX
$(,'m
Mn6}
'h==(9$l@Gf
p/fZvG
M (3IZZ
uy e
@Xi}
4eS8@M
A%F> &P:
gO)
7Bq zV
|b/h
CNBe
n T,
]CN<
eD
4to8
;r!A
F=.S
P@C=
iu<G
SBW1
2Y m
<|Es"
&1<wp
]jr=A
]~,c(!a4| eD
NzNDN
>Qo 5W
~UZ(
O+S,
p1gq
%b|z
W(l0
)! z
'}_%
T^D}
u!QNi
">gJ
zp2t'
fI.8
$A^){v79
.6$>c
Fq z
> <^
<i%Npu
F^NR
!oI<Dp
,R#&
<.D
0Kbm`
stra
VNbm
kh:?P 1
SqWm
>wsfL
JGwJw[:&e
<e`6
R?]7>:
zR!k
F?SKr
_M '
^+,.
s:'7
8u59
rJdt5
G5@bRWX
D;_u
:s2K
wsi
3dk
F*w ^
D3b^
T&}vGl
_'Z"
>48
uZP{7
33/ )
;g*z
eA8 0M
--
r|?4
? -uS
g0jgN
w2Q,
;>/
.9q*
YN"9+u-@%
+qy
`wB&]
NZNbN|N
1pt8
\+@qz
~K }
)*&*7DW
Dw:;
U8Zb
gq _
;rj %
R>sV
E/p.
Type
$N;N
ttz$
]&_G
ob-.F
ZSwO
1wNO
|XZ
Iyt
,`g[R
*WzKf
kC*}
]ag5
,Aoe
yk> @/
Qdq\
YHt4
eZ=o
3]dm
#V(H(+u
^Y '*
'l%(C
~{WY
R~WL
U_iw
` \`
?| 7
@,%cw
{$I})/ _
y9nt
RHm8
5G% 7G
EY@B
Dva*
8f=G
WlIX
nu-
]*Vt
)hC~
e[ !
!dc~
|5o`
s`yP
E;+B
qPN7
N"NANkNmN N4N
O_8e
(S7Y^P<
XR:,
]'*_
L9L *
6uO9
nz8<
'(xM
iX+E
_ze3F
3SHJc;
AzJ)
r3(A
bd `Oz
c@\%
* z2
pd!:D
ktpq1_uV
AID"
by?a|
DV+ C!
01Lf
NNNmNjN NZN
dvdx
6i73
U}P1
;1cU
Yw+m(
^KUH
ymn1
x&*G
5iAd
(@a}E
,IB{
jlVs
`(1!
*&3
p99(l
GetString
2<|Uumx8Y\
TLfH
Y~r?\
UF@o|
/8!ec
9v0&6
re6nWK
DaA`
Kzq.
! L M
Q;Ux
Nb~j
xk]e
o"wH
xfNM
S7J(z
7062
SkipVerification
c\hz"
GM9%
#L%.
2+R&g)r[`
V-Zw
29S)
z5.9
LDX.
2 u&
HckD
W9:~
##Pw
U R~
y? '^
#v7zh
H&s}
3&.[
NRZ|
lTm
1>SI
`whw
,o ]
l!T0?
4 ih
dXcG
\1c"
,S<~
i/T:
H&N7bm
df)-
Z4CM
[7Hg
SNVL
c6K5C
v= c
6Q#|
76"ns;
gVO=0
r]qQ
WB%2E
=Nh%
g\Vj
K|6
`.rsrc
6DaR
ji1(
o15/
/y*_
NZ%'
/0<Adk
; ='I
JBq-
&\7d
sm,X
uikJ
s4az
Q&X$
^.>u
a MK
iO a
Qb3$
U8y!
Na b
gUxW
b0og
GD=
U#wpi
?+1vUQp20
7?vu%
Ku.I
)[^B
bH z
.5'H
uwfZ
.*:?w
.MZ~p
E MJ
Na4v
@]NsNGN
N:B3
H)E_
"dU{+
6pd%$vW
<62n
c ~`
6kX
G2V
-(*L,W
N\NkN
Vjw8
W.0Z/Sr
[NCJk
T`T_
e^]MT
Ns'+y
aj?aG
a5aK 1
K*s
N~0
LV?b?o
jv6.
t5D<
o x7
DF62
(
HN9f
f[<v
jn!]
x)3YO]/K$\
P 15
F lw&*
_Stk
1ZDa
dmt}t
R&=$
-8dH
0 (z0c
aXtD
-~V)
`tv-
I&pK
Vn8o
Cy"u
SJ+_[l
`L]$
s@XX;
322m
HwnQ\
/sFI
M[PS
>E;(
k;:~
V*i?
$"Kn
&Xm u\0
lr$[
Cm$.10
By{F
!=?7
v_ys
9O`cq
q>K
3s%2
| bR
2"&F
Ut~7
jhL1&
B^Q]
+(Uy
<H1s
g=?
v"a]
1&F4
`jPR
bgH^=
Vaz6:yu
)1(O
0`S_
NVN|N NTN4N%N5N
gfR?g
^5 ^
sS|MX
hRd
<u9uJ
p^`f
$CM
8],{=r
M(;X!
k3:-
Xq<OQD
L7IUVPTw
y*AA"
|c j
BV&n6
P #Yh
=PhG
i46(
V 2r
>(rrw\w
).:H
D/i@
.+p6Jc@
4k R
kW!{
$z
7gmay
lC$<Q R
NcN#N
+<bY
nk:4
PiNl
n2y?-
i]|<.
sx5E.
rLN}
W1QSSP
e7ZolJmbN2wBkW35EEm
#<&M
yDh(n<
^B3k G
ow%+
VAjZLvS
m& 5|
yH$
?cYZ
g3gpQ
D.%V
{+l;Z}
R(bs
0hb
TIo6
g8eIK
JtL-Q
NbN"N
gxVlU
P 4>
Ah!?
d/\G
=Pm6YP
&=rLL;
vGyD
?HL>
dhT
To:ybY
: ?T
o4#
WmTIs
X"~W
QBG6
`a}"
#Strings
1Ih
_I$~4%
n98>
{l9X[
KSUHZLdKXzF7HBq
MI (
ZHmV4
_SQD
B`UC
SqI
~D{{
%*@
k^z$t
!/"t0
jg!n"X0
aG~9
^M!$
Pd_c
{NMS\
]N0g
Zz}Fy
: /q'
X!%XDE
H)0QM
j#f.Y
@tN{N
qCv8
N 6
-XT.
>JLc
'so6
A8'U@ahh
Ojv%
r8eIB
~~r2
v=kk
^6Gtc
sVcZ9k
r++K
E, p
.d{
Q Z&O{
GetType
!)AJs
l-c;
^l>j
n"n{
}??@
)oFy
o-t?
aKqGX
Upyr
]A'(
ZCud
>#q`5
''@}
Sb@i
QVX~
|k~M
w0w:
HZeA
XaO6
zX+e
$Mu;T
DE(^
t8Gk|
cRTc
6WYS
<S:J=
$}`.
l\EWC
o'C*
6]OBc
& E;
>\HP
EHdz
}I :
B .<N
HL9N<
SJW"ib+
ovp j
+c GT
kf 2
5MX\
N N4NRN NyN
,}(:
) L
>"MR
eh4x
\T.n
fV{c
SH&i PW
2;s)
%rOW*
z*Pg
C6YP
NXN3N
j,pi
y}:l
]C dW
v Za
]a--
h!9_c?-D;
y3;Z
7TGp
XUe[
U'2!
!.Qk
?*~'
N:N0N
]p h
1B6o
+.43
%;S~|
SkkTh
5 Hr
7[?D_T
JilR7
iB)2
,2NeN
P{H<*H
hdO !e
IZABGQ
y=X#
mgL8
NbpF
_q:;
'DiV
~?5h
6*b
\>]<
VO3$
)"e94_
HHT
`bf'4
mG
$"Piu
THLE
s2^mT>$
q6D=
NWNPN>N5N2N1NxN]N<N/N8N N]N
%HT F
d*WB
h&8i
gMa
F Md
/K\<V
?&B(
9(k(`
vtQ"
(" n
S[^0k
9.Dt
l '
Ru&.A
%@TX(S]
l(N-'
6jzg
A-]%,
vew2K8Z
?3F
E @f
plZ
^4(M
{G/=
/{[
AS^.X
=p5 S
CQBs
%r 7D
f^Ca
[ 2].
0/"g
z.Li
Q4jN
@6L6
N NUNpN
N"N NsN
-R
>Yv :K~3
ZA9
z3:_
+3i&
z /.
X$de);y
IT Y
SVCfK
hJPf
@6w*H
7!%
(g=K>
7ck.
lL-x x
M{}y
Y]zn
w-p6
NBN=N N:NGNHN*N
po5R
ID1N
TVdX
:+v{
[g\i
C#8JU
&QXLA
| kW
\MMy
:4F?
YW )
<0}5Q
mpEt
ValueType
9h]
G.k|
3;x)
'I(
@> )
TXDX$
[1QT
f g:<|O
E~~
JQ Ng4
g &/
%w`bX
}.ch
|)*J
{GaL R
(n j
r!uUv
02_r
A65X
|R3d
kp;n"
.pP>n
>T#X
w~k: 8
i^ML
X+PX
K)3E
w A"
gT(W+
'49/
#?r9
>"?5
uK]*H
cqr0
M 0=
Vo*]V
EBv
B_yJN
j$2u(
(QV'
dXUz
a%P$
H7'P
9]fGO
c2IR!$
_gk<
?n;{
{?2`A
#U+k,
Ql@+\{
UC^m2`
x}.;
4B(X
ToString
:PJN
8S-
W^IS
&,:
KL"B
9G[*
nzV+,&#\
k6f6
R_!6
9- s
yPW7
ts3z
v1{6{
FePvlW
IBSV
2Um3
pK8im
NKeEqs
57B@
8|Cv
fwj@d
jy1n#[
>.Gys

