1

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 16/55 Related 2012
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 321.39 KB (329104 bytes)
Compile time: 2016-08-24 02:27:56
MD5: ee6c06a31c6daf83adff3030f3b3cb64
SHA1: 6e16f1388f45f8e93be157627808adbb64ecbba9
SHA256: 62b5bf662efc5abc1c33c6d495b1a3f4943cd10abfba9c421bc8763c7830dfb3
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 4 import resource relocation security
First submission: 2016-08-24 18:30:02
Last submission: 2016-08-24 18:30:02
Filename detected: - 1 (1)
URL file hosting
hXXp://boksring.5v.pl/1VirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2016-08-24 15:40:06 [16/55] VirusTotal
PE Sections 3 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x260f4 159744 6a1fd82ec40bd1bba93a6c0888ae5e83 7c0e07553202bb152c5c8aa9ebc21d7d28efe434
.rsrc 0x2a000 0x25032 155648 fb05c6d8395895baeb0c897da979ede7 2f7c00fbb87c7d9a8a5e53ac235cca2a8e848279
.reloc 0x50000 0xc 4096 5e554ce008605b0dbfdc441ebe990c3c ac787c16bf8f4003bbd3195257d351091a36367a
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x4eb38 1128 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x4efa0 146 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
No Meta found in this file
XOR
No XOR informations found in this file.
Signature
MD5: cd65e47ce9f6b51c5bd3ec8d7aade32e
SHA1: ae12c15b114cb71a5109543bb4fca521c8f661aa
Block Size: 5520
Virtual Address: 323584
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
ku`oree.dll
IP Found
No IP detected
URL(s)
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
http://ocsp.digicert.com0C
http://ocsp.digicert.com0A
http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
http://sc
http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
https://www.digicert.com/CPS0
http://www.digicert.com/ssl-cps-repository.htm0
http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
String too long
DHKnzaugrcafopHNQ8FVXL9hW7ybMP1dISerAqIbN9kcnkkeNh5Ihrr1jBq4RqD1juvmpdksP279gyu8
Ihrr1jBq4RqD1juvmpdksP279gyu8DHKnzaugrcafopHNQ8FVXL9hW2ivp9AYHaMluQM9i5MHZVJyFC7
nableLUA
yIfIdle> <
> </Regist
GcfdOIOGIhIhg97qu89GAm
lZ1HGtQw1Z4xlH
gdNJUF8XYyZP0bB4u4XOflUBI
lz7d2GSVVOkpk6GEDNyC
aybJPLA7xINwSue2geWGE74
onTrigger>
YdXKEZtsG2oTC5wYPyWsrDpu
GisableTaskMg
icrosoft\Wind
serId>[USERID
eries> <St
le>false</Run
-25T14:27:44.
\System
e> <RunOnl
strationInfo>
USERID]</User
domainUpDown1
\USER\Softwar
ifier & exit
notepad.e
>InteractiveT
vbc.exe
qsion
pals> <Setti
eSettings>
cipal> </Pri
CXaBoFyT9JbG4bJ9uPK1ABf6vNU
OnIdle> </
,/KPip
label1
tware\Policie
riggers> <Pr
Form3
Form2
<Date>2014
"1.0" encodin
checkBox3
.reso
</Task>
Level> </P
<RunLevel>
QVRa4MiADOnrUZiALBlije
CurrentVersio
Produc
s>true</StopI
b3b633e94a5d8fd0c788738507071d4a
FileVe
ns="http://sc
stancesPolicy
d>false</Enab
crosoft\Windo
e> <IdleSe
PT0S</Executi
> <StartWh
lowHardTermin
wiyBiM03JTYnWtn7gZKUZmp4z9H8wapv
/ P6pL
olicies\Syste
Bsm.exe
checkedListBox1
eToRun>false<
cFe2xNIwPZzjYYrFLn9wEu5kYC9FbjkMtgu6
<LogonT
AppData
VarFileInfo
Triggers>
xpJxATOBWUEDt1BIKt99
CATION]
vailable>true
Option n1nH8VtyY64EtncJiDhwm613 is not available on x64 Architectures.
service3.
kXjC70ToRdzKG5E3Pj
UaWNuOyncmV26XHQLUKXjZKkyv
xpJxATOBWUEDt1BIKt95
xpJxATOBWUEDt1BIKt94
xpJxATOBWUEDt1BIKt97
xpJxATOBWUEDt1BIKt96
0kZ3m0BQXj9GIzIBkH9hr0qf5jJxgq0
fgalCopyright
ipal id="Auth
<?xml versi
button2
ipals> <Pr
_CurrentVersi
button1
YIwtRGYPlVmy8aRfuByfVRzCiKOL
> <UserI
egistrationTr
acpSettings
9027</Date>
iQhjpZLZAWNXAAsqkaxQLv
checkBox2
<RunOnlyI
M57d17Pjp0Keo36MiYxkd8sB4LA4AIBMk25h0rOUPVQaUrUS52
opExisting</M
CURRENT_USER\
n</LogonType>
eNgmfOQU6gk64sDigwllER54a2v
topOnIdleEnd>
e>false</Rest
OriginalFi
xt="Author">
NetworkAvaila
linkLabel1
gistrationInf
uaviALSFrCcAQZauLQy5ZZpjn
ngs> <St
k.exe
ONPRlKaclxCEOu6Wgs9t
comboBox1
gUjFXPYjnx6TaXPWLGyaEf5PmrQPdcTnh9
/c echo [zon
0PzMzI6dDc7leF3SZK
sf46
m5mVP11M9ulyMzQHktWuMgL
d>true</Allow
jce3.1.exe
Author>[USERI
ersion="1.2"
Disab
checkedListBox2
/Author> </R
"{0}"
Enabled>
Solicies\Syst
wStartIfOnBat
lowStartIfOnB
xec> </Actio
mternalName
checkBox1
cmd.
Fiddler
abled> <Hi
<AllowHard
4g44Y5GF85HFG
dataGridView1
GHFuA1jj3pKCK4M9P5xT685uu
AQ7iGEquSspTYGxwZGycAeemjoy7V
:ZONE.id
UTF-16"?><Tas
fNetworkAvail
ies>false</Di
ionTrigger>
e6LqcD0zGhe2UHpqZUK
StringFile
VS_VERSION
fGoingOnBatte
IPINj2sIkGwpQzYMkeKI6v5fGcx
contextMenuStrip1
gonTrigger>
cutionTimeLim
" /
svchost
fUudXNj5uY86cokCpXx
rtOnDemand>
<Actions Co
ilQ2DGgmfPLC6FNHZd9D
E5cU6HGhr0WuaFVNZZXQAYfRH
acpSetting
icy> <Disa
RAny use of this Certificate constitutes acceptance of the DigiCert CP/CPS and the Relying Party Agreement which limit liability and are incorporated herein by reference
nIdleEnd>true
<RestartOn
ty> </Settin
schta
S2UuMNqZU59f0tvdgLy7jCK
Translation
AxDeJPgQirvY8sLogi9yZ7qzXY[
Assembly Ver
/-P?pR
stPrivilege</
>false</RunOn
xpJxATOBWUEDt1BIKt98
> <Multipl
llowStartOnDe
Form4
2 >
HKEY_CURR
UtrRrEI2MnOXWctYui9AV6
WAua9FQq4EAL2GFBZrlpVtzR6ks
AppLa
F PRO
jcrosoft\Wind
ipleInstances
phark
"Update\
sbiedll
ksTllHoKx6xpcaZku
[USERID]
ansfer]ZoneID
ypAV0O8s0aKa2YzLL9XJZKpPLy3Ix
bme
/Command>
DHKnzaugrcafopHNQ8FVXL9hW7ybMP1dISerAqIbN9kcnkkeNh9
Enabled>true<
/windows/2004
SOFTWARE
EADbSZbVL8YPEAAwkVl36L5KinPuV89
mand>[LOCATIO
4z4FM3SDwRHhUy6Sk0yVrLqKt8r>
listBox1
imeLimit>
keToRun> <
/Create
ocoex3aaqL6lS32kPC9kMDLv4
FileDescript
000004b0
UserId> </
2s2m42KfeAVtO4UfPQl6roqZhJ5
as.microsoft.
n>false</Hidd
0.0.0.0
tartWhenAvail
<Exec> <
CsASaY3wuRd2y6oSP
minate>false<
iority>7</Pri
Form1
progressBar1
/mit/task">
ingOnBatterie
.exe
er> <Ena
<Enabled>tru
^cr@urrentProcess
h7:I
Q%//
H$ch
$_S7
M Y,
BadS1
0Sd\dS`Xm]jZm\8 mw
S&7?F~a
|5's
$Q|x
PNG
{ml(f
HlW4
6m8
>z:@
oXkS
-J5\
lR_#
mlTw`q~
hJ=B?
