Analysis Date2014-01-26 03:36:05
MD52d018cbfde3fed7010cca4a2d0b3e041
SHA17064d26d0d7f6d17414909d7dea23a40b9a07fcf

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit Mono/.Net assembly
Section.text md5: ef2a81fd53b9a4374a5b0bfe443b756d sha1: 29acee9ae9476215e8afd83a60922a53bcf09854 size: 117248
Section.rsrc md5: a5ee4ed22eeef9db32bd57f0effc8b7d sha1: 4d311054e810fbbfcd31c39a9642a3964fa951d5 size: 1024
Section.reloc md5: 94ece03a27a8ecda778c84031f2ee191 sha1: 552724318b2bde20b9332dbf2a76b137c7f076c1 size: 512
Timestamp2014-01-21 23:29:11
VersionLegalCopyright: Product
Assembly Version: 1.0.0.0
InternalName: tresd.exe
FileVersion: 1.0.0.0
CompanyName: Company
Comments: Description
ProductName: Product
ProductVersion: 1.0.0.0
FileDescription: Title
OriginalFilename: tresd.exe
PackerMicrosoft Visual C# v7.0 / Basic .NET
PEhash7b32055a9f83edc3459396360b3ad95f7325ff70
AVavgCrypt.ASUJ

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\JavaUpdate ➝
C:\Documents and Settings\Administrator\Local Settings\Temp\JavaUpdate.exe\\x00
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\JavaUpdate.exe
Creates FilePIPE\lsarpc
Creates ProcessC:\malware.exe

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\3b0d_appcompat.txt
Creates FilePIPE\lsarpc
Creates FileC:\WINDOWS\java.exe
Creates ProcessC:\WINDOWS\java.exe
Creates ProcessC:\WINDOWS\java.exe
Creates ProcessC:\WINDOWS\system32\dwwin.exe -x -s 200
Creates Mutexb03401755b38e3ada0cb75829de88931

Process
↳ C:\WINDOWS\system32\dwwin.exe -x -s 200

Process
↳ C:\WINDOWS\java.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\JavaUpdate ➝
C:\Documents and Settings\Administrator\Local Settings\Temp\JavaUpdate.exe\\x00
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\JavaUpdate.exe
Creates FilePIPE\lsarpc
Creates Processdw20.exe -x -s 268
Creates ProcessC:\WINDOWS\java.exe

Process
↳ C:\WINDOWS\java.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\735f_appcompat.txt
Creates FilePIPE\lsarpc
Creates Process

Process
↳ dw20.exe -x -s 268

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\17049.dmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\dw.log
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat

Process
↳ Pid 620

Network Details:


Raw Pcap

Strings
p.AA.A5AA...H.......~-

000004b0
0S24O+.F ?Q45R`mfPK
1.0.0.0
?[34[1I|%X
;59bg!eP 
5BpaVzHfCcw=
}5Ewd
5gS-=P?
5[YDM
7a[\
~9==
a2/R|9Rs#S\
-aAoYGw
acozmqPiUFyUJEJUZWgumhPMzWiNkHJugvbTIcGWpcgdokF
AFtboL2cnfs=
aobO
asdqmMWVmEcVwNBEoSAfDIuPJbwBpYuxpYLWSBFOSbLKCSQYuHPunRaCOIKjYdSXjdhtkunaHnrXEyQxzLuZqkrtWvVmKmoNwqwECBubsWVCQNdwsOsObUVIVUfENImnRrDwidDkPIzuBSfqNxJJ
Assembly Version
ASysxcemURMzQkpYZePpUZCZnNNXKLqjAYLMUZuTrvjDkhjlJLHBVQ
AweFBzQQPdgaceaPKpdRgNUcSNwaxRULjhJDrYJwyGNmhADGPwBTRhfienrYvnDPFTzhBDuJxzLJQzMQavKZDMYHBuFgfQhxDnCnsxBYBqcnrheOhUHeEKZTXQnsOHgeQZSQhOEMzNOUYIfWYBsejjLngkrELUegiKzLhJfsfyXxcksJoYUTHrI
