MalScore
100/100
MalFamily
Malicious

uo.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 14/66 Related 2132
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 338.50 KB (346624 bytes)
Compile time: 2017-08-20 12:39:21
MD5: 6d8ab5af874bc3bcdf1df536430235fa
SHA1: 068db39ea70430d8908edb0c3bb2105e3f06e52c
SHA256: b5869677c8c331b1e495f449801df3cf9aeb5d2969b86889ebda9ef8b42053c8
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 >rqkzA .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-05-30 12:57:03
Last submission: 2018-05-30 12:57:03
Filename detected: - uo.exe (1)
URL file hosting
hXXp://emifile.com/gos/uo.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-05-30 08:35:46 [14/66] VirusTotal
PE Sections 3 suspicious
Name VAddress VSize Size MD5 SHA1
>rqkzA 0x2000 0x4b304 308224 10de6688127978cedc7a7cf099ed593c c05dfeae654d3e2cd98799fc8639d3e5c2fd68e9
.text 0x4e000 0x43e0 17408 47f119cf1f99cb7326b344d52f8885dc a9e5a1d3ba28c1e08bf5676fec9f771011364c10
.rsrc 0x54000 0x4908 18944 0028bb4c21dec981c6a492077a3c3b99 6583603a7476e208ad52b6bd9184e82f8087b656
.reloc 0x5a000 0xc 512 8e315e7289dfe45e8ab44953ac185ce8 616b8665282e75dd3263da67f62ab20d4a31bf60
0x5c000 0x10 512 c01376691b09ba9eb7e8550b42e834c3 8b6b6156e99a5fc4d34ab9d91b8883a9448304e9
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x54130 16936 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x58358 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x5836c 940 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x58718 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 United Defense Industries Inc.
Assembly Version: 0.0.0.0
InternalName: salaerr.exe
FileVersion: 1.11.33.1
CompanyName: United Defense Industries Inc.
Comments: wtrmpztnuo4
ProductName: Lithiated Lemon Soda
ProductVersion: 1.11.33.1
FileDescription: Lithiated Lemon Soda
Translation: 0x0000 0x04b0
OriginalFilename: salaerr.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
IP Found
1.11.33.1
URL(s)
No URL found
wtrmpztnuo4
VarFileInfo
Comments
InternalName
salaerr.exe
StringFileInfo
Translation
1.11.33.1
Assembly Version
FileVersion
Copyright
VS_VERSION_INFO
000004b0
United Defense Industries Inc.
ProductVersion
FileDescription
0.0.0.0
OriginalFilename
LegalCopyright
CompanyName
2018 United Defense Industries Inc.
ProductName
Lithiated Lemon Soda
4"8K+
;#OsM
*[HZ
l8K|
AdJU
DX*L
__?d
]NxT.
}Z @_l
>8yv6
f::eI '
j<QN
\R6$
Z(~8
di/}
(j?h:u
fjSN
zN6c{
'P&rN
M nW
#YI,
mQIJ
|v(
ukJ%W
cgTV
6>kS
2].B
0j-?
HBpc
i4t^
8~?xZ
tfv4
1}1L
VZ-"{n
_0q[
Y3jiH
O ^r
CQV$;A+z<
z y\->
W!nC
A6(Lw)(
,8#
ResolveEventHandler
95|Rh
&m,
Vu$".@68
lkjj
l7x 6
eyVf
VPZ`
1,hZ
]v k
v&c.
>Sa(
mZ|/
>i*x
}z?$
i)Zr
Ywu0*
oWa~
.fVyG
_Ie2
8Jntz
};cv3
.#AIN
ijil
^#/H
y2gEG
PV{4
_i7Pr
A\`t
y*@b m
f"0pG
|eE_8
p|Y)8W
@?(u
V<?D
%%";x
Version
q^=_
8 vY
YZ);M
yQ._
g=s\
wzYg
M;)m3
25P1
5/u4
HOhCi
#.H= ao
;Q5}
8D\j
&uT6
t8yr>
S^}
(
%h'~
A85nR
;ama
2y^{p
*q:t
O`2S6
TUx5
j%sV
q'8K
GH!Z
Al:\
8VHg
73?3
>4
,jWQ
!4HJ80
aUzH
XH3X
>Dx"H
$Enq
P(`w
{t+%
vE1E
`S5P
mvsv
$FCP
H@;K
ZN61
PPbB46
j Anq;
`dT\u&GB
,i;l
Marshal
5?C2
]/7mt
C')S33
*hN
Leu/)
pGS0x87:
`_lK
03!7#
}Y.D
wbP>;
Q,>C
a1Y9
S+{R
bxt=
ca-
5g=
#+P~
;;Zq
7WyL
JJ$7
m8EQ
52Xs
tQ#6
]3-8
lfO6`
>$ >
wVy@ 9
b3>Q
op_Explicit
RuntimeFieldHandle
8|Tu
]>fN;]
u<_r~
System.Security
p^"v^
S"5z
>161J
6TU]
29fS
8B8`D
Q+9
zL8x8
RV[i
bQ4H
!'lxE
QOgY5P
n6R^
j;Hx
8I~8
[_4r
i%9
Az6P
<:qd
!c;LA
\k,@
>#Id
w-N=
uk92o
PmR5
(gfIR
Z,7s
&Jgfa
*&VX
"5u[1%
LlL0
{b W
9:rS
vNso
<`$\
k(T1
[-\.
ELp|
m3QZe
|8vk
>@":
ZS1m
IX(6KF
R}5%
l{if
ac(8$
170Pj
]e"|
df|u
W; }
"n\&
[ y
4;WP
( >!w
=KyS7a1aD
T CJ
mR &(
JU
E|al
Q|[d
g'NmZ=
R=I:
M+X_C
+=C
#Gv;
n>RbQ
9}1
Ri)
c\q'
R*!C
aD c
H,75
*Ms.
~>C2
VV?,
cQ=$
,eT-s!G~I
z++N
jHr]
-s(_
=_fmr.
W-f0
,go9
ZX$F
5QCL
u:SE
YBU/zo
e3U?
lBb&=b
9>|)
<>dJ
t;6#D
zg_H
4$M4NY
Hyt0+\
M~}n
|<BNspQ<
vhE"
AppDomain
G8c&
?Z"n
p9/)
N-G
/zzLb
E=62
r1 x
q3b
R&q1l
Pn]+
u(iE<~
q({z
?1/D
6B=q
s uz
)ulj
_P "
jiim
0rqi
Qw3zb
aPBa
MB6:
r?kB
O0F@
#a5$!f
#| h
(Kx[
geGBVR
KUcoM
4xb?/I
n,7K
Ib#_T
!$|9
f$v
3puf
Lw6dzI
+I"
b3ES
g]Ol
WA(Ds
[<PF
B#(Z9
a{s:&t6
J"k
;t'C
l_:S
Gw*
&:#.
6.Kr$
LkNV&
Uo]f#
<cvn@
cSt:;
N""O
#]-1
Ja0|W<
+AZ#
2G?
0OEg
j,]>T
?ML9
#LR
q4.sw%M
,S[[u
O <k
(;DVcc
]2%=,?
l"w}
@zy{
?`ha0V
D~y<
0w@kY
gh.n
x~Q9
Gl .
>f1x!
Sz_M
@xCI
Z#Sv
!}|;
eaq
!8 ;Z
90N @
@[Or3
wSJ+
O> C_qT<
nzsSIU>
n' z
cGG,
S1u9
#Blob
U?jZ
[PXt
KWe3
;{[h
M hF
nmj<
?^'I
wtC e,
J\A{
\j Y<
jHjq
LFEB
f\FP
NP~85
KZX
i4MP
zU~aY
"d<S
# =t'
a=H
0/X^crd\z
coL`
4#T@
$LGy`s#i_-v
(r{+
6$b
@Hdy
9-1g
@Jhj
M*A&%@
R 3=zD
!,/
]~kd
*[oU
-;U3
0Ssr
{v`_
Type
m{ 2
d \'
kd%E
aC|p
|lw<C7%-
LIE*
, Z
_9ZH
JS$<
I^ R
|{hG.
Onq4'
xR$"