H)Yn
DHKnzaugrcafopHNQ8FVXL9hW5M57d17Pjp0Keo36MiYxkd8
2HD
UWhmmU
4au|
CompareMethod
$n:q
fS?|$/
BYp_;
rO N
threadAttribuC}j
qU*L&
qB{~&
wGYk
<X
SB6h
HRzp
]>B6
InterV{moim
@f%?0
Xl373-E
UnverifiableCodeAttribute
hq3#
8 mY9F
>KQ,
dSit[m
S1wx@&Br
jZq1_
HMs"p
P}$Hi
> 8\h
JcrBttributes
zggC
1$^@
CompilationRelaxationDYmrtjbute
0 3}
8RaV
e*aZr
Fqf-
)!PK{tU
JG?!%w
L}+~S
i47L#$
Twtvgwible
j :Y
go<%W.]
=PKi
wg.-
o-a+&
!OIy
b138
<s8 x
S24mW
Culture
.-/!E^=
GetEnvironmentVariVzuc
aft_StartInfo
/fHi
P8SR
@g%
ZfW3
aX*yvvl\
Q1D
7V~r
~e==e~z
]Y.)
+V:1
h'^F
iD4N
Km n
/ mr
Kx@ua
path
`$TU&O
s#G
bDr'
}@sK~
gEgq
TZBv
w]x\"
t ScS
XnCkE'
!}y>'
w(Ooi
LaYa
Cv ]ZIa
)lr/
9ZmU
HN-3r*
* A^c,
/<}( z
=OiS
v0t08
Reserved1
CompilationRelaxationsAttribute
,--*C
ProcessStartInfo
`n?9
AtA%Ew
Z5Z_[
uDwD!
op_Explicit
`nj
typR
2*&>
System.Security
U [
|hG_m@[?
%54Fh
~?[o
*2VfQ`Ua
yI@(
Vl[h
{(N+
G >
sqgdx\
N}WNIl~
mscorlib
I!l\c
WD6G
ha3G
&*z =
,,ZQ
@JG{
,w)
M^8
l=1^q1
\H'f
|=^7
yd\h
/Ks
.$<e
)@Un
Dc1L
|D"Eu
~jauk&
O@2
Jsnd
lH5*
^^<
DigiCert Assured ID Root CA0
D ."Ds,Y?
j]6I
E{)y
EnableVisualStyles
<6x.E
:(2U0
jZ]lT
VDByC!R
8"O^\
+&,0D
Au]
z^ '
DW[N
LHxO
<Xh~
[7n"&
9#QRX
XC8N
&+E
m5;J
S`Q5>
cz Y
Q(bp
G? J
ListControl
;d"F
@1'<s
^Szp
s>z;_
YF#=
P y
*~?c
L)E
MiN>P
&+i
Format
KIDATXG
pCj1=)V(
0hjii
$#LiNF
^o_s
9_;
O8GxK=
_]:}R9
X{ ?
=tzob
nni
}j0f
$j _$
AppDomain
==}`
Fnn>6
^! H
ugWp |'
>VX%J
get_CurrentDomain
DigiCert Timestamp Responder0
checkBox1_CheckedChanged
Qi\l[k\
c%qU-V
A& A
&+!
/)q=
cN"=B
C!Ci>5+ *
Yl2tS
H3j
g:p)
uBnYh
^|m%
2X Cjnu
z z-
;O>)*
YElU
4pWy
-eT'S
] zC
E@#if
&lQ|?v
XT<B&
zOWJ
fe2~z
@N]x
]+i
c>/#
oa?
(wO$_
8"!#
g:Yh
BU':
+ eA
,_Y@
2JZB
H>q?
\~ 6
4 #[
l$IL
I 'U
Path
set_Text
@[F 0
OU}E
gfjB
(o:R
@n>Z
.b^ i
qI|L{K|
LinkLabelLinkClickedEventArgs
`\>:c
Tw[H
WindXojDsjltInRole
FXX/c
06
9c2C&
*N+
k_}VS0
$ />R
7yr,
?&"A
w!4q
#Blob
Control
Pystem.Security
gN}E
87Em9Vi5Fq8NWLgh3Gld2Cf2dniGe
+ Edr
FqAv>)\
I^:*
I9F
@ 1
?
O Y5
DomainUpDown
[LPmy
hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
n3BbQs
RekN
xKt,
]<m@
OphK8I
6P"L7
v A-l30
sKYVVUACzkxRUgcJyjWCnv
38?;B
6qXk
J_h{kU
=TmY
+!w_Cu
NwF"
w'$z
Type
u f&i
/x#U8
k_> o
:Czwe
!3>
922i
djP*
6> bD
|A@5
'^ ;.mO
)TNE
2Cy%
Q}+2
2k/N/8
O17U
ol;;e
MessageBoxIcon
R0cl
(UNa
Iu)R
Uy)v
~o`]
<9+n^
{+ E
@yI(
aZM$
e0Oay
4s]cO|
`D`9
vg(o{O`$
*1l*Z8
<^h[h 4
-kGgC!
^fNI
'yPR
prX{IctpPID
+ a
S`ktMy
Il$)
#cEz
?>V
r38$<
#kkkr
Sl<YC
$O:
NF6j
GetEntryAsseZzu
;hT$
w@sK~
4O[,L
VDqxY;
NT/=F
]0Qb
hN@i
P)w=
get_Name
\Y+0
Q?k;
Hat Yai1 0
B2f1
,<qthe
78W^
|F2Oq +
A4Z3P
service
j)Z~
JDEtR
@">e
s@x@%
&,N~.
conff7\|Etzpt
neP#
<(V7
$qwv$xB4_
.744
-Principal
F5l$w
r)2N
%r6Dv}}i
wle"N
DigiCert Inc1
/XOR
IDATXG
ColorDialog
_*N2
get_Controls
VeRa
f(- q
G 9=
O|O*
ISynchronizeInvoke
-Qzp
D0QK
G{_;+
S{C-
^Ht
={6U
@^JX
S A3
K )-
U81G
StEqwa
pf~;arr,{5
JvID
0b1 0
1# 4
pgma
ICVa
M1 ]
%/bQ#
/$! U
x]_1
@}1L
ekXD!
%eJ2"
DialogResult
p,&rsqp
NoveNext
[WWo3
_Ti= ?
j,D#^
xX^Y
g _Tp4
pY= h
]SP
.text
ProcessModu[}
XcIy
GetString
WindowsPrincipal
OGFA
y4w
%,V(
p~~(
0Sd\dS`Xm]jZm\8 m
, K8G
Vbx6
j852Ww(
`UMM
jhXJ
Xj&B
W)$B/an
Button
OiS56
"@vE
)m}h
6$i5Z
(F5<
dNl
n!&
wFq@]%
$^an
E hY=
V\J*
F>VI
T A_
>-e3T@
(yan{
D4bK
$(%Y+,
jUq=
54$U5;
DM[#
PerformLayout
`k9=
4PI0
PKx*
%^39ai6
~H=>
X}rV
mainFile
HoCt
/T\\S
t:q[
r~mBt
"X P
?<W)2
GetProcessuaPb
;gV2
@"w<
EV^V
w)Rv
Sg{jz0
0e1 0
C.bpM
& "V{
O;}fjZff
<xB@>
Resources
|Ng?
F\('
LRE[
V'C!A
.http://www.digicert.com/ssl-cps-repository.htm0
J^u.f
wb=M
;pLvJ
]%Cc
Fg!F%%2
h%b#
M ]m^;
Uoye
dSI$R
d0: L
2f8~
j`av
LJ2h
*Z(
label1
RuntimeTypeHandle
JQ!,
=^tQ<
V7)M*au
[:y#
B*vq
=>|f
dataGridView1
<P`#J<2
a{2
'H`R
<tK|O
c'(W(
Conversions
O &o#
BN(/
i>7H
www.digicert.com1!0
w>F'
]|[n39E
=off
RsQ
`.rsrc
4.0.0.0
wLo %
N!HD
Fa~xZ
o<K5
}=F4<d
g0(J
g#N
e}~ouwry
get_Default
WpDtC!.
