MalScore
100/100
MalFamily
Barys

werdftyxcv.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 19/66 Related 2060
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 323.00 KB (330752 bytes)
Compile time: 2017-08-19 13:10:29
MD5: 23ccdbf6db957beee15afc7cac91b27d
SHA1: 6e872542c7726c27b3d5d694723cd32675a88cbb
SHA256: f03090824debd7525a4380fa84e0c2a8b7d8cf731aac673743e23d5500e9b846
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-05-29 14:48:03
Last submission: 2018-05-29 14:48:03
Filename detected: - werdftyxcv.exe (1)
URL file hosting
hXXp://thehairhive.ca/sql/werdftyxcv.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-05-29 11:04:03 [19/66] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x4ffa4 327680 64b2ddd5e1c9c7bdf867fa84f60290a8 f1255e874c374ba9ff7ac205680091bb936d69a0
.rsrc 0x52000 0x648 2048 5759e595cb3330cff7231e324e86e62c 1c5bacbc5c00fe1ecaede0a63a74e1272398e3fa
.reloc 0x54000 0xc 512 b461c78c1f4fc978231e8860b8b16e96 0ece9a6f1028aabe03ee54fa08d165ff07a39c2e
PE Resources
Name Offset Size Language Sublanguage Data
RT_VERSION 0x520a0 952 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x52458 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 AMR Corporation
Assembly Version: 0.0.0.0
InternalName: werdftyxcv.exe
FileVersion: 7.2.18.1
CompanyName: AMR Corporation
Comments: q3bonzkhdoz
ProductName: AD certmap authentication provider
ProductVersion: 7.2.18.1
FileDescription: AD certmap authentication provider
Translation: 0x0000 0x04b0
OriginalFilename: werdftyxcv.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
7.2.18.1
URL(s)
No URL found
3e0e0885-95b8-0e
AD certmap authentication provider
VarFileInfo
Comments
f9200961-8a44-520
f9200961-8a44-521
f9200961-8a44-522
f9200961-8a44-523
f9200961-8a44-524
f9200961-8a44-525
f9200961-8a44-526
f9200961-8a44-527
f9200961-8a44-528
f9200961-8a44-529
f9200961-8a44-5210
f9200961-8a44-5211
AMR Corporation
q3bonzkhdoz
StringFileInfo
Translation
7.2.18.1
Assembly Version
2018 AMR Corporation
FileVersion
Copyright
VS_VERSION_INFO
InternalName
000004b0
zL1
ProductVersion
FileDescription
0.0.0.0
OriginalFilename
LegalCopyright
CompanyName
werdftyxcv.exe
ProductName
v6,
l2m
HDF5
O:C_
gh;
n>*j
#o1xd
2 $SY>
K+U7
di/w
Uef(
~'M\
2%:)R
:kjr
F@`{|
qFZu
PNG
!{dc
n%W,
K>r
si*@
e5 K=
WcJ4~
@N7;-&"
#x J
1nNR
92|_
.Jo|
gK_+
~E~
*R[vx)
-pR$
P4 A
=*`f
mHu58
WhFAH
^cr-
&w-wx
zn4
8.cm/
T:g8
G\)G
/1j#
$oA.v"
rfu2
JU7\
bg}%
1 &yU
ON)i`
4U/x
?_f
B`nds
nxI[Db
oSyj
SSP&
mW&Kw
sff?
r~F :
u,1`b
6/;*N
<d[Av
+%Nz|W
[r>y
9] o`#i
>6f6.
'bammp
_>U RE
U.~"
#%8T
p %@
!)j^
AD0w
jub:T
oVE(U
WEPx
q`wC
oBK9
Bdr(
-DDq
h c"T
4h?-_
\_UO
) s)R
4wwR
COS2S
hD5.
<_Xm
vVCz
I,[-$
s9!!
0PCj
` [y
m 'f
f?9!i
T]re5
c[c/
% Bx&
m rx
@K@3hEVo
i|XVgm
##Z0J
np9=
pN
_A+ .6zj
?MC4!
|I@z#z
WKh!/O
M!a??
9*)1
Eo56
'~b
\~ }
'p ^
|[}L
gO w
xbWt#V
P]-e
u<~!
-aRD9
P^+0T -d
cmKt
P~X4
'#~PN
!20e
w(L.
{>*}
6HEW}k8
f[o
?_7E
0[].nT
0%*)R
f#4U3
]]e
^m$=
<O&%
Ho8.
I rySr
jy$(
%&:g
xN,z$
K$[:
"0#V?b
,gH
p4K_}
:1G
RuntimeFieldHandle
f!i?
q2ESj
SPPK
pu'r7 b
v7 L
$_)L
N7(J9
]GN`
$wn&
.$"\
_Type
QYb^x
r-VU
mh\
}_nA*
rt]R
-_ 4
]Hp)
Vj_/
V5
oM@
U(H}9
4}|
C)WU
|Z:4ZBvi=
= (Lh
8W k
4\Ia
k6'XAS~
Ufnk
P`n_
r(:HW
kaFr
*vL%~U
0zKa&Y
PEih
X~hK
eoVU
_=0a
:S $
Qrg9v
c'-9
%/H&vF
$CI!
>X p
C{<S
9jKv
$99&
{2"k
2rLK
;R%H
H<kc
CO5~_H
\`LUT
l(+~
Adu\
`jR[
7'u\
/34:v
-Wt^
Lt;~:c
X]YE,
m tu
9RgK.Y1,d
O~N9
)Tw}
Yvy6
cfn
">;ub
}+k<
LGq)