;EqH#J
PpDe
#%}{
KjN?
LeNY=cx tE
h*kA\Fh
u3 T
N?NANvNfNGNnN
mvMk
PcXg
?99Y
#7Peq
z #
1bO+D
V%QS'n:U
'/ S
$@_#0
ttFq#B.
Izcl
vi(S4
F~!2
NQNLNTw
-h=T
AZ5|
eEL9K
F/z W
"IS1
T/MxR7
PmcI
&-g8
9"(I
W~pk
nI@D
b l5nA
),XN
N/N`NpN!N
`3"c5
@Qq(
s#oZ
'S;n
P=rS&Zqt
b+ZG
t0Xf
GY~Y;
8?<Q
vIN/ g
/hw23kI6
mj?g
@WVaC
tMlJM
N{ky^y
<75n(k
EGC|
TD~]4
!p$~
v.Y^22
.ctor
5vL8d
0J $
\ ]VGT
h2(|X?
ndq^
A${d
Maix
[Bm(
_>:OB
0t!{
2k}:5
-Mbn
09`J
&3^$ML7
ma'Y
N.N\N{N1N
SSQ V_
c)#ULI
upT h
.f4X
Ip~.
p q
eU>
YV _
3,9I
~R5c
=!"%
v4.0.30319
$#8
zFq}kK
EwO{
yc<~
V6fb
*4l!${,1d
T2 eo<
;AP~?(
XfQn
q&<D&
;`O1~=
Module
$0&"}ctqj?
t^KY
zN y
Ue/
N[NkN -
%Mm/
\0 l
tI\
@.reloc
cItrkJ
.D~$
hpb06f
o$bO,
!(-G
I3z+
j8!w
bk=Rb
(q00
BjH
59d1
e[uG
R(WP_S
N.U3
t_[
#''"
(O7xKS
}eHy
K$#SH
4l3`
{Z1{V
U&C[X/
.ta
] 8^
s*ou"]ke<
NANUN(N NlN
N/NgN
|q +
[$:E
Ud# 7
\-[d
`8A7
lPS~
_ztJc
/0Mk
N N|NJN;N
@qt8v
u4[@
ycH
E)_S
SpLW
GH]
xfB%
H\],
Mt
2#,4
g?tQb
OB9)
^h/`
9/MRO
';9G
@b<
3PRb
@dGrb
g} n
U>TE
c ~
&CRe
9W]-
RFgz
T4(R\
ij=72
HUNmf
/V/N
`D$aR
R%tE!
#5Z$
_I5R
&_;`
*yo\
wo4)
j7b{
GZ c
iiR5
p\*Ux;;
S3^`
pX0Y
?gqj)
2My :
yf k
iA7X vm
~U6g5
Y6_QK
Ji,&
$VNb
*Wnp
^JsN
0<2k
t2o{
Q#:T
A2l,
B{!P
09C3
Kwq
eFtD[
mI8I
TNp^
R02J
L>*
K|GK
Ltlm5]
n[+g
td~% 6
B|N(NHNHN
{1sV7@
2zp/I
N;N|N8N
50E|q
W mm
,rF'@F
|LnNt
mbdC
vP2O
")/O5
fZ~$
NXlE
yg+JD
n+1K
QmB15
[JR6
`V\K
B0J\
31+_?
f5Z
]NQX
Np&<Z
T(s?
X(s'
VfWn
|"^v
,~ H
vW=O
S~&3
uJ=Gu
<$2Eu
Zdr9(
wt3z
!s4H
b) v5
GuFvO
4'>+
-S-{+P
@(X O
cm|&ASx
t(b-
cH/
3K=)C
eQ-sA
NWdZ
LdG9
t\ r3Ij
N NUNUN
&PHS
\Be-g:
>EW
TY+M;2q
Xw,L
h M-|
M\lXV7
zX/U
og3+
~4>-x
~ f]
HLBmT
m- GJ
_oe*
p4Dd
(j<G
Lvnm
E4hk
Show
5 bS
#es LK
iii}
N N NHNpNEN6N
!N"]
PropertyInfo
'.VT
G6$
]*Ho
N}N N&NeNEN
.sNyNVN@NBN
GJ51
A,=Z
UX=N
;, ]S
> Fyb
ak
hd(*
0s*0/8@
/9a*
fU)@
H.36
M<+A%
<J_:H
+o_
."4^
7]6`
RRB9)
C295t
d[C\vt
b`"8nR;
2f0S
}4VV
gum_
*td5
bjeL
7)QWy
i%+(S
mpV< Zp
M0^ DA
{;e6;
Et.t
HdVM
)?S.
>hy=
Gy U
UTh#Z
-dt]
>pBC
2oEW
a.cR
J5t*G
40]o
08`uV
]m(<
Q@5,
" Y>
.RNfNTN
'ALxm
le[Es
@"'s
e}\e
aVR#
X|7F
7P?c
=La~
%OB
hW2 q
X C
>9QG4
0;`yhT
`!>3S1
ac,l
Z:'? 6V
EX,}Y }T
ctEu+J
NqJT
B)MF
I7 ,C
-|)`k(
bwf7
:h=K
l4n]a
*xx(
yB0<
K\^d
N<N?NPNKN)N
N N_N}NLN&N*NQNVNjN7N@NwN)N4N"N
@ cw
{<8 ]
0'$7
knG)
N NMNaN}N
YI(x
JaB'7
1H7K
A?=<
y-[[
<h>5
3~@ |
vmb:
&^CE
g#^I
] k5
(!9Vd
{qZ1
C\]
% )
1{@D
U)7w
hO\A
<,Yg[2c
NeNUNyNuN
C V{
<IYL{
ha R
#Gp|
r>0=$
P/c.
J/.@r
9G$N+6!
N{NRNYNTN
d 9Ppv
frR}
\gms
hCzF@
G{|$[|h.
m{iyz
S-rT
QBNn
:'yLD
l(k
#fx0
q1K
NW *
\ xxY
T~Jium
ASl4
<K$c[
z~ ]
? DKh5
WvB>1
^{<n&
x;+.6
{#:^
/,{M
O&js
.*+"
&YQ/
q]A|a
ZlnP
GNqr
fR<
C w[A
9Vs)Uv
c!=O
sJL=
qR$~
c @>D
+J!u
M|<l2f
IK8Nt|&
TvZw
ntx)H
=CF*
Y[H}8
D#%7
h5J*ed
FPb`
bexZ
wUb@
\_(
"G@6
H6h?
T KX
S=%Y
8.N@NgN/NhN|N N%N?NaNKN
{Ji
M\K]t,
spAn^(
Q65A,eQp_
R.iP\
q%O!L=
X18Y
kVLY
#6L1
-!^L$"
E q
6E,&
i~eo
X*_x
G$~X
mPz
nNC
$0 i
Cx>j
c+/P
E P
",W)f
iyOR)
Ym8O\u
$}d@
-c=L
IntPtr
|hN;S
_F?C
i~e+
E{E]
oL%%
YA0Q
wJ8:
O-y B
lkI`
/m3+yA
,O{`5
#bvA
|$_
z8YV
w`ME
N2N)N`N{N]NvNKNRN
9hbR
"R[|
T ;QQ
@KD9
_c[[>
H6j>
)AFe
Uvt39_*
{XB/
2@,,
/$o#
/?z$
9cW
H5}L
3_0E
N.7
yaDf
L|C
L\[ M
n&7A9
r5@
\BKFe
YD GO
\??_
KFN<
dYs
53m*=
Qw] e
dM}z>
NmNsNONMN<NKN
lKWJ
(!6:b,
8_'
.<|y
,b [
l!dixL
mscoree.dll
YlkV
JGI?
u]jp
&'!
Q3ks
j"'g
^/zV
Z+`W
YhVF
a}md
tv!*!
0z=`
gV^5
\ f}
K=01
kV5p
2iVINf
Co0|ei5
%uM}i
9bO
:@ (
wao8L
K(?V>)
.NF'
-Mcj3
}@^}
b".6
tXo&~
fg>fs
]r3
Bq9L
( ~\
r1t.
#Gm]
u3w
?,)},
""2,t
j5p %
r<W
r#{^
Okz k
G*Sv
XuKr
3SQ,
C zw
)a=U
(sOlHd
T{ bc
N[NHN
"\ &
kun
Gx$6
Ab.?
!tT2'
gb/W
_Gj*
wOX}
1,<sP
b}_f
ci:]
)J2Isx
d-$*
l637
cT\)`
Xl)Y Xr
y|w$w
%"f K~8
R8^N_
91CDjz2
iW ;
Yx50
>V:^7]]Q
L}eE%&
+L.e
KqE$
E3^^&Qs
Q08i
*u3
ATfm
`M _'
FiK;
OG`fm
y=zFh~
lDYl
%iq
Zx6jfM
Itr7(
#EGw
`m[L
.`mW
3vF$
Ht;:
8o{B
u<x}
twT
6lIs7K^~
;7XT
] qK0
@ !_
S[;F
Q!p=LR
]#)@
&<g}_O
GAf)
m'UVA/
0J3Cq
!yJ'
EG2R
w! "
S/?;U
Zk'*
/'2W
d Hb(x
YT;L@
NPNNN
)m!$
ywfX
}`F'D
&gQ@W
d>M%
b-bY!
Cd=<
4%NxSZ
A!aJ
l-[;~n
C;^o<k
)\
6r[h
,B7D
W2b!
.%N~
|kQV
x6s _6
AH8/
t)Nf*<
4qYV
W" la!<
R+YcS
?0.;k
(e39
tvP]
MW:t
lC:P
1(6vd{
-\3>
y4bi
%|
+lQm,
b!QW1
_3U>Vw?
4qYy
B?Upw
'(Me
4A3X
fPr
;q C
EHG
M_;9 d
6i 9
+(hhw
<wN=
t<@(
_r]"
` fX(.$D
1hZw|
ZI*\
8{F*&
qwG/
:-'e
C)uW
y26
<{B8
Lc)F
09||J
inK#
u{0m
#ooL
vhfhM
n}zg2X
@W)M
2p y
o23QsEn0lgiGfEYq6ad
-Jsc
naC]${
;w C\
GpAi
hXKl
p./Mxk
q9&
/>!X
k]]
FC|i
:ri:c
FjdL@,
"6]G
CzJ5
k[X
?xsC@
3N([
x^<H
WW#c
[!bP8
rx.th
L3Bk~E/Fm
+ R
2( y
1Id>5j
Bl{|
MT\3
h(]'X
4X/v\lJ
Microsoft.VisualBasic
%b8{}
%)vc
IN^7
KWxHN
q433s%b
Wjl|
`W4v
z _$
/b}m
%HQ
c q:
'(Ie_
/dz H
4U4<
i5_@
v\bp
o^Hi
L&hq
<%4Z'E,>
$_}l
\~Q5
9|)X
':&j
*;D2
X_;g
`1p'U
+"<
AYobZ
9i>
B5v/
cb&gRK#
f 8yM
1zEU
N&NsN
X5#
ry #
& R\
o=yH
37O?B
i"Y
dl#V
Tf%8
':{P
\L[
k269-
$%Q3r^
w=>/
`3{N
T.S}jfA
(Hi~
,. O
}6iU
osD:<{v
_$mD2
vBEB
P{d'
"SV73Q
Rt]
jtQ27 .4
* 0
KB g
ao`
UJ"`
~6UZC
qO_:
G0@
|L8
%q%D
N<N~N=NNNwNBNlNsNHNHN-N
yl~C
5Te;'
<L0E
N`N3NNNtNFN
*:&
+\jd
;h@}
x7k5d
$&j}
5'\
!M%7Y
~^P@8
Jejb$
EP*n
S2yje
D-7p
R~lO
m&%
C#bhj
x7Zw
:OnN
| )(
Y1v~
~+Ik\L
t! z
?]rp
cj7v H
`OHj
"Ry!
rwZH
f9Bc
7x>F
@U/,
bQ7qpkJ'M
;lGGDx
Qr.&
' v%
NrN]N
Y@+=
4>$6
]EEh
h@`j
!A@A
%l}Z
9[0a
tlyxki
l]1&
@ yD
v=Cal
Pym<
OM X
i u*
t" (p
Bl)u
(5.*
Xjg&
v%YB
$ }9
@LN}NcN
Lt@d
\a`
#db<
J@w1_
7}sJ
n.8z
)>D!
v{'G
Mz;
=DV#
FMuK
e {k2
A oo
TV1?\i
GYs\
O|UVw
~X{L
1w+r
NlNDN"NTN?N5NcN
gJ#t
"] X
JY\1
*waX
ou".
9e?
L"qS
LTA
F @G
N+R5
NVN:NJN%N
3E6*
eOm;
N,)#
NBNXNWNtN
!>D$
Fw|'
dwBf
NUN=NjN@NaN~N'N
,hio
R[ @K
Q.j@
>+HZs
$}R3
]Qiv
s7{O\
K3>'{>kg{pX4
eIUh
aj1`
\vaM
EbpA
%"> K0
Attribute
n H9
ikKR
=y@f
rRQ?g+
G(|FC
SD\Aw_]
NaN"Nv
sMxt
y? o_
OeF)b
&k@$
&6OK
]~P
yk%y
O*,=!:Q$
>BMMh_O
Z^Vl
" >5G
Pg >
6+\:) w
s^R4
u'_
K4ZY
NC#H2
CFl>
<xc$
K^\iZ
pb*u
q/}Q
`Iua
v)X{
@+h*
9!p
lrA4
1Hs~
6&0W
.!l-
t.1
dH],L8-}
*P\3Lm#
rEWhU
iBB0))
ISRg
7;0%qe
8K M
~h'*SE
-? k
5eN7
YH6,
}Ag
3gx
7d C
rMBf
uLf|
f:Og
R-M.F
*-.EY#
i/"-
a+pJ&
@Ps4
><sR
%8 Z
nlWtX
)I\H
0\pk
>Tq$}
I-d
%Q#\0#)
R9G&!!
Y`- =
FEjm
27|>
X vW'zk
R6p}
/SJY
Og;cO
8sz4
gYg
{h,d
jYT^E
X67py
]b?X
#=Bk
9|jVtxA
zM_p
co%Tf^
<!B*l"V
AmE*
]MAZt
"Di|
__u&n
{p )
XY!/
%vn5
)cn)
WbvvQa
w (Ew{"
!J[]f\
n1p+
k`ok
$1)Gi;:6M
"|u:Ub
8w^w
'+,]
x RO
a-g\
dG+:
gT" {o
oh@
1!Ke
HN c
mq."A5
m9v+
+>tR
mu>r
V-auG
b\[ey
0A[o
xhaI/
h* 7
MjhP
N\NhN
Hb"2;s
bEo`<Ajh
S~>59
t38:
1@a(
h?f;
N2NsN
5= '
^pq]
*L[Y
zh~E
zW n
/1H&
B[Vdo
:cpcV
<kT}
>a0<
6_gQ
!+* v
y"J#<
s\ ~~
a]/&
0_8V6
T-t"
T@LX
Dm>oG
{"RIRb
7hAIO
~]l@
~MC4
\d6Tt
c uy
0IJu.oh
];FS
Tj[>
8Y-i
f v9
:L?k
j6u
N%#U^
PC16"y
get_IsAttached
gT>c
(igX[
L?DP0
RyM^GJ
3$CfT
>&&V
Uie(W
6trY
P 1wXb~r@lF
'"-h
b/r
,5Xx
<wp0
(JM%
X2RRrla
f=X|
NGB$.
gc5
Nd=0
h49
k/[C
=Shv$c
fy|P
KlY?
cj[<Y
mK)d
)cle
T! B
%4#NtDN
,_ +
@|d~$s
k3GW
2)u{
KXv;
E$I@c
4|aw
Da5#
xaUP
!Cy%8
x|VC
m45V+F0
9mB^
:-q'
dik'
$W?
k^LP>
<G)
$,";
F!n;
45%$a
GetHINSTANCE
Buffer
j$x
*not
' IH
E)0WF
c # s
Q 0\
Mg?&u
] HxL
|tsP
l9p@
:6uBOd
[~LI
B3iB j#
g#I(2'
?jb*
c$O`
r9BH
S})P
rGe
.79
>!_c1
e`<F
V0"l
_6 d
)i+*
NNlx
dG9 M
t8\
O&dL
NI&Eu
wDHO
9XRi
*l}0
az}Uv
U~{u
Ud#kh
2 1]
fWKK
<^H@
IRX
=NfJ
} L\
L^K]
&L"Tm
-)o
N N%N
m^`r=VIz
H0Gs
(Tk
)zZ|8B^j@
oRi2X
YXM}
fOl2
T-WA
+ P6
}oJj
J79U
Hnm(
L9bX
Op>.>
h(Lv
1#'QQ
FA"JOK
z=QO0
L"w2
dUcF
x7z;3
7:)k;F
gZ#
ms~1_
o.eA
;#H&M.
_Y3^
rX(&b
krh'
c](+
[WhR
nO"8
q&nsX
R,_WvK=
g_Bq
Exception
fdyv
=I6f
Y=b>i
6#jW%h S
.I>IE\
)}Bj
VVNr
nEH7Uu
Q~|b1k/
# M;z
Tta_
meuvA
`q<3d
FUX
IEM@
@h*q
S<2%
vj/g
-]yi
O3_B
jJE*+
l{Iu
#Y<Q
W!{9g
F [IC
`Z2
A#b
=05eU
z@R.
t!%O_
rI6]}
OrD-Z
6[#/
kj4]5
sa:K
l8II
NeNiNMN#NIN{N[NWN>N<N]NqN8NAN?N6
=:0~aX:
'WWZ
ZW|5
H'K[<?<
Sp>w
O[z(
U"D)R
[Zp>
=+4n_
?L.O
moAP
3*ck
NINvN
L^ uA
P: z~
0CS
?)1+
';4O+v
A$ a
e*D*
*$OAS
Yf3I
SA@Os
E[M)r
mfb[
Math
(2Z!
pVMr
N?NwN2NdNQN.NcN
X3:
5 ;U
:1&us$
E4h0mF.
:9"r
e5KF[
OM{Pn:+9giW
Qd=$
_ta4e
UJ!^$
N:aJMp
{eZv
)JTG
SuppressIldasmAttribute
e5EhdjLJ!
8 dq<R
>"7\
N N1N0N\NWNTN>NNNvN
9 'p?e
98~c
.kXeJ
FFB
%Oj!
zPq0
nky*i
L$mC^t
)Du[
uyCLP
.NgK
#l(!
/k=;
vd6I9
,-W.
{;|>
#MXx
>-(e
XOU]$x
C?7f
p=B?
OE .
j5)a
{|vu
wapw
(on
k0\=
{;|t
S{DU
B9G%
o: hCT_u7
Hc0l
'@ne
GnLG
aH%
Rq9=
:p9x
`gg-Ii
'4X,q
<K{m4
M1'wwv
*d`Dz
hGU[u
y3@L
_-<Y
TDe>
"zsr>b
Gwe`V
!bjN
j^$ b
h$&j
J)NvN/N-NFNtNTN.N
g2<T2
tm (
Lq
8V(5
B1 D
/q9(
S2FD?
{v@j
9TER'H
(Ph$o
tg76
s24 '~
?m',]
u_iZ
=(?J
gRE8
;R/{
eF?f
ka'l
E>;O
3\>c
*Fxs:
LZ`p
(U CFJ
YI$t
M&+7
NVNnN"N
DNai
0nt5
?5hLhm
2auT
m_y4
i-S5?
0-|O
d*1,a
%h~(
TSr3
N Nu
?U\!
QGXhWwm
#tu-
SE6p&+^
)JB8Wo
{Vgv
s2-cx
G&[I
UH@'
GwoQ
y~lr
]{ya
JmN-N?NYNZN)N6N}NvNlN
)%F9L
.Jf!j
pQL1I
f Qb
D"h=
_(<[at9<F
r SgBv
vb<B
3E#q]J
Z}nQ
j*7gc
Bn >y}
6a
)}}W7
5e!(w
NQNfNiN
[\Gp
>& @
.qF8
# M]
WO/J
B_^#R4
f6JHj
e(-`y
":L_f
(mLw
!6WP
an #P
&Pq2
1@s-h
pwUd
bMJE
!{| Naq
>oT%t
Z=`%
3'*Qw
pagJ
)S8Q
|5{;
_Eg
s]1BG
(fS'R+
,uC'
gg8BZ
W+e<~
NlNGNRN
s]%2y8-
' BJ
^"P!k
TUy9
Je}]
"Gc$EFlf
lB,<
?[`1
Y ns
)1XF
vZHhT0/
kVJ~
e/qM
S)tT
-#S#
#__8
1Z8r
69 }NU
Kx e
x ;
XT8)
(z*
Cb(;?
N>NMN;N
V M<
;*v/bT3
; ><\i
gZ8T
OlrB
#y/%l]
qyO!
N1NjN"N
,GA-
J_:nx
SdP(
P5H;
p+?Q
)jIV/
3xP2*,
wI{
s@NEqOJRi
ceW9
omY?
&BRV
!tl
%PAl
<# w
?C}
>ZrW
D7M:e@
!V!St%
N}Tyi
H2&b
"gb#(t
kior
9600h
_aY8
Z^}#
``iz
d92e
R{*d
V,#\~9G
v~MD
.sxq
& ([
LT.`
"I'X
|Y)&
-qp@M
g*z7r
M|~;
i<|
System.Windows.Forms
+/V&
z0Sf
{j>u
hQ]k)* N