F%A.:
`Ih<
jO\9cD
.fx1w
drBQp
0P5[
k_<7
_ )6Ra
}NKc
`-]3[
K9?k (
+v+9
z0<eL
j/sI
R2{0
h%f4
d46*
nm:>j
IFd
G'1H
d9![
j/u1
-g&7
z-@h(
\4j/3N
dCJ>
wYO$
}4F:.
w}Ap
Char
InS.)
Nbb\`
P%[]
%'yN
T90d}0
;]^ 3
5S4-o
^ Sm
.oOf
Zp~
Nr3E]
@JJ.
{o5O
~b^N
$5Fj
%mp,
\[vyq
TADS
{>W;
~2f*
Wui:
p$V%-
T=9y1Mn
MRoO
![Zst
2piu
i]RD}W
' *TE/
i}Kj
\eE
x9RO
e $Fl
sbk!
qX2P
YJvk
HErY
he\;
b}.
O)od
R!i4
?{)N
J*GU
29wk
vI,A
Rj7
,F ~T
*gY4
8 T6
7( r
ZKy6
Y$=E
?anI
iGU2
@M$[
m`2H
Ip{0
I%} I#
gwR&
_CorExeMain
953^
Vjq1w>
G>5D
/LA B
e?L-d
q|x|
7}^*
NWr_B28Z
GT,8
R22
!0{<
(i4lY
B O5
System.IO
==GC>4
>i!M
N}w&5k
^k;x%,
(.DP
J(,i
9#z y
:f6f)U&
z^"q
8.0s
\h25r
0L|/
r|`0
bU .
qAaE
yP?5
B9SS
.text
K=v+=
<E |
J;C#
@7W
;WKJ
2qG~q7
}{6
RR[jY
S!=7
pRT_
d@Zp
gQ'L>
=KgAcW
KoS^
#AS7
5kuJ
r+cN
aTB.,
z#*Y
owK4
,Gk
y#B4
r4v5
grX!
%r?w
Gr941
-Hx>
2'4hT
Wf.
5kBR
xm,'
Wm3j
xc0g
?-Po{
4$?O
dp'I)[
D3Bn
C^AS
9;ObE
]cGQ81R
O_A
#(WX
QA5
z <#Cj"
>{i_
N{m
U`[~
y J`!
i{ko
Fg[/
#7/w
)/2C
K}"&
yA 2
h'`@
~a2S
FQjZ
Vp ,
#3H^R?l
>oX;Am
`:A>OA ;J
qYm_
@{Hl
c x"en%~
KHaMI
UG?G
)! ~r
Hxfw`
N <#
\mp>L
z)1
3 _.
Pi#n
?}4&?
qGAX^
Pr}-
'OXE|q
z.
So3ON
Fgv!
Kxe
K^}t
rn%b
sG'Fr
&Yk#t
@f3F/A
jmii
wR{7
UM!
z18F
u$
@RC
]:'P
B|GI
o fe
eNZ H
L`_|
X^{m
@e| !
q"-:
E fz
RgPL
R?*YCK/q
RuntimeTypeHandle
sIY
!S:SujO4x!
rBZf
by&d
@4L2Q
4`3G
V>0e
-r,GG
!DGu6
^)[\{!f
RgTm
d~^e%
ERko
Bp+E,
,`>P
V]jA
dWTziX,
/"-v"@
JL"M-
=,7Q
`.rsrc
9 i'
Pq!R
E+v-K
rj
80KU)
Ul&&`
4Ga+
T{1T
ul@2
w:V[
"?doq|
cI\0
E!5aP
Cw{E
w~~"
zV h
Y~UU\lA
NifD
Vk4D
kernel32.dll
%96L
$Av5"
g1 mT
E%kiP
1XF)
xgv
ztaS
DKdI
}g7?8u
Fo/.
gyEz-
r#/p
82aoE
ai*0
f:3 r
-ud~
|Li*
Xk?E?
)/S%:
SJbF
oycpV
gEH:
.3Db
.bhK
T(FmL
TUzg
U\ds_-
Ebzp
OEKk
'S{N[
^ !%
02 L
)gg`~
Go_7*E
z>V1/
`Pyk
t6/
Sw9e
HR9c^
v:F8)
p)jZ
{53'
EbX
nl.exe
ELDX
l22"
F@L3
fE`9
Yw')k<)
BPC-
bZjy
i0~5
i',*n
3qP
:7Jr
kMZl!X
3Iur
Y1JBp
Go.^"
gZF3
& (.
|Ro _
["o5B
fz:o
iO ?a
&"J"
h4BP G
#8;L
vQ$LwF
@*3\b
Qw,=
~vs[
V$AA
-?Mq
D`9v
W@3P
\!fM
zU *V0
=)L07
pY!3}^
gn k
/$%6
z=b=y7K
]L7Y
[vsf
'F-+
"Eg_
!Zb@
E xmj
(Afv|
KFl1
5ZpF
g2Y
l.l\,j~
+SQS\N
]! 9
_Kh=
;a]K
SB9K#1s
F:Tw
T&p|[
%-n^S(
@@0tx
p <P
DeJyl
o6Ts
YzDX
,U '
tjzW
Co0^
EY"^
d1X4~F
v {/X
0fyw
:v&j
3/J@
kt[ =;ID
87qw;
Ydmv
=8T@
&h|b
gKc;
VT.nN
W1j;
wxVo}
'}BJ
}C`
yCp^
rsnDs@R
l:
ilyz
Tx]<
3Bz
l2Ul
K=:`*t
Write
w,pV
R{ T
+38O\
QCkl
.oN?
U#LV
Ss<8
a<] E
.;HSX
J\iQ4
0:r@Y?
d6A"#}3
o-ec
[{JGMHx
?Xre/A
hKO)
Wf\I
N\z{9
q!{;
P*Ff
>:v]
`I}*
8`_o
y<-V
hFDt
7,'{
)/!W
| WY
<z}J
UZVw
1C]L
+q-'
x!>}
gUF.
Cqm"[
c])|c
kg%BL
,#I,+q
Q< i?
{8wv"+A
CCrd
Invoke
k4GJ
>Q!N:|
iSX)9
t + >8
L I|
Ju@8y1
zLx,
S!c5i-
N <j
2 2@
a@=O
mE?y
i>kJ+ZO
T3U]&
If`'
w ;W
Q_eq
8):(
9Hgf
~g>Cj
H]9w
z /
}8Ov
Z|<@j
4hW}
b !G
GRBa
y9@D
!HSQ
^W%&
?Kt
/D ''
S7 %
$Ez{
X8M4
sPic
PRf6
|!q]
y \
"SC
3=2d
Z 'c~
DH <
iyZFN
)k*5
fy8
X3\34:
t}5M
KQM%
%Movx|
w,T
~Rjx
f4Gp
>G5T>
J]c5
P (
KgosT
&pq|-
Bkd}-
xoj>
EiOi<M
<]/"
M[]0
ET=
I}Ry
8.Qtl
-R{W
@-L.
QU1&
+j'a
6<<S
>O[ l
;k"'
cuD]
*M9"l
\v!:
l*Kn3
`\j
m,34V
S>mW
O,uL
ZX &A
'0qYy
<|ZgT`
YBh
\Y%-A
4=Hbj
]yu
cj1A
%Q
System
?b|
H2jj
D#kY
t q-J
L}xJ#_
X&= Fe
giB]
H=:'
iGG
"FQ3(1y
q` #
~);
Uf6gf
=[M
/w9*
$3!^
A]O&
[-39
tY$UK
$q}Vq-Qf
%V ^
qh#
e~kp
Q/{t
Imd(
,\MK
E0Z{f$F
X Ka
-2S/H8
vq->
*sj/
9p,f p
Kl]Fq?YL|
cE%:_
y*zb
lEII
3 Yf-
2mgQ
7L41
Dm+Ke
q^zP
_U4h1
MethodBase
#Strings
,Hz6#
WZ%
v'V'
p8Mw
UP7E
\1Vy
i[ 4}?
{B)[a.{r
mGx7
1jj=
2^()
-W5K
9e?{
i$KzS*=
{tL
Y4M7v
`[=)e
L-^m(
"c_.S
;~86
oOkM
)Y|W
@G&
"=8l
E 5I
a~z"<
s<?7
VirtualProtect
dIi+\y
M t@
l*o6
w'4
;>.sJ
L1/grB
@LP c
ilkii
X*cZ -
xSm]v
_/ t c
i-etA
klkl
9gMQ
v[T)
k+Oo1x
\?5k
4`X4
/T,Al
& 5;
+"J
~[_K
cx4,R
m
As23D
.;Y Dx4
hP@,
Vw5_e
t=|_
E,;b
hiN?
Nu2~ !W
Ow$5
o H]
#Zo5
`19Z]
>+l"-
`1X<
^m+C&
g}.^
2@g~NW=
b[@z
]YvM
%^.}j
gOSg*
&oQ6
;a^/
] Nl
/*e\
GetType
tO9PhM]
dJ\u
GBf
c8%Mh:
aH/:
&b Q
^9 5@Z
BM )
C6N DI
8FOjc
l/K!
^wT2
O~fY
"3)-/
$ N9
GBs"
:dMx
] vg
!#@C
{ E.
?J8?
c1S^
4WOI
pP!6
{B5b%
_*fr'
|8qo
Module
get_Major
EJx6
gO-U
7vA
kikj
V X J
Rdntl
Z_0aa
rXAd
7]cg'
#6{aK]D
L3 {
Ou*F
/kRva
jHG"J
w+PV|S
%0G
Stpj
Nq,^
9t-:
Ml U
Ii0;
MN.%
TYW(}
8g"S
a7V6?b9
l"X@
|R@,
k`;L
iSYbM
UA P
4klV
Nd+
Xr d
!Ja]5,
";WT
b+v$
o*.A
/Nyo
4s98
cT[G(
,+L(&U}
[fVC|
(dv<
.$}r=X
#RCO
4QTO
}g]6s
c+O8
Uw"`8)}
!M8[_F
T<-Z(<(
$.1si
0R`24
7@ v{
)kBD
b$lM
R*vZ
cn\&
iZ5gB{
0kZCl%-
h/)e
e5 2
X8pK(=
&:<jU
CMI Z^q
1t8g
1juV
(ddf0
SnJg
M<FQ
)bB\
0;?k
bm;
Hu7
GDsaiB
02']
tfVr
Z?t.
pocRbL
8hn+
eMGvmPS
'[ca,
:a7=r-
xLtK
u{m(
]F'J
0??f
%] &H
wrM*
q\s'
:5=/
#L51
*UY^&
<Xnp
)0p%8
F^q7]
>pys
u P6w
Y}!M/}
ro7U
apt%
cZ/^P
SHS
}'cvc
u\XoN
<@ 9
&~A<r
9-i:
IfZ:"
&[ TYJ
>cCO
*rG';
/2!#_(Cu
(_j
#t
GXa
X'2d
}#jYEd
DY#8d
~0ra
C+Rz
Y^ IA
2| ?
c`Y
Ud 6
-i XVC
7M_U
xHK-.
xoC^$
. #$
mljl
%h<G
? 47
+`+c
7{>l/
oNjl
usoS
r|Rm.?
ZyU]

