tt.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 28/58 Related 2242
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 261.41 KB (267688 bytes)
Compile time: 2016-09-07 12:45:04
MD5: 5b99b211a6d06422ad1b1fd4ea86aa36
SHA1: fec86945882c4d9bfddc0a03dd1edd684e19ecc8
SHA256: 47e732b1d04ae1912701683fa35a7ffb7a7ae590456379e6e160c576c6e9c311
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 4 import resource relocation security
First submission: 2016-09-08 17:27:02
Last submission: 2016-09-08 17:27:02
Filename detected: - tt.exe (1)
URL file hosting
hXXp://vibaavaacademy.com/images/tt.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2016-09-08 15:16:00 [28/58] VirusTotal
PE Sections 3 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x22c44 143360 e1849c646b43755a02e2c211bdb133f6 4e84780cb6f0c5f5c700056ab3ea74b3dfd9151f
.rsrc 0x26000 0x1ac46 110592 9978c013ae836973f364d3134b2847e0 78e1cb255b8fb81c9bc170ba545092fafd25135f
.reloc 0x42000 0xc 4096 3cd11cd2d5486952451e68296de7cd02 55aef907a937f8945b93e05cae151c6f3e6f29e7
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x4074c 1128 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x40bb4 146 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
No Meta found in this file
XOR
No XOR informations found in this file.
Signature
MD5: 0d6229a10b09b485bc65c51d41907292
SHA1: 2078d925a8a56c2d18a668837ac35ef1bf5aacfc
Block Size: 5544
Virtual Address: 262144
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
KERNEL32.dll
ntdll.dll
mscoree.dll
IP Found
No IP detected
URL(s)
http://schem
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
http://ocsp.digicert.com0C
http://ocsp.digicert.com0A
http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
https://www.digicert.com/CPS0
http://www.digicert.com/ssl-cps-repository.htm0
http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
String too long
eyrJIIk88Hc7rBDVpmLtjzTdCdu2XfzUZLs2QG7tk6oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW4
oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW9Eku192eord7UGLPmY5ZS2PfHUyBH3Sa0IFWN4ZP35nsgy2zA8fC5
y2taaLyKVVCjKnJhTqtRG1xdNJE4mZPvklsM1B4Eku192eord7UGLPmY5ZS2PfHUyBH3Sa0IFWN4ZP35nsgy2zA8fC3
eyrJIIk88Hc7rBDVpmLtjzTdCdu2XfzUZLs2QG7tk6oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW3
eyrJIIk88Hc7rBDVpmLtjzTdCdu2XfzUZLs2QG7tk9ueOp9WlQBNiInD7ZWR9RVe1SSCXuuVIQgT6soRwshLILdJ164.Properties
oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW6NIQQB0zso1HTGpdlqVRgiGFT387wTEYrAt6bzNjeEgLT8
ueOp9WlQBNiInD7ZWR9RVe1SSCXuuVIQgT6soRwshLILdJ169NIQQB0zso1HTGpdlqVRgiGFT387wTEYrAt6bzNjeEgLT5
JUb5Ably4TnijFC3umxgwT8x70qW0ARLw2LSV3VqfufU7O4oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW5
zOwtA5s0esx6ZxVHs8HgpiUI54MJsCqB3fVxfVCPrSvoM5Eku192eord7UGLPmY5ZS2PfHUyBH3Sa0IFWN4ZP35nsgy2zA8fC3
Eku192eord7UGLPmY5ZS2PfHUyBH3Sa0IFWN4ZP35nsgy2zA8fC7oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW3
ueOp9WlQBNiInD7ZWR9RVe1SSCXuuVIQgT6soRwshLILdJ166zOwtA5s0esx6ZxVHs8HgpiUI54MJsCqB3fVxfVCPrSvoM5
zOwtA5s0esx6ZxVHs8HgpiUI54MJsCqB3fVxfVCPrSvoM5oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW5
oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW4NIQQB0zso1HTGpdlqVRgiGFT387wTEYrAt6bzNjeEgLT8
y2taaLyKVVCjKnJhTqtRG1xdNJE4mZPvklsM1B7zOwtA5s0esx6ZxVHs8HgpiUI54MJsCqB3fVxfVCPrSvoM9
k89M9RriLmsv4vqDUDjRNCM3PFihVXhGN7h7HJdRu9Zf5JUb5Ably4TnijFC3umxgwT8x70qW0ARLw2LSV3VqfufU7O1
oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW3k89M9RriLmsv4vqDUDjRNCM3PFihVXhGN7h7HJdRu9Zf5
eyrJIIk88Hc7rBDVpmLtjzTdCdu2XfzUZLs2QG7tk9ueOp9WlQBNiInD7ZWR9RVe1SSCXuuVIQgT6soRwshLILdJ164
k89M9RriLmsv4vqDUDjRNCM3PFihVXhGN7h7HJdRu9Zf5zOwtA5s0esx6ZxVHs8HgpiUI54MJsCqB3fVxfVCPrSvoM5
k89M9RriLmsv4vqDUDjRNCM3PFihVXhGN7h7HJdRu9Zf8JUb5Ably4TnijFC3umxgwT8x70qW0ARLw2LSV3VqfufU7O6
oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW3NIQQB0zso1HTGpdlqVRgiGFT387wTEYrAt6bzNjeEgLT5
oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW3NIQQB0zso1HTGpdlqVRgiGFT387wTEYrAt6bzNjeEgLT8
SENT_USER\Sof
nalName
? </Actions>
ueractiveToke
DisableC
vStartOnDeman
ds> <StopI
! <RunOnlyIf
`tionInfo> <
e>[LOCATION]<
k89M9RriLmsv4vqDUDjRNCM3PFihVXhGN7h7HJdRu9Zf6
=Date>2014-10
HVwPzuYaBp8dUHHA4OiXQMLWSyW00sl
Copyright
sentVersion\P
/-P?pR
LaBr0wfWaXFO6G5R47HBRxLrgn
ueOp9WlQBNiInD7ZWR9RVe1SSCXuuVIQgT6soRwshLILdJ167
SID]</UserId>
vorkAvailable
gd2T3KQKonQ7SMrl8O5Yjb
QdBp9Ha1EE8FCNUZ8KT6YarCBM4moq5
=AllowHardTer
ueOp9WlQBNiInD7ZWR9RVe1SSCXuuVIQgT6soRwshLILdJ168
uWhenAvailabl
0.0.0.0
U14:27:44.892
WTdpfAIR4ulYKvh1mATezpgE
bies\System
pqezwvO1YMuW2GXM4lTowhrWsqJ7G32l1
hon="1.2" xml
eyrJIIk88Hc7rBDVpmLtjzTdCdu2XfzUZLs2QG7tk6oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW4
FvYsUDG7J7suYYJPRg
ger]ZoneID =
? <StopO
NnIdleEnd>
#Author">
yisting</Mult
`cpSettings
cies\System
Eku192eord7UGLPmY5ZS2PfHUyBH3Sa0IFWN4ZP35nsgy2zA8fC3v