|E >
0R*QR
&sO<
{<lo*-
w =9<u
;R2z`J
$*,N
{0C5
(Nr
\w-=#
Jm B
$+K0L
(.W$
_\~O
R|Qc
?*oD
COe~
" S@
Y$ztt
;aqC
.M1.
AppDomain
Z3N"
#;O>5
dvo5
Wyw<y
E)X
{"(,
):{{
CALa
7LE#
'NtU
) J6
/"6C%;
>(0Y?
NpkDU
NU=/
Ww+Y`
- wN
OIUr9
]9;o
e=
CH kRD8M
0`8\W
vLYQ=
Msqb
2O,cD
r }a
8*De+
PP+-
P)-?
m2$YR2
)IrM-
;ev]s*
a} bZ
UjRMT
8H|c Z
L`H[
|)b`. J
9nh$
w?&i
+Bn&
-lTa
k^Ib
wn,}
8 GyH
U!`q
.yNZ+
Kovy
:8oh
2]?p
_FC]
d]p]
YUH07A|
&563
3z9
,6/GT
} ~k
9$5bA
9o2a
5m
Y4fY#
FnB
p[2|
5c: ^]
Pow +
#"O@
Va` i
' b]^,
u{E+
?07\
F R U
Y/b[
{__a
c7}~
Yt2u
o&?#
b!QV
id4n_
m:^^
Y@R?
KC4B:
v%w
7{z
<UBO`PrQ
\.*o
Z?eQq
K%Q;
S+1#
<^^j-
7j6G^Y
jOR~
bnxs`v
8vaI
~ Fw1_ ^
,v"]9
EFn 3
>$*U
sYg;]
y7CN!
CompilationRelaxationsAttribute
~7e-.@
k|kN*o1
v| b)Y
EFrm
+XoJ
Type
u0kk
sTv/O
T&LY
cddi
X# r$
z$zN
^C%V
\::=
YT/o$@
~bKSe
;rkP
hv?9!
v:m\
M4!^O:<.>zktg%
22j-
ukST
efHkjj
aN#kv][
eX9S
hrP~
`IW$
O,IP
,f} \
M]=s
T{p.
m_ ?
bQprp
S/~*
eUA_
5/dB
lnw
@(,d
^1a9
`~&eo7
* n%>
IR-N
s5Ro
o+z7q^
7=f
H s"^V'
K}M? ;
<->"
D- B~C
y.AP
(hbp
G:vv
) ih
&($,
T;X%
fwwm
8T*2
k1](
O wt
ZYox
G}9u(
cX$Sw
String
SH_r
*<dq
s=v^
}$&w
System.Runtime.Serialization
# s~GF@
RdRQ0W
aX@
T$u/
7 Qm0
c<yI
Z:Zw
##yc{6
~cK
cf44L3
^U:)
>jcT
JYlE
>Ts|/
:.AN8+
y,<hK
ID<BB/[
x,w+\W
HO'Y
v H"eV+
%w*!-
c6$#
hQ@J
_p~.
Go|p
4Km?
<H;8>
'jz*^
TI@$b
tOw:
0g*MR
@c&$
@A1C+
+A E
`' ,m]
`~DK
39J@0
TOsC
Z+J2
+ e b
`L!:C:3
yn14J
|E+|
q[VL
/=y/
gHPWD
_+)`?'[
^:*/|
@. )Z
}!?/
?mB=
j|c[
dog?
{ip?2
'j``
t88C
2a?H
"H"y
q!Fs
^hj8
'uI&^
WCQjg
V35:
uiI
r d@
QL9f
.jk3
7gxsG
QJ!k
z)8^
.text
jUqt
:R4$
ZX7x
c R|
Y`zNAt
(dGJ{
m h8
ICJi
H+ix
|0gk
Q0 k
sj6wX
Xy;H
5}S)Q
USF:&
6qtO
Gl>E
l,Vq
/h^V
9+) b
C~*$h
Ea0,
; tf\
YC6G
M>z`
anshC G
qIGQ
'Ghl
5<GS
z-P4
6&v>
"p w
|qV9
LAH0n=
^;(
R {2
8C~[
a| usL
q M2
)\@#UHc
$m[y1
cnRHdw
oHNC@i2A
au$O '~
6|R-
|=#^
=1g/+
$^G1u
$(,
?n5y
uRC|
X*U'
y:t-
NYejJ
LP (<-
vs E
W9 T:
]($V3+
{\CN0,
Iu;i]V
}LF+
n' m
-O9
7Z w
HtS
_:~p
lR5W
{d-.
4O!Q
UHSF
;O|
;&Lw
SH#=
!8 `
a`rX
GnTc
/~+d
rrHa'iM&C^
/}q|"
.:<A1
H d}
O=mn
8 NY
:cP
f&MV
&*J(
8hPq
\ "y
'&R
IE1v*
RuntimeTypeHandle
ER&(%
TWGG
1BP~
s h9
6?a>
.A*>
JsIr
; pQP
}=!
D3^2
;;nv
`$qtj
+Kt
&A<OkZ)h
]TnX
} 4Bvy
`.rsrc
><U~
'H@FD0
SuppressIldasmAttribute
,^{%
cd{9
#Schema
mlmi
c, 6
xSVBLaI
*ZZ'
gI,O
4+|$)
e y<
9:lR
EG|2
cO~
$fb53b0f5-86ac-4c9f-8ebd-ecc1aa8014f5
g!n]ZB
7"o}
eR H6
3p4u
? ,
y-a1
$: 8
yS\0
6X D
=3{J
Zc=X
,Lu;y:c
(?B<
/~?K7e
K7O[
|GZ,P
K=DP,
,HF_
f~ H4>
{]<Ak6
%qH9
$*1(
_CtI
bK-4c}(c
+Dcw
CMI
X:pg
pn$
|w&Z
,Gn%
6UPM
RY}C
'G8pr
f7w?z
Zcet Ie
*M{ <.
UdA
? o
nl.exe
F plt
Fv8u?Bj+O
hR d
f~.4Q
x*g\S
wVE}
,XAS7
k~[Kbe
AS%)=
3;hm
?~)K e
pv;y$
.kX|
Nh[$*Rl
81qh
CT@#
KH
m9.m%
u3ASH
-[s)
>sk9gL
P^(B
+L$.
*XxZm
3KNI
hx>X
0C*)R
`Bvuc
9.d}Z
l}k~ZK
+<t(&
R~2K/e
k3?y
fp!G
HB!>
f1@e
_y&
_1ah,
o8K
axq/
&)|AS
gcI
Rnj<L
vn4N
AbZ"
UA7 hS
{4>0
QZQ.
d1~G#An8
ZbFU
*Y|r
42sr
*.4'1H
y 6(
DqrR`
V^Cz
{uW|
NKW5}y
K0sk
S{_g
&47;
L :6{q
QQyJ kw?
upAt
A)f7
xWm-
GP3%
RPwK
$ H^x?v
"S> g
x1w4
Jn.;
P!f=
lU8-
System.Runtime.InteropServices
Pir8
Do d
r'w/
1KFh~~"y
}VEWi
Px`z
jvymvE
Ou)?
l UQ>
M*!TOo5P>tk{g"
DR| v
l,"V
@)TW
r:wB
MN&s
l7i`4
8"ZS
26\0|q
O }]s
J6A@.
Rw+S
2hB -
m +o
H\BZ
Nb
1[y
ucEl
^{?
cN_\h{rXetar
=%!3
KB7U
g^`b
#V(#Y
x@v.
hy%;
RRu^
6!Yeh
b:lo*-
QhxG&
Te~C
=e{HR
c1zw
u/"r
'`[I
R7LK
wjO;":
K[IU
3=@E#
c][@
j@tF
xy5`]<^
WrapNonExceptionThrows
^r*~3
&, g
?x'
,p%VF
Append
\`hn
Rb&c
<0U9Q.
nf8 'i
+{H6
*A*@
8#dMRr
$f*4t
cf;
T in
6]X3
fzsW
LYd 6
X7jZ$5
$q>_5
"K"t
}ob4E
-K[,S
