w.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 10/55 Related 2060
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 221.38 KB (226696 bytes)
Compile time: 2016-07-12 14:34:28
MD5: 620fd2666f81e4a161932700756415f8
SHA1: 9c191bf08b31eb74a2ddf874a438c54a4c7ec742
SHA256: e6b58d00ce842a3a0e499085f598bbca9407475b610b185a9d66e7b1593cf091
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 4 import resource relocation security
First submission: 2016-07-12 19:36:03
Last submission: 2016-07-12 19:36:03
Filename detected: - w.exe (1)
URL file hosting
hXXp://[www].evclay.com/js/w.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2016-07-12 17:11:17 [10/55] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x15394 90112 1274db8010037257935bd125bb3e4ace 2dadc97555b68c9af403fafa2dca4561f013ed6f
.rsrc 0x18000 0x1d536 122880 aa5c9248a72642d3d0f8e3528e99a027 90dd4339d7a5bc35fc39afaa54f73e4b1b27c3cd
.reloc 0x36000 0xc 4096 6b1bba5c22ab88a6fca4aeadba2a819e a60201c590c531f74761b62bdead29ab208babab
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x312b4 16936 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x354dc 90 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
No Meta found in this file
XOR
No XOR informations found in this file.
Signature
MD5: a86f5a04ff4abfd6765086a78397d3f7
SHA1: f56a49a56dad3e15811621aece6402caf516fa1a
Block Size: 5512
Virtual Address: 221184
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
KERNEL32.dll
ntdll.dll
mscoree.dll
IP Found
No IP detected
URL(s)
http://schem
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
http://ocsp.digicert.com0C
http://ocsp.digicert.com0A
http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
https://www.digicert.com/CPS0
http://www.digicert.com/ssl-cps-repository.htm0
http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
String too long
eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk71 pf8rFJWkYpTczBcuJsQ9ENpdWA8mcDbKqhtHmGV6R62 EVv76XW2rvYNvDHygXeygsxTbZBOJjkFHq77URl4P5 kqtFFUIrEgzBcRAdMTw9T0TS0trLkz44mQ7oIVyjskAYGxHw5 uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5 vra14 pf8rFJWkYpTczBcuJsQ9ENpdWA8mcDbKqhtHmGV6R62. eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk71 eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk72pf8rFJWkYpTczBcuJsQ9ENpdWA8mcDbKqhtHmGV6R63 eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk72 alO3FOPTOQJpSJTRKFG9MpE3YwMyLBDUT3i32NeHE6 uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5kqtFFUIrEgzBcRAdMTw9T0TS0trLkz44mQ7oIVyjskAYGxHw4uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5 alO3FOPTOQJpSJTRKFG9MpE3YwMyLBDUT3i32NeHE2 kqtFFUIrEgzBcRAdMTw9T0TS0trLkz44mQ7oIVyjskAYGxHw4 pf8rFJWkYpTczBcuJsQ9ENpdWA8mcDbKqhtHmGV6R65 KFqneAOblKDOXHoNdaiKaJwnI8j6fWuZDVEDuCPJHZkjq9C4eA3San3EVv76XW2rvYNvDHygXeygsxTbZBOJjkFHq77URl4P6.
uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk71 Inc.
pf8rFJWkYpTczBcuJsQ9ENpdWA8mcDbKqhtHmGV6R61alO3FOPTOQJpSJTRKFG9MpE3YwMyLBDUT3i32NeHE7uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5.Properties
uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk71
eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk71KFqneAOblKDOXHoNdaiKaJwnI8j6fWuZDVEDuCPJHZkjq9C4eA3San5
eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk75KFqneAOblKDOXHoNdaiKaJwnI8j6fWuZDVEDuCPJHZkjq9C4eA3San3EVv76XW2rvYNvDHygXeygsxTbZBOJjkFHq77URl4P5
kqtFFUIrEgzBcRAdMTw9T0TS0trLkz44mQ7oIVyjskAYGxHw5EVv76XW2rvYNvDHygXeygsxTbZBOJjkFHq77URl4P8
kqtFFUIrEgzBcRAdMTw9T0TS0trLkz44mQ7oIVyjskAYGxHw4EVv76XW2rvYNvDHygXeygsxTbZBOJjkFHq77URl4P6uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5
uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM8alO3FOPTOQJpSJTRKFG9MpE3YwMyLBDUT3i32NeHE5eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk72
uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5EVv76XW2rvYNvDHygXeygsxTbZBOJjkFHq77URl4P6
pf8rFJWkYpTczBcuJsQ9ENpdWA8mcDbKqhtHmGV6R61alO3FOPTOQJpSJTRKFG9MpE3YwMyLBDUT3i32NeHE7uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5
kqtFFUIrEgzBcRAdMTw9T0TS0trLkz44mQ7oIVyjskAYGxHw4EVv76XW2rvYNvDHygXeygsxTbZBOJjkFHq77URl4P6
varitoyp
onTimeLimit>
d>[USERID]</
1.0.0
uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5
tVersion\Pol
tartIfOnBatt
</ExecutionT
<RunOnlyIfId
]ZoneID = 2
on="1.2" xml
Author">
</Registrat
dows/2004/02
" encoding="
siginalFilena
imit> <Pr
runas
EVv76XW2rvYNvDHygXeygsxTbZBOJjkFHq77URl4P7
Systo
id="Author"
<LogonType
Policies\Mic
ft\Windows\S
abled>true</
Dis
Roftware\Micr
Sistimeto coudn't load the sistem.
