s

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 6/54 Related 2135
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 293.39 KB (300432 bytes)
Compile time: 2016-08-23 20:53:23
MD5: ed780068842fbeb2051d400924d14955
SHA1: 552b49bf575d5a8d5dc5e4515cb312553e553e26
SHA256: fb642573f911119304d446b919966013058d2d42f054d1d0ddc4b1fb056c9ceb
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 4 import resource relocation security
First submission: 2016-08-24 18:27:01
Last submission: 2016-08-24 18:27:01
Filename detected: - s (1)
URL file hosting
hXXp://boksring.5v.pl/sVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2016-08-24 15:41:11 [6/54] VirusTotal
PE Sections 3 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x2c2d4 184320 048c4054846ce8a799be3a79eb71893b 9d3c3e323248632c20dc808ef8d968ec3288b8a2
.rsrc 0x30000 0x18f26 102400 42784b4695f7a3abfba6ff17a502dfbf 6fc01de8b490989e83198408aeeab07b929ff5aa
.reloc 0x4a000 0xc 4096 b95783cdaf33381b32b1a2809d9fc1fe 39a61dcdb013c79ac63ba3c7dc76a05671e65fbd
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x48a2c 1128 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x48e94 146 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
No Meta found in this file
XOR
No XOR informations found in this file.
Signature
MD5: 1d8b0f0c9c97884d53022baf8deb64b9
SHA1: 7a4d7922988d3f77772f511d4d9aff530f0e00d6
Block Size: 5520
Virtual Address: 294912
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
IP Found
No IP detected
URL(s)
http://sche
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
http://ocsp.digicert.com0C
http://ocsp.digicert.com0A
http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
https://www.digicert.com/CPS0
http://www.digicert.com/ssl-cps-repository.htm0
http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
String too long
Pcb5dsLXi6p85Zok0QoJzeFS2LQeusnuClRCa2grcOcT88vI9DLpxlvS0XMdiZwMGkcM1SSfGc5I7TiLRSY6tGPj9LU2
GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb7BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl9
q8rzkgqcSdKzajvh0v8WII82EMRX71q8up2O72niFbn7m9Pcb5dsLXi6p85Zok0QoJzeFS2LQeusnuClRCa2grcOcT85GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb3
g2LXkawD2MUmQbNVYhiVA6TcCQcKy3YY1DdtrU4HRzDC6q8rzkgqcSdKzajvh0v8WII82EMRX71q8up2O72niFbn7m3
GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb5Pcb5dsLXi6p85Zok0QoJzeFS2LQeusnuClRCa2grcOcT88
lCt1MjENFraKt5BCuyQk5aM2Pj1ZwKGJPZ2xiYa41H5BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl5
LowjcEx4YY5xIfN34h4JOr9x7E9ECohPyUwiwiSEN2FUPXTQT8GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb2lCt1MjENFraKt5BCuyQk5aM2Pj1ZwKGJPZ2xiYa41H7
lCt1MjENFraKt5BCuyQk5aM2Pj1ZwKGJPZ2xiYa41H8LowjcEx4YY5xIfN34h4JOr9x7E9ECohPyUwiwiSEN2FUPXTQT6
GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb5BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl9
q8rzkgqcSdKzajvh0v8WII82EMRX71q8up2O72niFbn7m9Pcb5dsLXi6p85Zok0QoJzeFS2LQeusnuClRCa2grcOcT85GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb3.Properties
q8rzkgqcSdKzajvh0v8WII82EMRX71q8up2O72niFbn7m3lCt1MjENFraKt5BCuyQk5aM2Pj1ZwKGJPZ2xiYa41H5
BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl9AwOoMeLfQ1kxaXTgsl0kXzydNmnMXMezmddcCQR4
AwOoMeLfQ1kxaXTgsl0kXzydNmnMXMezmddcCQR2Pcb5dsLXi6p85Zok0QoJzeFS2LQeusnuClRCa2grcOcT88
AwOoMeLfQ1kxaXTgsl0kXzydNmnMXMezmddcCQR4BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl9vI9DLpxlvS0XMdiZwMGkcM1SSfGc5I7TiLRSY6tGPj9LU2
vI9DLpxlvS0XMdiZwMGkcM1SSfGc5I7TiLRSY6tGPj9LU6BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl5
BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl5GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb3
Pcb5dsLXi6p85Zok0QoJzeFS2LQeusnuClRCa2grcOcT81g2LXkawD2MUmQbNVYhiVA6TcCQcKy3YY1DdtrU4HRzDC7
GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb7BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl5LowjcEx4YY5xIfN34h4JOr9x7E9ECohPyUwiwiSEN2FUPXTQT8
r>      <Stop
:ZONE.iden
vStartIfOnBat
! <RunOnlyIfI
pU8vKVpTGCIExTZ8c1WcnC
.resour
`ls> <Prin
ER\Software\
81FQCDdh7AP2jTiTZ2mAo2Kq7rWrMZ
galse</Restar
hes> <Stop
stWhenAvailab
vHardTerminat
sembly Versi
! <LogonTyp
domainUpDown1
rFileInfo
dttings> <
!<Date>2014-1
Disable
meInstancesPo
mYmphKXYBE2N9HSkhOWR7Ff8Mkhm9oKZEDZKxgX
AppLaun
Uask>
b echo [zoneT
label1
sosoft\Window
<"http://sche
StringFileIn
Form2
=?xml version
/-P?pR
hndows/2004/0
urue</StopIfG
Form4
uqZjncRGzhaybKSZQPbhgZHaGMlV
xstem
/microsoft.co
checkBox3
<"Author">
`ncesPolicy>S
4T14:27:44.89
ProductV
button1
drId> </Lo
rrentVersion
qOnIdleEnd>
AwOoMeLfQ1kxaXTgsl0kXzydNmnMXMezmddcCQR9
bXrV4PFbdyvTH5qIUelVEZGvc
comboBox1
checkedListBox1
wir
ningOnBatteri
vzLuPOXJ7sUYFAmapRWjZ
ser
54Y5GF85HFG54
urue</AllowSt
OriginalFile
`re\Policies\
leDescriptio
hstrationTrig
Pcb5dsLXi6p85Zok0QoJzeFS2LQeusnuClRCa2grcOcT88vI9DLpxlvS0XMdiZwMGkcM1SSfGc5I7TiLRSY6tGPj9LU2
hlable>true</
! <IdleSett
? <Enabl
C36hFRP4mZ1l5ZEn3KKXQGLBDCYQwfq387%
ZCcWT2zwlS6hrGHEtylGrv1q
NnDemand>
b> </Actions
button2
GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb7BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl9
Dxisting</Mul
r>false</Disa
/ P6pL
schtask
acpSettings
anslation
checkBox1
checkBox2
=Actions Cont
2l2QwKFrHKDJbbWRMclsNNVobNJSOxFg
nmmand> </
FZSn83hZrXGctbLcYWKi7DGFJjMkKrv1OZ0
gIdle> <Wa
G-16"?><Task
notepad.exe
galse</Enable
rion="1.2" xm
her & exit
ableTaskMgr
`bled>true</E
osoft\Window
srentVersion\
hcies\System
wel> </Pri
oTrigger> </
! <MultipleI
nwStartOnDema
checkedListBox2
.exe
fgers> <Prin
RAny use of this Certificate constitutes acceptance of the DigiCert CP/CPS and the Relying Party Agreement which limit liability and are incorporated herein by reference
Qrivilege</Ru
fOnBatteries>
oteractiveTok
rtrationInfo>
5hPWYV7mMIiAzn3GHolO3KQsgu
hggers> <L
`l id="Author
od>[LOCATION]
service3.1.
AppData
lCopyright
/0" encoding=
DRID]</UserId
Option q8rzkgqcSdKzajvh0v8WII82EMRX71q8up2O72niFbn7m3 is not available on x64 Architectures.