=A]L#Y
NI5a>bk(g$
.ip#
@*#+S
QL^a3
xf@2
/2^_
S N2
k cPL
CG3y
_~cm
I.NO
H/rx
J#S&:Q
68AV
h6p}DD^
9-hi
Tjrw5
S|@[
5E V
)q}!
+{H}
^tZK`e
IHDR
d I<
zrdG
B$~\,
a\b#
JuT%
Y(ay
xA0 f
&o w
~&rR
G:cf
3'V>}V
w7&_
g7 V
$>"
Tf.Kw
z/b=k
rP*vK
")kU]
n6 J
*:^qk
*(/)0
!xdK|F
C0L3
~SJ>|OV
0 2~}
J6.N
o]sF
!u"h
System
s.r:v
SPc!
.V(#
C.L;
E26i
}++
#2T8|
Oo1cV9E
*K8o
BN}^v
TyG>
g_?#
|H!=
u@C/
}2%3
sWxZ
+wS a
pv:i2N
TyG1
AZ0Q
8IzFQ
%y@v
,L6
>T+M9
%n0)
z{rX
(tg0
!ef&
.JQ7
t-o4
KX%Sh
u6K k
2^ zG
z[sN
_(pF
3Ah4
2[w
dA'Gb
a4CC
"+Oj
]6n:
mkYI
Qa-iv
MethodBase
R\$/
$jPRY
^kS%
o,*$
5U ]
]2n!
M1o*
]@no
_51Tk3
EG6Y
98<j.W*&
S{&
Q_*kU
>NSaW
ZMB3L
:xSK
h>,"H/4
0%#)R
Q! x
hbUW
du4J$
^[D=
[im(g
to9_A}
"?QZ
0EwG
k;gI
gxdJY
6CSg
DDS<
R%D)
kG<a_
8?4d|
sN v
1C/=z
5-tC
= !s
/%t_P
n07g
:*d#>
jEaX
zb`e
^cR-
X'R
~H/i
1CLE
grf4Ab
3P>O[
s('T$
QJ;,j
)}fno
[dPT
e[21
,d#
Mu!cOr5h>Dkyga
f<Fq
@)}@
iU:A2R(l6
g ,E
[P'd
I{qT
;V FL
t(g-
0s*SR
9%U#
M}r+
wNf,
V3|)
R/n)O0
wn $
x;/"
m:jv
EpVaM*u
;dJ1
GetType
cHZ+S
:I}:
KR]5
J&x?0~H
Gld^
]>/m}8
0@*AR
"+?$
3wRVb
f8j'
u+`q
$+@[+
Zo>V
Pf+ T
tVrI
$3=/
@ ~B
<_O`
01zqW|
ex^VA
o08)
VU"e
+@ E
0PF
*6?o
\o /
pFZn
M?z"
e5 h
waQE
15H
Ugb=
!6S/
Xd-u
@K5
~i`:
{O ~b
CP:
t=*/!
kDjR
:g[z
5~HD
KPw8}
A,{kT
5#y I
B0%,!z
1I)y
2hr7.
io)/
SX2y
Jh=LNg
VAe
e7dvK
2d"V7 d
vERhE,
cVdR
&-Sq
K(5-
2).U
3~/8
k]#'(
pJ/
Sl[&v
" !yK
h=FvES
RMTohTw
xu y
:8G0
~@ P
yd`]
iM
cA\[`
7X Sp
KJ'=I<3
}9~.
bC#eA
Dyi,
SD<2
kg@LE
Tw.B
R ^1WpX
c 'ab
sC@y
G7.@
V40/
:('{
$,[|
i%z
B,d
B:Cm6
.ypS
";'Jf
bLFB
LDu6A&mF
:KYx
&b|i
sl ZJp
cI OAJ
fxx7
2< aA%
- xU
|af?R
f5H%Es
m\_L
- #
k0Gk
7SVQ.=!
k!@|
\ }BD
Hp\'>L
Fw 8
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
\#[Dx]
DWD
1zQZ
M[,l D
#LY `
7B~C
vl*b
"V"u
n@Z*]
k~ZKbe
cz] Wv
W!ha/
8J +
j =!
Pm-^
u jh
>Q&/.sH
seQB
U(w*
/Hi
"PE
c}yt
',[A
X[Q=
PA-{
d8cc6e1f-4d25-83.Resources.resources
HZ?c
^b7Q
!D ~
sA:m$
[0hr
;ttn
6fK4[3
lX8qD
oiy$
D/4LUj
/w,L@
9r U^f[
/6*9
G$H;
6@@
F?\weK
?xv!E
K+&.
+Ak=
\l
Eb7Y#
DgB8
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
e63&
0c*QR
IJc=T9g
MVG+
M'E\
YAy$"-
j6$-
/!1q
A 0d
v V[}c
8Q
~}tC
h0Zk
LM =I;4
vqJBxiY
SldM8
t7IC
]fQo
PTD-T
G0bP
StI'olJ_
CVzI
f@`^
=_Z7
."(t
A=C,
EAjR
@_DP6T-
1 {1
^H}
CTFz
>Wqh
rX#P
~~&n
eZGn.
GFp:;V
;/CV
Wo|-
InitializeArray
Z(b*
F/<D
~Ol~
29l{
^Dvg
/vbfX!
iJUk
&D4W?A
[ #}
@-[\
Q/d&
VFIx
;"Ut
}ya[
=Aqp
#Strings
Z<h
#) [
-{o8?
_wd|Q
N](d
](G"
g.$P
- N{
(@ Ky
c_&0
PRV=j
W\q<
6GAY
60Kk
3S!u
JN4T
Byte
>w0
:Cbc%[
q 5"
'N/:
H2\D
Jpz2
MCAo
0&(jI=,.X"(
+ %s
Char
xvJ'
TzeU
t/~.#@0
N\5v
e%ja
}NC3+#
>F%T!
P1iE
GP)v
WUh./P
rL-
TCC9
0yW
Yr{":
M:yE
5Bob
)1DF0
g{9
H;)R
Gn '
=;=suJ
@dOe`
Ae2
kScX
.Wf+I
hzW1
K)m]d
x`UL.}>
ValueType
rsR~b=h
P/pm
GuidAttribute
;)BaI
6 #
,MR,
!m"h
xf R
gi )
i9Ym
i+Z$
Pdm
BA}
Q]s)
+|O
c d-
ONX3
i3f=j0
/ .r
c d+
T:bd~
U/~*
N Zj$
P[P/
U/~,
P[P,
D+24
\9
_^,
P^+jTU-d
PCP
%Fbj
!I[
D~/`
<}F3@
y h3V
e9xuy
`LmQ
,u{hY
v^N\
Ip qa
<IY4
AT0`
cKz,
)RV>
wqmw
+,4X
uf\.a
IEquatable`1
~gpkjA%M
#A7
%_ D
x$1?
YV~}
09aUG
A(d>
R$fb#`
Q@A.
!^D%5
)u+g
{BdWW?
4w|i
W!hp/
"Xd>
EW\
BGE'
{$It.
FoG>
-3s\]
XVh}
\/!u
Bdiw
dfl(
G CEo
}t8o
` G%
:xE=@
/bC.
![yH
FbFzV|
+ VQ
`] 5
]6"]U
zbZ5
gFiz
Gl '
5W0_c
ToString
GRk&D
piXd
|vkBP
_G;@
I Kp
>;v
Bc
8%0
=PA;
Jy0Z
i+M!
Tirc5
T6Cy
a[,:I
B /n
ljiS
7ht&
TDGs
iIt|K
=&d0"
zyXW
P+^l
C^ f
EpH
R/mg
$qa
}A
RXdY
oQhj
*V@
T~ZKbe
Y|Aw
f '@
5qt_
YaCW
27zi
- 0.L
*'7\
^:l
qkc0.&d
fzcL~o
KD#T
^8=`
DeDbn
Q-aRD9
$+kd
T\|l
>Aa>
I.8
P -
[ !cN
vBdK
P3+:T
/-[