MP8:J
l_=
Gv -*
*:-_
M~Fs
kernel32.dll
dcgSv
,;.C~
bqiYJ
_J o{
IwQg
QeVe
*+Va
sethYkasnents
Td0H
KOd+
ghr
%:\.-Gm
&, (
kut6jb <e
&b9l
RjR"
FsP$
mHTd(
3}8(;
O16i
P&+y
cCJ9
xG~K{
$+i9
>bVT
GetTypeFromHandle
CP=Xl
l'Z77
o|?R
>;96[
u@(b
f#T "
&KdR%
$_`1
w_D~d
i;O
csKP}
S5Y[
3Ff\
MB=Y@vk*
zBfN
2eqe '
/.aus
`7+53=M<O2BK
f<8D
2 %
kmC.
&(Hfd
OpUW
()2F
9s~$
tPY; >
KpD%
M(S
{GtL'
7%XH
=X`( "Fg
loader
WeKW
SysC}t(OL
f."r
Container
colorDialog2
colorDialog1
|m 9"hPh7WoZV
&6"6RcSH
Fl gr-
m] \]
B[Z9w
!*q Mq-
,cma
`X"u
KsK4X`U)o_h+
UeR"
\i 1W
RI xf
Eg:-s
#+4
[_S`Sk
<roN
:yGW
j/6J%<
EtO;
sD|D+
r"f&
b?/&
U}cd
3OK
BqV+0
~I'(
qAvFq@$
(kEk
GetBytes
KX8l$
baE\^
efzF
%lW|
K bI
6j-~
O#Xn
+0H Oy
)]LR`
|ZSh*p
omheritHandles
ReadAllBytes
F@l4
.#RtW
&1tg
j.Ed
KffbYTJLcYb8MhWy
5' V
System.Runtime.CompilRjJctuices
set_AutoScaleDimensions
{Gi
NK* "
iI=\
6.*4
'oD(3 Sm
63K0
RX/5
=D }B
get_Assembly
Qm}Y
BuNQ2p
96Tg
ZBq<
kK j2O
`}}K
DCX0:
F.\
?1?`
t&")
@:d
pH.
t>o$
i}.k
PEwzcupWindowStyle
S7gg
%a1&JN
Ps0i
kf<v
BFw1f@
/<qh
N eX
='Bi@|
+]Vcyy&
7Yzt
//8
xNzR
bs^=
>JGN
Ri"&q
4>1%
Invoke
Vb 7
Form2
Rn Ah
M,{6
yXzrx
H$PCj^
(43Xo
Kts;Z#
T q?
OU'5#r
K*89
&9v8
061110000000Z
yx i
wZhG
+ nV
bV7Uf
M57d17Pjp0Keo36MiYxkd1dVH59PA09Ges9fvngprw7
}H4X
P5z r
5sP k
Form4
Vaq@
j8e.
n @#
(W44<|
,)\k._
ohbL
1]}]
4"d(*
i(>wBu
3KN4R
FnSdW
7+)|/Fp}
U6W'
0gH*
sB4LA4AIBMk25h0rOUPVQaUrUS56ybMP1dISerAqIbN9kcnkkeNh5
zuJR
System.e}
HsLY@F
-%C+
`jprcBllText
System.Globalization
\l Q
<MX|ljc=
H 1)
.&FF1
Nh! T
NyAy
jUbS
0&k*
NVS0
h ?c
IEnumeratoE
STAThreadAttribute
ty>-Y
I/"y
n^9s 3
TbR<e
QF,X
}YZ\
KIDAT(S
Form3
IHDR
Form1
; j_
Z>#!4
$2N"
kH'l
ReadOnlytwujc`tionBase
Than1
N9 w
30!nA
=6e"
`jprcBllBytes
@~A18
f `&6!"
isSandboxie
X_ dBW
=Ya|
#sIOw
'iqfQf
.+"/\L
U-K0
6v.v
NFFcV*
1tf4
fv<)$
0PaF
System
i_mI
MxB
Application
V[!q:
set_ColumnHeadersHeightSizeMode
FK ;S
`~aQ8
eccS{
T'E")7-
Htvs
MniuGUS9ufXVSM8b3Vy0
X_+SH
eiqG
4mcM
:[n
_W05K
XXVTO7X6`pbbbII~
<E 8
42^g
j&SFVK[
w:u s
X=^F
rBe
^Dck
{>t7
g{d&
ct)+=
^m C
4o_L{k
I/>-
System.Security.Permissions
G:jI
k8G~K{
Lu9
/-KQ
`cq9
)i\-
%*Hbum
zdUe3
MethodBase
#Strings
24_/V<ZL
SGG%U
H{Cv&cSd+
7VIyN~Rj
2WnZ;
(Tzr:
z:O}LyoH
k7;r
get_z}jugde
skK@
z eI?
isFiddler
CL6j:
e \$$
|b<~
`o9Z6
ScT
'C{Y
G]V(
/)f[
A; 0
Q=sE
AQ+him
aL/.
q_v?
[ <
frg>
qCVCdTsdi3L4OM0539KMn7A2Duu
-eBk
Rh/s\V
5t 9
~6Y; f
O4>F
www.digicert.com1$0"
Z(J|iY
]}UhY|R
0e J
uVZ>al
BUBvy
$L$
n8Kv
UmHLI
SuppressUnmVvxacgCodeSecurityAttribute
8 :_f
*CtL ;
FFF4
e##:Ap]
|+B!-
get_EntryPoint
8(Xn
htz01
H{C$
V\#Mv[lw
hA @
l ~~
c[=Yi >
BeginInit
- G P;
blk4tt"
F+f8
q: 5
xpJxATOBWUEDt1BIKt92M57d17Pjp0Keo36MiYxkd8
13QA V
*fEy
"{%D
Gtqay
-aH ;
mW 9$w
bytesRead
Dbhh2
;-Xt9
< 3
f4t@3
UT -8
kB-"g]J
PZ^lD
1Se
System.Diagnostics
as uM
Cq|S
.ez~ S*U
XoWo3
TAo 3
sL)0
SetThreadContR`m
.K|D
T-Km
AbY/
0vh
lX9[h <
} g#%
~7@zd
lHe4z~`
KOab#
X ^|o
260821113108Z0
K2;U
ZZZv
RF0z
e}1N
#?;4
a*Ng
iZi 5
MiHn
Oh :
< ;
]mZk
A[2'@
Cb{ \
8 8]dL-
:@ FM
FGj4
<?xml version="1
tM^~
MTTO
n614
MZ^Y!
http://ocsp.digicert.com0C
http://ocsp.digicert.com0A
I,7S
nl^H
-M H
p4:Q
t }s~q
JnRF}
F 7q_
FnhE
#B:
)y 9
GetBytRk
P@XQG
iQd*
W (Q4#3
% A
set_Location
G2V
82W(
Mu*}
07I9L
Ljx&&
w GOq\
D I-
^LvEv
C?.0AH
& p7
9S6[
X>Zj
Title
Qeplace
4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
eme==`==e|<<
'Pdi
}Zm7
ny<lB
Desktop
?#XS
p83)
<wI? @
(Q-"<
m*i
J!l)
ZrzOu
vu+qPU
j' A
GN&K[
!v9Z#eP 9
set_WindowStylR
n:V:
m[l\
Gq-u
)|]cA
333Z
uV4r
}gD&
zTxF
ONhOTC0s
{.3W
3tdj
"V"U
t do
iC$i
|>>>e}x,
[.t}
T6P`
b 2e#p
EZ"D
ifjZZ
M:IYU
sW<[
|C=i
>\)n#>
HV"Q
Sykl*
2P0uP
Pg_g
)C.&
eZZ&
Xp;b
service3._1
BitConverter
n|}%
\F G
ll8E
1%8
X)5P
qZF0
yE+%
2Jy
X,M(
>1q%
62.y
\P C
I/C
KWL613A6CXhcW3aqPoWx6TQCn66X8W3Nuw4Kxs3WhZ6cQGMtDG
UEg0
gcu}
~eWz
yS,l
'}IB6L
Form
X,X#Q
LIf
o\l[k >E
O`bf
qoX 3
|L{K|
0xG
e"r
rp S_
(F$}8.)
b"#8+NG
KseE
w@x?
J2OZ
!$q%^
%]~9
t lB_
qzV
IB\J
&WWW5Ga0
4/1w
r{Z\
;O^}
qX,G3
address
7AsC
,(qG
8 ^C
G .U
$n7vN
=4}=
Ohw32
`X>Zj
M,)e9
8Y
O'B' ]
*az:D
XrTE
8#!4
M}J9
XDG :
isWPE
j_;v
Y 9[m-
dBi )
Yl$<,A
S. Z
WritRHkiefssMemory
l&@1
mm(M
pT(d
qC|hl
\so-v@b
ybMP1dISerAqIbN9kcnkkeNh9xpJxATOBWUEDt1BIKt94
'4M9
'{Ll
2NVB{x
;-y#
pTQ:!&
7h1
set_VerU
x*g
G1t`
7=_l
hRK6`
|Eyz?
ni/V5b+
RItEYv
%R0m
L6/E
GetTypes
ww@onqy
set_Name
^8t='
U6&{
hMz*
yA'C
7w6U
bQfV
ListBox
(X!X
>wB
lYjR
qg3k
-$s)
G;?E/
H=';
fm}
3sLx
N"B&
canF{
W.K4
047:
/U*R
qVtlcess
4 |:k
admin@than.th0
3l+.
