Analysis Date2018-05-01 09:16:50
MD502280ae8ece57c5fdf28c9a893e4c8fb
SHA1a83d427353a431cb5ef835bed04f9294435b3ea1

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit Mono/.Net assembly
Section.text md5: 5ddd661d2591200f7afa31ef1a3bb683 sha1: 9381cddc6023fb3d850a4b211928e832b482eab5 size: 572928
Section.rsrc md5: c7192085e097124be0c63a87167b195f sha1: 356491acee0af6872ab456a37523ee9158e9fefd size: 33792
Section.reloc md5: 4718b81199356b288a7c15bbda0ed556 sha1: 72b1df12b74ef934f75fd0416cb9dae4d5d24b85 size: 512
Timestamp2014-11-01 19:20:53
PackerMicrosoft Visual C# v7.0 / Basic .NET
PEhash1e309c058d3a91f446cc6fb6067128601550bc0d
IMPhashf34d5f2d4577ed6d9ceec516c1f5a744
AV360 SafeTrojan.GenericKD.1964471
AVAd-AwareTrojan.GenericKD.1964471
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVArcabit (arcavir)no_virus
AVAuthentiumW32/PWS.ITQD-2002
AVAvira (antivir)TR/Rogue.611552
AVBullGuardTrojan.GenericKD.1964471
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftTrojan.GenericKD.1964471
AVEset (nod32)MSIL/PSW.Steam.FA
AVFortinetMSIL/Steam.FA!tr.pws
AVFrisk (f-prot)no_virus
AVF-Secureno_virus
AVGrisoft (avg)MSIL5.BELZ
AVIkarusTrojan.MSIL.PSW
AVK7no_virus
AVKasperskyno_virus
AVMalwareBytesTrojan.MSIL.RC
AVMcafeeRDN/Generic PWS.y!bbs
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Trojan.GenericKD.1964471
AVNormanTrojan.GenericKD.1964471
AVRisingno_virus
AVSophosno_virus
AVSymantecTrojan.Gen
AVTrend Microno_virus
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\Windows\System32\lsass.exe

Process
↳ C:\Users\Phil\AppData\Local\Temp\a83d427353a431cb5ef835bed04f9294435b3ea1.exe

Creates Mutex
Creates Mutex
Creates Mutex
Creates Mutex
Creates FileC:\Users\Phil\AppData\Local\Temp\a83d427353a431cb5ef835bed04f9294435b3ea1.exe.config
Creates FileC:\Users\Phil\AppData\Local\Temp\a83d427353a431cb5ef835bed04f9294435b3ea1.exe
Creates FileC:\Users\Phil\AppData\Local\Temp\a83d427353a431cb5ef835bed04f9294435b3ea1.exe
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config
Creates FileC:\Users\Phil\AppData\Local\Temp\a83d427353a431cb5ef835bed04f9294435b3ea1.exe.config
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\security.config
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\security.config.cch
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\enterprisesec.config
Creates FileC:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\enterprisesec.config.cch
Creates FileC:\Users\Phil\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\64bit\security.config
Creates FileC:\Users\Phil\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\64bit\security.config.cch
Creates FileC:\Windows\assembly\NativeImages_v2.0.50727_64\indexbb.dat
Creates FileC:\Windows\System32\rsaenh.dll
Creates FileC:\Users\Phil\AppData\Local\Temp\a83d427353a431cb5ef835bed04f9294435b3ea1.exe

Network Details:

DNSa26.d.akamai.net
Type: A
23.3.96.210
DNSa26.d.akamai.net
Type: A
23.3.97.8
DNSwww.download.windowsupdate.com
Type: A
HTTP GEThttp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Flows TCP192.168.1.1:1031 ➝ 23.3.96.210:80

Raw Pcap
0x00000000 (00000)   47455420 2f6d7364 6f776e6c 6f61642f   GET /msdownload/
0x00000010 (00016)   75706461 74652f76 332f7374 61746963   update/v3/static
0x00000020 (00032)   2f747275 73746564 722f656e 2f617574   /trustedr/en/aut
0x00000030 (00048)   68726f6f 7473746c 2e636162 20485454   hrootstl.cab HTT
0x00000040 (00064)   502f312e 310d0a43 61636865 2d436f6e   P/1.1..Cache-Con
0x00000050 (00080)   74726f6c 3a206d61 782d6167 65203d20   trol: max-age = 
0x00000060 (00096)   38363430 330d0a43 6f6e6e65 6374696f   86403..Connectio
0x00000070 (00112)   6e3a204b 6565702d 416c6976 650d0a41   n: Keep-Alive..A
0x00000080 (00128)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x00000090 (00144)   2d416765 6e743a20 4d696372 6f736f66   -Agent: Microsof
0x000000a0 (00160)   742d4372 7970746f 4150492f 362e310d   t-CryptoAPI/6.1.