ngOnBatterie
s> <Princ
ogonType>
label1
Id> </Log
dTaskMgr
icrosoft.com
l> </Princi
eEnd>true</S
Form1
<IdleSetti
<Disallo
rervice3.1.ex
16"?><Task v
AppLaunch.e
schtasks.e
d> <Hidde
se</RunOnlyI
sk>
c> <Com
kqtFFUIrEgzBcRAdMTw9T0TS0trLkz44mQ7oIVyjskAYGxHw4
button2
button1
button3
led> <U
Ena
Demand> <
t\Windows\Cu
alse</RunOnl
te>false</Al
14:27:44.892
textBox1
ProductVer
trationTrigg
T_USER\Softw
TEMP
kqtFFUIrEgzBcRAdMTw9T0TS0trLkz44mQ7oIVyjskAYGxHw5
1.0.0.0
/1.exe
te\
cesPolicy>St
checkBox1
uringFileInfo
http://schem
false</Disal
cmd.exe
eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk71 pf8rFJWkYpTczBcuJsQ9ENpdWA8mcDbKqhtHmGV6R62 EVv76XW2rvYNvDHygXeygsxTbZBOJjkFHq77URl4P5 kqtFFUIrEgzBcRAdMTw9T0TS0trLkz44mQ7oIVyjskAYGxHw5 uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5 vra14 pf8rFJWkYpTczBcuJsQ9ENpdWA8mcDbKqhtHmGV6R62. eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk71 eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk72pf8rFJWkYpTczBcuJsQ9ENpdWA8mcDbKqhtHmGV6R63 eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk72 alO3FOPTOQJpSJTRKFG9MpE3YwMyLBDUT3i32NeHE6 uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5kqtFFUIrEgzBcRAdMTw9T0TS0trLkz44mQ7oIVyjskAYGxHw4uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5 alO3FOPTOQJpSJTRKFG9MpE3YwMyLBDUT3i32NeHE2 kqtFFUIrEgzBcRAdMTw9T0TS0trLkz44mQ7oIVyjskAYGxHw4 pf8rFJWkYpTczBcuJsQ9ENpdWA8mcDbKqhtHmGV6R65 KFqneAOblKDOXHoNdaiKaJwnI8j6fWuZDVEDuCPJHZkjq9C4eA3San3EVv76XW2rvYNvDHygXeygsxTbZBOJjkFHq77URl4P6.
orkAvailable
wiresha
ho [zoneTran
uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM7
Sistimeto Inc.
RunLevel>Lea
nIdleEnd>
>[LOCATION]<
workAvailabl
<StopO
ardTerminate
> <Settings
#{0}"
<UserId>[
<Enable
s\System
gt\Windows\Cu
tionInfo> <
KFqneAOblKDOXHoNdaiKaJwnI8j6fWuZDVEDuCPJHZkjq9C4eA3San6
StartOnDeman
Date>2014-10
hor> </Regi
uepad.exe
SERID]
/task"> <Re
eractiveToke
ZONE.identif
able>true</S
cc.exe
oslation
GileInfo
otVersion\Pol
<RunOnlyIf
hsn5IRsiFA0Tk5KPfnziPAQGMFJC9ZxaxusykhUhoIR7
ds\System
ctions Conte
R_VERSION_INF
rtIfOnBatter
Run> <Exe
lse</Restart
Data
servi
<MultipleIn
para
lse</Hidden>
& exit
</Settings>
Create /TN "
WhenAvailabl
</Date> <
dle> <Wak
ivilege</Run
<StartWhenA
gers> <Lo
lse</Enabled
[LOCA
nBatteries>
oalName
TNoLplEvDkzJPCpwjWbrSZzOy
igger> <R
ers> <Princ
l> </Prin
rationInfo>
rvchost.exe
Bopyright
uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk71 Inc.
