Analysis Date2018-05-01 09:09:58
MD5066a79a0bcd330eee875fc613b834bef
SHA130d6d11bfd5e0aed03504e093de36f04c2861ab0

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit Mono/.Net assembly
Section.text md5: bf39326805aebb4fab16a0abe54640cc sha1: ab45ec1e07dd757e36ecfc6a8df4bf7e611e8001 size: 77824
Section.rsrc md5: 5495e0d66a38c3d9f638005f3a889266 sha1: 5d088db4c6c96cf83d61c8445d1a31c332f5ec68 size: 126976
Section.reloc md5: 846b56975eca735a14e60015e2076829 sha1: 7f77e70b9888aea6e33cbc17ca2742105ca9cbf1 size: 4096
Timestamp2014-10-15 18:13:38
VersionLegalCopyright:
Assembly Version: 0.0.0.0
InternalName: Free Compte League of Legends.Scr
FileVersion: 0.0.0.0
ProductVersion: 0.0.0.0
FileDescription:
OriginalFilename: Free Compte League of Legends.Scr
PackerMicrosoft Visual C# v7.0 / Basic .NET
PEhash4da38189f197c95c4ab055556f5a86c1a37f5d66
IMPhashf34d5f2d4577ed6d9ceec516c1f5a744
AV360 SafeGen:Variant.Barys.17702
AVAd-AwareGen:Variant.Barys.17702
AVAlwil (avast)GenMalicious-AOH [Trj]
AVArcabit (arcavir)Gen:Variant.Barys.17702
AVAuthentiumW32/Trojan.QMBY-0500
AVAvira (antivir)BDS/Bladabindi.alif
AVBullGuardGen:Variant.Barys.17702
AVCA (E-Trust Ino)Win32/DotNetBinder.A!generic
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. WebTrojan.DownLoader9.26652
AVEmsisoftGen:Variant.Barys.17702
AVEset (nod32)MSIL/TrojanDropper.Binder.CZ
AVFortinetW32/Generic.B!tr
AVFrisk (f-prot)no_virus
AVF-SecureGen:Variant.Barys.17702
AVGrisoft (avg)Dropper.Msil.CN
AVIkarusTrojan-Dropper.MSIL
AVK7Riskware ( 0040eff71 )
AVKasperskyTrojan.Win32.Generic:Trojan.MSIL.Agent.ffjt
AVMalwareBytesBackdoor.Bladabindi
AVMcafeeBackDoor-FBHS!066A79A0BCD3
AVMicrosoft Security EssentialsBackdoor:MSIL/Bladabindi
AVMicroWorld (escan)Gen:Variant.Barys.17702
AVRising0x5779bb30
AVSophosTroj/dnsauce-B
AVSymantecBackdoor.Trojan
AVTrend Microno_virus
AVVirusBlokAda (vba32)Trojan.MSIL.Agent

Runtime Details:

Screenshot

Process
↳ C:\Windows\System32\lsass.exe

Process
↳ C:\Users\Phil\AppData\Local\Temp\30d6d11bfd5e0aed03504e093de36f04c2861ab0.exe

Creates Mutex
Creates Mutex
Creates Mutex
Creates Mutex
Creates FileC:\Users\Phil\AppData\Local\Temp\30d6d11bfd5e0aed03504e093de36f04c2861ab0.exe.config
Creates FileC:\Users\Phil\AppData\Local\Temp\30d6d11bfd5e0aed03504e093de36f04c2861ab0.exe
Creates FileC:\Users\Phil\AppData\Local\Temp\30d6d11bfd5e0aed03504e093de36f04c2861ab0.exe
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config
Creates FileC:\Users\Phil\AppData\Local\Temp\30d6d11bfd5e0aed03504e093de36f04c2861ab0.exe.config
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\security.config
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\security.config.cch
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\enterprisesec.config
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\enterprisesec.config.cch
Creates FileC:\Users\Phil\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\64bit\security.config
Creates FileC:\Users\Phil\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\64bit\security.config.cch
Creates FileC:\Windows\assembly\NativeImages_v2.0.50727_64\indexbb.dat
Creates FileC:\Windows\System32\l_intl.nls
Creates FileC:\Users\Phil\AppData\Local\Temp\30d6d11bfd5e0aed03504e093de36f04c2861ab0.exe
Creates FileC:\Windows\assembly\pubpol4.dat
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config
Creates FileC:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Creates FileC:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll
Creates FileC:\Users\Phil\AppData\LocalwKMZTolmwS.exe

