Analysis Date2018-06-10 17:15:04
MD53041604281e3eb22745fe2fa78f577fc
SHA19e3df82f5524843241f60975e9962efeeca7b13b

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit Mono/.Net assembly
Section.rsrc md5: d5a13d48d648beed4450992436beae8b sha1: f2e3b25cbc3f73e29557f4494f57590d24556bea size: 299008
Section.text md5: 15cfd8458bcb2b63df757f6040168e19 sha1: 724b43f679cae6f61fd5212d2765005c5410e3f4 size: 172032
Section.reloc md5: 318f900548ca2afd27202c720caac435 sha1: 626ddb361274a4e9f5bf2e9dbb8e678fc4a2ea79 size: 512
Timestamp2014-09-26 01:22:09
VersionLegalCopyright: dafazcxz
Assembly Version: 1.0.0.0
InternalName: 4yyyyyyyyyyyyyyyyyyyy3rrrrrrrrrrr.exe
FileVersion: 1.0.0.0
CompanyName: fsfsdggdf
LegalTrademarks: gfdsgsd
Comments: Setup
ProductName: fdsgsdgsdg
ProductVersion: 1.0.0.0
FileDescription: Chrome
OriginalFilename: 4yyyyyyyyyyyyyyyyyyyy3rrrrrrrrrrr.exe
PEhash38d346d9503ab3790bee0f1fdcfaba0fb172589c
IMPhashf34d5f2d4577ed6d9ceec516c1f5a744
AV360 SafeTrojan.GenericKD.1883442
AVAd-AwareTrojan.GenericKD.1883442
AVAlwil (avast)GenMalicious-WA [Trj]
AVArcabit (arcavir)no_virus
AVAuthentiumW32/Trojan.NBUE-3851
AVAvira (antivir)TR/Dropper.Gen
AVBullGuardTrojan.GenericKD.1883442
AVCA (E-Trust Ino)Win32/Gamarue.IKdVcDC
AVCAT (quickheal)Trojan.Generic.g3
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftTrojan.GenericKD.1883442
AVEset (nod32)MSIL/TrojanDropper.Agent.BCM
AVFortinetW32/Generic.BCM!tr
AVFrisk (f-prot)no_virus
AVF-SecureTrojan.GenericKD.1883442
AVGrisoft (avg)MSIL5.CRT
AVIkarusTrojan.Win32.Inject
AVK7Trojan ( 004ac3541 )
AVKasperskyTrojan.Win32.Generic
AVMalwareBytesTrojan.Agent.MTA
AVMcafeeno_virus
AVMicrosoft Security EssentialsWorm:Win32/Gamarue.I
AVMicroWorld (escan)Trojan.GenericKD.1883442
AVRising0x575b747b
AVSophosno_virus
AVSymantecInfostealer.Limitail
AVTrend MicroTROJ_SPNR.3CK314
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\Windows\System32\lsass.exe

Process
↳ C:\Users\Phil\AppData\Local\Temp\9e3df82f5524843241f60975e9962efeeca7b13b.exe

Creates Mutex
Creates Mutex
Creates FileC:\Users\Phil\AppData\Local\Temp\9e3df82f5524843241f60975e9962efeeca7b13b.exe.config
Creates FileC:\Users\Phil\AppData\Local\Temp\9e3df82f5524843241f60975e9962efeeca7b13b.exe
Creates FileC:\Users\Phil\AppData\Local\Temp\9e3df82f5524843241f60975e9962efeeca7b13b.exe
Creates FileC:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
Creates FileC:\Users\Phil\AppData\Local\Temp\9e3df82f5524843241f60975e9962efeeca7b13b.exe.config
Creates FileC:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
Creates FileC:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
Creates FileC:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
Creates FileC:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
Creates FileC:\Users\Phil\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
Creates FileC:\Users\Phil\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
Creates FileC:\Windows\assembly\NativeImages_v2.0.50727_32\indexa0.dat
Creates FileC:\Windows\System32\l_intl.nls
Creates FileC:\Users\Phil\AppData\Local\Temp\9e3df82f5524843241f60975e9962efeeca7b13b.exe
Creates FileC:\Users\Phil\AppData\Local\Temp\9e3df82f5524843241f60975e9962efeeca7b13b.exe
Creates FileC:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Creates FileC:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Creates FileC:\Users\Phil\AppData\Local\Temp\9e3df82f5524843241f60975e9962efeeca7b13b.exe
Creates FileC:\Users\Phil\AppData\Local\Temp\9e3df82f5524843241f60975e9962efeeca7b13b.exe
Creates FileC:\Users\Phil\AppData\Local\Temp\9e3df82f5524843241f60975e9962efeeca7b13b.exe
Creates FileC:\Users\Phil\AppData\Local\Temp\9e3df82f5524843241f60975e9962efeeca7b13b.exe
Creates FileC:\Windows\assembly\pubpol4.dat
Creates FileC:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config