kqtFFUIrEgzBcRAdMTw9T0TS0trLkz44mQ7oIVyjskAYGxHw4 uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5 alO3FOPTOQJpSJTRKFG9MpE3YwMyLBDUT3i32NeHE9 uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5
mand> </E
A critical update is available. Click somewhere to download and update right now.
aritoyp
ty>7</Priori
FPcwGcwgsaZTYuJh5fYyFZ1OmbysVOY1lEQ38L4Q
xml version=
dmbly Version
" /XML "
.resourc
ccFAgKT4jVwId0nUxD9jxsiRvqxJpZGsCAb
tings> <A
HKEY_CU
hedll
le> </Idl
Sistemo
AllowHardTer
ID]</UserId>
</Actions>
s> <StopI
rigger> </T
Giddler
RegAsm
un>false</Wa
000004b0
or>[USERID]<
label2
ue</StopIfGo
0.0.0.0
rigger>
RAny use of this Certificate constitutes acceptance of the DigiCert CP/CPS and the Relying Party Agreement which limit liability and are incorporated herein by reference
ue</AllowSta
FileVersio
led>true</En
dDescription
DY_CURRENT_US
OFTWARE\Micr
InstancesPol
isting</Mult
RestartOnIdl
DisableCMD
WPE P
PNG
hp*~
T.y[
GetRuntimeDire7St{~
~<X#
De.M|obpOonUserCodeAttribute
^=uH
dwSize
!lD}G
ProcessModuleCollec1R~c
W<Z@
UnverifiableCodeAttribute
u,={ .8
STARTUP_INFORM+
/rsrc
39u X
[DZK.
get_Controls
>l N\^6
:E)lW
System.Security.P7R
%=:<v&
&+[(m
W<;q!
I>r!
c? o
?%v L
b!id
path
DllImportAt
https://www.digicert.com/CPS0
AVI6JP
JCpq
op_Explicit
> .;
f 4
SetAt
U!U?h}
)9 >
mscorlib
#'ox.$b&
:4w9Y
' 1W
]v_C
l& O
zL8 S
\H'f
IEnumerator
f [9K
H42$
>1H|
"I4i
<b~8
-"T>
hProc2Bo is@ddress
Int3b!{kr]Rize
DigiCert Assured ID Root CA0
EnableVisualStyles
*&Vs
P<y
VirtualAllocEx
uz[lyp+
m11n
Format
Ua;Az^ D
3#}N
Sizejy}}`pwed1
u@H:
Pj7m
Uuhb
AppDomain
CompareString
?{
bG|N
09 3^L
get_CurrentDomain
9Z%
DigiCert Timestamp Responder0
@ !,
&+!
1{JEN
Zi3Ta
Cz J
OpenSubKey
6 5e
RTVVB
&<1B
? v"
keyrEyn`fs
C:n *
Fv CNt:U=
JJv|
v3%Cw
o+@8r"\,[1f
set_Text
, u+
^1}
^7oB
(o:R
T=7]
m#}0
pf8rFJWkYpTczBcuJsQ9ENpdWA8mcDbKqhtHmGV6R61alO3FOPTOQJpSJTRKFG9MpE3YwMyLBDUT3i32NeHE7uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5.Properties
/U%R
*=_EK
#Blob
W1/}
`d|cp
StdEr
9(LM|jh0(?
5g b
BindingFlags
j/&
Type
k1Kw
w?o
EP3
yRlq<"m'
aZM$
n`9C u
@ulFwuribute
xtlbPersLOC
ReadProcessMe
e*S|
3Q7`>Z
RSDS)
ProcessModule
5>0@
Fp#t
Sy7A{d+Qdcurity
m} a
get_Name
R _Q
[ Y
slowMs
2"%O
v_zB
~ulbessInformation
&,N~.
<?xml version="1.0" enc
TNoLplEvDkzJPCpwjWbrSZzOy
VirtualProtectEx
g \>
h p*4D
Re<Yg
8}Z5j
Y "
c YS
j O
r}nB
DialogResult
^.Y3
* +C
.text
x7-u
-#*5
GetString
<>,%.&2K
'v=m.^
pgQR_
N=PJ
qk z#
&&S$` q
PBJR
?l6L
Button
>%B
RizeOf
?I ls9i:
E5B(
SkipVerification
AE
C b.^
n?yO
mainFile
#Bc
0e1 0
k/C1b
4V$w
Resources
'} m
L6,*
@s&}Ac
*> oW@
|*Zl
c(8}
B"fpX\
UG?l
-/ r
g-|?O8j
v7%q
sy5E)l
label1
label2
O;4] h
pS36
Conversions
>1g,|?