0x000000b0 (00176)   0a486f73 743a2077 77772e64 6f776e6c   .Host: www.downl
0x000000c0 (00192)   6f61642e 77696e64 6f777375 70646174   oad.windowsupdat
0x000000d0 (00208)   652e636f 6d0d0a0d 0a                  e.com....

0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a363430 330d0a43 6f6e6e65 6374696f   .6403..Connectio
0x00000070 (00112)   6e3a204b 6565702d 416c6976 650d0a41   n: Keep-Alive..A
0x00000080 (00128)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x00000090 (00144)   2d416765 6e743a20 4d696372 6f736f66   -Agent: Microsof
0x000000a0 (00160)   742d4372 7970746f 4150492f 362e310d   t-CryptoAPI/6.1.
0x000000b0 (00176)   0a486f73 743a2077 77772e64 6f776e6c   .Host: www.downl
0x000000c0 (00192)   6f61642e 77696e64 6f777375 70646174   oad.windowsupdat
0x000000d0 (00208)   652e636f 6d0d0a0d 0a                  e.com....

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 33383a35 3335370d 0a0d0a3c   00.138:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a396231 38386363 302d3361 32372d34   :9b188cc0-3a27-4
0x00000280 (00640)   6238392d 38636135 2d633333 37323936   b89-8ca5-c337296
0x00000290 (00656)   65363863 613c2f77 73613a4d 65737361   e68ca</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a6337 63616536   >urn:uuid:c7cae6
0x00000340 (00832)   65352d64 6361382d 34396562 2d623063   e5-dca8-49eb-b0c
0x00000350 (00848)   612d6362 36623935 39613564 66313c2f   a-cb6b959a5df1</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>


Strings
.
4
.
]
.
.t
.
d.<.
g
.`.
.
.
....
;.
SS
b
.
.
..
.
;
51
z#.
g...
000004b0
{0}{1}\
1.0.0.0
1414869869_onebit_33
aspnet_wp.exe
Assembly Version
Content-Disposition: form-data; name=
, Culture=
Culture=
{data}
.dll
Download Package
#Ee.#qb
ERR 2003: 
ezE3MjkwNTdlLTk5MDgtNDczNy1iMzQ3LTM3NzY2YTdkOGM4Nn0sIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49M2U1NjM1MDY5M2Y3MzU1ZQ==,[z]{66f5cdb6-a764-44de-b46c-cefa267e92cf},ezE3MjkwNTdlLTk5MDgtNDczNy1iMzQ3LTM3NzY2YTdkOGM4Nn0=,[z]{66f5cdb6-a764-44de-b46c-cefa267e92cf}
FileDescription
FileVersion
http://raldcail.com/system/files/Steam.exe
http://raldcail.com/system/php/upload.php
http://update.raidcall.com.s45.ru.wbprx.com/download/raidcall_v7.3.6.exe
InternalName
label1
label2
label2.Text
label3
LegalCopyright
Loaded!
