order.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 15/56 Related 2134
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 536.00 KB (548864 bytes)
Compile time: 2016-06-27 17:12:15
MD5: 5bbec95c53e5281b607aea9795b4b3bd
SHA1: 6534bf5a45fa89b73af66e0e5af8ea8de06c0cb6
SHA256: e99e89896235346c0b894dcb64cc17e6000a4f12d87f9b89e71c4d19523670b8
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2016-06-30 20:12:04
Last submission: 2016-06-30 20:12:04
Filename detected: - order.exe (1)
URL file hosting
hXXp://104.168.189.222/~mmxslcym/smart/order.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2016-06-28 11:46:50 [15/56] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x85404 546304 d13984c2c0734612d1e5363d8617e386 8ad723466ca04f9367134a8df8536ff5267ccad5
.rsrc 0x88000 0x600 1536 8ca84d682dfc993220c10687ca58153f a7543b4630996bba8c3f00935aa03927d6a60368
.reloc 0x8a000 0xc 512 93197fa11823c3ba0768f5547004e198 b33d3a44a692c87ef6da05efa7330183f280e6ce
PE Resources
Name Offset Size Language Sublanguage Data
RT_VERSION 0x880a0 780 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x883ac 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 Dicolab 2016
Assembly Version: 25.1141.111.4
InternalName: TeamConnect.exe
FileVersion: 25.1141.111.4
CompanyName: Dicolab B.V.
ProductVersion: 25.1141.111.4
FileDescription: Flash Player Service
Translation: 0x0000 0x04b0
ProductName: TeamPlayer Connect
XOR
8 457738
1 457738
2 457738
4 457738
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
ADVAPI32.dll
KERNEL32.dll
IP Found
5.50.51.11
URL(s)
No URL found
ClassLibrary1.exe
W9s
Assembly Version
-98
Comments
TeamPlayer Connect
-48
-49
2147483575
-40
-41
-46
-47
eEM
403
-114
Translation
`B-^
-84
="|
-125
-126
-85
-106
-121
-122
="{
-116
-111
CCWsdqwa30
TeamConnect.exe
-110
C*z
-69
c54688e4-abb6-4a63-accc-13258ebf101d
126
914
Flash Player Service
-81
LegalCopyright
_/bz
CCWsdqwa31
-39
-38
-37
-35
-34
-33
-32
vt0
000004B0
Ex&
-99
CCWsdqwa3
{|-
VarFileInfo
-100
CCWsdqwa6
-105
-107
CCWsdqwa21
CCWsdqwa20
CCWsdqwa23
CCWsdqwa22
CCWsdqwa25
CCWsdqwa24
CCWsdqwa27
CCWsdqwa26
CCWsdqwa29
CCWsdqwa28
-26
-27
-22
eEu\
@RNl$q&v6
-93
427
CCWsdqwa2
s|-
CCWsdqwa0
CCWsdqwa1
v~?A
CCWsdqwa7
bW'^
CCWsdqwa5
-90
CCWsdqwa8
CCWsdqwa9
-95
-94
-97
-96
-11
244
-13
}c1
-17
Gruhryn
CCWsdqwa14
CCWsdqwa15
CCWsdqwa16
CCWsdqwa17
CCWsdqwa10
CCWsdqwa11
CCWsdqwa12
CCWsdqwa13
CCWsdqwa18
CCWsdqwa19
ProductName
-124
Dicolab B.V.
137096
_t%]
-119
-118
-88
-89
-86
&Tx
-117
`A)Q
-82
-83
-113
-112
I"{
-109
ClassLibrary1.Properties.Resources
eE{R
`C-U
972
Copyright
-92
zc-S
2008
Google
b(Y]
InternalName
12241
VS_VERSION_INFO
CompanyName
25.1141.111.4
-50
-73
-72
x.BV
-70
-77
-76
-75
-74
-79
-78
29827
-123
S%bf
Dicolab 2016
-53
Uqb
|B<S
-58
(l8
-127
`r-A
65535
-60
-62
-63
-64
-68
950
t&F
.ActivityControl.GetMethodBody
12210
StringFileInfo
www.google.com
FileVersion
W<b
-104
-102
CCWsdqwa4
000004b0
ProductVersion
FileDescription
OriginalFilename
-55
-54
-56
T$n
se!]
-52
-103
-59
`t)V
-24
wr<[
a~.F
}c)F
!iB+;
lCi3
7'PS
cVX$r
_zZP
ReadDecimal
PNG
@ZU 6
Kiur
/?t&p
WgIK-
K&oHWR
etgZ
NY)|Vu
ResolveEventHandler
aY feYY I
cx2gf
iUU
ku"k,
u]-[
'H@A
6>4<7
.]a~AD
XZY
|<M
2]<d
2:!R
q_eA
x<F;;
!9t>;
!!F)
YNy<
XJsT*;
oVwh
t@r l
f& @
K(Ml
MkgI6
`-lR
BY$V
VK cg
d 8S
Int32
F!<`
k:c] Gg
PN&
.ej-]
J>q
bScIW1
M{uK#
?$U"
\xG*
_o%7?
U=Ag
`LM_
i?y
ZeYaY V
B>yg
StartupInformation
?7T9
s\9O$
a#FJ
CjOZ
l8 Y
ViFD_t
);s&
bN '
P!f\[Q
WFF,
defaultPath
/}{X
g5!feeXY
_v],=H
O>sA@c
'&?
9V5?V
DfT{
VZg
^A^e
%1
Format
>j)c
Wbn{
N*:o)
2j
UvB:
!rwh
\]K1
5t4V
k.D
Y.!:
<S<Q
IImM
E<b)w&/tbN
GyW4B
X%oZ
QSt7P
9RG@
iRFH
FRa"
OpenSubKey
kZXaY
* sx
KXV;
I!Mv
z.,b
v>l.KB?
%%@:
Ho|bS
;e%>
MYz7
UnverifiableCodeAttribute
uF X |6
qtXuS
[hvQ
=4j2
#-S1
:7\Eo
n7hqf
ovST
{Dlz?s
RU
ufT3
AMvI
^W Z
q]`:
FO '
Mybyte
mR{p
& 7=
3sm?
P A,
I)ma
<Ij:
>}a4
%^,a<
Char
"cxX( e
7z60
0uaLK
Kl>Z
u&?.q
GetValue
9$ q\
!.+;D
}j+n
HashAlgorithm
&+g%
& 2O
QBZ8
Z!\NF
5xY
V` 2%Z2&
d^+y
7*"&u
lL8ogM
2"[M
V|?k
CZ';
%&iml9
Jp}qdM7
W/,\
6s7z
ETX"
D/ #
installPath
!z2'
>^/]2
u&9r?S
lQ]r
`UY}Y
.text
[C3l
GetObject
'K S
?rPJ
M3rR
irJ@66
}oI3S
{B*NK
42D#
"b8vC
LBT
f`z}
mz_Y
.w~r
9K(3
J*>T
Zf
!9,#
2VJj
H8 h
>[9l7
-g3}^
{Dgr
CipherMode
)9Bc
5k@7s |
E7!V
/U&r
DEO>
k^o-
flash.exe
ru ju
]s5
eff
t(8t
bi(B<
T;3pb
kwS
4.0.0.0
IFormatProvider
/?N9
y+y`\
CompilerGeneratedAttribute.get_ImportPath
d"7i
CreateDecryptor
eKQoOV
G\z5F
GWkP
result
o@tZ/I
tfs#
sA X
(M_,
Jlt
%=U
*gl N`
q,9S*
ProcessHandle
']81
bX-|
[Uz&
set_IsBackground
E^a>
3|)F
F#(&
FsF>
K5Ve7o
Tly{
a%)Zn
YP?c
E _
:IF{|!y
#.k@
d6'+
-F af
<s1IB
`i/KM
JTE[
*QJE
d5>C
Cd@HO
!~1@ d}
6N~g|{
aY3
GetProcAddress
mj Z
\0{@
>h z
startupPath
v&oj
Z X%
='"pG
%a'N)
(WIl
6Xwk};
Culture
ReadAllBytes
WT9
Get8CharacterRandomString
3J=qK9
G^x\
0>z
"F
R~>k
r ' Q
Main
G;C"wu
LwrN
F#xh
\H!m
oPCz
jmD@s
As10
^<)1
BD),
d4b
\ *9
c h,
o\$(
/F.^
6yC2
Z z9@Sa
+Jpu
*+(*
.M3e
=C!~
lqyy
gr$
l)x
2 :P
MO!'
7XJZh
[s.jS
ObX^
YXeYff X%
IHDR
0L2E7
bJJv
]vnx
@kP}
Me_3+,
HJk4
0f$>
o>/
J|Ve
S \9
y) g
ZY X%
pfq4
System
EventArgs
VsF`K
ohL
,+0
e&3LJ+
G*`=R4
^D<*6
e{-<
&5b
.7`%
o+"%s
)c1'0"
-T(l
MethodBase
T
K,zB
}A?;
HLKD
!SIa
m@#5
Jn:FT
GEV?&
D%pk
>E(S
:#I'
D`Fm
F-d{
'u+3
EndInvoke
x5h3
hi@
9;y
!&lw
bytesRead
ay
D7lq 1
>6Ki
inheritHandles
pumsAjQh
%]]
pjLl@F8
s!SX
i^@y
7plTr,
po*ff]
0{ta
rb^Zl*
>2GI
GB
i%
l <o
-a3sJ
3B}d
JyyI
:'Es
BA D/
PHd!
hvS,
3ed=
1)v
0 !K5
~h)`b
a3Hu
lU\yC
itqNB~
VAcX
_ e
t|nZ
US)U{
l!rd~z
v-6%XA
h"<\
Desktop
<5z|
WKr->
2+<=
ContainsKey
oE"Cxf
-:Po
m36U
startupFolder
a" Ok
z6Bfs
#T' AW;
zyo@
_%14
NcfCU*Yh
{/.M
i'f
p4 j
>UO.
= hln
(EIxP
2" l
"Dpd
*dS:
^kXX Z
Og@
|x9W
\X(A
9=%x
:^?py
F2 p
^E[F
?# W2I
Sl8
Ppvtpq
s.y3
(\/j
MJ2Ww
F?cn;
/-)&
@UC2
s 40si
GOh&
GetTimestamp
z<yt
]~T(
ActivityControl.GetMethodBody
cF9~
cyLZ
|a s
yfWy
@r =
TokenizerShortBlock.GetApplicationStateFilesystemLocation
`AfN}
xbV`
dz`g
GpA7>n^
/8Kj {@*
0>m8
^(kkRJMKH
[_f/
j__k
Byte
NGQ
%w'.
BMso'
pM+]
Hx5
L}`w
f)C
HM%
GetEntryAssembly
lnfs'y
ym>$[
bU*R
>BY8
\96b
"i7D}ke
N7P&:
` i'
_a|-1
.Yl&
=(rz
nb_q
<g64
ToLower
wZX
1wcWz
<-gf1
ny.u
ProcessInformation
; $I
ea%R/
.%df
04)5w
3!!
#'0-
)dZ XGaL\pA
;`1/
K#_
4 X-
U* d
@8z1
F5Dp)
ToArray
SG'E;
$S?Q
6h<qY. w
gSd^
y-dgQ
"!D+
GlN(0
&Ai6
;y2|
bo[v
t8%j
ToInt32
u +A
6.4q
ClassLibrary1.exe
#?q=e
ICustomAttributeProvider
>;] 4u
$^Vj(
k:+\
'X!nv8
l7dY/
'gfefY
D^2`
Y\pt
IP(&
D;v@
t^q$
}Ou
FTLZB
:lXS
Aa
StrongNameIdentityPermissionAttribute.GetCharsCP52936
&SqS2
havXAvk
KW'
zW[
\ >B
N |@
7J+%Ze
3OOy
;~se
{F:ft5
{NFNy
0Qi}@
cX{,
qm()
Zfq~
hd8d
H4M1
Ee7\
a 35v
X?X
e_vH
C q &>
4m7i
t H9
qbSW
y'*1JB
A6{v
t9L2
zr-
JWasa
mdE7
GetFolderPath
[zedI
rKKM
{?hlb5
FDvw
&" }
@q;@
g:}* ~
@V|r6
9N9`j
xsh4
z`jX
z7'a
Invoke
Resources
!N5!
a{CJ
g1O?Z
_SE6
&l$<
*-$V
buffer
-c !
