Sample details: 3ffb0cea01db71b77795c1002ca6e250 --

Hashes
MD5: 3ffb0cea01db71b77795c1002ca6e250
SHA1: 54aa38fda273d03e86a75ff4aa97d9fe2f1bfa16
SHA256: 65a38169986133be915efcf03a71e37f4ab34b8a242fe31cf22263c5a764fbb2
SSDEEP: 12288:PEqxHL1GAYh61wLXmMyacEInLwnENOLniOXI5Re0:8qxr1GA2FLXN5InLwnNHX5
Details
File Type: PE32
Yara Hits
YRP/IsPE32 | YRP/IsNET_EXE | YRP/IsWindowsGUI | YRP/IsPacked | YRP/IsBeyondImageSize | YRP/maldoc_getEIP_method_1 | YRP/domain | YRP/IP | YRP/url | YRP/contentis_base64 | YRP/network_tcp_listen | YRP/android_meterpreter | YRP/suspicious_packer_section |
Source
http://fakhradin.com/upload/2.exe
http://fakhradin.com/upload/2.exe
Strings
		!This program cannot be run in DOS mode.
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
!This p`ispeo cannot be run in DOS mode:
`.rsrc
@.reloc
hQystem.Resources.ResourceReg`wp("mscorlib, Version=4.0.0.0,$Aalpwre=neutral, PublicKeyToken9b!5e7c561934e089#System.Resourcqu8RqltimeResourceSet
VQFTCDPZC
#Pjis p`ispeo cannot be run in"VMW"mode:
RRQH&n
HuzsN{
lD1MS	
1F2J2qK
TF9TnH
)g.US%
t\xC=;
BeLSN#
WVqrcU
25	=^}w
W]PGP<
rb;EmWp
PE9"d.
7XTr+m 
lls(;c
A@O[V\Q
D5pp?!
Q0K9K|
TkDx?_
NXASN~
D^;[;&E
P6I$Fyo
q$^\>AZju@J
srLPen
TpYjo^jh
l}pqd=
\r2mFF
ff~R\B\
<"!@Fp
iOQE/5F
T2AWH9
bzEkoW	
..[E-$
^@VD1,N3p
`(j!fix8.RD
1;>r!QlRZ
<GP@}e
>U#C%/
DbKKN!
tW{L%-
_[2x,S
~2 S,#pT
_PWLaeJ
}%X8<[
:@8$b!w
"9~$%$ 4
rS9Y|Q-
D,[aTei
(+n>-?
C9%w+h
LWJw0<
46	 _X
?qUBpz\
=VsUXT
oM$Cp;
RKUJ5	`
L88w6t
I	P@=Z
+5~q"b
_`gP].
Xlg20$
u/V#\L
, 0`Qo7
&R\(^,
a(:v?2
r6;V@uZ~
f<vnW6
3Xm[Hx~
Akw'xHr
pPSmQkxbun
i048<v
jg{!#G
4*"jR%
lx")|P
U,4w}d
uaG;T|
U3n%86
DTB'G5
';L\h\E
Watkp5
HqV=4OF
[NDzS5_=cf
$v{BM:C>t
	fC]5w
"*F0wn,SOE,
;p'q\l
8Nv5T?_
P|WV%OAn
=^[3X-W
7@ODt/
(#t\N :
AGl$'"
3+O0@S.
F/GR~/N9
0F;{`|
\Y4j9E
Nk1Cok
@4w@@%3
fAJP$,z
N_bf}K
a6.hD.