bIUYQOqDJxQROLxLdsuLPeFbqAMNbUmEMwPDfMWkuBUOEyQ
BLPDzBJqkHPNLLRjpUSEShFiVLRUIXfwjnLkjwUVLgkdoG
bMnJGEYWShQmPbvUGuVVrjZzwJwFdlPTtktNbwtYeCuZcSgekqoukNRqUzxkscjgqeykHSnOjBDnVcbTkjdSsJSQDUYyTyZuBxwnGvciSeksEgDcpbjDYzzOgUXLMcFwIojliFgULolDlEhugTBRkKgZlBmkhpybtHFstYVNygBhWahJtNbWkTjkBQPkmNXYqDHYwdQBLHbuWUYLJKDhfAblIRzaiXzbicirzvmZiTHErOdmKNcMfigQqDlUevz
BQTxhOScUcKSJowEUGImgGVegojVcNFSNuSZVylvvMpPJb
Comments
Company
CompanyName
cpTnaStuGoFlVIHYqKdAKVECXxxOYqhdsMGObCRvBfsDijtZLqTbjofoWSnvWR
CypmzlDiSYaZnxPkZrioBOYInfGiGJmBjlZlslRDZDobGFQernJnMxbFIeoQ
CYwDyK
]d>0
ddDcriPcCjaTTXNKyoJukRRGHqmgkONhFqgqFZoDXUZxDEGHZMoIfYdbeeLrGtvUrpPzyswsUonwqrxXGcEfNaQjhDKPXrbhnNepbVuoFXrAXVIqzMmFNKgQPWOgqlEWzhHAPtMZhnKEmGPXrUEcZvUWpYdblKEGogIBwzwYiqdVYov
dDIpHbcbVcOTFCOAZNoTEkRbdJniNtaDOXHaOpUzPYOqbrMAzhewhoLImOel
Description
dpeYtnPmLVThUdKfUMYJsdgZlpnxEhZJWuQLrIGCrEwIGcuhqMfQ
dVotKpxgYoyFoxZdTRGiZCyLgVoYIFxWIpGZXprUvKYNJAYGQppVzSexpmI
dWErLFYjoSIbpqQfHQgnsvniXZQUOKrGQXHNECvarcbfzwFyuYtkounvsmHKvCAWvKOmAFOqkcmVQrlDjnBMJfnVojHmhrflnYGRuclHpFXwjrRXwwlUzSwjhEzUsodNBRCgiVzaCRLBKFgBpgJGVVNrmRDDTjXqhewGmZwOGCPMKIGUHUiYDT
eCrFlTwskymvPFkDxCVgcjYmXanzmphKmHobqCvoRyDzyWsP
ePoYGXPLShXsOdgkzvUMHZtWrpGXjosZIsSwHJnnoIWJbKkZamqNFZ
eRc@tk
EttgRoXSIbkUuzdPeTQiZFwjNpRWWLVPkxtMFVjacYcvdEAxSJYcCBcnIZrzYwlHxyYSAtonGrMcZqSREVekxGrEilBnHCAMhuksBLXdOinzOJDqozyRlreOnUJuxzENrequktYdDtTSYdxBYovdvbdZUecWImscxGgdMgWaUTrfToiKlidDh
eturtSuGNnjqCMECxqe6iQ==
ETWQlqNjUffkVkKdIjsEOZNftbsANpFPecuCEwPYQEWToUpmiydMDWWGKxZXXWULDvSexjKy
exApNYJVRfrWYotEfYmlHoTVXuLkcDbbCnzgUBeyNFfZPTwMCYpYKiUPBbGVBprDxaVVzXgv
fbPka
F&.c:%eD?
fCMpjcoRpLElztZclSVBgiZxopkpyQCNWhHwkNUNmPGnRVLWpsnammHTQlPpdlNRDEpFrsejWTVQTFiWqnEMSbunMmvBmhJYpbkltzVaHfZqthsWCNxgNkorzDtOludtFVKeRthJIshhjqSpYuCMuqATgOnxfUcfzXxoc
Fh\/*wh5etg7LV
FileDescription
FileVersion
FpBEZkMpaVCtLpfOBmHyOIejKWkmEvNTaneIJzRhjvcTjeqEQjsHofQMPqkUKQlC
fRXkvQJjgTeCyQNuLYMqEEubFvBaPIFGJdvqytTjySeITsLHGpAHKhjuyZvDzApPve
|,GHn/
gOzdfQzObjycTPpNuFZzegTNKkiPiMKLfeuHzHTdYnfsxaxKyjJkJbsONRECxdihTvwKuvcmUWNEERmRdZkSxRijUwYopnUaLGoQLHtwtrDoQsLrsQvvVZyDHEOQNTiePvRxUQMBzSxkkLgGWKMrtXJPyCxayULDXlENrxbftqQbiDrNmKbGZIQylbSphlFryjcgQjofp
gqgzjjCsAKQsuOMufuYPMcXpFrgZnzHPPestiXidikXkypNOahgkqFOwwkxlQcgNKerBAyQpNtyVSwQPdwXZPERKcfNIdCiACjpocFucMKYipIsoiBIeYJIVnRpPvjiPTJrxDQDJumkBNEaQhXGdqeFoxynbqVexHqfWLORGsYfyaHyxfHXPnqLXfOmDTLQSndEttYtRUbIKmyjYjCuqErvtrFlpMeZIWSLxMgkzEfbUQnianNtwViquZuCmjVWrjluixzGDk
gyiOgYyNLShfUWnSDpliwLiSYBLvREVcvzviJmUTlPUbErEpVoiKaitSyjsgqTNFejjCOJhBEuWHUHQmFtuFEykgzEHFMajROUGvINRPMdELJrMJPlEQBaEWhteWTlGofYoUVZljOqMyKCpvufUYQJQxXWwNOvteFPVIBrGSmClBZjPDVxdNBujQxJzMyzKuPOqtDHoXHiPEEjrVIVQIdYjibaBYtTukqoJdTHCDmowLSUhjPoDxLGsPOqXkluRDmcUD
GZtMHvck