/"Pp
a2R8
.~rJ%
Xm6p|02
N"Cq
4_{}"
N`oH%
%J?1 *
z5tKP
Array
21Q-
I V#
-ry~
CGI$
ia}
)b'V
q@[5
#,5u
a*b4
917Z
:_>u
Iq@K/E
T30qs
o!{k
[Hjl<
]6+
<C W
E -W
I- t
/Ie8q
wXsy%
ik%|
H QB'&#
Qs%e 7
Biv/?@t
jXmPq
J2:j
J,e
e/>:
lpAddress
<=M36
ZbB
1 V=
A}V.
BIEJ
p>[M
d]<w
g2TF
cNDC
LN,T
>~\
Onxfb
ReadUInt64
nK|~J
E4SO
)vt
RuntimeCompatibilityAttribute
!7)h
s^ Z
R?~r
"kS/@
+HHaS
}pJy
6U?sP
;5 u
&kgq
0@:s
pF#:
|}:S
"Q?&H
4&I?
|x;M
"2 wf
. R
_gEX
YNJ
Ti i
p:>"ft<
JUf8
I"cp
""2
Size
r+#lw
bn >
Leu/
m/'S
Uw}'
2I}k
]3Tu
3iJ)
;WaM
tU)`
3G)'9{
Q1A+
h~.n9f
x=I)
"q5aG
=|O\
+bEu7K]?Od
%M#
s%F?
get_Item
Zir+
Rl=f
ISerializable
(e[r
Uen?
a,(T
uVG3
k}~3
N]$+
B ?k
FVQn
<-1i
x2{^
Ijhr
]OTIY
G aJ4 X)Y
.F.\S
6gAj 2yRJ0
j0UX
M8wX
ResourceManager
Wdk6
GetExecutingAssembly
R]sc
uJyE
K!ot
g0r-5
F}'>
v:"$D]
"beSt+
J~(W
nHD8q
5tgf
0b$F
o4J0
ToInt16
WorkingDirectory
#iJ0"W
d^G\
X`pq
bu+pe
*a&5
S}+dY:
wz}/k
{2*(
ZR"a
hk^l\
<^#6Zz
Pg[Ib
cB'\
ng:B
=8!\
6d?e
]-*qc
:iWc7
Empty
I%C0
MS;LZv
L^7&
%w#9F
?e}j
pp']n=!
FJ5)s(Fy8
wf/]%
FileShare
pAH0J
$O_63[5
a:U{n>^
#Dh\
idG\
UNOoT
3cOu c>
AP=k
~i,S
nJ,0ZXv
>a y
g#Yk
AKg00z
_{[C
jp4Fl
K3~#
MS|We
wPS.\
$yKXV t>
ZDFl
Read
M9QL
0ufCc
h )Wh
MTkvf#
get_Hotkey
DBaw
|SLq
,BRg
""UV
_QR(=
xmZ +
e?U\
1YG4
18p f
ReadUInt32
} sQ
FpA^
c%v9
MarshalByRefObject
aI'h
t(n 32(
mscorlib
{%"
FileMode
DkRz
.]e6B
S2OJ
:62
eP}%I
x3a
iconPath
PW j
]M`R
SHiMM
6hXYF
`;m;4j
P -?
#[ZR
$uXB
RfXZ
{-(t
0}4<4^
F|+WW
ManagementBaseObject
E/h
pass
FileLock
get_ResourceManager
<^y=
PyRr
+U}(
kONY
RuntimeTypeHandle
_YN0\
method
Z N}h
c:%@y
b Z G
^i j
kON0
AEhv
-|K
UInt64
c[~84p
Oi #
aF,u2[H
S5'1
<!JCW
}EKB2
< ?
LxW^
`v,btv
& s:4
re 'u,
E(}C
/mgw
v$3}6e
o.4>
K@ Q
$}zl
m\2Z
Mkl'B
a};Y
Vz'i
J'L9
#f)^
H]3
WOl0
Partitioner.SafeRevertToSelf
$-tE
|qhF{
Y&)w
>nQ!1
1yMZ
2T\#XQ
*8R
RHyHR'
GX9D
FM7Z
Sx
k( 1
2qjtS
4 zbT
Ag!XC
Z T^#
drTQ
7yo7
u* J
eGd+ (d
threadHandle
6vl{
lpFileName
c3}:~
z}9B#}
3msG
f$Lx
nQ@`
#7W,
;r^7g-a
=5Ly
DV3U
!This program cannot be run in DOS mode. $
b(_j
M+H4
SU&System.Runtime.InteropServices.CharSet
l}to
+ "bm
sR3RS
x`-dV;%
Dispose
Ln/
<@qphz
?Y"X
enK)u
8t1
9(Au
:-DG&Hb
zI3;
y"Rq
n-7r
bK6
w0Z6Z
uCU<
0B(2&
.3Zn]&
y3T
B'"c
R7-A
8-Z -
\JE/
TargetPath
C)<1/
:psy
ApplicationSecurityInfo.ResolveSignature
(Yj]SH
H1t[?
*:}E
sR,JQ
g`$C
Z\L7
{O'jm
get_MainModule
j" dpB;
JOQO
B4 w/k
="5V
HsNfiS
C+" xad
Z R(6
.)D_
~K?u~;
(mCS
1M?# 6S
d\,]_DX
O{Ks
PXuQ/
ANe1
%)[Xg4
&#f5[8xa
(yxnSm
N^F
),3
|1+mM
number
iB>5
AxS7
x`0g
S=( v
LE*St`
C6wA
1:7+
~/E[
yv6M
_/(R
|AU-
8zKG
QUN)h
SetData
nH.pM
Dqb(
set_WorkingDirectory
Bjyd
get_FileName
]f+5
gWMz
8fqVy
Izr03NM
1HX
3+@
c}dq
v".N
BlockCopy
D|-9g
pB;n
)Np8X]
*c" a
Mutex
SizeOf
wq37
#d5t
&+\(
2*['
wfZ
\V+>
BinaryReader
yha}
y!Sa
WZ #psa
SM)V
@of
^ccx*
]aUr
'nml
K9w\{
CultureInfo
AL bO
%r-
X,X{
c 5u
}l*]
Dyr)
Q]kJ
_nK\
R_+D
Boolean
]zT
CZ0%
ZDDG
m@^*
jh5q
=' $
MethodInfo
effe
i8j2|
K6L5
s?4x
Z ?h
Hashtable
p\54
CRo-6
h;'UEF
jpYMh3
7KF C
d98v"
'x} X
D51Tf(
(!$V
_,?d
e&}S
R*FMe
QuH!
$G]*
Lk ai
<.w-~([)
{ms
y "wX
L08TG
m3t7
K(0x<
cJaB
W#Ra
;F$
_$*8 ]
; [r
90Y@o't"
_2MR@
mutex
R y_T6t
{q:/>
BC8UbqM
2J:TZ
:(aP
.4']
GZ hd>
;u]U
GetParameters
U2QsrN^
I=~$
QX"k
C!
xZw_Y L
'f%B
processHandle
[{dT
G nH
YM1> {
BM5P
|vtGX
TryClaim
>PrT
3AB/
4 kn
#N7:O
' , Q
/ yE[;
1vl^
(.19
mcX8
z(-cz
Misc
+X?Br
%'Z-
G3,o
6p5iMr
Flfi
>jYD
Db>g
VuQtp
5 +S0`
IsSandbox
.3GFC
GAy'*
FbhL
w>g
currentDirectory
Ov <
42 u
tA43
y^)`t
_|P%
~KIq
|,~'
+LG"
System.Text
O<4f
=z1R
7[j
z,n$
S7l
4ST
#R \
1xLWb
i_zF
Oh8d
)~4|
eQ(58
i\Kb
Y,Hkv}
-Ap
!A%}
;S:+K
1M/
\xyF
F aR
|.le
S,#X
r\gQ!
<T_
KoY
vM
'r1
F4 3v
-:Ze
`\or
Kpu?
Show
tsy%
CShE
~L;{
p,9].0
&Zf
^&^4
-F'
Zv w\
[!ie
y/ju!
7{$l
pH8Rq0
L-^
^i*y
" 40
_CorExeMain
DebuggerNonUserCodeAttribute
cMFU
SNO
k nF
2ls>
G{^y
object
l%H?3[
PJ\?K[
DebuggingModes
= IFM*
#a`q
`Xc:
q* @
y5^w_
V{k*
&k~a
[f0]\
?<KH4
k4`
COFt 3
"F?Obw
#l@9
}e'
x2w7
;5,<N
y?<
S4M2L
V> @)d(
P>i~
d~X6
eSQvQ
F/4
dwSize
0hJTZ
?-`c
mY+-
>x4TM7
;v!0
|U$u
l4H:
ITY
get_FullName
62KJ
WffoF
}7eMd
(1; ZtLj
p!JdF
@-&F-Q
rFj0
Single
X'
m!MJ
CallingConvention
-:5rA'
hPT>\
i__e
d(bt
_=JubFn:
J\}t
>;bM,w
~\Nv
h-2:U
!{x.4
\n7cO4
{aZ
;E*eN
c
3|Qa|
w}>J
Z}S-
ev )
:QrW
~#^%
YUi!d
processInformation
#k5Mv
::e_
TEQ8
'%WR
f/VQV
}!pqV
7Ug-0
2(gf
HYYYfY
_rU
z t
z t
#]hW
W <)8
wtK>m
zhSk
D#|f
GenericTypeParameterBuilder.get_MinSupportedDateTime
1`*l
DFi[
g0Dbr
=DLn
OC.<=
PGu:
# %2
P@_=
index
\*01
get_Length
2\,c
<" o
{(2,8t
NB5 f
A2r'* YZNj{a
Oi -6
s+rk
uWY
fsg{
T wq(P
P~n,
XKQj
_ ^.
{Uz2}
{" JP
tIYa6[
XZ u
sRGB
\`DBaB
Ad0<rZEtk
_nkA<
(6%|I
L0:}
} "$
|.^-W
VR_A
cS+B
D\3LE
jWtq
ToUpperInvariant
ti#*
M/>VM
LR@
Q`a
${.A$P
Hy 1
+ >'
nc)f3
H?XO
{*w|
_X^8
\Q
kM"V]
0 8O
Qx:I
Xc}-
set_Description
dVt"
"g1;
$YcB
5QM 0v
UxaZefae
process
nyTo
4xa:*~
Ten
N?v
+ZF
<H(U
sIbnJ
CloseSiblings
9]IS"3
!J(v
z(hz
7%Y+
.^tC
threadAttributes
Bk&
v8U$
tF>u
*P%0
I-*g
7%Ys
o$&n
Jcv!oH
uXTZx +
Zf6z
XXeYY m
I} b)2
)}h>
#O*Y
[Tge
-g_n)j
yUO^
{BGT3
Epbr
e Lry
gf/5
n<3x
5{H2
&3!Q?
set_IV
SIimAy4
4sd3I
System.Drawing.Imaging
D8wI
"}LC
_H,)
]x>
h2K"
R*;g`
%m?3
pi8u$
6.tP
#Fq7
2NX
p+tU=rv
i#,{4
i}U$
set_Culture
aH|8c
u'f"
^ESc
w J=
}Zaf
LMxk
Point
%WDj
F`pY
'D ~
jR{
*5"9
|`^T
Z/N}
eeY
|oZZyu
>{IK
Y^m
\4nx*
]tT
Proc
fbMv
Z93&
Do*l
XffY
?#:N
j Z/
2008
M2 h
{>ae
StdError
YY n
%M-.
W$Dp[
r'>
aVOb&
2^r!