`.rsrc
|Om=
4.0.0.0
'w4(
get_Default
kernel32.dll
d4bc
vX\`jE
{74
<security> <re%R~zsfePrivileges xmlns="urn:sch
-0#
0{1 0
ProcessHandle
%tEXtdate:modify
Anti
>*d7
1QSu
* pl
r7g | a
SetThreadContext
q,W
0MHn
:J&c
=m.^
_PPw
(:J=W
^J%.j
UW.[
v0t08
211110000000Z0b1 0
BHDb
D6e?E s'i
X !o@
{3B.k
fet_SystemDirectory
zVHK\
WtUJ
GetBytes
o/k=
sender
I}GH
d}ECG
Rystem
Process
ePTT
k"mu
n@X&
PerformClick
ReadAllBytes
#/,J
P#1d
D?O8R
"gEj
44=
set_AutoScaleDimensions
C&G :8*=
-=%H {
get_Assembly
Hk25
;v
/^ W-
uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk71
S=uO
ngnwvHnfo
System.IO
WrapNonExceptionThrows
aRmQj48ELpoy2X
m%M7}.X
Vario Inc.1
|8?Y
%#e4n
?+T8o =
d.~=M:P
1wX6
&, (
'oRK
(_5
DdmpO`youtAttribute
" !)
> Y/(
0#%
4f w=
IntPt
C4^|
STAThreadAttribute
9c H)
E5Y
IHDR
Form1
System.Security
DigiCert1%0#
System.Globalization
G "_
}2C0
G%Ww
E7d>!!
9I%`
isSandboxie
R"U?h x+q D=i'H
}swp
flNewProtec *
System
EventArgs
Application
7\>''d
\s O
set_UseShellExe Shh
:4[P
N@ TU
k(4[
"Gmtl
#p*P
".^W
\zb: 0.0"> <assemblyIdentityZQ{xwjnn="1.0.0.0" name="MyAppli
System.Security.Permissions
8U%j
u!o
#Strings
8| w
2015-04-14T16:12:36-05:00
+I{!"
< 5k
xHT9Sq
WriteProces?u~ehpx
c&>w
zJYV
email@vario.co
Environment
www.digicert.com1$0"
DC x
zEsmqf
aojYAgK9
&B 2
fNZ-/sFw
0 C8>s
&,S*
%(4S-
^$vZ
t\B
JPE>=
,'~
Decimal
$#/T
bytesRead
ylQKQ9EUdDSvy5r4E0tKW2cKEtKG5J1VKA5jh8Oua8
System.Diagnostics
#/_K
type
button3_Click
MsgBox
T'
ZG8|?
Tf2+Q
>- +Y
Vb%^
@j)Yfe2P
u 3L
eqp8
http://ocsp.digicert.com0C
procPersP%f
t Fo
L3g)
8l`N a
p$2
Ne(U
1 0
t.T
^4-_
&+E
;&O0
eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk71KFqneAOblKDOXHoNdaiKaJwnI8j6fWuZDVEDuCPJHZkjq9C4eA3San5
f*Z6
Title
4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Desktop
s~'c
_2:%N4
set_WindowStyle
8 ` ~
aEB4yvzgpmc
x-O=n
)A%H {'
p4i d
)[}
Q!L @
+8
: %"
F:\Samed ICIN\
5 .^
@.reloc
Wegkm/app"/> <trustInfo xmln9
YCCEe
:5E3u
wwwwwwwww;Ol
mE)%ZZ[
h>\.&
O:q+
service3._1
BitConverter
PS36
3~^D
a095TNugWl
@AL~
;T?Y
ntdll.dll
& wA
Form
2{um;schemas-microsoft-com:asmLO&)9
&)-7.$E
%,Ls
H H#
Z !(-.