hgoRypBUhbvofZhvXbCUHQWTCOlGKvtqqEakDspQFTeHPFrVmMKJEZxjYvItsMyMZNTylaAJzORdCoBIdfeYrYPopDOnQTxMlCgPYIWiOHVLTxzpxcbTwiNQDgUxIjgXaSdrpNsVCuGMrbzvyOEuZewQboftembvFYnPICEPVnpwTWUaoHmOREQdikszaEIxKfJXPpQCgcCL
hhnbeOwLLZBtgabzrbureeEZPlzOVRCGFlfYMzxOpFQISBBwhirfispQzgWojhOoQDXMNZkMRNdWiwsjfHTBMankswsgrHBxiXuCQoTgqrnDDnMEvqeiYWHJmVwmWcNtxPMXtsvmUTQsNaDTlLuOAipzqgEuGvutRGtLdnJsMUiesMLtKskhaNjY
HI EJ#H
hJHEWooDAdyBnrvNLKoyUilIufKzqwOtCqLehGLCEZJGIinZEAavvYdiIbPKmcQIBVqdQQCMWrEbgPrNmNQxbYHNUsUhJtXUUEWocAgYrJNTzYbWUitwfPYtqnAnudlZWefIuxjgjLEBstwTTnLwfeUoUkvkPHSVQqYvdEmCZbDbFuhxdYNPEZmavzcSlnuhIhoelCeVnjkOsgYVTcXZSMpQYVChYfzUlfwyAsFzhLVCo
HKHyfomUAqHxQOyGHBISKsyMnkHvcKQgqVtkitkjeudgSyXuChRuXYCRbQgdQrfJAPrOZTHrHlWNQMCDJwTFFONCsbLNHGNuTWgHigEwGyHjSLsRKTfrqbOauMjDIpGfKDUuWTnCRmcOEQgBLDRNgnkCwJlUvaEPPHCJpcZPRXWleUf
HrvfXIdIjGwZgjOjhFrpFgxiBSSvKVnJJQkjwefySmGuVNjyKKSpWgvsKgJduVcZRmttRZbVTfmPZNGVbHevhLRxvcNlQXWkzuEJeGYBGcWlmwnbElJJikSZcwLVTrfScdyieofSzQsJEdmtNkphSSGzbcnjzqJVcLSLmDwVlimXYLxWtEQiXrzMJ
hSK.C
hyxOBLMgeHCluWfynUTxDrLKIPptQcFwZOZVTxmBgIZzVypFIiGEekXEuufhXuyhRs
HyZEMgyinhTNoVxLFypPTEBILQIUtgmUswMqDJKFyYgQJbfLKWLh
I6d1|>0]o,cvrK
ichNCZkjNlnYOmjEdoyDLIHybcUPkqVvxwiglIgzIccRcNMWFSxYkfPXyannMPouhzQjJpotOrxoWuXXJkMpPKXINPbHwhYaduYZxAkTsvWIoURiwNDlQlElQzoUPMkqgkNirCWlGDxibdFNSeoKxrGCvgClsFukhqmPihwCdjraEo
ihNljIOFUmknxmswiEjMrhCKsDgNbnkrgJWnmUQtTlrzMtawqGzB
IHQTmWfNCqoDweYKILtRqOparrjcqpNjIrFVSRjmbhYWSfapDRBYpLTeJKRJHOZsANwesqNxBlkayRiSUXUFZNvBefLUxaoFsxLhvvMLicrCVprGPFWCdVQINbmxwZClrXSUIibogkQrSCvVvqbCimYMPbOimNIzHOnfNDBwCjciWGpYWGEvXNQcuGOPAtDJuxrDuKjyFCuQQAWgydbVdmTKtFhWQheOBydjDRIxPqcipjFliLRkgzTOKZgipYWBesPkxp
IIUGDeCpcxllHMptpMNREkIEprHJiAWyVkzowipfwVeSexkDfjLYbhWwJuRVWRhrPculFDpvDpxlDliOevHBDfsfSqKxbvRdsgUHFKrSBzFyHyZJnpPFJBKmSbyxZIMqHqnJZajfrvROSDxVHNxvXPNBLvydrZKLHBOBnRHQaYvnLXripLVdTqpExtXyFPxX
IkXzIpMnoUNbRWPLFtAIJMVkcTaHVZNqoTsdOxENNBEqEQPOljgIekxLfVpIdNNzjXPLTZCfXqkBRxOgjizINdelxsDaDOlFAYJnEWDEZPZxlTIdJRbwurKZlMmwbfaWxwxxDqAybtRwfrSSMgNHdlqDGKMhNcMhVyeyhqdmXNzfjLORujvgoCzJBsJCOmsMUjXXzUGO
InternalName
IRffcflmFVJxtHFCNInLcIQDizhCJXaudjwfnWtTuwDDOjKhopQFIUUcDOPXqwuOqlVQCPKmoSWwheWFurxCtfpQrkrXwMBgXstVWDzyQFELAoDfJjVlljpcbhCkcOLDAZCcyjaLBep
iRRjKtUksCoLfLRYQBRbPvXGvDIhedQUyowFUxPmhGPVpPzobrXYaBptFCfJSDUeKiZssWHGewqqgnoyUytoxlkOiIuWLdiUpmjyahGUFPBXztrcQKMWbNPqzJjXDSPTHqIXMrTFgxcSpwRDjPMaGwnDavgNpmXDhheTxQDnakDdwKWCwDaBjBKbgGTtQyPylCfldRR
JmctEfZiAAsxfClHMrfEvYtsBHGdncPJtqEX
jrEwbYwSbvWdCKQuUUMxDHrBdGgWNcBYkkQcpmhhhBSwnAonL
JVwGCnPEOtnhBicvWzNyuwjPbZqdrZRkijCCVHmBbvQoFxEKyIPOosDcaVUqJGYRnQOsWqZQzcWbdTXKfRbLBzFHjCEyEONKUgqDZfLzeAMXpkQyLqHQAGVGwjCczmTSYsoKANcCLfuCLmRaltNGIAjbJeWDOPYqtPRpUeH
k5e05qLri
kah46/@%
{k(c
kDFdgaVyhzcCQlaDnDiPPwtSLKGnxbzwNPpQwAkmdjJChjnBuiubpxPsZxLX
KghvbCPSGkJSbbrKiRFeOTehqwjORSinrNDdlvQVhAigWfPlVOnIthbcxBxsXUVDQeixzqaKOMhjODuFngZoduomXMFCCMvRJBLlThHrcpvHGpubOmDFUBhUtyvYHrYkyyabuPcazEMjzldHYEOqSxUglhJppDSRLqRBdlxTHZUyvmLEtCubadPhcijjzrsV