Process
↳ C:\Users\Phil\AppData\LocalwKMZTolmwS.exe

Creates Mutex
Creates Mutex
Creates FileC:\Users\Phil\AppData\LocalwKMZTolmwS.exe.config
Creates FileC:\Users\Phil\AppData\LocalwKMZTolmwS.exe
Creates FileC:\Users\Phil\AppData\LocalwKMZTolmwS.exe
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config
Creates FileC:\Users\Phil\AppData\LocalwKMZTolmwS.exe.config
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\security.config
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\security.config.cch
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\enterprisesec.config
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\enterprisesec.config.cch
Creates FileC:\Users\Phil\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\64bit\security.config
Creates FileC:\Users\Phil\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\64bit\security.config.cch
Creates FileC:\Windows\assembly\NativeImages_v2.0.50727_64\indexbb.dat
Creates FileC:\Windows\System32\l_intl.nls
Creates FileC:\Users\Phil\AppData\LocalwKMZTolmwS.exe
Creates FileC:\Windows\assembly\pubpol4.dat
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config

Process
↳ C:\Windows\System32\notepad.exe

Creates FileC:\Windows\Globalization\Sorting\sortdefault.nls
Creates FileC:\Users\Phil\AppData\LocalwsBcpkFkjX..txt

Network Details:


Raw Pcap
0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 33343a35 3335370d 0a0d0a3c   00.134:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a313433 30393834 382d3835 39632d34   :14309848-859c-4
0x00000280 (00640)   6563332d 38626165 2d323238 36643936   ec3-8bae-2286d96
0x00000290 (00656)   39383339 653c2f77 73613a4d 65737361   9839e</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a3061 32306630   >urn:uuid:0a20f0
0x00000340 (00832)   33362d37 3464332d 34393361 2d383337   36-74d3-493a-837
0x00000350 (00848)   322d6433 34383833 66303963 61323c2f   2-d34883f09ca2</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 35343a35 3335370d 0a0d0a3c   00.154:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a336331 36393938 632d3936 65342d34   :3c16998c-96e4-4
0x00000280 (00640)   3536382d 61636135 2d316638 30343432   568-aca5-1f80442
0x00000290 (00656)   64353030 353c2f77 73613a4d 65737361   d5005</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a3061 32306630   >urn:uuid:0a20f0
0x00000340 (00832)   33362d37 3464332d 34393361 2d383337   36-74d3-493a-837
0x00000350 (00848)   322d6433 34383833 66303963 61323c2f   2-d34883f09ca2</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 36313a35 3335370d 0a0d0a3c   00.161:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a393730 34373931 632d3338 37342d34   :9704791c-3874-4
0x00000280 (00640)   3564392d 39656337 2d653636 38666630   5d9-9ec7-e668ff0
0x00000290 (00656)   39383531 323c2f77 73613a4d 65737361   98512</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a3061 32306630   >urn:uuid:0a20f0
0x00000340 (00832)   33362d37 3464332d 34393361 2d383337   36-74d3-493a-837
0x00000350 (00848)   322d6433 34383833 66303963 61323c2f   2-d34883f09ca2</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>


Strings
.
..
.
..#,J
...
..
.
.
...
.
....