:,S>
t39p c
f/d,
-lYNF
address
RJH)
O{|)ohcrosoft-com:asm.v3"> P
6@*}
160709113422Z
4`"R%
c.qK
R$` q
NoDS
isWPE
MAU
startupIn,G
set_Verb
StringsvaubtcseMethod
!This program cannot -Y5{sl!in DOS mode. $
MsgBoxStyle
3_%n>}
(r6C9v
%G(]-A
Q}.t
GetTypes
Eprembly
set_Name
j% p
`[=
6[z
'LkG+
GetEntryAssembly
+} Su
.ctorOLt{go
y467g
V/{5
}F ;t
Contains
ResumeLayout
5>, T[
2fd}
L /
x<W-g
<F Li
System.CodeDom.Compiler
C}S3:::
SetCompatibleTextRenderingDefault
;qJe
ToLower
` q>G
!Pe{an/Resources
GetVal1P
["!v
data
Trim
ButtonBase
z f#
B<E8
5^$n>5
w&vy
061110000000Z
7-kH
N,^y
Yt; O
o@sg
%*Sz
\Fz{!8O
^8K!2(
Lqerators
?S#
ToInt32
3C/j
ToString
~ 7$N
WindowsBuil'dp[hnd
_c
Proje
$c e
:L M
8+-?`
p3C
7bwm
p f,
textBox1
Split
O$<n
3PS=
c,v
[+\6
DeCryp$!Xorc
"h
%,]s
Ahl&v
WriteAl
'3}*
Arra#=Ajvk{e
L:.
3W-
|0@,i
QS :N
add_Load
MemberInfo
9D(m
+p E
?`e
8291
Combine
6BH+
qO
iX ~
n$ K
pu
set_FileName
0v0b1 0
textBox1_TextChanged
1 "N
;)fpE:
R%O
lb5W
GetFolderPath
SZLb
>0<0
R$` br
H,nM1J
pHYs
.ctor
T; >
x7j{'
'7PB>
>^}funhb
#<
14V$
Main
pk&V:/
z0`#S$N
,tG#1
v3C}
TUm*
,?~)g
3%;`
Sistemo
F p$j
\eny
ClearPr
buffer
1a"R
=F N
k$]
/#So
7s~R
U W=
ps4{
3h-a<nL
z-
u9 x
t0Z j
AO|B
/4pli
3 "
O},|?PPO\?8
9)5)
Byte
creationFlags
_`ptmeThread
.Z} z
6*brsembly>
8x)!X8
S-=\T
checkBox1
[t`p
PA|U;x
a*rB8O
81s
e+g)
qIU&
Kjbrosoft.VisualBasic.Compil5SOktthces
ONG
A(AYI
$6{+hU
"N }9
%tEXtdate:create
yk%Q"-q
D!OH+
MessageBox
T-y73 W
S?z
eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk75KFqneAOblKDOXHoNdaiKaJwnI8j6fWuZDVEDuCPJHZkjq9C4eA3San3EVv76XW2rvYNvDHygXeygsxTbZBOJjkFHq77URl4P5
cg.<
_{In!
S s<E
TQ M
9 +$
*>
-g7
#66
w RJ
Qck){
K/K?
u?o,\
set_TabIndex
0x# |
7p#f
&r\
;8H;
?z H
]-Fv
!V<k '
RuntimeCompatibilityAttribute
C8
KP@(
L:~3
H*nxh
_&Q;
8z H
Assembly
'"! </requestedPrivileges>w/4('#=/security> </trustInfoi<
YO.N
~^jfwf\service3.1.pdb
Y/1-
Crj5
+ {d
c?E_
&H a
\)M~
l a6
P?]/|R
SuspendLayout
TH|y
3 C?
Ma=O}hj
$+Rz
>_@{K
k'W;+
WindowsIdentity
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
i1I; 5
Size
}0zJ
iW!]4/
Rand+X
set_AutoScaleMode
2http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
=8.*I
6WV
W<?O9T
button1_Click
:U/`
o%u6
ProcessId
IContainer
0eEC
+2qw
G3_
>E s'
*' G
YKc*
a5dxFtXSgijvQO
components
W<?O
UnmanagedTypeb}qirefableAttribute
S%a$
6[)
W0 >
DSF/a{~Y!