Process
↳ C:\Windows\SysWOW64\cmd.exe

Creates FileC:\Users\Phil\AppData\Local\Temp\Mozzillaa\mata.bat
Creates FileC:\Users\Phil\AppData\Local\Temp\Mozzillaa\mata.bat
Creates FileC:\Windows\Globalization\Sorting\sortdefault.nls
Creates FileC:\Users\Phil\AppData\Local\Temp\Mozzillaa\mata.bat

Process
↳ C:\Windows\SysWOW64\wscript.exe

Creates FileC:\Windows\SysWOW64\wscript.exe
Creates FileC:\Windows\Globalization\Sorting\sortdefault.nls
Creates FileC:\Users\Phil\AppData\Local\Temp\Mozzillaa\invs.vbs
Creates FileC:\Users\Phil\AppData\Local\Temp\Mozzillaa\invs.vbs
Creates FileC:\Users\Phil\AppData\Local\Temp\Mozzillaa\invs.vbs
Creates FileC:\Users\Phil\AppData\Local\Temp\Mozzillaa\invs.vbs
Creates FileC:\Windows\System32\wshom.ocx
Creates FileC:\Users\Phil\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
Creates FileC:\Users\Phil\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000001.db
Creates FileC:\Users\Phil\Desktop\desktop.ini
Creates Mutex
Creates Mutex

Process
↳ C:\Users\Phil\AppData\Local\Temp\tmp.exe

Creates Mutex
Creates FileC:\Windows\SysWOW64\svchost.exe

Process
↳ C:\Windows\SysWOW64\svchost.exe

Creates Mutex
Creates Mutex3770066751
Creates FileC:\Windows\Globalization\Sorting\sortdefault.nls
Creates FileC:\Users\Phil\AppData\Local\Temp\tmp.exe
Creates FileC:\ProgramData\Local Settings\Temp\msezxwc.bat
Creates FileC:\Windows\SysWOW64\svchost.exe
Creates FileC:\ProgramData\Local Settings\Temp\msezxwc.bat
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\42815 ➝
C:\PROGRA~3\LOCALS~1\Temp\msezxwc.bat

Process
↳ C:\Windows\SysWOW64\cmd.exe

Creates FileC:\Users\Phil\AppData\Local\Temp\Mozzillaa\mata2.bat
Creates FileC:\Users\Phil\AppData\Local\Temp\Mozzillaa\mata2.bat
Creates FileC:\Users\Phil\AppData\Local\Temp\Mozzillaa\mata2.bat
Creates FileC:\Users\Phil\AppData\Local\Temp\Mozzillaa\rundll11-.txt
Creates FileC:\Users\Phil\AppData\Local\Temp\Mozzillaa\mata2.bat

Process
↳ C:\Windows\SysWOW64\cmd.exe

Creates FileC:\Users\Phil\AppData\Local\Temp\Mozzillaa\stres.bat
Creates FileC:\Users\Phil\AppData\Local\Temp\Mozzillaa\stres.bat
Creates FileC:\Users\Phil\AppData\Local\Temp\Mozzillaa\stres.bat
Creates FileC:\Windows\Globalization\Sorting\sortdefault.nls