L( f
!$jVSn
eC5 |
Cm*EAo
o/1q~
UHW>
j{m8keK
af~8
DbYI
lZY1
^XK m
*8aH
VY^`
v%UJ
}e%,
8i/cyfS
GquwrC
+)]r
GetFrameworkFilePath
~V K
*L2K
UXt'6ml#
workingDirectory
&o:
q eYa
3T8 K
m-/
fy<S
b #aX
>:l
Kv$+
RC>4
)OXv<
5[\B!M!
q8h]
_Z:b
= U1
$R h
x8 ;5
o?muE
WDlY
?V_A
*B&Xn
wJEw
@f*8
VGbwT=
=.pL
n7oip#2
e+5(p
U<Qs
ps!\
1[g*B
ZZYY
hxec
H7$irA
(,QiB
O*L9
7wB$1
g0BuL9`
4XE4
9" D
JD7t
|>lo
s|c$
y ]
u 4)
HrfSEIID
AS<p
D2\
Q([N"
Gn+R
=qnn
xod-^
81 )
u27`
?9Vs
?q_t
z~8og
VlP
fO]w
8FE1J
h4zC
IDisposable
Xz!C
k3z$M
3_'-
+'n9
ReadChar
Ub;<
uT7F
= 6b
j0g
ndxJ
q. a
p<8[j
$9bu
yEKcbUnj
+Krwq
_|[Q
7>"N
iYwC
rJfL
HAYJ
2*}Lz
F1=C
.H4Y
lqamv
<VDKJ
dczH/
X]TJ
H 8j2.eP(p9
o#\U
[jp4y
UcDWl
]k $
"Yr
i7=
.XbVS
7H\`
K`yD
EditorBrowsableAttribute
hX,]
NF:<
FvQv
cHC.
EraInfo.set_AsUi8
(;[c
3E'
xDb3]J
ig\'
}<}M
[>Vu
Uo>vmN
?rA%
'F&V
3qKm
qc&]
#GUID
@ IA
$ &0d
jrR2b<
cBuS
z}d@
n7A<
wC,%d
hYE+
}z8Q>,
SIx z
nl+d^
m%dQ<
MonitorSpawnling
<yR{$
'h%&YR
6=|B&]&
p-N3
g#uFi
g`}
PH)`
-ev&m
' y8
5L{H[
DispIdAttribute
\gu|
olp=
}O
\+Y-K-P
^^d
HfY
$"Pd
y|eX
h)<a6
^tQO
afY
fY O
9#^z
|i 1
w)&r
-B8R
fY Q
xmy\
3>g2
jd;zE
9P!cf
H(%t
q8"q
2`y3
Ebn?d
.Tf
wqSF
& c?
(~n6
G.#
m0xX
get_Size
)k`g
OOIr :
Tb] B
F(Xd3
Q/<a7
VrH%
[RwS
Replace
@Q.
RegistryKey
Oi0 G
&S/#
+!P8tk
dQ{v
2a^l_
F`~&
IWshShortcut
M*"
4lBw
j~MP
nY<3
iu[H
[ /EiW
w*e[
[jCX
P'76
+2#
Jlnsv
DCs9
9QYO
\@n]
ej>e
@x Y
mwMjG
31]u5
@FZY
~t<A
N|R?
c 2_
hMZ'h
System.Security.AccessControl
F8@
\a?U
aGGp
GeneratedCodeAttribute
;kHU
OYy/'y
(Db 9
bbG
;R2'p
^7{ m\2
'I}4
b BF<KK
KIb{
)+@
>F]F
\1e
{,fh
m 3
u$pC
l\AO
{tOU
SFsUk
h_rI
/,N\
:Heg
Zj ]
p 1Hu
Hotkey
XHl?
w=|_
'ol3Zx
!wFI"
c]p>?
jltSf
syQw
O:n/f
0/&1
sKxA
Substring
Process
TP`_
*I2U
YDu6
Z-Q`
GJPr
lpModuleName
L;W
*DD
:(N1
lLZ4q
_cnmR
F/k?
GetEnumerator
gDH,
Ym9-4
Ebb
`# H
*yT6S
`a U
A{=i
KaLqz/jcj
Ia^B
R /p+M
1EFm
30`r
DIfr
AsyncCallback
eCGv
f&yu
v`)H
5f EZz
z ){8B
_?yV
\&X|
Wtnd
lE&#
x[bW
<4|&&-j
0sBE5
HT<,**
Zn6y
T#P\0
}1>F
F$[>
E}k/9:/
y&lQM
-Vo2
K'MX)
hgtiO
^FP?
oP"a
=&f@
ImageFormat
"g&
AssemblyCompanyAttribute
f=c+
startupInfo
nb6a
_XAX L
G`?O
length
l4iv#&l|
Vrk#G
f =?
-^%3
L16V!
l#z"l
icw2
AppDomain
h,WH
UFVc
-w.m
am[]]7
}QCU#L
82& A
^.!-
#+*c
<*ns
PADPADP
`oMJ
Z\+#
|)`.]
X[N:3
dQBR,
t`8F,
|dJ4FiD
n"a-
EyUF
R|.`]
qF(n2
.N:,U
]T2}
mJvV#
{PH
S}0XIq
Pm C
$#aCj
j/Mn68
c`p'
lGKf
Yv] Hj
,[Ye
=*Kw^
!;iZfY
& t
Gdvm
}QV/3*
@:K;
DD8=D
E|Wv
Type
KVBY
|K++
N.YO
SEN
$qH%r{.
'.?D
!\me~C
.k+
WcIN$
019)
5e00
Z::3w
>3]~N2
G@iy
eeYZae oQ
5&7W^
A5)(~RL
bBc=
hm&[`
System.Runtime.Serialization
qDe0P}
FYj{
1ni~
/B^>2;
,dhw
@OBf
n<7
1Zh0M
Q #
Coi
5Tu
ZYa
5E'!A
s$S$
t`J.
V51-
D 3\v
J) W
Xz" Y
D#Vcr
VOVxl
\&}o
bZYS,[
P<1T
1xy*qS
r4/*
$n}rt
ksuV
MonitorName
DJ!
c5%V
O7D ='#
\@lyoQ
}e\<[
/8&|
0b\
n: U
List`1
ZLF
[Tc&
tK0t
J6/p"
|@M\2
sV 75
3 3O
&2FY
IE*B
^G,b
;kq
:h
m)<w
2,@#
SkipVerification
X 0?#
+ aI
/|p)
Monitor
Kz vx
43;m
Md5HashData
v~62
SM<5
#dDqZ
Nd yz
kF&y
MwX[
!_>]
.*^R
jm>w[
sD\\
EnS)
0m<]f&
! 1
OH($Y
GetModuleHandle
zI;N
yzR ~
- B:
UKRE
`.rsrc
z>_&
iGP
B'*l
X` M_=
RReadProcessMemory
*KN
e}?kU
XT)w
hHqB`
:it`
lnbY
U{`tB
y10
8nez
Q}(b
@GrA
{PD
wVE[
PrkS
'vwHJ
69 *
Z *?
L]_D
FJG
yC7
cZ9Q}
+TT(
kG^N
=Mk}"
am'
x%du
Load
>VJ%c
1( :4
|a2zI
8G c
9N2:
Igju
Td, $f
sVQ]
.9TR
p+G %z|KGN
Pk-84
Fctv2
5.
~,l 5q$
!^sw!
qZ3'
g'w#
V^"4
rA-$C1
u4r)
kernel32
0g^#
/&`{W
MQ ?z
Ha$X"P
Tg~/
m&Sy
9<PK
)Z 8
\-zM
Tf*:R
n
y8;"h
7 G}o
mMp/a
|Nzc<
Q^n
As?d
~& w
!tq)5
z r+
|E*
=6j.:
C_{-
stp%
^$)g
/q%-
^|]+
% (#
{"|e
[?Z(bq
A* *
fPh'
0^V%=
8X61vv[i
w C|
dbp3d
@i 9
iK3w
">yI
ymA6J
Ll5/X
Y14"s
kVxs
b'8%
rile
8'H?
2sd~
nv
+n&'
G$R 'C
9262a
U\]4
g3 0
.k2.!
W6(o
M9fap
(e;ZW
%<b\
.#:
kYlz
#Strings
+ JR
-A_J
Image
W F^+n
Bn
A9@vN
cF(m
::@{
get_Arguments
v_\d
cMyX
X$b> S
$jhZ
E G5
Y|>`
f E ]
emi@
I67;P
2M7H
_?X$
-E;.
w*d(B
m:jr
GetEnvironmentVariable
'a.
;HQ^
!q?h
{.+|n&
y<6N}
S@o7
OmbCvO
@g M
9$gT
Z g
)c.d
?Fd4r(
g&4x
tz sW
RhQu003D
X)Sp
1x#+K
^j0
`3)c|dr
Z\ G
=Vr#A
B.!C
`oRn
DA9+
~_Za V
_(Q>$^g
UY=
l"6`/
X=G>
!;-
NM6u0
aYe X%
%F}p+f
> 7x
qT4)
}> $
LOtO
!9&` ?lB
oo8j
Ir3'"
<g0C
Z-v}
PDV|
+g6!+
flash
)#vpv
J"|,#++
(%@K]
)x^t
HItZ
A{Tt
NQyQ
hxKZ
^PDv(
PS*&x6i"
c i?KP
>t3Na8{
9~wi
BitConverter
Uta \
xXam
>Bhx
t{kTJe
THLr
yAJLoShG
,~eo
k[c
_*O*
'Iyx
G1=E{
10fc
AZ fL
yEh!9
!^&VHX V
RZr^#i{
M[}f
$'CQ?
gyGR
]IB>IQu
&u3IZ
Zt%l
mKi.
Delegate
,1oO
`@%
}'c1\U}
2[5
get_Unicode
6,o9]
#-Xt
,PwlldE
MType
t<VP9/9
cKOWZ
J9&#
get_Bmp
U&bX
! r}-
)Lw~2
pR,G
00rq
#lX
olWH
Rj?S
~ F
*Upl!
2Y*
Ge 3
Q+tS
Pc &
74;
zN"F
(b x%
Contains
n/Gm
0.7w
=+@f
b<v}%
q>\5
Deserialize
ValueType
N?ww
4dCi
F/W
System.CodeDom.Compiler
I)fc
x&5b
TwC*
c_OH
D3tK
o *z
SiC
11(x:>
sD1
y`3hx
:T xbv
3t7S
+%wX
|y*u|
v &C
d*p6
?0Vz\
) T{AN
eB&Q
OX A
ELbhC
Wait
get_Version
ZUJX
.tF jP
ToString
+Ml<
mG*_
)x60
HBNi
_nE
> $2t
M, =
Z H=x
#%}G
) RN
_<_=
~ab
G[Y+F
{%ZX
@,
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
AV% 6
MonitorRegistry
[RCt
WRMf
2A$"
vd'E~?5&
TU&X
{@S
d~%m
f@#J
NS T
hZC3F
{Iu'M
_/?(2;
Pack
+<5c
f_LK
G^_t^
q U'(v
M/6{
System.Security.Cryptography
>k6J
!]Px
k 92~
!+y
C" `
6b ;
A4{R
-;:YQ
Combine
-"HMz
< 5F
/'JxI
:iJ,#5
=B8W
,\O8
.m=p
CA5-
PPEek
FcyK
>n??
MC55
'|ues
$B%(V
('`3
B`W
jDSqY
XO-}
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPADp
RCd
52~B
.ctor
h2^6
{74+X
Cu|#
70z
_)`
rR:>
flProtect
@m!-
aXUC
XF xb
"}L`[
KA{j
[ ^k
y~to
,|lY
C0f7
E8A2
vJ o<
]HV)j2
}u{6n
5j|@
fWn(
->a+
hzrm
c%~
@.reloc
k5+r
lXpt;5!2
_~@i
'UB;
,{yh
%{AR
.'w<
pA~H
ByteArrayToString
dUQ_
WriteAllText
creationFlags
K#(y
q+x7
cEz8
NgX5
rq1y]M
+\<N7]
-
b&H0-
ftCo _,
\]dS
SfYfXe X%
DlPa
1E(S
wt U
d$s~
TypeLibTypeAttribute
[XXf X%
IR =
asgfytmn
j}/h
UN =
r0:va
H:%I0
' af
NF&X q
hvH;o
,_.b.^
nB) ]
& 3
-\i[`\~\
`npxm
}1qO:
,{ e
*u;W
*s!
]B'm
a ]ic
z+Jl
VbL+`
S /4
0"$f
d ?