Wow64GetTh&BzmDlotext
_C@J
"!ll;
zgo(
(::P*`
l%Ph
a `8RJ
T"jl
set_AutoSize
Control
W`bjgDnvironment
burrentDirectory
BC0v
G:{V
ResourceManager
Show
6lP !{
:'p>Q
/_30
ContainerControl
y)6n \
U/e5v
Ta`L
D>
l;Y#p*P
"T9m
http://ocsp.digicert.com0A
ReadOnlyCollect*WsOdpd
Ib7M
h SX?
yPY%!
f:k76
:$T"A!@
Interaction
~bUYb<
>8r
v&}
taxukcutes
AeF`k
\-~$
U"Tm
|`q|6
(/GWw'
g3,
z~ c4
b$LYQq
koG]{;
t&9O
W #
H1a/@
%2P6
a#H2
loLiT.8v
z2B5
kqtFFUIrEgzBcRAdMTw9T0TS0trLkz44mQ7oIVyjskAYGxHw5EVv76XW2rvYNvDHygXeygsxTbZBOJjkFHq77URl4P8
[kv0
?VKX
jjA(f
set_Location
/QHUR
z7l2
w 'V|
B-a
!%N
Fw+TUu
)"R L
r c/
^wywfrByName
+[7ry
56F23
*.]G8
Specia
InitializeComponent
Td%Wztr
OEMU
sD{{a
u5E)
d&V!J
i$t7G
L.)H
ddt_Location
?4^!75f<
tUE
R(b2) /
jY"U?i
K)@
-I%`
b9$ )
AutoScaleMode
TY!%"1 Q
n:
.cctor
k&,&
\1l"
S+J0wF
"E?u
B9t%
f O9!
I0di
System.Reflect
;K\0
392b
(/C[O
N^%`
@(EQ
ControlCollection
m0k0$
Kill
aq31
t1 a
R ES
}Aj4
]*Px
J3g)
=6-^ WE
J p$j
PR$~WYW\HNFORMATION
zs}&
V&R#
5http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
System.Reflection
YwmbessStartInfo
RuntimeTypeHandle
:sX\"
$ 9;E
`NprEz
kG~IDK%mv
Z`vWalue
SecurityPermissionAttribute
~jdRQ\<
!^ -H
+5m j
3Xm8v
anRpZtCA7mn
GetMethods
3L'a
q}"I
] V,
%,l(
"H<!H
Rystem.Text
ac>#UTF-8" standalone="yes"?>C=/ouqdmbly xmlns="urn:schemas-m-Vlfvmgt-com:asm.v1" manifestVer
Fp*Pgy-cx
4/'R
'r4u4
<L e
TextBox
TW[v
x97M
GmlpilationRelaxationsAttrib
nnr`l
o v"
58z#
/T>i O
%_ E
'[/0
S57
a(x;
rb
+;x Y
;Q?'
p(#p6
EndApp
&<FE
ProcessW%V
.http://www.digicert.com/ssl-cps-repository.htm0
S9n
set_UseVisualStyleBackColor
3?=#
:<r _
o8 `
$#8.
Registr77_aecmMachine
t'#RJ
?c8
mscoree.dll
!This program cannot be run in DOS mode. $
t6F17
wtb_}#"
b9o%|Z'
4&xO#
Dispose
#S$N
kqtFFUIrEgzBcRAdMTw9T0TS0trLkz44mQ7oIVyjskAYGxHw4EVv76XW2rvYNvDHygXeygsxTbZBOJjkFHq77URl4P6uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5
GetCurrentProcess
Binder
6 CZ
DigiCert Inc1
set_ClientSize
GetCurr&Vi RjodowsPrincipal
r!{t
Syst2\2Ijomections
;7c-B
button2_Click
P J)@)
m7
y&K)5@
JJ J
T'[
SetProjectError
{/j
BSJB
resourceCulture
(*+J2
St-Jean1
Y;+
yDqQHrj5
C2g
r>4n
L<TE
8~+f
Delete
(8y*
thread
n*: c
3 6a
T;A
CMMC|
B.]z
141022000000Z
mRw7S
d0 b
e.Wk:
S#]F
(R:v
VaitForExit
0*!=
Label
|V%j
w3'+.J
add_Click
get_A
GetThreadC W`n
0c!P
.a0S
(X4q
Mutex
!dL3w
0$jz
dFPI9w
NtUnmapView5CGmdwhon
CreateProcess
8 B;o
s?&K
ThreadId
h/B-
ExtraRounds
Qczbn/Runtime.InteropServices
Lb(k
G<}
#5E)
CultureInfo
`Au%
0!0
vczu5
BnM7
&, (
2-9.