MultipartForm: Error retrieving server response
neutral
null
OriginalFilename
ou812--------------8c405ee4e38917c
pictureBox1
ProductVersion
progressBar1
, PublicKeyToken=
PublicKeyToken=
raidcall_v7.3.6.exe
Screenshot_3
SOFTWARE\Valve\Steam
ssfn*
Steam
SteamPath
StringFileInfo
Success
Tahoma
text/xml
Translation
Unknown Header
Uploads: {0} kb / {1} kb
VarFileInfo
, Version=
Version=
VS_VERSION_INFO
w3wp.exe
Wrong Header Signature
/	([@@
$018359b9-08cc-4bba-beb4-3f78a1188c94
(0D]aW
0G1CvH
'0Gc9RZ
0=gt_F
]0.)it
0Knz!;
{0*O"^
0(pX2R
0}+t$d
0T\v/X<`fR
0;v"> 
%0+W+n
0[X^}N
1.0.0.0
!)*1+0hVwn?{
11.0.0.0
121018000000Z
121221000000Z
141101162340Z
141101162348Z0#
_1414869869_onebit_33
+1~6v8
1<Ak!2X
{;1b+Y
`~1HL^
1`-i!	f
1,j{TX
1kkkG$[e
1m0v6Y
 1mSUh_!jIJ
1N*hKWo
1%Q"v"
1SJt;$
-:1:Xg/
1>"<[Z
{#)^2|	
201229235959Z0b1
201230235959Z0^1
+2?3/)
23~*Ij
2/:5`rw
2Dfi,Y
+2D(i6@
2Dy?sq
!2;;eZ
2f2YRyK1i
2)f}87
2(#;fi9%
"*2`H\
2jj~P4
2j`p>K
2/p8Nh.
2"qPR;@H
2R<zkaR
._2V\z'
2Wm+:O
2Y4srK
:2.*yAB
?3&$0:
<35?&?
391231235959Z0
3jz"k5
3\M[h=
3}o&f2
3r4_)D
3@S'Nd
3System.Resources.Tools.StronglyTypedResourceBuilder
&\3Udc
3+v9&gH
3Wo0J	
4.0.0.0
4/0+ET
,<41}>
;4:3"[
4{5"(:N
48j'}1I
4A&Ac2
#4Aqf_G
'4J(>kN
*4LCSV{
4m?!l[H
 4~N7(
?4P9~<
}4S(\(@
[4V3E(
4zj 4GuUN
5`7V3f
58V3&RwY
5-?9U9
59v!dI
5Ed't,
?_5-F-
5f/M'W
5F]<w:
5[*G>E
5=JHo(\H3
5tJYg?Z
5#vR+7Gm
5`W@ps
?5Z-d$Z
\65-N@
{66f5cdb6-a764-44de-b46c-cefa267e92cf}
6B	`U"
6&!H@%
>6hi&jWv3M
6H#Nwhq
+6#[iL
6iR2^=-KK
!6R.kr
~,`6=Uu8
+6vr C
6WfLX&r
+7#CR.
7dKc1tn
+7[>F9
7fhe[Bh
7jVDuf
7K<37S
)7K-Pp
7_l}Ex
7q(FKd8
=\7rN>)@*
7-UwyL
7V2Em>
7]vF9m
7y-,y(
-8[4_~;
?862)I5
88?~P$8
~|89&Q
8A&mvHn"
?^8"d]
@8Flv*
8[G,ZXC
`8h|v_%x.
_8.j&H/
8mI/eF~b(d
8}=<OCL
8Wo*S?
8"W&	Y
8<YW<i
9*1WZV
94AEsj
9:5~Rb
9 >:$7'
*9AEQq
9 En0[
*&9[EQx
9gDRcG
	9Goa7
9	HM%O
{-9Kq}k
9L$Ler
9M|hx Z
9M":p8
A1rks;
"A'3"|
:A7#vn
.A9&H-
a9hI5*
aA#Pi 
ACFpb)
add_AssemblyResolve
add_Click
add_DownloadFileCompleted
add_DownloadProgressChanged
add_ResourceResolve
?a-\ep
+AgDj,X`C
aH7o%c
AHt9yC
\ai.2*}6
AI~vyB
),(a+L
AleNQ,
~a'm-B
AMf7js 
AMpy!{
A<mQ'!