.}#'M}m
WbXN
Aj5
HE[/
#U|L
,q].
GTz}
' f@
XsSy
%2N.6
.cctor
9n7 2
^I~N
_2>KS
LENRY
02'
0"5E
p*]4
:T \>
=8t
v+jEw
n^<u
rA"C
l' \
(GIA$
xAPx
'Kl8
DJeXg
cKhsSN
P5PX
V:nT
:q\c$N
fB1J9
V &zO
Y@Ler1
$D%]
948+F
+/",
3@ZNj
6B%Y
4-C.86
Ah&h
\q[,
T' "
j -qy
0EwG
*qxe
y@2B
\8R&
dOc?@r}n
z/Mph
z KU
9Ls
)7Tx
BAdy
JcJ 6
IDATx^
]r4HO#y
VA:h
UQ2Z
MJ1 DI
3X=E@
pY0<
Data
eP5b
J"a;
jD-.
%tjsE
:/N$
L1Z
);Ms
3{[eb
&dPbG%
.o!=
NIr!
2cD D
%6>
sG=i
N5 S
7 |_z
Ts,Y
4%{]
Baw"
>hVmY
\N&+Y
~d\
8d(q
H^~|
Y)2R
A8_F
Pcw!st H
f:A
AwST
pHYs
.ctor
k|. q
&V)O1
A1P "pQ
bSxe
+-*4
(+#1
U)1`
7#Om
| QdS
]"$5
EO\
Mnb|C
nds a
[036_
jO:4
=z @
PD3#VC
x];<
P+n=
]Ah`
tx j
F/Epi
q {7*%d7.
v|re2
i!;z
3H!4a
V O4=
9 &2W
Invoke
8:d=0R
>{1MH
w' \
nPW$
FUX~
?fk48
:-N#S
W )-\
FF7N~
b,/$Q9~L
D-3r;
tM%O
_<-
Tf)M
2^Yz
\ uA
GS}QG@
MM1I
KfM`%
[yR>
& (y
A247
f8D(
ZWup
D]S*
rjd
xO:J
;G_Lz
) !4
15ZM
Hykx
Yh{)
z=G"
Zg{Y
RuW7
^ OaN>
7:Dm
eeUA
sa85;gh (
\, u
'&\
\N %
){0
cD<G
iy6`
`lf?ck
l".y
_opO
zUW-
SWIT8
qd5a
<H<\
^Q1 4
TMG=
hhE]
bc}
)hGw
`{Jv{
@.reloc
@F1"
Gqj^a
50>Nk]g<
;sh*
bBJjP`
0Io]@
F Y0
T"f,
&iQ_
WB,1
{Z|,
3$7%
Z+w|a4,
*3?
TOY5
mguc8
++f&
Ml8MP/
0f7w
m yf
+>$5
U:26}
ZJgK.
|B N
vD{6
A"q:
X9,gA
&$Q
0c76
"1Qj
H2gA
Y1Ph
'6bQo
GMo=
'ua
4Z7
< oh
$46Ytr
4/b1iBI
a<Fs
Gz
%/dC
9p3_
\ ?X
k a-
KVk'X
1^og
go|^!
@);9
192!
Bpb@
NfWwJ
d8En
}|@m
@A&Kb
aPyk
4jtW
$;!\A
z{E<
s[:g
Eygcw@?
-pqOs
`VD=]D'
@\,mW
Y 8]
EuzR
K(?B`
{T|f
|D4L
Assembly
G<d(1
NMaV
I(6hZ
ra d)
/7(H
7u} /
PAK!r=
AK0E
WJbv
R0wv
@LSg~
'vAc
BQSF
$# E
K+}z;
?|qZ
E/_3
OB<d,
`U@`?
7 oy
uk),{T2
8f(4]3
dyX(
>-1C
w2~/mcI
QF7]w
nhHAt
hi`M;
J'Kmz
|!5~
" ",
E"@5B
B~ a
[O`A
*(Y8
4KUkg.
)$a
WEGb
O4{
Pq\l
Awl=
Cvk~
[MX_
ITe3z
]7k'
}Oi$Ws{
{J6T
SWKA/
3 h~
DLEGR
=}XW
E}29
:L2kR
oauA
<ZKP
{oz
krr'J
4 E#
kUGT
(|w@M
tl9)(
axgN
&!<2{H
S~b&
&*EJ.
) TZ_Q16Fcm
$- c
,CV "
"1 5c7 t
Ns"
'&\hS[o
9<O.
V~nLV
3Ko`Si|
vb Ad]
jzw;`
seB,
\kOZ:bU
S;r9
\^v6
"a"o
oX<oqmvG
w.,N/
xt=-
l *Y
v{X_8E
0R
2`.9
u [2
:`xz=
[T/~+
^(@Y
2cfO
6h'
nl+(
A|On
O/B#
9n-0
Axrc
gu/t
'U
4Z-:!
`<i`
RI*Z
@RSU
,[Jv
Ft(t
XAS7
c`yg
phVKQ
(y~y
'+D$
Jebq
c>R3)
:45%
cZ3+
/dY
_ 91:Y
kAbw
]fno
]dn|
# SE
_{~?
N~t ^
@%d)y
jxO*W
8~J" hK
.C$5mo0
e B%
VDP5
'7xT
Xq=)
!O 6o
N\;!
CIUJ
u7pe,
:Tk}
LbQ7
T"EF
#<#.
ASFx~
q|4/
Y pE
H XK
Z~XZ
`b[&
<APg
y}g$
AW0.
hck?%
M5!VO_5A>}kXgx
8S3Y4+
s|ZKbe
?2jI
:CW+
$QU
y@5C
y@5E
Emr'
C79h
Sk>0
Tw!#
V['
l9[+
sVj}
WCrI
M S<
5v =:
p'n\
4N<&
6b7d{
Hc&C
get_Version
gZvC ld
8w
[.V
J o#
IS/-
_I~O
'pu< ZIQ{
#GCM
8c
>^Ej
YO|H
(}l7
X m
h5;x]
ao2[
9~6K$e
9euh
ed~=
=O"=
A{n>
$.51
0%*)
dHI[
GKye
[<R~
!WOX5d>lkQg
Of2!7
#Blob
\[&Y
r$h
0$9$Z
$.TO*:guPb
kY50
*v!+
DM* X
P^+jT
"Iq0E
..Rs
\hT*
2%9(R
?2;c
' Kj
Cj^X
c/a9
f 5k
;Z&*
/(vR
o$m=
"m"F
~/ x!
5hu\
YIg
Dm[VT
J:%0
k:nR`R
zA<'%;
pw}b
r^R{\
_/a:
4O Y.y=bV@s
?GD@
3t; E
=q/
HS@'
fK4{3
! }p8
*^|X
c8dJ
Zb /
j)a%
gG\XF#J
pG;J
B~( \ <
$5,d
/%h%#
ThrI5
pjZOf
oC]z
j3-F
_Y~O
QI0?
P*BD
{FOK
W+*
C>WD
5I0DYz
y"x0
{<";
13oez/-
v[um
d8"k
p4v<
6#,/T
'|^7
:LF;z:
!L3AA
.@(&
sQX$
K(8)
v{RCdE
pRCn,
H~+S:
[47J
gJMZ
5&0X
' bwo
x&9k
m|Bq
P_-k
Pu9q!
i>uB_
Snko
P 0n
WLX)
1'l n;R
v3f\
$ E ]%
TOr55
@^(WYP*
Nr%-S
|k{D
g[ 8Y
5P8@O
VX(N|&
X4J
:/z@|
' BF
cudi
]9=!
\!)g
c.dOMI
ghX,
xM9@
3 cd0nL
Y 82
;x;7^{
L^Fi
``bi
ABKP
Z;:f
{r`o
9J ^
Y 8.
#r)g/
9h/c
N ?9
@ *N
-^?9
-CiI
_ ~
4uRP!
8 nN
W #8
@Q-~aRr%
w {2
! ss
H3+M
6:o
J Wz
*[4/
D{ T
7,1O
5;quyRk
LYL7
> n
_Rzyo
!9;S
iyH'
NIFE
A^0z
NE []
8>Iw*/5{
b8 a
1R7
;N+Q
@KE1
0Tz}
b:l-ho
<Module>
J<pg
o::b
*1_.LQ
5Bi:I