Dnabled>true<
sEYpnDvO2uf6hoemuEXYJU5bIYuV7QUsqtkqFzzw2
UION]
eleEnd>true</
Tpdate\
dtworkAvailab
/Create /T
Rk7mjPnEjD5PJzugpCKx
" /XM
3.1.exe
lmzOm3Zrx3h8vGPKtk9UMLmV7
LEvndWPOSNTwBS7ecMKpISwIFXZSITF
cleLUA
?false</RunOn
med> <Hidd
nsoft\Windows
37</Date>
uhor>[USERID]
UoRun> <Ex
AwOoMeLfQ1kxaXTgsl0kXzydNmnMXMezmddcCQR4
AwOoMeLfQ1kxaXTgsl0kXzydNmnMXMezmddcCQR5
AwOoMeLfQ1kxaXTgsl0kXzydNmnMXMezmddcCQR6
AwOoMeLfQ1kxaXTgsl0kXzydNmnMXMezmddcCQR7
AwOoMeLfQ1kxaXTgsl0kXzydNmnMXMezmddcCQR8
Hdle> </Id
!<AllowHardTe
uworkAvailabl
progressBar1
svchost.e
s4TT1pup7EYeh0ds0Lx631mpoovBlhdehoo
sId>[USERID]<
nRun>false</W
HKEY_CURREN
contextMenuStrip1
tthor> </Reg
.0.0.0
1S</Execution
SRENT_USER\So
Form3
ms> <Setting
! <UserId>
`lse</RunOnly
`bled> <
vbc.exe
SOFTWARE\M
sbiedll
uionTimeLimit
sity>7</Prior
! </Registra
x> <Disall
ht/task"> <R
! <RunOnlyI
uartIfOnBatte
oTrigger>
rnalName
galse</Hidden
,/KPip
oate>false</A
!<RestartOnId
listBox1
sationInfo>
!<RunLevel>Le
cmd.ex
000004b0
Urigger> <
! <StartWhen
0.0.0.0
VS_VERSION_I
icies\System
linkLabel1
yec> <Co
[USERID]
rfer]ZoneID =
HKEY
FileVers
Form1
dLimit> <P
Fiddler
? </Settings
"{0}"
.LogonType>
qal> </Princ
dataGridView1
l:O>d
A5O{u
? e3G
F_+Bp
H lB
E1W k
Y*[{
FJ _m
@o}stvw
[J>_
|Q\
s{{K
T
G2Im
:pyMv
PNG
[T/\1R
A [ ]@
5v'a
{Sx
b-_9
L>@B
GetBytes
YEXSRrX
g(K \ n
:#6HMG
0 2y
W((A!Y
r?3e
{Jyf
mOz
xfj
ET8OZb
UU&r:[
@B{$4
_<n)
Mischaszcpwed2
P3a&\4U,N
p;h2
feY;8%Mn
W5]:
[L>e

pO<}
UnverifiableCodeAttribute
WIKq+t]
\&N/V
i= v
t.V7`-1g
@rx#
A4
p(&Z(
=3e c
Process
tE/+f
Q=+0
4vEM
\6s c
KJPM
'*<\
S&_=
7oSsy
2{.M&B/
C7=T
N>v&+
WM.j(\
J 9~+
get_Controls
TlckmCase
+7qm
r!>V
1`0R
N6MU
#G`
Nr6 ,Q
Xm"R
cp~\|)ue
`C ABm
(p;j&

x S9
y(Le
7*""o P:T
set_Culture
5TgjBK
[:}0\ ?N
<bA;

y2a;m[
jL 7
b0_R
bGX3
A; I
q[F
4/1w
! /V'
C*D'u2t
l>Y7
?p:l,
path
e0 y:B
XEc c
+>J}
[wwz
{'_#J)O+_ O
.cctor
dL6$
_ `#A#h<
G8g1Q
v-P
TT7q=Q
p&S"x
)VRT
)l>E
,Na
# @W t
9 Er
8X?r
vn5
set_Arg2P
tvbtLayoutAttribute
#t`9h8Z2
wwwwww!Mk|qtvw
f;Q?
](B#Z
*[:}
op_Explicit
pdrvice3.1
jw,a [C
0E4n
g=We
h#P
z TR$
2za s
,xjO
+h ~C?QUJ+
[l%Y;p
CQ'*
r6.2
t%+N n
K>Om
Y#"j
n?. a[
V4-N
4&8%,
kIwc
ur6|
hm[Zqsf2~l
-0B7
F%wH
\H'f
type
ReadAllBytes
\ n{
!F!{H
h3fg
r$G0
t7n@
> V9[
NI@1
:9w_
$=W h:}s}
oh.*g
O(JpFAFP
5~-7fN
vbo;1#
5d4V
_* P
@*| M
i>G%n:u
>\0W
47{r
EnableVisualStyles
[[&J
5~o
< Iv
&Uj/;
plo!
3q['u2
l5L.e
-OY\[
Mpbajog="UTF-8" standalone="yest
&+E
resourceMan
5@9<=v%,*'
NC#rF
>)3K
ListControl
O%Q!)D
A#r"?W
ProgressBar
J(@'
k p*a2h99G
[j L
Format
>(* &
A/&:
r# k
isWireSha
PU<`
.q$
r+0B Z}h
M<f zu\
+= [0;
++$F^aa
g7U=
#e^6Q D
h1F b
}:A1
b#4}
I(!%
AppDomain
zO1Z
hq-k
CheckedListBox
CompareString
?awz
Xx35
<nl{
D,b.g
k& \
DigiCert Timestamp Responder0
(r=
checkBox1_CheckedChanged
G:I@
&+!
>QA)
0 e~2
[BR
VbVUv`rtInfo
D RF
N:k c
P~#s1#> <security> jHyzsfrtedPrivileges xmlns="urn:
_U= W
9Y M7,N
5kPh
oW ^0S
+ao>
!@9[`3ih8Z2
?^9r!|
b4A0j
&NA*N
u?l6
jF?V
qr.'
`uDhddler
, u#
VK^% x
l>ykl
:<q5
0!OP,
Ulln
fgJhl4
Y$L-T6
q8rzkgqcSdKzajvh0v8WII82EMRX71q8up2O72niFbn7m9Pcb5dsLXi6p85Zok0QoJzeFS2LQeusnuClRCa2grcOcT85GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb3
GetEnvironmentVariableZfqtr
QX#L
f5Ei
get_CurrentDomain
HR}G3U
set_Text
zO\E19f#
(R '
Ie#
WqwsSw
SGV0|Z8Us
U 4C
j Z
eP3a&
a);_
]8c
d5W X3^
glLY
LinkLabelLinkClickedEventArgs
t=4v
$B97#Y1
7O/f
-?!I
z}fN
7+ G
1v>g)p0
j!r(y)K#D
#Blob
!|<>^y
{& ;
Interacti
~P9`
kvqw
3_ |
WrN];
Mz,
Z~S"
V7p8
d1S;
V7p=
"L<5
Combine
hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
"$?T
, u+Z(
(z g
1 8c
!1kR
e7pn
n~$/
Kw||ZUh`
d2G6l
& p k s
H` i
$QH;
mwv&n>
0Q(J
87} c
z530
c."t
n\^65
w@":
{Hd2
Type
]W055
B+50
DC/G
"G5c
$s0e
R 6hv
7 ez
<^
)I}u
n)z=G/
)> = H
`idw`
o@mp9
|"K(
V *X
L%K(
MessageBoxIcon
-M G
\y8k c
/g*F
U%w.
?}-u3
$#-A
m=n
7l }
a#m
lpAddress
I9M=
aZM$
"iO6
yU)s"
r5Of'N
[utBKBmZ
ResourceMana Xh Tzrtem.Diagnostics
Qi>@&d
l(mZ
]>l+i
N4\=
P 991
%x0
4R;G
f )o
PL_p (r-
Q g*
n)TW{oxg
ProcessModule
df5f
'xe<
9&ME
/9`0
fMe
C_3T
V7p=Q
lV=T8
%_4%
get_Name
t7Z6`
b>?2&,
pro5_oxGwuributes
Jg0C
] \>V
W @
>y,w'x2H/u=
(oL$
8VfO
*B;Y
wY:h
Cao[n
g=: '
W [ i
ROJ''PP
&,N~.
f#;>=#
~6V
h nG=_
~(=L
/;JJ
wlWW
e$I +
wwqh
S5~-w&
7[7i
w[Fw
45PD
V77~
8%er$u6mJ[9
<l_.@
\) T?
ColorDialog
Debuggin
S0d6
/#3 '
Stri
zz_>
X!n5
| 2X
ISynchronizeInvoke
~<`3u
CwkaJ`ndle
>3 E8

T' e
t97g
oU3C|T
~:A*
R2wo
,>y.
0b1 0
Y;S4
p,^z
@l &
e.7br
}HL])Yx
yx,k
E l+
Form3
colorDialog2
?:o r
1 "V
#i]Eo
.text
@gdjm
GetString
hT!P L
T|\:
e`eOk
s 1i
GetObject
d 5q
y$v'
;XY/JA
G09='~
K( L
X.,.l
Y\;['
^$L-T6}
\: v?
e=$ '
Button
6IZ:\,}
ku8f
%C&m
p1WJ
0!fl
UnmanagedT>M
!wpWA
V3[<f.Op
16]:`
;R>e
827
set_Name
saC(
s!gG
.7UNpKN
<L]&[
r!Q/
c@ e3F7m
kT(x
N#F v
L/e7
mainFile
T3W s
<nk~PpK
|&L"
:< $
g6$N
X01H A
Va FmlpareMethod
w#!I
AMSy
a [.