KlPixqPHRZBzyMDMVkcQsfWHFqFUpqLwnQmktFOfsOjueavfarATQVbTxmBkpAynFpoIls
ksfjjXeoatpuLthFexHjwwThMlMkWPPTFVrDdTLRieOQXMYXKrXeulGovFz
KsGzEdBTsoCeiUeMKXXiDhmXCsrKwEpcUexULNhXqPTDqCGFFJvRzGfthfFytdaDyUqyBLkXOdhtOHoshXyNnNLjMuYuBausdrOuMtVGuzvMuQPSENEQRSbEERKWMZExTKsLDoROdeSOiOiarYMcharlUflszEhHFCKXbFPhsdrWSjwLGMxSXVJbYsceEygSBcuxTaOGBGvFoKGVNlmHbleVeMLCNpCZXrWHUgRhUUEkjYOybFHRjEDOAwOfRKwYgDSWTHa
KVVToKgQeGEaVhxudZdkSkYlarZfGZUdfHSMICFpOfBVashrkIPQJSIkTuSujXYYag
kydWGhByjyEzCItnXBSXTiZGRCjkXaRyEQqyCq
kyVY
kYWQif
kzfcsLJRKPnJzDQSRmQSWQNtGrKnfMkVZMwREbFzsMDrLlOjdQqNanuCVbVRJavhJEjGgLGeCuaUAyjyKxULhPbXMttVdfxhnYGDzjDloIRAtMPtNcPVSQxnhouFOueEPNdPkSiFEyrsSvvBoAryKLwffJlfuqggpUNyPglSzJPCyWQFoNNDjXN
`l<][<{
LegalCopyright
ljFmTRYBfgCMSUteEGEBxqQoxZgEdLwbYCJkHlUZfCZOPDSKSlNJcvZJdzImUPNlAGzOWpRLqJwZxGHuzeQGTcVDzduOmThpGkXENccTDURFmChmVStqJXkFJGuKJWPPKfNJaKKWoZSFdEzPBqePtxarbYrcfoTnjfCdFEWyRNhbRbSCLoFfSPzpWRTRxiClxXYOyZWaJXtWxjtdVzEmcpPbPcJfEUYjVyJTyhScktirRqlSAMKoSkfbd
lkQOeHLLKHnDTmyiGEXBzrLrasrKomodTluVfsFHgdBaUuOJKIpAvkORmCDrBHBSYCwKYfuflkIQMYIhTumjMhiiUJTnhCEyPYwSYHfamTBLESTVvpWWgjzUFVizhExRGHWPWEPoyjHgiKxTFBThsYPWHtZvovkTMLxUFGzPirBvpjtXKmGljigipmRxsKSyvtCDOvkzFyMb
lvlAGQtrIsXiPAjGfOedHOsGczIJqNbvTcDOXzyGgigajAGYjnzoLqCMHbm
LzskEjNVYJJkogpQGMIoOXsFVwFfZQPJbJDApKjSWgldEzuaCBPDWwhBmnEEfJyOrUYfQlKFEpGlEjNHgxCNFKacZexhGKxUqeizPgLWsfhNIaqaYfhtAQmJfNCFbdwFnbXgLQqdbIKztflCEHoIHYejMVyzEpWGYchMwwWRgORAjBgonybNwlhAkfhO
mCBMOgbDalWUnhxNDLzEBJkXlwHLUQKrZXivyFlEoyXCgbtvzswoTwDbvDiAdDKUnlwXEYhhkPZTAIhtpIvgOuZlfHInilYpriYeUdVHpMubcgHozviOgxzIasrKyxRkfqluUpCOKdUfaBBlQaJtTCjOgFJrwZWJyVpvawLGpcHJPJzljKgxxvLEvIUKwI
MdtFHKGhNabOAhFqszjYybgKUluKOjTqUkfgttbjNFqLqOERwlgLxwRRLalFPRWlYCqIdosfvDNuiBvcNvXfMkLJKFSsFpMgrpCxqMnBLOIYEQUDuYVqSLDTSWEdNadIZudFIjiLjpFfdOcsPqyrviekTKUPtMBaKiqHYUGwHXwnHUiJQvNKJpYPsyalOzrtgfKOC
MHDWIsrmfhPumsJCBrtUFftimebFOdBfIBYBpgYxdxmYLgHUWVpdftghAFzqBihDrwBZFhdBJdcMVcvbhpdaFWphaJzEQVbyUWFflyCNgzFyygUorbdzNPPvUSxlpsffzBGGQgpuprXbwaUHFLokZAnrHPZGAmOpMatbhlNaYHXnYHi
MICThZmXEQyuiNXqyNrfzKIYKccRpWIBTuUilWSMsmdcVlrTMmgnFJQpwLCUzmgZ
miiSIQgAwBgsJQwguNHKsdtKaxuxHhOlMMzKHriGuObOXnnkCkzFqnBfjKulaYEXbyHtvMPkkKgTynKKHgjnlVBkEyegmvORgZGNnjDHIYwDXncxiLFqjWsbuBdHHSnQYyOxQZtBmaLrzILahBWmnZoiNWyQtHUelroQ
MIZGdfKPbiUnEOuZZdtMbusjKCyrctPlewiIsfcCpOQgjwgKlrIzOhhPcctrSxTZMExEmFmdPQXikOTqnpBWTkPwKejuIRtRHoisEhHRLrAifoOxrIFjGxZcaIpbEGBhbkugKCvfNETjKNgiBiwPiUEBBlDbcZFgxYlQcwxYVxuWuhkdBrheqTeFQreVsDXMOVtwbqYwZ
mpravQVixxaaMrtdpKshmEVivJZewBeoPRbWxljWtYGNFpRTwIwfQytBhUgwhcvDfvUJquspOqWLiyRoaCZUjooOCrOzZxslCPCnUICObqEUoiBQwgIBkpPubQEoTafOCOILfnXWELmqUHfbfkhdRQfXZfmSKaONhUdTKnPrBbUlJwwCcXfrXRZslsLCLQIVsdIXqg
MWvThchGqDPyPtWIHQPFyLswGwMTSyRmUcnUG