Yju#
Tb g
bnw,
.zTe
! _U
'&L
m)GQ
"WS:
RkwM
Y 8B
W h{/R
@>*4
|:nv
.8YpR
4D>ln
4-4s
i%#k
>;Ef3
RAj`
ui >V
6O l
hqP(
,RM<
=J^
n Sgs
P + T
V,}Dj@
=I=O
G#?
7jN`f
V hrx
@.\o
m1u^8
!'n
G5s`
Eb*q
= =y@
0/p[
^_y9n
SB#.Z
1.0.0.0
I*x7Tf
$Pu3
gb t
,O(g
HC 5$E
:06 :
ktPVJz
NX"I
O8O4:
hqPq
W5O-
/+\$6
#Sl[
9.OH
SaL
b"#(
~ EG
#~<K
N_;O
#9%4{`
q]Fj
u\`X
MR"\(
+Ggw
eVl
rMu\
VaQ2E=f
gAMA
=Nez
N+8hq
W7)D
~HK&C
v$BtJ
gwbzA
F Ex
)w$C
0]e"J8
]cdn
VeNz
YsP}
MarshalByRefObject
,M{ <.
YoYA
}QJ8m>
c [aH
O$ l6 g
7Wrd~
6-g>
>]k8(
6=Di
;y> U
2z*z=
nJKy
qM8u6,
bS)D4)^<j
JI5$
aGERm
M)!XOU5n>ykwg7
$!FT
"d"\
f%Zo
KA9)Z
6p6
}Q0b
,v-w
' 2y\
*q$ld
M S"MV!
L7"t
"u ]-
K>@?w
a\Q?:
*F3E
{][9s#
~!-"
q<!r
!l D4,
5U+R5
by%E>'z
a VL
-u,CjRd
[%#d
_i~}
c^W l
0!`U@
L: B
KVKu
WpHy/0
"Rix
##IZO2
L 7X
M8m<mS
p \^
$7E '
$W B
Wy2n
F=K-
<.R-
x^>.
&"L+==f=`a
/%)u
;5;[z
d:>v
c\d|
L_xQ
VAgA
+dF$H
J4s2
z8_!o"
Y <-f
?q ^
U?po(@?
|n&%
]BzQ
<SSm
26^NC
W_@Ir
TtsC
System.Reflection
h&YQ
1a a
a _1p
*%RO=CgiY~
e9< e
6]_'v
b=i^
T[c]k
T^P(
cKy!
x iF
DHE%u
.kbP<
R~!-
-=O 8G3
t3tKa
c9K~I
/cr'
/fQz
I?qbW
V%8si
,?]#
Q4?
pu[\
IYak
O``M
40r9
=-S2
TN_(_
W;#yw
]j$X
3a v^\
klmk
Q+kE
)kh'
\K~A
+sD
O@M5
-(
rk#
cTTX
UNbi
iMZh`UJ6
>Sny
OE/c!|
XUJE
r0Hk
=|-h
:C*I
,EKQ
b+ix_
LcDCM
y$ z=M
WPX"
0) ~L
RfX)
sVH}
ZUA#
R'kw!
w |
\<Cn
I1I|
X^j9
1B } C
UA~*
kB|+:
-2_
Xjzy'
=}(*>R
TcG-
&9F8aK$
ocq_
%h(]|
.#"=
YE|VW
82}r
-1^mKcf
Zs,'
BWIM
Kn.y
}23A
ZFcC
+}$
D.S\7
r(H>@
EGhPgl
IhCO
g0FX
*oOy
~]k\ w
[$s K
={ k8
m<iZP
w<tl
<|"=j
`p&^
$x3JT
k|j
VT~+
~+(9ZZ
.C(=
4!ZS
81QhU
K]yX
79mK
Kd ,
CfLn
wisi-
XMR>
<U{>+r
?~g{
oHJb
TV :
0|tm
w J>
_rf>
6:~X
rKlJ
hqA
RWG7
h%u
r[w3
q$jc
f8`i
'HtT]
[?^LM
+r=:
5VJ?~
>!CAgy.
yEx
%:eR
V 5sSI
}NuW7
@g!3
4"gN
.B :~|
4 _2
G3h*dDt
g0"k
vb |dk
9 k+=
|j~G
I"4i
GeJx
IEND
N xB
%4Qq
V/D#
6.k
eu-r
P#rd6
o8*[
6C61A2AAB9DEDA384120B3D6595C214F06494695
M*!kOw5y>"k}g
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
2k=V
Fl ^
cN7N
".*I/]
="S8<
^JYo
]kbW
rt@%
X )o[y
iLaF
\H
U}~Z
#7?J/_
0*PwAzE
ge`~ D
Vt%L
8y)
!Dr
~D|2
>LrB<NPm
-}b7Th
mscoree.dll
!This program cannot be run in DOS mode. $
Lg;y:
q`fC
MJO"
u rm-x
$=A*
.c(D
!L,X
LTo;
XRXDr`
UK~y
(;0 r
l$Mm6
uW 3
Q3O&
8Pb
]#l
!r.=
7a{ 8Q
Asl(
)!8
_pSDB
m+us8
l{dx?j
~ mK')A
aKsG
a}-'
rx&&
}* !3
eroG
W-fKB9
)) V A
!g}x
>t j
L~ p
(W4F
N1Lh
wKJ<
]ono
hO,d
[ s"aV
EaKy
ycO4
_TKu
R!de
4#)s
3dSv+_
gx|
j1,f
xX# r$5,d
T.aZ},
%jc
U_ |"
NcfGE
tUe]
&=^:Y
h;
/:*?
Y cO
GB K)
| ,":
(aN3Q
0dloFS
%cI&
_@[:
1/ *{
`*@$ 8
l_#~
TjGY
mXAS>
#GUID
s*G/
1f*o
'm3K
Tb66
g} J7
1}%UF5C
9!Iz
*+q9@
S 7Xd
D4r
C"\o)n
' b
] ;L
(aR{~@
w\ y
iixex
_(Fn
Krbw
BSJB
lV#g
0!k1
0 =a
XED
cN,7A
ER(7+{
p]M^
rZ!l
0-1J
c `D
TwGY
"=lY>
O-2
GmMF1l
o!)u
C'Qb
pL:w
c r
gbtC(e<
=6WU1'
M 4sz
q%WY
Gi9jS
~fE>
>d26
'0Uh<
?%()
,W*3
(<l+
y!iq
<O JzWo
BBGv
~Ovk
> `[
J$~b
X$Etr
/ qt
Ld/#~E
'avz
l6FW
ZPZ
gXh,
X*Fv
}'&.
.k~ZK
pC=CCf
q`I}
h $
s`nPo%3
;$q;ka
1$#)
a 3IO
aj8=
=5_9
FgZ3
o{E7z
!_z{L
;LRP
!e .
V.X%+
M; 1
F~wjc
?.<K
{;rB
_bstc%)
{;rE
Iy C
GetDomain
d0?
N{[v
'zb~
6e14
Fc58
AlOEC
$ PF
K 1@
?B9lr
SY5a
jER
JK=KR.$q
-Wa*
Mgo|"
q%t
0D*eR
b"Wv
C,cD
LwhR
P(M%R
H4:R
R'$/
E-_:uK?
b0Kk
z$,g
4:$
5F; _i
P d"_V
JnTt
zu`(
WSh5/o
A~ dp\o
,w`g
${qro:q
E_e7
wGe"
2=KY^
e%/X
'|jD
P5+:T
K^Hp
]-OC
\-Nt
HQS
e'L\
4c#`0
(jA<F4r!
,2%;
>;\p2kf@
z''\
1 [b
;<AX
UW~x
A|u/
t5>~
1 \8c&
$,-y
u"Lgx
k~[K
#Pf]
:,d]
gk~h
+.Y5ci
]&lD+
#zzs*
VR\"
IDL$,
Hw,k
CUNf)e
vB=B
JXQ
.$(w
.$(t
.$(u
BGP^+
gmVV?
AWhq@l
e[LV
UA )
cPI|o
|0~7
LMM4M