0.0.0.0
000004b0
Assembly Version
FileDescription
files
FileVersion
Free Compte  League of Legends.Scr
InternalName
KQXxKqxVbg
LegalCopyright
OriginalFilename
ProductVersion
sPpoItSUWm
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
wKMZTolmwS.exe
wsBcpkFkjX..txt
+}+	+|
+$+%{/
$0000000c-0000-0000-C000-000000000046
00-(supV?GF"
.0-2IIER|}w
.0-3MMIR
0OR7WO
331!wxsS
3/i!J<
3r"z5D
3SZk<C?
4.1.5.
5638RRNZ
5647PPLY
5gAt!'
|*5y~:n
{654f3d96-bd03-4110-b2f4-56f45c3afb1b}
$&#6<<9`npk
6vwI6AbP5JjKKF
$7c23ff90-33af-11d3-95da-00a024a85b51
7|]DU{
%7T5i4
 896<WWS`
+8+=+Bo
!:;8=XXTd
9:7<QQMb
$9e3aaeb4-d1cd-11d2-bab9-00c04f8eceae
^9r)/;z
,A[=8o
$>?<Aab]i
(AA>Enojs
add_AssemblyResolve
add_Click
AddDays
add_Idle
AddRange
add_ResourceResolve
adx9-k
A$m[Jg
	>A>.MNJY
AppDomain
Append
Application
ArgumentOutOfRangeException
Assembly
AssemblyCompanyAttribute
AssemblyCopyrightAttribute
AssemblyDescriptionAttribute
AssemblyFileVersionAttribute
AssemblyName
AssemblyProductAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
AsyncCallback
Attribute
aW2:tK
azIDATx
BadImageFormatException
BByv44
BeginInvoke
Binder
BindingFlags
Bitmap
bmV1dHJhbA==
bnVsbA==
$=?<B\`]r
Button
ButtonBase
Bv}n\_]Q
BX."q^
+]+^+c
c0-a(Y
C0+LbL
callback
Callvirt
$%#-CB?Lsto}
cbProperty
cbReserved
cbValue
.cctor
ccWnybI=(RMWPybrNoNGI1aHYs92f4KCy4KWz4Kmb4K2j4LGw
$CD193BC0-B4BC-11d2-9833-00C04FC31D2E
{cef414fe-82a3-4aa1-9fee-d0d627057f8c}
+C+K{%
ComInterfaceType
CompilationRelaxationsAttribute
Concat
Console
ContainsKey
Control
ControlCollection
Convert
_CorExeMain
CreateAssemblyCache
CreateDecryptor
CreateDelegate
CreateDirectory
c(,u#O
/C>W%~
c+	YNP
DateTime
'=>:Dcd_q
DebuggableAttribute
DebuggingModes
Delegate
Delete
DESCryptoServiceProvider
d~hQrIQ
Directory
DirectoryInfo
Dispose
dlibMove
DllImportAttribute
DoEvents
DoNotDistributeAttribute
*D{$UhT
dwCmpFlags
dwDisplayFlags
dwFlags
dwFormat
dwLockType
dwMaxSize
dwOrigin
DynamicMethod
dzN3cC5leGU=
/E6)aP#
$e707dcde-d1cd-11d2-bab9-00c04f8eceae
%&#-EEAKuvq{
e\m7++
eMWOyaLNstG01bjZut2g4KCE4KWq4KmM4KyW4LGe4LW14Lif4L2l4YG54YWJ4YmV4Y2w4ZGp4ZWd4Zmq4Z2X4aCV4aWO4aio4a2O4bGM4bWp4bm54b2b4oGL4oWw4oma4oyu4pCg4pWa4pmh4p2g4qGg4qSp4qmB4qy34rGC4rWe4rma4r2H44GZ44WQ44md442A45GQ45Wn45ma452h46GW
Encoding
EndInvoke
Environment
EventArgs
EventHandler
Exception
Exists
ezB9ezF9XA==
f5Vd|O
f:(BHv
f~EE01\
FieldInfo