mxnItfpNNqUEGUTPUJbXHXUIWfzROKCrwDVOSneFDTntFSqyOorLnqiLlUpWYJewindGsEHvJMWxZQZOaicDVQqrdkPhdgxmaWTVYltIqLyRLgTeMVhHqIJbvQghXWWxaajDrhGabvdgwbXCvMeyOxTHYfBkcQIcTsjsEHqnnMWXUZgVEqdxcZfvmxZorvErYrDoGbGWwBJpZnDMJuNEeCAUHGkuLXRQILYutEJFWCakGh
 n^<AMt
NceD
NcxyJSNq
NeeTbmakegvbGNdOGlyrPyGwkwCwfpzkjgftTHYObtsfQWnXQEIWxfckHShfGfYhkEfkavgZoZALGCgmxFDpuKEAjnBifdBfHFMmiBMgexpRgWkkYPGfbFygEuezZOokwhvrEjYQQJlmwyeYpQAIIONMkfluvioLfnGdrhDItMUEfkK
nHxBsGSBbVqtcxdkCmlAGjegvmQwlShaWEDoSWCECjvXFcYjxiURywphmlajVdfnUTJGIlUyZVgfnPHviTkAEGmQJDagseefQCodEDzQzIcViZlgHBYeooZrRZXvWTavJLFGzlvysEJPgpMmjnLXreEFZJvzyfVdLDiIiRIrTREhWsnIcmZBDJbBwOULLuPZmlAFteqp
NLyyfbJGxNwMpWaZTxZJfdwOVFiMLuDGjXptnZFwwEDCpGRTlAymvigSlgsYEgufRJTnMihDJUBfpGZZeofFEUfrCQopxfKupraNFxGjMdfepQOzahJvIkHuweKrrnNJcoxBUNpxeBdhrhxDzBXrIYahvrvPpyTeIWamFYxAqJkVxzpsfQLaGgBPZZjprIpOHLxCQbtBVWpdJNGasxOfDCwyMxPAMqWBbDfAQrIvKgmcTIKOPUoBibrifbeRFl
npjYWZgnbgKShEBIvQdIQNghIBhoRBMTjreUhHPgIMShoaVDDPQtPvtNMCrZTQKIPClfOYgfLulVqWerrjDpuyIyMavozHlbVBtyioOvgsaJDyDvzHtsUeCKyFvbWkQuqUEVEMowGlmuoRViRRnvDuBSJWthAHchOpUrryhDaKXVOhHagumvJFirjKrCzfvKewqHJIVldvijqCpthZsnDQXBMCqhiNyybWUMUxgQDcVejmuHKpHRylyTggrRPNMRtwHBp
oMkYiqhwkjQUEUsDeiuamyvxMQhicSxkplmsxfQrJbqnbbBolTUHWLPPbVcWrcFFqL
oOCNzug7O
OoLaZCIrWpSJuCrNVcYMyfQsySGfXLQYfevwtI
oRGEHVhczRmxwSWscpfHbcRHHzTKpzvMuMhqGvxQjSYRBQuZkItMdZVLCzPgvZuuDMInoewPzmSbztoCRWjywkwKYkUoCIekExnoVfGtkIWUGKhwJNCNuRWZJmkfZIaClDVpOHDZfNktkXeBQAmcXaypLybjKRmLKljROaZjMsznUTjMfFoaZigaApVrJzxEGYvRPTG
OriginalFilename
otJxPLoccgXNfGEFygFnJnibrBNiqLgsfCnxJzKCqZllTQCcjLAsRptndjqTYtuYXVCCyOTaYasqbeCFTHLRgmjXGFRZLYcKLLKpFqyxUvBDYknnxitmWSmhUdyZYpMDroTlxWhVaVzgXreRDGdJVkURTsxhhgFJSmRwtDwlDGFVfwe
oZnjvbWXSNWGikPQyOLnNwBQuPQYbOywGpqaPofOwWKwvsBYSfrEnwbNktZKjuyXDcqpec
pCFiLhIXyRhrYxhijiBiavPEwzXpcwBFwicZHQAHOnOpQwIMumWcrXwXFDHwl
PHgpShTLVkmkZTWlSOTGoNvRsFXogkGeBSscySfPpovtrggMVExVsJhcyciWj
pnlqUxcUfpsHisFRROsMWqyBxtMHHyKnBRMdGptoQyUVGefpIJzRnyzZDzeHDWHzJUZTvlMRpEQngYvCsmVnSfshUjUylvMBHNhoIZODxWplcNkHQLQBgZLZsNrJbLGurJqQPviCkPzqRofDYwqlyToERzDPuGZhIYKakmCNvxCdToQuKFFQoEIXoHLrKVxPBTwuooEobkFaDBYhVDRSZUAgCBYQusJuRKJyoWfWpSKrSkRCEhUZC
+=ppD
ppyGCnBQijSODkpeXshXzJcSOYLXvzhaCAbMzvrZvdAsWPGrlygzf
pqJDsrqWTrZgUKTLBHIKNTBKrGfLiNfRNpMtafOinRDiwfAlLb
Product
ProductName
ProductVersion
&)pY)MlbVtZH#Z
q(d;R\
qHEgTnnUzXIyIXxVfCgTJOPXpxxtnmmHLojPxNdGVTznxfucUFEEmYIeJemVWwiwIzrftyyPnkqrFwauojLAvDCyAEHQKINljokiPndESuTIsdGnkQQLZjORTYohUzqumrmtikdVNbbfotuTCiHKHuIJSyvNYyLlFOuBXfzoPyWAGKsihbhUWXOewxuejrILhUPhEMYLUcOuPRjhTJzQnFOdAjtHUVNXPWGNyUin
QmvAxubIsUhJpmOYkywlbDJfOqMkSnDbKZWDHXNuLNCKbxVCZrnKgriFVKfNIaNoUpqKNDdcXwxoChaIuOVQDGCHiXwIqXpLxWCIONTzfEhJROCMmjWdUxEbFTXmnoUkkkceKwxSLGwCWnPUbWgdiLBVNTxfAUSRJCFFDBeqpXfETcprymAurIyiuLWgLyPwtZTwVcb
QvZfxMJsYKuLKnRpzCgdwmWuCVVCaayKsJFdghokHiKJhSgegIPaPHhzdWkKGtPMIqcZjkmVZjsLsZvvbaExxuJBqGLKucPGuZqltUozkNbDoRbcHHfCjgNGgdSMSVzHVDhYoMeaRqYSidNHEGSmtKzZryvPBsIznXSuvixgVOyLBfrURTeJDCIobLIaXQfPxbKHpChycPrUqDwynfcoedhlMUCIIEmAKYUyqWPCbmRQimVzLjxc