Process
↳ C:\Windows\SysWOW64\timeout.exe

Creates FileC:\Windows\Globalization\Sorting\sortdefault.nls

Network Details:

DNSwww.update.microsoft.com.nsatc.net
Type: A
157.56.77.149
DNSwww.update.microsoft.com.nsatc.net
Type: A
65.55.242.252
DNSwww.update.microsoft.com
Type: A
HTTP POSThttp://91.220.163.32/a2/image.php
User-Agent: Mozilla/4.0
Flows TCP192.168.1.1:1031 ➝ 157.56.77.149:80
Flows TCP192.168.1.1:1032 ➝ 91.220.163.32:80

Raw Pcap

Strings
fg+
+
.
+.
...
.P.@
n..

000004b0
{0}{1}\
.-/-0-213141LKMKNKQPRPYXZX[X\X]X^X_X`XaXbXcXdXeXfXgXhXiXjXkXonpn
1.0.0.0
34256fcd934ca661
4yyyyyyyyyyyyyyyyyyyy3rrrrrrrrrrr.exe
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
Assembly has been tampered
Assembly Version
Chrome
Comments
CompanyName
, Culture=
Culture=
dafazcxz
.dll
{e56a3bee-d47a-4c45-8ce0-080dc124498e}
ezI0ZGJlYjAwLWQ0YmMtNDRmZC1iNTRkLTk4OWZhY2M0NDIyNn0sIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49M2U1NjM1MDY5M2Y3MzU1ZQ==,[z]{24dbeb00-d4bc-44fd-b54d-989facc44226}
fdsgsdgsdg
FileDescription
FileVersion
fsfsdggdf
gfdsgsd
InternalName
LegalCopyright
LegalTrademarks
neutral
null
OriginalFilename
ProductName
ProductVersion
, PublicKeyToken=
PublicKeyToken=
Setup
StringFileInfo
Translation
VarFileInfo
, Version=
Version=
VS_VERSION_INFO
-=+<,-
-	+?+@,
,,,,,$
,&&+<|
,#+&%{(
,	+>+?
&+=+>,
+<+=+>+?(
+=+>+?
+=+?+@{
+"+#+$+)+*-
+"+#+$+%
+$+%+&++
+&*+**
+.+/+0
+)+.+/+0
00Mdiiii
,	+0+1(Y
.0(222Gqq}}}}}}}}}
.((0(Jbh}h}h}}}}}}
.0Mddddig
   0u	
' 0Xdddddd
,1&+;+<+=
1.0.0.0
10.0.0.0
%-#1-		o
1#+O{h
1:->v{>
{24dbeb00-d4bc-44fd-b54d-989facc44226}
+2&+6,
2~!\" 9
2	9[AF
2]p0gj
2r)KO5sA
-2&+>+?+@t;
-2&+>+?+@t7
-2&+>+?+@th
+$+%{3
322=3_}}}}}}
333333E
333377776
37777=7=*
3AAAAAAJJJJJJ'
3`IEwH
3pa"uu
+/+4,%
%,4%,.,++0,'+/
%-41W+q{h
;4WfVZ
4yyyyyyyyyyyyyyyyyyyy3rrrrrrrrrrr
4yyyyyyyyyyyyyyyyyyyy3rrrrrrrrrrr.exe
-5+4+5}
,5+4+5}
.5555k
#55???k
*+5+6-
+5+6+;*
+5+6{P
	59PRRR
.5AAAAAAAAA&
5B`C'!
5I\n1%
[5)m=}
.5R3Ud
.5R6[j
5v/k`-
6pkxMX
+7+<+=
+7+<+A
7:DJ%)TDt
&7iN?~	
7====P=Pqn
+%+&++~8
8.0.0.0
+8+9+>-
+8+9+:
8boMx|.^
,:+9+:+;
+9+>{.
+9+>{"
90*,:OA
	99eiiiii
9Beiiiii
+9+>+C
9E$R~	~
9*FRk9`p
,9+H+I
	9ORRRR
	.9PPPP
	9PPRRR
9PRRRR
'9w14$
,<&+a-
+*+,{a
%-A-;(
+A+$+@+A
.AAAAAAA93
AAAJJJJJJJJJJ'
%??AAAr
+A+B+CoG
+A+B+G{D
Ab*h@S
+a+b{k
Activator
add_AssemblyResolve
add_CheckedChanged
add_Click
add_Idle
AddLast
AddRange
addreSA3AAEss
addreSDSA3ss
add_ResourceResolve
AddrOfPinnedObject
addrSADASDess
add_ThreadException
add_Tick
add_UnhandledException
AddValue
adSDA3ASdress
+<+A+F
AJAJJJJJJJJJS7
AnchorStyles
AP6nIuLg
ApartmentState
AppDomain
Append