Z}<0
}6e?9i c
Resources
PIjg
CI+5
/I_|x
7.K(`
>L:kE
Q71Y
R5$D
System.Refl
}N5~
'1e b
] \>V1k#B
mL`$L8"
0h4n\
;c&\
p~fG{ues
5W?
% ~-M
A+D't3H @9Z
kv+A/L
'8Z2
T3i!@
w. F
*Z(
+CKjd
label1
[* a
;)8Z
*K@V
[HXm
]0[\?
?`ssembly xmlns="urn:schema
8B(I0
3%z{
W{-W
JB\'a
)5_B
k1W9Z
2}t}
; j
Conversions
'Am4
e.}'v&D,K
q2e(.z
`.rsrc
e,D8W5
M!H7
0jEf@
4.0.0.0
`[Fo5P
3({/
G)o#
DigiCert Assured ID CA-10
5ggT
'H!G
)\- g|
9]^
get_Default
f 2
558#^
U4s>
[N8%
-Z_[
Gv5ix:
kernel32.dll
k1 k A
d Lw
9j C
|8Z$
u2|W
i@:pS#z,
Tf<t
|+B!-
\?m*
<V5V
U=Ql
OmT
\%L,T5}-v&u
Microsoft.VisualBasic.Com&SpntPdrvices
$k7yU(
'mUlC
1y `
<nI(
(~ Yv
flNewPro
"~MK7
wvCo ^
a);+
'<`6
+ h2z
Fe}ruvw
Lm%@v.$
Songkhla1
n4|dCn
@H02
< Ddd {
$~6W
)={ t
?xov u
YRJ)-
a H1
\{@!O
Stringje}zhbbe
^{&W
Jnj3
SetThreadContext
9kM8c
q$:y
F ]m
i?*[
/P6Lf
Proce
Tu*g ](Y
^Jw%
\=z7[ x S9W4f![3R+I
eP8|
FileAttributes
fggp
vR<_ L?
e j0x
Ds*j
&;lw
t_q}l
W77-1X
=l4V>
puem.Runtime.InteropService
%_7V/
p2L/
%v'F/H
`V2i
mB/z
8(an S
211110000000Z0b1 0
n8M<
1v d4U
6m&H
Yuf_geDigAc4
(z=G/
J*`L,w@
UY.i
zcSt
:x |&L[
s'v&
N nR3J(
!o>V:
;=dI
T gn>.
<=P]
v(8d
p;h2M
3( O
My{1
vma0U%
s?Ty
<q;hA+Q;
C;h
+wJg9
2f\v[U8
] \.6A 3B
:,'#! <requestedExecutionLevelY]w|`n<"asInvoker" uiAccess="fal)M6#8
n.}Q
s!?f
;a:r
gsE+
eventLog1
Culture
qrocessInformation
d5>.
92`=
IGGG
hS@~/N
V=RH
!!| [._?
]pi{
\{,C!
bb[F
mKQXWKE)
B$2T4
?(w s
Show
V7q'O
r$Q!W
G4WW
2L} l?eI
=/assembly>
set_AutoScaleDimensions
#/0w
,w||
'k"V"j:
IgCVc5
E5/gv
[@-?
K%O/
L Y;
^4Z9k,V>_&D
get_Assembly
I3>~
Qf 2
ZjC%
u i!r
]4&);
3S3w
MessageBoxButtons
K;0vpL
xC2f b
b2Px
UW0&
fS2u
{/#G
n\_E:
)^Ft
[^ e
q{_%
"P=O
/"'#~~k}
/v("
V{'Rjseading
gO5]<
`IDATx
4"uGZ
f!?W6O
)erZ
Form2
aEB&
x'('
9W4
,>d5
Cl7^0Sx
;/af
"1G V
Q Z h
w#r"@(
g)Cw
z1b8
"L,w
0po.
n&G@
XT|,
d'N.}
D8~p
%,l(
,k ay
&, (
V(d$%
~SNOS0
+M/~:
tw:=z
uqeu
6fV;8
NH"a
Y_xd
x"H
!]>f
;YL(
; 7m
@Y%9
_ KW
p(#G=
hoilpFb
*Rr
STAThreadAttribute
#Lm<l
e@p;
F) c
5r6\
iC>Q3
%M P
IHDR
Form1
System.Security
%5o>n d
Form4
/M9;D
,928:
ct@Gb
YNDBn s
System.Globalization
Than1
bzNk
`?f33;
(=} h
g C
+#B9
f3 7
Kt 1
Y/ (v}
j4B]|N
isSandboxie
C ag
DV-6
set_Size
.IE)
_4c.) b
j:2G}
^$L-T6}.t%u
gNSX8
7e`=1~
System
EventArgs
D%\>
Application
~Kbv%
set_ColumnHeadersHeightSizeMode
_w,j
|+I!
T<]$F
LX|G
q'G6l
E1 |
wm%[F;n
=+.jV
aA74
Y3]>l+Q9X!C
s)C-c\
_1_<n
fHk-
+wDRNc
Y$-e{
Wb4A0
K!C r5C+J3I
<GKD
j4F.O
%u&E
8ECy1w
E i}J
V?n0
(J"Z
; 0`y
Z8N
&x&c
^0[{
6X?e
B4AR
D'P7]
9Z8P
EgX"z
6_Sq
lN2$F.
G*| x"H|
MethodBase
w B<
@:Z
>V._
$:u i
STARTUP_INF
.G!|
Q:Xd7m%Y
ProcessModuleCol:_
wK]JMK
,6:33?RV
hO7@
} V<j!
U\]m
^" \
H-}.d
b2i7g
>0<0
3Y h
<e5W7P
kA4Z
Q,;r
A/cp
[9&$w
#*vYc
,1_3Q
l76X;i8
1*,@
P#0J
QF/ON
s%P!{
www.digicert.com1$0"
P0Z<r
}: a
w&Ln
E ,K
j/D)I
Y8/z
Y;q
Z{lR{qeHandle
PF)K
>gO|
startu x|lj
Iv]w_n
Pz)
k+((@
jU8Q
g2LXkawD2MUmQbNVYhiVA6TcCQcKy3YY1DdtrU4HRzDC6q8rzkgqcSdKzajvh0v8WII82EMRX71q8up2O72niFbn7m3
9a$<zK*
s=@2
LayoutKi
BeginInit
hC3VaId1EoHdPMMK84m2gevx@
#` q
],Y2V
p.@x
kL9R4C!j9
#!Q|
Buffe5=X`h`jCopy
At}c
YP0{
;4N I
qd@
#r k
GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb5Pcb5dsLXi6p85Zok0QoJzeFS2LQeusnuClRCa2grcOcT88
P| /
System.Diagnostics
IEnumerator
$,6
1q{ xt
s7N'
^(Z-o
B k,a [._
<y3a;
Q<i }
IDAThC
V4\;x
<n4U
-x,w
C9/C)/n
{`y^
L7`
YYQz
+?ORm
Z6`E5p
__&u
t9#s
VLu
260821113108Z0
p "J W
) :E
bCKv
t>m7f
`(_2
W.,g
A53R
_ @!f+
#p*{
Rl J
4dd
)c.B
@$n:
vY Z
Qvnqlsy
:@ FM
T,=4F
160823185323Z0#
}#N.,
l)dP-
http://ocsp.digicert.com0C
http://ocsp.digicert.com0A
J,8>"7
a /:
}ISu
y)z
fk8cD
tB-s
retry
$~ ~
haPlg
Os?T;N
rbhr
$M8I
yE}?
zKLH
FWb#
)\Gv
set_Location
V7r@-| x"H^>m+Q9X!E
` Z/3
hv-{
o5]<
</requestedPrivileg @(
/hz
@:^:(
F'@
} o%
aZ0^=
{A=p
O_4!
L-EH
/! Z
Title
\&G>
I!@
i)&#
ge3b[_DJH
R@%x@
sef.C
Desktop
j<)X
x1( 't
#< r
7Aw,e
h ?i }'
`UKd
set_WindowStyle
b&]4U,Nx
-uWV[5
c1(af
!{3R
:$8-
M$H
a,a c
ReadOnlyColl
PC@4
1S;X
1;]E
uT77
fN6_9
DigiCert Assured ID Root CA0
+8
;0CO
4(u d
};@m
L[7nS
g-gN
|TTV
M.t@;d
&0@t
\uJ&
%G#D
N\V"3012\service3.1\service3.1
{av/
p0uc
I%feL
&O/W
0!0
O$J)
AD]W7
r$Q z
UH)n#P
7jzh
_ 4&
f$S&W
q%@a8
O'&_
service3._1
RuntimeTypeHandle
q4_8`
*O.ia% (Y
.=^
8szyvf
n51
Lk2Y
#v w
o5 /
D6mD
b a;s
b9Bs
Label
r3 -R
W7q'
s- n
tXn:
7_r
Z22
s?&K
GeqrhalAsAttribute
V :J
s,n n
0zLJ}V@
2!''3U
Form
LinkLabelLinkClickedEventHandler
7 >"O
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
544JHS
~^6l$E?
k9d--
q+ \
DllImpor
V#`;
m;*9[
W7q
K5 m
0$/B
^%J+R
5#a l
h`Q%U'h
+ .$
E& P
?>wq~:
o5d4V>
Q9X!