A}Ne(Xh
a)NL;Kn
}Aoiom
%aO]~To
AppDomain
Append
Application
ApplicationSettingsBase
aq%&,7
""AqJ)
a\!Q+zt
ArgumentOutOfRangeException
as<=j%
</assembly>
Assembly
AssemblyCompanyAttribute
AssemblyConfigurationAttribute
AssemblyCopyrightAttribute
AssemblyDescriptionAttribute
AssemblyFileVersionAttribute
assemblyFullName
  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
AssemblyName
AssemblyProductAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
AsyncCompletedEventArgs
AsyncCompletedEventHandler
A,T`6h
ATDq]"
AtOx-5
Attribute
AttributeTargets
AttributeUsageAttribute
${a+?u
A,u	:K
AutoScaleMode
A(v#8V@
AvailableBits
AvailableBytes
ax%[BP
!}AZpS
<B&@("
b0"xvf
b36R~,
B5r2XF
=b5T$S
b}7'].
b#';/7
BadImageFormatException
Bb}<Hd
BeginBoundary
BeginInit
Bfbh2|
bF|uma
'/"bGi 
]b!)Gol
,bgoM_
Bh[8z0v
(Bh|mJc
BitCount
Bitmap
BKK$ux
*=bKOf@:
BlockCopy
BM$4dM
B_M5/S
+bMP6h
Bo!IN]
b+pjYN
,bQ fh
_.brfA
>&BtO>v[
 bu$%aG"
buffer
Buffer
BufferSize
buILw'
`bX+3 #F
BX;Bm4
b{yu6s?
<b>zvI
&c`0Ed
+$\C2Q*
C;3U)X
%/C7.(
c"$-ab
& caD:(
CB4(h4'
\cB9ky
:)+cC*?
.cctor
)~cdD2& 
;/cDyC}
ceb	@x
/CHpech
cI#DpLU
>cJ0p9
-,cJ%1
[\<CK'
c"kkkM
CMan7]<z
)C[&@N
codeLengths
CompilationRelaxationsAttribute
CompilerGeneratedAttribute
ComponentResourceManager
ComVisibleAttribute
Concat
ContainerControl
ContainsKey
ContentBoundary
Control
ControlCollection
Convert
_CorExeMain
C<Pd>0
c{Qe;*
C*R/c2
Create
CreateDecryptor
CreateDirectory
CreateEncryptor
CrWT)7t
c\$=sj
Cs*t 	
Culture
CultureInfo
|!cULx+^
CurrentUser
Cursor
Cursors
Cv2t92
\C(@-w
]:cw@R
cX R$	
CY-AvB?.k
D0D|K-
D1]&wk0g
D:4}=$&
D.69v>
>D6z=`
 %(_d7
d:7%$@
_d800_\W
?D{80uL9
Da(^{b
DateTime
.dB&kB!
DDe-q]
DebuggableAttribute
DebuggerNonUserCodeAttribute
DebuggingModes
Default
Delete
DESCryptoServiceProvider
';Df4c
_dFlF=
d	h}Ezz
dHTDFQ
DialogResult
Dictionary`2
.$diK;
Directory
DirectoryInfo
Dispose
DJ]bjb
D@%{jsL
d~lM<|wvN
DL-=t^
}Dl\.U
dMQ)a	
> d;^_n
Dn9TMz
Dn|V0Y
DownloadFileAsync
DownloadProgressChangedEventArgs
DownloadProgressChangedEventHandler
DPG:4M
d;r4)}
dU9]]Yo
Durbanville1
Du&z`JU
_Dw*+b
E.56=7
e 7q[Hx3q
(Ea'ri
E=B	]`D
-@E.c!6
^.-<]ed
EditorBrowsableAttribute
EditorBrowsableState
e:DOO|>
eE$.]=.
_eg7u(
e&G[9*s
E[H:D%
EH*"nx
]_e|ht
$Ek2pD
E"MoAl6
e>MxD)
EnableVisualStyles
Encoding
EndingBoundary
EndInit
@>ENDZ3
#ES~4p<
eT(Ss0e
eueA_`
/^E( /v	
EventArgs
EventHandler
EV{?NL
EW7;'\
e=w*B~
`Ew=jw	
Exception
Exists
e&?Z8p
!EZ'g#\<E
EZxCv%
!_)f1L}
f8UklA
f"C"y.T|
fDN:	]
f `gTW
f{h^_7
@;F.(!h"Y
FileAccess
FileAttributes
FileContentType
FileInfo
FileLoadException
FileMode
FileStream
FileSystemInfo
FjFgqEPH
	Fk37M
|fM;}#"
f#MHpn
FontStyle
Format
FormatException
FormBorderStyle
FormStartPosition
F|PKz9
F?s[g>
~=Fsgo
fUOTZd
%,`Fv/
fx/5WhM
FYRSO5
@g@=+>
G\5Qd]
G6N:<Ux+
|g-%8!