X^2k
/xXT
'hfN$Y
9g D
? Run
"+Ba
2CmG]
3Q (
Md9z
`C't
>s<!
y Mc
JCO-
c?C%
aP8@
/Oa[
% +mw
]\5M
FUN9K
,9\B{
Rj!"
+4b,
q"c<=
*#~ 4
uAHc2
S;fm
b8sSs
D<1
nq:Z,E
h .a
|*CI
[D{X
T!,W
/l)y
v'kM
+8n.A
nuu`
a+hz
v)hLP
.VSd
uYXl
Jw#4
1U8
d,SF
bPVf
E]GV
;IL,
zK 6Uv%
S9,Fl
`Ka8
9Iw%'
uw@Pz
ConfusedByAttribute
qwPJQ5
G2n<
9{ypO
\yn+9
gR`u
+?m
3(Rxd
5C@`
+Sx4
7?. _
La+
%Q0nw
iq# #
G&kGQ
r|c?.j
=)(/
H~j\N
GbE0
m%#4
(5qF
1TIw.
(i3C
NCN N
g6m$
Lh@&
C`u;y
y<ML
w)~w8
>2l
K<NP
Q?jM
x\lq
KTsg
Ts{'B
QvfU
:@_T
lRbq
j)<
39`r;?Z
6yH
uv`!
HEej
CRs3
xncp/
sJX=C
_= M
N3a+
*~gU
5yM<]
:^#+h,
A^a:/
XH~1
- 6j
O>uL
!=F"
:$#
EXuo
bxCg;; ?
Vl>Z
O"*@>
op_Explicit
Z [Y1O6bo/
sXL"
6WP%
System.Security
@gbN
^q{r
G*1d
MzA Z/
R^*R
t&d;
kHSt
I@+W[
`j1?
4Nls
I |G /
[:BGe
MU /
:==
g5^!Y4e
?u5"'K9
eD<Dyi
2gL
R@Bs
2]w\
K 47g
V3Kh:
>& .
) fD
Nf o
` ID
= }
mGc~6
IO_T
_/1eJ
q0GE
,PTE|
1?*50
za=m
aw$.s
~AK0
gX[QQ
Gnhrp
/[n
$r!-s
NTN NKNWN
n!!H
:--uc
m9jD
P;E?A~4
NLNMNQN
GvV8>
:`I U
G!7|
r`9/
Mk<k,
f5`
Wz1%
/PO^M
tq(.`
"7OF!J\5
\Fo_
JLa 4
</#_I
2ec6
Tg[Jg
hZ{
hyzO
RI8
< Lu&
|7 d5
;gcH
hGJw
N[NwN#NHN&N+NJN
j*b\V
7NW91
3E1$.
7`6?
qt'|
7{zw
6nO@M;
:J%G
{:i s
rpr
<fPW
0Fi&
"k[_!
kC<L
lh_{
y+U
A|+q
<tU:
_lQF
3XMc
]_Rc
Dm/}
#Blob
%%%vA[
&=2}
q@9 }
B !S
}]dzXd
Cjcj
[}Q
V eG
~Y* to
J8\'
MM'
uh #
Oh!p
):_/
h=U&?
Nm:|R
)@ MC&
B]s/
[9pH
k$AY
4CCF
s'%xw
|&}yR
(R'n
zqqb
N N<]
UE 7
\Z!d"
:y2
D<5@
y=2pI
~m[m
*eIE
j;.N]
Dv&
TZLH
NYNgN}N
{G^y
HpP7
=x,-B
\\U-
[cP`y
[2>Y2Vx
hjSe
T5I*K
[WJkf
j+DAZL{H
% zi
X=jcX
#BWV
/IfIr
_,('
) i i
d
J5ZL7y1Zbuqhg9RX7P
/lH1
l*iU
Ktp;k@
yi[l
vo/\
.moK
?>i01
?CW`1L
I|t&b
xd@M[y
G6;j
eaR."A
vhDEW
RNd{1
k5]'
fn-:3%
bU)2
Ms:f
Tr0h/b
g}Zu
9q]F
0t #
]IHn
cSOoFq|
QU'dU
?FId
"uqW
58Pf
ZGC-t
QN$sz
M@<$
T9\X
BSRR
={<$
Dz=Bs`
42`J
49qU9K
mNsO
ovsh3os
57EH/I
[*lDx
)5;G:q
w,GZ
DialogResult
aN)[g
6_+C
Hv>p'{
]*=>p
Qk6'
C(<#$
FRH@
C+Bv
os6A
4Ky_!
qo ^
P6W8<_jXl
[ 4
@zZv
flz
FRHh
#)]`Y
lDDs
0|Xn
sqnq2o9Z16cv4Ddqo2D
fk#w
yt|
N\N1N
min0
PLHnZd
Wl^!
4%ZAc
;S5^
mX ]
@[]\F
EWJ-h
[lY`
b`-I
3yC\
OV24NV
`yl0
u3P`T
/&yW!3\
P]tW
uXudK
faVQ
Q|Z2
u^ k
,RHM
='Q?
l @Y
&]ClK
AY1d
1%mI
#5pU7<
>#yaad
b++iW
5JRj
S@F?
GetElementType
1PL>S
c3Nw&
tO'T
NrDl
F}i{S
llFg
q5Nk
MW%
nH5<
$9j]
^cZ{
i>7D
a!=
}%- ~
tu#wE
l'|~d2!
^\.y$z
v{9d
d |Y
Y Pz
OpPHh
<LN
=%Uy5
.\O%
TPsM
yy/X
vFLr
FivDa
x/LvX
{0y5
;5 QW
e- }W
N=LO Gg
X`3M
@++C^
1uU=0
p41=
s&FD
~/}p
4XY'1U
] Br
GQZ_|F
rOHl\08
VsFk9O
FGuV
/}$N
w5F^k
,?$g
0*og
f]B"
pwfl
T~*i
kiq ^
FO #
m 04
X9e^
Jfj8
MvIk
NTN2N
=&#<
ry|
0eT&
lE/M`c
[OH#a
[Eq
U/V)
37p''R
}-wN
uH09
A]vc
.d :f'~
4V/Eh0![
HBnuT
NCN4
bfHT3w
=g=V
(-g4
oyR
NgN}N#N!NZN
Mixp
2bx-
gyh
-z`c
Zhl,De
X7'n
#y!l
f(h&'
DXc;
mSb=
l:W'
'yhL"}8
guwG
=`&ux
`u(m
L8&R&
Pv5Q[
~ Ot
g6<e]
- 8u
,4?4
vT$h
wM9Q
K`!
4]JwT?
I8M1-U{oQ
` "f
sv;Ge
<] E
14,[
=w=d
en,~L+p(
Q ]L
J,!:
FKjF
K"z*PI8A
sg`n
3Q+p
W@V=
~!W/
7@3
hnHe
\3V-
Td LP
Ir2[
2A]
~ue^fR
b,_UM
MJ-
n|5W
nfGZ
WpS?N
jmc8{
:z|~
WU70FPV
slra
UEV
System.IO
nya)sz
WrapNonExceptionThrows
4-kX
#c N
m".1
& 6oqJ
*PqN
#+V$
XTZ
W+EmE2hk
`T_P
z1O#
:283/ n
L=@[9
]Zk'X
vGMRar_
|7B=
CX'Yn
WId op
AR:k9Ws
}B C'2
#V6B
70F(
$xPm
^Sj9
88j:
Z _
B0iP
A``g
9JhoP
q,}L
oM;ts9
_N'N
"K">
LqM+
33u8j
Yem+
/Xx5
P+Jp
e,",
-$cdVD
T6<N
AX 6/IY>
-J{#
lk "
1_G
`/to${@
N:NVN%NEN0NfN
_j0D
}d%P
qZQC
||~'|
xqU
{VcI
u>bo
{bW_
N@NIN,N
\2]
VR.
N t #1
q-9x
ot,g
;5eu
rs H
_t'o
'qFX
G@Yr
!U,)
1{m3-
FNFy
f<\*
<gvf
+4Jn[_a`
V }%
e"Ts
X =__
kp U
vY<B
k+"ze(
DA\B
v6>qG
id'E
Ti*vo
fQHT
(EL_u
gdZ@
X\b^
FK"<
Cni \
jU8h
HAuWK
(+(u
aG4O
tD]V
o-Br
&T2CX
NiNlNnN/N/NBN}N
VirtualProtect
6xr]*o
0%#k
lbx*
6PP5
`y*C
*zuJC
S<ov
9 w
,xIF
CU^1>
@l$^
^T Q
H?48
$-9h
98H
!'N
D1d7YCFCKltkoXQ3JV
]8b
ue l
,CI_
sph,
>g,a
L_xHL=
4pC
>e:.
qGKN
c72n$
System.Diagnostics
&,Sw
i-]V
k~'>
IfKN
zy4,
l#D\S>xU
?}]U
gNHf
*Sa`q
5d9R
OX X&
O@DN
dWSVM
8:Ut
B0;U
Zj7
c+X~
O;"I\
Vdd
Gaz^
?7SJ
l>32A
EqA=
?%xg
2LiafI
?tho`
N[NzN<NrNzN
$HM9Ax4
^W68
WA5:
<eA
IZi#E
&m$=_
o"UXo
8 v]x
B+|k
j07Z#U
r9 d
i{C9p
2B]g>J
\ux
bFN(M
#"ge
" _?U
M5.dvQ
wq6]
kRNDn
p'"c1s
get_UTF8
F=b&W
eY%\H
UXBx
U?&h
(NNiNIN|NHN
Y.roL
K'"6
p6q)
y3Rs%U
04\>
(t}K*
.+ T:9*:
zaTG6
gJlL
J%FZz
w 6t
&O/I
:A |:k:
<Y<; >
D,dG
o1?Dv
`;W)k
* nG
hpKcrQ
>^y\
@rsRN
G_|x/
YkAT
q{PK
}3T2S
Xi=w|
]@ T
)NBR
!e3q
wP4O(
d*}
_Q O
)85a
agc T>1
^({m
xna/1
w<=?
3 MnU
,J\ U
,6C$
7)n:
G}# t
R60p
BhsIXZ
P,h\
H9nW
o{?g#
@I:xmv9"l
m0)]
5*MM
gXGF
+&0X
|2KB
9pOro
7;E0{
p)5
ru.R
2Nqt
~y=ZJ
V:{G*:Kdx
ywK8
acp1
R|vP
hPx6
?_`c
@dG2
'#zx
ij:c
uNm`
^Bvx
Ifb<
{ra\
S#w`
&_w`V
..&L
#w<-B0
k(^G
4YKf
:HS:
ParamArrayAttribute
}fc =
Uvc+1
4z?V
6~;z!
kkVz
h :
;`-U
Hkkv8j,
YqD+.
,_YFLP+
hc%Zj2
G_7Av
bF[S:jU
ooi
T%Q8
8'u?
39c7H
;]J7+
f]pI
g` c
R!el#
f K0
+ur0pP
W|\r
k{^z
ne07OeDz3y
"@k$Q
f399Z
=]#M
-yVyr /
UKgR
U%zo
`wU1l
=,Kmk
8hQ.du*/
_t:i
K1xA
k"@N
+/wG
NXNpN+N%N?N:NRN/N
7Llv
94e]&
<n.j(d
5K Q
TY|{
>bFW:
v4$j\s
mi9j
\`G?{`Q
(KmQ_?
Erm)
C3bD
?[WW"8
N*rs
5 LomlY
Flm(
mN(`I
F`@wH
ZUxP
Jh8Yq
8v\W
{ 7.U
K*{H
YVB5
~[p*m
pw|
O?%k
x2B6*
A- c
)#
;imK4
gs/Q
B+ B
@q|`
{'d6{
'sb
B9!h
UInt32
)-e|+
>&\[
Cvhp
_ZZrz
P 2\4
$]):
iNY +
c6BdvyZTdeNaStCGAi
_Oqu
0 yS
{&Fy5
{@]
>W]l
n"c=+
Evx:<
dR:7
-(1# =
8n6(
SC?5
0Id)-
_/_Z
TWV
%1@;0X
`imp
xJS~?
<e#(
!?&
)4i*
sqQk,u
d1'\=+a#
/)C"
BQ<C
k;d6
T!L PrF
o q\
*3
))!6
PIy
A+!q
@!XJ
9:M>
uWOE
N N,N
]G=.
qO,|
/x"`
nnewnewcryp
{EdU
1s%i0fS ?
l;#>
?st>
C(e1
6]E|L|o
ve9=
6<_;
6E0y
!$b5
r:cK
U PGP
X_.{
@I&0
MemberInfo
%9,[s
Tfnn
a5~|
YP Y
t*12
=O7O)H
_*pJfk
p^@&
}itQ
>zjYMn
$"$K
tH+)
UTax
y1;'%
KDQ
O!32
NSNhNpN~N1NAN
A.438Q{
fvgr
R$gJ
W.Xq
[ Ee
,,!D
,eaG
_zrH3
6:H3
\9ElGa
` 9P
,v[X
N'NmNkN
2Di@4
%p3*I
15lo
K8Dk#
8ItU
b ;G[[
#|P
KXNc
uwk4
{8U)@
.xzL
\i|f
8yOf
PiBm?[8F
P''=
EMN#T
'h q
l%#b
p("G)
EK"d
S(4:
smxmj
}8e1
40)p
p9$jU
HGyCufw5Jw
|V:*
2=Bq
}61Nr
v SE
g<3 T
`{3o
SO#V
hRF
~<J\e
Ksps
%%X:
I= ^
fGJn
h=#A
g Tv'
^Lu%
quI(/o
7>F
{CQ7,
~^'6
D,d^
2H8{
~Aw
uf9,
I>3g{
hsOz
)/ [
+)+t
Hx$r
get_Chars
oI512O
cx1|
SdZ#
`+*>r.6T
M-[I
3)'S"
/V]*
]E2m-
k- R
hLfx
>{ LV
gN~"p
@^t[o
$3sjM_
Ni0p
z}f
ZAc
n=i,T
~r~]
[NC U
H\S7
aq]u'_
Mg U
E2~6
oA<t
)AoMT
l[ `
?nLT
{S!RC`2Xv
&%8'
jd3nCH
`O}WJ
:PY0
gUk Q{z
r26:
MessageBox
r `~
jK+:
mj+$R 8
~h*8ACz8
VCJ3
h4so
g6D
;! v0
N}Fya
fW'ir;
+0&b
2C(q I
3]l
W7a(
GULp
.cqI
/,{)1
mTQj)
)Drf
"6$%
)<_?
jfPl
02 Q8yX
TE^9
c~&tt
^+Nh_
L /"`
zgcQ
e'N]K
|d#
^Q)I z0
k/Ci
m KA
t79g6mz^
@jc&IO9
w/x+
q)~9
~+*
vH^c
>r.o
#~ P?
Lyvp
,\F>a
aaJ
PE) o
v/d
& T&#X
^'Ru>
<tvf
!19. D
.L|Xh7F
z^:f@
NGsR
"_ZWl
q8~6
cvi~0T
z*_6t
[3P\
%vp 3
dA""!phE
Co'
H 7I
=*[M
=1RBf
c3Apivu2ze5NRc2scH
>pM `Q
XTV]o
IbTE
)8Whl
;byD
1=aG
b%NR
8OXD
TL@f
078v
NnNfNyN*NdNhN?NxNyNuNgNXNvNZNqNJN:NoN9N
M.`n
x(El1
y;SO
TF A
8aG:
=k0&k1
6P{hT<
q>lw
_"Pwf
:+|d5t
' 4xZ4
em Q
=~_z^
_>4#f
q2<S[n2
NgN?N-N
`T'D
Q/p%
<GLu
~2RU
(/T!!
ParameterizedThreadStart
aPW7J
5f|r
eCS(
s}$p
X"4(
XGI|!
a'==
+g#6
6b`f7`
]Mo|T
,$Y`
?8XQ
HPLn
x7VE~
lR"
S%ar_
DrK
>E
NrNdN
=g!]
U%VY]
E8Ym
.RJF+ BU
oPj-
t9K&`
=1j)
}y3
<@F
fz4_z4
~^.u
+X47
e/B4@T
`W2:
UJ{}
Y kbJFs
])z_
W58X
~Y?#
?l^R
'][ E
+WVH7
C1=F
G(,
oPco
;X<Ik{
=krt
VrAt
9v={
2oWv
vy.p
kIZzL
bP`
+bFL
DBMc
guB[
q^@h
HT2wF
oM=.
xv.Uz
a#Vc
V9p<1
0q!n
(JLztEj1
V5<-9Q
<-;]
i Pf
)h%l
S> 3
6,EK
Interaction
c~YK6L
+t&b
/_lZ
<M2X
N!N/NuNnNgNEN
ma:G
E}tHP
0}WP=5
$1 :
K0q7Fh1PZK04dGg
;@gok
)|In
~9[v
6i9&H
X%6*[R
3Sfc
KHJug
Z&Q)
H+ (
;o>6
?b!/
^,Fk:k
vx(^q{
*f|<
=nMP%
.KIs
7]"?"n
8^J<Vx
m5W5
N,NAN
P+N/
/ R
Cj6t4
{t~U
O*`7x
9Z]kN
T:F{en
~}q<
G8mCa :
NgNJN
E~T_?
J/(k
![Bu
YZNF8bLvXx6qpX4s
h?i
cOjaS
6fsU"
GiP|G
-8}Jl
g&n:
[N> P
5AW8&
& pSA
iY
|kV-#
L#,h
bvL;
}g}o
XopE
D)l;B
K|T[
c{[GR
0[UmO
xZzR\
Z\/Zi
ub"5{
sf0@
w1<"
@3aK
kT'Ty
.I?
l`k1
tJGe
"L(1
PLKfl
RH(s3
q*6m
^}K-uvJ
Stream
3`Djzi|\
-q+v\Q
C+")
\bC`E
^kiJ4E
`/[h
3I"
Oj57
{4|
;9:#(:mYU
E w3
a{,K
N0NxNCNaN
elT|.-
\MA}
H| tnTW
4KK0kZ
}1C;i
v:{4
nPgG
(8F|1
:nYO6
sg6|
6GHE!TNu
l/2Etj
~blE
I[B,"
C #%
.cctor
^KID
x2xI
ez}2
$pn;H
lPC
-\a5S
-lZ.
' ]L
~| ]wE
`;_e
T)]`_+
l717
GetMethod
N,N{NqN\N
jP1e
y%C!QOx0
-XSXF 5
WxK9cj
0>`T
bt \
%LV
RXL%
%E}p
D-0S8j
bI
an(T+
%LIc
%uzUmCj
NLN*N
Q7GvT
$&YT_
^_)t
2lgB
73Fm
|wz@Kk`
yv\O
gg*~
# <i
Cv 4
c=Of
9gI>
WS .
O=S4LT
Lu-[t
Pc@.s:
%u}W
rLNY(;
Y-.u
*,iN@M
| oT'
Wk:}
E>kG
GetMethods
/<fh
"g 5$^ 4
r 2C |E\
}A iP
-e[27!&
W e;
_.VT
G0TK
}i",
bAa9
,KepMZ
4 /<' L
&s@K
6C~ G
8LRs
X[Ce
{Yf |z ^`2{7 P
$V%LA?T
"DP3
.kGp
8PNo
prWM
S9|n
*,3J@eZ
Mc0P
(*@ -
e{o7t
O $#*
$y-U
jGIHnG
=JfUY
16nu
\[~
n m4
wo;%
cDe
h7%2
[gQ!
Q~<
_PIN
enR*
zh,}
TDk&~
jZ;<
NJN~NDN9N^N'NYNaNxN|N3N
J0.cd
5H0@z
!X+1?R
o?6y[
4^+T
^@_o
)gq0
Ws+|tEh
'Nki
VuK*
qMYh
Cz>V
sHl3
_J WV%
/1zA
*.b
>H@7
Gw?y
Z^e
l";]
dExH
C/ *W
xN*Oc?Z
ylZG0
fLPv
! b]
ldg_
n#1U
]9G9
b*<Z
|UWuo!G
N7N/N
n00ie)y
" \'
v;_
{ 3t
VE?<
bQ sxD
;9dc
X s2
NZYw
U|g'
2' p
[A3;
&3a 3>H
^*Ng
c2"g
{j#<(?
hpWC<$
:>%{
K}7)
FRJh"
db uC
$3q
7a A
6N"~q
:(`A
\*J
d xY
v amW>s2dhe#l
,\n ^E
sP03M
1u` Y
#$?Cc
.uIw
] c&
f-K3
d^{i0
]RD&
Kt,5{]
cvrE
40M)B
K62A<
uV 2?
ukX
8@nGk
g(GX
&z-;A
plj
617=6
7xQ(
"T<Cr
l65F
3]md
F?J%
:GeW
t ;l
Ewt]
kNan
f.sr}
$jYiIe
51yO
5 j;
Y 7
EJAa
6AuG
*q2@
JX Q
x;jo_w
/4Ei
gTBL
3AAp
9Of)
Oa"-
^ w?
BU
8jN.N6N$N NKNPN
ID{5
GL16I
QH\t
^3]N<
ww^1
NnNBNtNyN
T\sKLYOw+
{V!#
VC-P
|8RB
SA5/
=|uT
y7qF
G~@6+
;47}!hd