yG*
x +G
+R69
-m{(h
;$ +~s
L,}3
Y :&
g q(tM
]l-?
2\HX
]SN]
}V+}
0Y?J
r=kBj
qCe_
7s@$
*dNMc
51q!
s&y8
S:~P
hwtJt
juwTt
`CY
+:m)
U|N L
) ZH
jg;i
O=og
v)wF
;?r
^)~r
Yi2<
RABQQ
pjxO
&QR9W
rqfC^a
epa<
Dp'3
*@S.
AkK 3=<
e-|v^
sG.N
u!AC|.rJC
kvN_
=0}\
!;O2
e$'s
$*L8
k(Ak
>I\2<[
qH6P
yc'I
>J=r
WI T
GuidAttribute
2uc2u
AX2q;
-{\!
7Y[v
]bpI
:= S
t `
(j E
HM[
5lqz
FAk5
%rAS
x=KQ
5no:
lP@{
6ic9S**
eDRP
Zawz
P"Y;
=l ^
IVK N
vNFym
`w3>Fz5
rqCq
PI!B
=KkB
^6NF
InitializeArray
Ov!o>/
mP
r V Gl
4+!n
UdB|g<
gR1!
v]I2
4`Yh
0v${B
M3N|>k
2S7r$
i{PG
e= 5
,+y,
vgeO
XAekQV
cwy<]T
dX&LX
8cz UcU
;8^-<3N
>^D
D+U$
<, 7U
b*D
b9}Hr
5:7C
= O%
g/|j
PJM>
>Q5(N
b mO
97Z5
Byte
FbFX
o8 dh
46#3
dmo|=
]i v
9\fqI
86c
get_FullName
I0q|
U9=NeFYx
0ga&
5n: v<M: "
kj-r
{rQx
%t<u
iXDa
ztn2
]b0,i;b_[l
+f0I
B[F4
DJZFC
7rCS
| 8X
]6c
*-2 <
+N#x9
`dc
6W T
]1P-
l9 R%
At]x
\!db
IEvidenceFactory
s6W@4
V;_@
41jY
Ub|[
L7Xh
sKn<
pg m
<c11)V6
L_GW
T~|AU
xS2$
MHJCHWv
2?37
s:sm@
e^":
]0@u
9!$w
?*.wW
5Gt~^|A
=*sm6*
P.VW
^ga>
z! {
\g
K3-*
?VsS
"E,
s|Nl
`^yJ
lIuw
7pd t%
|n=P
]_y)
"j $}{8>
i{'c
j-=g
N{w W
Cz$k~\9Z
X)*d
.>>-
r;"&q%
Kj4
HB?I
o2ll95
oEVN
FCtT'
'_}o
MpB4
kikl
32P]
FV8?
j' <
2umx
a\t.
mM[~$
IhKI
Xz`P
rmaN
d~h3>r
:Qj=
#5]u
2. c
n'=)
E sa
p!I
) "=
PF(iw
OA?0K
"vY0+5
b]R5
9CjwW
&(4>
n@ _p
$vFOW
_XPw
]`1b
3<`u
SuppressIldasmAttribute
#R?aLx
<Rpf
F-C
n:MO
j!"d%
X7-/F?!
j@ 7
J`Q1
[LSW
K~']
GGhpC
9M5+
X J)
UInt32
8$7B
,KRY
Ht$G!x
J/`tBJ
yb Tg
ikkk
_g;=
e#`O
;c{k
\8
get_Version
n0"K
,sK
D#Mcb
*7"b
_"1p
;yp x/~J
ToString
6x.,6
x^EI7
<
3TmE
LIISN
)\PJ
[ -#
yPE=
1Gi\
C*j|Z:1*
57yn
*jfa
A\n3
Nh-.v
[a=6
L%/w
4Je
8 60
YGbbi
B !j@
`'~E
=Z6{
Xk@x
gXPUdo
oe!a
7cn *
&`{L
PnJ5
1u 35
RuR
l[how
3p0F
*#$[
eig(F
bL(n
5Mh5\
@8l#
sh)7
U>K,
aK\Y
EKNcX
Dy^Y~
SB6h
5p;w@
-v/A
4;<
?,}Q
E-^n
#Schema
q%#1
R?X=
gX
hZX
,mah
/ pli7+
];?e
p@P@
, gk
^6M<
h/0
hs3K
K2Q)+fU
UyAY
'}>y
1 `d
k=6b
+>sjd
90"
Wih%
^S7}no
."(%
#qAw
ky%J
DTm
ds'*%
-<_#
Z)d
r-[r,F,
/6.J
:Keb
N)zI
%0:I
pR^Y
%hdqb%E6{{
3@YIz
qxSq
MemberInfo
jXj
-Gaa
5Cs9
imii
e%8*4h_
+*g
sw|"
)/9s
HV"