=OQfU
6[z
p(t+
nL3bl
ycgG+
QSjL
j.$>
p}<bgp
e rB6
E>fP
IjKS~G
'Es@s
ResumeLayout
J Uo
FHx Y
8_,H
lc
)A3H
Fk/
r["*
Narshal
t o<
j9 .
-rlt
Re7D
tD_0q
LG 1)qX
System.CodeDom.Compiler
set_TabStop
2gxj4
{Osp
aI6n
$_tw
K@Nv
n :YnVnYjRgW`PgV2
k=> 9
DHKnzaugrcafopHNQ8FVXL9hW7ybMP1dISerAqIbN9kcnkkeNh9
N:KH
Si1G
5[u*
e,Va>[J
ToLower
sDwOz%
eAKO
#n'QY
Wtzk
&!vd
nE$7wy|
5\IW
QcR6
(m`Tb-j'|
i[[ii
data
t/'3v"
'EsI
S~6H
,.*C
8rt^
`>E>
#$FkXk
itiwect
progressBar1
[k\"
ButtonBase
4 6x
fHx;
Hn %Z
WG&#Y
9L-L
hxOk
m4^z
D"Fv
l ?o
Z/Kol
Yr'+$
D\oW
+bsYm
Si {
23f6P
# OC8
R<?s
wyF6{<5
ku8_*
'Y/?]k
~cr\ASCII
VWoW.
$KYE
l["Y
;s.]
k=6~l
e7W|
_o-Z
vHEG
CXOC
$:a;{T
mGGg
H4St#i
N%aZ
<ZVm
0 ~nA
6ZJLD
lzhy
M 0e
\mNO\w
iY-T]
Q$q A4
+?.
`}yE
[Ef2
B.b
RU)
pd,C
3w/r
%ptd
_CorExeMa^v
<6$
8wzR
%*0]
c$Hl
_c (
Vkm,
|ApGw
<L;R
'pl~
C7a`"
o %'4
e@Kh
'i K
\k163
j/Se
sStE
&[j]mZ
82li
.rsrc
hVC2l
Split
g0%l
:qjW
Qru2-H
34q|
3 (jRgS
+ h
7[I/{R
w/P`:
z1+D
!QO
*]6=
,E)<[_DVDi
n N
$ 4!;
j=09/EG
\q'
button1
l*z>R49A
tYV@ #lC
E{T.
\@vm
=.E7Y\;
|Z.7b
sT2QV+
0~9-
nC^u
K{L}
#iNe
}n6v
~r#?
%,]s
t-H@Zq
jc2&
Zn,o
_: i
X>[{
c)ta
)tB-4
@zG#
@u5d
z\w8
Z-IE
)3[o
*M E
Crx
Qffj]
`X`JoWb
oe`~
dpvq
Ncbj i
nn"=
K{L5
jzJo
{'X0
047;@
'$` Es
add_Load
aU3Qb
Syyl
MemberInfo
1,U:
zk6P/]
u ! !
nj 1
/CUF9
<[J
Start
VO?qU.
7-QL
Combine
#j *
i5We
7wR?
&zrI8
lg F
2KdG
nL}&
|H)<Y
/7$y
8fZ0
E- %L
MY~.
mn#=
$<8t
x4"F -_-
set_FileName
0v0b1 0
v:+LBo
jK4w
\_aw
~j\m
Data
S}r0[
RegistryKey
.o ;P
crO^
SkipVerification
GetFolderPath
XL6&
ETw0
^OE$
F~ a
2H@Z
s4{bV
>0<0
bIV[x
7JJBU
ArA$
lSZV
fse\
rrqq
RBvIC
ProcessModulR[vjjfction
t3Jv
07/%
pHYs
.ctor
csDh
<yCd.
i8Hs
} 2i
i,{F
fX sD
HVw(
J$GC
i =
`Y_X
"RXI
mscoree.dll
-1Ue
<k;3
XNZ]
L8Y(
Ps|W
rK k^:
s~ o
zn#?
tzax]!
H2Ku
*2r\
Main
GUv9
nazV
k\d4].
z ve]
%A
'$ h
DataGridViewColumnHeadersHeightSizeMode
L*!m
fUudXNj5uY86cokCpXx.resources
uL&_v
022N
7xwww
DigiCert1%0#
9wy~
(LuA
k7oc
resourceMan
V 8X
wA!*
.MzB
;kiWZJp
Thread~|
89&:qequestedPrivileges xmlns="Bjw<u`hemas-microsoft-com:asm.v3
DHISA
i^5>fu
_+J.
n~: k
4X`U
9~Edx#
66Vb
eyreU
C|$)
dK8|
t\B
DAP k
h%r1
k#lr
U (B
,wuA
,^crWhreadContext
Zd)S
Lrd;q
H %i\T
<W3~
o1Z:+
b4C2
G$S|
'/`xAz
WrapNonExceptionThrows
^_ZF
%Fa4
@9[n
mX>l
LCj]
m# 4>
hoq|r
@.reloc
XYA1
#X0?
-*i[
P Aa)
f-4'
lJ4@
: = :
61L{
MsgBoxResult
q' 4a@
pVC^!
X"nh
BoN>
%*@bM|
\3Ap
9lL<J
: 2NqL
iZo -
H}NTP
l 8\6P4
uL*N
9l?d
vlY*
z+ixc
Byte
@w./
,LME
6>$t
V8sT
o_\7
}93_
ga(l
Xh[c
\et]
Z+VVi
Zq'aE@
C/Js
I }
linkLabel1_LinkClicked
OSsCpH
o\d&
[nf}
{3^3_0
^_\Z
<Xl
L N+
,h^;
b)vg
!}/-
? ; <J
)FFo
U3Qb
z m2
ahT[
DI*+
Ik9r[
r(Tin32
[M<P
ZkXk
^crSrocessesByName
En!N
Y$v8
?|*c(] `
rPID
-e7$
3
nL U
v!wb
lpAddress
o]h[c
MessageBox
Dn]n
8 ~
M\nn@
get_Location
T?*
!811
_cW6
8cSd
checkBox1
checkBox2
checkBox3
?Za$_~
A+*qp
*Nzz
6| 6y
8 8]L
m4/
>:yf
Z)`w
Oc P
*Zh"CR
1Ifa
UvFvAr
8MgO
|+n
iX8 m
`)85
<aYlF
m~ 1~,
set_TabIndex
6/^1
9C^)
g&]I
; i2
-U N
B{v.
8ccv~
0kQD{
IDAThC
ivp9AYHaMluQM9i5MHZVJyFC5ybMP1dISerAqIbN9kcnkkeNh5
!0][
N9Sjb
!%!<I,k
SE.}
N"8q
v!BtG
W"Y+NwC
linkLabel1
a>[z2Cv
Juw\BfS
B ?
dtdF
Lu(\
jQAj
5[=i
} $3
iC(
kd4I`n
RuntimeCompatibilityAttribute
x?l(
0>UPM
RuntimeEnvironment
z(6<
Assembly
9]? z
P(K*
qGe&
fIDATHK
a4Lt
WHHd
td'F
,/|@
zf(L%
F<CM~
Hj|m
MuM*
"t0!
w 'V|
,1Gz
K=Y%
8g.,
tBflD
uOeM^
+aJ.
8I!.
r \)
7h'`?
SuspendLayout
jR4P`
2<.O
(`<Z}
@R}4
HHhAL)
WindowsIdentity
F~5O>
lzEI
TtI ]
/. m
x3#!