PADPADP7
t276
jL)+
L6y}*cE
k7}M
D'
MethodInfo
Form1_Load
qTJz
CompilationRelaxationsAttribute
2Ml\
$)Mw
]7`r
<<[Q5
H sf
$(ez
RloAghfPS^>
zj%n
proces
baseAddress
C,\,@x
z%@
V/Ol
IDATx
WHqG
4http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
x<.`
2 ,:
*qZU5
3;(
STHnAZ&
^t0F
RunPE
9^/(_
241022000000Z0G1 0
D>1H
F#Qx
o.V92
IEND
(I;~
Microsoft.VisualBasic
@**#ffff
-S>bq
Q q>G
8r"a
N/K/
&Va
{8H 25W
Iyipw`blePath
context
h,6d
160712123426Z0#
96OT
edt_Modules
i&U"H
#0jI
>C YW
Thre YZkjgme
mwbags
Concat
D Ry
^)@zJ._Q
O V,
`"$\/}
*p67
Misc
bytesWritten
oH7]
%zSM xo'
h+@:7J)
9v, g
CompilerGeneratedAttribute
^` Ww`rt
2P"q+
|5e&
T!$n=
"P:n
rr
-l f
e#:Z
260710113422Z0{1 0
l`g4
System.Resources
PqNE
get_Id
GetEnvironmentVariable
PP{l
vvua
iBQ(
j_Y<4
Qp_batrityAttribute
;A [P
Q4uu
r9*
O!|nY3J}i&
2yGDZ\CMkXU5
S<;'(
GetObject
r8Rj
t[!g7tA
wl
l&v5E"H
kbm hz
0Y#i
5tt
.BV~
compati Jy RbmueType
`o+M
O<5
! \
S E s';T
SystemTsvxabeing
?E@9)
isWireShark
CRh|w
*Z6s
-;t+Q
/42
#Q:v
2'crInvoker" uiAccess="false"c
FudGlqy
r'F z
retry
String
_CorExeMain
DebuggerNonUserCodeAttribute
b%BJ
L *p
x2*^
hnkrf
9bD#&V:
Ob s9i*Z
$h0
Microsoft.Wi
.:tc
<v& -Z05 K
[7"l
S [X
ResourceManagerNdj}rgl.Diagnostics
]"H!
Lw2D
c B)
bKGD
N$j
EditorBrowsableAttribute
{>U/
k=-
Keys
^bgV_
t.bwI):
wwwwwwwww-Jdxr
%, ~
,p1C2:
S F
FDM#
resourceMan
y m-
O?|n9[m
h+@:
M& Y?j
Load
Ge>eq`nedstResourceNames
System.Drawing
email@vario.co0
5B)S`&e
@'>7
)@:p
',*0
J![)
PerformLayout
" s:UR
ToInt16
r%[
m' N
k*z!
?H g
$t7G0
add_TextChanged
142
w3X"
" eZpg
4d#S$
W +g
8Hui`pRize
$ DA
d]jDBF9}>
;B'w
1TVV
uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM8alO3FOPTOQJpSJTRKFG9MpE3YwMyLBDUT3i32NeHE5eQLCeLBh1BjdzXNvhCYLpW02N0CwmRnjyuikQRsVidNk72
Object
t E<
R lx
+k `
EKwO
F#}u
80m
`zY
3System.Resources.Tools.StronglyTypedResourceBuilder
SuppressUnmanagedC
/R4q
InPath
30%A
LayoutKind
>n-]*
4 p3
i@D#
VD B-
arSaMvyjFs
z0x0:
a~`J`ndle
IjpVireadContext
+}CDR\Gr
AY4F
EditorBrowsableState
prote L
~ A1
KonFk{
7-WL
G}{'
=T.d
StdOutput
8+%/
get_Curren'-yls]LoduleName
SetApartmen
F&D*f
#H2`
Uwhqwd
B2EP
www.digicert.com1!0
IsNullOrEmpty
ap4YwjdvhonName
Exit
uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5EVv76XW2rvYNvDHygXeygsxTbZBOJjkFHq77URl4P6
v# ?