@;`rCn*M
${rd
RgEYCLTetXqIgzIcfwxedEffsbhflZKmDVqNNVHNEexHuGgbmnakyJFbtSHDbvJBoEJmiddQx
RLdaxT
RoUzOrtnbjkYGuXRRGXeNgLdfxaIfqUMWWgecsQwempNTOrYEVvFtNxYetHBnGJqyybXMrIFtUUtWYEODOwLwpLyCfhbNjXHantNVikYuCMwSTYvpFPfYHRLbapQFUaTeMWgEMKHLEHGHtNcqQnuaJeTcCTDSJgjkozNOZzPRxsFsuoQjQFnFsKdieJWBvEKVrRoBPP
=Rvl
\rX9sZ02RjE9*
ryimkKjnmFSxpQkDGawUZfJIlcnVOHQwTKbdAurldXgFWDYpxxmYjoXvoSQroWE
S~7|e;/S!Q
SJLLkCBneKYGilwlCOUPpppXZfzNGngQNfZtYfwRrXoxzSIkJhygjcKJVTtytmvmKJaYjzfxPOfVfSabzMEdxYTtlQccQwrYYDsTIsBXNsaxQUBHnLNcRLRWjcdULyXVQXBBjtOpBPxsGmVnnDziWGndMWuSbnZBWdrAkTssogqCJiNOzzNkoooidjYbNqfvLJxzRcBYvxiMsfeFdoLvQTMitcaqhhLwtZMTKoraToXxQRyLSyZ
skwVGUXIEHhcRSRpnnQXSiqcaLWKVGDSpbXrtEbZcZUrpzTpa
StringFileInfo
sxdWYZHToOtRsZInttzgUfBsCgqGcWlfhkeUVJsjeuSaQRSlVJmGkygAjPCp
SYLxPNPfxltKQZTgbgrokVsvvHnKYZucWrTlSDvfRXArOuNiSSEusdcSGBdUvFMoogbkzWGGUXeTqrpAYWZprZLGagZdjyHiWmyDknjrGgvyXlnRwoPjIdfwGrosQZSsWDzzCYTTftMnlxvPmQriUMcUxelWSBizqbtfcwyWqFtvIwDcwwTwDtoKDofXQCrneBt
SZNjexaImCtMEVpnBZKumMZeNHfCmRWhwDavXoxaVvxhpaBsyvTYUxYrjJlZlMPnIYKXGsfuF
SZXo
tiBEEczbyZgfItncbYJtCdGiHQIzVMsQzCARmdSwRtUGBPCo
Title
T*KbddA
Translation
tresd.exe
tTPuzPAhTZbywVUtEmMxMTRyURRdDLPGSlwBVYIGBGsUejpvFDEFmwZERoS
tXjiUCkQUSAtasNIrbbjWbYUBcksXgmFmsxGGjkMuOXkhywtcJikGZpTDwBTSdvciUThEObtXcamxGqEbqknkvuxCVzLtOexsKgQFFJLuXSQDvLJRkMOxXcteRjUibJrioufyQGalCRzCqvncLNUxRFYFzHpHBnwzDMwyRxVuqDlIfOfLfxpQWTKWXVzYOQPlTpqc
tymwqFsTUuGtLfgofUhlvKNGOmBrUxBHlXJwvYiJSrmgGTp
U1oCgL24p
uNqxBglatjxqIRfITMeWGeFfqKUVbwsQIHKnqczYYSaTqce
unQytjIkFFsDxzLGfpmzAnbrAXjCjhhnCUGWvQxBMklYydHPVoSXqLIratLodObhzODkyCrQbVAQNOUecWFBlgeiolmDHOYwlRNAPRNODbSNaRnkTNgaGpypVmBSzjaLkpXgwuFIDdIDTqJyDoQkjnNadWXUoZboHMARdmPOiDrcalchoafTCbSEUTXzImXtHITvrw
UOBjcSZQ*{
UrciPVGKExxhLYBpqowpzxdjLtQGBJRXDUJuGNcGoaUAygQiyCDhgcUapsFgDgWCiVgziOjGaMdZhOTZZVEFiJNWTIJYLwGGELAXOMLLIWeghKsQPKHlZjsYrDkMvvCkMDasVxoXhShvTJVIOjUBbpqjDrqXbRtqCLPjYJBttPtvLjCTGybIRoCAolgZOaUZZqkhYmdXHhXSBXpDorCWhcJaPKjuoJjNquQNQJVbHzPEGXBqPwmWZf
vajlgvMCArRSYcPdqrlkcZQTRvAhhxPvmFlPvtoEsYBZVgQmelXM
VarFileInfo
VCTvIWcaHXsoHPBXokHUMjXzNZZearbZxOJwmxQTHdGMvchcibNHlDlwJaIZDQdwvXWwbCcDzXNTvSpNyOwYkMsaWnRHgDCQSYSGDHBKiCbRiHPLoqXckfiTCJOlkZnOONNguhdYLNLPkQuEFDDaMetKDiORrXYmkVfcywbkzgUdNUb
VpVScfXGwjrVubQHZcAwoKxqNVdbnRkfSQjGjCmXUBhT
VS_VERSION_INFO
vT8gG>
VvZIwbXKMUerdzRMkWqgYezYDcChlSXHWuIOQdZdxUvoBNUXBVkXXLOsBNDIVXmgulIvbgIyaaRKihVtRqckWEJlqotdonejwyDERJgMjxBHBBkmckMgekDsDIUEyrVCNloFtmPIInsrRvirSDjcDfSBWVaCHKgcYzKMRsdbeymfjtkvVzplBQXAeeHkYUfwNpMnrCrEgfflNWMpSXZWgTofIjLREwpzOJpycsciwkRXLEiLsahxAPkesofMISdZJIoHhpD
v-x2+O--;s|J^@fTnUSTw]
WBiUYvLQDJaVMaDOLHnlhvhsLZJabxqsGaXQqZgjOieaunoooIcoJADLAVgihwyFE
w?.ht
WmFjHx<q2Ps,(j
wPwe
wQUGANMolajOECbjQLZUbuyuagwnyUQluSZPIvARXEiETDkQvBTqyMlGTTaTvEfgpsVLMBhdVJSblNEPhFzZhfLuZReTZCTUZKrbnitVXpysIkVPlkoTMHeqeUOhnHTZvsCQNfiKcsgcekjuKGtKshwRnSyCWCsoXmskzRfHAfEBVS