c6qr
35<+`S
<z6I
{OXQ
6 a
M\Od
sizf
BcgC
l^Xf
%?92_
Q `0
4 fT
g6y>f
j:}=
Za+]
1Uc&
b>>U
@l:
.-H=.
6z#s
`nrx
get_CurrentDomain
Sso]
?%1Q
kO\Ikx
GMB;.:
^F8C
m=Na
ZK77P
vbM%J
A^X"
JjO=Yu
:(o}
./2C
0.,f8
+,#;
}lWB
C<j
Ip=
!d`?8
.<D4
U<r*
[ O-
.v,:q
%3 `[
7/J^
ValueType
.|)vQ
bo=4?
d9Na?W
/:XX
}FVw#hq
Zas*
.ctor
JIeBT#
sG ?
jO)C*7
W^?y
*z;kV
qqd}2rz
xl)A
- o\|
)BlY.Y
t|~Z
>w1l
'58
?G:4
Nvh>
%wz
aS X
wrq
7i:T;
vuSU(6ZF
)p)
H>P5
EUWmn
[L7~
c-dg
Q J:
JQ^C
}VN\
+Y{|
klim
|"~xvT
:i{gd
R||!
1'V2
zgG
0)dB
>xO)}
)@UK_
L)hvf
IvFP
%gpJ
T O?x
W [|
B{\|
4r,
$|7r
w-5/w
LQ\~_
!j ]8
=25
H`";
(%F'1
"k!.;
R Sd
c+(3FL
{$O22
V 8M
z4,6
qTI/
yiU*
fw1k{U
3<Rth
rbPi<*y
ZZGK
nT!R2
lgy+
}=_g
T]M-
ff_}_
C%h'
;9/
je _SRr
&".4b
v?>a
Iw ~+0
M]lr
{! F
M.
9=mq
Array
AW&b/x
U@.LPYg
%@M:
x3Q{
1y8{>
~O \U1
c WX'
k9_0,
mZC>
Y`=U!
]-' =
| ,FI
4z?n
@.reloc
c[b? `
/D=&
nY;5
z? k
Q Y=
Hwh3
jV"S
V:4K
&$c=
\M\)
+'>428\|B
<@2l
P`>
Kgn,
Z8fm
zNN?
0.Y@
AW!$r7
A=[i
[ZM4
p&D
C!$u
b(J?
TDXm
/ 5K
get_Chars
. qU
.<:{b
.,i
A/;9
xwLu
.C4bC
WrapNonExceptionThrows
5Uj8
< k
@U*w<
-ZTE
/{r=
W@0s
,wo-
|B/C, ^x
/w)\
TqzB
AF8xG
D}3r
5aQR
ahMZ
c2c}j
i=QB
5% Hr6
{O>J))
BS[7
o`s8
R4u<
OQXu6MC
EK3%.
Lo]
A?KLbe
ASzT?g~4
h8Oy:8
RU`q
!k^y
pVsz
\}1(
>X?|
gwN0:JF?2I ;vD
#=fTG|hhC@21
mHNY*
N hjV^0v
5+=:[
jJsA
2eyH
,R9rA
? 3<;
+~C1
dc)[X
vL@ux
l>Nw
/*>3
>^;^N
b)9c
EIl"
>C[I
bq nL
*8^?
]XT|
~2Lao%eQm
vwgn
H/ o
-zXI/
Assembly
f`=9
In[f
D0Hb|
yutH3
-n?'u
>($+'
R5{L
H"[l
|N{8i
cEtn
cRL`=
p:h*?M0
294dh
C .&?
KK;
[MW;u
Z W
u5O2c'
tB1O
1jEE
>,O.
*xK2a
]#8x
({}`
%{K|vt
Zfr
p@ oA
M.(R
tx'y
Y'Y;\
aDg,
Y^7%
T*vh
_>q
4j(|
N^l/_
HH/p
Gs/b
0`DI
{P6H
ip2`;
On\M
wmd M8L$
`W Q#
$'Z8#
^(r
D3/1
M'#>K
x\;/L
U`s9T
o5 '
TvV)JF
I;30
DV5:
'u<`
WU|,L
`~0h
>00%
\'O[
mA}_
W qA
crTvl
5KJb
s$J!Oz
JLUv
+E_!
4}&@J)
|]&
f!EWM
^BrP>.
x?|1
-fw^
tLw%$
]q=[O
vO4L#x
`kBF
3-._pj
;m0K^
G&Pp
/g^W
^wl1
>Kyce
WC|v
EeBI
+ V3
m:K
>'Lk
TV8i
d~c"SI
[[h!
^[}7
aufZj
k4\2hT
v"9L
kHXae
M`
wa0*
|P|o
S_ 0
G!O,oU
Pbz4
3= B
<m #
+WC/
G_yX
R`doG
p N
HsF!5
B4mg
njj'
"h"[?
e6uD
~`FJry
X/|Rk
)q1q
lpT%
Orqz
mc!fs-; N(
fH`LH
} D<
mTCnPlgMVGAySDStYGlPBAdcqefmA
0M$5&j
h.A|V
k1~C
?hyFi
staJ~
GpHGG
/x(zN
o8!{8.
z HT
<7'U
RJJQM3
CqLN}
y8@*
Y} \
3 i8
PXk/%
x >wYw7
Su&fKb
y|XV
7.<4
z1c\}l
x*J.5
upwK1s
d>dc
K7'j{
q}jV
I/fY
3ur3[
F+
B[ zp 2x
47`U
p&gT
QFl\ol
w c@
}<t:
H{B_l&
j%#e_
mN=2
@d?6 g
|Z7c
$w#HV
j8LU
dYC_
<%[-
zY~A
iS 9"
"+LS
GST2
w<mOn4
P&B3~
Og=/3
kuMQ
pU%R
J[`'G
pn y
#P^u
\K\
rf\H
[dq|
zA~.
u_XN
-BfG
4.SP8
Zl^FJ/
_3W$_Z`^
gA
#*S
=>V<
$Z=
{H &q
jD{#
sb\
hmn:
j9^H
/^Bd
@;k.w
7}2,Z
ay}H
*Wt*F
v*FuxN
WYon
-TSf
{>PaY
P~<% k
l9gT
/ $G
b sE
B&
0]ygF2
7 J
Tiy?
}aB
_!c-
1~s]+
V W1
;$QKGW
kt$E
)w$B\=o
7K :(
cITq7
G@kZN
Q-?P
|3Jg
Gy9$C
wi u.
_@Mj
N83I
)se7
Q4b+*
R3Z}
/"dBoM
4[1
`Itp[
7-Q,j
zr,6T
=j1Ls
h/jD
bz1d
pc%
p8V<6
!4j[
|cM
zy.\G
-?L>
@ip[*p:}
H3}*F
XNU?g`Mv
t8+}
,k1l
; rU
I+cy@
15a!~
kIb{X
f %"
{8 {8
RuntimeCompatibilityAttribute
^ M
cui3W
By0F&Fp
n~3'
d QX
4- }
_B2=
oY^\
ke.C
FjQX
WiGu
:^sW
@;rv
{`m9P
ZC)P
G@Vj
0 P
plUc
3K=o
r(,
mJFeU
A4=2%
p@~tO
RFs
E)oX
MH.pZ
ab3A
7MrR
1Jo6
Xu>|
w("J.
v TG{4
(Nnowc
6'V'
%{jv
q-lZ!
xvh5<T
gI4+
e>6{
\45
ReadByte
ju.Z
p&?g
0M#wr
}+*G
_'ko^
>2v5
.9Z
HBo6</
7s8!
4b{w^
>G+ey}**
)$l[
M#){4
XXoI
+KN#|
$mJb
]3'\'
K}N]
etq|
Ps$$u
XaagD
t"89f
O&OzD
x U3
8u .
Q,:h6
|PA&
52,]7
)g3;H
4h3v\ A
ri^rjo2
"fp$
Bx(bQ
65D? i
]TbH
X4]
@xH1bXE-
W %Q
>l<D
c&F~
yKR.
`mKT1)G
nvd
,"fT _
f q
"]!>m
% Us
18C72B62DF4D9D39E9FDE7EC6423BB46A8AD3EB9
l)uT
Z[Ia
GM>.
2#A.|s
Hh3&
y\*H7B
7GNq
pZn=
1(.TkF
^LLz
S$n9
;ge&
ltsv
gL4"$
cg4l8
k5Tmx
q08S
/HM'
D=Jf
*]_L