appFriendlyName
Application
ApplicationBase
ApplicationException
ApplicationSettingsBase
AppWinStyle
ArgumentOutOfRangeException
Assembly
AssemblyCompanyAttribute
AssemblyCopyrightAttribute
AssemblyDescriptionAttribute
AssemblyFileVersionAttribute
AssemblyKeyFileAttribute
AssemblyName
AssemblyProductAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
AssemblyVersionAttribute
AsymmetricAlgorithm
AsyncCallback
Attribute
+]+^*+b{
+<+=+B+
BadImageFormatException
base64Binaryd
BBdiiiii
*+B+C(U
BeginInvoke
b&fcmPv
)>B_%G
+B+G{D
Binder
BindingFlags
BitConverter
Bitmap
BlockCopy
Boolean
BringToFront
bufDSA3ASfer
buffeDAS3A3r
Buffer
buildFriendlyNumber
Button
ButtonBase
Bvvooz
Bvvvvz
bW<rXC"|
|BYl{xyh`
C%]0<#
callback
cAMRKE
CancelEventArgs
"c];}b
.cctor
+c+d+eu
Ceiling
+>+C+H
+C+H+	+
CheckBox
Chrome
ClearProjectError
Combine
command
CommonDialog
CompareExchange
CompareObjectEqual
CompareString
CompilationRelaxationsAttribute
CompilerGeneratedAttribute
Component
Computer
ComVisibleAttribute
Concat
ConditionalCompareObjectEqual
conDSA3SADtext
Contains
ContainsKey
Control
ControlCollection
ControlStyles
Conversion
Conversions
Convert
CopyArray
_CorExeMain
CreateDelegate
CreateDirectory
CreateEncryptor
CreateGraphics
CreateInstance
CreateProcess
CreateProjectError
CryptographicException
CryptoStream
CryptoStreamMode
current
CurrentUser
Cursor
Cursors
c^#vVU
cyber1.My
-:&+D{
-d&+.+/+0+5+6+;+<(
dafazcxz
DataType
DateTime
DebuggableAttribute
DebuggingModes
Default
Delegate
DelegateAsyncResult
DelegateAsyncState
DelegateCallback
Delete
dggggggggggggggggggggggggggggggggf
DialogResult
Dictionary`2
Directory
DirectoryInfo
Dispose
DllImportAttribute
DockStyle
Double
DrawIcon
DrawImage
DrawLine
DrawText
Dv^ZZx
dx[krz
DynamicMethod
{e56a3bee-d47a-4c45-8ce0-080dc124498e}
E8P [:
,'+E{D
EditorBrowsableAttribute
EditorBrowsableState
	eehkkkkk
	ehkkkkkk
EHoHHfj	
Emmmff
Emmmfmm
Encoding
Encrypt
EndApp
EndInvoke
EndsWith
Enumerator
Environment
E/N\w>gy
Equals
}"E(RI
>@es=;
EventArgs
EventHandler
Exception
Exists
ExpandEnvironmentVariables
ExtractIconEx
Exxxx}
Exxxxz
?^f5U@S
%,F,\8
F{A!Dl
fdsgsdgsdg
FieldInfo
FileAttributes
FileCopy
FileDialog
FileLoadException
FileNotFoundException
FileStream
FileSystem
FileSystemProxy
FlatStyle
FlushFinalBlock
F/N\w<du
FontStyle
Format
FormatException
FormBorderStyle
FormStartPosition
F^^^Q}
*FRk<du
FromBase64String
FromHandle
FromXmlString
	fsfsdggdf
@FTQQz
===G_}
GCHandle
GCHandleType
gdi32.dll
GeneratedCodeAttribute
GenerateIV
GenerateKey
get_ApartmentState
GetArrayRank
get_ASCII
GetAssemblies
get_Assembly
get_BaseType