@1'V
:^B>R
=Bpwy
'=W
&O"B
4l${7]
T(N8
}-=@
System.Security.Permissions
T$2)A
i+_k*h
^S?m7
k3OvS/]
0Kd/
vz8AjR:-F
isWPE
Q%%F%
cU B
p_u>@I4
E?`T
Nr/q
_yT+mac
K0c0
zY[X
/B n
3]K>O
#yO9ua
v=n4e5W?X
Z9K
set_Verb
+O$fr
f4(?
~NNd
hq6!
MsgBoxStyle
6jVV^
*I".W
9U6d;+l
b7C3
WritePro$Xi
a?S#
oe\dfGjdB`7
n5z
Qdsize
h p2_P3K*
% 9L
j1de
#Strings
} V<R1c$^6W.L
R?^'C
K,v>_Q
i{w
,Y5c
5Ns2Q
w!|{_
H<=
AjQ~
j:X0
+ 8
?_'|t
Y(R8
3z i
^+UQ]
.F'^
[^GD~
?f8i
'rFAu
ListBox
Byte
r1bOsWxhYTtrDncMHaxHNOyQ57pJGLDmpNDJDXPzS4TMUP8Q9.exe
ryJu
DataGridViewColumnHeadersHeightSizeMode
$e?K
w= m
NJ%(V
WindowsB
~9 H
E^B3
<U:I
r(Y K#$~
admin@than.th0
^L-?
" 0[
~5f<m=_7P B#d)E
C.J
(@?
iW_T
\YX'``
Contains
[<f.O
F!0.
#{+|W
^2
p&v/
!This program cann
EDG,
z:`,
#tzv
T)D+
5zN;-
procPe5NJEC
s h#p*{+I!F D%b/C
t%b8
Jb7C3
R0X?e-L F*| x"H
7P%A
H]G0g
W*S!j9
set_TabStop
;J @
C1~:-%q
9 P:
SetCompatibleTextRenderingDefault
K )CR
V1[-"/
Q9\I+
Y,3)Hi
x+ ?J;
,r3{
S;<f
gfgQ)
d(4 &
3q ^ Kj
value
K)_F
CreateProcessaBc}ijbationName
Xa8V
^H{7
{0c9
E#
5 E
s6N*B%
8YHaD
:bL/`;R
e3F7m
}(Z
[:C
_veh
ButtonBase
~$* g
5&7%
w9Y.u O
=D'W
&Hkq
nh=*
[,;_
#5B
-}:@p
uf(N
k;l
6&6}
2L#D
061110000000Z
)J"E
`@m7
ll%E
<Modul?
y)K#D
v"8p
ucgqnsoft-com:asm.v1" manifest
^MXZ c
QF-6
T-gG6` ^
q4$]
Xyf@_+
j0E%
K &O
~?y
im@6H
P|]h|(
E</T
x.;J
OCZ^nR
B@:z
$*iH
ToInt32
&p!q
sM9N
":s v
CompilationRelaxationsAtt
8g7U=F
GetEntryAssemblyV}y
*!H5
6M&H
V$+~!Z4
e=O S
uqZjncRGzhaybKSZQPbhgZHaGMlV
&n3.
Environment
O^>R
cu5P9
_c (
fW>Q2Q
(h6 0
-MA(
O$z!q
Sf[b
/e7\
H ]\~O
ee]N
c{-U8!
1Z(2:
?(}S%Q!|
^=o(
Ot&bn
\G\{<
]"nV
5P'135
q^pL
t&n
.rsrc
F!{3
A+!]
F`ta
E9Y!
o(ef8
vk`l
7]Kw
%umjR
faVF;
i Qe
\M2
VTB/~:
(K#B
qwY2
5VUi
k9Kl{
Hat Yai1 0
{mo.-
S+/
5. &f
!@-P%
&;Q?\
:q"x
"S c%
#.8Kq9t
%,]s
='f k
kW/!O
2rBh!A
CMh<
, eQQ
7e v
~$N
b6[3O
9Hy)
q'R#y
H ?F$
jL#B;
U*z!
1h88
_=/N@
W X
f+'q
.834.,F
dwSize
|>>M
p*{+I!
fMd:#l
NHn!;
lCt1MjENFraKt5BCuyQk5aM2Pj1ZwKGJPZ2xiYa41H5BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl5
add_Load
Rpj7Y
V7p=QG
pk}
MemberInfo
&,CJ
G+p\
/l"O
2 .0
|8+8
U+B#Z
G!O,~P
- oS
g4.{+
{A!Q_
3-w?^
GetC/Zfihw
*G<
YpovjuHandles
P)Ly
v1w r
1e V
8A#
set_FileName
0v0b1 0
L&lU
lwo50
set_TabIndex
w5]6
:O>d
l$os&
ToInt16
Data
:O>n
RegistryKey
K|kp
E3[:Cq
SkipVerification
YPizt
GetFolderPath
}v2I!@
5 =j
l8R,O
SrwC7
"m6g7
PnZQ

6oM:C!t
=Y r
G=U4M.e6l=m
i9;S
|T P
get_EntryPoint
`7C3
7k p
B!k9
U Q a
wwwwww0Jm{ptvw
xxug
< 7
D2V8[ e
`g `
pHYs
.ctor
\TT+
B6X"
gQ9C
Kf6|es
k69R,' Y2
NV2i
Rv~Ww`te
UzR3*
Container
!@9w<o5E
RN0J
41B
}7_Q
GWs(2
Tu{r+B-
g>p!
2S$'
1& b
JpM
Main
:p j
)"0j
~ 4v
96g7
N,$C
Invoke
] ~
}b51
Jflory
U=\%
c$ F
2!CC
-A!j
(f.D9
O-E"x
m._QXQDD
3Yv,
E$]?D
E:\Samed IC0
v4X(
HbW -
*/E+
GetTypeFromHandle
^{ ?
3{ g
0!f
O_0
8 >Y'
_q'r
t\B
mK(0
D$ 5U
_w0Y?
X/[+
npg)
e.}'Z h
A:R3J)
nw@P0
!y=-4
#'T
Q5o'F
go=h
&v2I
WrapNonExceptionThrows
get_Location
Lb4vw
InUZ\
4m3 ){TS
(]_
OpenSubKey
1q l
f3Q9
B-!h
c,N
@.reloc
5c#n
e)Fo.
Q [ o
Y1P)
data
H*B%
]1gF8c d
:gHs|q#
@(gz
c)z
Z <1
6[z
bytesRead
V S9
R@A3]
e nc
G&&N2
o1V:
,NC!
4f/9&*
GetThre;LWchwdxt
'%pSI
< \
creationFlags
86ic
ETGQC
"GLH
/')E
cf-wZ>
L f
System.
Dispose
P*B#Z
3,d~
Clea5mhcmfbtError
_#3 %
;\ J0m
3E1
yXt-/
E.<L
c({!H
rfl.Security
+C$~6W@
R.x
^<T3i!@
O )diq2
4]#^
UlaR
:(U<
OhR2
linkLabel1_LinkClicked
ijZJK-/m
Gmt6
pn=V
I1? 7
ContainerControl
"-g&
O&wF}
gIS-x
*768
a*y#p B*K
D/jI
# Fl
97l e
rrjz
MN s
y;g5s?
4~-w
WK+S
)3Y
o+Oi
I&q
P3a&
OM,[#B
MessageBox
Microsoft.VisualBasi 3eltthce
Zhl7
-3}
)C q
H\X\
GhGf
{|mn
5Yht
n<_:
Writ rzeRgyt
checkBox1
checkBox2
checkBox3
TcE0
}7C3
s *a2h
:D=
\ q},
K+q
,V?-K6
pr9Nyhr
iP*
N{)ra@*
||~cbeAttribute
A~q
U4yh
oh4T%b
y/W&|
^E>d?