zEFz
#K7X
y4r9
]3'R
_kZ_
(wOV
Cg$y
@.nP
FEXj
!(1>U
_fNB
&/ "
eJrC
^6m@
^9?{5uK
rHE+c
)Cnw
j8i}
- wL
}{` [
^Fuj
op_Equality
uw;@=
`{eM
8OA6
dtsm
IltS
S4=p$
' f3
65HnG
o a
~UPw
$3hDr
e=|=K
Pr-.
1 !BC
Q'v|
NjhH
y t*!
Jx^N(
:LX@
dvoI
tEG1@
-ytPU
K@ C
WF%Z|v
(YH
<Ey1
uBDp
FG/l
mfG2b|
oez^
MethodInfo
,TY*
^P B
{_k;
AvYHZz{tV&
Htrx
a)&s
lMfQ
y-[9
wysWD
"\lj
?M@_
vr(
CqNF
++HR
?LH%,
tVo~:
_Pdt
yk0
&Gc/
_f@j
|h/BVi
]( a
Y)$2U
V?M]V\
UH^x
xn;E(K=
Z]25
9^|H
%cm^6
0C-n_j
=^aE
*.fY
cuy9
{)#9.yY
%Dk[
$ Z
v'R5
!!7Ys
jI;D
M j!
p,g
;R>Lo
+ 0fs
@/":
+Q$L
qE_B
VM^ I
.D*?
SY$ye
eR5B
g8nt
^k6 .
Fs$Y
IEquatable`1
r.PzES
T79)
rB;
QLGx
CCHdd
;QFb
Ak+JK
*R;a
2Pa@hv
1 "s
4:A'tb
P:gTd
PBha
Nx 'cak
crO>N2bp
@q:$
.cctor
0r^J
D+>ab
>
X_pp
DEyN
Wh!xv
t'wx
Viuvn
~}W1
"Y-@
I!uc
<%$H
b^q6
B!:0ek
Ds
cPVL
{[*9
N1 5
;/T&
_GsY
ec@CECX
pea'B
hK <T
M ds
Hu|/
c9vM
d ;+7
}7Tvpv
8=/*
|(;)
DXw5
34Og
?zkY
lqQF
&L1i,
s!nP
:tHHYs
"|OO61:
c*WFb
jmNU
5X,fW
=Ce/
o_xG
{;>lY
hfIG
D6
$m<F
gc8.E
8$$&4
tm <
SZ;v
.%dWD
1n~Y ae&wd
D-D6
S3rI
lK #
V)vm
0lCR
5\C6.
vs1R
2a+^T
j?T!z
/p-`n
g; d
.{)<
3Hn.y
mmlj
,?#
GQ\.
ej\z
)rX(
2XR2
f04?!
VYMt
R8e:n
HVGc
un,
|c/\
T 9]
>~;!
@932G
G^fc
& ]k
m!Xg
g`3R
hHC!9
TiZ
${qD
Zl\]
&dwb
CiNu
&EB
pOlZ#
vpmk
Bhk8k
JMt#
9 Zdq
3XeW
IkC1
2ND,
Xecb
P|[u
2Cx\
(HB7
hNK
fBg9
)Iuw
<<J)
CJ g7y
P^-o
2"Q|
W5 5
Pe"<e
B*"T
6Wx7afC 1Sji
\ R(
sH[mR
0~3>o\
i K{
+hN,3
!`y>$=
JGn{
a Sv
Qk3;%A
( L5
5}$?
<j 8
T{v,
1w`"
TW<0
btEI4
*^-IG
;mBM
{m9L
?u5W
Jx k
4zV>
)l D9=
g8_t
2 @K:
+b?=
^L_O
|*b6
m\R}
'qc!
]bW^p
}%~v
|HPI9(
c{X%5
#C62
FyR(k
|WRe
GUhId
vqW;
i?E:P
6Osh!
X j@oTg
,tw1r+
Xvdthk:#
Z(BnA
fip-l
+OoO
I9?y
kd-
L^S{
rOPY
!ie>
LwOvn
c0o%
W^:
^L\ki=5
$F_v
FPPT
S"das*5F1W
M"cT
&M59
' @!
m;A!
liik
yc+
fO'U
rBj'p8
p3]|
`3@
GG:;
9L4dX
Yp V
!L<L]
Z157
@Ux=
)wr+
$6"o
{0D"
u Cl
pc`mo
D6A; B
NuQwC
6P Ja
A^y
Z}U
1xnX
;[}Y2
uJEAD
Yo0.
3;?>IT
*tAH
w*x+m
j4Jm
&1 [
/o.K
F.f*
Q]-k
WO_h
6DkR
&vEfw
Jd~U
Oh|,y
D .j
+1Gl[
rg1,
Ct?k[ ~
% <\
FG i
_4pI
C=yF
V//+S
k0Zoj
i={U
.7^v
EcQC
ot<\
%oXv
lW Ce)
Ux.;f
2X /
6C61A2AAB9DEDA384120B3D6595C214F06494695
.i_G n
irKq
u -'?
#H&*
)B+M
;nDi0N
(f^E
<D0k
2=Vcf
>yi1AC
s$VFR
7VW`
qg\;
j4|y
9QydUT=&Z4
+!|N
*y>U
(^A9
D`g
lNXqD
yGaB
{ D0GX
mscoree.dll
!This program cannot be run in DOS mode. $
N .C
r7S}
th ,=d
z%O>
]wK4
K+eI
7usA
pWw6
m)no
0 <|
}!ls
% 1
*wc,
LPyj
( b1
8kT'Q
smOx
,5 X
AyKQop
K<j?
X/J6
!]WS
o}[t
=\Ob
]Vf>
qJ*q
T7E0
Q<Rc
sUL`
;/Gs
R :Y
sQ4!
Q=@
9\'j
lXtO:
0OB3
s3KF%
2~@A
s]~S<q
ErlP
&'9%
xt?0
7M(C
k(,]5
M?Vg
+X^7'
+@eJ
p6@o
a31Ei
s;iD~
gVhg
{Kz8M
_0y8
<^Zo
/N3)X
j}72
yi<`A r
"]rD)
OK9)
!P:c
T_?
67y
?~#,g
get_Name
XPZ.Z
&E v
]]eo
v w?!{S%
`=4(;T
Y(V'
aC1eX
.H#
Y{.MA
GE F3O
<a0x
.VUo
v ;
s|/*
a[@L
?'N0
' Am
r|+L
*?q(
TI=
Qv_[KBO{5A
a!tq
W 1e
:l c
/]=f
St Y
=&J$
]K$Z
xNQ"
;KJk
sPV6
2~R,
!gYl
BSJB
pj?BL
R~?^
t Ja!E
ZXep_s
%v$;
bb|0C
RNSm6
wSqW
X:GVc
<s*:
3d3g
`o`pTO G
##4I
_k&O8
<nK ft
wwjh
-,1.
2/~@
pA_B
b(uJC
B-G
XoJ0
I i?x
P:2
O1>t
Q(R|U
E!W]c
tLo
o 6D
_[n'
7?<]}
.[!6
j7}SRbO
8]!W^
`]vN<2p
`5!A
IntPtr
D?fZ
>'$9
Uu6Y
<[>X
}tX\
~D&<
aH"{^
5PJ_
Asp
Mq:\
E*95
nvZ:
\hHd
k>\fu
lS5j
0 Xh
(]5J
EiR&
Hsgs
2(.?
7^&
X@~~-
Y`[M< j
^B \
4G)y
S?I@`
%1pm
G6Sc
25{M66
l {9
Z+\-
0 +W
y6'7
s*K5Yz
U.c2
} X-\X(
{\P07
I!nj
m%1n
}|Sa
LJ "
# A
+l>&
HthzA4
QI#H1
Gly-
U;IaCb
o4~:
f0&H>
LSg(@]
'y :
e[*z,
sMG>
XLqVU(
,C",
Zj>|
KNu#
!&
m ,
9zTc
2R$^b
HxaGo9
:ftZ
qzVL
=@_v
InJf
6Vn^btW
kw&
1?("
[=j5
x 0n$
m/=a
O{/(
'}vb
IxeM
AI(
cMex\
hjD`
oD0 ./)
SLGnA
|:~O
m &.
q$;drN
ui5>
(*W'
BlockCopy
WKP*J
(j"H]
2HYs
ZjuI
Y8c k&
J+kP
1!h7
5Nd*
c >>
get_FullyQualifiedName
|pDR
vosU
">ao