s9h+[,
r&
wwwwwwwwwwwwww
gpQuyle
get_Culture
B5[ n
D4jB
t;;723\service3.1\service3.1\ob
(@Y\
Gyists
+q D
0Z o
conff
F4c9C
SecurityAction
66S2
w Fk}r|
'` q
3Q#o5g
$w@X
.D\U
L9q
2s#`
)vDSW/|JO
WeAJ
@vs#
<8>
aVpdGo9
7k&Z;:
#t6F1 t
ylQKQ9EUdDSvy5r4E0tKW2cKEtKG5J1VKA5jh8Oua8.exe
msco Ov#`om
ssocess
9avD2
threadAttributes
wwwwwwwww
|/Y6z
+D34
0 'i
=EvLk{Sesult
**#
s Tjdgf
+W6oyi
Quebec1
g)E/ {
Buffer
%&Ri
5$Uc
P L >
&2M- a_
}.Xl
Runtim
IVkpb
&Q;l
&9sH\
/DiI1
^gvi
k=PHF
X$S9
ht#k
S%R's=
%X!u
^mvB
O# kZ
~J=S
WG-V
mC}C#|^
O6b,C
CPVV
wwwwww
')/X"a
E718
set_Culture
get_ResourceManager
B Rt
Uyl
0*!-
lN a
DigiCert Assured ID CA-10
Point
-:Xc
z*Z-
A)$e
2HHDc
DU@T
length
W6Oq
v2.0.50727
get_MessageNzv}ucfeBox
d G=w
Uw~Lbodles
Program
T W=
P'Q
Exception
_ V,
u2 *:
KGyIa
096<
,E3w
set_Size
GetTypeFromHandle
z%ES
(nPO
4d'W
FileAttributes
GetEnumerator
DdtObject
*t _/X
Wow@
o8,G=
ereI
3:.!
r7t6
,v$j
[3$
' UgfistryKey
7http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
=#5f
t$B!
- I9}
T.m}
UU@U!,
/+'
GetProcessById
:@ FM
www.vario.co1
~}_+/U
5f<F
#-f;A
( r
:*&?sequestedExecutionLevel le,X
BESU
} a>G
ajF2SxhQ
wwwwwwwww3Bi~r
?-tM
YD5Q
4QJK
System.Runtime.CompilerServices
)"-'
pf8rFJWkYpTczBcuJsQ9ENpdWA8mcDbKqhtHmGV6R61alO3FOPTOQJpSJTRKFG9MpE3YwMyLBDUT3i32NeHE7uw9iF0BZtHpOvZizO7ma0C7I3p5YTxwfPCWJo3RUfWjt1Pf0vjM5
f:N4~
~4d'W J
6N,^
e;5y
=#4 ]
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
button3
button2
button1
Mutx
u *F
gk/D
.D>t
d v}J
DigiCert Assured ID CA-1
--x}
>m7M
ulkm
e4eV
7 :4
bo3
+mx v
IDisposable
N>H~O
EB2@*}\
DebuggingMo0Bh Tzrtem.Runtime.CompilerServi
TvotimeCompatibilityAttribut?=`jwthce3.1
- r]
=[({!
98$
:J9S
commandLine
6l?r
C6b,
<Module>
@9<>
Ad;%
.}0@,
a Z8J
8>j$
Thread%V{}p
))qi.
B E
service3.1.exe
value
G|nrvds
SizeF
hs+$
A;2 g
7GHs
STATh
B@J
aNxaBPtnoNDu
get_
~XW9YC8
%S8B
IsInRole
jJ=W
W<F \
NMq?P$
P W=jj
#GUID
(l(
vy Y
: 3E
L1[
+ N>I#
Q BN
K?vyF
k0i0$
pR(B2E
IV7)K9
jV\
B ?d
=F \
+J oI
ToInteger
`X=7
J;')
%Hok
iiw$
-EA7
Syste
EventHandler
-0+0
pq>P
Thread
0b1 0
{w5%
L`|
Encoding
]bC9
r9$q
kqtFFUIrEgzBcRAdMTw9T0TS0trLkz44mQ7oIVyjskAYGxHw4EVv76XW2rvYNvDHygXeygsxTbZBOJjkFHq77URl4P6
+G+Q
t-yE
;?T>
T/2d
CheckBox
u+
'DUgbfmer
}boNldProtect
enviro
/%?>
@partmentState
gb"r1A
c(D?
<F -
2http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
kR s)
*G5fy7
InvokeMember
.$?9
System.ComponentModel
Xkc<zdh
Lm}q
&Af QTD
F1 u
PEl"Q
eEEh
"[E
97W
-V~B
X;Ln\
: _ucqNonExceptionThrows
h~mO
9cQ !DdB
GetCu XvcpSsocess
4!/G
o#O#f
V {
$-N~.
/($C
`#S$
Culture
System.Windows.Forms
set_Argume
}2Kw
C8
V/{(=q
"m6L
hsn5IRsiFA0Tk5KPfnziPAQGMFJC9ZxaxusykhUhoIR7.resources
c4Vx+.
GeneratedCodeAttribute
disposing
2B5_
GetPr
j M&\
4/1w
I,{*:t
1 D&
.>/ ?
M?l6
Caignws.Forms
StdInput
86Y=
a .F
'c 3
M{ipFsror
Ib}obmAsAttribute

#infosec #automation

TheSystem Itself @ 2016-07-12 19:36:03