R</ExecutionT
nicgOuGCHvI9WcL8zcHzwUqbg1oxF
m id="Author"
meEnd>true</S
dr & exit
APmsOK8hihgbQhnNl
AppLaunc
`lse</Hidden>
cled>true</En
@ctions Conte
fcer2IbwvOSjUdW1M65jauvXQP
08i1FDYED2SyWtFh
button2
button1
uhor> </Regi
O6y6rF2DmnmRwjIm
HON]
service3.1.e
checkedListBox1
qdate\
iDzhJB8NgFwPOup6mmHrUFB9kmbYHa65Q3
soft\Windows
HKEY_CURRENT
A8RxMziVTia7Gv9VmO50faV9g
R\Software\M
! </Settings>
Y0gIXBQfmL6LQZtERJ53ANgpJ
! <UserId>[
! <StartWhenA
ior>[USERID]<
IardTerminate
SlDISIiqVVUsIi6CDT5WYyrmNbqW
vbc.exe
uworkAvailabl
Reg
eouFiyS0H7YfCw0Qm3hNUUAEWxtOG
rtem
wire
MogonType>
utfxGGK6ssXNyOMT8Y5TD
ProductVe
S_VERSION_IN
`te>false</Al
/ P6pL
acpSettings
! <Enable
ocesPolicy>St
dc> <Com
checkBox1
checkBox2
k89M9RriLmsv4vqDUDjRNCM3PFihVXhGN7h7HJdRu9Zf2
Urigger> </T
cYXhDIAXPPjwGN248vGkjqL7
1" encoding="
cmd.exe
bleTaskMgr
urationInfo>
NnBatteries>
9xCsXPDG4YG0MwAZyg5cyfGVTbb
notepad.exe
`rtIfOnBatter
`sk>
rtrationTrigg
/Create /TN
[LO
roft\Windows\
@ppData
=RestartOnIdl
honTimeLimit>
licrosoft.com
gwxY0z0oZoK2I0dtRcuCUhBo8XPoHJjhr
! <IdleSetti
wAhQoHSuKJJAEiYxD8hIDi6RZfwS4
lb9X6tyepeXmQHzv42u
J3y8iv6yTGT00bTezXuMQ9LG4Xh
dl> </Prin
FileVersi
? <Disallo
k47EorqQ8XbyKdnSzTiUw9
,16"?><Task v
yIk96I0S10uoKNaa8huxDG
#http://schem
RtartIfOnBatt
Fiddler
! <MultipleIn
r> <Settings
oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW9Eku192eord7UGLPmY5ZS2PfHUyBH3Sa0IFWN4ZP35nsgy2zA8fC5
Mimit> <Pr
k89M9RriLmsv4vqDUDjRNCM3PFihVXhGN7h7HJdRu9Zf7
YJFhzdYv2WJPHPeT5e4Pv0npKFNZxS9bpDY
cled> <U
eDescription
RoBgpiUAoCjgIVxlliffWdKDPI
NIQQB0zso1HTGpdlqVRgiGFT387wTEYrAt6bzNjeEgLT6
schtasks
aQVYVGsyyyyJAjQrDmuvj3LmciCPJh9OFi
sue</AllowSta
6</Date> <
u/task"> <Re
EnW9cCyIsQHHSuxcm7u
e50AlJIl765jMheIDFT9j
!echo [zoneTr
TEM
rentVersion\
YjKMUq0UWM0HGdfMz7uHbT5b5fMkjrRqyHUPqClY
dd> <Hidde
! <LogonType
fgers> <Lo
meLUA
fers> <Princ
RAny use of this Certificate constitutes acceptance of the DigiCert CP/CPS and the Relying Party Agreement which limit liability and are incorporated herein by reference
ueOp9WlQBNiInD7ZWR9RVe1SSCXuuVIQgT6soRwshLILdJ164
SE8NPxs4wWNoywSKmhuzzEf99BzLlZGXMSy9ijK
`lse</Restart
FOtwRsQLk8mqOdvXzE58QoLbG8A
ms> <Princ
FileInfo
HKEY_
y2taaLyKVVCjKnJhTqtRG1xdNJE4mZPvklsM1B0
serv
hngOnBatterie
k89M9RriLmsv4vqDUDjRNCM3PFihVXhGN7h7HJdRu9Zf8
tringFileInf
5NU0Lwxu4S4S4b1jzJi0B
nRun> <Exe
`l> </Princi
nslation
Hdle> <Wak
utings> <A
`lse</Enabled
.1.exe
! </Registrat
sue</StopIfGo
rxsrevibnuhWaCF5dM5ynYa2I
" /XML
=RunLevel>Lea
SOFTWARE\Mi
svchost.ex
JUb5Ably4TnijFC3umxgwT8x70qW0ARLw2LSV3VqfufU7O8
>xml version=
UsG1AJqOdcFfOMjg83iLYVr7ZBMwqjDGBPd
Hd>[USERID]</
kKCArCgbyWhDUZBKRvThU2BUwMxyIBSSf
dInstancesPol
galse</RunOnl
lmand> </E
sbiedll
0.0.0
[USERID]
.resourc
5Y5GF85HFG54d
0rN5Ds8ie3MuMIrp4hHwbh
run
sivilege</Run
label1
oDemand> <
sigger> <R
,/KPip
hty>7</Priori
Urigger>
?false</Disal
listBox1
sId> </Log
mse</RunOnlyI
3GSH3uo5NBj5YGPG4z1
000004b0
odows/2004/02
ULb6xzAtNdzbE05nRrG
!<RunOnlyIfId
CgTQuAqkazVUM0lzRYiQfxVTWTJr21a
mable>true</S
y2taaLyKVVCjKnJhTqtRG1xdNJE4mZPvklsM1B4
linkLabel1
exe
nsoft\Windows
riginalFilen
y2taaLyKVVCjKnJhTqtRG1xdNJE4mZPvklsM1B4Eku192eord7UGLPmY5ZS2PfHUyBH3Sa0IFWN4ZP35nsgy2zA8fC3
ele> </Idl
y2taaLyKVVCjKnJhTqtRG1xdNJE4mZPvklsM1B9
Form1
Sun>false</Wa
embly Versio
:ZONE.ident
zOwtA5s0esx6ZxVHs8HgpiUI54MJsCqB3fVxfVCPrSvoM5
1yPoltgHvkxhScD3zqTlbE5Gt
"{0}"
se\Policies\M
oabled>true</
h$j?
F?T9
zTPRz
'
DUDDU1 1ZU
9L v
v P
RoBgpiUAoCjgIVxlliffWdKDPI@
M6KqX
LqRT
lS-g
PNG
!Ft1
gTV>
+WqH_
sL,P
EF:
EebM
j(OH@
uDrx
uk,$j
lllf
3:~oec}?
wJ1/,
6LW)
oR~r
k][`\[]]
|w1.oL
%L*L
}~*
+cv|
eyrJIIk88Hc7rBDVpmLtjzTdCdu2XfzUZLs2QG7tk6oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW4
eyrJIIk88Hc7rBDVpmLtjzTdCdu2XfzUZLs2QG7tk6oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW3
s M
[34|
D?)F
@[A!
8h]Dd
G\?4
4R4C
UnverifiableCodeAttribute
Proj3_oIgw`
VF_z-
}6r"k9V
.V?&
faeu
6x=G
0[Nc
9f2W
(W]Y
\iSU@
q(JN
6r+&
_w,,
'
v2_:]
1k"q
O iGI
T'e":
ks_m1v
/&*N
!1xc
u/..
get_Items
jkKQq
k* 3_HR
Q2"|
;dJ
q!LO
W<Q9`
Wp=9
|Co<
Culture
p~FI
%rnE
[B`?.;
set_Culture
9NnR
lGuC
] 2U
eyrJIIk88Hc7rBDVpmLtjzTdCdu2XfzUZLs2QG7tk9ueOp9WlQBNiInD7ZWR9RVe1SSCXuuVIQgT6soRwshLILdJ164.Properties
0d(f
e&%Oo
chMe
4Ar]
LQ"%SH
+AcC3
cr*1i
I.f#
>yJ1
y zg2.
path
1@DUUDUUDC@DUB@D@
=A(y
gG"}
7G3ww3vg53gs
+a o
pE@da
bOKvG
%f'H
!=%@
|DLR-
&0]
r'5#
zL[-_7
s!N(N
op_Explicit
Threa
WriteProce7[_okmsy
f*/,C
System.Security
|'2j
Kj)Ul7
]"jf?
r2a(z
*Z3J
:FDf
z.>'
;}Yf.
Cl|7|]
D]y5
*-h+
wW#&p
f ^sx
|7 #
d:*g{
Ad|z
[^!lk9
mscorlib
K-e4K
6$ r
m&b2{
?;Q6
p*S@
5 glk<
@9
V pL
type
GnG1|
6Izp
8Iswwdm.Diagnostics
@DDDDDD1C
#w?n~z
gvo:
z[8_4
GetVa M
Process>ZwniuRtyle
pn:W
"I4KI(
`t?Q
WTXN
w=dL
\p\6
ProcessModuleColle Apfk
EnableVisualStyles
Point
\n|]
c)*K~s >b
:6K{i40-+2
[mnv
WK d
5kt>
&+E
X%3S
82F^
ListControl
&8ix
9qFs
=x/X
_,VJ*
_K#F
Format
:h#?