gPiOQ
y3"/
a:"i
}_pE
9tsV
XFMu
b,3Y
d A =@
!dt{
-{,v/d
;%w{
s36C
g?]m
/v z
T%91Zo
_Cn}uSQ
}daNML
E~iv
7#,uB
irD2
dxi[E
[w\ze
*( _!
ku77
e}{%)8
hn>Fg
rAcX
aY)v
;*6K
y/Sg
T T7
]`CtW
HHhz
O4^K^^;WJ
^9BO&
@ 6
HHGl
KCJ/
9))D
08T!
^D) m
B\5`
l U
>o&U
UPC3
]7|O
lQfUO
&~Oq7
+t2`
&Cn/k
9`J/
MaL
\3n8
;ez"$
Juoyc
v}/n
,be>
u@v9
Vj[a
!_it<l
R6'p
, [WJ
s)Bt
?{D*wb
.eaJ
c)sX
E$`+
1!o~c\
Z4H9
jOh5 7_|
Do`n
J @$
u{VD
VFh;K4
x#N-;N
XZ0K
1.0.0.0
_C55m
b>2
1PC"A?
Q_OM
get_EntryPoint
p r'c1
NHpA
ccRL
CompilationRelaxationsAttribute
J|F
[ ~abr
K5e`)@1Wo
d/`
+c IXeE
~e?k
8&r4
t$$3~
NT>4
bO3c
;6%FD
q2:J
)QY6
"Jx8
e-LV
OFT *
rM
9Bz,F6
-Hc|
AMVuU
}l[N
OiC?
h>o&/
25`D
5]C;F
> J\
#U'\
"#>1
SpFHp
,m8d
o_5vZ@H
8|
_ISg
`F^}
OBL<]<`
0Lab
XxXi
xpl1*
C"2d
dWB,yzd
;pe{
=tej
n,B*
#uYh=
W60?
AX?L
:$VJ
j|}}
%++
@=#0+X97
7pX?
Q\O#e
(ui>
(8r%N
UHDt
3OEUN{
x\4O4/
wwvF:!
|p #
`4b
)F s
xb",
-v>{-?
7'2h
| ` lM
Ot1^
u f]
]!~cTlqICbcO
~pvQ
*o"rG
ss:Z%p
""!G
o1$Rf
zO(#
}|6`"
@;q~[
'IPY
a%qf
d*H<+=
Zl0*
'^nG
R4%
)+ uUX
AdIc
o kP
mk|B 3'D
zgl8
#]'z
td,T
C|}A-
1`@Q
Q$eF
i$SK
gLZzV
(,;zQC+
dW TA
Sz_h)n
Y[ E
'}WhxR
5!` #
pRa&D
8t|D
aO<R
bUQe
pX|,
-0cS
tnKU
{"dyc
[Mv5
.Z -_
\=4y
t `1
000`
?T0@3
O~HO
tiG"&
_Z7*>
- #~w
o"uTU
~"pj
1eGC
WYE
CLqeYf
X8I,]
I:F)y
-AlO
M Ni
4gvz=
mvUj
gFv>
9^2uY
74U"
JM y
%8u
51l7
XI %
Y%!+_Ey9kd
JhcO
StringBuilder
vi`
v!@T
foJ]
J"$GTfv
qsms
Append
fJX^:
Rm] L[
]}p>
mpi,Vn)
OOW,
\>G5
gt@e`O
Ec O
lzbk
A+]C
Wl?8p
@:qr
B[_3
B%^=FkU:
=bAO
' <d
O0j+o
uia:
4z-`
\G;x
~dV[
2X\IsE
{N~/
gJX,
1{/I
0Hb(+
C.BO0
5zM`
,IDU
f=i\b
\G0*"N
u4.t
?t%;
MUEC
)7r
N-|Z
7UW6
9m!-E
i;|,g
a __
RuntimeHelpers
>[P2
w]h4
M\i=
]xM]`
dj/@
EX&s
7dI&N}
/$2%
8|~5g
"1e5
30PK#1
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
AssemblyFileVersionAttribute
x5"H6D"T
DI[~
System.Text
q]}9]
N/n
^N&]u3
G_5o=w
HL5
g7[j
_TKS4
GrZ%d
V!xl
M#3&
>Q%k0
E6U~(
N~`:
-b
9)W&
^&~Ts
' 5Ie]
e(!t
-{vX
lkijj
Gird
+.@W
D{Ee?
kU'"
!4M$
W'F 02_j\
n[&G
aIEMux
blF2
Z6w0I
JQ9z
`@KS
2w[
FL,l
mlimm
`C|eF
CCGX
_I
jTLWh
B IT
^4 U
N%P7
>Y+XM"0
UtkG
& &}
uY%>
X%e w
^\lZRt
4 SQ
dmQU
rtNT
J}@#
l7MJ
_~OUy
G)1 yM@
q&%P
b$_ =
~Nhd
k[kp~
]\hL>
[=~J
b@+
1Wp8
/}fd2-
%Ej4
;W3J
Fs8!
ER/Mz
_37a
&!I
-BE}9
0=\C
HZ9!
e<pF
z}m7
.a%5
9,Oj
?;4R
5 $;mh<
cK<`
j7%l
b<t
?1"'
uc J
i=q*;
}Mm4
1*k:.
jjkj
\R8Oh
1c/y
RFilP
PhA]
Wg%M,
v"a;r/
\Vt~
N; w
C9#
_Z.9
1P>c
~W9QJ
50 ^
]M74Vo>d
}fMo
)hsI
N;Ep
mJ9F
0y1C
SMZ
[@^\
6y$H`
2Gq.1w!
5P:r{
_`\o+
String
#P~+
K$ti
WbrO
^XK$
d2zH
nd0p
"6!
^2lC
R#ow
cP7'
K.qh
-Z@^
')/
NLq8
cU26
p:V~
"w1/=
>[Bb
]O+{}
B+NP
<S&m
df ,
tD 5
$?wW
#1;E
{\JMb
B u-
He ?Q
Qv5v
eDK/
TI]:o
4hXh
,4@~Yd
dm..LskW
0tnA4C
#- -
rMH(
L!PBd
W x#6
>1is
#7rcGt
8s:-
=
%[:EVW
x*7xs
c (
~)i
H=3j
O#Ay
yd])
/<0,
5@:
=eKo
nN%*q
u k;
)Qrj
>tT3
ci: D
?%8 {&i&
)X1?
Z+<%7
U yr
%hAW
\Z3S
CFU6
Environment
_4Z0}^
d+"b
|]a(
|X[}
a#Oo
Y0 7QP5
axA\
p:d#
e! \
CmIE
Y+ u@
o/sK
/~
(eI,
6vMI]"^$
^ M:V
^=J0
>DR+Mb
X9q
`T exz
_.KI
iTwMR
9b0E
bs_D
B6>`?
|6^P
zTK:"V
;^#f
u"-@
+-FI
B9&)
{ iC
5[qiN
Tvwu
+W? {K
IG/=5
JQ6:
aL `0K#w
/rQX
NPvV
Lk
^ic4
T4o>
Load
4&aH
p0LND
9]^[.
get_Module
gkKv
, `
7btXi
6kwg@
u*B~
Fyr2
1\ x(
R l$
0 n*|P
Db?(
kjmi
]De&
<YZ$
EDsLS
AL`O
2BDoE
b\HNM
"M]:
yH6'
{Q#
Qx/`6:
o.5W;V
F)as
-;z&
JiQ
J{C~
k.~0
0~W~
U@|]
z nP
@g94
X-7B_
t4R&V
s`pH
&p+]
sa`0b
D)."]s|
WZYi
B[^<
n~1(
I{\X
FU{&
]iL*p
G]Z/
7h|bAg'$
"1p
G=$4P
L6
R)uD
dGUE
vic<
q;#j
x rTK
ZMZ)w
pm4
;sA \
^>xq
U$2[nz;
c3?29RX
D JG
"YJ,
Pvf
62]Q
_O-
+F}TJ
^ g5
Pi6 /ul
}GAZ
>0~D
&mfK;
!QM9lY
Gy+l1&
[^$hv
ORb5[
4@]'`
=tgg
02-O
6JJ<
as0p
f6sN
kuu
3BYlb
G3#K
L'lk
W6L:
*)\hn
cq'#
:-+t
(L,WQ9Uz
v2.0.50727