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
lY=
m`T2
@=U4N
Q.6Q-
Size
)|0k
U DL
E ;P
#DCA
ZM_
C?\kSk
iW!]4/
}l`nb
1% -
set_AutoScaleMode
iP!=
<n3i
K[|:{F
P !7
1\-mb
IsCsD iY8Z
2http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
|Y^z
kPJ
|lnQ
3&*)
JsC"
4bkN%v,
3:>=A
button1_Click
9PW@
ww@onqqtwwwwww
I*4I
7 E}
1p:"[#
?c\+
Resize
) oVb
jwAd{K
hAOl
hK 8
l]nJ
IContainer
lmme==dde~<u
9i7y5
p -:
v[:x
*B:L
md61Z:
hP6
(q0JN
phiAd
w_ SL
{|KT9
set_ClientSize
Whug
ExtraRounds
V+X__
KX:
WuUu
ON w
O=u
f\c%[
FT[SU
? ;u
n1nH8VtyY64EtncJiDhwm613ivp9AYHaMluQM9i5MHZVJyFC5
*-&E
3|~8
LFs#
8!;>M
Bg$R
LH]H1=
!DlZl
?/cE@
AHgr
FEB3R
O(|c
0Q3=
XX]i
Aa'k
param
?j{Q
g5B2
$Uv
zTWrx
set_AutoSize
XU>E
aYo73v
TiM
CwC"X
S^IF!
T $(
85 {l
R$rG
W*?@
K^EL:
md&flJ
ml"z
W>Mw
&o,+
MP8Vc
:4cS
set_ContainerControl
ResourceManager
xpJxATOBWUEDt1BIKt94ybMP1dISerAqIbN9kcnkkeNh9sB4LA4AIBMk25h0rOUPVQaUrUS52
y#c\
..RT
=+t9"
2bjJ
B:+O]
_(Ii
.S[F
|AI[
y`&%
p/4)
<P=e1v
pIDATXG
t#KY
94@n
3LDt
o9>b
o~0vUX
|5p ~
DPF%
aF=?
in@&
R 2
Q?bE
0=U8bI
<]? nXkX=
S+/
{MqV
ToInt16
EventLog
Z]]
xz]5
uk =B
5S`)
/QtR
w m\
aES0 M{V
T,X~,
!qF(
Mext
xITh667
IP*'
:Ku
&Bz hX; 4 +
~ >+
Q9R,
_5*uf!P
m#&Rl
S){s
7;qxr
K}kC
fMDDPX4
%|1|
o6Q\{J
"/I4[
!2)<v
,(51
Le,g
UgPc
f1+R
bv'?Bv
8x8)
>nJ8
`S`X
$f.>" l
pjI
TkuTw
H hQ
hM,N
Z|&]d
Songkhla1
9 >
pBX_
tArH x
eaz0,g0(fifg
{CvFqY
QDBi
JzL}
2&,*
'DsKsDwOz
eQk{@
tCsD0
54;
Operators
S7^1)
t:~L
4RF-
k %]
.Z~C
~EI*
A&3c
e\lo
@uA R
!CIE
$ 9U
U4Ra
&WaS
!OX@He
'Pao
^.7Qw
q^j
qi0]pI=
..a[
[F<G
e&! L'B
?c"?
Iq\:m9
x@_<
;BRR
E*H
zttr
z^6
<Module>
(`ks
YsS
\(IS
~xjuf"/> </requestedPriv^t|acp> </security> </trBkmOheo> </assembly>
uw$2
yD|D@@Dq4
=KD0C
sK~
pYt\_fI
<_h
]*}0
wyyh
38~|
+ J
8 jS
`X>Zj >
UY\o\
4;o}
/K o
xCvaw
A\zN
!w);
D{4!
?ZcW
R9_;
Zi %
bEjC
{ 5Wa
cIDAT
BSJB
q5jE:I
&JB
#?BG
www.than.th1
\.)Bp
)UI
>FD=
+K8]
62JI U
[38pU
Y>_k
+P9j
h 8\d
aG^+
E,l1
u:[d
; = iH
W *
jws i>9C
|]^(
InitializeComponent
"tk\!
} WD
&1^
ADh}
Ja[q%@MF
^o'|
|W 0
16WDr|
C\i_
T["[
2z=r
xn(
211110000000Z0b1 0
9 DCnY
eTgT1{
UlhCp
< %`s
;zS^{Y>
B9j+
>BS'
+2 V
IFh
&u+
tER.{N
IZO!!
gAMA
ComboBox
i#4;m
u%2"I<
pLNdE
%[1]c 1
;(dF[-
*Fwx-
AY,t:
brRrg
P V
AutoScaleMode
< i2
_ ]H
.cctoE
4fFo
yZEHM
LinkLabel
afHFSWqtXHTA2fsUyQy330
*Rr
Jy ;
+$3 R
b)Ff
.cctor
N80q
@Aw0
)Ig~
bg!H
u{C%
\YG4
(\Ou
mo'*
/6fv
f3wU"
uj#
\X A(*
,Ogi
:R!{
-eT!P
N`hF-
b3f.Z
J{
O!Di
processInformation
G0 &
W2(2
~"t a
= : = h\=_l
ovTjvSjP0M0hIiOsy0xXnKzhr580xhsf
cZQD
'vu1 h}
/IG0,
`* 0
Y2l^hA
BG X.J+=
PLC#
TeV3G@a
>su T
ControlCollection
z0>OG
y=gr?
&(B !
m0k0$
KE}E
2HB9\u ^FS
Kill
k1L]De
LarYu
set_Size
eFb%
=P+
z q b
"VI
|SrWK
#m{HK
6EtL
hksV
T@R9
H/]|
!This program Tywhiw be run in DOS mode. $
&)Z
$RDEm
@xX;
MG@:
&c[c
ProcessId
5http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Q*0<9
System.Reflection
` ]G
_ aB
X_9]
~leH~2
HLDY
WaitForExit
XZ'C
&# <requestedExecutionLRn|j&oevel="asInvoker" uiAccess=
T`M
25&V
hE2 J
_ O.
j9uI~M
-z{>
}A'C
'Cd\
}zvNV.
Ez_
qn~N
qf~3
10|.
{C[X{s2
:SW}
SecurityPermissionAttribute
YJx)
_?+)
t@!Cp
}[JL
j+>c
sender
=?L^
\-Yu
A5Id 5
160824002755Z0#
=eYb
GetMethods
5d=
1) -9
VB{]
jN =
~G j[?
: Xc
F) 8p
O%Fc
faq
%,l(
4SkS
jW?N
z?Y=
p%b;
bZoR[k\
@m;m j
M4Bd
/hFm
[Y/r
9!mI
7ejRT
oG?'_
`=\(I
J43==E
5$cm
,W`o
SC0.
F7 I
iHZh
tB?[>
f 6
`*e~#jk
/O"Z
H^q0
4^H
9 De
0 cU
ToInC}~ct
UMJAC
?a<6
Z_= 8 nW
\&Cz
E0D+
PgU1
e^7;7
LS[3
xs@c
qyjA
7lJ
H*^A
D$*R
ys>B
pXiq
4c!\}x
#{A
e:pC
GhBbU
"T4
LinkLabelLinkClickedEventHandler
}\u*
!!;LaB
~Dn
`fh?#Qd
C :
L$jl
5VBV[
+8
EndApp
h +x
3Qg/
?/b!
b \
wZFN%
:J2A
bufferSize
!&&-#
@9^>
?8/B
2adhJI#
p5O:>Q
f^8\
^t i
`# Q
od8
*~(H
)94Pe}
3System.Resources.Tools.StronglyTypedResourceBuilder
aP0G
c\&1q
d,[n
+dh.
j`6B
}(QL4
\L0g
M[y/
@H@A
ExVR
D(I8
dCA L
S gLo\
pid7kuiqNsH
_4p;
*@|_
'2S
>m+QhN
6{
.-//
v_-m
DetManifestResourceNames
y 'N
t0i)
gWo4
!This program cannot be run in DOS mode. $
vIA%InN6j!
5p#
l$B_
R ue
rc4S:J
@TpGtL!k
!J^_
File
42!I 0
04t7
C[K{L|K!
G6~?
hJT1%h+1
>:2)z
NI\6:
Jf`U
O,R}
S 6-
Dispose
iZR8
0B@
KleR
!:W&/5
D& w
@+#r
B{K*
KgW`S
$rs#
OukNoV0xLwIJYgkOy4KPIKVhCQKd@
=LsssT(
F >@#
aY\KeiY
pIDATHK
get_SystemDirectory7LqtcbdStart
ApplicatiXv
A%+ oh
(EHvH
u>=s
+8s"
u^lTa
@0Sx
' t6
N,v_
coEy
DisposR
VirtualProtectEO
qD0[
9|rb
Arl ^2
}i[`
Njd}~
x2>]
R>n,b
1MQC
DataGridView
wqX;
f;BZ
.avv
9]? : lUa
ZJ(L|
:3*95
-O 7
5&AI cyJ
O0V<
]]eP
1 S
V]F|
APP#z <
t ,J(
B{D+%s
procPersLOC
\O d
:if
M)`*
(<?ND4
0RN
/I `
N\D<
comboBox1
xZSw
acw_ExecutablePath
&FGU
y'Gl
q{J
u_8 i
uh[z
+ML9
bpplicationName
tl
I @
m B0
sam
9b QB. 8-
X87gc
y-18g
SetProjectError
2YM1
hAaR7
z ?B
Oeco
b>g5v
yL|K)
resourceCulture
DHKnzaugrcafopHNQ8FVXL9hW7ybMP1dISerAqIbN9kcnkkeNh5Ihrr1jBq4RqD1juvmpdksP279gyu8
k5!r5
#4Z?