g~b}ad
'>g}C~
G%d*Q._
GeneratedCodeAttribute
get_Arrow
get_ASCII
get_Assembly
get_Attributes
GetBytes
get_BytesReceived
GetCallingAssembly
get_Chars
get_Control
get_Controls
get_CurrentDomain
GetCurrentProcess
get_Day
GetEnumerator
GetExecutingAssembly
GetFileName
GetFiles
GetFrames
get_Hand
get_Headers
get_Hour
get_Item
get_Key
get_Length
get_MainModule
GetManifestResourceNames
GetManifestResourceStream
get_Message
GetMethod
get_Minute
get_Module
get_ModuleName
get_Month
get_Name
GetName
get_Now
GetObject
get_Position
GetProcessesByName
get_ProgressPercentage
GetPublicKey
GetRequestStream
get_Response
GetResponse
GetResponseStream
get_Second
GetString
GetTempPath
get_TotalBytesToReceive
get_Transparent
GetTypeFromHandle
get_UTF8
get_Value
GetValue
get_White
get_Year
gF~j6&
Gg\We)
=(gi/Z
g,||$jd
GJu/Xb
*;gLL*Bo
Gn"/{&/$
GraphicsUnit
=G]r\V
GTm_og
/G=;TZ
GuidAttribute
g|VpHN
GW~$4/"u
G&WBL(
GwsQ8W
gYTrn"[
h0#n,>(=(
 h3vT4&
'H4,'n
h=%5"2p
=hAq_F4c
Hashtable
HB[^!	
/&HB6$
'Hb:!@+u
.h>C0}
h{->(e
)/H|-e8
_#*he\H
hJ35gl#
hJbxx){<
HkD@>[
hL2N1DM
HmXrc+
$/hOM5Q0
@|=>Hp
hqJ|l'2
?h+r0^v
Hrg$Xg
HT{%MP
.http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ocsp.thawte.com0
+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<
+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
http://ts-ocsp.ws.symantec.com07
HttpVersion
HttpWebRequest
H`V{*9f
*HVJ>nz
h$wzPKJAN
#H\{Y>
[hzD#^5O
+H`zn^X
H@z$oi
.%]	 i
+?.i,``
i/{=:.
i}&>+	
i|0D_Ab
I6lg3(
	i,8XK,r
I*aM7.
ia;T0O
Ib$/@?Q
iBZ6;n
IContainer
ICryptoTransform
IDictionaryEnumerator
IDisposable
IEnumerator
IFQM+Q
iGSb}m
iGX<W1o
ih?#D\
;ii"Qh
=i,JKv
i+kgYx
IndexOf
InitializeArray
InvalidOperationException
(I&p4"
+Ir3%gfYJ}=
IsFinished
IsFlushed
IsNeedingInput
iSnqX-
ISupportInitialize
IsWebApplication
IS^_Zw
ivD!i#q]h
ivepHVS
$iW`D5
I	WPJ@
Iw-Ssz
I_X&63
_J0;"^
j0(jD[
J5 j]7
j7+= )
Ja;p1m
j\B7w3Q
%j?$D4d
'<jh(`
Ji|i&Z
J{J3nw
JkU?`,<
jLbxNB 
JmF1y[<
jN~,JK
J,Of"6
=j\(OPo32
!J)PsC
J"Q?8Y
'jt/sS
jVTFoJ
Jw'W#&
jyiHrq
Jy)m-T
JZcw8y
k%)0pL
%K	\1T
~k&2vB
k5m"up
_k5q%@
k78)[K
k)[7Su
K\A}2qD;
*+k[_b
/+)KC-
KcIRL!
kernel32
/KG:?/
}kGHGF
KIRW	Jd
k$kBA!,h
K k.rY
K?#l,>
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
[Kmt4C
=KM(!:u
>kOZ=e
-k%p1|
Kr^?hVL
k:>sF;L
_KUu1J
kw<:$(
Kw un#
kxSNuG
kYP'9p
kzbdXG6
^'kzs29
Kz(`WD
_</{))l
L0hL5 
`{}L_3
l4r9g7a
lB<) ^N
',\lcv!