FileStream
i~
=/`}
_fO*
9>Z}
R# F
2-hKX
&UuOo<7
gsCU(
V4$7
Imk{
G ku
/Fu
XbD*
(Z X%
,,3o
|0zD
w6xe
wC8# S$
3q.S
=TZD
mb!Z
&iX\\%^
'y<h
r8=I
}|s?
`G#w
=}FL1
gyI~I+
:RI?a`
_%w7u
V[`h
Ulam 4:q
j=tB
zZT6?
~-4a
, ;~=
KWS$q(
ZY 5_
=E~|m
Description
{C
xP C
*Fx]
yc?jY2
:.
+zc;
get_BaseAddress
Tvh)0
:a)x[D
$#a{
f6*k
E%F
z\<X
A4fn
F S&
$.#N
N.bY
9=V8
~Rf2{
m4;Lq
kcR
7n vv>
#.$r_ g
M0kO)
LAKT !H
GJQnS{FY
A,O8T
JkzG
Lnn9
P`-c
AFJ#p
qD{a
6 +
yRWw
QJMM+
}q\5
0L+
<h#3
-]w~p]
b~pQ
T,4Y:
iunWvqaJ
(6
V*cqi
Encclass
InternalArrayTypeE.IsModKey
IComparable
IRestrictedErrorInfo.AddEventSource
-*hS
Zfa
zKl}
f|A2
#dVTh
CreateApi
uO8^
NdT#F
Equals
=-7;Kl,m
&;H*
UUJj>
*<(T
S!Pk
Rc3f
Lk`H
5P]8R
`Mv `
tIw\
ExpandDictionary
KR6NdG `4
Qz{9A
z EKTB
r J
Uj'
wXfT
"yGo
vAG1
+h%Z
^Hb4
)"SF{g
Tq#RL
get_Evidence
j!tg
}" $
lB 4
qJR-
%< {
X & %
o1>=
7cQ'
K4x`
BeginWaitForCloseSignal
1BH
xI# [
;x_}i{9
.^yhu
~%ts
)>& "R
|W -
set_Arguments
u 4
$1b507c00-d6f5-48be-a565-307b5bbea5c9
iHKrl
$$^
q ^!
o] j=
/h)s
8;w`*
_<Uu
;gh]X
gAMA
!K{t
5}XZY
uDZe
Q-.S
gynI
DIX
"X m
gtZ;=
targetPath
DU1'o
;^,7K
%4E!y M
valueName
""'=
,:C>?
RET+
qCzW
.&iM
I.W5R%S
^LD3
SQLlw,VnV1S(J
Uk-;6`
JiKc
V|~x
82;*|^
{NH5$~
R~ML
FOE(e
\D2C
YY D
YY B
Wcb=
{pWntM
-N +&
u/3]J
`gSN
g,GB-
Bitmap
$. *O
P~<g
x'5n
|<kt
C5C
4X>3zW
VR aE
WaitForExit
i&|,@(
"w|v
|M y
t7 x
MonitorPackageHost
Gov!
,5T?
R+L7yb8
/SsD
$R'm
, ?s/ +j
n0jI
/bpt
_)O
zg5G
vYZfYf V
o(CP
8`* C
(5T-Kf
#sO8%<
6J!&j
?Cs=^
kT"<
$8z#
S^_L
EoQ
t"6\
/Ue}
OxWy
IntPtr
vG>?4$
K(?{
*C2KH59
kUh4E
cO(o
}xz)
OuU
iu^p
ReadInt16
TGdl
(2f5
]^V~
; ?h*K
<)M*
GetFileAttributes
VI'
BeginReclaimMutex
~ )?9
ChildName
F%HF@n]
a/(Q}
YSgr
?9Kl
UnlockBits
/-;U
get_Assembly
fXYX 5
g6gd
^]XY
mscoree.dll
4fme
*$;)
>kfF[#
File
:!Uh:
lc @`
,lk7
> 6zc:
.ik
F97](
!#2CW=
\NKqi
> `{
_|-FI|
ICloneable
Gl3Zm
=>C4
7xSZ1&
$a;+
get_WorkingDirectory
y7T7=K
K=0n
ValueCollection.get_UsedSize
5" L!
ocUN
o Z n
dUo+
} Z@
Y0uq@xBP
L]QY
%K-0
DateTimeRawInfo.IsPreamble
Un?#
DWML
^7SHp
7A"e
*l9y
f : /
get_Scan0
^wD.
uE%i
k
! g;
lk;Q
WDzV
9[c'
)`GD*
FHPP^
Q>"A
|+=h
L'1x
Delete
(gU9
UpXr
(>/C
<5+J
A%O&
\[Zih
& &0
IP:
YOC3
UKmK
`Q @
255P(
~BA@
s_Ln
" bD%R
82 w
A,PS
$ X%
HxV$Q
`*&g
f?M7
F TT N
yKQ[PZ!
/ BqUk
$w#u
7xCD@
uX].
m[i5
GZa
7$<(A&/DE
L4b/
<XD
_a($x
>CN[
t aE
s [cS
d Qa
M't
wUG[
\33J
O=-z
yj*dO
<QlM
aY /
A(#
t /?
8 wjJ
(KTs
{x&i
mwtGX
parameters
2!#o
([,G!
RXUl
-&men
2> V
@Z,Li
)B$az
+w%0
,WE}<
8 k
LM j
MC^,
3V,x
Par
W9Mm
t2F#
h/<Cy
L(3 r{
d`kgG]
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
]C~[
{S5+Bu
]NuTrF>
KJ[2
|7{M
jF0}
4!mC!
T@B"
Au-H/
>~;k
J+iRY
7WnhJ
hotkey
.?C
l8"Z
ThreadStart
|*1
fZ *
2+1-L
` d\
viv!
p(`#;@C~.Z
H_k6
^DO0
ReadBoolean
N O&
])WD
[7d*
nRq6S8
$psDl5 )<D
~4^L
^kQ
|xQyl
i9D`
UI8a
>Z>4*
$1.ID
{y3l
+Ti,
D#w\x
% rA+
w.[Z
ReadDouble
SSc.n
%g_eZZ
p`#Z
EpV
'LI<
ZaYXae
}{"s
6}-|
$u h
I1Tg
fwjY
|$ y%"L
~fw4
&Lb
:F6Qi1
e'2z
]Xf&
]kRs
Q 2N
jTa
iAA\
QrZ$.)~
=i"1
HM@'
%kP1
TS)M
\};)
Llsp
EoSg
Z jY
n'$-
ReadInt32
x:Vl
ManagementObjectSearcher
8QY
p#n9
t7)`T
Y{x#
8rG8
_jT~T*Ud
eXa .
+HEj
&HIJ
mEy=
}^GnC
Dj?s
x+HDB
,U-G
[nig
%t}c
T Z
DB>L:
8j:
Pc&V
M(@U
pU!V
hn~j
3Y(\
U?s?
=>% fo
ImageLockMode
ICollection
yg9c
ObI'
ORGS
'S-Afk
";wNM
gPJ"
y @ vO
c_,Ut
Keydatetime
\'Fl@
uaHWgvt1
] Y}
[58 !.
l"{
c;u9
$F935DC23-1CF0-11D0-ADB9-00C04FD58A0B
{^p-
9 c-
F}j=
uK{C
"} A
c-#9
%<"|
qVW!
pc2V
g/_e?
.D*'M
2XQ5
Pk`S
=}:
PUjC
Ty;`|
]H?,
#\v0
D = ^[
tpz
`hVM
Gi.l
Attribute
0a~-
j|R>+nO
C#uvz
dLGr
:,Qxv
{r/s
,gwW
v7r2
55wfQ4\P?R6
b)) r
0*f7P!;o
-%^A
g5
u U2
N
A)
ia#>
DNNb
#[6
loR7
InternalMemberValueE.CryptVerifySignature
qyW"
{T3p
e 4
GOL)
dQe+"
Zfe
whs@D
BA:q
dS7a
.(xW
d$7<!t3
d=rQ
IsNullOrEmpty
G),
r_
Registry
g+fsj
GetFileName
ComVisibleAttribute
:F-3
%z9kd
Q hF&
ed=_
CZ X
`[xE
=@aN
lyi5z}
hModule
NL1fd
sLw2
<%$1
IVbK:
/%T~
=%Uvl.
3^c
6\7!
J2
E0
%rt{
*\5(
q$w.
dB""
^eN?
s_u4a
nCG
Bb/"
.wbs
d';x
Vy1*3Sqw
StdOutput
~\`v
S:wt
System.Security.Policy
;GH53
B,{f
*V8-{
]Tyn
5( dD
H< VJ
Gc&_
w;.x
kF5"
aY+f
{9$ -
d,tIwH
N\F9C
f=YSt
$ |\v
oo`$
%wu4
%}!I
I6@_
? '4
D<1}
4DQR
DaZ
Hi
5EGr
ha~/{
fJ\X{
,| l7<
O= t
1>FL
U}f*
kja]
=eJP3
Lt0_
)n8B^
<yjC
?4Y%
_u<"
EUI6
O*14
{Gj-$
'/(@
.Y2hh
uyhP
3NwW
pj %/
ffe
K8n~mO
J@ %
|`'5
JrCet
ry.6
FYd m
~k2Wx/
Yfaff
UgvE@
a!,i
(&=DB
_l6ATI
{Yl%
hF|v
KO(C
set_RelativePath
&8g
I"w8
s/l
#OI[
,`VzA
\R+o
uc0H
[|BL
RBI3
AE;s
X*=;2
}v!m
'r!
V"x
$!0 3
LKXf
i=;o
Ay^
}HZG
6s*0n=_
u `*
Bn~]
Copyright
Fdn(
$:".
eAyQ
3152
"`UF
f@]<
-q b
[)S|F{
A?t&
cjH!
Ka M
TQ*r
m1{"^Q
vD28
ujP(
~4L
MgMf
F)Mv
NIq
RuntimeMethodHandle.System.Threading.Tasks.IProducerConsumerQueue<T>.GetCountSafe
sOpX$
>lleG
set_Item
`S_C
ToUpper
g.K]
PI(i3g
JY^F
#7Z
data
XR'6H
SetRegistryKey
,YPk
Z :
Exception
7}u0
CreateSubKey
#..tA
%T$)
|e='
:V X
f7fb
T#85
\"JY k
op_Addition
)]q3N
8UG:
F;:q
m8Sy
xT1px
<j3:
>iTm6
zN}e)V
FhW5
E9hA
WindowStyle
R@j ERwn
H9C`
N"1W
?E;O
y(V/
{-F
M_N a8O
h=cD
RcXwscnC
ChangeExtension
U!.'_%C
GG _j
uuB
Ne#1
bW7Al"
hh(f
Or
ZCPN
6Ne\
E_][/
! W
hf;p
rQ,
set_Hotkey
E<oH-
R.ae
; bZ
+Hfm
UnmanagedFunctionPointerAttribute
$UIDAThC
]Y\Te?
FKNX `
qVW#nd
aYe w
[|eP
Z,JV
xhRJ
x7{M
^MQzYYo
tjw26t
Ha>~
q=Uty
z>m\n
aFP)t
Pw<0
fYf
P(Ld \
gHntS]`? 7VH
MQPR_+
_EventBuilder.UpdateDescendentDependencyChain
rY 5B %
SuppressIldasmAttribute
+Ve%s[oaB
Twc3:
EeY6
>H'p
.fva
Ch_K|h
k<+i
pK?s
Gh"IK6I=
-Tm>
6tW1
' WOS
m'3)
@Z R
WaitOne
state
v Y
$4vD
&+h 3my
vzl*
iN]F
aQt];T
YF2h
:]~'
&@8L
'J$b%C
.Vz1W
9}$YI6
"JQ-Z
_$A$5
$LH|
Q)]}%?