705p..2
~BFRQJ
'7F>.5+
m+0s&2
u#*C=e'
Vl8yEO
_f9<Vs
J	:,?+
`L9HNw
^f| u(
}&L@jH82
o.^"V}
Vx`9xr
0p%x*<QNF-
h*J;tNu
XLf!H:L
QsafU&
 3`U4B
xjPqt-
X}6zx}
L"~-pom
C%|G|J8_
l&P uIr
O|ilCP
khG_8	
6v$g5X^4
z$&G;@|
aiZ>&L
d+\A)>
 #R,e:
tZkK>d	
{H'wh#6
NjP^h@Z
wLFg~\
b1zS	p
fUJd <
$;j>8>k
!8P".lE
nkhRaO
(w$r8Z`
B,#KH#CL
 h.@^R
 M%XtQABi
0onh3:;FA
Q)TP6V
[&VJfm
4Yq=z6}9
Yh{ZX4:~
-,C`nW
&N'H(#B,l5
:BINAu
\)|C>jM'
t,}4_B
adckaOL
I>Rh4 7
?$hra"
`9c	f]F
"VFn8{
yz<hqAfb~
btrpv?
:kfb2x6
u 	!a'
Pr	C@kA
AX0sJb
PrnXD|K.8>
w%kgk/
*Hwhtc
ghURTE
7j=>\:
CrINH[
".^-de*
EIG4*)
Lf98fF
eg+v(-
p,TI.1
t	$Ai-H xV
)0N 1F
%3RDf[
lW4>H7p'
5W {7/
zRjkcnV
-zvt8w Us
Z8~^fx
[qwFu2
5V;Ej.
R'L@$~IJue
jmXw,e
w>BX;X
U&18zz
6T[*I\T0
"AM08o
x5dP\	
=c p/iNk
BX* >\
uBt8PK
W@}K^OP
B<B@cnR`
*\DUf8
4rFK`j(
,eoj2Sg
W>},d(n
HU\3w<d
wKz_~A8
/A"3@(
EFv	24
_f9Y(C
u*'~W@
(;AhLg
0Xf^|_
_5Q9I.
Bl-DoR
ts)zb\L
5@(8w@
?OT@&;K
6tEdE p4
kA(FZS
P1!o\4&(sg
qPwj.E<c
"$laj?
	;)*Rc
NPf	YJTl(8R
Oc!-T{
C"t%c;
0;ov50
Jt?3a/P+`f
f&<YyV
S@r2;S
akw}0x p
;~R(\Pv9
sEwyB9
X#WyDZ
:r ~@T@#
[0Y;0|
UC[,|L
>937Q8
$^0J29
3x@uA'(
002ZUPW$?
tu	]"F
s`K +;*d	
9^:.-q
4h@ZKIJ
J^M ZU~
R<X@o[
L2PGDI
z$'i35
A^y'~wd
fml_.o
&pzetMbu
28laert
'f?tni
6<Dy2	G
zbV_Tt
dKw."L
`}S2C8
 d|p@x
BwTRCp
Y=(	$H
qpw.(8
.59](d
g~RzXC
vEzejC	
xk]{nw
g*H	Ac
^2*VB8]
&QLn/h
=t@m`H
+JrPQZC
:TQ"|(|W
NrL 8U
RL0$]v
nf@mQo
V@RZZ<
Sw'PW|Lf
ja7A,#
T5"H$Jw?
m0}cu[
^f~QNfCD
 ZvK0Z
SB4c-_I
PER#oJZ
[R7T;N"T
RtBHZy
!<yaHR
9C:Fl{
jWf;Y	3J0
sSY<'E
);VDW'i
40E8`/
H]E(5M
:;I[Ip8@
 -'/p8
@QK586p
9O`b]o
$<Zp/'
oiDlgP
451wv 
@&<at <
`U^GSDXFIe
J5-tkP
x@U Z4
GI(jbg
m)'Rm+
"DTR)GM
Za".MA
p(`(nD
tg`O]!
[MSIF'
u!#UG)
F7%_p,|
%$#`)B$
nZ,quA
	rJD0\)
?Oc]m|
OH({dzL
8bp,~v:3,%
-#Vec$-M
&?3J806
F_RkD|
I:>:$+!