\ldg'ML
:lgjAf
l^GVZ!?
lh#E9}
List`1
l:}j(0
.LM=IiB-A
lMT#v1t^
LoadFile
;L=SJ3
LTgjt!7
LUxG\-
lv[mJ#X
lYAj=W8c>
LztxApF
M=;0HY
m2\$l2G
M2NrzO
m`\2Tk
~#M7d|
m7P~TL
M$[&7T
maxLength
mC5jNZ
MDn$[w
M%&$E0
MemberInfo
MemoryStream
MessageBox
MessageBoxButtons
MessageBoxIcon
MethodBase
'M$F1VMpv
M~Fk$"
mG%B%-
M.G $G
Microsoft.Win32
MiisFiX%y6.
minCodes
{|M-IQB0
mJhR<u{
Mj[w=2
mk9|*M
M)})L)M
#mnduM
Module
<Module>
Monitor
MoveFileEx
MoveNext
moX`v987
mP*Q8KN
MQKT?f
mscoree.dll
mscorlib
%MUMN3k
m(w20C
mw?g+W
':MwptF
.mX}cJ
m:y52.hr
:My)M-
M Y:{qc1
."-N|:
N2]%qZ!
n5.OCh
N6%!bf
N8;9mF6
N8iYi7J
n9i NLa
NAeANl5
NameValueCollection
nbDv8[
(Nbf}:
"n$BrM
`NB#%@V
(nCA1pgZ*
?nCm|hA
NEa )0
Nf`{W"${c
	NiR7 w
_{ <nkp
NkyUk-,J
Nl4 'T
n=;l#~q
Nn?\gp
<_>n!o0
n=o|.h9xUp
"*n?oP K
nOzs|C
\)}NqM
nQyAWQZK
Nrfq(I
`(]NT,
n{u[U^
N&v&iU
Nv{m"5
N[Vo?{3
NWQ!\=
<nw@W$
nxmR5W
O:/2BbZ
o2M$8[
o`2Xp+
o{9nuCJ'{6
:oA^_ACPYGa
Object
OC[Q('8;
o"^eM0
ofj*x{
\oIfAA
OlA=qm
oNSq7T
'ontijX
%`<O<p>"_
O+P*cbO(
OpenSubKey
OpenWrite
op_Equality
op_Inequality
orJ)zuIv
os:tUVl
&o_Ul~
~OVHdJ
o|vL%?
owf@$[[
OXOA,7
/%\>OY
O"Y[yo
OzA;vc
ozEwN7
{oznU:
:%p""=
+:_)^P
,p7eP)
p8m(c$
<pa0PE$
P#Am;a
pCc$HW
Pd<V\i
pending
P.#eq1
PerformLayout
*+Pg-&>
PictureBox
PictureBoxSizeMode
pIGnF\
pio}Fp
PL"N{%b3
P=*>LO
.p?%nF
}PN'Go
PN]	&$I
pOtU{O
PoweredByAttribute
"Powered by SmartAssembly 6.8.0.121
pPJ5\;
Process
ProcessModule
ProgressBar
ProgressChangedEventArgs
PR-U{x
=PS[Oo
{$p$ThN
p;T*IRp
Pu11"49
P~U!JH-p
p="\}W
\\[PWh
pysY[1
%p[y)V
PZ1lL-
?-Q1'H
q}5efL
Q&7MF 
q*7_W8bY
qc;ambf`
`!QCd_
qdTlLWM
QE2)lSF
qE.cpl+
q}eEd;
q	#H,!