#(;p
EO~3
siek4
xIDAT
oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW6NIQQB0zso1HTGpdlqVRgiGFT387wTEYrAt6bzNjeEgLT8
z*c*B
K'fl
) o
OIT(}
DX}:
Z{3A
_FJZV
xu?:
AppDomain
~ om{
%2VV
]V\L$P
X i"
xM\H
'(g r
i;j%
1qI
K6l}v
^dbE9
B:#:
?N'rm}
':s%]
checkBox1_CheckedChanged
wwwwwwww3_e}qu
G-\1
j-I/g1I%I
&+!
_ubDcre
*BN_&w
& ^n
ra3O9
=bnKpAe
]HLL
"6[8R
OpenSubKey
}O=?
sy/l
jMMuX
+X+D
rP('
\1. &
VYNA
hGSs
%j,%:
mi '
@ e5>\
}ZO[
Z%X j
;m~$9
D`X?
E7qG
`bYy4|
.dwK
L&t6YT
set_Text
A( [
, u+
&^uLf
(o:R
l~QFw
KIDeFo
OEY!
proce
qvU&
YWZ`
t #h
Kd`Y
9x:n
\5G1s|
[PXM
o;0h
#Blob
#W?k
O [
q!%;
qB?*g5Z
wM!b
JuD9
LinkLabel
+!;D]
o?"72
\5!u
SD<_
!IDATXG
hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
wwwwwwww
{,_9g
%z4g
BCj,
:z3mQ}
h0LkJAT
j 7YF
4E_@`
f5 L
Type
`;vG
SkipVerification
MoYzO
w<x(a3
CCgG
info@arma.co.uk0
|\RV
ILzQ,
7`9{
/6O T
_# R)
e~N)V
i1#9d
ht>~DVw
S4r|
ffeeZZfe\
aZM$
({m>
3dJ$
ueOp9WlQBNiInD7ZWR9RVe1SSCXuuVIQgT6soRwshLILdJ169NIQQB0zso1HTGpdlqVRgiGFT387wTEYrAt6bzNjeEgLT5
PhHX
qrocess
t5!U
?8oD
G$C]lhkgestResourceNames
)0$o
TgrumeThread
NB~~
>z;Y
D4%L
*bk
2p&N
B~yoodEnvironment
ProcessModule
]:J#v70
WCUUb
75x w
:8$5
[X-a
yJ-f
5 O>
get_Name
ntR$/nJ
~ co
^BNv_1|R
&` b
WIL_t
h(3G 4
'\91a4s
^&J&O)O
AqSl
`)QD
(e.F
&-'i
&,N~.
iEa{
.Q :
i/> 9V
L&+5
5*eP
VirtualProtectEx
ResourceManage
*Kq\#Kw
IDATXG
) MK
get_Controls
D!!N!J
w ,=S
ISynchronizeInvoke
2"%3
?h8L
&;qd
ErU*D
Rd\Y
cc]]clxl
voVM=-zO
yJ?z
Atp'*
a&L*c5
pQ+>[\c
dQ]N
,:'-
L_r:
uWH5_Eb
F`hafsNonUserCodeAttribute
5X*:
8q>@+G.
9/t
Js[[
@zz:
DialogResult
yx,`
gak\
.text
.QG/
+% w "y
0}B$^92
GetString
NiL:
: Pz=
1nX
GetObject
5MTT:%R
-(b g
43bq
oDhi
QWN[
hrj mmmx
>cMW
$T3V
bp??
/7`g
Button
wp,j,
!Xwk/
QMB)
get_'xZ@M
6r;
+x j
2oB
0Vy%
K%g k"t
z*V(
}{`m
B:#A*
(Os
\QvG
>0<0
PerformLayout
'v?m
5w d
(07
6t u
%<o V
12[cPm}
mainFile
!#w"
+(b C
,o&
<4V
P az
Nhcrosoft.VisualBasic.Compi
E:\Samed ICIN5eJ*4202\service3.1\service3.1\o&BNNc`tg\service3.1.pdb
bD P
0e1 0
Ngv`
AxG:1uE
Pi"{_
7#//
gt D
Resources
1R}
p(u 2
"| E
(%b{
ut g
(@xXU
Microsoft.W
q<bb
^w*p
Z g&
y=+7h
XWi"
Exzg
Z Mrf
mRlj=J
V2y=
)\rZ
label1
.Yf 1w^
WaitForExit
V*zN
IDATx
V;X2Q
?G+G.H.o
W UN
mjCG
:K!2
d I.
y<p3 [b
Conversions
\][`c`][
~CHZy
{kh_d
"}Y;
`.rsrc
x}hn
mN%N
4.0.0.0
w"b N
1$bB4
.#5[
? AU
DigiCert Assured ID CA-10
o_q\4
A19
i0d O
get_Default
b%JK
vz(#
\Lb3h
dK?W
fffFf
%I `
kernel32.dll
LAsz
]Mg*
Zd D
t=}F
l ]: |
17q#
.ctor
rfe2
cK+H"
?9KTr
8Wo@
ProcessHandle
B+LQ
r"k]
,>(
GHLKI
$entbl
}Sg`
7^}
Y)@|
+AMn
*EB%?
q`='y_
Wj0k
GetCur
Ay@+
SetThreadContext
7c
JYT+
;WmVJ
{M_*
STARTUP_INFOR$kDDKM
$NfQ
'?AII)"
`w)
e#t>
L|\&s6e*
6>'3

`dp+
v0t08
cc`^
SecurityAction
N [
211110000000Z0b1 0
8b,{
rD_dJD
\9s
fFCG%w
-z3amK
4hio
_?af'
)a}g&-
+H/e3K
PG:*k;r
d'I
3x c7%b$^:t
dC[(7
sM-x
i]A
l4#I
up7ab~
33478OqyJ0xqkFM6h5ieQ7cd0W9JH6dHYoaeoj6jAxeAGW2A4v.exe
8[2J
GetBytes
i6J$r
IntZ
Process
>4f
/DUD
(LzZ
`'x2
ReadAllBytes
')Vq
zj b
%f
MG{"
</ So
*F + ,
6a8o1
Om Un
>3jR
d&4;
-fX=
8GyR
3mYr>
G%E)
set_AutoScaleDimensions
pJ 4fg
M!36d
([l\[dc]\d
fgwvvfve'Sw
_m&pd56.
|E6M
get_Assembly
T+.1>
Z+NVv
AI=2y
vS^`a
F=tD:
Sys0M
<[L3
=(LO
,tQkA
y3US
=<SX1V
s"E_F
X}4
W##&
32{8
O*44T]gX
)]4^9
6l-H
SCF Section1
Ng`X<
E+1v
{r%f
&: 1
P9,F
Gjq*nf
WrapNonExceptionThrows
= pg"
,;Gh!
EZ#(
061110000000Z
RuntimeTypeHandle
$iYVG
/CDUDDUDDDDDDUDD
~=WE
zcmE+~=
nDA.C
8veegdr
re(
@:?%
T3E-y
y2v&
& O&B
xdL
2%}(t
&, (
%B E
N%D_
o%L<
IDATHKU
ofwy9
WD#i.
eB~V
WYO&
z)5P
& f'
X,L\
T{&$
IDATHKE
SX&7
v"(|
*s$L
STAThreadAttribute
Sat7
VJ17
9 a=3
5* x`
$:F%O
NA U
IHDR
Form1
k!wC
.M!M
H-o[
}U?R
System.Globalization
ax 6
dbb|
q"kN
>B.5
Hr"O%[
Speci
Sx 7
Q< A
0FCs>
Mb7q"
7j0<
c(l<u'H
d'M
isSandboxie
?w N
set_Size
h/D|
r}6#
$o]y
*f k
System
EventArgs
procPers9z] vpncPersLOC
Application
hm8B
HTEr
eZ-E
p&MR
-KU
ZmE
`jgL
EWn7V
wvuK
33478OqyJ0xqkFM6h5ieQ7cd0W9JH6dHYoaeoj6jAxeAGW2A4v
+~ w
|(S
vLj
#! </requestedPrivileges}8
JiON
msc Y|l*fml
;^9o
DigiCert Assured ID CA-1
s c7%K
~+no
Rcqn
*)J(
P% ]
a N
.B.G
J4(Q4
ih_=
gI]2
System.Security.Permissions
x~:>
]5}9i
`$J'O
RSDS
eo <
&D5]
MethodBase
#Strings
nE4i
{cqwice3.1
~A_g
O!NQ
Md-v'
JMJ2
JUb5Ably4TnijFC3umxgwT8x70qW0ARLw2LSV3VqfufU7O4oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW5
@oZv
7http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
_kq
0:6!