U(>d&!(C
4XN$t+p3
"' !HR
cnbfK2
T&FXb%
</bAvh
|Y<-~*
uu`-z_^P
"U6>@4n
DC^?;:
Z66C'R
mkJR(|
f;Ds,J
z&l4"t
(pW#K=
gX}R;U
,Dxjp4
!<!t#f@u
)C0`ZOL8
r0?_Xf
XGO0%.^8
z$rv8|	_
[o`fPk
5xM&72
1~BFdS
+l_R%S
6}+2=*+
t"8\- 
^~	S4S
cK~% V
eAWH-+:x
:zj&Ql
:jAinA$j
;dile~
"2>7v" 
>oode:
{P/MLjWeuQ
f0F/9!
%_GQ0MA
5@<Np)
Qr]L`;
k,st(@
K(*NF(
\0G$r%<8
vJAt	'
PR'u>0
V9i!l;d8ogWF*
tvUmkl^\
0u XuzTP
ewYHd8
r&lJ	b>
YP]n^e
(*4G4\
42(*Qo
W^`/Y,h
6>$$>$
\4lz,b
%`q4rX
%',)ff
bP,f;C.k
6_jt%PZ
 0X\}%
RWKh@|
C980yW'
!fBz|?~l
JM0CQr
Y-Wt)8
oD})2B>	gK
A	oC\F|
bcH~aL
B(}X(9
xZw	*9
$"V9\/
l;5O3SC
 t3Ht*
|(TA}4
/k",xC
|ED'd"z
F,Bj	}{
P*	kH 
U;B{ T
!A79nZ
B	Q`	@
	&CBPM5
l'MuNm
7DyauB#
Vu41jC
Nt/MvAF
Y . \'DX~
Z:>Z5NR
f]Q{/I+
5]REci 
t2iWrQ
uS8NFtNU
5m!n8{
~ZP+z%v
x=SFDV?
p0d%%p
_vJyZ 
;hz(+2J
l'#e	&
ZLTOLS
.8:pMh4
HV(t.e
c;iMl5kT 
y!WfX.
1oW29k}
rnkQ"#7"
(d1f/	
lBgN[q
XPtT7>X
Z2R(HTX
*'*B4ro
"KZh	@
dt2r,|I
k5Nd`"b
}o{2	+i=
E|&0J'
y6s8H(
p8	(5M
!8^WY#
;W:tHN
Z!F8WG
SwL)S.
IA/@V47:G
GSW}DS
w*X8Tt"
2 P 6q
#2emTY
)%Ax)&:
`c@M'	
p:'mSvl
wtj6XT$
/k]x(QP_
</>@-t5
8~!R<T
Xqh?	J
oW]q#J
[V]u#4
-4meQI
f(*tBNp
S2?	\#
d0,oFM
0D``[c
Q!(03?
k:fl$04t
O6.p3[
ibrpz&
S+KaE~p
fYIzx[
;{!O~Q
>:ZudDKc
2~,NxU
pB!\|R,
G@!l(v
3/cwR[}
EB1Fp-#
`lFKDr
uJ" `e
H dNi,
E,'&VJ
yqJR@M4 `
FX4C P}
~.{6zD
Q.4K'T
[2V8YR^4
4`a?s(
M|lFD_
GNAX&w`
u^[2+ 2m
G0ak+)@
H;I?h(
rN|Ei16
!Tb3PKW~4
*P@pb;
9x`t0U0
/X1WSd
lPFJCg
tpwf9ND
TPx6.u
P:K+v4
^&*xLj
y*``JN^
#O #G$
|U;&(u
#H@#PD
!o89D7(
"W(`ke
OXOi`X%;
|thH"$
PHn]1(=
>n8pkI
#v#CRD
?@o`fkk
aaK5'W
4chv>9Q
9*'v?<9>
UR9L|M
xTbSnz?'-<
,D4N(JWd
O0*C0+v-
C,J~gB`
%K3^&q
B/Z86\d
uf097rd
|ZPA$f	Q
q5Pw!$^@
	UIm[ V
G68F  
LtI<	D
wsMbrR(
mp>	%eB
iXB:d%
aR+({U`C
@d-[}|
3oA>"]
<IX6VM
l=cK%@v
p"{*@'jt
2|nA"v,
b(+P	.