	]q,ib@
q#i{l~
QKB5\A
Qkkbal
QKtho4
QLZ+e'
 qM$,)
Qn9f U
|?q%O$GI
[|qOT(
&Qp(KtpL
/qQP;E
qs=[Bl+O
Q!Sk@q
)/q>T7%
Q.(t_Q(
,qU[pIQ
Q}v]1S
qW$6>@
qW[L^[@
QwnK%:
?QWq37+
^*];Qx!
Qx~O^o%
QZ/e.M
}R[*(:
'R]\0T
R1*+7#mi
r6A4j1
R8C2U?
R>]	8X
RaidCall
RaidCall0
RaidCall_Master.Properties
raidcall_v7.3.6
raidcall_v7.3.6.exe
-RBQ9\|
rC:^C,
ReadByte
ReadLine
ReferenceEquals
Registry
RegistryKey
@.reloc
        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
      </requestedPrivileges>
      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
ResolveEventArgs
ResolveEventHandler
ResourceManager
ResponseText
ResumeLayout
re?w<9
Rfj'|]
rfl^k3h
r<[~Fum5NO
RgJKOj8Dn
RijndaelManaged
rjK"nm
R|L9K%[
%RM&c?
Rp)W|0
~RR6U}
rRFDv%G
Rs6;pf
rS&cZ2
;]~|rsj
`.rsrc
RuntimeCompatibilityAttribute
RuntimeFieldHandle
RuntimeHelpers
RuntimeTypeHandle
RVF#+s
RvX'h/]9c[
R#\weCV
rwO.A|S
R	'&/xG
rxptLn
rY[6("
~&]|S"
S2c3<x
&{s4Y>Gx
[s4Zf9
s5[MR>f
]S5	q}~
&S"7IOn
S%9=*\W
SB +"9
Screenshot_3
SdM|S>
    </security>
    <security>
SeekOrigin
set_AutoScaleDimensions
set_AutoScaleMode
set_AutoSize
set_BackColor
set_BackgroundImage
set_ClientSize
SetCompatibleTextRenderingDefault
set_ContentLength
set_ContentType
set_Cursor
set_Font
set_ForeColor
set_FormBorderStyle
set_Icon
set_Image
set_IsBackground
set_Item
set_KeepAlive
set_Length
set_Location
set_MaximizeBox
set_Method
set_MinimizeBox
set_Name
set_Position
set_ProtocolVersion
set_Size
set_SizeMode
set_StartPosition
set_TabIndex
set_TabStop
set_Text
Settings
SettingsBase
set_Value
set_Visible
SF,NBa
(S}<Gmk
{SHE&y1IQ
s@I,bWD
S@@\:JA\
"SJB/Er
sJjGLY
sKa5&R
SkdB*CR
+sl82(
SmartAssembly.Attributes
sM)hYZ
[sMu6Ov
s~-O`~b
sp2z@*)
spu`9Q
sQL\Dv
SqPJlL
s\R{^I
S%R\o 
s`}Sw<
\ST#/'
StackFrame
StackTrace
StartsWith
STAThreadAttribute
Stream
StreamReader
String
StringBuilder
#Strings
%#sT;Y
Substring
SuspendLayout
Symantec Corporation100.
Symantec Corporation1402
'Symantec Time Stamping Services CA - G2
'Symantec Time Stamping Services CA - G20
+Symantec Time Stamping Services Signer - G40
SymmetricAlgorithm
Synchronized
System
System.CodeDom.Compiler
System.Collections
System.Collections.Generic
System.Collections.Specialized
SystemColors
System.ComponentModel
System.Configuration
System.Diagnostics
System.Drawing
System.Globalization
System.IO
System.Net
System.Reflection
System.Resources
System.Runtime.CompilerServices
System.Runtime.InteropServices
System.Security.Cryptography
System.Text
System.Threading
System.Windows.Forms
'"}S)-z
	t0,4I
T06x#H*5
	]T2}[/
T2sibM
T@3!1N
~t64DL
T7{2wb
t9a;Zw
t9P9	x`
`TA'#DqZJ
T!aUQI
tA=	we
TA-xri
tb|EvV
=T<C	C
?Tdx+X
TE4w'KG 
TE,BL%
TEJ 8`\
TextReader
t>EZJ5
!_Th9x$@
Thawte1
Thawte Certification1
Thawte Timestamping CA0
!This program cannot be run in DOS mode.