get_Bottom
GetBytes
GetCallingAssembly
get_CanFocus
get_Chars
get_Checked
get_ClientSize
get_CodeBase
get_ControlDark
get_ControlLightLight
get_Controls
get_Count
get_Current
get_CurrentDomain
GetCurrentProcess
get_CurrentThread
GetCustomAttributes
get_Data
get_Day
get_Default
GetDelegateForFunctionPointer
get_DesignMode
GetElementType
GetEncoding
GetEnumerator
GetEnvironmentVariable
get_Exception
get_ExceptionObject
get_ExecutablePath
GetExecutingAssembly
GetField
GetFields
get_FieldType
get_FileName
get_FileSystem
get_Font
get_FontHeight
GetFrame
get_FrameCount
GetFrames
get_FullName
GetGetMethod
get_Graphics
get_Hand
get_Handle
get_HasElementType
GetHashCode
GetHdc
get_Height
get_Hour
GetILGenerator
GetILOffset
get_InnerException
GetInt32
get_IsAlive
get_IsArray
get_IsByRef
get_IsEnum
get_IsInitOnly
get_IsLiteral
get_IsPointer
get_IsPrimitive
get_IsSerializable
get_IsStatic
get_IsTerminating
get_IsValueType
get_Item
get_IV
get_Key
get_Keys
get_Left
get_Length
GetLength
get_Location
get_Major
get_ManifestModule
GetManifestResourceNames
GetManifestResourceStream
get_Message
get_MetadataToken
GetMethod
GetMethods
get_Minute
get_Module
get_ModuleVersionId
get_Month
get_Name
GetName
get_Namespace
get_NewLine
get_Now
GetObjectData
GetObjectValue
get_OSVersion
get_Platform
get_Position
GetProcAddress
GetProcessesByName
GetProperty
GetPublicKey
get_Rank
get_ReturnType
get_Right
get_Second
GetServerURL
GetSetMethod
get_Size
get_StackTrace
GetString
GetSystemInfo
GetSystemMetrics
GetTempFileName
GetTempPath
get_Text
get_Ticks
get_Top
GetType
GetTypeFromHandle
GetTypes
get_UTF8
GetValue
get_Version
GetVersionEx
get_Visible
get_Width
get_Window
get_Year
gfdsgsd
*\g?F%i
!GGA55
!GGGGG
GGGGGGGGGGESSSSSSSSSSGSD
-?+G+H+M
ghsssssssssSFFFFFFFFFFF
Ghttp://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL
Graphics
GraphicsUnit
GSEEEEEEEEEEEEEE
[Gs :f/ZD
,G+Y{l
+&+(+){h
H6aAcg
Hashtable
	hekkikkk
HEvfQN(Y
HFA7Att
,H+f{X
(__hhbbhh}h}qq
(((_hhhh}}}h}qq}
+H+I{*
&+h+i,Z+l+m
[HjVpB
	hkkkkkkk
+H+M{%
	/	>	H	R	h	l	
HttpWebClientProtocol
http://www.smartassembly.com
@http://www.smartassembly.com/webservices/Reporting/UploadReport2
HY{gc=
H-yYE|J
i05U#AD
IAsyncResult
ICollection
ICryptoTransform
IDictionary
IDisposable
IEnumerable
IEnumerator
	iiikkkkk
ikkkkkkk
ILGenerator
,i+l+m
+I+N{&
IndexOf
inherit
InitializeArray
Interaction
Interlocked
Intern
IntPtr
InvalidOperationException
Invoke
InvokeMember
ISerializable
IWebProxy
+!+"+'%{j
Jg0c#QZ
JJJJJJJSSSSSS
JJJSSSSSSS___
JJkikkkk
j\N]KN
JSSSSS_______
k$|7R{
kernel32
kernel32.dll
kernel32.Dll
KeyCollection
!KKKGK