3^:]
<3M @
>c}s2
Dg vifp
7stU'
j d4
lE{G
Y6I6:MI46
Environment
a70 &
1>d+P
Spd"
asCG
www.digicert.com1$0"
^5D-x
envir.Y}hhv
{0t$]
Q2^7
W|@czu
hkmS
FE*d
L(c2^
o<f;x\W
/DF
NV<Q9W
'[Ck
t\B
=u$]0
3$V"
BeginInit
5n}|)
!)1I@ F
FRtpfr
@\r"
X LJ
e= <n
bytesRead
9G!v
=[=1
0u H
E:3{
y"<`
Ran'Zt UqncessStartInfo
GetEnvironmentVariable
]_ _
*2 _fB
e,$
~!/RD
k()2
SOpEd
0Y M"a l%s g b
HXD$G
&ecM
IDAThC
)Y09
V Cb
7^(N
EZ+K#
gT,r
T2z?
[7^(N
DigiCert Timestamp Responder0
Ly1b
0:64T
xo1dF}*
tw9ma
B;m,C
4qr:
qe#F(
. @
.}\
]R;*R>
VkYcpwices
rFW
(USr}}}zYMI
Pe*E
BQ_/2
DBUUZUN65:R
P8;U
:@ FM
E2 u
,Qbo
;%L*
http://ocsp.digicert.com0C
?dr-
Z9#w
MQ*c z
V.H.
get8}bogvuablePath
f J0W
oK1 ysz^+
k?-Z
-"#>
XDfA5
pr^+
d$C3
zOwtA5s0esx6ZxVHs8HgpiUI54MJsCqB3fVxfVCPrSvoM5Eku192eord7UGLPmY5ZS2PfHUyBH3Sa0IFWN4ZP35nsgy2zA8fC3
(wu>Q$Z
6u t
/CWUUUDUUDUDDBBDB
Eku192eord7UGLPmY5ZS2PfHUyBH3Sa0IFWN4ZP35nsgy2zA8fC7oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW3
Bw[a
EToa:~K
-jBl
compat?^wh
; O_
GIqPss
O9,a
okoS
IHOM
9<<+
q,|A
Title
&4 A
+A/n *D
Desktop
6I r
]V~a
#DQ(
V?_j
IA0&
\Zsj
_1ck0
set_WindowStyle
];x5
Zv7y
]Nh\{
dkC#
=t'h
aW+I
y0I&&
GetC
|5c
\M3B
v72P
@^^<
ZfZ[]Z[^^^[Zgg
[*O}f
/(k<-
DigiCert Assured ID Root CA0
C$T=
+8
i8US
%[dlkkk]
H^r(
7nBc
JJKp
aKDS
Ga?$`G
[cmm
F+9 $
p@B<_8
tgpE
Tv,s
pwx|h
'%/}
/d)O@
G1.-
ww(n
Bsc#
service3._1
BitConverter
%6sCD
0iv-']
Z?Cr}^
#ITIII:::3:Y
ReadProcessM
S=[fok,Recurity
ci(e`(
Label
WfuValue
O3&e
1DN=
ntdll.dll
>t>b
[fK?E
=(/"
#s::
Form
JEEP
K\(0
!mnGp
!)!I
ZaCie3
jqi#"y
sT#;
%,Ls
vy1^
n[mqCA
6F'r3]
kaq_
09M*
4/1w
=]NKgSyy
3Y^f
CaEa
l^68
address
n,Ks
)FCx
@p9o
$Emmlections
{vf*!
2Ibe
/v-{
EaC!.,
k f?
h]B,
Pc(-.
J4E-&
t1#b
\H'f
]^7<
l^mP
hV,/G
( f+
1SG"&'
W B
"1jA
F<r'
9A)O
=l C
set_Verb
k H50-
Hf)k
b7C
MsgBoxStyle
-LXnkE
4i^'I
=w/{k>
jF4S6
<:oMh
)S>s#j
B:Gp
FdfFllfa
uP{5
WM@9
#P:]1
f t/
set_Name
ueOp9WlQBNiInD7ZWR9RVe1SSCXuuVIQgT6soRwshLILdJ166zOwtA5s0esx6ZxVHs8HgpiUI54MJsCqB3fVxfVCPrSvoM5
95~F}
]ll^
D@UWD
KFW]#"
kL;%C
"f?n*
p<h!s
CQI1v|
'5]0+
UhndowsPrincipal
<[`\
hPro Pjz
K-^7b#L
9E'$
finiV
#e|<
6ibu
6[z
by} >s
*r
GetEntryAssembly
sh]!3M
GetP3XshuqdsByName
`6R6
>BDv+Z
r By
c!(]
Contains
J"J,J
eXEHr
3'OH
r;m,
>lHM
,Q6F
9sp6
)%#!</security> </trustInf
UC@ZU@Wiinpd\r
nc~xOFr
Fia`lMachine
P +V:1
%t w
E.y BM
System.CodeDom.Compiler
set_TabStop
X )
SetCompatibleTextRenderingDefault
S@T3W
"R_1
/be\
uQ $`
ToLower
BGk9R
_vkk3
XleUuV
S 9t"PL
uaKsJRArSr3SIA0LpAGf2Ohkrp1t71
\K}2
#6W
data
BI<j
Trim
wwwwwwww>^l
set_Argum&[mz
vuew7w
1sS
W(O}D
]x~2
ButtonBase
|~Qz
+i,;n
k;"q S
TkZRW_
J%jM-
OCh7
}j(;
+DsC#
%h-(
f$e4
1<v=
?\@Ko
g4c)
(&Ar"
#0\3&
m "S
)}aI
A\nH
:YC7s%
get_Curre Q
3<% &
OrU-A
[t~8G
D8S?V
&s21
DBY7
%\KYO
{Iu>
Qq}^#d"
b/ ,8
({'x
#QQ7&
13e0
'=Xx
Mzk
ToInt32
EO96
?#Ku
63In
d<W2U
OZG
qExf
3{(}S
lBQY
W=ZI
@nmpilationRelaxationsAttri
oh<`
2 I7f
P_8
@hDW
_c (
KKKq
Y6u)
,|T\
H6SUq
"fn>
U@@B
b->Z
F> >a7
s|:&O}@x
s{]
.rsrc
&.t!W
Split
pWIG
hxm~t
D&no
{Q0+
dl[[[\d]
1d KmLw
66:3=
wmGzT
2Xs)
& B5
]@PH
button1
%(]3
xi1b
EZZZ
& Cj%
1f*A'
!!
G<R
wlZ8
i*$A
wTvUcY?
`q^@ I
IK ,
pEF(
4}*S
/2p
%,]s
$P0X
9XK`
i7nI
HHQ)
7Y6[
C~/@
exK5
"~7^#"
w. 8*<@^0
Rpah?#1.0"> <assemblyIdentit8
lws+
^"kd
DebuggingM.Su~
d%f:Q
]h#:
3| R
add_Load
L~+}$2
"($
0\13
:cu{
P4-"
yHNI&
d/l'
Combine
GFno
=w#;
iX ~
frw~
>O@y
{0 X)
h>^I
set_FileName
0v0b1 0
Y#:0
s{V`
qrt%P
NON
4N!y
g/E]
get_CurrentDomain
Data
"5j +
PdgistryKey
~&NN
a_iB?
X>i F
GetFolderPath
_+) 6
qD/Hq2
_. v
Dci'^o>
.B1<@
x*n)d
`f \
!Nx
WK$C&
Dwtg'7gsx
l N
<AQ
oqAddress
k)O@*.