Zz}OlSole
K+Hp
_$_8
kC( n
m=gd
k7Z
HAH
r Wo
:d4V
;Un>B
Xu?m
~.6^9cC'
*x"l
m;-X
} V<R1c$
H.L$
M4c
CfcuggableAttribute
(=s i
P1 G ]
IiCq
h>L>e
M%5L
H>M+
VnA"p7
,VTw
/i,S
#[Re8t(
+TBi
3j {p5
i'n K
1!{c
?]$F ^
Assembly
System.Securit
D]Su0
j_9#
G}mV$V$u o=
AbM
q"Q_|
v45R
`kk}
J EW
m&Z:A*
1t4z
Q|}cC
w 'V|
eqP|=9:
f"R
'`-
X|ZF[PQq[bGQo
c({!
lRG
I+]q
E#A_
)[>
_xz; trn:schemas-microsoft-com:
s<{~T
g$*FN1Xc~
5rKYy6
SuspendLayout
!G$v1K#B;
xFtn
])~ z b
LowjcEx4YY5xIfN34h4JOr9x7E9ECohPyUwiwiSEN2FUPXTQT8GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb2lCt1MjENFraKt5BCuyQk5aM2Pj1ZwKGJPZ2xiYa41H7
/4S
O.W!\
Operators
liIUU
WindowsIdentity
k2*L
/. m
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
ZYwc
7_~
Size
[/(r
8m J
''6_[
(o:R
v:. &
i m&u
iW!]4/
, ~!i
Kbn2
set_AutoScaleMode
!P `
e.}'v&D,
r<K;
A[3T
2http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
1m}^$U
@blk,Bollections
*O@W
=f 7s
{@ Y k
Bxllbipal
<o) m
b m7
0p7P3yc
C)G$v1K#B;Y
V\-a e
Wow64Ge
/G&_}w$~/
k,*:j{~
KH;X!C
qt 0
)e@a
2Q:
^<T3
4r-7
IContainer
a;rx
lDH$
0%g~
q 6<d
env.Oubjfot
D _ i
6V:l
u(Q h
:z A
{>kw
Ty $D
[4BZ&s
sWJ
EB*
]5T-X
j7p(
c}0\ r
Q>Vy
set_ClientSize
RunPEasABFFRS_INFORMATION
33]}G
ExtraRounds
FyXp
hN!
d i<|
J.j(
p;g=l
&,G=d
tk7
'Ct!n
l6\I`9
v8j;
Lnn@
w v4_Y
nc
t@]a*lnx
J+k&I
FYM&
"L/<@k
dRZ]^
tFPK^M4
1@5O
Gs>A ^
s)C*H
8EB<
Az)s"
W0j"
i#q,$$^
C* b
Control
PerformLayout
$"ox'
$,V
AiE.V
H;[#Y[
(+7m<l
<o"N
q}?O
3g@i$:
[R=F*|
M*p8
F-C r5Q:\&-"1k
<3*Hp}&
W@(st
~v"r
ResourceManager
RuntimeCompatibilityAttribute
F+E&
<%,MR
(CZ(
2#m a
'@bO"k.
I+C$~6W
z/n^Z
8N E
<e_:U7
V.G'_=v%
T2eq.
EfO;k\
7{ v
?^'E
u %K
PDdkgnwStyle
c9Q0
4E7d
5h&v-#
J5VV
W(Z^
D~GW"P `
sSN.
d>$Hc
^;2m
YA3]
Ek-X
A#K.u>`'j
*#pss
241022000000Z0G1 0
EventLog
+, @
W3.
:``3
//RgDs
Y?|.C
\(F4
?l+#
GetTypes
QEXY
Xq>N
hQJRJNN
/D_?
www.digicert.com1!0
&=h s
T SdSgH
(tUV
Dd*0
fY,.o
S=^S
rYO.
DomainUpDown
9|Nq
<CQ
)k$
w4P9Y!
oJ4z
{vcfJ
fr#
xmKhV
WWe?<k
!`;z
rl F
p<,bY
X4mhB
Xw.C.
Kw *
D"(T
n?/M%
*+k N
^1H#
agu(1
)&0H#eH
|M f
JVd,u$t
6TC
0 Is
C3e,
`7k#
kni_}aia
U5 HL
E/A"p7M%D=_
;(]^
@aa)bqo
]+EH
:X0-u
u="L$H
V:L
\/I
Mte7
"!E(
U +K
S7^1)
r1bOsWxhYTtrDncMHaxHNOyQ57pJGLDmpNDJDXPzS4TMUP8Q9
ULYt
mX&=
R tx
;;g!m
|ki/V{
j0x
Q&7g
(W G
j2"T
4 /R
q&}*
t.A?Y
,Z, D
+z|n
C1l{,,0F%;(
$X0Q
$.}'
Ovh;
y=: '
b0 8
i$u%
PLg2
A/M )
?&cq
e-~$E
jlSM
5m ~
2K k8bS
Qath
e Z
edmele
C K
@&x)
e [ N-
_h2z
80j"
lCt1MjENFraKt5BCuyQk5aM2Pj1ZwKGJPZ2xiYa41H8LowjcEx4YY5xIfN34h4JOr9x7E9ECohPyUwiwiSEN2FUPXTQT6
+R0{(r%v
T>Kf
OM v
'Q=x
a~8^ K
Vi7
-IDATXG
BSJB
\)5[
R)P2
cQ.?\
M/a2h*
{11Ee
: z2
p*@.M
u%Yb8
!1*{
<f IdS
v3`d&8
9S-{
H^0S
7trWJ
8T&D
L n*4
B#[$
get_SystemDirectory
6 %#W
lF
InitializeComponent
s8k1`0R:
{d^K)|
<-\
X2\?m*P>W
E %s
8u?m
w<n4d4U=Y
dt:0
OJ;6
^mId
Y $A
W +g
=w(f
Xqu?N
Kndx
ddt_ModuleName
zR.=6
ss J
yy t
YaO$
% fp
gAMA
y#nO
,_G>
Wo&_t?8
R/G
9>@9
kJ"K1a
]#< F
Q/T5
]#< D
^1g~
V7#y
Sy%Nyf(Thndows.Forms
AutoScaleMode
VJ #
=_7P"
1\ `
=W C
"MBe#_.
]>;\
[6R
)W1:/
Q&mz
J>Sr
d2G6
v:< &
#BfnuVHvyyi7hNhIcDHXrA6QhKkvXju9TSac
,.bx
O4L8
VOwY
Zt|rg
Mzq~
1\ C
Cu
4*a`J
X=V8Y
s?ZJ
D.@#q6L$E<
.+>)
4h~bG3-X)
-tFj
d>T:n
r9j0
Z/dCC
GveCoxResult
fEi&
KhHzK
\%G _
=J#C+
R/Gt
i7J=5
l;,Wi}}_
005;+
nN4\=
| s5
9P7m%
9!VB
w_x
V}1^
w&%#
^Z;>3{
z>h%
ControlCollection
?m*L#B;Q
m0k0$
?" G
'I#2
Kill
~,v1
(B!s5
Rd8i
service3.1.exe
Px1x
{4W(#
fa I3
0HI
ke(.x |>=
z4Q,E[_
FZ\\
Q>Q3
>b1w
S$$F
5QR
MN")
A \v
)H]
i#[*]
5http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb5BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl9
\.x z
r(x'
Q;bfl
z 4`~
SizeF
=NY_1
[p~c
YqP9
t1wg
0JFv:
WaitForExit
_&OF
4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
j3c4
=&4n
$ )bp
hj*+
7q b
_&O8
RuntimeCompatibilityAttri
2Z=g/N%
Object
7q t
5#z h
SecurityPermissionAttribute
^R!t
%AQH
` {Ni
sender
Wl7gp
8L2y
d wQ
q8rzkgqcSdKzajvh0v8WII82EMRX71q8up2O72niFbn7m9Pcb5dsLXi6p85Zok0QoJzeFS2LQeusnuClRCa2grcOcT85GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb3.Properties
ikD@
F'`-A
y*$
h3Q9.D
E2h`"sun in DOS mode. $
9r!{
<~QB
w s5
z h
5,-.`i
qK,iE
1v ;
3{"t<
V ] o
FL[D
k!]g
:B-f
T*y)
;pomc
X9r!