d:I#\>
"h|q
9Of`
}J'"s6}DM
@Z6n
<O6Z
oOPI
>X(=
[v]5w
KMT"
s Jdm
:UhP
fzg[
p<lZ
Dtt<
"^9M
U.Bl
s?S5y
m2nW<
+cG@&
XW
8y=w
NPN[N2N]N N1NrNIN0N!N2N:NYN]N]NiN
gE$l
x;<C
p5vg>+t
CVg.
Y`DC
a:"q
TlL
v(:qA
pJwiumDc24f8pK7J5ym
~m%r
{9t~2
n* F
y>CzL
`HJt
s?@<W
3XMq{
02Ks
Y\X`
:xgS
NaN1NvN
oev,
R O^G\
!F/
jcC`
) E(
P+p{
M+<-
[Ma?
LZp}
Bgp
-\!z
:;G^
Ow 8
RyNS
mp;&
:hD=
7~wE'
Vo+g;|
pK X5
av,.
B_uf
8eQ<
g,fs
pl4
5cq_s
131_
Z~I%
NjN,NcN
EQb U
,3vI
4HT
/b}-
le0>
,s)Kgq
fo*>
PzP:
pk3b?
zGyEo>/s
$7t)"M
s;4.
$#PG4
?\\]
/fY|l1
AJ .
[`TJs
x5[R
vjFh
lLt:
^;,V
uJ>Kw<<BX
J8+hqN
a3Kc
*b
yl1}
|Z=:O
I&O6
s?Xa
>$o d
f @^
7RkfH
TZ7Xj
Vq:QF
,+fh
17?QM
f-&C
:E K:
:v\9Ro
NPor
*3fG
1_s
Nl):
OBHr'b!
k&81
E*U?
,l~
2|MF
A!i$C
K':q1
j:U;
| >
l :UCaS
YKj;
@QBT
i* )
r9VR
5 Y
6 Li
7#*;
?ra-
vBzx
D w;
VS ?
jW$5)
TpdS
@TxP
k3
LC:{Te
uB 3
Nj?_
<n^(
M.yH
I@bl
Xk%R
256,
Lo"O
tE[@
j.uT
M&T T
= VD
b ]f
x Le
[%La
spbR
O$Sp
wH^.
Q sE*/v7
9{W\Z
ipWA
4b u
8v8<`
e\wOv
=_};
BzW0?
9K 7
%cvO
HT2T0FH
zW><@]
AV3d2T
q(PaN
9*&?
U<#/
'f2ylp
=q6w
vTdt
<} F.y
g@]
GJU4
R'^*
)<rCh3
=o$'A
(-|"
:? ^z7+
0<Li
|(~
I}h~
j<i
N(N-N]N
MSt
&%iL
o#iH^
${}c
tE<9
3>.9a
CK E
s}r7!
8p\3@
+`-G
~6z5
j~yT?-
Jf:Clp
Q 2:
?lDI
N(A"
*=<&
`E {5FF
,x[ 8_
+2<,
p|['5Y
hI2LBau
}?p'
KLv
]J \y/
M<dt&
UltWq
mOjd%/
eMn+
0 0^
dfS_
2`26
t9G9
aNKfhD
<@ M
"[W)
ay!G
?X[
G4NP
!x}st
e1,s
PS7_x9
k}.o$`}
5DH*
MzrA
yfeu+
Pdrm+
w j
Y N,
B3EZz
t y`
g' #
W Dn
l;D?4
qSu8;b
s68)J
c #
N%NjNTN+NcNbNRN&NeN
2S50
J vWA
X0t3
HbJ %g
E a}9]/,\
RRe!G
B (,k
)l,5X
58?a
4F`p
NiNLN
;;za!
tJ=u
<so'
9"14
nBt{)
69;,O
~<%u
GYO
5ZAx
Q1>?[
}#AS
RQ d}6_
q}x{
TA-}p
y2,e
wP`{wU
N N;NjN
Zs -
><h`
JKg@
bM H
e Aj
!Bt
) tn
y(Wq
r#X8]
$Xc'i|=
xD9Q
3b_^
6[wb@
3 8 FY#
k2yN^.X
luN8
z/ E
Vaa<F
8?5%
CvenrngcDg1pCfp6mw
]~bz
; ~'
)eF!c
A c#
IPH
mJ7p
t}Nq
N_b'
fN-A
8a[)'
2/Nq
m kxXm
hW>-=
}\?[
y#gQ
j/&8:
IHQP
$Ux
|j7t
^XMV
zZa1
Fy;`
Cas.
yTukP
XuPG]*
XSr
4ru F^
"z X
p=V,
XqFF h
LXy Vc
:rh
<J=0
||TB
=tb$r9Y<tX
"T9T
r)XZ
(aW$
6qwX
"j$Y
#Q@?
NaNpNYNIN
iF<c
7'BA
D6H=
=uV$,
>5* C &,
OQI/
'r<zg
.r;^
zdWj1
N)nWXL
POiI
jr33
T U'
w}LJ
z 7MNk@
~7 ~
njI:
# E-@A
7hqJ
AI e
^!gU
)RrK
}c q
6g^+3.
/ |e
~reKj
CMX]V
M*e<e=d:
I/cb
"G{+
{Koo
rpYn
f }>of
|_z ur
DQ)}
TR:Q
+ p2
`f;-
9Svs)
PlpR
7Yi7
z@&e
NsN@N
_R)l
Co1sE
:zt_c
3U7
get_IsAlive
#G5P
Q-kb.
Kmf)1
y1M6
VR5:Z
y=0av
.GaW(x
<%=Uu
b~Z|
0QR"
E<0HJ
dn'i
io$\"
VA0s
T$PXwN
Za#_$
h<+JOp
16RQ
`IBI
?*q1
xU"~fC
<i|u
"R9g)'
U(;c3]
xsOW
^'u;
>1v>
ustF`a
J)4JT9
v*mF]A
Lw5*
LT}0,
3JPq
Ws=
R[ ;;
Ij07
-zX@6`
)#G<k
cq^$
@ajs
p])H
H^&r
e6%B^
xr:!
pMT
9}7
+lY
Sm)hE
p{#) 0>
M;Ax[
zm="bBbh
OpZu
}.s(R
INN
uDM`:
<-4\
vPO>0
}|.m)
SHa}
(d2l.
K5 b
($u8M
PPYS
K6*
7'gc
+n=y713
O,4q
tws+
O @IZ
HqP
g QGv
myo?'
{xJmx
r {SgFb8O2
:n1x
"naY
eR{eZ
FailFast
j$ H
-3>mHX'#
](Xf
lIlk
Qeo%G*
sh>Q
VfH1
5a47
}.j|
JO 'L
,W@
IU$K
vH 7
6N#^
1kIW
.3o;
pNR+
O1 `
Cr"@
8.D8
FW&Y$
N`NTNuNGNHNyN&N=
UYH#
7G1
!$plxN@=o
$Hc 2
;$0'
1%3`
ORPY
UpGg
%_[;
]!4{!x
7 a.
2de{
(}>U?
=?@?I
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
vR-+}
~-jOr
m)3 EoI
jp Q
e0h#
v@G^
_He1
o #*
I<Tja"]
;+Pa
?8OD
k K=
.X#8
{*S/|\
P $zg?
]2#Kt @:GC
,FkV
bI'l
fK#E
S+ (
ps,.z
Ox)8u
oYP7Ll_
oaUy@
eD/j
ZWh:
G O;
tok'
hfuW2
i#-o
*QK6,
^$>_A_$
@)iS
Qj~:;
@`fA
I*y)O
,y0+"
9mgx
5+7a
Debugger
:vx3
}{Y&^
Z7b5
*5>i
i)"
?*"6u
(SN]N,NINnN
._ NI
Decf
u3s}
w>'f
0)NpN
=>q=
MB#
r*Cj
%(TH
\(+
m.m7F
kuZ
YEG"
L :P
SDdL
J5gCy$E$h
Ai'?
fWH
Q&&ME=Z
>JU_ G
H7uQ
}aM
([C|
1`s4
Ks_p
uns?3
nViu5
c~Ka]?fZ3
qS)&
-/U8$dEL
dKchYn
/fm%F
h-u{
b,%lw
f;u6o
1suVY
A 9>sC
.^=m
Edbj!
t/!\
}el9
(G+}!&
*i]y
Ummb
,UfC
b*8-
WlR|U
d >d
[b]+>
.YR
= nDI
2nV,
Q6UY
MNG$
,rsb
l<=D#
F4xEb'~
G*6f
}Lm`{
Z.ifQ
HC,_
69/b>
5f0o
\C[j
T}LR
rVW}
>8a[J
92rc
V v~
5PT7
uGYn
NxNXN
{:f7C
3MHdO
<EDP
CIiW
{7a#F
Y|mv!
hX@T
I5$f
v9Up
ME]H
^+tN
[.^2(s
YBm*
:Fkt1
:"t!CN
@e y
ZkbTA
0M'J
O* /
B TY
`Yz"_
NYNfNjNON!N
i.n2v
8FTo
R~TT
JmlE
L%)
Bh>&
:?|)
&#\)
p$/z2[[
D"Y4
H3iw
]pZD
7(&
Mj/@ /
R-1s
*TgY)
=lv*
! ?}
'WPA>f
(0#\
{[$m
v!)} >
h1I@
XU/5
1d29
@.n<
_ fS
LL-F
R]ZJ*
\LW"G
O+IV
4]\d^R
r$
%8%h
%F~]
%>
j]}!
5Ao3_
)@ ++/
2h-j
. Jbh
sm Y
4|Zb
J"t=
h"Ct_XE
UX)R
lS~v
W9ZJ
>q#K
9Ek-
F8<@#7
\#o,h.
N-NXNaNfNCN N
#KgX
0Ub./F@b
<[FD
e?b
.U_K6 _
i! h
I5+O
PH(n
+bG
g)x/
5m%/
^DP/
9atL
FEzN
DUcB
7n9!6
^"W|
-}bL
NXN<N4N
x._z
pesDK7
Xu6]
C`a
frF
n7 R
7i*$
)3S
i.6
_-*E
iT$L
'>1*rHg/
}"*5-
> w
~u J
jcO
&r|3
[Xf?
hNs$
a(uBj
hD<$)
zr6eU
}ALT
u= T`
X~ X
Q.y/
tYF]u
Ix>'
W*,W2
M0i1
NmNSNcN
$a3<:
svvJ
WV&VE[nk
pV'_
Iy#A
76;;y
C(l
G(N~
.knv
g8.W8
)|?d
,$gq
UH;z
|0Vc
ON&>{
YaIM
Equals
70d{
VA2Z
(P\X
u/wD
Sqq
dbxH
@pf9
>"H:
/c4[,i
VR=g
XX 1
UZWj
B(68V
PHgMG
Pa`/
:U|x/
OBi7*)
Tz9&
5V1E7q
s k)
j,T%"
{4 %
\u.P
#5S$
#!G.
RnOO5
)w[b
HOON
#:=`q_N8
ydHp
f_yb
Z\I[
/;2W
fRbg
_Z%s
vR!y
Gnb
X!Kg
(qw9
SU1Z
+;L&
G+:yd
*SY;-
aV-lz
bvv A
^oX._
n;XNh
Jbl l
'ws
QSHl
EHw\
"8.e
SAI|t=
GMj!
^/.b
T#^1
'hGyc
d+"gX\
g4j~
b]H-
X{S]
(2 R
!rW#
0xhy
>#OF
:-z$W
{,?$
U m~Xn
gptb
r 8s
T#, R
cQ|d
ds2RE
XT.
6~r$ngA
Mb.3=
0{j1!
2.o$
n;Ha
.Zfy
}0(w
Thread
Rd9a@
Is/5q
%T9L
E+J$?
fwh;=
EOQ$
UYN(
Ax#k
nj vz
-/,g
=AYw2
/.q<
<8~x
o#|{YN
get_CurrentThread
N=N0N
AN`h
WYO
KmvO
Hv8zA
!2Uw
Hse33O
q7kU
|Xa9PSn
-8D(
fNZ-
\sRr
t`FUY
## k
rO3;
jHSN
`U7\v
|C7B9
'%%]
\ bS
G16
[yni
w+V qy
~T[
ZJJV
T I?Z
bF$N
p%?#
G#b
>|o<
t }a
D[ t
A9J}
%0RlQ
?y3
uSpb
y_:W 2
t0 t
w :
-%Y
1Wu|
a_J
E&ms
a&*N#
J*\0h
x fK
zh<vp
[p\Y+T
Y.4\
vLh.
IG2x
*C? ,
;1EZ
31KP
G`fms
= 33}
ibnC
8=as
DF XU/
,BRZ
t`?S
gkbDTUQ
M- @
s^2 a$
dIpGcA
WSKT*
"PA.
*4G9
LjkN
W hV
fsW4?0
r QV
nl~w
|x8
V,>G
gth'
j>PO
BR5S?U
/ZA"
fuU#
Spo
BKO
NSNGN
!{z;v
lC3@
nAgxL
,&vM
M+?%&
-t"H
,;q5
}3= 2B
hv4su
E uw"E0
Vl7+^
kE%,V
N N<N]NMN
thdu
6BQ
*0M-
:sXt
lL#0
$,z
E;ro
(e 3
5) E{M
^I *
HrCF
(>n
z>S+A
},9~T
60"bwMdn
Lk#g;0
]@J
"f"J\]
*N
]>= m
W'Ik
lU#:%R
k iF
!=&F\2
tZJ`
j8tX
f%q)
Sleep
U_}-
GL ,B
F1<@
%9i9
gs2q
/*xn
!4lp
p89S
5=_:
jxl1vRTHIfNkN53j37Z
t0yf'6V
ub8w
NP4ke|
RjI?^^
;8*z
N=NHN]NBN[N3NUNtN
g-I7
o TN
`T,o
@&NL
:$N0
Jd~*M
k"IC+
Mth
:HTjZ!
\+Ze
]Kur
o T#
=/J @
<u.*
olkzryRCJ29EG4zpf
djS7
A?,=
>lV
)aIg
{\,=
f&,ja
Y= w
wbJR
vr Z+a
Y<,O
kb&8
3{^>
|J9Z
3}fIHz
_%gv
O{1{
DO%;o +ER
dX*L
*Z0W
()gU
oY'nR|
NMNKNLN?NxN
Al:]
ewH9
6'\C
$14R
R.qj
4T 3
4;.Z
!f;H
G=7x
9>|_
p\#?| RU
{[S^
g"%
>m5 s
x;t?.
^:Re
gFVJ=f
)#:+
H-7,S1
2._^dB
nr3~'
\K>i
okZ9
mx\a
RuntimeFieldHandle
O-an
E{N8
1#:
H0=+>
n,l0m
NRNFN
>#5=J
\!\1B
36533
jRx}6
*S'
FeYxM
sST7
+x'6)t
g?0F
,OYY
=TC `
Yd^
.q;
~Z8.1
/
kmb>
{@KF
Gf``-w
SH 6
TpZ'
]~, ?
6UW<g/
)0=?;
{U]r
@@&HL
d 5H;
RULrS$
hs'f
76;s
.,/S
JKFl
"h a
)5\e_
0@#,
<M[B
Q{Y@Z
zKY|
BhY
& QYD
|\J!7h{
KhxX
X^) m
=y`b
IK *]
~F*a8
v:_\@
M!00
y9)M
.XJj
.@1+pQ9'
d(ZZ
2l-k >
07Lq]o
MBynd
I6U
is.M
U"6H
Ie{r'
JmOB
@8=O
Bqv<r
[b<im
OyFV
![=nS#
r) P
Pf 8
9Thr
$1 pt
M*_
,d/x
sp%b~
EN|3*
JBN-N
H<#O
9)nU
)@e^I
B@^N
il[+
x2pH
} cw
xcO]y
O+hU
^b f
tFZB9
CRa\
!w3e
'}<rpv
4vB?
zfrh
tW fK
]T.[5
B>0n
kM8u
y<vz
QTW_
n^ /
Ts 5
xU?
~:Om
LcVJ
"S~.
m3Nx
t_6)
~<21
@E87
y j;
#RVk
|XS?u
w%(X
3i%A.
RN_
=[P#w
]fyI
{g%/
j!F
bFm#"N
/MLHM
"_WqZt
26r|
q;4e
< ,e
`]S}
1%bR
}$*D
vuPt
"K= u
?V@eN
W4,id|
n;Ts
^h0_
Jhljw
3 >=,
vsAf8
z yU
eka~
\w}L+D
$UD}k
OGs_
H1"
}D}.
kj'iCx
Q^9ntG\@
})~zJ
get_Name
W?HQ<
hj,C-
X.|N=
Tpk/)'/
8., U!6
<p"<
f#468]
qaH)
NBGT
jHVE
K]TV
Dxs<
L$3&
2~8;
F>U2
D( 8
#zli
Bd,db6
g|N"
V1*ZV
W;PK+
&Ie$1Dk
=&2%
}(q{
]Xr}
}7V+Y
sbk`
"}lX
#`7o
MDND
@0e#
,M=ylu
vELT
x @#)Vg
Y/or
}mdCu@
4LQ#
uhIiG
kH {
5Jg2
IrI5:
u>+|2
6`@
~R>`?
kq y
/ZCx
^<yx
-;DA,
h%7P
g:Az
ot*-t
hX/)
tE!-y
<{5;i*
!Mp`
'> H
8-ME"
: F
@eqQ
ce2+.
NLNkNcNUN
SuD6
4 3z{4
N&N2N N
X k*
System.Reflection
vJF]
&v>4
D- T
QKJA
akiTz
Z&_'
N |I8
EfM{
|r[e
YJ ?z
q h(
jN5?lT
'7%92
#7U
jB8o
IsLogging
E'>pv
NzN%NLN
|;v
.`=W
8#2r8
)sJ;@
i~e/G~
e }r+
~g?rVw
VL"v
,%6P
g@v
Mr|>
HZC>
wCz-,
W=mr
U9MZk
K?<
AI }
U7 \9
^A"X
jf"<
O}`s!,
VY[#
(]uS
JT.N
7;Kl
Kqp>
X0JB
?p$l
In;
x{ 5
82:5
r\Ad
oO]`~
X2PE
<RvUv
&AZ7
3mF/]
NGN3N!N
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
J{7A
PhhcT
kernel32.dll
Xb;S
-by jJJ
w`/~
UBa&
{2|{O
~(+Kv
*MPv
$7uD
~\-yY
tr#
Y@GA
+dY 9
nrF i
?'4\
@m$!
*j W
~dt
?S[`
&JSg\
2l@P
q k7
(ILf`U
f|!Pt
3y.
j u# V
?)"1D.
BQxZ
84=wJ
Lc k
C<mf
l`PE
z5_Y
T.DmH
-'kX
ry D
_skd
k4JgE
.=dT
%P!~
/2dq
z p
/;U|
bq,_
8[oE
m)y1
H8Q8
-xx}
Ihb<
0G=P
`osbX
IP\S
/!'8
W)Dww
[d.N
snB/
|~Ds
lMG7
:qGv
Gdu\
)[aOc<
N NRNDNON
sld@
1YyRH
H=P
* ZF
~[8n3
!vxj1
PIyeiz
?s Wr
QY U
Write
#p}7
X<T +
.|H?XM
#}D 2
k w
B[V%
97L3.|
P.vN
Ck&<
} [$
Uf7M
X o)
uic1
X~ A
N&;L:
[;B=
};G=
aF&n
|<v[
bH3y
! (?
/nhZ,
NO\t
bw+&
MK4:
lB!2
,%-
1]Pm=
y!'<
!Kc#
_rk
+/nh
x` ;
; 'Ul
q;2[
yK@-
Qi{-Fx
et"@dQdW
'dgl
H'N3
P7^Z?Z
\i<}
`Wh:
f[WI8
iJ$(%\
@<a9
;Q:+
(I,ds
x0Zt
.Q`
uy,p
] j(
3q+
x. }
ff $
|:R6
XC M
f! s
n ,&
rfiIa
6YI+
o9Q/
3wQQN
y] UPD
' Wh
[8]O
[5(#\&a
FV(m+d
4f$}L
8*)*
C\&n}[
z|7 'k
|Ef J
T]`c^Y
V<LaK
!*~#
\Dv^m
h+k})
@|EvXs
w>&"
EKi>
Rl!9He
Z!>=
g#b]HUn)
GW\BjI
UM SU2
N[Ez>Z
Ds?t
6D&#/
tTxjH
CreateInstance
>#\a
mS5Q
TX<= MN
%S*G
;y$Rl
,o`;
QRFvpk-
) c{
1U}n
NtN~NWNSN
'}E<(
ssv2
ZGZh
K$-.o
l7 ZT
`wkw
x4ah v
V- |
!G_5~
k Ty\%
A;Tv
SQQx
Environment
/zXb
H f=
o4WZ, O
D\JC
ilX0]
X <u^.
kgoy;
NCNDN6NWN#NbNcNtNSN N
yC(
|hCG
6VI6R
*kEyD)
l>&
a>$-
{$}Sn
xRO1
(xlS,xY
?w.?mMr3
H 1
mNc
9b?K
>nYC
<)>@
V5xy