7s"L+
1v8f
pHYs
SetA7Ak`gvues
o ;'
[. q
+**p
W;2f
z!n
&<;5
WZ1k
0aDG
] !(xne
H g|
Hh0E%
lK`s
X*j1
&kFHp,#
Q[mG@k
N+K+
Q-(E
Puart
)$g p
Main
!L3=L
ANH f
QLu2
L$gw
Invoke
)} Yx
+.~7
MC~^
/5u j
Z[p`
DigiCert1%0#
Ci_lPmlaB5
E*YY
.%a2f
resourceMan
Z}#^QB#l
Fk2
p8>^
y9x'
y;Rn
a R&q
X,^.~
,C{Q@
*t 4
Y3TV{
$!-C
j 2]$}
ETxd
8rso
s6Cfe37
l{H>
*jKF
{8R5
st$ A
rZ*|
>\?
FYJ*
*5z |
Sttec
}w l
tx|]v
F;e+
Cr6 f
xmhvv
M!M$
iyq!
i $e
3Q\O
Ot#1
@.reloc
5n%u
%<1E
!P@R
m^5 F
i,2
\ ]0G
#n=S
zOwtA5s0esx6ZxVHs8HgpiUI54MJsCqB3fVxfVCPrSvoM5oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW5
7+Z'
,Q`o
5x N
b~20_q
Byte
creationFlags
KNg%
Q*1j
f'H a?1k
}&v/G/J
@8T8Q7QF"i-}4f
t!)
^f"UVF]
Dispose
^m#\
!-t5c
8SoA
SuppressUnmanaged$W~oWfburityAttribute
iHDG
-H.Z
kD%o,
s5:b
checkBox2
iBidVsdO
~(e5
*B3
@)z>_
~KQh(
Rd=
+?/U
A \-
www.arma.co.uk1
? $|OCs
;1 bj
Ty3v
dK k
W1zINs
BH*
Ii
6$ &
V466
Mgm#:
#\ IPk
GetThread%Dw}azu
1a4[3V
8I a
b94&
:-`ssembly>
System.Drawing
Gs`[
.\Roj
}s]
6}ps*OyC
y^g[c^e
F) G
+r)l
checkBox1
^LXgD
M*c5
l[Ly|!
UK&0T
@::4
FLC6
#%Hzm
fFQ0
K%4{
r+l:^
T0 X
set_TabIndex
&n<\
%.j^
160906192455Z
K%| m
@KK+
6$ef5[
!(` u
K 98
&=m6
[oXn
q475)
H0A)
#?}!IZ
kmx=S
RuntimeCompatibilityAttribute
Zu2^
\bVI@Ld
hMah
f{\
_Mo~v
L^xh~ y#
%w7Y
5}9i
Assembly
X{ i
Syste Ebvg`ding
2E2N
oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW4NIQQB0zso1HTGpdlqVRgiGFT387wTEYrAt6bzNjeEgLT8
g I/
Zlz)
k)D$l:B.W
[/c2
/ "g
xe(I
: U2
;8`>
&Qzx
Z1W1
^-j8
Cfu>
1\5S5y
?e|L
`Wb
SuspendLayout
z(2 &
U.f0H
WMF|^y
L%A
oT 9F
&OEGZ
WindowsIdentity
i;T
9VKA
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
!d&J
*+| r
\n~su
2{-U9
Size
q:~
1 0
:8Ht
` *0,
iW!]4/
W90X
set_AutoScaleMode
S0P}
xs47
aC1 ) u
'1N} O
U5+y
C>(`3
S9^;
5J @
O$2<:
92v_
RGM1YVMh
8CPRR
0~F"N'
p(D8
j(P
_zOP
PPXOL
A'A e
o:4t
}"%O
IContainer
@i<4D
y2taaLyKVVCjKnJhTqtRG1xdNJE4mZPvklsM1B7zOwtA5s0esx6ZxVHs8HgpiUI54MJsCqB3fVxfVCPrSvoM9
<?xml version="1.0" en Z}`kd<"UTF-8" standalone="yes"?R;
||!K7
X5f$
D4:&
OFk
jk$B
8@,@)
='ga
PZ'H]X
\;J7D:-j R 9
D k/
~g$2Dm
W /V
v5Ow
+3.`:A@
2.te
ExtraRounds
.{FC
H,g#
X$S?
:hl7
"Z@R
kJ`kC<
SwUk4u
bOR+
>?G
Buwp{V
{F{gquInfo
zFgc_
u?*{
H1Y@
&K3
kp#>>
93FF
H 7<W"}
[u[O
jZyjph0'
0t]/
set_AutoSize
BjJ:K
rAiu6
|U"q
.h@p
mByQ
X1d%
+$b j
R:^
*%t p
i%Lk
2d*QJh DeJ
]EsU
s:sU
&T+/
5gdp
ResourceManager
Show
f+A6
,qYE
F!21
Jj!#G
set_UseShellEx$Teyc
u( F
^/{G?
ZB<p
bs!#
@xI8T
JbXRQ
ContainerControl
K@#d5}f
>'ox
|6/ =U
0;h&
f>q&
ToInt16
3m g
http://ocsp.digicert.com0A
X%t{
1l`4
Y`TQ%
t L4
1&B|
M >
X L
z c*k
5-:}
*<:3
Gq<8|\
_i[v8U8]
;rB+
ck]$JVL)\`^I
oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW9Eku192eord7UGLPmY5ZS2PfHUyBH3Sa0IFWN4ZP35nsgy2zA8fC5
3+dh
sH$a
"c n
*E)@&WZ7|8
>Y1jKk+
(Vd%
}xEn
",~
X?b#
X e'@0Y M"a l%s g b
`/?'E[/m
D;pD
[=M^
:X^4
MsgBoxor`}rgl.Runtime.InteropServices
l<Y
o9 X'4}/
!qb.
+' b
-3#
oI ,QN
uJj&
[`wE!
@D}7
#3m
:FL{
l1<+
Xf [G
f1Kb.
tE?4
5q!h
j'Il
O!c m^
Hto.z
$l4Gb
;'K(
mj79a
S*&e
,_c,
,0|d
+V,~
3g9J
Ks1o(
~sPGa:
7\w
8]GD
jY<U
kdJd
U?I|
_t7.
@#S:o
j;s
DkgrJ`ndles
rNBD
`c<:
MG x
set_Location
Ir"Gn]'
Ac`$C
|wX
d a
t|"#<
!|fu`
g;:.
SX/\C{
]6m
5a m
* :$
-p!^
w 'V|
}}wYNZb'
I*0 $
CknmU
/x<~
7W#P|
=3k o
A.l X
}(+
{&;- @
x/nZ2/
7<|RC
K8kj*
.CyY1
i3R+
!c n
] |s
Y1X?+
Q_G7`
iQ0$
G8& A
isWireSharkC\jOlgeler
Ie=R
InitializeComponent
_o@p
6r,1
FFf&
F*Q q
*}KL
U(e\
!X;I
7r j
hed,3 PPCPP@D
bpV#
aV=}
j+$`0
Zz1Q
k89M9RriLmsv4vqDUDjRNCM3PFihVXhGN7h7HJdRu9Zf5JUb5Ably4TnijFC3umxgwT8x70qW0ARLw2LSV3VqfufU7O1
AddRange
1cGbz^
gAMA
"3y.
'x3:C
3DQD1`
:73-
Y0#0
3j
0L* hQ
D&J*#TJ
!j.H|.A
.kd'Y
AutoScaleMode
?[D4
> D}(
S$B O
FveecuionName
nn(R
$^awUhreadContext
k&[S
.cctor
"x2a
$] K%
V=-_
flNewProte
oGD'r
\vby
yAD|S#V
oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW3k89M9RriLmsv4vqDUDjRNCM3PFihVXhGN7h7HJdRu9Zf5
, *,E
t%q1
~uc8n3
v2t7
fhtqhon="1.0.0.0" name="MyAppl?_zyolo.app"/> <trustInfo xml
{<) 3
tb %
%+X P
;lhkM`
q$eV
n3 g
{ b7
8v m
=F&F
w=e!
3}U
Y7"`
ControlCollection
<U~<#
g.;V
m0k0$
Kill
&`k+
q$e}
ElJ>z
Vn9K
$@41'
;+Bb
44!#aN
% I.
Y8: $
39yF
h ghc{
r~F.