O:?,(
KF
mQuJ8
P=*jT
R%Oaz
@`85
?X
P(7$r
0{q`$
y@
V\Ta
``_lUc
8N7m*
WG pP
b9L{
oL<,g
{-;Z
2A >
Bg<O
|^;r
`tq2b
R/gl
O:|s
O/S_
mx0'Tv>
A1 DT
g_vO UdK
[n/
gg7(
!q`6
cav?
Boolean
az!8~
X]X
dyk
#9s
|58t
p2(hA
fg^L
{F3C
ZoI|
C -J
I0tU
>A2t}
nE,oZ$o
)cl=
;|,|
MethodInfo
?f^4.3
PhPc
6|hN
QLXA D4
:VS[:y ;
H9i_
rmjUhK
y,K}
9]/za:
sVg}
k~\Mdd
kkXErj
{ g.q
x:)Ikn
ELCt
q.@R
SJ J
gS$
{$%9
A265
']R
<> A
UjQ =
]I~T
B3=\
"9"x
KSN9|
=+:K
c 3
aA2;:G
C /X0
U&,z
.fA$I
@=k^
p!Y]A
vkGZ
.'$8d
aE\]
K6NY
=K;1
=` D
C{C,"J
Cb%
7oXy
{>PvZk
)ya[
,c>e.
ooFI
%mC$
g. F
FLHF
2}_+
MN!_O
T~*bL
A&0e
dcC3
eIz3
&B1&
h}2p
,oIy"
i!Bv7>/E
`ky
\gon
+tjR
0vq!w
\gom
=XWG
gq i
lyBC
>XAL|
W8ea
vVjs
fmx3
0 v/
msuv8
=_|NY
sx\g
AX1Sl
9&(J
?-L!;O:5
Tr[Smd
1?p>
get_EntryPoint
D"f(
{D*JQ
7a#e
TTSwlA
R%Z)k
qV0d
VU/:9
cI#?
`)
8OE
,q-NkV
B=f{
~,S(
0"kAwE
C6 !-
Do|y
B ?F
0t"94
%6Dv8ZZo
rvq'
~8w1r
GN8/K
v '"8V
xWAf
IpHH
4. @
YS\d
f04/3
) m`
.A_{@.
M4kP
2f"
(V2I
(1,!!
03RZm
IT7tGO<
Wih0/r
EKzy$
YR_d,
]-LyEx
_=cv
M'.s
r-D De0,
\>(
cQxv
W ~\
)y&#
({|M%w
$X9Sx
*{1u
v !8
'uA b
Ew/u+
\ CI
ESFaZu
Kob
Yk>L^
?e*;
jBYl
@_1U+
)Q~ yX5^
& %=
RuntimeCompatibilityAttribute
LcItSo
Fm\\7<
+u E
a-.`
@=33R
J;1Y
&Ym>Fv@
xb/e
\ <y-
m6jW
";+sd
k~ZK
DA8d
TVoI
`'a'
%8u
ZANLm<
x9'z
>Jji
d 8Rj
0r8"%-
#Z\NV
o9wH
5>nO
61>B
L@2K
1Aq_b
&%Qm*H\fWu n
@$Qi
2FDC
Jq5
6U-&
J0~
*REe
#+0$^
FKw
UHiu
Ulez
Ihd.
QZJ9
4R3~5
}`5
/ py{z
tjsE
.~K
Fx*$x
:V=M
ECZI
,jTe#d
:j k
0uRL
"Y95
zjX#X
O>J6
\[`5
1(eC~
wpiRr
Fmnt
wKf
nIq
YyfZ
r*%&
;w31
"KS.+
9UBv"w
=9`pln
/f7
P| y~Dd
dtI]o
y|Z1
$,-yS
gsva
,DC Q
K ,5
~
fPW$
@6+(
vh5
\Y|o
.Gv*#a
M2:7
mwvH
kLb!z
/0J
AssemblyFileVersionAttribute
6:b9
'$bIo
mscorlib
System.Text
:3 ^
;!V"
Array
gwH7
\TQ,
;~\
oPR
CbNI
ti pox=h
1QO}
fqpL
n Sn
0yC}
1 ~E
rIr.
DC&I
gbw*
8E+q
{H<s?#
G<nO
"J]"
_c]q
VKkkjj
fPs:
r3z V
H[7 0
#tmjC
m:7O
V}tH0
qr:_
DqgvF
kKHT
[bmGG
X# r$5,d
0hQy
D978*
b &k
)k\9]
YGI$0
Mu!tO 5o>qkCg{
;OqF
=I"j
h0]
[b'c?
wkGZzb
%bi$
*[~>
UZ~a
J.U
X] 9c-R
!7d+hg
#Jk4
CN)v
_/)Mc
%qt.
uZNM
/Uij
:KC{
zpO(
HH[1A
||D[<8p
JU$cL'
OO/q#
WnbI
f, ?}
-a&Bc
@smH*Y
P^*>~
@<%
J 7@
o}yX
@b#b
d C
(}E*t
4+f#
Fz c
t-r'8
" V@
L<-&-
D&kO
IV(d,U
,' \
8qn;1u
Wk~
8sDix
9Ba[P
)X ,
GVF<
?k?Z8b
MwXY"
&K(OP
:w1g
gov*
\G^#O0
n 2@
1-<E
)^4A
AQR-)
T@rj5
g +B
Q{_M
c9yB
?SSP
^"aK
O1$Z?
)+kp
b#F'W
VF[#
PA@U
4zIwh%O
_CorExeMain
cO-j.
AT0)
kEqh7
={`]
T$r85
H7Fb9
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
,e>v|"
$fs5
c\wg"
-OXx
Tvrb5
JD):l
]&t 6
\fy_4#{%<g
+DW6
U~~`
0W%X
r=3,K'
T Tt
wwB;
.oC*A
]o=yA
\WFJ|
rK$@
"}^N
: C?L
lnno+5
C%L-r
H~!T
ETm]
@7Jg
$(3H
Kqok
|Wo'**k
-yj
~OR*
F#BA
cKXF
<fi4!3
M@vIfoP
(p }
cOdD
90|D
+'&0
MLN&O:3(
,)cb
X$It
8km$
EF")N
1b.^g]
yvKB
<W Mq f
\s{:
+, v
Lo)y1
{. k
r- 5
Environment
a +b
tgo
&5'}&
ax[shhs
VYJ1
Lc4A
~-s
-$`)a
a*Le@H
zszOn
S gbdt
g'v\ Ad
%%#H
gN?R
Pb-+
-%Sz*
cyds
GJ 'O:?t6
#.rt
]VZI
_B&F
mjq,
^Gj8
"e"I
]f%./
f\4X3
c yw
2]*3
8Q<Y
ZW pMKXqD
IDu
s,>9
Load
tQ.
US^ h
c!yC
?LB;x:l
u3fE
(W"a
j-ScKy
w8}=sG
l?YL
P^!R
xbW
@Ql 3
"%n@d
w}L>
|& B
S&P
ml]s
Pb-i
"u$P'N1
I~.X+
Aq0w
WTqHn
: f0F
j k"gVv
J-,Q
mAuS8
A.9b]
PZ-,
!Bk
Kz3a
t]1F
-yN#
<+xu
UR_)M
CHI
'',h
RKMdD n
mt~
FZ,Aw
m$= p
W lQ
~Wrq
&SPHM
".rm{,
<3g
[Jcc
[Jc`
"<"4
I6 +
fcE4|oBH
VEReo
rP E
IX%u
{/#o
6NFvAU
#Q/Z
PyWe
P=Pg
NlLL&
z||:e
Z^DS
dGU7
_i&XP
18C72B62DF4D9D39E9FDE7EC6423BB46A8AD3EB9
13.R5
Fs!p d
6)0bj
h`"[3>d
1#6$R>
")jU
RuntimeHelpers
&GwjQ
U<_%
s.(E
CKRi
N/zg
cC/\
i>qN
K_T
~taK
?^Zje
RrZ}
(Otw
_!VX~K
^F3-pGe3
[u}s