;iA*v@&
bUY)
KdZT
qjFz
?K<$
Ou6@
Rzat
e6tx
oI#t.C+
k6I35{
`]RPEv
Db*w
L(QO
;oJp
;-2uK
xrB;
YfQf
f\ 3
CxV.
U:Fy
<.D=
\HPa
NUNkNuN3NwN
ZAw!
xx1
?r 7JF
5C +
iy1}
06=ox
(o^i
V 6
JJ]wYqJy
cb30
W]CD
u +#
W.+o!
emUe
D]L"
TIRcX'
T M;
vV~@
%e?'
}QlZ.
Jw$KU
g*cQ
Intern
t@)@
"5''
NYeK
i:s(
3T7u
1tE]
z%% J
N !R
(=t-
.%=JdX
lV=zO
PaG2
W=` Gz@
KPDZ5
6o{c N
~/PY;4zK
`XG{
cXfm
eda=
xv@v
EdM!
{ckQ
rtX{
bigx-
d,e<
RiXS
g]A G
=2 oJE
/fa 'ZH1
:<vH{
/7 4$
- jI
W2g1
ZGEf
;0>
Rnjc
_>N3
UHzVg
s:v!+7[W'
+Lk*
SK@,6y
>4?v
V9aQv
YUQp
],g{9
bakg
%?]=1
ie
Y5!I
Ej#UI
{AHm
Xf&b
PyA(#]
[/sv
{bN
`8|+
fzt4
TZ,!
t7W@
cD+
]o37>
2L}S
@7Rp
!.Bl+4YnRh
qh}63<
@^$c7g
F/K'
Q U53
LU9U
)km;
j _m
^o\y
*u]G
N-N7N
U%x
4 "#
R|X S
,]@j
k}a"
p~XvTBde t
"v|C
9QpA
S)w vx
m `A
[ nd
u[{
bY ]
fgT
^d?[
Bgpl
;\<g
:P69
M{$N
y}sJ
1|&k9
get_Length
!;!*^
lB&.}
1u/"u
0 u:
TY#S
wnS;
/t-*
x\1>
>9S5
}`2
58s])
>Pk?
'O4
B^T)Y4z
Ajnj
#a!=
acF@
@+~
U52 }
1P6c [
tir&+9C
0> A
$rt^+1
lUu&
KC`e
$p[]
4Ap
&'z<
>LwF
jN80\
=l|A
{>&b
KLFN
\9(B
;-)>
:i>2I@G
f%g$P
LA]0
| /gn
9)I
Jj^)
Vlc6q4/@
GP;h
$Upc
Rb|m
(ZSFw
uT(^6
Kavo_
J ruP
l=CC
S?uw
n}IVt
C4Nf
lKy(cVXa
f) 7u
H\\e
.Y+!
n<4:H\j
N5NbN
5n4o
-e6R
(i
ND44;y>mE
TAA
xy`5P
?_7:l
0,~"D
+X<}t
TQVM
> QbB
N$NzNENq
a0l*zu
33 r
P&0iz
nD /
SJPO
o4{tj-
w& kr
%>>|
EL!l
d(GHq{
4Kn-
xHCA
x92)
L%"rY
N>NRN NTN?N/NmN*N%N]N+N
*p=u
cOpt
<6is
SF4$
:m>e
{%_c\I
%D (
CallByName
2"<w
Io@E
z*Q
*Mqf
/y%r
E{7
zj a5
jjsD
eI(%
3[A#
tP(S
=)K
/SS
h)n.
),|l
,.NsNaNbN(N+N
W]ax
fMlz
xwAGn
ChSG
pV)/
eI(W
VO2%
$uB]6
/Xhc
?zrj;
E<} T
G_RYF
6\l8
@dr^
8S;1
sNO&(
6<`e
HIYs
zV qt
gQ[L
_Zt7
Start
>lUo
?f)4
{Sw.
vIy2
6WaY
iRH-
A6~a
k|
BS1[
KLY"
oV7V
>rJw
/uK h
jyG?
._Ep
%0>w
y5bp
g:~c
aOF&
u=9?
Kt+kJToaf
]F4x
dtU9
vi!ZYei~
Xt>,D)u
5)0x\
MOZU
po+3.
W'%4
L}E5X
nrn g)
F}oa
d5Xpj>$e
wM\!
TIIJ
t){2
X $=O
Q`}m
$i>1
SllYDC"
$9x8
%V\
Ku|*
\A9$
6 S
;=gq
,D z5
eR}o
<B{tz
MC~:
O<B
-uq
;QD?
cf q
(]n\
9va)^
\d)W.
ioBT_
yr(K
''UJ
'$k
6 >@A
J@NK
4: }#]
@7g`zJ
TSJ[:J
b"x&
E _o -
|-G"
&u\
jv4N
>@1K
T/cgG'
?jx+
f/Nom
"knp
fvMZ
kA.)r
G ,s
t@--6K
3e^n W
5aBLO
X|V|35p
8oV]Z8z VM
.kO F
Kon8
.X~/
o),/
oP-]
?e'D*
Byte
axi+7
Qykf
~9r
qB[x
e8EO
[_)IH
"WF+
|MbRIe
Ewc8
vm+7
&[Pb
H*N?N
J@ y
o|x@r
HM(>
e !Gg
n*9d
$KqO
j-P6
o3py
<#&=
_puKE
Z=La
C|kG
)G"c]Hz-
E|/
&.4#
Npk[
8&I^
`
{#u;
MYiD
(I>%X
Q?a7
~Z)W
5i)l%
BtZ-
:% "
_y=FT
dE>r
t!w$
}U:
wY$
50D|/
?x6
qFM:$
AoI
+'z0
pTZ%
\v[s?
7qGK
Bg'^%
1++
B9Fo|?
ZYI.
aK]?
6@(8
^A&9
9U)zV
gs"
'0:9
UAJiAc
RU]q
.resources
esBv
thk!y(
)SHRD
5:zD=p1
V>R R:
>oTB
fkT
_pfi
5q;4
mY|b
6 @
QVrK
x!j
mY|m
s0_t
17I6
=p>`
6=i0
h`#,
e.7v
CQ`O
t{J6?d
7 05;
F}/O
B(R_
!PP=a
swvB
--vi5
Z8P@X
V*cY%
VD6
oOh89
I79_
NBN N4NONPN[N
cI k
^d=%
hK G
-7ip
PN>5
U7#K
0!)J
vSJM
wdLTi
\)Ld0
@ani&1
} Do
O^*s-
^ODh
,2%
$ db
7<&&J
+HU}
H3q!
2%\i^
?\:t
z=2O
Rl^K
+Wx+
\K f*
jP&D
N;N-N
w>,
` w+
<J+%
id_c)
-B7a
4q$:
:]1\
L:
eEi.
D::=
eVZBL~|
? 2;ORU"
v'Os
{60S
2`@[
:]29Q
1&6fX
Db<M=
Cv-t
!J'Q
~ZAF
v(4r
9:K`
FMrD
!11B
6I;x
` s`UYoaC
~KB )sIV
(!lL
*jVV
gBd6
H%NxN
^F:=
~> M
|&-W
S`66
yeC9
YktDg
0`(`
( &~8
EZ`oz
6gNXN7NrNrN_NPNBNUNfN+NuN
0~-@
bzxV
*mJ&!
<M]v!
lx'"M
vE8y
ShsX
F` W
Znf^Z,
WS}Z
[WJ)
8GX&|R
<mC6
.7@&
aj}ql 3g
7Nz_!
ReadByte
Ne` <
\1#-j
*"m5j
P6sR/
UpD\
"SU\
6GMw>
nY*-
pk']
[y:Tm
'Y<3
N' /\
M %+
] t-
dz%Fy
XT1M
N N<NUN2NlN0N.N
e1<DJ
G08n
W-(
g}<z;
t}p3Y"
'n.kq`
]Pum
YaAu
IIel
U&TZ
5] m9
2/jJF
EP+,1E&
aIP,
n9h0
\l E
+)".
?9< c
S.-N
O$2L
F caau
&f][
318Y=
#4!`
D<SIdc
*\ ee
,-HS
_S#T8
v (QZIm
+(h(d
>XJ#
eDGO
%L Z
)5U
*%i H
$ "d
UJ%O
+T\<
IQB2_
S9xrY
/+Yk
aYSE
3V)Ft%
<18!
{FR+
' J+
0az)
Niu
3XBpfd
\P3/q5
B"{/(%A>
J~H
77&W
N)?U
QYZ]#
>*E"
BB(;xU\
T<SC
N~hE t
b%K&$
jtSG!
ZX.J
D2F^v
^/&~
:+FDV
aBMI`f
f?L^
}#6?
-V(0
t_vqF
69=h
cK6?A
`tct
e60C
19x*
F"w1
^}iS
y-?H
_wz.r
T UD
$Yul
wsM?+
BxqC9
_^Z`
CCag
*[iv
,f<D8
@3;b,
SeL&
4nUv'$
n eGt
g%j~
"xok%
&$q]
ZM^J/
j ?B
5pDS
U E
Q}-Z
jm-w
k@?c
VG.#Q
eQa5
fM`vG
^ b "
-)'g
}>G7
E4k$
W)2[
.m">\
#V@K
EzCl
cX"j
)JQC
T}r=K
~n?!
>~Kt"O
E.Uj
V3v:
)7&F
]sz)
Vg;r2
T2~&
cg2-K
5tt|
W})O|
~dP*
, .>
$:[KH
u%%4
D^\h
\)I71
*:,^
`O#EH
fwp]
Rc4@
N~t4
L+a
y`|?
;2Bw
po6W
fl<
k h]
KvKj:
k c3+y`
s"Sk
(E2T_
op_Equality
+<2_
~9PBD
ABT_
^]2.
hlbBBT0ZUUFEYd
NPN'N&NHN3N
nTe$c]
)F5&
bJ2A
j0+n
!aJ
[-B
lH<c
[R;
W `D
W A
vdkiVBKhqtEjSDRIv
UULOLx5FYEnQGq6B
m KD
w!Wj
XKj.
d# 5
x7,12U
r@d%=V
_DhiJ
AN{s"
5"{3
?>&l
U.Q?
Z/.*|
nwS7
DteC
@]0S
~bFK
6 ?
cLVB
fODs
!#qH'
}8X#
EZ"S
sO.
6o#J
y`ssY
< ^n5
N=NiNUNRN
3 o'
y:N1
C2AlV
R?,3*
Xq@+
pW!h
@"$3
\z5%P=
xK4)
b0 h
t<5a3>
P~e`
<Rc5Y
fI-Ug
{/O$
w2{`h
}>b2
erMz9
:b<n
:XPkERc
2%4j
get_Message
qI.H
@_uQ
_C\KrYa
8: fA
.bJ$
i4Xb
"+\N
C #D
7]TdX.
Fe$_
L=vj
itswY
"g!@AI[
`Lk$O
cI"v
+W(h0
1e)X \
l0Dv
u/DE
gz@yz
gYnr
lfS]J_s{5wS
Ahe`D*
+g~u
jY32
3U&Y
jg3>Z
N1NdN
D#I!
}GOr
-f,}$V
M|,)-
X=Pz
uE>KG-
M}:K;
%9P!TI
r 'u
tuwj,
L-j++
=Q`?fy
FPca
:b1~
3*OHOxh
9kK1
BSJB
yn&$
(76
"]y>
Fq8,|
~UUf)
N^NRN
ry ~
qa=1
91Do
]1n
j Z8
ue7
e`vV=-}
Ra{6
=< pynz
|A O(
r<e]q
k !;j
8|&k
KMDO$0
:"`&
0| L
<::3>
FCy>
1Tifu2
,GKHQ
StEl[
E$|A%
6HT?
(Jr!
f "PtF!
$"0mb
I:Al$g
*0&q
V%Ew {
9.t/
8ZV#
xila
M _w
tC9B
eI{i
v$Uh
%qAXd
z !
^O]H`
dVBm3
A'_\ d
wE.x
) %<
DB]}
w-H*
Tmuw
SqQo"
5[ S5
*/l1
Ru{#0
l] z'
.SLV<
vO'W
YJuLr
f,_=
>UU{
CiOq
IX1kq
P%e Y
K|hB:
=!#Mt-
95m2
#\5c
KFP2oq
9B'
>m (A
=bl[
,-N3
:E{r{
RGlU
9L}i
zT Z>
2a6J
%aFt
31;u
)`P3j
X$BhAK
b mSFX
H]*@i
6CeY
/odS
LNm%
gTw"E
'3nHj
]qh-
&2X
TiGn Tn
(;N%N8N_N
T ; h"
rnZ'
YE 8#
] 2z
1;ok
<y@p
%y.| <
:8tBl@n
8;<Du|
[ sh
l2C+
2~wWf
"l(hH
>:y f+
*t~1
rN(Cv
'*7e
*woNQ
(<qP
_@ e}.
U0v'
O_kG
zP@_
~qo9J
c-nk
>w2G
"i+h
CallType
zh/ep
{.svX n
(zsR
r>F5
PEKu
oD.W j
7lIS
'UMT
UhL4
0yym
pZ3pBOQoOBbndXb4k
.F,&
k|u9
$g! b
bvO[M|
%Es J
k}2[N
|(Ewv9
ru?dj
pxES
zqw!
@v*8
Hg2RZZ
]MK&=Wc
$ $5J
$$gNl
Y_r2
@W,VB<
;g;amf
0v\r
{AQz
4! >
i|\BO
{IVn
2 s
M)o%V+
qR/ld
HpF`
1Qc4
l)tL[
uEE?=
9[d<
(;n.<
&&2l~
%&j
Z1l
w Y Y
)r7b0
%"nW
v~aw
..-
t`j
grA
Z@W\
W\z2
RL\j
#zdj
i.!e
`Iv#
0Ah4,
EK$WF
xLf b"
#9)Z
QxA}
= (
"`s:
6 1s5
N0B
I]i=
&cK_
S3.)
A?12
9n+
4LY;
`d K[q
$]OZ
Zb9y
TlK8
: ?t
7sTW
UANlB
u %<d
b/N`
d$\R
:zi5E
b,BU
6XD
O V_nZ"
)e{A
ZEv~\
tm|r
(4&l
,tT?
<X8L
r+
@t%(
l7Kdy
E4B*
|+`U1
Gg_ek
)ax![
nqKr
xo04
t8NQZ]
Yf6|
I9J;
74VQL
ILt!
WX^g
QCL.
3oZ11
Arvo
"Gg+7Q
xp#]E3
<-=hR
ZoZe
[ I
xl+>
"L}AX\
b=r
5\y0
(nit
>.Pn
H Yd
5ZSd
Fr3Wz
e,-^
9gW\2
`.L
Q7n<Aa
: r=%msJ
]}BvzR
A*Lc
F1c]
YDSu
T+(v`R
NZN|N2NIN
,L #
{f2r
zB b
9)H$r
mIqu
qr:-
#k R
\lk-
+T0N
,#[&
!uEonr;
')`s
{P(H
!jEo
0V@:@E
iL%6
Ku]T
FeN3
*BO
2n"#
[m?|Vh
Cn iy
?5
y`]t
'FS_
3$$z
~d{K(L6G
r$x:k<
M O[
?)n&
5.`oxP
X {U9
NWDB
String
o^$5
OtmQ
E:?1
^/UfZ=
,_5sj
n e9s\
G-beC'
#/:n5
n VI+
Qh372
#I,r
2GYn
InitializeArray
gYw#t
NnN?N
yY u
{TLE
"N}nM"
4<ZX
z(}=["]
\lEefum
IdhB
ea}Mf
DSm(
{fV<w
VY3zn
>:7b
\-^_
;K*HL
m?g"
4Ekf
sO4(
@q a
@Fm;?
Ez5~
7!!v7
r,q1
tZ8S
YzB]
x 1*?
Z7@@u
d) A
nq&{
wq3v
-*BhM
o$Dz
yyI
AC#"i
NdN|NTNKN
]FC@
2?X8
/X_k
p8Xy
h(9>
CP Iu&
(v0#
kPegT
p7yl$
@c6Zm
`EuJ
t)R
sxGo
SF2a
xW l
tw0F4
AI}"
[ 1iD
HyeUE
N\NzN0NTN
xe '\H
B{IVa
xPeL-
Hn,z+{R
S0,
abRX
ew?]\
Z#Np_n
(\$/
TO1
Gn'2
f] 5
>,b$
rb[T
P a=
o 7
A!1:q
=tYC
f|X0
'Ycf
QO:6
RuntimeHelpers
tX3C .
FqbA
F[TO
+}?9j
44W2UW
<%GJ
9q#&R
V[#K
On 3
uWs;
=l*u
1"4F4
BgUe
X>@vs
d78B#
cJ6
CUup
Jq\o
s |9H
fO2U
%h%6
u DV
Object
l [a
IP u
S^Xp
lE<8r
_WcR`
k"C7a
*5D+
wJ5m
@tBI~
Q75c
X(>.y.
V(w]
98G5
.7U/
W\R5,
-?Oa
7}}>
*!z;d(?3!
FV9)0
{N3K
:C7|
*!N3NgN)NgN
[?{`2
\Q{7
' HV
:<<n
Iv6g`
eDK`
%u2%
=Fwy
]6@>
*(:\*$B!
u~:
Z7$7
NAN3NXN
{;Zo
m[wF
Yl0e
S9q'
<*xW
(n6e
?DdV
-*%o~
35RX
|-q
lhwU
<+TS
E ]y
r5EP
nI] D
s'Pj-
v5}&!0
UZ K5
U:D8%j[$
tD
ESpM
c1i'
B_/b.
eB P
9| ]
Yqt/Q
T *5r5%
QqpX
HbO2
}L#^=
qZ` E
}SjQ
Q<UQ"
}{kd
F&BX#S?9
.mcG[
:'c1j
;;,H
A/Q#J
C dE
g+m3X
afJP3Jo
rVHv
W0sfH
Ll,5
%>h:
M oB<d
,c[ h
8C_+
#-Fg;
4K )
[5D|E
57\e
,v)v
{kaX
<:x$
/1I=lJ
Ce
{Y
hpB-
/YIr
vU6W
3Cy
z s
G}D
G!|
`CAj
I?x0
z12C
>o/No
0l-^
Cyve
9 (J
n5oi
FZP@
'PR @V
q)p>
9N-tp
Mh KM
H8)t
0o*-
_5wt`
bv=d>
4W>l"
`O8b
8&!|
JCRJL
N0@"
System.Threading
shQl5
XYxu
L`(
Q<@e
|h>Ul
A'V
+VO7
ZvFx
({pGx
,(A
.#Ct,
V,JB
5* u
@q~z~
3TdB
c@^W8
IsZ.
eVCa
$=X)ow$|
IAz'Ey
tRn5^kV%U?#K9I
oSV'$
"H4:YQc
NfNvN N N~NbNPN9NzN4N
|w t
GC|EO
iW
CNcAj
{Y{l
(ODU
}?`
E/-sEU
"*edb
#XgPu
{F);%x
xY W
~5lX
p7>s
etF"
N7a`'
xA&u
/+3V
! :/
LgHul
wyf+
UgGR
z>%D
Np+k
zvk qWC
xqd
l M*
NPW3B
A6f}
c7dg
\AAg
>TT
#( ]
M@+<
4> J
t=E}
9 fI6Set
;yh
PR6L
, d
JJ_S
N-NHN
r:d!
:;R
Ycs\W
R"RC
N4N"N
;3Da$
+bP4
P#+ac
bM)&
?nUWu?
=y('
>n6;
h\}L
|dA.tMm
'*Tu
m Oe
l`Uj6
Xn4p7,Dr
Uf_L
c\J
b(<<
2c/X&
H yf3
B^0.U
4 u1
zo-K
<M/JX
}i}a
(@'}
(^ k
kfK w
[|OGA
6X hw]*
Z+2SW
;F k
NUN!N
%)uU
UH*D
[89m
NbN|N
W?>@
'K8bU
E@ "
+#8#
= p#
s}mR]<
z01
$f!P
/}WaS^PN;
vk
>Wo_
M08N]
=AWR5jE
NtNMN
6u\V
daOdJ
i&rw
E9Dk
"=q"
.t55)
>%4mD:
OJfZE2
I6umr
wpp_
GetTypeFromHandle
|j{9K
Wo=M
x,ZA'
%XXR##
^7=c
F D
J6^$
pP*n
7Z|R
B n^M
?W_0
v[Ip0?
' 4x
4J e-
$% 3
D|>tX
@[k-
wTM0
Fa+e
MtGD
>y!@
aq<%
ql*U6
7dR1
2|Vu
O+{4
VU;3
AQ{7
aS{ N`
]As
s i_
&;;:
q$2d
;Er*
{]T^
by[x
e=m?`
e0?=H?
B>J/k
P3Wh
p8ZU
HtS>
Ahjx
@k^
LArXr0
D)}5
&\v\
_1A'
System.Runtime.InteropServices
V5:H
l4\4
3 &c
%"b*
v,IaG
%;T
w*xf
^p&S
TT 2D
W2s_
4C!|
"xZ,
JG!P
%e6;
V#f
H9#q
vkcfX
0%(a
cf"m
m1l_2M
System.Runtime.CompilerServices
ub%OF
D)}b
W_/gQ3'
gW^w