R Yu
value
GKxF
wt0vF
XN{_77
5http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
System.Reflection
ylq.
rM\Ef[
/^W
dkklmd
h"I:{
Pz<W
h&u
4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
7[7^
N5#2w
3<i 8
DAFnFl
kb3] G
hS-L
(Y- ~
J:P g
SecurityPermissionAttribute
D qq
,>s
sender
`O<>
nT m
GetMethods
"D"%
*O%B
SLiYXL
9 G*02
yvPV
./1
V~%O
U30A
G DLf:b
1nM_@D
a"NV#Bq
d3|e
%,l(
System.Security.<Dsbekqal
2l>}
WindowsBui
td=pd
info@arma.co.uk
2%AC
x7|7
$7b o
FJwa
V7,CUE!
V{C
UE43|
d89(
checkBox2_CheckedChanged
4:00I:::6Y
^lmiU
z8_/F
_xxm
f2_
/%;|
M* Q!
#765
px7t%l>Q
b&v?m
U$-p
5 qq
;yv
#O&{
X47{
0?;
BzON
[yhx
0*M=
PaK}
fLe %
q4\+
c}NN|O
)%S4}+Sx
vk5q?NQ
_<Z i
- \O
_1!cG
,F/Kr
16 #HA
86i.K
7T(Y
>u1a(W
w&-}C
3V1g
y;\,E
&Kn2
ok]r
erZ\
suggo
e O)
j8
g)<:4<
s3Gb
>s'
&t ^ u}J\
EndApp
1H$H
+z7yTn
/T!b
+V Lu
=-=F
&1oBK
NtUnmapVie
%h :
}bAR
CDD111@B@
.http://www.digicert.com/ssl-cps-repository.htm0
3:{n4
eyrJIIk88Hc7rBDVpmLtjzTdCdu2XfzUZLs2QG7tk9ueOp9WlQBNiInD7ZWR9RVe1SSCXuuVIQgT6soRwshLILdJ164
XN0,
#E \
mu h*
_DAq
+v=D
=G^"
2http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Wba7
Fz.R
8| 0
F+?A
ZK~X
VT\S8
LEG{'
WFsV
6MW`
mscoree.dll
!This program cannot be run in DOS mode. $
P)0X
kI1V2
"K-K
t mw
IntP=[
Jl7^
z3(E
k89M9RriLmsv4vqDUDjRNCM3PFihVXhGN7h7HJdRu9Zf5zOwtA5s0esx6ZxVHs8HgpiUI54MJsCqB3fVxfVCPrSvoM5
d KlF
t^Y QE
'6(k
"KFRy
t--bm<.
SetApartme']H|gwd
a.Yb
H `N
s$ ,
}zy|x|zyz|zz|||xy_a``c[a\QA;FE__]dgBJDCO?
no8%
08 Qx
BQ%B
!An{
@s/:
G~6M
C?\6Q
"Z5T3
} 'j
"IDAThC
?J'L
` a7
button1_Click
ndfRtN
;uRX
' *
DigiCert Inc1
9vv6cj3
Ohs"
set_ClientSize
?P
Aberdeen1
W/C/F F
4/;B
[r];
'Q>X
Un_`^,
@P&(
h2444
3 WQ
p }Q
u1bF
%em&
Q_+<+
|g U
-G i?G+G.H.y
YpievDrror
LayoutKinddhpxwj`lAsAttribute
k4.NY
A9U9
]M8h
j{0v
k89M9RriLmsv4vqDUDjRNCM3PFihVXhGN7h7HJdRu9Zf8JUb5Ably4TnijFC3umxgwT8x70qW0ARLw2LSV3VqfufU7O6
SetProjectError
TI1X
BSJB
S'Oa
resourceCulture
M{0-
9/.C
rck:
)]g0s
DO=[u
JhojwQrocess
4q"
jDuy!
7!!)
BWW'::
pBjm
m]Dh
M1V[K
A=U4
Mdj
CompareString
RX3?
x)A%=
h3J~*
jaw^Size
X2I[
'jIQ^
]1X>X
Delete
FetObject
9*( G
thread
,q3g
vprWx
z0x0:
S'O
Nperators
"7NFb
j]Ez
VL %
0RC4
.=+l
!This program cannotFI|)vwo in DOS mode. $
Niz ;
EYy%*
y3S&
ax,T'
$-{x
141022000000Z
l4e_
KTy-
0L=,#
(QXI
'7^ c
E|M$M
+mZ
l Wt
YERV
mG.s
?o&u
@$''
rcQ/6n
Lo$N
PO'hv
Rg+E
@;e-|
0g L
%7^ |
*m<E
791x
D9pP
fXMUP^INFORMATION
rH1_
VirtualAllocExdMpd`nd
L?JJ
[C1Y@
'9Qp}2
Y("C
;+CI
#=d=7
'6pI
`J c
d?ON
s[';r?F
Dfffw
t+z3
c&r&
z {
=rF'
~}su
)K^+
& CdV/
Mutex
(PD(
SizeOf
|$%'
k s%
03Kg
N/y
+g@
8i 9
-himF{[=
aDmmF
qWIf
CreateProcess
aAVg
I*2 Q
ThreadId
nEoH+=
:z=8
|$%z
1j, &s
components
Y A
\9s8S&
qv#+
~$D
Ai$}~
65SW
lSQr8BKlWE5D2Vi3ZW5qMJ@
,I0W
,_eB
9C%NP
$B]o }
0!0
DDcY
fet_Location
d~!/
vBN7-
kk1r
%>F*
>'0BR
(Q*
ISupportInitialize
(| O
pB-l
*6m}J~
@IaT
jF-E$
c\8p
Syst!E<]oleows.Forms
mkg.
!Q8J
<2n
6OT;
k03,
#+b@H
j<>1mt
E&0>V
UP`Tmme
k7l&u
I:6T5
f-iO~,C)
'kJqs
M've G
Form1_Load
4/:L
9<j}zV>8
Ta<E*
DeCry4\
slowM2
ObjectCollection
CompilationRelaxationsAttribute
8{ m
id~6a5u
r?$j
A Y7
PAs$
D 6:m@
:)7g
z9Ai
WE.G
KyZp4OBbdOWlu6yXUUSZmWBzF7RN
O|RQ
n>x+E
baseAddress
%xaR
3T r
$p5f/
a&%#
g&"sK
97d ;
(Fg8
wwwwww
aX| W
h.PA
y\MH
K 9q
'\0\
q9p V
rIu uCsF
G-1r
\ $>
Gb$>[C
5M q
qhn_
%@Y9
<WLE
GHwzG
jN9r
(.d4<u4
] b
}pSD
QLPm
i"q,l
)(^/
]/}d
|ut}h #q|s}
Control
'PTR
=9 X
V$:q
vj`1`
RunPE
(^Ie
|/Iz
X4^#%
241022000000Z0G1 0
;Z9U
sk5I_
IEND
`<6.#
A%n*z3a
|2+8
Microsoft.VisualBasic
\S-
/*S(
%LWl
*X[k
qpvgP
K 2X
[* n-K
hv(q
-$EZmvbkD
ya'~
QaQ!R
a;d0
>eZy
,UIDAThC
_:] o
context
O)Z
9!G
! Zx
;bJQ
y$\Z
FVb0oJ
ndNX
*aQs
`d$`
.H O
Siz,)Imufsved1
U :E{x*L
x<8i
|lEG
n*#h
##4III36::6:Y
*u g
lhC8
V%1 :
%[l[]]dd
A2xO
9f~Q
G_fhfdr
5u`f
!Ji9Q
Concat
"$=7LoW2/,..13
r~T373
c+b,
}a
sUi*
?O4(
*q h
]+*O
J:CZ
Uqw
s`X$
6ilhxO27pZ7dy6G2UFGd
(>_8
}pSDb9
ud +.
iEY
P]4x
u%^3
&!/!