l ,S
vm nd
4Fu4
*!-\
M!! O\5/>Tkng;
m0: s
E)Vg
N$dt
$ &0%
91,w
a ]Kb
/mkH
~ zB
0,X\MR
-y_v
ST\Z1W
F+c~
:Z\
as J
ja3Reg
w49=
jxa:E
M*~@
Object
/XpE
|lOc!~
6*%my
9 <ido
seWI
qVcI
;MVx%
W\]=
X.B(
]qno
n&]O
,M#\
ComVisibleAttribute
veUL
_Y9~o
hV:3
y F
l8 d* =o
2*EC
pG(z
YIrO|
XOR'J
ge98l 7
f9koJ
QA sf"
#/mf
g~Foi
p',<
jvX`
kv*
c:~v
H1qp
J',=
O)X
UJV
i hl
v >`
DI]u[P+
_3'cP
5/8@
5XH'U
{o~fj
oqK~
hi+rG
J;fH
64a
j*2
ML!;O:5
t#I
wdR#
~'fM
b?\_
W=ts k
\! 2D
)Bs~|
FCmO#
-W0Ns
cAUh
k+%x
r9)G
mv!"
(.eDg
Fss4z
)>|A9
*! B
zO]B
-&!w>
\M(S
tbf0
oORs
\}^n
lZ)U
>I\I~K
J0Fk
mduo8
\iOYt
|xy+
nAv#%
s+ZC
aQ-b
o{hO
n?|S|
(rOo
1 6\
@")KFD
Z0qOa
[7UIS
W K-
2.$J
F.QT)%
w &i
~@{V
T8G
XABL
z .0xz
TmrB5
ccBd
)cnC
P^ #T
@;0:
Q$n!
0mpn
h*7K
$=V@
NO5up
iHNW
R}&=
()+F
]~>G
PZP#
bn!<V
H0lk
"85\
n2z$
zhV.8
GSPFZ<WV
2!gMkd6
y>y
AP y
Q[3@
' by
'j4`=
jM #X
K7&/
G'bt
c:Kb
lUS4q
jO#/#q5
>MW
1ZsK
o {6
%{$2wd2
Hap)
RH[Y
b e* %n
z[tJ
gfv*
xI<C.
P]g"
2@>%?
rQ9
f!U|>3
\i{,
I~Jd
=>Vs
@6rH
]Qn"
5Z n
GP4
H]z b
_q x
G3#|r
B@D]
azVR
S: 6<B
\4yj
LBw+
#Vgn
UG,-
f_4)3
-I O
5 m62
M[#*
Y>IjxEd%
B6Gl
_}#Wq
U"C
F1_5
-?=$*
]jR^n
u"2Y}
2];4
A>sw
Qk3t
HkHu
<RU2-8
|)o
V<_b
CRM2YJ4y
>k5?'`T
jG}8?
`t2{
?uor}
qY+;
$a$,
R+jP
~1liB8
nY&p
jp8Y
=*~M
C+>"
5Q(7g
zctL
t%#jlQ
{ d@
lb P
P <8
1[!/
;3ap
+e2kS
UG~A
$j Q
|dsG
/h?-_
,U*/
]>i98
Y`^a
IGE
e7!;E)&
fwYH
l+~g)
[Xq-
Jb=/'
\lY
rV.t
%vVc9
M:(T_
hoSrn
{ `9
$Dtq
e6Km
f`Dy
455~
GKF&}
s+$b
CILR
b4gFo
c-vk}
+?|n
vqjX
v.bl
wz7t
N`FAb
c&yx
tVo8E
WF4x&d
wiG)
rW!$
+[GX
pKI0
psi6k
s9MlJ
[bXH
Ut$[
twpue
HJ'c
;:-<
k1+h
x/4"
:/$*x
du$+
%x y
2VCe
k+Q+
W hy/
agvE
I,O
}%D)0
70/R@TW_
U;Jg`
2I O
ZiB\
^^jC
'wbbo
yVyL6
ojO!
R5h
@fI<
~A"v
`EtY
J>!}2
;8 c
+1`G
jXIc
Id|>
MC#
l Ji
[+@,+
v%n`h
2}ew
ioN2
$gL&
@K$b
L@;
yj[}.%
Z:~iY
f=JC
~rFi
$;Xj
Z ]l#
^Tk!]
R>V!d"
}kFOo
1X^z
u G8
;VJx
Ld_5
T5 T<
f&$@
FgMu
4QeM
]gnn
o7 3
g6>r
Y%L)b
; :o
;V{v
685,
|}pg
^<%~k
V/O2Y
ybD8I
&(qdvU
P{Jk#
Gn,K9
BtRb
()*%$
%6LLk
39[0r
`(&''
$QDe
Mr74L/u
g|F/ #d)
< Dc{
\Qz'
#[{~
_rDb)
rWYh7
9D7(
qwB
P:e3
6@ufN-1
1IOLJ
System.Threading
M{ <.w
< ^|
/#<#
get_Major
0%"}
.)_
h&:}
3!L2
$ wP
VA:;
rc '
\WcA
wGb,
b-dm
bIg_`'
U\~I
r"Tp
$7%
B K'
8U(d
6_/<
F:su
[ nE
9@p#
;+:m
d2.Gb
[~/U
v2.0.50727
^XVN
!~Qj
$1NZ
UOFG
|9Fe
7l1>
aj~-
buq
yN{0
FJo;
L"w"NCM,
dC'Gb
BRHV
cmgXc
Si60 ?g
>p[_
H ."\V@
OO>H
5@Wu
th6Ag
!vL<
x8!g[Wz
o] r
LFFC
enI2
G Df
Z<k(W
ISerializable
MTm-;
mgx"
:Feb
+M^X
*nwmX
78qA
5`23e
l )w
xp) 6
X1Zh
w"&\
w68D
v@Xz
< {_
kL(/
0\*)
+.G4s
L$mO
FHok
v, PpI
M{ <.
s)Ek
`vvR{
pUElv
@i D
~ 'U
u&Ft
LFP AsT
gt3
zxr\GM
zwY04
Q3SX
rmM=6
5~xl[k
7| -
FO4?
+j\}
|%VV
<}:U
nZ[^+
M9)h
1N \O/FS
1w)me8*m,
U?x
Xc7Z
E#/+
e,jx
kAZK
d-UD
Ah\V
`YP?
rU0$
~mKb
"N U
s|>Aq<
3p`\s
WyT6
mRP D
)FOy
N k2
I#u
i<qRe
Sfuw]
6y%} !
*6&`
| Zn
_OxN
yh:|
gz{f5M0
8#u 2
/oY*i
'wbGo
K40]H
[(Y(O
_XAY-
c9"A
L!=e)
{&v*
] Kr
b\d#
WGhA/V
CQLs
(S[t
,zO LV
JV,L*
%N$R
,Xos
u8aY
* `Y
}d.J
d*C|Va:
, V
FIO'?
Un#d
_@uD[
CUW.
Y5 !z
tfFRc
pY X
IOwsvA%
o>~JC
F7^1
!Vor
KGp*
_HVV
4D %
mX~]
< {
ia3@
q W
539
/Z#I;:>{\D
v-nF*
]-j
h#.|
hf?9!i
)DU,>
a?IV
G=5*
xcf[
`ov+ 6T)
qglC
OQwc
M,su30
8kk%H\
1TFg
zg2*u{
2 1j
`V.}
bT;J
41z$#
i4;r4
R]xcf[
p'\j}
;R~E/
tmjC
Hwa/
;::$
h?-_
>;"Q
~ KRe
}vZ2Et
XDP;
UW~n
G6I5I^aK
MW[Z
tiz
6."
0yKQ
%WS3
GVn`3
U2ham
System.Runtime.CompilerServices
fnw+
& RxJ
N|{?
&q,:
Sc7<
:^Mjf
A5M
Ra/T-
[4]E
['6!
xBpNs
qptH
Oz0G
MuJU
{w3BF
V]g'=
q1P]?
d[L>
1UKs
= C)
,c2)
[ :-
>Of
fyhw
8#&a
D1~h
YE`e$
nAjha
HfX_
<H;8>{
\1Jh
\qA(
'u\
vcSj=