w#Jd!
BVX,X
sZ\X
-!\"
wKiIH
*@ $)RA
OP\ P-
V J=
9r@\
5{_'
.S {
QpVX
/FN~J
:oNM=
Fh*
.#R!
J=FR
]vkvg rQ
]cEA?
"Y6l
;?`l~
Id"6
H6(
+|!5S
{rH,
u\|],
4>{ PC|vCN
V~Nj
vs:Lx
[hKZc
#[jz
?TBd
31R
0=<! !
Hbbc
B* r
+p.m
exaJ
j,yJ
|Wm,
2m.?
Vp0^
`"_Tt
g&Rh
j,yZ
+y;
@>568v
Lu2Jd
t;4y
+Jla
D=B2
v> T
E,b1
P*83
a!''f
tOj\+\h
K:Ca,
ODm
iy2E
:P '
!D d
%oO]
1,&#
=* \
$CFxL
/-U_
_I,r
G=[e
NlN NTN>N{NBNhNBN
NpN*N`NjN$NcN NHNzN
^kK_
;nz$
,gqu
NfN:N\NcNkN
~DWxY
! GG
8V:N_
xGhC
r%dF
'KeDHl^
!2f=;
'S| {
EF%
o Y+
!>{<u
@dK+
?uEL
q]PuQDam
>pX5
vyaq
zF_L_*B
C}xj?
DM#]$
<U
sC#z
56k>2r
*c2 `
ax
)ip}ek
Efs9
]Q;_
B@Jm
J tG
g-z=`
S,J1
] xP
+sz0
4 W
=S,n
x\0y]:
.1|s=
0)|
LCN<N
JD.G{
kp]~
u<(T
9-3x
%"jG
-M X
NZN)N2N
zY>z
=\>
71d-\
T|>E4PZ
etK
{{;(Q
'8.)
@I1TLi<
tj"M
DL U
$$+dc
.P,0
].G~
b5CD
PQR.
NEX
34 Nk
@Tjg
SSBK
D^F2
Encoding
.PtE [
;\|vr3
0yX.
]ATB
(RE|
&5{D
h3'Z
IX1#
get_Module
NwS~c$b
7d;cCv
(Mi>
?K54"
<JF+
w!
-&7[
<cBw
G #\
f1O8
?hHR
8o$n
POte
k^+Bm\
(7)M
}[7<
Wl6*
[!Bx
;|6'w
%\)^Mb
~{G[
}U>}=|W!W+
0BK
f*7d
2{tj
7oDU
;+wT[l|
$Ix:
I6juB
s;Tk[
\Ov[
0DUO4
PyROW
Kl`.o{V
+HeJ
xtl[
by${
tH}x
aiM<
Tko3
O?:<(
`n;r
8WfXN
rhmP
%skQT
[@RTz
mw/&
\bmK
OAIE
/zPj
1p`]r
Fx6v
s0,1
q C<
\'}q
C?G]
m(1G
7u.f
rDNV
"">
^!z[
;]o:
uu#R
ICsHm
>.Xm@
^Su
M'Oa
E4L!
r*3E
ixa*
:Ic]D
T<vD
uuL=
V* f
ln::
!Ht'^
e?R_<
2>[W
g/$0
^ \6[
U$j7
:I3P
whNu
E>+A.
lc[W
*Z.Z
$ca:
EaMp
K>S(
JZLb
NsNGN8N)NIN
u*pb
jI "
T^e}
H3y_
iIy?
d"Z{|
%N Y@
cYcok/IZ[l
m10
#|*G
D s\
4aE`g
,G%D
8%1}
u}iTd
4>L7
:h0s
D<dQ:E
0+Q2
M=6Pr
>]L?
jJ,0
E.)8TQ
CE=0]
Qpb4'
I1UJyk^
.G$<
Z!y).
_okI
i8 E`
q*j;
&ZlE
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven06_64 Seven06_64 VirtualBox 2018-02-07 01:29:43 2018-02-07 01:32:39 176