=p_6~
|js:
set_Mode
'hJ\zX
/FN[
MU:{o
avQ&DC
`#'n
/=.\
AssemblyProductAttribute
JcG<
-S[v
>>Fu
<Module>
aa02u
OyV9
eFb
get_SystemDirectory
MulticastDelegate
X'D
PIgB
%jp]
)kBU
c]:
!:5ye
H8pp
+}ha
pLhZ:
G}}v
/stl
p0<I!!
o ao
b}sz
lS0H
dZ8NR
DeflateStream
bk:S
get_Build
xhXD
{z p
Z__v
rW
^cRf
^cRd
-(-6K
2*}B
dfXaYYe
N r*
'y'q
)22E=
pZJ~
@tbH5Jd
Mt^<{s1
+'^T
v
sTDgTZx
$rnlp
{2LL
" s
ET)A
zHWwXB
,Zr
+j>mC
|yU-
OM4h
AcQO
h|1h
&P
Z\G5
SetValue
gmXQ
f_w3
m/ e
r]RJ\G
v-]&
,M_<
($;y
,ffE
O U9
j0rw_VX
}$C
YXX 8
4C,
{fh3
C<Zg
O(
Nj5u
9%Gr
T C
jGMw?
=2&oZH
f^ "
? |
\2),|
pkH ~
_8V
GVZ g
+Z 2,tg
_~Xg
System.ComponentModel
o 8F
LocalMachine
Y+v/;
+D^b
4x\*
\d[>\
yL7Xs
nohK2SM
l+)2<g
BJq,
@eau
Z *vn
j-lQ
FI- /^
PePTO
}y\`
_[.#
mDch
NW$Z
>|}
a_/y
m~6}
System.Windows.Forms
. >IU
X1$U
__StaticArrayInitTypeSize=100
M[ZAZ
dP
N]2B
4-J
Xgz'
,a)]
8NP/
RegistryRights
Q*f
$>Ke
i"xA
m{X`4
^`h7
=gYBF
EM_
doKo
VN(W
Sleep
mmBnYJi
_ (D
nT6
r{)7
S Qaaf
9UQ9_~
IXxH
(BJ.v
/\cM
; 8d
O(:f)
6=j@c
o 03
y;0g_{dc)3
DelegateEntry.get_Port
\do0D05V
/(GgK)
RF/>:
kJ68
BXo3Mc
QhQu003D
2;AZ
\^7"
Z%Xo
t<i{
] 5X
A ?[
nYbb
<PrivateImplementationDetails>
J$3C
Version
3"U<
+Rje
gn 46
CJX
Kwv~
cW\{oj
SqX3
;oNv/
Ct'v
ZfY
oUk:t
x[4o
h =gy9
A s R
Q#cc[
;Q`=pgE
4P2P
mN_e=C
aD\!
9) <ZpD
0r.@+
UvdJ
Z9Kx
Reserved1
snJ;Z
Reserved2
op_Explicit
System.Security
]o_.
B-qD
b/ZBrG
bjmK
KjX5
^owO;
GetData
x:7.
Cm, N
PqYz
\Z _p
V7#AL=
! aF
#.1q
[}$,[
\q>[
=i]*V
]Gf
7 dz
<?K&W,
NM?TQ47
!_<\
9COl&7
i`06
*L{??
-e<60
%`-$
G<-Xmph
H#x1
y643
`E8{
wq`
.#6&
$+^B*
j8gK
A<m`
=] Y
'Y t
get_CurrentDomain
H6(A
I";1b
~^8)
ow5)
Bb+z
B}su
FpjZ
c7yj
r0Na
!<}7
1U 4u
H5bI
+ +>
^ ={
=;f
Akcd
h1#^
%[U00
/|:I
Path
`mm`
9 $>J
%U b
_r&V
:TVWa
t,vP8
#Blob
R% x
CNo
Dk*%
Fiyl
get_IconLocation
1k(fE
B-ns\
hThread
)a,Lx
Ep!U
u(;_
Ao?Z
o<[p
BindingFlags
gaeXf
p;5YO
2/, Sx
$OS
X ED
|_]!t
sujp8>
0'tJ
^Tf`
Q imA
6& s_
P{j*
rP>T
)z!7
aO4M
`A$q
#7fQ
Mus#
?< 5
"qG-
ProcessModule
G`Z^
p{{%
!]eQw
YVk
Vc%O
gs[!IQ
`i!
q*0d
lvbq
-2[c
',Cvi@
d QKQeQ
|GN0
E4*a
XW0kt
e.{|3
aRnxW
y:)oY~6
.9Ri
e}^o
z$'{
&ex>L[
8::|
-oBP-*
|Z`H
Wjd $n>A
q+r|
@<['G
RuntimeMethodHandle
M@+
S en
f^YX
^"hN
N=f
DialogResult
yFJ~\
SetLastError
TVh\
oi.xY
, &Jd
" i
SpawnNewProcess
[1Kki
zzKN[
'=c
YXe
i~}`
)~@]
=rEyR
>s_3
iDo3
AHMU
yl,p
>O
UF[s
L7\C
l%:d
RsP6i
mu(e6
UK-'
W B{?Q
ja3ea;F
YV!e
s<hW:jRV
7Z\k
.S}r
y?S\
)'_;o=
I3Q_
ha m
5}7io
oWqV
jNyO
:H A
xHd+I
(es#
_/iv
HY&y
g}GL
= I8
<xOZV2
(~o8Y
hg*/E0 d
EeTz
8^KrP
Ln;{
Lf;$
tbXh7
AU|{>BF
'"E^u/
)T*z@
.E.\]
d NT
flAllocationType
n1N@
`# ]
WHB z
$U`{
A7g R'
U"H#P
6+7v
O2ri;K
TjTI-
Z8q5r
Ze s
wGUF
HJ+@
.PYz
}- m
%kaut
!o(
ve |
$g!4
A1._
i k"
Dxgk
System.Runtime.InteropServices
j|=:
Kk m
%1~q
z.u@
n Z"
$ !x
UInt16
,(*
!4ZYL
_JFF
hqBfx+
-:vdJ
gNke
E-"!
System.IO
WrapNonExceptionThrows
kq/H
Z1ea
Z;>e
j6{n
%- &~
!pGy
$D8A0B47E-25B1-44E3-9509-393F4CAF3289
8jI?f
_8tSU
&o5
@a+<
@@y
get_InvariantCulture
XMqyE
ib+{=
VK6o
yzK
1Q2/
,J]8"J
A QY
tK-5
}SDl
H;}b
HV>e
2x7S
B+Yz
8N *k
_bJ#>
j$}l4
PsAk
)F% G^
B2Cb
}^ML
GJg(
HBg:
$"1)P{`N
Z2xt
*xv;
DR V
=2b%
3JX
- Q-
dea:
Rge}&
PF/3
HHe~m
:LR4
!xbDDR
Evidence
eYf 7N1
O$ 5
R#i0f
sEv!N`
O(x`'?
CPCJq
'B <
$,Su
T(B&E
#Z X%
{|9
(|) M
bj- \`
H"B)c4{%
x] C
Ict g
2 \E
utek
E}a)
/C)KW~
rES5u
:e"#C`#jT
?`~)
Z]eI
o2S7(
,tRi
sm?3
%^
System.Diagnostics
\ cy
s%[e
6>>
%HYy
m_fbV~Z
S0#;,
^Xq[JD
KpveY |
7YFN
Zaf
0Nht
U?+(S
YTV
-pI2
bo$G
KKBxn
?7S1
KQ%Q<
i-3
8Nl1wR
Ih}T
dET
ye^g
8>y~
get_UTF8
IEnumSTORE_DEPLOYMENT_METADATA_PROPERTY.<ForEachWorker>b__25
O!@!z
!}:/1
R9 Av
Y{ ;
XP(K
d 5I^c
>j b
*(qf
?s#h
sW"g
uvZ q
3xR5%
oP=i
~)iM
$H[M'
CjlW@::
@&2b
ji*}2
TvQ
advapi32.dll
$[LT%]5i,y
% rg
YE:O
J[5l
cW4&
1rtDi8F
`$%+
Z Ra
}EbJb}L
I Xn
/HyCA
eX W
=P5 a=
MzH6
-4;W
aBwB
JsO#O
1i!m9
yWD^
LCrs
"X{C
|~ 7
P:bPx-
!zAF
:K8
H01
%d~t0 I
-6%U
oR p
=zSd
UB}Z
aYY
l5d
b=-"
ez% F
H:lG_:3W'[k
vd^F N[
}V 2{r
c=_J
5;I'
GFJ}
>x>/
i^4Q
'X6
A>@,$=
[<a|
%`; $
lS>BZ
0]``
"Y{D
r ~v
eKqY
I;#i
aXfYe ;
s(RHcg
#/)JfO1m
& 2'
KGz*
2YGF
o9z6
"k.
v:G/3W^
" W}
/sf0e
keyName
Op<p
K1; sq
8 vh[
(VpD
GuidAttribute
FtRS
Y&( }
K+Q
6h/]
g Fd
h49N
J,r
`KHM
>,tyH
+BUw(
Bmi!F
_isChild
a<<t
. \c4
(?cq
.h]'Z
gNr;s
Sg4"
] :
@d$v
-jzX
'et:
8l4Z
O iZU
UInt32
:=##%Y{
E>,|
Z=k<2
hR_q~
fileName
DW]4
Nd(_
ma4q
W8LM#3
J>HH
FAESFin
g'cv%
?.nG}
_mwf|
bGrbt
:F%3
;#^qn
/hL<
: kc
ICryptoTransform
add_ResourceResolve
di@m
AssemblyTitleAttribute
DkT0
=hg%
$Cc?;
A(-$
dpK0
x$-t
fk0vm
]<D{
RxQu003D
t#m'
r U;c
Ymp}
ByN[
L}gG
>zlM
H3|?
Za :
Ltj^7
Z '|i
T[2N
g"hf
.m#+
$|9n
"Y}!
0Ewc
Rv$)
8At|:
3@BP
Int64
zD Ty
n 1
1!H4
y9\U
-cB~
Lz_ [
e((T/
8(
flash.Properties
FmD~
}_G]3Ac;
K kn
dI!&w
pS/s
WEc_
SZ`j
< g
MYGH
.:Aw
UKy
-* "[5
WaitForCloseSignal
@iLCp
Xg0N`.
NV *
m O3
BM}
}&-$3+7
\qrq
=Ko h
n8 9U
H@R(^
|[MjP
lFj.
PixelFormat
I20L;v
^dIg0
Jp3 H0B+
Hx$\
q` ,
q6 j
r9Z\
@}{>
&T <
=*sV
l 7u
Y@ ' !h
GetProcessesByName
-AhZ
Y}L{
|kn*
SpecialFolder
get_Chars
( k_
5+Lu
L R
9J<$)
Y[4[ZJuI
. 1
yl`M
LB$c\
&Iho
&'z1$>
1y
$&%Ryg .3
xqzo
yv^%
n m'
1jKe
Shortcut
49pM
| +yt
MessageBox
L3<
`FK&fv'N
I82rX`
'r)
lpContext
<h%
G&+MU
?2#g
%?:L
gz1K
)hfaaY
cYtL
'nh
+)Z}?
~~ +
*Hh7
Runpe
~VQ
ReclaimMutex
[Iv,
ClassLibrary1.Properties.Resources.resources
d&3_
=6$,
?M# O+p
-4&
Assembly
rO<
XvJ%
(|`s
110}
Om6P
82='
v'ed
qF w
o0J
7*2u
l:]0!:
A[ u
| a~1#
;~>*5`
GetHostPath
&!(,U
. >G:
S dB
mMl
-76,
>1sP+
hW s
8(v42
IiQh
5_5a
pz~eT
ProcessId
m9:f|
IAM`x$N
^f9w
ParameterizedThreadStart
5.50.51.11
=BZ+
?V|#
o-!c
bj#~
(}~
6s:]
F 6wa
TY/
:mU#AG
Bf@v
ysY.
.Xa
nOr_
param
cEHiP
`S|j}
2B"1~
PRLGU
%[0-
>*t
eQ8ff
%&4
S$ ;<
0n4!
h<;0
^aa
&pH
*=G4
VtGV._q
x C +1%b
pathLink
\ejZ
)(o>
`f OI
CHdb
I7E
images
WWon
eM;F b$a
} Mxf0
4\O_
_4O$
n3!%
lpUNu
ZBqOG
_0Rru
pX6h{
3 7t
[n;
z&yO
zKt 1
&A1z3
Lh4z*
AssemblyCopyrightAttribute
Z w|Q
J#/
p_vPq
7 ~g
<:Rl
J 4^
v3Zn^-
yTsz
2s':6
a{:WQ
0W9qsla
:hpJ'
OBqW
v :)
Thread
4zGF
9\c-F
Pe o
#S~t
Gn)
QX\NK
fe -
q6$7
}mMT
Imn#eL
BlR;
+x:Q
9a8va
s:|
ManagementObjectEnumerator
%K4*.