kkkkkkkk
?KKKKps
_+K+L{Z
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
+K+X{*
l3wI|b
LastIndexOf
Ldarg_0
Ldc_I4
licenseID
LinkedList`1
LinkedListNode`1
List`1
!LKLKK
!LLLLL
LoadFile
LoadLibraryA
LocalMachine
LoginServiceSoapT
+L+Q+R"
!LX70T
Marshal
maximumWorkingSetSize
M{cMi	
MeasureString
MemberInfo
MemoryStream
MessageBox
MessageBoxButtons
MessageBoxIcon
method
MethodBase
MethodInfo
M(_?hj
Microsoft.VisualBasic
Microsoft.VisualBasic.ApplicationServices
Microsoft.VisualBasic.CompilerServices
Microsoft.VisualBasic.Devices
Microsoft.VisualBasic.MyServices
Microsoft.Win32
minimumWorkingSetSize
MissingMethodException
%,M,J+Y{
+M+N+S
mn\[) X^
Module
<Module>
Monitor
MoveFileEx
MoveNext
.MPMMVVVX
mscoree.dll
mscorlib
mscorwks.dll
Mtg`{$
MulticastDelegate
'MVVXXddd
MySettings
MyTemplate
:.MZIZ
mzxvvvvvv
mzzzzzvzv
m{z{zzzz{z
mz{zzzzzv
mzzzzzzzz
	Namespace3http://www.smartassembly.com/webservices/Reporting/
	Namespace;http://www.smartassembly.com/webservices/UploadReportLogin/`
n/a[x>]xj
N{&[E)
NewGuid
{N;h]@
n~S!lE
Ntvmmmmmm
object
Object
Oekikkkk
OnClosing
OnFontChanged
OnPaint
OnResize
OnTextChanged
OnVisibleChanged
OOkikkkk
OpCode
OpCodes
OpenSubKey
OpenWrite
op_Equality
OperatingSystem
Operators
op_Explicit
op_Inequality
	?OPRRR
PaintEventArgs
pGjfz-
PictureBox
PictureBoxSizeMode
	PJiikkkk
PlatformID
PoweredByAttribute
PoweredByAttribute2
"Powered by SmartAssembly 6.0.0.513
)=PPPPMMV
			)==PPPPPP
	PPRRRR
)pql}N*
+P+Q+R
+P+Q+V+[+\+]+b+g+h
proce3SADASss
proceSA3ASDASss
process
Process
ProcessStartInfo
ProcessWindowStyle
ProjectData
PropertyInfo
proS3A3SAtect
proSDA3Acess
	PRRRRR
pSiN),
PtrToStructure
q{*=+{
Q____}
Qkkbal
QNucgi
+Q+R+S+T+Y+Z
Q^^^^x
_r9zJqi
Randomize
{Rc(3_@
ReadByte
reaSA3ASd
Rectangle
ReferenceEquals
Refresh
Registry
RegistryKey
ReleaseHdc
`.reloc
Replace
ReportingService
ReportingServiceSoapT
ResolveEventArgs
ResolveEventHandler
result
ResumeLayout
Reverse
RijndaelManaged
+rn(&=$cAh9?
~ro7Vi	
!RQQQL
rr33tt
!RRRQ>
RSACryptoServiceProvider
RuntimeCompatibilityAttribute
RuntimeFieldHandle
RuntimeHelpers
RuntimeTypeHandle
====S|}}}
+%+&(S
SA3AAAAAAA
SaveFileDialog
ScaleCore
SecurityException
SeekOrigin
SelectObject
sender
SerializationException
SerializationInfo
ServerComputer
ServerFaultCode
serverURL
set_Anchor
SetAttributes
set_AutoScaleBaseSize
set_BackColor
SetBounds
set_ClientSize
SetClip
set_ControlBox
set_CreateNoWindow
set_Cursor
set_DefaultExt
set_Dock
set_Enabled
set_Filter
set_FlatStyle
set_Font
set_FormBorderStyle
set_Height
set_Icon
set_Image
set_Interval
set_Item
set_Location
set_MaximizeBox