)?@=Fikft
FileLoadException
files.resources
FileStream
FiVuFp
FlatStyle
Format
FormatException
FormBorderStyle
FormStartPosition
Free Compte  League of Legends
Free Compte  League of Legends.Scr
FromBase64String
fusion
fW>ba>
GetBytes
get_Chars
get_Controls
get_CurrentDomain
GetCurrentProcess
get_DeclaringType
get_Default
get_EntryPoint
GetExecutingAssembly
GetFields
get_FieldType
GetFolderPath
GetFrame
get_GlobalAssemblyCache
get_Handle
GetILGenerator
get_IsStatic
get_Item
get_Length
GetLength
get_MainModule
GetManifestResourceNames
GetManifestResourceStream
get_Message
get_MetadataToken
GetMethod
GetMethodFromHandle
GetMethods
get_ModuleHandle
get_ModuleName
GetModules
get_Name
GetName
get_Now
GetObject
get_OSVersion
GetParameters
get_ParameterType
get_Platform
get_Position
get_ReturnType
GetString
GetTempPath
get_TickCount
get_Ticks
GetTypeFromHandle
get_UTF8
G\]fa(
go'EB}fP
grfCommitFlags
grfStatFlag
GuidAttribute
GWm1BD
_=h5.u
Hashtable
`HGAg7M>
`_h{u`
IAsyncResult
IButtonControl
ICryptoTransform
IDisposable
IH4ZhF
>_ih{Q
%+i+j 
ILGenerator
IndexOf
InitializeArray
InterfaceTypeAttribute
Intern
IntPtr
InvalidOperationException
Invoke
InvokeMember
J3swfScgaGFzIGJlZW4gYnVpbHQgd2l0aCBhbiBldmFsdWF0aW9uIHZlcnNpb24gb2Yge3tzbWFydGFzc2VtYmx5fX0sIHdoaWNoIGhhcyBleHBpcmVkIG9uIHsxfS4KCllvdSBuZWVkIHRvIHB1cmNoYXNlIGEgbGljZW5zZSBvZiB7e3NtYXJ0YXNzZW1ibHl9fS4=
^J%9]O
jHV`Uu
jjke"S
-jU$4C
JvAZc7
kernel32
KiX_RTL
" koeV4
kPUXw!
l`#4bkBK
`,LaQ|
LBuilt using an evaluation version of {smartassembly}. Cannot be distributed.
LCBDdWx0dXJlPQ==
LCBQdWJsaWNLZXlUb2tlbj0=
LCBWZXJzaW9uPQ==
Ldarg_0
Ldarg_1
Ldarg_2
Ldarg_3
Ldarg_S
Ldc_I4
libNewSize
libOffset
"$",?@<Lklg|
llFlags
LmRsbA==
LnBuZw==
LoadFile
lpcwBuffer
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
maximumWorkingSetSize
~%mcJ#
#m	eax
MemberInfo
MemoryStream
method
MethodBase
MethodInfo
minimumWorkingSetSize
MissingMethodException
MjAxNC0xMC0yOFQwMDowMDowMA==
M*Ne/9
Module
<Module>
ModuleHandle
Monitor
MoveFileEx
m'|P;%
mscoree.dll
mscorlib
MulticastDelegate
Mx,"rp
o1**:6
object
Object
OKd5O~L
@_oo/@
OpCode
OpCodes
OpenWrite
op_Equality
OperatingSystem
op_GreaterThan
op_LessThan
OqT`[W
PADPADP
pApplicationContext
ParameterInfo
pAsmBindSink
pAsmInfo
"PB{*:0
pcbProperty
pcbRead
pcbValue
pcbWritten
pccDisplayName
pdwSize
pdwVersionHi
pdwVersionLow