&&T~<
b [[t
>">cG:
,QOe
ArT#
%\^m^
D[}Y
E)mQW
)_+h
Fj0r
\W%u
S6.,h
MZdi
BBGa
12ZL
/apt
NhBq
j5y
[8.!o!
?{QbV
sDsK~
/j]nt>
o`DB
uR0eDWI0RBjE0Lom3s9rnSAx1jc@
Delete
thread
_E<e!?
7IFk-
N`,&a
}%&E
- .#
QgjgS
c*V'%
=nb)2Z9
En t
g`@{
gxw7
WI_3
Gmyp
HWdV
creationFlags7}wpoqonment
!U@O
[P|h
<Y`T5
d~~V{
ws8?
^kcB
{q4O
,QC1
<eY
z3#
^V6m
yzEZ
&vvK
geth[lttfnt
5MjJ3
EU!x
FZ]9
,,, '
hf^G-Z
Vb|
IdC>
commandLine7hkiefssAttributes
&&>5Hx-
?ZcWVc
<Km8
z x0
`~C{C
]OQW
Label
RQew
@4lI
System.SecBjpr
E05=
`# m@
CreaQ=
"yn1
Environment7KicejalFolder
gYD*
2<Ji
y54~Fi
Qklceu4
"(N[
49_#
sK9P
S`Xm,
=X:
7h1%
EditorBrowsableState
u6Cc
``)@d
XIi+
Mutex
z>C{v
zL >[b
GetTypeFromHaY|uc
pZ"
SizeOf
E3kG
n] @
LMpbw\
f M'*#
G:kU
]w.b8
H[Sj]nV
UdZN
160823113108Z
k\d\^c[n+
Q=6*O
s?&K
hjuFqx;
ed(Lw)
&.SZ0Hk{|
~6K<V
YcCU
marb!
8eF$
g:^Y
components
RnqeadHandle
listBox1
jc`tion
AEC<
XaxkbCy
ReadPrX{|uuNemory
0Qh\
CRJ|L{
5j3 v
*pzdq
9zjn
k0i0$
0!0
i 8Z
"!%R$
(E L%mr
r3 3w
-llo
ISupportInitialize
Microsoft.Visualuyjoe
Ij,_
dXi$
?hMo
:u#8:}
U|ha
OH8 2
#x<N&
Dd@'
d%4y
0i9(Q
@3ce
OwBr
o SM
# vL
wdRr
MethodInfo
os!'
f +T
]n]8
Form1_Load
+J oI
C\0LH
P>tv
N xf
n1nH8VtyY64EtncJiDhwm619M57d17Pjp0Keo36MiYxkd5DHKnzaugrcafopHNQ8FVXL9hW3
k9qa
4vU`4&^
Jp*P
0RdW
FJz$
O0*H
hl~>
)1dW
wKKx
R|sB
r*
b mu
Di)6J=
OwB+
PAs)
X o8
%,Ls
baseAddress
M[+Pm
oYjY<
WA{|
b`U1
#84w
J!-k+
+f%-1
<4OC
/: k
n,B8
X 2
s/b*
wwwwww
Pk8M
`d-Y
#T<u
O)M}
mnXxM
iyD>
IDATx
ContextMenuStrip
6Z`c
hJc >
5gein^
4http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
?}:k
( =
ivp9AYHaMluQM9i5MHZVJyFC8Ihrr1jBq4RqD1juvmpdksP279gyu6
BO-j
*.~#
|GtL
e:4{8z:L
0tXM
OSSf1"
1yp7
yry<q
+O[
Pf!s
`T5}Ue~Z[
FRpO
`2 Z H
v=YaD
#~($
%ZE]88q
(ZBE
n2qBzO,
PtW~
Q!Cz+^
~Cuh
241022000000Z0G1 0
a<ec:c
IEND
2EJW
C'u/r
x$q8
G$WL
H}L(
EfxDT~
f\L^
6TbQb
)1F
p i6
>< I
$D+c
:#S~
]R n
\-)*
;C :
eDr6
SE.J
K? Z
HH}M
tN^H
context
< 0
fWj2
.3Wg
1I n
[;5"
( 8Z
1 1y
5-+6
l`K7
BlockCopy
h<6"
va5y
7 yy
&5mg
VVg=|6
x>#4
WLD7
OxGz
MVG"
M:Rz
2http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
!dx%ihk
dFvI
<-$o
`T7"
EN70
1q3g
>IT
]lw:
oyaA
d-Fd
r?8=
%;O,
dlkohds
-Q;j2
-,sH
ek{Wj
/h U
Concat
yH7\
RrYx
9*0"p
L@j
E:\SameS8PEOM\VS 2012\service3.1\servicR+77Zlbj\Debug\service3.1.pdb
h v$}j
tlaZ
:NST
*EAU\
{2
MicroDw
m3P:
LayoBlRohg
&&^uAAC|
/ h!
hKD
$H i
Y 9Ep8
0fv^
}CC845
2 Sgi1
Z=
RRBd
wS"#
bytesWritten
PSiy
a Ju
*n : :_fR3
P+xVRL
Mao
;a,OF:
HQlq
EYaYn
https://www.digicert.com/CPS0
]IRb
CompilerGeneratedAttribute
W|v%S
[4'D1
set_SynchronizingObject
C}gC }
contextMenuStrip1
tLtC
4GGJ
pFJ=h
hP6Rb
DG:!
. GL
(x5A
)E@6
-Tk&I3
2ZGzX2q
Kcj
SetAGykrkfntState
)E!.2E[
IM\8
currentDirectory
zF}b
y_.x
gQM
q:H-
7b`j
"]3q
6%](
8=_z
|Hrk_"
2> o
Q'$T
l)'_
! ],oIK
vzhqVB>
lpflOldProtect
*-.J
3JC%"
System.Text
L.P(
oTow`e(
Khm,!
STARTUPhQW@IQMATION
#T&f V
pq
4;=K
3 ?)`-
}k0{r {)1
System.Resources
set_FormattingEnabled
R:4s
jg2;g$
ymL4 -
Cmd0
;_k
}9%
4Pqk $
*5R=i
A\Nygq
rC+2
n=id
A%}PP:
/.$(
)BB
h<if
f&~ 5
F?y?]k
&W0):
a855
q6&
GetObject
5J>$
ProceDk
#0[c[
Vi0|
domainUpDown1
CZfw
~.CV
62rr
r>v Y
iQ'y
L|Kz
9$ N
KeF#
I*$%>
D@zbP
e0T`
^gO.
rz
i,9FW
tA V
Ljqs
FP"NHk,
<`PgV2
6vACz~
sn(Z9
QBjQfUm
+' q
uU(v E
! x1
StructLayoutAttribute
4'+]
7erlr
u ry
$6vv4
$MyV
.jw;
>~/y|
lcF}
D, b
vMrQ
% 9"
ResumeThread
[vkvjlerServices
j]aYn
?W7v
F4 IR
Show
L:
%'8E
H&ei
O>0vq
flNe@Hkirfct
&J1c
tt|gtSrojectError
!=sV
HZK[
ProcessHand[}
fVcS
t\3.]
+S)f
/:QY
H4/!
service3.1.eO}
XgME
x6A9
I!$
9 J2
we>p
Nm~U
}c%^
5 h
1F#R8
F4%9
MsgBoxStyle
}RIh
G)_A.S
YI`+9
retry
1 0
n5C0*
_CorExeMain
DebuggerNonUserCodeAttribute
@N4n
q(+>
2B`+4h
b-"z
tYBr\(@z
(L;
I#')
9!U'
$"9~
zC$M"
dRaY
qmlDZ
Kb4[
Qeserved2
>S+'
p}mEsqrent
Q/|K
bV^eVn
#g5_.$
wC!Cp
u %
v9S_
vW)
u98:
FA
t6EQ@
C7Vc
UODQ
nEJj2
kyJE
P0g>
`NU_3
h<[0
C.G2X/
q^g3
`cNF
;e%R
yaNUmU
/8iSW
tB$}
"ZzI+
EditorBrowsableAttribute
oRyf
MarshalAsAttribute
W +g
VY!G
":
u#| e
@#|=][N
c:77
oE1d
J|2f
FoUCg~
wwwwwwwwwwwwww
cW>'g
l+${b
Keys
K4=1
,]q(fQN
ContainerControl
WV#>
%, ~
SdW[m
6$v50
b=%'
j7/Ro
iX ~
SgH{q 'K?