3 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven06_64 Seven06_64 VirtualBox 2018-02-07 01:29:43 2018-02-07 01:32:39 176

6 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\nnewnewcryp.exe.config
C:\Users\Seven01\AppData\Local\Temp\nnewnewcryp.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSVCR120_CLR0400.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll.aux
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll
\Device\KsecDD
C:\Windows\assembly\NativeImages_v4.0.30319_32\nnewnewcryp\*
C:\Users\Seven01\AppData\Local\Temp\nnewnewcryp.INI
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\Microsoft.Net\assembly\GAC_32\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_32\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c7dd43f20550205c8b37ec91b5f2bec7\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c7dd43f20550205c8b37ec91b5f2bec7\System.Windows.Forms.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Windows\assembly\GAC_64
C:\Windows\assembly\GAC_64\mscorlib.resources
C:\Windows\assembly\GAC_32
C:\Windows\assembly\GAC_32\mscorlib.resources
C:\Windows\assembly\GAC_MSIL
C:\Windows\assembly\GAC_MSIL\mscorlib.resources
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\*
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC
C:\Windows\assembly\GAC\mscorlib.resources
C:\Windows\Microsoft.Net\assembly\GAC_64
C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib.resources
C:\Windows\Microsoft.Net\assembly\GAC_32
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib.resources
C:\Windows\Microsoft.Net\assembly\GAC_MSIL
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\mscorlib.resources
C:\Windows\Microsoft.Net\assembly\GAC
C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\nnewnewcryp.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\nnewnewcryp.resources\nnewnewcryp.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\nnewnewcryp.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\nnewnewcryp.resources\nnewnewcryp.resources.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Users\Seven01\AppData\Local\Temp\it\nnewnewcryp.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\nnewnewcryp.resources\nnewnewcryp.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\nnewnewcryp.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\nnewnewcryp.resources\nnewnewcryp.resources.exe
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll
C:\Users\Seven01\AppData\Local\Temp\RunPEDll.dll
C:\Users\Seven01\AppData\Local\Temp\RunPEDll\RunPEDll.dll
C:\Users\Seven01\AppData\Local\Temp\RunPEDll.exe
C:\Users\Seven01\AppData\Local\Temp\RunPEDll\RunPEDll.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources\stub.resources.exe
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\msvcrt.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll
C:\Windows\Fonts\staticcache.dat