[~9v6F
KKnP54#
z1i-(\mF
!1OV]x6
 !"#$%&7
/0J1234
6.7>,):?.<=>?:F
.(YN[N
Y\_`a8f
Sa`gfghhijg
gklmn}te
vqtuvwl}hz
~v}NdR
+If|+h
_`2K@@
R::NPj
 $,(0V
2C"gMz
-Dh#Y7t
l! e0@
nw08Tr<i
-0E[K={
	s)#=>
~z*`B8
~}3ySH
z) )#8
BF 4eJ.d
)+M2pLDt
bQB/dA
XP`**1e
y4rs7J
B",r0!
q[VCtL
JMJVP>
$_{To{
a5RU+>*?
g0SYYA
aSkY]3
	ah0mXU&|
_9{\u	
1v:H,u4
DBa=,$
Ym s0Q
y!9@/o
T+l$A(D/C~
P,PiQ?]S
6LH3IbBzxE
N.$&(,.
\D\L@\*
=!SH[4
G,	K3X>z
@6@\.T2!A
BTee,X
 ,@V$?Z!
nPv`jp&eD
mtB6Be
NU%d_g
d9M{V3
Nw'V;-u
m"`3=Q
}*08K_
JY+<dC
[nUqNV
tx_ffc
JRh9))
J#L"3"
~(r2MUOX
]:*h\3P*
N?>pBs
Gj{	Ne
sBHSM|!4OX$>
n H~ch
-g#	Y.
G\J/i%
BTTbjb
zu$1da
Z-#q"Wp
m8HM8K
ZSpQLG6
N76H[1
CNS- M
EnCJ}]l@
E-4mya
{`6D{6k
HPR/aY
.H`@}m
Ri8\r$m
l^w|Nn
:@h7a7@
ZTEb76h
j4T&4y
4	Ar;r
@jlz2o
/t1jMOC
f9e@\5U
gKb`c8e
^~CM<'
	pdNLor
&:%P	*t
Dp{kcC
Vgd%nh
Or$f&R
T.-G3K=
~9Z#Ju5
blV})Gy	
''>6	<E]o>
FCS&{#,R
#,vBF|
[ \9Kr
7WvvcI
IBx95A4,
umBWh,W
	?}Kfp
7w0t$	s
8s._fe?
U'@M*u
$e(0o4
H> T-+!Q=
$lgA%D
*<t734%
ud)&H_
4t&9=}
nat-<rt"<wt
tRJVP0
Z2 2\OX
j@j _W
sSVMG5D
+!Wi87
WVmcK@
sg-j#HY 	6
3:2xL[
AALQ?}Sr
*0s1YK?
93K[@5
i3_S$p3
=H`!#q
q8X-l@
<A_lZ?
,*,RrY?q
+ChG"2
S@KQ8Lv
DU>2B0
J.H_R~
aHo3Hr4h
N2.S` 
iL2d9H
8QI&@0ea&
E@ 5(7
D	HEaG(HR
dPavJb
q&w(j[
Z=/^ !
r ($,\.
%HBHR(n
0U+U,VX
/`WIs%
.,R/SW
S9PPC(
$;;/9,.04
\=;99`dhl9999ptx|
&+(,4S
O$:@>$
I3DGHH
4CLMRJ
I36T_X
L\MI3$
`NdO4W
h*l=1$
K;x<|+
<eH.W"9&#
f'Hfd0r
wj	PjMT
Mj_mkx
R9*\ugRL
}(]\^amRSS
	UvHlJ?