@T#qUg
ur}l
y!1P
bRo@
Pg6C
qnD<
E9M!
Decrypt
Nn 9bf>
oR`F
IConvertible
Stream
kLP`D
9-bJ
Lm/>
7T v
4 fG9
FcG0v
dR%Q
|/4F
{/)PQJ
aHN|
g~P@
^D{F
ZZ K
.cctor
BkZK;
988 IM
r~+wA
ZC(Y
&E&<
REWgV&
t;;-N
#b$B
Op^d
\qpY
= J{
GetMethod
H[R ,p
`QT@
LO4q[Y-
MG9V
1'Pz
o0Es
&PDVw
FX^rCU
$8"
<t0$
U0 Y
];a6
+ISWgL
!7)4)
b mt
if Y
<8u:K
[.c
"mGm
AssemblyDescriptionAttribute.GetRequestStreamStart
System.Reflection
!N4 BLzd
ZNXjI
!sGQ
H!%b[|
@T~v
MN o
Um x?v5
U<ZC
v1]
$> z
; W9
?xyu
\2`QRk
(\bp
[^yX
^mr[_,
_x?R
K~Fj\
oC,8
( D
&jBZ:
YO..
wQD5
>7{R
Object
/D,aC
fdAZ/
[F~!
9Z5|Un
":I&)?
j2#L
lG_AC9
0}N7
&0@;
J{go
9q y
pea E =
AssemblyDescriptionAttribute
E$}t
)}tiw
Xw{SX9TZmz
_;g-',
!~$B
@</rNUfq
[<
6
(Y#
# jh
XK\7
" ng
P 8~
nH?q
ReadUInt16
&+[zr
O/\P4
s|3?
tc>>
d|,$
HXQ
AjU{
F *g
bq FN
{ c{
x\NA3
aX Q
BnMtMPCr
SkoToRbk
System.IO.Compression
0(.e
s{8&
8{.jT"{
fafe
) r\H
"b![
Ge&d5
GetCurrentProcess
kTwx
vX_?
5JBztS
lY n
bY.D
}7fSS
\CF
c*oe
3k0p,48
B-"efb
UYD#=SV?
quz/
@X9
+]6($
D%k;
1$V "
*O9!
Nn`o_
yDnE
xwIR
Sa_l
;"mI
<c)^
, w
I%Rd s
yc\K
U+V
y5K9
bd'X
OI#'
XYee
~7GK
WAV{
#,d0
yw5^as
k`>/
um5m
m$YV
-R3.H@
_AppDomain
;{ )
}Zz'
5P=3$V
-T,JOX ;Zg
OO7h40
n#L(%!)
z|-5
>RB9c
RW$h^tIj]
J G^
XW_-
}t<k
;<$|
ClassLibrary1.Properties
||7iS
u.X&
eMEh
RiE@
;V@V
%pp
Q?f0
7Dq&+
z|F5
%pp'
&d+Vw~
+;f7"
=eZaaY
rCY\p
63Qn
j7*lz
4S~g3
c/vrN
p[Rg8X=.
UzQ
oU;5k
#= U]@
{n:xM
tL&/j1
ZYX
sxym
?5R[
idhKgu
E_nx/
tJ.b
`(=X}
"mO@
0"j'
> (O
Obqj
@o)4.
3H7=f
( g!y<Z ]
AssemblyHash.get_FirstDayOfWeek
z@uV
'7IEyv
aS +
5clv
tFY~
NYc}
sOw-<!
U" 1
:fAm\k
\ Au
*+AL
" "5|
@[vI
<i)G
?)c"
ResolveEventArgs
,FHw
hY]e
it+
3RQ
^~s:
,eJSY
kDO!
hzqf
kNV
Sq}Y
vq(ogg
bKs"
e.
9 z
H7+d/~
Jy[K
&CzCd
YwZD
8ZYe
6~pO|
{!b
qmT*s
B]2GS
R) c)t
fcX'
>g{$
WMW
HI~
/Y.J3i]
P^O:
9@%7
#; F%
hProcess
./*
z1j/rR
IsMonitor
vGzX&
Z?QU
IComparable`1
hUC
jQ<M
fo|,
AS\s
_[0Iv@!
Y~ll'
uW`.
~
y(qZ
fb.h
*TYYf
'a.X
y *c
nr|>rR
3-:|
fJ{6
jIq4
phV-
)d .
RL&G
#A&=
? K*
yWq>
3uIZ
4Pt
z{A?
066D1B019BE1C9F5CDFA363535AD3A982C71E4F0
~Q{-
*?_xH
gacS
=)-l
},/z(
SrQu003D
pSrd
*5nI:
]5qW
r&/
_^zGCR"i
h:42
q@oT/
=]8{
= ?l95
Z 1SHa
:f:L6*
Copy
cE<d^
AssemblyFileVersionAttribute
a_N-
GetTempPath
e9,B
wq,?
m? 5
System.Resources
vjcj
e;DL
Ebb;
GetString
sr.
:)I;
SE*q
|;(qJ
)rLUM
T=H%
TB:j:
Yc7l;V".;
Nq6:
W"\ub
{|gU
g:K"
H l(
[$Kn
FubI@=3*@h
Class2
Class1
EQGq
=fvC
-Kfp
-:sA
s,e|H
6]X!
SiY
HO ~
VM9`
*ZS
Apii0
3A h
S-EY8
A~@ GS
I'~lk
Exit
:leV
;NRH
X%K'
mghV
&uKC
z.5?
%n i,
!Cp\
HMjK
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
zYt@
]z
J:R?
u%]OE
]nBv
v&EB[
q+Wa
!}MH
e#Jn^!M
R ^
JD\
JuOY
j}\=
U _(
DEBJg;
<G+E(
3[q?
&|#{
w{Ze
^#x!
Y|1S
$yg
WydG
0OI
,'`\Q
resourceMan
0V N
C)hM
Dgc:
N>I<
d&= D
System.Drawing
|_u
mIt
iq#~
5oU
Z[Gee
zHhC
ZfXaeeef
RbQu003D
T{sb
ToCharArray
w.x{4<
mBr,
STAS
)=Ow
y:_'
DebuggableAttribute
N$SC
' t@
aJ1*
P7Ov[
>Ps`
[bw;w
w] b
:%p(
0rKc
' }D
?R(
^0)*
z;s]T
\6 8
}|>g
D) YX
{.M8(P[]
C`k=
Wtgz5X
i*A^
zw\Nk
,-Rj
,&KM>
$hUNd
{tz+
Gi:\
6 R
B Kf;.
jy1Ou.
]AC+~
+d]vGe2
&hd9V
Q5Z8JW5
[>-/
9 )$L)9
P^-
6p (
7w#
tLuh
gbRxc
EFMl
pZ]c
&Y{
owbT
_Assembly
H?.p&3
0(u
zC G"
EditorBrowsableState
AssemblyConfigurationAttribute
t2VG
'O-.)
SsM_
`prTI`
,D9
u]0C
0zL~
}Qn%
t%Gv
Vo+:
'ro(
6C,m
-.t,
Z#kL
DqU3/f
<E(:v
lAIA
4q@9Bp
Cv}FBl7G
3%NP |
V?YYlR
`y(=4
tN(#X
[NS^n
" 3h
w>UJ
<8'I
svo
dqP
!02
q <e
WvPG
[,Ax
A*uM
P{tR
`68Y
h&:
get_Culture
0\[9
C8-Lf
8ti{
AF2f/
_1,f
1Nnr
jDQ&
wVN%
m=d=
vX-8
i_*D>
l (u
run"^91w
2 nr
~E.rt>
nV 3:
B[i
NF$s
Gpi
N%q`
@pp(KJ8
AQAJ`
"1'CE
L}qXu
MessageBoxIcon
`i
gZae
Odf2!
U#F|
Y y
Ag,s
/M )c
3< yySK
g:>u
{>|3M^7
v!&_
;^ e
Yt I
ToSSt
LTZa
h'i5<
PDj!O
l;|C
?)Bv
qw56Tc
Z04;&v
P6#G
ImagesToData
lAl{
Q~g%
\lKI
B"X3
61T.
&+Q%
B7H%
D`*x
InvokeMember
D1)_
SgU{f'
NrbNYNAc
fb~6
nZ{
G]x%kW)
"X{
|:43
N68=
g+!K
1I^0\Q
yAN}4|
) wq
GmnG
Bq|]
get_Major
Ovvt[Z
(HYXXeXef o
K F
.VGZ
cRr
Marshal
nUYa
v2.0.50727
[E'
lzLtF
{o_8h
,?.K
lUv K@
sb/E
|3Z F
A/ Y
^Vr Ogj
x$P5
$x89
!u|J
I3pB
Oe.#G
G+>/
Te}2X-
e.+
2fZ.L
get_ASCII
Lh>0xa
Ka=8
DeleteFile
O9j
_rH?
Y {cF
Y@#DM^
*e!i
m+*
SymmetricAlgorithm
B>Qd
09ol
/--6
~R>J
MessageBoxButtons
3Pa
g[FB
w CQ
w<6V
K^qJ
b[,>B18
"sd8
nGLj
ComputeHash
asgfytmn.
XpCk"
YfeYYf j=
Pi09
g9BIXw
ToUInt64
7NOQ!p _L=v
t' <
9-KT
r.10h
.2 6
64SD
l$F[
DLl2
pb/ W^B
$ )V
:RiO{
1cC>.
~a=o-
V1 *
CWc$
A[-;
D\Te?
=w)t:
VEg|o
v2vc(b
Y F
\Tyi<uDW
P[$'|N
HQUD
hy?
nTRBJb1
xo#
m}e/
<Zn#
DVi
G6avJ@J
%V*a
v_.,
wX'b
Y>o
Qo$H
X:m
j-G\
SByte
26"$
dXYeXYfef
-rKEG
S!6Ccc^}
4>=
XAlo&
\8hG
LifetimeEntry.InitializeSwitches
mYa
+bZ 8
aZaef
GetManifestResourceNames
Ao3
TransformFinalBlock
SZ .
Ipi|>d
Qe6-
`fD~
r-
c;F^
Close
JYc~
"iLt3;
\6Tr5!vp
0d_Tv
Exists
Buffer
?c*P
^Nh=
,#Y#{
Cr|3
G=mj
aRBb
dcY\\
W?1C
/18{
hbkt2*
KJ<Zc
l(b<LR
HV1pA
commandLine
dH4S8
rWzB
_X@D
XX E
M)}a4*wI
)Bq>
:<8Yya2
-q}>Q
+j_a
dkVG
709]
Qa9d
\l:R0
i >I
N=K'ow
L^-'
P;!o
value
cz``
fR)4 `
cn0ec
2016
InternalCrossContextDelegate.GetDataPtrOffsetInternal
^+ S[
)P 7
YzvE
$=PJ;
fj S
g.\B
(a 8Y
3`e
Z7(*
$tk1
-6kX
D"z#
$cRD
ml+:
qXhZ
a ~
ret+FK
ky| l
V! J#
q.4R:
?&_^
Oi3d6
3>[
1Nr<:
b@~ko
!m;?
40z_Fq
E]Ts
Write
=7hD/
"SIMw
&DnP
^a= Qd
&'{}
b=oF
L -
xH9m"1B
<<Ng
Release
d U+
r!bu
${TQ
qV$)U
#fV\
oluT
]1GX~
3 ?W
K-3~N
2Z 3
AProc
'a*
ReadAllText
TFJ<
\e]8k
|kaL4
kLn2
K"5A
VhM<z
BO C
p;MZ
dw h
!V'>y
eUUf] O
DNR$I
Uhlb
NYaf
&Q=k
r=FY<~
E$Lb0
Sf\:
\!iX
Nq:G
C0+H
OH{+
uMf o
Nb6?