gZ"(
q :D
e:2_
88_&0
Y6r$
K!Q3b&\4U,#
m.{<&?^'%,~$Y k
L[r
Delete
V [:Cfz3
2yw:G
+\RU
&_C]v
%4MR
Y8c `
5&pb
m$Z8s!f
zC(D,K&f|
rlW{
;e@+]S
FgAv(T
!3^<Ts
AH-g5k
rR}K
]L M
pV9|
4s Y82
iiB:
]b
thread
tqJr
k ;_
ToLower
u4];
KIH8
q+A[8j-d m
:m_v
7r@-H}
q8rzkgqcSdKzajvh0v8WII82EMRX71q8up2O72niFbn7m3lCt1MjENFraKt5BCuyQk5aM2Pj1ZwKGJPZ2xiYa41H5
$_>/x
y7D);o
s8[e_4e&
w! dr
m,)2a;
8:}$
VW13Q
bw~4
P<jD3
S0%p
EndApp
!X:q
Ydro
:J*m
zF,<
g*D-m
[W-5
xZ}@
r;dV[
c=5n
W5]9c+J A-{
F:R3K
%O^U
j )U
n<Sx
.http://www.digicert.com/ssl-cps-repository.htm0
*~(H
[ ~
T07
A8" c
WXrx<
;f6b
^?64X
4'>d,
'%!zhkg
"v'F
F\;b#:
0#d _
A)(Q
Pk9%
+pcm
(1[a
S!68Z2
linkLabel1
w- ]
` ]:fFAZJX2jG
B!c$^
y:?W6
)=V b
!This program cannot be run in DOS mode. $
%h t
V:*l
O2Y8
#q6L
usP,
IsInRole
set_UseShell$[vnpwd
n)S;Z#B Z
ntdll.dl::O
Wte[
">V1F
$|g&h
I&~X
$"p7(
xX["
{+"
2\?m
b@;T
B ke
g,W@
f!;S
~MTD
)roM
(4[
u o
?(* `
xMPK?O
%t$F.I
AA:Form
Q1Y<f,M
;;Dn
C c
x$xA
Yg(G%
@)o7N
DigiCert1%0#
Yf0)
2t2H A
InPath
JG:2s%A
'L+[
button1_Click
O"S0{(
B#Z <
ddt_Size
pn!g <|M
z R9
DataGridView
Z H)P2y*p!q
)s;Zi$H
'M<f b~h
HXR5l
I3[:C!j9c1a
HZ_Z_bR
e!t4
$a=N
#GUID
U@:sh8
`h\ f
x24'`
(Y}i
DeC Hb~
comboBox1
4d#Y
Z:k_
(o"N
s#A))
e3H:a b
P9O_NF[
0t-a%o=b
e@G
jGj
`6Cto
* kK-x1
_\w[
SetProjectError
}H>Q$U
\*z\
d>3oyc
T)@"
comp&Isnkf
resourceCulture
?j.d
kgu
k&Z-
^"Y2
%}_^cm;
ComboBox
]?jX
WR$
L K1
p*b
]+E%]@#[
Tpoibr-microsoft-com:asm.v3"> g
a,M H
^ Ce
=6/
w//c~n
tmg
hqegerSize
A h/b
"m"O
B^<g0hc&J
L>X@
BitConverter
mt{m
a13[
*}3`7C

f< O
G2C1
?79U
GvfZGdbug\service3.1.pdb
{+I!.t<
j@ q
qW5|
BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl9AwOoMeLfQ1kxaXTgsl0kXzydNmnMXMezmddcCQR4
T'[y
x.[*p
oU+(Wk
K/p
)&H+
( "
z0x0:
n5`&
XB)H1S
]>:}
dF@T
{/|&*y
vM%B
F<S2K)c
9 5E
(]@ o
A*eH
8,4%)W1:/
: K9
^ydh
_~EL
&l?e
m>y=
$SZ[W0]!
j!*\&Nh
9)s a
#o5h
R:;B
vl~vjcutes
S_1m
|5p9
[2]>
:c l
+=s d
#y>D,M
];+3$p
Q3x+>
((y o
@21aPJ
3 <
VirtualAlloc$[
Bfv`[
mI l&
wY<f
n\X64sI
|7d>
:0cQ
n_z!zv
7f6T<
J?.`
5eCw4
h"#0)
q l
AS7
#- %
c_"U
J P4g![3R+
@,Ef*
^u,p
Cg%''
, M G
?,*P
J+l!M
1JmT
C:?t'}
x2F7m
)g0 C
tx~'g
i#k N
add_Click
VirtualProtectEx
Y"S c
kdZ-
F "t
S3t9U
oS#
KE#}>
?`SD
(B o
Pj o F*b
w G J
Mutex
R+l!b
IF\=
SizeOf
I['P
xm8$
Y,%W
s1;
[D!q"
JzRH%8
AbD>q Z
EXH =
`znF<
D5 %#n3
WeLM,K?
fc [P
3 pV"K
ThreadId
~8s z+
CGO|fbutablePath
~\^;
U=|W
tFGa
buff
A+E&t3
f5s /
components
?2
d_5J
Split
cLjI\
r)=\
AwOoMeLfQ1kxaXTgsl0kXzydNmnMXMezmddcCQR2Pcb5dsLXi6p85Zok0QoJzeFS2LQeusnuClRCa2grcOcT88
'gM)
B$O"
U4@|
x" ]
k0i0$
A+px
7q's
>TiG
E a
@!f+G
QZ W
Y12 %
L=#@
'x,w
R$x)L
>(g `
j@C~
B(F%w0
Eq]9
_lgO
TRx?r
)<,TV
ToIntege((G`cfq
b o=z
~1E,
R M3
xx n
e?v'F
V> #
Form1_Load
G-#@
{|mmm
d6 ;
Gz,>?
CompilationRelaxationsAttribute
j=jp
\:L+q9
J@n*
XB( |6z
l^:h/
os?<
+y)z
!,t1
T6}.t%u
gg`M
-z|m_{
PAs)
m&yE
.7eb
z-X)s
G#J+p6V
SuppressUnmanag WUfbgRecurityAttribute
B!W:
mO N-
L.2p
+p8Y
D".M
?k1
ReadProces%wyfiqx
@:P1H?n
y d,
tHJe=
sy,V=
wwwwww
Thr3[xXrbst
f-~
Yv\%G _
#!C+
qH@`P
<d*?Q2 N
W;IX
7p:;$L-
<?xml version="1.0"
u/E7
*.~#
7C3j
u/E+
|&N/H
*;'h!
]ND0
)!Du
W/50d]
*'Z2
z h O
r V f
-C1_
8=-_
!" [
YQ-\
k;Y1 Q
i7][
e7T;~
Pl5fr
J G$v1?W6O%n=g*z
:XL#AS
IEND
#)s"
V9o/X
$ ] o
XM`[JZ@iLJTnAG4
J 1R
t -qxM
+1[7U
c"b4&
j $G
)P2y*p#t
%7v M
:/ J
/";{
)S2z
ASn<
jE 5|
?l72[:=Z
'A#K
H)@H
context
9yk$
TKqG
L6_9
P=4u
address
nl{O5
BztW
ll+D&
System.Runtime.CompilerSe(^}ocp
m8b2P
!y6_9
3(d g
5:u v
2http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
3_ iu%
B!s4
6z!Ip
hS!C
P;U6d#
N-=JL$
73U S
AwOoMeLfQ1kxaXTgsl0kXzydNmnMXMezmddcCQR4BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl9vI9DLpxlvS0XMdiZwMGkcM1SSfGc5I7TiLRSY6tGPj9LU2
+C"[
kr5N&G>$
h>"2J:
=n h
jKv'-
~Hmk5
l" Z
CMKNRd@
e.aa
K&po
}l ;
y_^c
CP<i
fhv4O(`<W
I_cv>
z=&U
UZXlH/
wJVB&
J;A+%F
6e?/
)-$Ew
J%$JP3
O@-eN
DialogResult
P<t@/f
o)1or
lATa7
*.B,O
$x`y
|}n`q
{7 {
[J <
ZQ*O
U7_8b*K y
progressBar1
c9?Z
WEd
:j g
get_Modules
t#p7M
'R
https://www.digicert.com/CPS0
Ek*sgssion="1.0.0.0" name="MyAp*D}ogwhon.app"/> <trustInfo x
!!6Tc
CompilerGeneratedAttribute
8IIa;u
|.t%Y;S4
EwiD
]q z
set_SynchronizingObject
contextMenuStrip1
H(@%
N+%o
4~iI3
GW+
H1l%
F kH
nt+_/Bh
" ) A
currentDirectory
K 0;
1~Fj
D}We
il+?