PictureBox
p|i=DB9
P|&imF
PlatformID
plibNewPosition
PoweredByAttribute
Powered by {smartassembly}
ppAsmCache
ppAsmItem
ppAsmScavenger
ppName
ppStream
process
Process
ProcessModule
PropertyId
pstatstg
pszAssemblyName
pszManifestFilePath
pszName
pulDisposition
pvProperty
pvReserved
pvValue
pwzName
Q3VsdHVyZT0=
~q4@PS
qJb7'8
QkV]d|	V
qUir;s
R9[n5V
RA==,e3NtYXJ0YXNzZW1ibHl9IExpY2Vuc2UgRXhjZXB0aW9u
Random
ReadByte
refIID
ReleaseAllResources
`.reloc
@.reloc
ResolveEventArgs
ResolveEventHandler
ResolveMethodHandle
ResolveTypeHandle
ResourceManager
result
ResumeLayout
$RIkx{W
`.rsrc
RuntimeCompatibilityAttribute
RuntimeFieldHandle
RuntimeHelpers
RuntimeMethodHandle
RuntimeTypeHandle
RW5hYmxlVmlzdWFsU3R5bGVz
sender
set_AcceptButton
set_AutoScaleBaseSize
set_CancelButton
set_ClientSize
set_FlatStyle
set_FormBorderStyle
set_Image
set_IV
set_Key
set_Location
set_MaximizeBox
set_MinimizeBox
SetProcessWorkingSetSize
set_Size
set_StartPosition
set_TabIndex
set_TabStop
set_Text
set_TopMost
SetValue
:sKOQb]W
SmartAssembly.Attributes
SpecialFolder
StackFrame
StackTrace
StartsWith
Stream
String
StringBuilder
#Strings
Substring
SuppressIldasmAttribute
SuspendLayout
s"Wo*a
SymmetricAlgorithm
System
System.Collections
System.Diagnostics
System.Drawing
System.IO
System.Reflection
System.Reflection.Emit
System.Resources
System.Runtime.CompilerServices
System.Runtime.InteropServices
System.Security.Cryptography
System.Text
System.Threading
System.Windows.Forms
szCodeBase
szDisplayName
szName
T0s=`e2NlZjQxNGZlLTgyYTMtNGFhMS05ZmVlLWQwZDYyNzA1N2Y4Y30sIFB1YmxpY0tleVRva2VuPTNlNTYzNTA2OTNmNzM1NWU=
"Tb//cM
@.text
!This program cannot be run in DOS mode.
T`hMd	9
tmc	m_
ToBase64String
ToInt32
ToLower
ToString
TransformFinalBlock
~uAkQl
\uGdQ;
UHVibGljS2V5VG9rZW49
v$~%!	
v2.0.50727
%.V7/|V
v9[-RDm
ValueType
Version
v@MCbE
VmVyc2lvbj0=
+(VO5He
;"w,?)
>WM|,K
$wn>LNAz\z;
w.[O:@
.w& ~P
WrapNonExceptionThrows
WriteAllBytes
WriteLine
wzDynamicDir
x1{smartassembly}
 x/JTf	
Xp2@^Z
:X]}Sq
yjNa{[
^y&KFc
Y+,KTx
Y<nlCk
YXNwbmV0X3dwLmV4ZQ==
z7Wqb~0A5
(zBP)FcX/QlRRL
ZTJObFpqUXhOR1psTFRneVlUTXROR0ZoTVMwNVptVmxMV1F3WkRZeU56QTFOMlk0WTMwc0lFTjFiSFIxY21VOWJtVjFkSEpoYkN3Z1VIVmliR2xqUzJWNVZHOXJaVzQ5TTJVMU5qTTFNRFk1TTJZM016VTFaUT09LFt6XXtjZWY0MTRmZS04MmEzLTRhYTEtOWZlZS1kMGQ2MjcwNTdmOGN9
ZXJyb3I=,U21hcnRBc3NlbWJseS5MaWNlbnNlLlJlc291cmNlcy4=