(wV~PpJ4*b2$d
Xb|m/D7j
xfFdDrwniqwKREfGwTjLyWGSWlagekefNGGrRnvjTKKMfCLiHRiUFYOpQmupBpay
XgCwxRdegdOcoSfqVTBPwMPGwBoTOyQvUcDewjnZZQFp
XhvbhvthhDGxjQfCBfDyhsQeXjLIEkdClDtGrtKHALMfsyNsRFUELvNeZQkgegHWsxBTfUwJqCVpCQyNbdStdvDnMPEXIpxvnNAmfDtdBMNsCpznZPJRWiuFmNoeCOJUtLQTpsEHkWnVvkQnEodpoaOSRWBjrpYyYleNvfWYMvyoqCNEggoznuHmNUviyCrizI
XoZVqmeQoJZMSimfIowkEcPuvGgsUqVKbJLODdROMpjbsCv
xverYpuQDKNjnxpyfhPzFgNikPBKkgPwOvmDqnBuaWBHJNLkSaWTdRpHABuZOfPDYbKdelWtypdYQjbCbOFWPcCjWjMbtmGwkRVFVjBbhsRVpNgORZkwvOxcFnaDIBkrErnazlkIhGlnQBVitjgiFfUBLrFvqawCregbxqUCHGFPapaSTQVaaP
XwofVjhlIZXASpyKnzcSwuwOOqWCQqRvKbPWTTHykscUmAaalaDByedhzHQQaLS
YI8@M![};s(=
YjSCnbyERweuGJOvFWMCswiReLjwGohQWsjiJZWjgvCWrEXiyaxGSsUdmemISvUVMcwsvlDniVZMGYJmHKrbrFYotvbbIpyIcxoDzRiZslyhYrvJABCnbzxyOkJaRoWZUxFFssufGzoPODMDnYkwfOxfyfVCVKIXdqMinHuIOqajlcKCbkSJjqZa
YXtrybMVgkcJTVdmCgeEKtxtVnxlZEFPttFUVyyghmUQuTiNCKcjnQhVsSpTwfzMM
yZ*ei
*-z/
Z7?_jC
<z}(&b
z P?
zPqHxuButwjsWAQYMuCYtTjbHgFCdcuPNZOioNMPcLuvLtHsfWdVcueZOHoPtYgcENPkOuufoC
ZzQ[
2l7y4[
2(Ld-5
2+Py5Z]
2qsb?<
>3#6-c
-49!p(
]:4G!M
4Q]p$)7i
4System.Web.Services.Protocols.SoapHttpClientProtocol
%7Urv{
8.0.0.0
;}9G83
9)^jJ9-.
Activator
_>-]A-i
aPkOjrLjvvorIRRATnKQDImlFdLWjxAXeYwWmxsk
Application
ApplicationBase
Assembly
AssemblyCompanyAttribute
AssemblyCopyrightAttribute
AssemblyDescriptionAttribute
AssemblyProductAttribute
AssemblyTitleAttribute
^b;=Gc
BivqiGflHTIbhTwGORfgfKlSSOiObLnacNhJsfwZjLFByljWpdaDldbMhbeasNfHKlwFidDCFlXgPVkIKUuTWSQaEePhjDSPZaeMDvQcvLyzgRNbBLZMpYRPJudS
bQkbSfpZYM
bSfHSJXpbmHbeydOeYohjstyGYardSYTqKXHhmCuwRAyGpoe
.cctor
CipherMode
ClearProjectError
Company
CompareString
CompilationRelaxationsAttribute
CompilerGeneratedAttribute
ComputeHash
Computer
ComVisibleAttribute
Concat
Convert
_CorExeMain
CreateDecryptor
CreateInstance
Create__Instance__
CreateProjectError
CTi&I8O
CurrentUser
/|Cz*x
$D5C\uW
!,d]6]
DebuggerHiddenAttribute
Decimal
Description
DialogResult
Dispose__Instance__
drKFCHLWIphMhodHPFyuPYvMCFluyvmosvydMrQXEBpHqeJJXmpTEbffeidtciIcZOMpRCIbERzLnRJPhaWhmLfPTjNcRCHshisNCtKbasYTRnBOKcmHsErsxYv
EditorBrowsableAttribute
EditorBrowsableState
EFBztIwXRckaIMNEwfUS
Encoding
EnpjVlNbZIkbXTmowcixrrDCmnaQWSxeCallbkcVSpqJYMNl
EORPRsANbHoTIcyxSZpdXmiUuqZyLsaxabGSqWMsFZeaOnafc
Equals
EV&EIM
Exception
fbPka.resources
fQfzsFzvCMJXPyl
FromBase64String
fwuPghbQCIumYKGO
\!GcWa@
GeneratedCodeAttribute
get_Application
get_ASCII
GetBytes
get_Computer
GetExecutingAssembly
get_FullyQualifiedName
get_GetInstance
GetHashCode
GetInstance
GetMethod
GetModules
GetObject
GetObjectValue
GetString
GetTempPath
GetType
GetTypeFromHandle
get_User
get_WebServices
g<KqU,4<]
glhb0c
gW,vq-
HashAlgorithm
HelpKeywordAttribute
hFhxNxYlbbjaIxoVHLbjsMyIiOkdssueRzxJSrDMMHYOcDOP
HideModuleNameAttribute
}HlhY`A
h>Pt]n
>]Hu:%8
ICryptoTransform
i]E[w?