*\ns,
K$E
pcVt;
[69Wg
>Xj\
9ELi
g28
FullName
Y -O
[ama
Y -S
V)`p
get_Minor
T >oh
N@W`
Gg@_Ix
l($C
'7FZ
@ xD
}b@8pe!
KyYG
#$@J><
w<|[
jDg"
l2l}A
0{*@
MsfR
*3
h:?(
R#{WC]
]p;I^
@n9d
d<)
Hwk
D8M>
V%$&
GabRs
@`=23
ReadSingle
>Eo[_-
* D!H+
v|wt(
'a'
>Fyc
"eE.
DateTime
X ;C
a%HR
ObeG
Cj9j
*6Pq[
'+1=
C>yj
q- |
:IMa
12!}$
l#\j
zc*tf
TC+]
~0 `
Z ?OQ
t%w\;
R$#|H3p
{B)cp
ak2
5 Wo=xg
6Yh6
ia1E
AV+<
7g*
g_j5
U:`:y2
n54a
'fON
LockBits
4Hr52
]$.O
}#y.'%
l lx
ZX\#
^+{E2
SU:jaw
_<7<
5hvV^
y=Oq 'u<i\0
cNO8
T<tV
path
@ >(p7
vYR
+1c:
Q7x0
4%IvY
5NA"w
#E(5
tL,
RuntimeFieldHandle
u^c.
blkKtzzP
x@5Bg
$/c)
get_StackTrace
;}"
"] ! j
e i
2j'p\2
oel_
?P a8
p&!2^
set_TargetPath
uF < e
bzrW
yp[x
GetRandomFileName
5WZ(
{Wo?
%9 )
* dpTN#-m6
p]\<xZ
PzJ~
:I <
ObjectAceFlags.MarkForCompletionWhenAvailable
6 xZ
5XN'
\XMK]8g
Mh.-j
description
Z Sn
:s{J
P(6p
fHK5
L>ww
U%@w
'{_f
%$,D
/E A{
o,YE4
xB \^@
2GNE
VYX%]G-9
N|/>;X|
E2Z t
sQcs
*r`F
=W}eG
FromBase64String
jzwl
%|%>!
[IcY
AssemblyTrademarkAttribute
eT,{"
XbK>
Decompress
a}]-vj
$z7G
lv"
6ySS
&+w Y
(UbH
2C?`
e@`/
A"T
cF=4Z
Luc
YS5H
TmUc
q+@<
cwiY
\8kqt
*&?_%jn
G3hXV
HNg8
,Stll
wwca
Z{=}^>a
tng3
ow0%^
L*]}j
A.mP
\7 MeO
(AQk
&CB
6T]!
5\)}
X7&
]43k
"?S/
gK;6~
e/sk o4W j4
vlWC
2O3PX
UQ,L
YG`7
Y3"g %
get_Name
CreateDelegate
*3"-2
9:P
SyKq
(z3M
*Hv]
{M2xK
F$ka\a
2`W#H
/';
=.uu
0o_l
C(NV
K!
XCP,$
R7M
/v$F#x
,UGnZ
WC#&
Ffn!
9:4
h>C6%x
?5),z
brcn
R@q0
Mk n
9 J d6
|04}h
hee+f
Ad*O
'r
$$|J
ef 99
'sM4
+xzx
i\h
|$>.
V#lh
Convert
0~NCk
9koQmzZ7
0GCZ
7I,lIT
Pmh%#@
ehtcYcc
`mR~
?<me
/anP
dF `
dZBK1
laLm
~ kGW5S%vf&8
k.o)eZ
uP #B
t<d*;
N I O
-xX+rjksy
kmneM
eo-Z
KED'
}nB{
_HJfH
q=ph%
'u8Y
a7b
9Q&_
?[M.
Flash Player Service
Nz=p`
Ge'F
_>L[
zDU!_
oeJy
lO/
u*|<
kernel32.dll
IwQo
rgp
|4j`
z ";
1K+O
ta~
! ,^
.pJ"{X
~B@QNv
6Z n
X3bE
Jq/>w
f rN
a -8
;wIUe:
mZ[IL
]GY54
"0N<
CbCn@q
Vhi-
YL q
Aydk
98=v
:xf
&tM 0
V2/u
Y \nh
jzlk
tt7q
)~TAV&
@o]B@
2SA@
4_m-O4
z5i9l%8
CS s2
UL)uw
) #1
_D6T
sX 5
|||C3
jM~L
Nkdv
%Hh^
.FAe
cw1F@
DGh
2g]c6I1
GetBytes
F>jQ
RelativePath
,CXN
`O1&C
X vyJ
S t'
&6 :
SdmV
dW?.
Z3 N
)!.4
K /T
h'4(
'*A
R k
Z(56
j `0
arguments
"Ect
e<g.
Z Sw
c$xc
System.Management
t{ni
P}1AM
Y [H
@nX;
!@5A
! E{
3QY[
H!F\
pAys
`eu+e
j.i?
SYxgtY
/S#Y
u^aZ
bb},
@&tU
, 7l{F
)7X|
[Bs}zi
q(_cY
*@LO
{\Mu
$"A*0
][Da $
De?7
V;*F
Trqmw
cS v
System.Globalization
8I`)
neOg
scv&
RegistryValueKind
&^ sn
GetUserName
`VD
JUsM
4-:-j<
<63S
oxg|Bu
LyGz
S@K2
jp{i
e#cxHO
_%`} T /
,^?GWJ
pt3t
YV>
&tV~
o&j{
CreateInstance
r{
SZ|/
j(Hwvn
n c
rOua2M
xCx
<sJk@
vtPZ
lSBx
3D:(
GO}l
!F>] s
+ ?-
9>]X
<if(
OJI0
iBb\
& C_
Z7:}i
zw N
.t%
:N'SNqE
Environment
N9bA
KVFsW
7+> 1
az`\u
LdDa
grr'Y
b=<t
*xOY)u
9:aI
Decimal
%Rt|y
CdjV
\A;U
1xj"
a ]YfyZa
</ <
gL0:
?/"rWA
+s9
FileAccess
#urH
dS{A}
nU h|iG
--o Q)I
?B]t
E[n'
Activator
Ms*%
d'W
; 36
!h69
Double
"XYcFE
N;6N
~f;Z
[<@?'
#$gf
+htm
I)ye
A{+
MD5CryptoServiceProvider
/PS3
Z E^za
Title
}`D0c`
q:dU
.Pc
)PCW
Dzumg
set_WindowStyle
3{y;
t^]X
X@l=
IKdpGPvw
]30S|
y:d,
l 0.
environment
$Nf )
{{k`
tIBF
*2[:
n YB
vcOQT
.y w
x $ [[
s| c
cvF,d
mL[c5
T #J
yW_,KlA
5utp
Stnp
<bZl$h
l 3c_
[;_a
`!:%
/'g+=
cOH9
N2*t
ARTX[
3Syj
NMmUg
*xuQ
D; Y
Xlo*
<pr z
Math
Z 4
9Q$#
%N8o
RandomNumberGenerator.BitFieldEnumToString
0 f<
lpProcName
@2;/5
QFug
v@"*
h7y[
ParameterInfo
}8U FF>8{
{ _8f
GC{IT
* ?Q
Yc 1
>N"Xb
.XU(
,9&'
U-;p
&?Z%
H5Uf.
v@
HOX=&
Gwi A
RU+I
kK {
q1R'tv
Q11
`$,
0]CvB
s93r
Iry0v
CloseCommand
BEHi"
1EK
O<Av
Ul)Q
!$[
1m4I
DESCryptoServiceProvider
System.Collections
V j*
.gjy
MShell
A2%b
`6/B
IEvidenceFactory
AD_te ]L
YoPH3A+l
4'@0!t
:vI
>ED
4`k1
G&w>
'RWZ
X y-q
s-f"
| DW
1?W1
X_a8
iRmU
VaWr,
ZxY@
*n+?Q
/_PW
DlO+
(7:e
UUK}
timeout
"4bW
eXX
y *{
+b]&
<?}@
^Il.
NzJ(x
-Z1j
W{8$G
Vkin+
Z Q}
JJD@
BDS
D6@=
Y"/:
\{g;
mI~_W
name
q;-S
Up`CB
1kd
SZ&]
Ll~C
`n39
-!TJ
v%mA>
d<jrs
j x
f) F
s^R) a
(f]2
yx: X
Save
XD-(|
Vh,(k{Z
e-/T
NZ sC
L\5
~zo<
q{>.
IsVm
%yPN
db}n#!
FW(8
I.U
])Si
#+a)\t^
E.t#
{ocL
ADP:3
uKF@
.e{
ThreadHandle
w<aJ6
/F"x
Q!4m}
Y%=^
6 1s
uA"(
jNNY
>0<j
Start
ewi0
YJxziyy
` T^
ZZpVJSnW
MV:kL
Data
B ya
nH.9
NGbl
lCO -7
WcX#
A 8O!
U+*$
get_EntryPoint
4"2G=
y5bB
pHYs
|d4|
gq+G
5SWe
c2U0O
]d H7
:%D5[r
g^#B8
;;\;Iq"T
ypzY
~m}Ku3
]n}c
|];,
t nj
Df 7
>DQ6
%{x>
jSg";
}7mJ
`7$jU
7+Tr
5=+-
Jc{o
t'[ b,
vX *
mbzqL
[P5 ..
E+1!
-I~B=
"" ,
y I^%
`/2Z
UxC.U1
2 P
o hkmz
qb`YZ
s6~@.
o9En
W7 Y>
o*(6
e<D Y
3BO'
^9sr}o
e<-W3
*5]J
DpsU{
+r'A
+ttZ
@Ul;
MoveNext
}J |
=ffXXae M<
p\nJh
o?{U
)*hM
. ,H
nQhI
<N2|
^ ~;=
F&~=(
WL(b
)^q]
LP6r
'xNvk
j\zfC
\Nx@"p
, 4-
2!U+]
k|3\Y
iq]
m2/e
=Mr4#<
pQJ_o
Y r} B
iF7d/
H7&
j,[
tJlB
8yX
f/a3
B`^6
&+<z
a5u$
Xaa
XvDK
H&SB
) ?A
IMethodCallMessage.GetGuid
@._|
SI G
w @S+
M3y71
GjsM
e8V~\r
KRb+
2)E2*
?opm
& Ic
~)$)qc
_7h-
x}r$
DJF~R
l#{
3)n
9'h_C$=<
j?2]T
G[q|
aYaY s
cash
>Lq! 8
^wZ
rTkkLw
A>lm
mr>]
Open
Ay[/W
hr,T
]Wi _
]~Xw
GbC(
&pteC
zPKHq
2R4:>Rc4i
i_5a
0zah
&7Mq
$UT;c
\ut^p=a
[j ,
X
Signal
AssemblyName.GetStandardFile
rFy;
+%[2I [
ClassLibrary1
o":F
s0c_
"n~5
?!|Fy
[_jK
QUSv
X d
y3('
,-O=~
c{1H
HlfY&-
xl7JX
n%Iq
4`RG9
;y,&
NO "
[$97
J9L,
X@ u
p@yU
- 07N<
/Zb?
1ojQ
%w+y
X
.^rx)
*~m]
WP DBou
) HfE
fZR^
:P^$8
V#S<
~+6wy^
2yl
get_Description
I-XC{CV
EN9BA0zu^
iI bo2
pgiYxU
82['r
#ZDQ
\~Z!
~vPae
hPh
pq~]
{5+!
RVI.
+$Q,
& 9!g
g(nt
# 1C
wYfaY x
'>8iF
Z W{
bcS9
mWce_W
ReadByte
z$.g
bVD
AS"6RH3&
A0=i
o?D1
v<&~
YrgD
ReadBytes
Roca
R$%-J
r"Cl
6z x
Oe+
PKjZ-
BitmapData
IconLocation
\hE*=
ReadManagedResource
>Y,l|Y
Z}!
&KvO
)S$c
OTu#
GM%
ReadInt64
"O|s
rAz@h
L3R]
B 7|_m6:`
C)O*
wf['D
`'R'
OvzD
+0U
CXQ+
D/Tx
wL{+U
j\j
Nfg-
ee=,=p
Keyshort
get_TargetPath
Un~/8J
resourceCulture
Libs
Eyj$
1 O
&5U~}
0ida
-68!
kj.