L$J)
>{ _
z+F&
YZXQ%=
r+):g
;'"mN)_
s m<J
K<M,%
OV7Q
2}a`(v
System.Text
O,~9
B!8o
#*y#R
,y z
mYmphKXYBE2N9HSkhOWR7Ff8Mkhm9oKZEDZKxgX.resources
05d}C
\FFG
76;h
4X!1~
%,Ls
{<n?u
System.Resources
J@ U
set_FormattingEnabled
r)S}A
3SSr
h t)
M]_<
3( &
7E-L
I8 Y
Wa3,
F+~ {!K<o:}
).gn
l+w;.:-W
1(Zt
Yv~]
WindowsPrincipal
Ew X
F g1_
[<a7
z>Gh
l;(p
P Z h
Microsoftt
\n;
| w
#g r
g e X%T
QX ;[
a)s"r
( B(-}.M&
K|>d
{!`0B*9c
76i7#
Vw HgrsageBox
DV5T-Oy
`+x"+ 'O(r:[
&K%F
7G L)7
^18#6
FSVW
3x Q
*x+R
26%8
E@QD
c -P
d>o?]5R
i:Y2
A1U>Z
bR(
\k7lo
lE`{M
x =_!d
WY:h/Vn
set_ContainerControl
%||&
8M<f
7k :
}g\d
n]he
vX-\
w*ia
3W&K
=h0~
s)xi
;W?X;m8$(D
/V%n
} ( /
c T
www.than.th1
$6u
"u0b
T|[
fpp&
3 h
&}6W
o5_1R
;c,N
*f8S
^@;b^4
rrrodS\o
#tZQ_k>{
^ 6C
s)C-
M+vc
>$N C
v8@Y+D
7D W
~:~4V}K
_ V Z9R5o'F
Y*c&
N;}1 r
IK~
!;yP8<
SesumeThread
_CorExeMain
DebuggerNonUserCodeAttribute
V:c
]E!{3R,
listBox1
]-7p=Q
d f0
wouhAYheV9O2XihlPUKPfrVzH@
6Ld;1PdtThreadContext
N-F!{3R D(~
iI0"Si
5 xX
z"(5z
{pbM@
m ?)
zMWhn]
8Pu}
/y x
Rn5j
NtUnmapV
.Eb
) pW
-97bh
P B
Md%i
YJ+V
WrapNonExceptionThrowsi;L
\t&iC-
S;Zc
p, Y
2' #
L2 ^'
RetValue
?=G/
GF)K
EH$bxG
(9V:
3v3y
NWL%p
`$d6
VW<R1m
EditorBrowsableAttribute
]v?_
6|5U
4?n>
+J @,z
wwwwwwwwwwwwww
P{{3+v
P8{
*N8[
Keys
Uy&-?
A2/@
C%u&
qrocPersLOC
%, ~
P1v;W
J$|r
iX ~
ez%I
I 7BpN
iY3~ h
iN q
J^ 0
z8u B*
$XFZ
ZxQ
B\bmD
h->S
zqz$
$n>z
" 3!K
Zn6hua^
GetRuntimeD
Start
~]V3
O+ZejN
Load
W0j"C
p/M6
7oRke%
3lVIyTAS
3{$$
HtNm7
oz#z
I,lm5
System.Drawing
M9Zw
jji\Y
au`nrlib
1:s h
pBG(p>
S3Rq Tfrerved1
K# g
8=6=
5#V'}v+|`
hP(Gwiup
9u?m
M"@(K
J<#C
:c.B,9
0G7^
ALB1\3
wfotProcess
Q<)I'
6(z u
J%CF
&, (
Re?@
C jY
PM#\}
b n4
h>K:` d
"SQ3
(;:C
Y;S
ProcessId
Tx'E-
^6"S
V85<
"3]5W
RS`/"
8+oC
~4 M9
.6id
Writ
,U>Z
7<.t
vI9DLpxlvS0XMdiZwMGkcM1SSfGc5I7TiLRSY6tGPj9LU6BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl5
X:Ru
w_PLX
&nmIfF
n<'O8/
{ oU
ISupportInitialize
aA#e)D
N.?V
3;J
r(B9
E;cM
=p"s
F#J,u<\
OO+&JPP
Ko:)
!*" Ig
whn}
t+bu
dv<w
o#z3
vk0m
?t/2
~$l
@lj"
U/G;
Gn^Jc
z n)
GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb7BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl9
-y$&
t"v*:x%
domainUpDown1
qX/.
.`}*
@6K]2
wK>P
%IIS*
/~+]ru
!e4K?
B9)*
#v ;
p>\]
SecurityAction
O%K@
<X^`
FYg=
H_@f
^'iS<\
I&vt
sKCl
:^(Ks
V3F R
0c5@
1PmZ(]QKB
e2{D
}%m UV2
6ZR^;zq
3System.Resources.Tools.StronglyTypedResourceBuilder
fsXot
set_UseVisualStyleBackColor
m&u/~.L$C
GSt9w
60}p
#i;b
I1ds(
7a M
r z J
&k~O+
$7>V1
?W)d
DigiCert Inc1
+FER
D0d?i
`@B
WI(L
0_zdI
{Io!
{?*9? %
]W/N?l)8i
P:7I
Y1t;m
#v V
N.Ny
P!U%}
qJ9V
0e1 0
2(B,O
d :W
aV77b
0NU%
t'O<
EditorBrowsableState
l sS9<
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
Q3Rg
MethodInfo
*bbb
hdmO4Q
!*(30i
CultureInfo
2Zs(
||:I
I8B(
~9Am
oM<$G
*C r
-` Z
StdOutput
V7fT
5S2z
/~Ar
O# } B
-VyY
K?;#
%l& ?
Xx.[*=|
xz*z
W7: 5
_{ a
*;f(
lH`HZ
p`-
Jnod
O%w(K
%$G
-E:
C1;
,]%2
:K4g:
Z4W>4R<^(Ku
*0X|
y/2C
sRGB
s14>}
nN$
IsNullOrEmpty
~B.m
%_7V/
c+- f
i3&]O
ZqFHCm9
#K*S"
-}.M&
y6X
g~{cceContext
j't5
Q\TM
v i"
X7m%
Exit
v-_);i.
RT0Dx
:C!jQ
:C\K
YTov
u84b
SYQ"p
T& U}$+
yOJj
[/>4)#Tk
r(i9K#4n
,o>q
t:\qG
X, S
S(LL
\/O
2|H]XnY>
get_Culture
}-+ ,
'E<
add_CheckedChanged
I"FSX
m2b9
T7$ +
Pr9PyhrG`ta
<w;C
n(*3R
conff
f5]gn
j+pb
8!j
ResumeLayout
$9l>]6R
nXKa
Regi
r2@xR
i\Dr
p;h2c3Q9^
j= (
2)&G
{){"t
lfp ?A
n4|
nCs~
]r; =
w(e _ {!K
process
3RD
In"jhy
b`X?}
C j-
XHlO,s
2H2h
>W 6
tt+%
kXQo?
7f6T<
(Hk)
OhJ3+
L%0C
commandLine
w5y?
>#Ic
q% $;
"! </security> </trustI
ssQsX
v*.:$
System.ComponentModel
K(~{ P
k?No
.F'^ :i3b
K`nZo
ErrorProvider
y+>(
^O{*u
< V=
-Z^Z
Yp8Y
[3{r
nlo="1.0"> <assemblyIdent
%6IDAThC
( a#
KboifestResourceNames
|;D
6mZx
~U6JgK
Q{N 3
?u'$
,v'w
piM&
xpW
threadAttributes
e!o/
Y!]S
LM rnv0
<[/OS
-j'K
4V>
aj0w
79"P
)uFPLa
]7Z:i/U=\%G _
System.Reflection
r]H2@l
qCpx
ValueType
dataGridView1
k/E)
%I-w?
>l7^
PW#@
t4w1}
GetProcessByIdyuwhpeferNonUserCodeAttribute
sIvx
g irYp
WlP5
^>kB
S*0q?Q
XJ%C
%~6W
PQ a
S|"O-
1Sp51
z'v$F.
5N{4
XZJmoIVuJti8RhQiDsK@
*q:\$
A0_=
?5C:
baseAddress
GetMethods
0!L.
TeEcQdction
YkWU
$L+qN
mnHk/
?T.F
QC(9-b
MD;I=
Q+C"
^$LB,
0~ {!<
\[/N
\w$ hB
e}ruvw
hmeAg
g5_F@#
6 ca
'{ppNIlLD[a-
;FI]
O)YnT
ZS4
bgywjcute
5]?m*
H)h%I
GetTypeFromHandleanr
|j<~S?`
b#~/
)S;Z#
iW*s*A
[rEK@n:
Sj`;\
m%Ysycf/dll
SW4i
E}7q=
Tl%E;v
kFK5X
get_Mess
Ag`(u
bytesWritten
<N_`7AJQ
n/ "<}Xj
6ot!
&,&u
f?o@
] &23y
=o6]
Rl|4
+s$9
"$iz
N*Aq
T<;a
A+G%x@:R3J\
L-T6
d j0x
Q;U6d#
O]2a
b9\=z
V;Wx
v,F(K
get_ResourceManager
@;T&
|e<g
9.[*
atIk;
T|#%@e
_/<p4}
c9S=^ K1Y8A#h;a0`
+H}$d
7SR1
i9y D(
Point
X9 t
t~/r
]h8
r \S/h%I
length
ContextMenuStrip
6m<`'j
|7O.
v2.0.50727
jUd4Y{
C5]<E(d7m
vciJrl
\%G Z
K'N'|3Q
get_Cur5Xtx
15eE
%G _
Ewi>:
~=:@
3Y8&
u (Z"
ShowZ{m
20+zwyv
*|klj
Program
\6W4{;
JeB k
SH.<Yj
3J?F"
lmm.[
?:r a
Q!oa~
rJ
L a X!3x
4http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
C)I+z>D,M4~6f=l<^6S C#
-R9~
XP*?t'
F!{3R
^E z0
u+F&"}C
.(e|
)|,\
n<{~.