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\nnewnewcryp.exe.config
C:\Users\Seven01\AppData\Local\Temp\nnewnewcryp.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c7dd43f20550205c8b37ec91b5f2bec7\System.Windows.Forms.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c7dd43f20550205c8b37ec91b5f2bec7\System.Windows.Forms.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Windows\Fonts\staticcache.dat

Write Files

Nothing to display

Delete Files

Nothing to display

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v4.0.30319
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v4.0.30319\SKUs\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319\SKUs\default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nnewnewcryp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\NGen\Policy\v4.0
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Servicing
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-us
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-us
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\nnewnewcryp.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\B60E90A6
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|nnewnewcryp.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|nnewnewcryp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|nnewnewcryp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\nnewnewcryp.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{3697C5FA-60DD-4B56-92D4-74A569205C16}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_CURRENT_USER
HKEY_CURRENT_USER\Keyboard Layout\Toggle
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Language Hotkey
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Hotkey
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Layout Hotkey
HKEY_CURRENT_USER\Software\Microsoft\CTF\DirectSwitchHotkeys
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\KnownClasses
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-us
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-us
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\B60E90A6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Language Hotkey
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Hotkey
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Layout Hotkey
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

Local\MSCTF.Asm.MutexDefault1

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
clr.dll.SetRuntimeInfo
clr.dll._CorExeMain
mscoree.dll.CreateConfigStream
mscoreei.dll.CreateConfigStream
kernel32.dll.GetNumaHighestNodeNumber
kernel32.dll.GetSystemWindowsDirectoryW
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddSIDToBoundaryDescriptor
kernel32.dll.CreateBoundaryDescriptorW
kernel32.dll.CreatePrivateNamespaceW
kernel32.dll.OpenPrivateNamespaceW
kernel32.dll.DeleteBoundaryDescriptor
kernel32.dll.WerRegisterRuntimeExceptionModule
kernel32.dll.RaiseException
mscoree.dll.#24
mscoreei.dll.#24
ntdll.dll.NtSetSystemInformation
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
kernel32.dll.GetNativeSystemInfo
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
clrjit.dll.sxsJitStartup
clrjit.dll.getJit
kernel32.dll.GetFullPathNameW
kernel32.dll.VirtualProtect
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
kernel32.dll.GetEnvironmentVariableW
kernel32.dll.LocaleNameToLCID
kernel32.dll.LCIDToLocaleName
kernel32.dll.GetUserPreferredUILanguages
nlssorting.dll.SortGetHandle
nlssorting.dll.SortCloseHandle
kernel32.dll.CompareStringOrdinal
kernel32.dll.SetThreadErrorMode
kernel32.dll.GetFileAttributesExW
clr.dll.CreateAssemblyNameObject
ole32.dll.CoGetObjectContext
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
clr.dll.CreateAssemblyEnum
kernel32.dll.ResolveLocaleName
bcrypt.dll.BCryptGetFipsAlgorithmMode
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.CloseHandle
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.GetProcAddress
kernel32.dll.WideCharToMultiByte
kernel32.dll.DebugActiveProcess
kernel32.dll.WaitForDebugEvent
kernel32.dll.ContinueDebugEvent
kernel32.dll.DeleteFileA
kernel32.dll.IsWow64Process
advapi32.dll.SetKernelObjectSecurity
advapi32.dll.GetKernelObjectSecurity
ntdll.dll.NtSetInformationProcess
ntdll.dll.NtProtectVirtualMemory
kernel32.dll.GetSystemInfo
kernel32.dll.VirtualQueryEx
kernel32.dll.ReadProcessMemory
msvcrt.dll.memcmp
kernel32.dll.WriteProcessMemory
ntdll.dll.NtQuerySystemInformation
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationA
user32.dll.GetActiveWindow
kernel32.dll.GetCurrentThread
kernel32.dll.DuplicateHandle
kernel32.dll.GetCurrentThreadId
ole32.dll.OleInitialize
ole32.dll.CoRegisterMessageFilter
user32.dll.EnumThreadWindows
user32.dll.GetFocus
user32.dll.MessageBoxW
gdi32.dll.GetLayout
gdi32.dll.GdiRealizationInfo
gdi32.dll.FontIsLinked
gdi32.dll.GetTextFaceAliasW
gdi32.dll.GetFontAssocStatus
advapi32.dll.RegQueryValueExA
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
dwmapi.dll.DwmIsCompositionEnabled
ole32.dll.CoUninitialize
gdi32.dll.GdiIsMetaPrintDC
oleaut32.dll.SysAllocString
oleaut32.dll.SysStringLen
oleaut32.dll.SysFreeString
user32.dll.SendMessageW
advapi32.dll.EventUnregister
oleaut32.dll.#500
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
kernel32.dll.QueryActCtxW
cryptsp.dll.CryptReleaseContext

Execute Commands

Nothing to display

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-02-07 01:30:18

Detected family: #Malicious

TheSystem Itself @ 2018-02-07 01:42:01