Misc
h(m>
bytesWritten
kQi9V6
GetRuntimeDir3_obtz
O,G~
]5S]1o
CompilerGeneratedAttribute
EventHandler
xSo\
y0m
V?K4
fj2/
8aI
set_SynchronizingObject
oIDAT(S
ReadOnlyCollec
W@(b
nFt &
~<[+B
7+ CAw
)A(O
nD"\S
dLF-
d:#}
`O(
^,lJ
r^s)X
currentDirectory
] =e
D As
&mb
A%n*L
s{V|S&X
www.digicert.com1!0
L Va
TdH9
My@5
# hn
hjGU
g~vF
hzJ(~@
System.Text
\ 3>
Yf6Z
ldFQ~
zD*,
TG0^
]ze9
Qxstem.Runtime.CompilerServ?_~~
System.Resources
&P<h
^6!H
set_FormattingEnabled
;=$!
`vdmOldProtect
?BhyevMayoutAttribute
ElE*[
get_Messag 3Touq`geBox
XeM"
160907104502Z0#
Xe\#/
b4OR
IqW6mMtNWxayoCmkpKGamyBPtIvdqx8P
kUr\Ehgg
B5:\1
k2B
hs2+
A|kbCutribute
-%}_
q/O(
-H-U#
DRJ/
..)Q
-c_}
H4'O
>p>"
#&Fl
q$t]
1cG!.
8H^S
h& D
hGVr,
s?&K
`fgna
snaw
qSRs
*5t `
8E+">
[&qO
0|R
1cTJ/
u_tL
Si~w
;C/5
G4$QR
w]/N
H@3I 7
F8='
*7j`p
dng%f
gdMM
_\l\W
:6c,&B]G
_^EBp/^z,
suFx
v ghw
4 VnF\
dc!%
^ c!
}2Tg&
0@*j'
}t'M
=C? I
axqTYRiUYxENK44jUY5RH@
ofGv
_aphze
retry
r %5
String
,O#$
_CorExeMain
.<fd
v# x
anY=W
listBox1
M"',
k"\0V
!i|{
* CML
zJ&f
,WRt'
TymH(YE
X$+qpo:schemas-microsoft-com:as$
c"
>9i
i+Lu
%Hzlm@npy
%o!6
0<\ i
\3p
]gzst
bufferiQll`gsSize
:u /
T!f'lH
n>w%
+_.&`3\
Q%I%
f\"w6q
(+&r
PNQi
Na~v
/YXSH
k(B^
p$ '
^2^
VH1g
pez)
C_D25Yv
3iE9A
vd)r
?Fs.
.OcJ
EditorBrowsableAttribute
MF2V &
Runti;YOtvfIandle
rZN.
G}C-
L6: &
Zd[w
6\((
Tzsy
:5,i
oF]R
^[V^
]+~?
ipVF
Keys
v^m|L
h.Idd
b5p i;
%, ~
=X=k
dwSize
d'<NG
p? C
pbP;3
N]cO;>'
[3E"
e=tT;q
7uco
z3;n
mt}q
n) AT~)ES
Load
Z` :
;.ou
X^J |R
| -]
be}5
3 w
m8\
J>C~
N>K bt
1bSZq
GetTypes
<U4=
Am{qu~
,Q>C
.cto
~?S}
&, (
g$N)
UVKA
<W\D
OBJ1
ProcessId
JH:O
xlHl
2mKL
vb`|9
y<jN
Ey6
VS4|#
U6_9
yNRE%
7G.e
o6n'
- <?
'p6? Y_;.
,]c_s
.a{Q<
ob~[
*(J{[
./BD@
0^1b]]-ZZ
(` _
*KhX$
z\8V
So *
:Fuht
V3!w
W55'>
EventLog
y2taaLyKVVCjKnJhTqtRG1xdNJE4mZPvklsM1B4Eku192eord7UGLPmY5ZS2PfHUyBH3Sa0IFWN4ZP35nsgy2zA8fC3
`i.1
)xe+
KpBz
$vUe
`L]qKajB=
2b;~?V2|
8<% `
erI(k
W +g
0 ?y
&,N~.I)
uk1}
$+k+
C>.*e
+X,7
+6~k*
7 cO=I
O8Dc
IDAT8Oe
8t RR
GuW=
PtntimeCompatibilityAttribu=L
AjZzP
+!M#
5+ F
)e~
ListBox
Object
8#0}
E,+/
br>m
GOBVN>
ut2l
,n N^
oL*
rya7
mzTW
6VxT
}&A/
2O$I
4,>o
3System.Resources.Tools.StronglyTypedResourceBuilder
ssR
PY\F
set_UseVisualStyleBackColor
jXg6
System.Diagnostics
!Um<
U $oP
FY:
InPath
_ bP
[? _
@4 :=
xrE8UL9^
X57(
g>?3
$_5/
}P>W
&y"|
t\.z
wv&_4
4W!}
+_ J
m:$= <security> <r [ehwwddPrivileges xmlns="urn:sc
`}.+
EditorBrowsableState
J dC
mrbEB
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
MethodInfo
,~LO_H@DAG\
}}}}}}}}}}}}}}}}}
%9oY
@ c
3' `
)m |
CultureInfo
k 5?oQ
:,>0
:vh7.
&g5u
8qoAfQavGgS0EASGpPT2Hz
-\34
StdOutput
C?vB
DE\?:>*
@dHU
(@+B$
;Q]S
$,J}(
[]]`dmwa B
j!e5|.A
~{5
v4C3Z
(kuq
A$l7Y/"
?VkHqj
lE$'
C+w
/i[:
e%e(
C6m o
"u a5
System.Reflec
9}-d
_*ySa5
nR{-
~sPLN$K
;1}"I
sRGB
3VX"
IsNullOrEmpty
e13C
Ch
oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW3NIQQB0zso1HTGpdlqVRgiGFT387wTEYrAt6bzNjeEgLT5
"ZB?S
8j h
N lj
Exit
b
k/s6
Q.U_
[[:T3
c O{
2whww
'wL9
' X7f
(-^K
wwwwwwwwwwwwww
SJ;d,q
jj )
get_Culture
InteractiondhbmFmyResult
add_CheckedChanged
7pV{
System.IOIordc
T,@,EC%p
Ws,"
Sjs\
>u1a(:U
}}}}
OE~
conff
N9b"K
startupI8Zt vqncessInformation
G-Jx
ResumeLayout
|9Gy
gDu(
ypFd
g3e-
fet_Modules
8mk&sM?
<s !
Arma Inc1
F"{5
1!@BDD@BD
sY+p
6:I0
t #M
x X
1a,U
ZqAs
pgYa-
R uP
P.I0
$'q
M]!=
2&["Y
!3:
aJ;
+xv4
Ls5S$
rb
j%u5
>< }
%I%L*
[aRw
yd-2
Qf1(ng+]
Q9s8
0pTe
s3JX5e/
@(](
m'e 4E
dFWwf
cQz;
I8hM
-$@F K
9443
f eh
Q#F!]
dvfOR i{^
W Vf
1c"F
d2.3C1
}dd
xQ_[
threadAttributes
IC`T
b6bR
V`!=
+NG
&wXu
NR'kb
7z:G
@h O)
O&@&
CKk
y_!ka
442+
?s;f
lbVP/
+' p
Cp2,
P(D(A"D
B"X~
Buffer
M[KQVY
a? Y
7G]E
hxVw
wD+G+
j<^ ~
1@DD@@UUDDB@B
?(LBl
r~,ug
<sD
tU+<m (*
uLE/i
mbTJ
DDBBUD@
(K/[{
F8H#
3k i
zz{p
7~(P<
c-9R
+0Te
;N{B
$7w o
<c-f
#.4:
add_Click
p#` m$
Wow64GetT![~ib@nntext
u"F;
>\hg
8i !
|.{NE
5k0u
* vK
/H%M
jq%g
j)r#k
!ON41uQSYMmtWG5WeUdhEnGC43WzXsRtdP@
sw%v
STAT
*1ah
x`j[
FEg(
FY1c
AkLT
R LB'
k[{
#g\7
D.I0f
PQ^&
Y Q
Z [
Vl;
UnmanagedTyp !]kdwfgableAttribute
a1 ,
Zfz]
w|Ya`uion
B!4-
>O `
32/;
jjjp
',N~.