y;!jL
bI$c`
0|*gR
_5 qD3]
lY yPK
+bI1
:'Ps
87*z
uBnU#
qNv:
@^_iTPA
yjVe*
+8x=+
L,X
?V25
\=n\p
WKA/
y(vU:
6K<<
Yoct
x:Gg
Z-`J
artsC
Ee|\
gpIKy
|VM}
*@9po3
'sNj
R}[ V/6
So5_
]u^m
\y b
E 13
q2]*3
'KVH
"}}
"W"[
j8>N
@6pb
Xu;'uc
tPMc21`-
S)x,
%1t[
"\\S3
ru{+
Ds
P}\+
3b(ne}
W% #
e3BIE
XAS>
?Lv]
#H l
QN1p
N2o
([0`m
} J|=E^
P(Pg
wZe[Z+-
6~!+
be
+[#w
hC/+
rGn:
-}P++7
b)/s4|
^@XH&
W%m|*
|Z2)
iVbQ{
F6>3
oZy6
$rf;
WS<r
Xh6AB
. 4<
[)/
t9DT
^CXn
oP%|
!r!k
K\-S
,2q{]
//*>
W1.W
ttdp
5C{p
m%Wu
r_H^
j [o
0U*FR
v&)N
Y 0
X- y
%J78
]z >
rqm
tUx
i`O'
Z^!X>
H?,t
;UP
aip,
.. Y
w {r
IhBAu
rf o
d B]X"
B nK
S1Uh
lBd*
TBrM5
9HJ
6rQs
U q"pV
EJ<>G2=
?v;Z#
c>d|
zb7(fe
$w3
5FiC
#G|dl
ao|x6Q
F-B_
%o lK
v wB
&fcJ=
U l0z
\*JPv
ZsL
?jkq
`kKG
s X2
U_*lR
@7lwIc
CgXj
*^-&
@ptg"
D14J
U^U.
|<VL=
\rG~YW''
c8v/
EL<6
*hlxC
HZ )
A261
qpd6"
[-+L
d)Ds
9nHq~
R0ok
y6F+
n*5f
"8W
:X' 8
$*<l
%Sr
'@hT0
LdNI
hT2N
]V_}
S; 9
mRuX8
_ c;
#ude
~Uh%
w2O1<
.t(G
!VvI
z e}
([)QM\,(
f{).
Q hU
/FrC
$LG;%:}
`G4F
#?,
|<XG
oSN<
O"B?
t~!2|
k("E
Gg6k
3fp4u3
Y\@X
Lv^
u}]b
XWH"
k;hbK
_ZNN
o|m"
!k'f
fov+ pe)
dr.V
+ fa)
QVg{
Ka L
Version
\(d86
[cH5$
XRR}
bk$z C
H@ol
<vNOZ
v`ib&
,uXR
$3~V
YX`s
D5z
Dkx\
9!@K [Aa>E
riLGo
'x/0
' _5
cgs%C
D {2
n;$n
2*{]D
Xht d
;v<h
C*Ls
w0 k:
="[7
n R\Jz
/$ t
OV?P0
) Y
2D) [o
C$Kt^
|$]tp
.T /n
R%m|*
SdBK
M,!;O;5
4L2Ol
^jy "
aS`UC
P_+JT
unq
/ &a
Qc(R;d
$wVx=
s_sG
@xea
xuprf
Thread
QO~P
^GT>
>|pwY4
iHD
99]H
H!HzN3
;JGY.#
U,Gm
V >Y
u"b?yBj
t4,d
0apG
eWM
`=..h
vmL;v
E:mv
A j2
?E KY
r A,
{7$M
1t"\ jk
-KT:
+m"#
0Dgb
! TQ
f&M)
ecnz
y|HHJ.
Av-m
Bs L!;O
)gm,
:lsW
l<VTbs
u+vw
!:M@
P/6()
Y9ps^Y T
7 <kE
J$b@5
K)zN#
W h{/
WRZx
`FDB~
}^3x
\GbtpRO
?{U7
n'4,
[E%'
U 6~h"wqgC
rcv).
g@>w4-
]fnoy
yMCb#
! D^
<Euvy`
f Mb=
#iM!T/
Vs\|
GetTypeFromHandle
6QMG
ID+LO
f|~9Z;
,:s\
hIJ
k~\MJ
B,Zn
a:lv
'C1u
G z\
bMy!
v:<l*8
c0a(
9=pM
0IGv
?/Y
jFZ`
8X&S
0oo)
^'d
1 q~)
#Z Q
{Enw
;~X<
TQu
P7<U
M|!rOR5X>fk|g
aRa*c
i|mC
.1nDf
BSa,
k09ki
$c8o
x"]7
lT"I
Cu
~YNZ
|sOC
dRWI
DTn}
chG6'
1 JF
/".u
vA\
=W^
*>9,
2a^
" RQ
}jm"H?.
+(f
a x
c9"CtY
\b3D%
K[xd
eiMPr2,
F7 r5g
XDr`
lo*-
O'8\
|!fd
m1uu8
=o^
#5[e/
M[gN
Oa;m
z5,m
Q;x5s
bXfh
&i=<
U\F~"a}
Hgv{
f#`KW
z:S
fKB9
x ,"\V
XVwI
*o(y1
`ko e
4v{f+
-:9t
"J.u
hR3<n
OLUX
\M/|
A% 6
*}^c
n1ch;
"o"J
"p"B
Y!V9!
aeaH^
_d 4.
T$s/,
U|~L
jox\
eq3 /
" ",
JC]X
\!+t
2V.
/yk\o+t
P{{
)<P
? 6+J.U
u5*U
(rXY
hWB1
T)iE
CFLs
'CK*
w|h r
Ab$U
System.Drawing.Bitmap
?C+j
EE-=
p'!
g$vZ ldZ
^qj!
0"e8
:Zqe
zF:j
&Lo 2
v{;8
PYnLB%
OdhG/
cG\7
6<h&=s
Ksy~V.6eui
i9kU-
'`kR
StringBuilder
Cl[ 8
dfzq+
bE6c
n c-P
ae;v`
xj%i
Q~\p
u7@$-
Ss};x
H0]$
A$%d
M|W5a
w &A
o=S^
J1H&j
'F|&I
F\/o
\]j_
urn"
{Li@
.A(=
b 6<6/
tk6X
;`BY}
T %&&
^STfEB
gj)q
$@Nq%
CuUI
8o&Si
ewT$
Dx_z
`~g GN
LgPv
% $#
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05_64 Seven05_64 VirtualBox 2018-05-29 14:46:07 2018-05-29 14:49:00 173

1 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05_64 Seven05_64 VirtualBox 2018-05-29 14:46:07 2018-05-29 14:49:00 173

0 Summary items with data

Files

Nothing to display

Read Files

Nothing to display

Write Files

Nothing to display

Delete Files

Nothing to display

Keys

Nothing to display

Read Keys

Nothing to display

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

Resolved APIs

Nothing to display

Execute Commands

Nothing to display

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-05-29 14:48:07

Detected family: #Barys

TheSystem Itself @ 2018-05-29 14:54:01