V >^h!D
dwSize
FCi<
K[S9
T`M8
%C#|
AZ,!
Resourcezywgafr
AQ}2
!a@r
%} :2
PHGV
Load
1Ha6
f 6a
'hgm
@fv~^
N#3*O
t1[w
@L]B
kuL8rW
System.Drawing
!n%7Ptj0
I^DS
t4'n
CW-Iy
q:2=M
]g*qnnZEZ
Mx- m
74L^0
"UrD
cu#6}
v 3J$X
.jr ooo)N
\Dvp@rXF
%R4|]
fM9d
-HqaPe
xFtn
S > >
\/VRb
add_CheckedChanged
SkS?
sdCHgA
;z-z
SGCrAy
SYSIuP8
!{R)
dVH59PA09Ges9fvngprw6n1nH8VtyY64EtncJiDhwm613
gPh
DebuggableAttribute
=Ya_; h_g_h[cVfQaV'Cw
=_~'
, 9J
4SzKJS1i6SAcKMS03oWz2SfxPyAwdr
ptem.Collections
__!
o\_ !
EX~>
+}';
rDtCr6
q-{)1
|{8NL*i
@cRx
NQl]
*JmX
|<<;;.m
D|C))ZWoZ
(;&cmcoding="UTF-8" standalone=
JRGWhreadAttribute
@J}
WKO=!$
Lk@'
`s`Cz
w]CH6
!e]
X# I
(N\<:
w 'j,
SW;r
RuntimeCompatibilityAClkodvte
iG^K
0J>f
BRt)
`_n5V
bQ4
HmUf
( JF
x@&Br
rqqI
g&LtF0+
WG>(
Uhb7
Encoding
R6x=rc
O|D1
b+ "
%]b"-
/mlbvzF
<F G
82fi
cxP]B
s)
mT2V~
s9sb
} A 9XaU
v=Xa
Object
uF#aK*
N"eC
\n>B"
X*0
!M 8
G-lI@Qm
GX Hh
,c,v
/9"E
w`W
|C(c
;lJ3
`Ovv
^ nZ
Ce.|u
prR_
j, 0
@XSE2
set_UseVisualStyleBackColor
I8dSgRBmVHplGNKU3C9lICU
91>F
["n):v`
BnO6
ix1c
xAyA
InPath
r0 &
s-#i
YH6[
h4I8
w#X2
d. 6Sj
{qE$
QPA
B3W{}? p
6No%Q
SB: <
z0x0:
7<tz
"xH1
j` x
&crN
<\i 5
hk,p
StdOutpuC
l-G?
F\ MO#
AQ@7
CreateProT}ju
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
aMQ4+C
^SFD
gs_3!
V]CD
HY?k
8MS{4
6KR"
JP^F
.teOl
) Fa
>Zo
CultureInfo
#G`R
yd1y
4ku A
6KR.V
Y~o:
)m i
?KC.
w:[n
W~nCR*
z1V_
x~WDH
qNUD~
iQ7Sc
'Z'pn
RfVWX%
cPc[
: 81
xcoz?
Jy!O
IsNullOrEmptN
$jmm.R
<{\G
aQ t
W nP(
|=>|
VMGb
dxtq'
JlB
Q$r9
46-r.xEx
#Aw
MTkWQQ
vR_1
JiN>
'r2:
*"0
`UaVf
get_Modules
ShN_
7_{U
sRGB
i&! S
TR"& f)
p[I)N
CompareStr^v~
PhrStr
}G&Dw
cjpk
#qChM
\$6x
|Xl.j
+] c==M
[iI1 r
Exit
YaY$
OpenSubKey7_|rPblue
5a&G
b^hY=|
Ig]q
YaY,
JzJF
t,X>
d558
Q}!
MG=:
|i<Bf
di$n
ZBL}
!yuGW
process
Tgmdom
i$.*
GOQa
IFjJ
get_Culture
E Yx
Contains
8f<xH3
x>[a3
oWb
1F{B
oWb
Il<@
^n^
.'d<4u
<;,Nv
`<;>zz
t 4 ;hPeI~Ny
Type7JlhrjmeTypeHandle
GoD"
4=f
SecurityAction
vA"B
(J_'
=YaYR
= 8f
yvWp
PiY8
mP:S+
ha~J
xA lU1
lYeRb
l}uc
F0qY>
_hPh:
ME1u
15 =&xH
j(Uw
p ##
Xixh
aVaYl
WKO(3u
v0Y"
5nt4
{,H~M,
duQB
Xh_oXi 9X6
v!?q6
FN S =
*Fw-Y
SetValue
Q>DpCp
c')eW
9QEA
i S$B{D
AMrl
znrTs
QEqf
JI8U
R!M5
x k:
System.ComponentModel
VG61
*Y(
@G80
4m=p]
~|";0
(]P|:
rod,
!zCP
c9!}
m s
% Eq
c"b4&
v02t\3^
X.M/
zqE$N
w^)K
#_x6d5)
95 fr'
tewQ<{
O_01)
-c31
!Bu-
DW~e
k8p`?
bG%,
B,S@k
nFy#%
ValueType
96-i@,
q^#e~
{Cq|(Z
M+Po
Tf9n)2q
%(-vT
ssThan Section1
NtUnZyiPofwOfSection
>pqY
= h!
aujh
bI59
c$O$
f\={
m\6U
+sVa
k B
KXh
,ya};\A
{.7
=w.P
X<'Y#~}
)h*D
EqB = 8\
_0Pz
&&>5
G%U;$
SetCompatibleTextRenderingDefault
b|Vl
\V%lD$
?H/A
_)'s
ytt,G
aUBvN
O2Sk
f-ePa
J5O#
fV&T
VyWy
+ .A9''
5y)6
`-@)_
2,'%
"T OP`!
:PE
A8D:
add_Click
Hm n^
6m~ iQ
>fah;7
N(*.
B0Rd
`eu
LTZ
q2\9
9`]H
_?*
5R$~(
T~BB
k<~&9
^z\~
$%[L1
XkMy
|X24
HH\U
;H4@
BvC'
k/K'
7D/,
Hi 9
VirtualA[tveC{
m<9v
S_ T
0 9Xm|
{ 6o
!PXmu
b/Rd
Uaw,
yN?{{w
1FP}T
W6cWCp
I$0Z
~y:6i
set_Culture
}X]=
;O-K
get_ResourceManager
F4#8
II g
_g_C
LMxX
u\?a
(s [
DigiCert Assured ID CA-10
f'10
}HH{
Ao@>p
System.Runtime.InteropSerAqzcu
Q`+W
P6Rb
Point
WrapNonExceptionThEwnu
ProgressBar
R)Fd
length
nI}oO
d[}APS
CheckedListBox
v2.0.50727
E+G9
t.e}gM
:m+c
Ea!CF
Qi\t
@x@4
2% 2
ToInt
2f4&
^qXy
pdzz
isWirRKqgth
Program
5\_R
9mqh B
n5@$
/1?=
*o_hX
qjjR
qm1>
1QV|
rJ
=5S
eZ82K6?^
[x8e
2j^03
;TZ>
n1nH8VtyY64EtncJiDhwm619M57d17Pjp0Keo36MiYxkd5DHKnzaugrcafopHNQ8FVXL9hW3.Properties
acM~
ix$r-
~_ P
3& *
@TM,
iV"6s
5yp@
JeVt
FileAttributeD
Id?O
\cNq``Z
ItiiectData
G'&qce
#]:2Q
LIR-
c>Wd
\h-v
x G]
=8Y<
~3Um
]{#m
get_ASCII
|M#1
"}^v
b^v=
s-Uz
Hbmk
(d @wO
r8FO
.Psj7V
Anti
2>}>
Za 4
}E$+
mI?(?
C4 7QH
DllIZhvtrBttribute
ot;K
4pT4
r>]j
gQbQ3 =\i
"Q}J
GetEnumerator
#(x}
x,r5
|xtx
'#%]p
5fcq
eventLog1
m^i 5t
LdiE*
IZZX
~["
svOX
$&q/?