set_MinimizeBox
set_Position
SetProcessWorkingSetSize
SetProjectError
set_Proxy
set_ShowInTaskbar
set_Size
set_SizeMode
set_StartPosition
SetStyle
set_TabIndex
set_TabStop
set_Text
set_Timeout
SettingsBase
set_Title
SetToolTip
set_TopMost
set_Url
set_UseMnemonic
SetValue
set_Visible
set_WindowStyle
S____fbhbhhbh
shell32
ShowDialog
si3ASzeSSA
siDSA3ze
SizeOf
sizSA3ASDASe
SmartAssembly
SmartAssembly.Attributes
SmartAssembly.SmartExceptionsCore
SmartStackFrame
SoapDocumentMethodAttribute
SoapException
SoapHttpClientProtocol
SSS_____fbhfb
StackFrame
StackTrace
StartsWith
startup
STAThreadAttribute
Stream
StreamingContext
StreamWriter
String
StringBuilder
Strings
#Strings
StrongNameSignatureVerificationEx
Substring
$@S'Up
SuppressIldasmAttribute
SuspendLayout
SymmetricAlgorithm
Synchronized
system
System
System.CodeDom.Compiler
System.Collections
System.Collections.Generic
SystemColors
System.ComponentModel
System.Configuration
System.Diagnostics
System.Drawing
System.IO
System.Net
SystemPens
System.Reflection
System.Reflection.Emit
System.Runtime.CompilerServices
System.Runtime.InteropServices
System.Runtime.Serialization
System.Security
System.Security.Cryptography
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Text
System.Threading
System.Web.Services
System.Web.Services.Protocols
System.Windows.Forms
System.Xml
System.Xml.Serialization
T_^^^}
T9G2Po
TargetMethod
TargetObject
@.text
TextWriter
!This program cannot be run in DOS mode.
thread
Thread
ThreadAbortException
ThreadExceptionEventArgs
ThreadExceptionEventHandler
ThreadStart
ThreadStaticAttribute
threDDSA3ad
threDSADSAad
[tmmmmfm
ToArray
ToBase64String
ToBoolean
ToByte
ToHfont
ToInt32
ToInt64
ToLong
ToLower
ToolTip
ToString
ToUInt64
ToUpper
TR 1cnk
TransformFinalBlock
%,t-t&8
tyDSA3AS3pe
+\,;+[u
.*+U{!
U=1%P>
U3I9*7
u?^bhv1[
UInt16
UInt32
UInt64
UIntPtr
-ujnx@t
.u%{(Mp
UnhandledExceptionEventArgs
UnhandledExceptionEventHandler
UnmanagedCode
UploadReport2
UploadReportLoginService
user32
user32.dll
UTF8Encoding
Uvtvtvmmm
v2.0.50727
?!V2Cc
value__
ValueType
VBMath
Version
vMBzL]I
=voooz
v*<Q[d
vr/`'m
[vvvvvvtv
,(++{W
^W1PTm,M
+W+\+a~
WebClientProtocol
WebServiceBindingAttribute
w;MXmp
>:wR|@]
WrapNonExceptionThrows
wriS3A3S3tten
WriteAllBytes
WriteAttributeString
WriteByte
WriteElementString
WriteEndDocument
WriteEndElement
WriteStartDocument
WriteStartElement
wwwwwwwwwwwwwwwwwwwwwfe
+X+]+b~
XmlElementAttribute
XmlQualifiedName
XmlTextWriter
XmlWriter
XmX&ij
+X,N+W{
Xvvvvmtmm
xw5]LE
%%%%.Y
*YITg/
+Z+_+`~
Z+'+,+1
+=z+A{*
Zf"`Dm
Z+I+N+O"
Z+K+P{
[zvzvvvvt
ZX+,+-
?zxnR<
{{{{zz
\zzzzvzvv