iIzNGhHMGBGGPXSKwDJzvRxEnlKSGTNXSPuaWhaCC
IK2fA)
instance
Interaction
Invoke
ipwNnmDs
`j+Cq$
!j&n	a
jN`OHVTJ
J rjOSI]
!jSyd[zt]
JWclFxQkedjMOmdi
JxjSygtZpsTeruCYrRiDvhTNgwWeRxHZoTAlqQOvgEdYyLrop
KGiexYKcgvgOepvlcMuKHgSHfhSIjRsNsaXWsUaPMacMYrlfD
KH+*I+Py5Z]
LateIndexGet
lLy&h@T
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
*}MaCb
m_AppObjectProvider
m_ComputerObjectProvider
MD5CryptoServiceProvider
MessageBox
MethodBase
MethodInfo
Microsoft.VisualBasic
Microsoft.VisualBasic.ApplicationServices
Microsoft.VisualBasic.CompilerServices
Microsoft.VisualBasic.Devices
Microsoft.Win32
m_MyWebServicesObjectProvider
mnCoGz
Module
<Module>
mscoree.dll
mscorlib
MsgBox
MsgBoxResult
MsgBoxStyle
m_ThreadStaticValue
m_UserObjectProvider
MyApplication
My.Application
MyComputer
My.Computer
MyGroupCollectionAttribute
MyProject
MyTemplate
My.User
MyWebServices
My.WebServices
n4>DNZ
NewLateBinding
O7oii1Kq9DbjkmGZ8CA6fi78P
Object
OpenSubKey
Operators
*O'-V8q
&Ov<q}
&Ov<q}{y
PdnWWJJksG
p?G''d
 Pk k}.
PKUkCYJtMBXcDMsPEgoeLQdwQxEQhoWzrxzQBElDOGeqHTWihvvKSDpjpRYaFUkutWjtUpNYtlYHPZPYGmiLapSmdfkodaYLOaQVlSasZFWqnwHOoDbzMFTxOap
^_pL,3
+PPNUO
Product
ProjectData
pvOkwxEnZMlnFrld
PyLWclw
QbLtiHhFnpyOrwsHExojruXRzNNecAAZd
q^cvt6
QDaTlYkkHPRsklDvEJuvuebrBizefoeTpoyL
qEdGjlGOyrGfLecYVtRVCBDyXruwTqrh
QgCXOsThMXRrnuOWtEPppZuyoSBcPUXxTcEtNGwyRBzoNWb
rAimTDictCZDhHUEciIrPmUHiyxwMjotP
Registry
RegistryKey
RegistryValueKind
@.reloc
ResourceManager
`.rsrc
RuntimeCompatibilityAttribute
RuntimeHelpers
RuntimeTypeHandle
ryGyiOCUSKZQJMwbIeRJoNxhlrUHCfBgoFgoil
S{_c2~
set_Key
set_Mode
SetProjectError
SetValue
Sma4+BA
s;oTA1
StandardModuleAttribute
STAThreadAttribute
String
#Strings
`S&Vd7
SymmetricAlgorithm
System
System.CodeDom.Compiler
System.ComponentModel
System.ComponentModel.Design
System.Diagnostics
System.IO
\System.Object[], mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089PAF
System.Reflection
System.Resources
System.Runtime.CompilerServices
System.Runtime.InteropServices
System.Security.Cryptography
System.Text
System.Threading
System.Windows.Forms
T0mlW33R5933w4Xwn8LL8
TbZ'^l
!This program cannot be run in DOS mode.
Thread
ThreadSafeObjectProvider`1
ThreadStaticAttribute
ToString
TransformFinalBlock
tresd.exe
TripleDES
TripleDESCryptoServiceProvider
U@9]py
UIh[ne
:(UmdS
U)XcZugA
v2.0.50727
%}V~An
VMlOtqZNiY
VQuaDwilLVeydObrMiRktQGVnocCbsYzmQwPCtHPSPBRUzovY
<vxD="4
WebServices
weeUYrWJPGhjhmEsBLvlfKFwpWMTLGXIrcluMsXyWHHXiqXtZ
w*(=eX
wHeLoFkrLS
WIMUJqqRfxTAqqYmiYQFKLNAcQqqymuWYVcgkcxKpfcHxzwdOcylLeVwOnJyOcgWsIzDDaMbMjEQHRJAUmjjFiAglqtOJTcYSsPrhIOcrtXMQwvMYTSJVsqvr
	 ?Wk$
WrapNonExceptionThrows
*x5:~w
;X/IW>
xRORtqQwLmwIczoHPmggHinmTTiLnHrbcr
x~u?Y>
ydkanWqSsVMGbdWsrfrUHFKvDIvZWypylCBKcQQQalUWRylcG
y#e'3o
YHRCNDwTJqUGrTQmvbwzMhipDjLUmXkmZHHGXEFFDmnfjBwOM
-YtJ6r
ZgDVtlWkHkUWVrWKhouEWQrwCJLxjXNdvrFVeXinkpqDotomR
zvC~K:
zX&[am