) ]../
MessageBoxButtons
$iHN
LVQ
>w{PBs
my q
CfYP
qB6 '
CD-
JrbFrror
uwem.Windows.Forms
{<>|
KWL613A6CXhcW3aqPoWx6TQCn66X8W3Nuw4Kxs3WhZ6cQGMtDG.exe
%ji(
GZ^'
,=<z
Zj p
5q )
Bb0]%4o
xb5z7
zqje
lVJ9
{f _h
f.JsG>
6\j4Ql
Sg{L{.p
7http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
L0a>=`
*5&hyz
5aH
9G L
tJY>7'
`x.(
mYF-
T06"
a4a2Y Z
wYyCuP%z^j
as6
W\%Wl<F
1q{ xt
w#3N
K<;8i:
H)4@w
2[MkIK,b
KBF8
phU(K
Blob
*,NF9
r95cS
yeqA
GF`4
J1R$
2wT4
8 D;
a^h
X'~[
@C@X
&UmzZ
$M5W
5I;=
z;mKq
4/KKs2]-J
)~g)
f9J2
-"\! I
eM3{m6!";
ApartmentState
8 h%I
kUyXGd
E,\<
141022000000Z
GP/U
1ik
zk~Di{
d$CO"!#
add_LinkClicked
handle
CeX1/
k|:%
+K\#
Exception7K`urfm.Threading
uqJOb
System.Runtime.CompilerServices
VGg),
CheckBox
LNZf
I_7c
f +;
+4!f
wwdi
I-|B
KZiQ
X\YCvp
UDvtv
Wz ;
UGAU
"Ia>@
9ch8
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
OFTU
button2
t\>L
^7 3
~I 9f
TB] @
B~\Zm
h]=
checkedListBox1
checkedListBox2
DHKnzaugrcafopHNQ8FVXL9hW5ybMP1dISerAqIbN9kcnkkeNh9
:`=D
FRZ_0
{# 7
*R209
A[0xp
8m9(
2M \
`\jM
1K}N
itn[
quSgYc
CW/1
U~E2
Microsoft.VisualBasic
]F.q
+D..
DigiCert Assured ID CA-1
vc*Q
Ihrr1jBq4RqD1juvmpdksP279gyu8DHKnzaugrcafopHNQ8FVXL9hW2ivp9AYHaMluQM9i5MHZVJyFC7
S+R`
LY "b
0D_#VBp
hsxp
01s0
H3lGxX
6vi<
.xRD
^F;k;
wW<j
!&MS
`ueY
k`T5
#+,/
G 1S
h&;0
jX+V
4=>I
T%?@
EventArgs
E0@V
IDisposable
1e1~ :
HxO,
Exists
efZ/
D?q[3a
x{OM
,; ;
vFqAv
GfY6
'L|5
}MzN
l Rb
[=Yi
Xm "H
77>]
z95~
'.`0*
gYy4
||D"F~x
g!}{"7iAg
QMd`"
`* ?
mOxK#.
C9l i
ybMP1dISerAqIbN9kcnkkeNh5DHKnzaugrcafopHNQ8FVXL9hW3
_o|c
ZF|p
Iy#Q
K7dS
qCnx
O,gB
4t~o*}
^lu@$
uj4'^m
T+*
Yt{%
-999
F@sK~
YgM
?J^ct'
qp?8
UVqw>
|_A3
u91'L
bquS|(C>
GeneratedCodeAttribute
FuY
YtnJ
%q<;
C6l9
Gd wt
SKX~
9\eW
GG~H
E~4g
q.J}"h
8LY@
,yK,
Waiq
I/>-z
=9af0
[9H7
E_aS6b
e~j
#IHICRhXI}
{]_r
wu![
value
6g_fz
SizeF
vE,1
a|u$<> <assembly xmlns="urn:sc_}tgu.microsoft-com:asm.v1" maniQ}jrPfrsion="1.0"> <assemblyIS}wrowy version="1.0.0.0" name="zaXvvoication.app"/> <trustInQw9~kons="urn:schemas-microsoft-Twt<gpm.v2"> <security>
@\
<8a(kO@
ZCI<s
BMDt~v
|mueey
g:+h
gSIu
r(-'
RjWN
bTg_
+;],v
*~(
V9fl
;^cW6v
-3Jx=
m##\:&
]]TTTWPb%R
yn38d
/C^~NX
p Atw
W1oJT
IsInRole
i<uiM.
2$c0
hPaQf
yA'Cs
;A6Y
]=4*
Y cm
uN\^, ,
t&/>
kq0;
F(o{
#GUID
?F#L
@vC'
pEhPq
)GUbQ4
2;/y
l4.9
DsCt
7Id"H
-2s
PdGz
8 8]dP1
:CqG4E
/[3D
82GcyL
g>%P
gY>G'
GebuggerNonUserCodeAttributR
-b.
UQWM
M[ R
Y &R
EndInit
*dDp
DDMP
*5[$4
l<<
@Yz`
3C7V
Pd9;#
set_UseS_}ujC{ecute
,U W
"Od'
vksW
\hXo Rc
?_J'Q#'
"_Kt5
$-abD
`m%/
p8m)
&<Wg
GetcpkcggContext
9L\i
_} X
"AvNw+d
stVjmsvJnfo
A }e
;M}?
ScX'
~lmDx
DCo62
cNqAvFq
0 M"
phaNodes
H@:c
UnmanaP}}R
r>;y
p$(Q
\%nLM
& X)
EventHandler
k_>*
o?vx
Thread
j9*s
rJ"-
"oSr
EncodinP
!n*2
g 9\
e0sj
r\{1
Sk^'
ErrorProvider
9$_%&
<u/c
^K1 E
admin@than.th
wN<
wi3}
SLH%N
DebuP
kT0 = Q<
7oFd
jQKh
pH7N
Ci,bf
5
@l)W
FZ$3
VcTe
u+
Qlw64SetThreadContext
(%v,
N&&L
x9I3se
35b74
ymw
@rG#
IDATHK
x'="
sM0F
*XzwwJ
[{ >
bMGs
|M3$
8_|e
Z_,^
> k^:
Gr<+
}'dM
nV1]%
aT0r
!'Z)}
Dx3mb;
aG1N
{5"3
60C3rTaGo9m0Qh4Dyx9o2ffh
-$6y
Dq= :
JycO
nW>GO
r X
get_Size
"8ph
22'v
b1kmDA
O%N_
+H@MK
ntdl[6}jj
>k2Zn
r( B
SROCESS_INFORMATION
u%-*
E137
?5Icse
b3b633e94a5d8fd0c788738507071d4a@
errorProvider1
ErBu
q%+Ys
gia?T
Zero
LocalMachine
)jn_Ik
f-sdata
zIDATXG
U\2.
m%,Q
sds5
x w;Z
LHK#.
.(G$
IYEK
Xn*Go
Opm"
bMuA>
`qe]AX
7:j8_
Qo~4
l)~?
zggK" W%
> ~&S
/`|f
" q?
ESG
YbXi
|Y$j
Fz@wD
u;Mhe
mof35_8
vJ,H
q*stfR
A '~
tb?m
ku`oree.dll
MBla
w#wY
0j+$
$YY&
opN{M
"=qH
fQ]j[
_-Hq
E 2
[m 1
1,eR
.0':.
DxJ f
M%=>
:R #
bkQ7
50hw$r
>8Y
wU73IA
qS_ BYqX
70:%a
Prf 2A(
A(2zgit_T
NkYqk$
service3.1
2cP8l
2V d.
",0&
8BQ[ E
>X< )
7*htY
Yn3>
12f:
$V8
%urs ng
GKh&
System.Windows.Forms
I,T(
Y-F"
|DqA 9
"4L(
dVc>"~
PJ6K
zm4$
u7.
Todlkohd
vM1~
H.Kr
|Q%]
l~Jk
49>!
E ,r
:w5i
H)u.
System.Drawing.Bitmap
C7 K
hQ-
WT+I
get_ModuleName
fuR0
&*&
=M4m
8} :
r[A-q
<Gr.
jw")R
~*y
+qEsO
p!00
X< 1
:2H.Z
T}[Tj;w
}jrh
kK?^
cP2y-
disposing
8U*Q
,,O&
mXE
N~!|I)ZB
%:mx
.g&<%Wq
aZMel1
U5Uj
&*z
n./btt
'~B>
<:${
\53GMg
*"3j
a >C+
y=U$
h)y{
,Ga2
w.gs
%{ =
2zYy
^&&sf
StdInput
y8_ v2
2 2
j]h 8
t#2zr
Sleep
F.+!
GetRunt^u|Boqectory
E^$}
JZ%K(

#infosec #automation

TheSystem Itself @ 2016-08-24 18:30:02