3BTg
k\#+R
VDEBZ_
]> F:q
?j/{
K *B+
ip]&$
L^%.Z~N
X( e
uI-
)j"|A.
64#+s
o'v(
y^OM
uY 7
UOSp
uuql
Dp<U
$W ~
aUOO
kI ?
q\S/
\GHC
{"6{fd.-_I@
4R b^
$fqw4
-hL.
CharSet
9+b y
#^egK
*y!~c
R !(
@%q F
z,,
:9'i
%4{5
e\94
=d;Q
QH$o
0pPL
o&*.Q
e`6."
0y DF
$H}q"
%Is#
*io)q
(I $
R E~
?udk5
5!3"
'nmSZ /
T%/j
~JT /J
"jnNW:{
mz@
H%Qk
MI7m
W d:
EventResetMode
sH+=
\YRa
oF7=
Append
/"a
lAgyO
?P/6
)r x
op_Equality
UX<
|? b
m$Ndwy=
ncU4Q
]'_[
t]"T
~Mc"
Ywvz
%X%:
set_IconLocation
F>SH
>Q[]n
{|k4
H?nC
?U'C$$
v._,
qz_.'
Z)7j
eaF.
GetFrameworkDirectory
9faYZXf
num1
num2
|IkW
]k|T
E3_
uW9q
^eML
=[' I
F\"0
({I*
>+$n
:})(ES
O_x}
!QNp
SbQu003D
JuWes
7"A$z
6c/L
d"?6
MjM]8
4\BT
executablePath
TF_
/N-[V
.C>A
callback
Concat
izu]
}iym
X'I
NugLd
kLIF
U0@EtHL
#WK1
TY?"
xaX8p s&
= T7 _
Dt=g
$- {l
&J 8
je)@S
Binder
] uMw
1`Imd
'Eeb
#U0w
Aslp
M{ ^
;Tm
<^?
< $9' B
\o9E
759B
1s1T
:N\FSq
Microsoft.Win32
0di%
0PY
&hd~
Ngk{bw
Wt2i
TypeLibFuncAttribute
BSJB
W G%=
P#l
SJ<vk
p3\G
Ss k
Wyh;
hxR<e
Rp9#V
$ ?7?
~J:w%
'8@b
0a_6
?N\P@
`c}t!
t{0
,yl1
thread
a"NI
8ja
6^X}/
=\H\
ba__
1ZRY
~(}b
U i/
Ms?xt/
.En[}
ToChar
|&~
@stV
}_>g
=w??\
applicationName
Nk(
C4J]
l~.+
rDoT8L[
Gj%u
?i?&Gd
[0 D
<Tb<kyl
Juv5
qT3*
)!(h
u\_a@ D
hR8r
XfrF
+q|~D
[Q ,
KLw3<t!
PW]4
zFl(!
m:H`
mOb5
1v7d
mDl@
prB]
ThreadId
l(9\>
-vtp
|8he
}1
}u7^
|F'd[n
NX"UK
nZ m
2Y=O
k7YP
/AT
l! H
e4
%XT
<ru\
MH{;k/D
e>wn??
VONV
F#]\
E JU
nOr
;{93
:lR7
XbC-
& 1:EZ
,{2N
RunPe1
RegistryKeyPermissionCheck
tO{/
l!x
mc6yvH
R5s)
B\an
RX!$
K_6-
baseAddress
~Xz
f'4E
n-$V
www.google.com
2WvTL
u[""
Vybs)
RZnL
)RWf^
azs?/G*
_3*-
v =X<
~(^l
get_WindowStyle
(o'.-]]
TryInstall
#}OtKbu
_mutex
bqE"U
IEND
no /)
E6Cp:$
_;J*
P!K&
m/9 U
iwVDe
k3l_2
(76-
WriteAllBytes
H%Do
Y$sV{O
context
F>?J
ED;g>
3_p}P
YB~2
`8Y\V
}k1cA
n6IT
g"Bj
gr=z_I
0=;&DX
StringBuilder
>}~
&+m
@wG?
|5];x
c_`o
du0X
bytesWritten
>F\`O`
yAi7
(I s
g^4wh
CompilerGeneratedAttribute
N@M^
# #c
] d}}
c]Rt
M]rJx
&0`aJ
ej[rT
I=!x
8;dOF
2^fe
rWQQ`'
Ii1/Ag9
(>C'
@(mR
Keybyte
3Cs
r<uWa
h1CM
Gz)ZY<
DUVC5
'd}
/FkZP
,u 3,
5 SGu_ZYf X%
j&d+
=PCqQ
Z c_
muDq
cZ~{
1<ig
JrG^
gpB5
M {c
687t
rh:fk
g) 5
zMy5i
s+bm}f
dyTi
+BwP
*+z6
S&~ch
Je}I
Y0A7
.D;J
nt/x
FromBinary
fnMo
EventWaitHandle
3f5G
/ Su-y
String
n6qg
/G,`
YeXaY
qV V4
S>@:
set_Key
.RGc
P|cR[
04`l
vjIx
F-$[
ea T
_ooy
Lup@YW
InitializeArray
M|^
In3h
;KFW
]Z?q
#skj
7SE
J!IT
rMZ8
X@Z
")3Lk
.)%
e >p&
BF9^`K
S]PB
s<w9
1LVr~
*j%K
q<N}\
Google
KK N
M=/0
vQ&
*:aYf X%
(:pF
~DD01
$)QZ;Z
GetTypeFromProgID
(! 9
b!h
& $
s\~(
CurrentUser
ExplicitlySet.GetByIndex
M?}
Dictionary`2
BeginInvoke
Arguments
mHFy4`,iRD[
gPy[E3
1j)Ck
l[JSz
f`;.v
=^$-
kyu
*/R[
e[rs
z@0z
wvG*
l5Ig1
Q+3U
RuntimeHelpers
$g84^
D 1^S
I*0F3
)n%7
@+)W6
;b8c,
Zee X%
q lo
?8>F
|2C
6{kw
X<>z
o+G8i
9V{I!
7Br:
FASr
yD6H
omVY
y{iM
vOJ&B
hT Z
cI^_
3System.Resources.Tools.StronglyTypedResourceBuilder
dT0G
Ch :;m
q99A
K>NT\
jfGJ
o9^*
7[m4
m X{
1'6V;
{G6v
lu*1h
iF>%q8
5i R[
~ q
(IYbC
YafZYYY ]<
ft?7Rj
yz/Y=4
b A_`x
?=$P
&g5
;'Ly+
xg_J
Nm-
Cg"'O/
)|#K
StringComparison
=,=8
%F]_A
+B_AJ
56;+<y
)p/'
d;e7
j^Iu;
CompilationRelaxationsAttribute
%||e%
#p^BQ
{c ,
JY_6
RC1|
h Y
4"m,E
IsEncrypted
yzn
zW`:N@
Z R9
f1)A8
Fh N
}F>$
r A8
J\9n
o'r\
d$;&}3
"(M9
~mH/
1-"yV:V
S#fZ
'ELE
9t7l
8$ d
japX
}~S,G
MemoryStream
&v$_
h8V
+v>gXC
x8"\
yxp/
7,t8
jYO7.Zq
\ouq
QkA
scS3
37oh
2s+Md
System.Threading
<]RM)
WVJ$
(2]*
8k j
9nH"
V(Xzh
(CAb
YfY
Ir((p
}?;<
8y0^
:bcD
z(wzj%
'e"l
9&ES;
pE#6
get_Current
{V(lN
rlSp
JSD`
[":}
Ez7.
423
NtCreateProcess
m $e
:B?V
1e$*B
L|Vq4
-= f
,16
-q/%T!
..gp
Structures
7=g:@
>Lb/
]en[
!\>u
I i
~|DK
-_1}x&
F5G1a
pY9<w>
zNq-
{n ,x
X-?b
!O)`RB'#.^
(u
,=2G
:*jghFF
-%Zy <D
3>,|
QZ+B
3NS>
Z1hsoYV
^~xC
l;f_
PI a
,%<^
@p;
"@4zL
9Wge
p;!>
SetApartmentState
Bmn(
CreateStartupShortcut
pjl(
8(0{
GetTypeFromHandle
IAsyncResult
quhs
w"EI
z]cN
n(((
L5jE
0hyb
'^e3
GetDelegateForFunctionPointer
z}g
9>+A&T
Int16
;1(z
eXa
Q=uE
5T*X3d
LCEUX-
ty ^
/|5
^i h]bn
0KIDAThC
v]]%
mlTw
tU9U
$bAI
Z,KSh
YYe 'P
7 vb
H2.`"
&m8{
KZh_=._
vQpo
yhHd
[<fC
5|0e
]U2s
25.1141.111.4
GetProcessById
31~!
AcP,
/;o,^
`w5(
?c,K>
vNr[k
J1\?
Ye t
?`-XWI
O%M*
pY"Uk
^[Ox
92l*
ApartmentState
L-MZ
F NS
88Ba
!VSV
~Bm^ss
Y ==T
[lGu)
~z"'
System.Runtime.CompilerServices
TPv4m
`L ';G
aY i@dn :
)+qQ
;1Ck4
A*z_
EYOy
qP6p\Px
zO#a
NonVersionableAttribute.GetPermissionImpl
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
6YfX =c6z v
)UR_
_monitoringSelf
zZs >3
FphZWh
E 5a5V
c2D6
bHd\P)
bv?9^
Z4 E
l BAq
{]~
d-3[
]_x1
processAttributes
eYY |G
{k
($T~c
(@w78
CompressionMode
Enter
Z^|;
4QuUQ1/!
XXaee
Q%F;
&i &
x hz_
^*MB
by~g
H5xt
v|^F
sPM,]
BeginMonitorSpawnling
}H~NK
t:v(
%Bm_
CX[B
?9@_
z7!Yt
WaitHandle
`.g(
+Gz~
heI
\}pu
S o+
bufferSize
y ~l
System.Drawing.Bitmap
Z !b
=p/ml
z[Ef
V7c-
0DYX
Yt X}G:
'pP
Z\oxRd
,_ P
#?RfN
QT pg
-K@rO
z4d6A
OrT?
$Z e
I1lZ
V" 0
/rR;
EBj&1
HIAj
F 9)
i]W;G
dzZE2R
4Mgw
AG D
_meZ ^
PO"=Gg-
5J<}>
'U$a
l0b@% B
Uve@
Y<~
8sp Z%
oZ[vX
hrV}
Encoding
B]_|
HbzpU
EC}O>
o3q"4K
!No>h
SimpleIpc
:F Z OmS
P)J\:
qACx
'0Gw,
kHQa_
w6s3
?P^
SfejnEte.Resources.resources
Du1VThOR'"be
Rectangle
}*]7Hi
Hpe.U
ReadSByte
1w~
XaY
P}G`F
w|Gd
"HFje
Create
@yyj
}aft
HiJR
S3K;W
]|&S
<JFV
ReadString
Zero
f|Xe
1&{S
ManagementObjectCollection
g mD%^
;FX
do>)i
0coo
U2ma4
Z(D6
v3sU
DS:&d
#-)
j*25_
%&6;m ~+e
j`F
#<pG
7s-;
/J ?
FMQzi
EhN?V
ujr?
~3\,
Fx@}1T
oZX7JDo
*z<X
gh_
a7pr
System.Collections.Generic
LoadLibrary
p'J^
%& (
rDN0
& ;
CVO_*Y
hk u
TkoU
;Lwt
#Ye*
wXXyhFuK
9yb ~y
AY q
ynqFK
hUP=
Icqp
!Ahn
B w<
#zG{
9-,m
edXza
5)9Ore
Zs{}
|gVi
#5eGBW
lL{^
UH4C
FR*B
'2emvLE
CM]I
Q.qg~
vq\fU#
926R3
2XlJ
e|v7
D8(:
&%Cs
^&&lY@!
StdInput
3Xa)F
;-cT
z^T|F~

#infosec #automation

TheSystem Itself @ 2016-06-30 20:12:04