4#29
SD]+
jjii
jjim
>%u+
oF! 8
l-\k
g+RC
aU&Le
8(=R
`kja1oQ
zph6
_G.
KZ3
=_z3
/$
$a3d0f35f-0c6e-4234-87ba-15a110634682
"T/o#
Object
klll
c"L-
&P@R
|}JG
(F"}
( Qu5
?|qZ3Sv
etG3
,.&;
]{s6
k-,A
EHQ6W
B^f3
X.U
$^&~p
+;f :
ld*:
ComVisibleAttribute
^>@%9
get_Length
CR) QG
nvN"m
)|p/
3Iws
klmm
8VmQ
o@}[
m R3
b!*m
*^|
5iz#IF
RQ)[
Xc;%
$^QA
f&F4
D98T
'<o|E
?UN
KuKj
g O
'4b6
t1V]'
b[q?
?Gj$
`'La
\5yb
i)%N
V;tt
(S6hT
9G$M5
9z*[
FYgl
( T_
0[`y
urUHa
K_g.*E
2a"S
. ]]
h&ZL
+eO(
x&mqo
%aR+
9HaU
Zup H1
__G% ?
5 4u*
o{:b
2b W
Aqox
sD 8
Q@{M
}{OY
` C
oX'h
%\Qy
.Du64?
(6S qmX
&"/q
J_q8
gaxc
h +B
Xx=3
Y^ i
24?1Ly.
T:M[b
HXF`
|BrC
<4<D
F$ig-
gP[e
0A6u
k@MQ
c%i#
U_,c
k YC
fD1x
- E1TD
(.:
] 3n
zsTG
18bJ`
$i3R
j$E+
N#QC]
ilml
fA[K3
4WfF
#j4&l
b %y
[&+ta![6xB
K{O2
I%@C'
Stream
.(8 Wk
lTx4
oa7+x
* +
!LM)
b@($
gl+8
fOmz
Mx(h
[nz'
FXr7
JMYQ[\3
iTIq
H$l6
B9s
|#ct
dE6'
]NWVa4
F*mB
Gl
V1!n
&}#`
5GcJ
9[cv
1t V
!*/K
\ r;
s~Z\
"Q; ?)
m@$M
%<CE Vy
&@dN
E~DD
Od~K
RlJ~r
wy6g
\0LL
- ;{
1<=S
~t/f
Y5X
add_AssemblyResolve
dg*P
z5Xi
<l^1
GPS$
p= ^
5z1*j
]M|V
TmVb
5LUK
],~%P
Yk"I&
f9^U2
^AusH
sNy6;
f3e"
q^fQ
i.1C
N}~m
ou{R
T!vS
}6-`%
I7Pf<5
~Fuf
:5m?:`w
fWh5
]ug
"i>;k
(G^{^B
M%t0]
KNO)
hq81~H
.^iKw
Z`I3
j-H:u^
x@3D)8J
9' f7edK/
b&.
:l-}
R1X7
Za!|
u|3w
(8 Z
<GQer
grf\
NA<
|'~?|
?i4p
n(rt
(giiW
3c'N
C,r@
uy;WO
BuW^C
H:%W
5)r*
MemoryStream
XetC
R8mp
$L &
"5k)yM
=wb
MAW#
gvFhKd%-
x>zU
ruPh
Q7j8'
_pN0
H554"
*Q>_
r$X?
Z5`1
x= ^
"bgr
System.Threading
T4d_T
WH8
@*7
0G #6
y ;
e{g.6G"!
-;s*
nu:Z
hb[^
A+0
.034
|J4C
C d2}
G\:W
2#BDM
ResolveEventArgs
(Fyy
YS#p
IK8*
o|T.]
0L_?
jkmmm
System.Reflection
:IA_
wxRa
WM5__|
J$}V"
J8}*
L]nO
Q u%
%` )
U`M3
>z"5
uo<I
|.|\
(86v
Ki;|
Ya,`
N_}v
qQ9/
xV J
<L$x
T]i@
EVkK
;$R$1
`Ag^m
9qAH
88>
#Ui6
bTjY$
Buffer
4DSN]
* FqU
W5fW
M!)D
jW3n
V}g9
}S0d
\jyz
P0n6
j|$g?
)S46A;g
cV+. "
mUi$
uN"I
Emm\R
$L^^"
" <1
'; t
F-48
ga]
p~1<
0UxGi
.iK)
zM-p-
nHFF
PiPt{
o]X.
K" u
=2s{
o&a
| eV
Boolean
aW4VS
Cab0
-?s\w'EW
lPe/
qFZL<
q<E v>
/+.cJ,
?f%p)
% !
mn
Mk1+W
G`brR!
Llur
!2=I^
^W9`
ulfO
Kq;R
.q@6GF
!c+7%M%y5Xh
*|}h1
@^;Ac
,Bj3<C
M"5[R
<l3Q
RBZh>t
7ha*"
=/5c
r3q-8
v-ZeV
&Ar
:5B(
yzzD@
X8?W
w#"
Z(D=
G9VJ>~6
V{u8
]lBw
(T 7
r9X@
Hz|x
<Ql>
&) a
B+O(
8'q
v6e2
CLKv
g]G
SmO.`
{}e~
Math
Z cM
?C+6O
vQ*AK
+p=
z$BPA
.{8bg
'#MR5
E:YF
d [[Lx*P
3Y6bj+
@Fpu
f <z
O1?Rf
p%z5
S' m&
Y,&]
n7Qf
)ZSv
,d>%
rl"D
1)aO
a[R
|Y+(
r j
40Zt
uF /
RTYuq
(1@8
/?2$
6W!Q
?JT}h
$cZO
/Bh_
X @@]|
k^aI
bF"QqGJc
Tg|,;
MP`1C
kwkM:
$.bh
'D.(
T}Lk
)%Oo*
=:eJ
gj6<Py
wkBK~8
+#3TH
`T{<
!q$|
9&/p,5
C}kq
6jL`
b}qp
()Oe
DBhT
cN n
D4kW
VTf5
Q6FZ
gS$'
Dr=s
?n {
<?=6
pf7I
=j5ow
\5wS
}7tt
}WO'
?3LF
fOzJ
iH>tu
KKz|
dRu^
GVYN
JW^`t
<Or3
(N7D
,V s
&=+e@
CwcK
K(ex
xH5q
bOO+*In
SWA)
AO-R
@;)WjL
4DGFT
"fKt
$=5_g
|Zc*
V8~M
l.k5qS
X7l.
t~f$ n
v u
%Ab
s%o0
b:b(z
O`O_
?"9L
d.MC
kY:"yd5"t(
o=Qn
t-? V
=hGm
sX3?$
OnP[l
taUE@
KHP6
M 9'&c
GetTypeFromHandle
9/a8
-h:^
n7%3
-P%ha/
I (O
}IXsq(
0} s
Bd+H}Q
1 )+
`^8H
8V<t|
Pha}
N*z%
,c_ML
H6MY
J."%Gs
FhW;
u-.7T
z~YQTa
O^R?
ac\
xar#
= yp
V.j oAW
[wX s
g,<a9
&aL}
}sd[
VZJj
axLS
{7)6<
2+<;
1(;(
_oIl
POO$
W3,Y
`6Zt
RF'[
dUfo/i
Zkjt
5C![
w3zh
a`7;
99.)a
_fT{\]
9Obd
J8"Ph
$,?w
l 8O &p#
nB|z
P%^4
=2U_
2JvQv
trp6
}E2K
sZT.K
GSEX
bBD[
4t$8
Q>{eh0
/3T
{y5~
buNq
5u?/
n9'L
a`7
;0Cu"
ge_]
HMh{
1LDL*@
g9O9
tpYj'
s[z0
D1i_
w84.
gTtE
`aCbf
W1.=
Mh 9
&zg T
FM9"e
+elbW V'R
1n r
System.Runtime.InteropServices
?vll
,3DNPR
-KEt
Q)'i
:*IR
||Vv
?BO7?
%RrK
_Ytr
]u I
ZlNK<
?^mj
; Lh
noj
9z(F)0>z
!A2l6}
hadc
Z_{#3
8JZ-
S$=J
2 $e
s@!Q9{@
B=o-
(Ej'
B3H9F
uF =
wgKW
9 _bv
j`%E
=2OZu
Wu1g
;9P8$
PBq3
G"E'
jR54v
IFu.