Thread
ThreadStart
t&i2K#NW
TimeStamp-2048-10
TimeStamp-2048-20
tina]!
!t_*"j:
TJ;I;}
=t.;jx
t k.1,O
tKo_6k
tmF*}x
ToArray
ToBase64String
ToLower
ToString
TotalOut
]tp4iH
tQDLZ	
tq|!EF\
Tr6>yo
TransferHttpVersion
TransformFinalBlock
  </trustInfo>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
t,-Tn~
T)!u"Y
%tVZS|
't	XuNd
[#[T&Y
!T,:YQ
\Tz|2?
u2'$j'
&"u41Am
u%'>6'
u'9`;e
-u-!a9e%
'$uAAS
@U|ayXb
~$u;}Bp4
Ue%o~?
uf5@-g
uFE$Dc#H
u<^Gk;
u_Hd[D
UInt32
(+UkH+
u@K|n&
uL3rk#+p'
&u%lFjk
 U':~o7
uR8Uh=
{U(_s5T
ut+g2>
U;<T>jg 
u(V}BU
@uvc$*
UwV	;f;(as|u!#
"uXav0
$ &UYS3!8
{uzH;$&t
v2.0.50727
# v>3A
}v4j4lp
v6P9-]
ValueType
vB|6th#
V[B-Jq
VbLjZB
V*BO&`
VC[z2W
v_&D;,
VDe[UV
v#e~C(
Version
Version11
	vf3W/
VfQS7;v
vi\,Ew
|%*#vk
Vk3 ?WZ
VkHh9b
vL&-B\
V?*mfl
~V[MwX
\VnirJ{
*}voWA
V}\Pau
v)pU`i
v;qXhC
v{	{r%F
VRS||lL
VrUCZ_
VtABgE%
#|v|UIoz
*\VVf;
v{x;zG<
:%'vY_=
vz!'W%va
*{}W(	
w0HF]Z
W<5:$f
	(w5N'
w7%[;Ys
wa1?5^
w+?b25>
-WbQ?N
w(c@2c
WebClient
WebException
WebHeaderCollection
WebRequest
WebResponse
Western Cape1
wFSMi-
wgc8u3!
wGvv"=>
w}hLO}k$
w!K9=v
-Wo[B'
`WoyKM
WrapNonExceptionThrows
 W+:r&H5O
WriteByte
Wr#*z/67
*Ws;~h
W)/tf6
Wu=ATZ/'
\W_#W!;E
WyltnwC/~\
>wz`58}
%?#*:X
x#014![
X2C5@lR9
x:40y_
X]*6>sV|
X8@0z.q
x9o iZFI
X`~*9:y
;XC~B(
X<D]y>
X<[e*2
?_XgEm
@X}h%zp
@xj-0 
!X=\~!La
*xlyf3
$X[mAA\
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
x>OwQU"
~x$Oyl
x'r8>DmP.
xr#-}TDd
X\-u);
x,%uEr
XUkweh
xv8cwR
X]V$k8?l
X|XL9}
xX`W8y
X/@ zF<
y1K%Mo|
y2)3F:J
$Y%4;xU
Y5,)0V
]Y68EN
|Y9i(A
y9ouxh
yD* `*
Yd7b_8
ydc nSH
Y(+dn'
yDT5VW
YgoHef
yg^ONJ
y[Iaq<bP
yK"GO0
>|yl<`
}y[`N.
%y|*ni{
/&ynnQ
Y]=og$!
YoQvBwv
YqHx\F
$y&"[Uk
@YV	&N
`yW;r#,w
yW's(a7
yY_Thi
=>y,y{zCY
Z0ofANO
Z/}_39D%
Z5_dKM
z'*5s#
Z@=6MK
Zag'Ch
Z}csBw|
ZdD9B>Z
ze	d4@
$Z!E kH
ZeN~'w5
zfs@yU
)-,%'ZG_qU)=
Z-nT=?p*4
zq~	> 
zq!BIq
ZU:2[J)
zUK*a0m@
zV:2rK
Z$zgJ/oE@