3w u
"m@0C
g75]
Exception
U3hV
,h<3c
]S=^ K
8Ms2
8VX-j
S(P@.
t3~'k
]?Pi8
h(- 6
$a.L$
!
get_ASCII
uKYt
~T/H
N<x,&
T bn@-~
_bDF+
BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl5GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb3
Anti
Ogc,!
x?%M
~O{D_
$!6
7| :
Q3[>e.P
G=U4M1{)t%u
GetEnumerator
yd,M
B
Eo&G _|x`
WdR Y
?s*cz
#Y;j
\a3B
Xj tbsam
-H'E
BK8{
= (M
Ri"&q
f/]>Q3
?e-L
;Y}c
+SzI
O1z)s"
3D|hvhmeEnvironment
O,D}
#z2H
n=g6{
#} 9
hv9 H@@
Zf ~
^5\@
1lLm
~%:L
1} @*D'
1s
160823113108Z
$L t
4q}}SZ
=4Uq:
{v-}
G'wS7a
7http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Owe-L
{\h6ZGC
)&?+
@:R
3Z5W
PV Z
Z#!j
M;[I"W/
z(( C
$f \
. @+
((} c
:Xk7
~(],
]&/}-O
y =`
L57|
q:i3r
-FO^@q
^gia
yj(E
Z(
Y`.t%
[NP;]
& )*
L(R%
3i8h
B d
&lN
O%K(z=G/N7U
lg28}
ApartmentState
G k8
2:p c
vyxuY:
O'B' ]
z,Y(r
M(G%x
:_5[
sC},
@ a7B3i
$ 1C
j}@)
0YrK
1T7}
add_LinkClicked
z;#i7
v o=z
X=~m
nX}3x
System.Runtime.CompilerServices
7q t
L!'E=
*R V{
T@_T
!O,|;J_>7U
Wz&,
Z&E*
;*F ^E
'N+y>
Q4]:`(I
QL)$6s
*9HSa=
h.G!"
\ e
:u e
button2
button1
ggQb
O_JZ[
u [w
Mutx
checkedListBox1
pO E
checkedListBox2
Pcb5dsLXi6p85Zok0QoJzeFS2LQeusnuClRCa2grcOcT81g2LXkawD2MUmQbNVYhiVA6TcCQcKy3YY1DdtrU4HRzDC7
h3$
m7]$
141022000000Z
FpK)]
|/o7q
K v{Zt
b0w e
LinkLabel
pvL<
_x QdD
_K.-\
C `sF
xu+A
iO`l
S=k[
K3j<
qQID
*/E_pVEsObO
@}?Yw
g&n2
3x 8
69Q|
Ry+l
9* 0n
cMB
System.Windows.Forms
1w w
r%QY
p)x(G_
1R
|8l7f6T<e
_E/9
O5]<E
OncalMachine
i;|
.b2d
9X$g
bu7{
mc*A
IDisposable
O1T"#h
ty}~y
Exists
f![3R
/F*K
OE_y$v
O%,2}
DigiCert Assured ID CA-1
e(<I
2 :l
mq`LU01h
6(q 8
x<W:
. 43
=m7.
+QM1
Nv4'
Y;q
K!/L
U8Q$
H"@#qK%@!P2y?`$t
4Z9k,V>_
Q*N
Qpfx
2Wg:
S1Y>d,M
rQr(
r*L6
%8; 9$
]i1
Dl4[
ynl%
0]4X
4 hh"
m@~o/Q)L~
O,~9-E$]
)z,w'w
4K)l
6?f6o|.i
:6r6|
Dr\j8
rS GX
n6b~
C8\]
<Module>
[9f&
<b({!p
$frp'
#h;a!
v,F@
)Vy<
ProcessHandle
;Tn<Gm
PO%
Y( c
q-M7?
S7E_,B
t%2^
Q0w:V
b%9Q0I
:d c
38 c
L m*a
qR?Z [
E0_=
$ lo
8/#|d
aIf(
T;;k
EMb3
%DW6~
/M%B
_o1[
O.W5
7t S
C iB
=m7^
DE&m>d
iamKv{
Zci-N
x!oT;Y
2CTH3
*^fj
OT}{
H*B'~7W
O-Ea
kukg
r5b|th
+d k
*~(
)MJ#E
dr-n
e:@(
I$Un
2D6Q
p[]po
W%#W
7 ,l#
psSw
i.c
Qv i
b)8d
c#@}
}&,|
r sA
-jJI
uwI
K;dd}
A ~
Q @h|
!E"[9
s_M5GD
# xO>\6X
0:a:k;Y"
u'iB
I)Q3x+q"s
i?=_
m0"[
NjmO
vflv
B#N
/E+H/ 3
j72
Or o W
%8lw9I
}E%D
@/q*
Spe ^yfBlmder
K(j
,&.=
EndInit
QrocessStartInfo
1Mm jl`der
{p 2
L-j'K
rmVE
PQ!|
i3Zt
{7V?
b3``
)\-w
^o
G2-L
U/:]
L8R
+J oI
~i%Y:
T%!7
V"J+R0{(r
GOOfLvqUljQ95lZly0wkjngHUbkpEGz4LyHeEeMhCVTggb7BiQHdyEv8xflp75G23eJGQUI5Hur3qPE58HXQaz3ZqWotEl5LowjcEx4YY5xIfN34h4JOr9x7E9ECohPyUwiwiSEN2FUPXTQT8
c@.u%e
*g{I
G,B!
y{ P:
o!63
GG_=|AOY
\>)e
d:3 k
*8b3
;|0k
DnT?
jCyl?p
`"w%
A?Y9A$
oZ3Sc
B5W1
\>)|
nqflOldProtect
EventHandler
<y+r?6ao
Z, M[
mscorlib
Thread
w<5y
$-\ W=S
q7Oc
D`:o
d'2|]"
M#ACAR
2{~Kq
,U jsuH
P)5
!k[B
c46T<
ssThan Section1
admin@than.th
Hx:l
Encoding
nq+c
l!Ad
-*&J
5Kr;Y
" A.
K!O,~9C+J3O
w&H2
%RP!
] ^sX
A<:l
-uE=
@QU
CheckBox
V4]=
u+
jqQ^|
7e#$
_[>-7.
_@7j
-yLi
0![:r
*D'uG3
{(r$?u]
+^u%ap
IDATHK
z\5:
Y12 9
02\d+
r1Du
1:y
tq8r
Y}puem.Resources
>$ 3
t0%h8J"E
mj"K
colorDialog1
~ z b
R<S2K)/
9Xdg5p
[ :X
v0t08
nev4@
MUP)
sKX:~
*x*k
{|u:
D&N+r;[
?s j
N-F!{3Ra-B
z`gp
J.uz
SetApart
Ql*Q")
z?>;
CiFo
J+n$I U$~
M<k
r$g r(z?z?
sp m^\
\?X
Ge.xfcefrsesByName
T'T^(3
SWui_
Uy
@O@)
*p8Y
errorProvider1
LMhP
v|I
1 0
h.i
dspr)
k"M\
LOOw
K\rs
'{}+v
{\:
36t/
093 {
ToStri
n_\{
w4 miE
<:6Z
!3i761>4
j J$
B"D(
U,m.
&6f#
L j|
b%N&G>p
#xVRgTMU7
mscoree.dll
fs2f
(.p ;
e2!L
\yk#r6B
^e.P
8uMz
R3b&]n
"+9i
<phP
}(aJ
(],v
wM %
`)A)N
,x||
k8l7g
TsPNX
X01H
n)ntt
^3P]
I:,f
V,D%t
@f Bj
4-)z
Trimy|}|`Ldxt
Ch{C
m9S=^L
tX d_
^d'"
@0 3:
Concat
C%P)F
+D$I
DC1Y8A#h;a
)1} i
7O.}
vYV r
_Dnf
*X+5q
StdInput
[8+l
x(:R%
1j q
J-x(eA=p
System.Drawing.Bitmap
"RGI
WL,b1
!vXS
&*&
Xo2W
A0j{
%s9k
* .K
ZD0_=
M1hW
[Mx.
F g1
System.CodeDom.Compiler
Ezn+
jAV8
GeneratedCodeAttribute
disposing
)FvF
H2Z;BP
% \]
'hF>
set_AutoSize
2(2 +7_
e p!W
}+|+l
V7L v
:Q@`
A0j
:<LD +e
!3p H
=IKL
!`jt
I!#=
l+{u
z/,)
Q Z
z1,t
}7!B
r i"+
54nt
/F7@
`+x"s#A)N
IL+#
n N
MsgB5P
@1qu x
w!T%
&*z
O(r:[
Yt=j e
F;@<
nq-@,

#infosec #automation

TheSystem Itself @ 2016-08-24 18:27:01