{ X
>#}y
WATHy
(g t
n?}f
m@[+
StdE
get_ResourceManager
E|7^
W1y0I
Fq%$
j~K0
Q=T&
$GqJ
IDAT8O
W6Oc
} .>
rd$y
ML@5I
#(} h
length
L&y
Zu]6
y[5Cv
CheckedListBox
v2.0.50727
&,t5
MF1IMPKAu5H9AAKAp35OmjBkRxdnr
W(>^OH
(&Gqi N
SE8NPxs4wWNoywSKmhuzzEf99BzLlZGXMSy9ijK.resources
7%J Ie
^Bvz
JPTR
,:HB
<?-
Program
%h4JP
2y-r
> m$
=i l
oVlw
*ha0
3qPy
P@Rc
rJ
2wBky
4http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
cWQ-
~1u%
|.Fl
m@Wo
XPd;
*cBc
D[F0
tUNE
,g#e
S8t!
1D2
Exception
cu47t7
?sXl56_s
+xQb
tBrp
JP_U
K}.1bI
#I.{
Z[RT
@/+-
U Y.l
GYo;
duw%B
3v q
7L#(
U`lueType
;{\%
1uG2
Rzx}
#i:t;
`\u5
Anti
GetTypeFromHandle
!? u
ClearP
Z,To
FileAttributes
7NE
rQ [
x:V
GetEnumerator
IDATXG%
=klZ
eventLog1
3PQY
8QEY
5Ey4,
5gT 'ZpIM
Yx)u
sWrn
j jS
\ G.
?3rj
lFu:
LQm&=
5V~:d>
yxr.G
\87m
q%VR
NAlS
^]]a
Y{(Y
v!E"
HQ`=
@le^5
q ?}
?XuG
n[b9
aCGa
p^*U
7NT[
?#}%
<Module>VQhniqmib
k(VT
(B%l:
s2H91Ps3Aai4C5O
i) g
IDATXGu
t`(Q*
U3d}r.
#+|6e
8:,G4
R3Lwlef
v~.)+v`
GetProcessById
String:)Xgks`reMethod
[09y
dx`$
o J/
4biYPNTJ7IlqsBuppwunHOWk
260904192455Z0
]gk?S
I]|s
=n6&
5zY <
n2_:]
FOH^
15|Iy~
u>z*c1^
:fzi
}&XQ9
+</]
O`Ro7a
"#L$D\
9v&J
ApartmentState
H Z6y
CvV&
;-)W
m8y.
-5x g
xZQ "
9A:Mi
DllImportA7Ak`gvue
YMY
NzX9|
t?2k
isWPE
7t%fu
NH)I
X^P=]0
"'zg
p9I ]
lk}#
WF`s
System.Runtime.CompilerServices
ZQL{R
F5z8
z5mk
t8="
^9o G
9HINAL
~\l0
V4Sq
+t#E [#O#
8}d=
db/Hv
g|_;
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Eet*
button2
78N 4
vuZ/
A=&My
Mutx
checkedListBox1
Mm#N
{ g8
gpuU
r1Wc
@>2D8$&%*-
&,g"
!EoF
d"5t"Z
k(3-A
J5N
/o@ O
~u U
wV7(
Axnu.licrosoft-com:asm.v3"> I
sUf+
|t4!n'
3i g
d|2pGG
%e K
L<I4T
<$Zqx
/1CUDB
:L,]5
.j \
System.Windows.Forms
i:hA
)ZJ10;
kPpPm?
aS\,
Fg03m4Z
nz=c8
%h))G
Vbuh
linkLabel1
lFOI
l&mm
,UIdqR
I/`
L2z
I.7ka
IDisposable
`?Y*
DebuggerNonUserCodeAttribute
D<P(@&@
R8D;pA
"^9m-
w4^9
32f/}
~Q)(M
O!O^
KmX0
g1s G[2
]7*=.
pn b
;Ii,D
-p!N
oNCxANbg1CKuq6qRU85M2G
w@}&
+b40\0Y?Y
iikE
(T}>c
lTzD
cga9R
1 Z
7m-s
~6Y>w
commandLine
n ;
Y] K-
*YM
UK2y
https://www.digicert.com/CPS0
<Module>
aU;S6
k Z>
z{Zj
Yjaen
Crsembly
2qJD&
&SCm
get_SystemDirectory
82S=0
ToStringD{kyrgl.Resources
nA2J
k2o
RQT4
{9T4
wj,M-%
v3Kjc
Ukt}
Dxists
H24
m%W=
service3.1.exe
0[BvN
VP~pphbutes
$ 0
SizeF
dldflC
<NE0
$&."
&!DDDCBDD
+v*P
!N=(
Kc f
kj>G,
3xyo?~
Rd k
9'l
pt7G
i=}'_J*
o<G\
r|2}
zcZ6C
1bp
i{:Z
o`A
H'@c%
I({
IsInRole
7t"_m
hOa6#
=D,.
XRfWq?o
l(m
]S#s
#GUID
MIPBl'NH
TP7R
6_Wa
R&@ii
tzfp
ULfr
6]q,
~i xy~
b:TVU`
A# S
Zt,._)
P9 U1U
WroNV(
LDqN1
\7fK
60`#E
EndInit
X<wm
E=et
'V:V
O#JH
~/f?
vi+s}F
o<o/d
y e3V
;1 W
&K>ex
/A3ns
k0i0$
G%7M
9*&"=requestedExecutionLevel l!^wf; `sInvoker" uiAccess="falseE
+J oI
qVFQjOkEjTwhwBCvpi
ToInteger
nB{J{
\l[S
cDU"
[O-?Y
5z? }
0br}
7X*D
|MJ_i
prot Bm
RRHt
Regist6Q
`! x
nD ?
&O%{|1
dt&R
8!!A
w}1B
Y0;4
-bGsy
QUY
Scotland1
+ES1F
bD&Oa[
r^c^c^c c_[cng
wD4|
"IGI8q
m7z{
<P=U4
k $H
Thread
|7s#j
|7s#j8W
*Y b
j)D$n9o
0b1 0
JLMnQq
&S *
232D
0S*u
--]4
<Q8!
de-f
15qP
ehnmA
x:],E(P?|
Encoding
IEu
TcDB*~
_>29
xN($OV&
nTgHbi
1%b a
|4Jf
/9B/D*
$e H
CheckBox
u+
q:/2
y;?+
QA I
sa%P8
Oamt
ShyYM
0#::#
F:1[ B
E!^oZ
{l>T
@8pu 8
>Lr }
^:q5e
h~T"
NZMd
2http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
p(#D(
gPF4
0gqrembly xmlns="urn:schemas- Lrxkqnft-com:asm.v1" manifestVe
xa^6b
]Hq
0n=^
'Pz(
+rIU<
@DUUDDUUUB/D
oE7lINdGY82kKJkirABtqa82F98fwd15sxhowNq57EW3NIQQB0zso1HTGpdlqVRgiGFT387wTEYrAt6bzNjeEgLT8
FS| K
wmD-q
5c<y
vCSr
9(N$&
System.ComponentModel
HP !w
wwu3
2v/&
iA>I
2L o+
^:T3
6V w
D}m3
%f e
IEnumerator
Zecw.
Ak+g
mav^ModuleName
?\ i
yY3 I
_[x"
4B ]
;##`s
C3@HR[B
Yb$X$
;E+N
=X@ Z
E"IL
\~ lDQ
s0,H
w#-2
r9Srn
W6AY
e0FN
Y4Tc4L L
ow H
7n~{
l*\}
::`t
",Gi
K{7f
.1Z/
~=5 -
#iM
'9@
ugR_
<JTx
g1V=
/a_K5
_#9r
dvn$
-r/.4
=?on
A&V?
x<l%
F][4
;b-k
#ad&
?Z<Z i7j
(J'M
System.Drawing.Bitmap
V1Xka
6T0p} In=
sO"!
SNS}
dK\B
6az;
HP`B
J}Aelele
zs!!
5e??
>MM3R
WriteA
=?N
GeneratedCodeAttribute
disposing
('&E@
Sc!5)
g/!=
t r-NjB
b%@i`#
"r;iy
f?o&t
BRJ*
* \D
yOo_
WE%s
1g+:
AfG9e
Sc}x
* lW
StdInput
#J)*
*# (
\m N

#infosec #automation

TheSystem Itself @ 2016-09-08 17:27:02