System.Runtime.CompilerServices
*/=`
Gn%S~P
yHT
8Q6+
3< E#
mjmi
>S >
@0aY
yUriA
Aq%G
"/Ha
t Y8
Wef/'PxD.K
/"b^\
ap]
T^\O
*RVRD=o
k%C
72n^
jq$1
>%>]
\cc'>M
?m?_
B|gk
yk9@4gu'
rTz
8QK^
/mz6
WJS>
fOzRQm
Tr9y
.(KU
fh+K/
)8w9
]|@&`
RY;P
zb\`
G0K%
+$3^
K/B,
/s0S:
Qu^c
kiw6u
OSQ\
iPu6`
$C-)
)U1*
VlEI
ID7
0 rT
zs4 G
}:ye_
&a`&
pYEt
s*o,4
e NL7B
AtPSq6
h\]8
G,Bsl
%]iK
`9z
?=f@
EGRFD
<K{n
J%2v
8RmDOC
3{|
O`p
JI r ~
93"?
yo~
PjLN
)~UG
= m_
1J{}*R
NZ^;
rd%
qyc
5v H
JLD(
Mzax
R\|'
J%2/
O[r
Nq#6 u
Y?fYG
+xin
P ~g
/J`UE&
)zeD
"(fS
E r
=qn
n;c!m
2r=+No
MTjc
uwO!
2f|82
A/{<
?=;3
9j*1
KNm4
{C&E
lQne
W-vx
hRiYI
Jr.c
OK,E
mscorlib
,0VE
s?*,
Q!
\ E@
g{Pru
,2fm
RdCG
|LdI
fsZH
^TqH
} =*@
O$4;
P W
"1DlKJ
T:8
G@.];
<Module>
4!1=3
IQoi
1*/<^
x>9~
,BT^
ZW%a
S!
l}%Kj
jdF
:v*_!
d|PY?
'ZC
iv7
{&S!y
-cg
b<nF
G=!7.
ToS9FKy%
9f4 ~
FdC\
>>F<
kM U
-0#q
jUlo
U-%P6
)c`R
LW|f G
5.!
I )/5
R E |
sBYY
@6;4
)SGE
]2 g[
{O> V
]6pvk
:W8H@S}
^{4u
)7`e
vw5K
1oQx
-^0]Q<Z
lh]Z
?Um
["6ga
#z*GP
>\Jr
YMQ
#,'q
e'z+
E<C
P=gB$D
Y%U7S
MU#%7
l~XL
`]:O
iQ>j
. $^
h8<+J?b._
3:!n
18Vr
;O#L$
hxVg
":Q=
GbHt9Q
s;.f
:R/n
#GUID
*n3\
7Q hb
-qST
f %
'$]K
FO0x
dI{{
M)ee
GetHINSTANCE
~r?a
3jw\
}fHkV:D
&{V;
K4+!
o7E^
G\|$V
AKM+
Read
_ =K
|4;\
_BY"
m73@
:es?p
QeI
v0g>R
et DP
[|x
'auY}
{JdM
gz7#5
5+h`
G/) hn
mn) {
Bc v
cp n
OpV@
)mF@
Z* ?
hKxl
fVwV"o
}mh&
2"ir
P %)
U*Uo
<$Et
G-`E
%4?E
G6^{
*6,I.6V
*{b\
%! V
R!O;
vIWc
A*'K>
Q0y%
sPP2
;7O:
h]c
N9w
'xpk>
]BGE .9
2o% 2spF
Ye3[
y#uo"~
eW^pCW
Ma {
Q p
'crO#
L_~T
s3q
aS:O
Z"ki
470U
,v3(
>8RBz
Thread
O7\u
y+EC
/M%wD
*(}u
vl5
} GD
0>hv
tzt@
<DFyP
5qwe
,&@?
"eN>?
v2!S
7&'f
I Eq
?90({
~\?H
Qks @
[r!l
^' ]
Juv+;%
Jru`
'Q|
T2p4
f#>?jR10
?;Gx
#0b>KX
'lJ6r
Ijhc
^@D 2
@y ~
dggF
|(]y2
jjlk
kpC!%
,t oC
+w'Yhn
TzA^
' $s'b`
:e0 J\'hT^J
^P:Va*-p
o@zw
1jd]=
GbP\
.@Df
\:hCG
$Rm D
av w
3(?0
m
DOWj
q},q
T L
RB
Quf y
R#q-S
ivulO
rqfK
*/-}
W0M8
8?{1o
#+i~
H>r
9)+S
O[<f
n [.
`` N)
um/
Yl}i
{{f
L0b["
kv8 2
]MD|
V"mR=G
;,#0
4oH\
#p k
yO&t
Dc-T
6F2/
(2Rkx*
aJYT
0MWs
}kP1
QnSt
K#Q=
J%hL
;GwTV\
195d*o
I?M z
zcx0
frHRF7
gF|K~
g.g$
sy t
$|>h]]l
SK$B
(`7+
SFd\
&<K3
B- 5
4)Ru
KyI<o
HB Z
"={p>
j r_
ELTH
%Gz
n<'*
B[?<k
>sDK]8
0Zg";
VC]8
V},n5
[oM]E
U<)
Xx]H
JG^<b
ShJr
;\y
\5Qf
4Yo1(
CdKar
]x~E[ >
#:*iQz
$WJH
;iRt
=zY~
~J1G
WHP#
L=.+
&0+5V
OSxyp
e' 9
d0010505-2ea8-46.Resources.resources
"'Zw #U
5 MK7
C_=H
0ir<s
>rqk
*m.$iN
?d}4^
s9 F\
xHpo
2uQp
?Ssr
ddw`Sd
Pl-@[
_C<
!X& 9
683T
NTl";?
x/Ux
Qlj
D9Y;
k5yUD
uN69
Gt.V
G=Jj
Y%Rs
_rCj8
CphG
"&2 S
pSjd
P,lk
^kX)
P AZ
Cd!)Z
$sUS
~$ D*
]l\9
bo}<6
Pj?x
nsQK
tC!uv
")@
N fW
0, J
0K`q
~Q(W
`}N&
QX8
M4J
"Nx)
h8u4
lE3[U
o
{{;2!
Q-|B
o0$-
#wP #
* _EV.h3
xe~
Q8 =
a 0{4
}CEM
HMn"u
0zK]
;N<@
GetDomain
k!G}
84h%.+
eIK
ALsN
E~nb
lQ*{)<
?rjo|
P-SP
2zK2
PR; a
n)=%
rP<R4nUJEv{=
[N-a[{
DN@Q,
g<m=eO
\Nl %
{"{k
mjjjl
qR"H
1=y/
wPxX
2E<3
3t3_7
@0G~
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05_64 Seven05_64 VirtualBox 2018-05-30 12:55:06 2018-05-30 12:57:56 170

2 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05_64 Seven05_64 VirtualBox 2018-05-30 12:55:06 2018-05-30 12:57:56 170

0 Summary items with data

Files

Nothing to display

Read Files

Nothing to display

Write Files

Nothing to display

Delete Files

Nothing to display

Keys

Nothing to display

Read Keys

Nothing to display

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

Resolved APIs

Nothing to display

Execute Commands

Nothing to display

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-05-30 12:57:20

Detected family: #Malicious

TheSystem Itself @ 2018-05-30 13:06:02