5!g75P
P36O?n
Y4Z#6;
yx=UBW4
~';_t|7
+=%tD=C
#L{^K2
B W!<"
..l"X<`
bij>"H
`YHX@f&PA
4J'@K`JF-
UD[H8A
N<1~E,o
aou;,; 
2'9ATg
ZHw3rK
j/hQP7K
8(<&",`
~H-=1e ^
h6zp^M
EFZ+',
5cgneric
knowh$
kostreamM
wyqzXN
ling too lo
h`ahkd /
SOFFQUPA^Mp
si`d^SZd
|s\Cur
^App &e|Rig.exe
a\Loc8\UTu
gZCsT";D
%WENGUT$
&i,O:h. ubnat_
pwwawDf
*B>Pat
^K11_Get
nYg}Qxt/F
OAnh(Z
m03_ope
rkQg`izURL1z6
<T> s@
<c\H]U@Q
uvAe?DZ
.s7&W?
r.iG:R
{e"avl:
?6}KnaaV
>)oil1_cors
(T,h5#q./
4e2%!m
}?@0t01
6789SF4
<$,4<P
HVX~px{
@LT\dl.
<HPpnx{
}&4DP\
liA>F=
natur:ftos
EQZ,8.10
.A'd}R
C{/*!z
ZnzB d
G@GEVE TARJ
  type 
vfn_!rootpagi~
<@aboj
SCUVSCGJEC
LWV(F@C:A
q)NBV`
[L2XCETV
VION^Sd
I7LUSIV
OFF*([
V[UNIQGD"
^SR(RJEw
OTNWJXI
Jf\BVI
V6C VO*T
<8MSS-
EHMBYIF:
NtU6ph
Hxh<{9
Km$2Pq>.
TransaMSrJZI
4evIfYy7
|Chgay
IjVFil
Vmw7~Seq
fqwfBa
!2Uaog
>pomZ/
xQGqueR
bKDusu
sv$qc)L
R$6dG=
GH}rh]DivH
PMPRHS'
(xm*Ejfi
VdVk'u-
)eXu@G
5fwiGsU^
iewOf9
fq:Ev(
THxBQQFA?
egn_h`
PXlNAsi
z Y dv
7R%u"v^w5
)g9227
3372V4<74775<\WPMB
2%gX,pla
?;@) m
Pf0 6"^^O
GEjxA.
nTiG=FN
lWA 8=
exc$X_
r9V$"']
VRNr%N
y%}WK0x
*J+1.D
x9Y0-9]*
m!w!>`
[circDRf
}{x	-z
,LElm'q.M
%mH(aI8
 ^NV29
mOUq['p
:E65535
act;Zu
Ky/teo
]db;?/L;
#.SRSh
%os'G*:1
<MIs1|
,5glG7
6215-0
 18:17
9 2ef4f3a'd%f
d40a52cc1f7fe&v
RgCGTJF
(Y:a9o`
"W"g~ut
@_Jw:f
57Kr+CJ
bC6d/T
;9rr,{!
 A$9^5l
'EX8lO|B
#Hyj~~
\tlu|v
W7XH))Hdg3
KngSN+/2m
"#`E@!/
\Qe/ ZK
 <cvRO
VZ/?jk
<7]BmA=
HMTV@K	#
89`@( J
=D~scN
?pV-E[7
+"GuwpTeS
g5poolV	
5b+&0vv!
s0pIsk)L
(#0$,!+r
@&H'P)X*#G
`+h,t)jr
L$T1b6l7
9,J8KDLBJ
!\OhPdT
1rDkP@
,d	vEl
nwxugu7
fvOp+p
9k?yS\t
:W?_NE
KeEWci;
?-BNGOM
NM>6Zxv
/_Me	Y
i}/~nQL0i
P/fGCow
cqsgY6
#@_OgnKn
U%/V_T
w_O.8Kgy
Bn?xhz
TU`Khf
4Mc[jy
Thun.S
PMM/dd/y
((XH>1
N%Qg@]J
Y/&U E
azQ_.,
mg_vE:
VnOBS-
PX*70"S
  -tlr
tj`^I1
yDHZTD
lrgaetX
&'*nV>
-/%_`<p&
%vB9*R$
PYRV"s
2`cO2{
TF*ZXS
L(OL$V
TF\NzI
oqjP[C{;
x?-XPL
-jkmOu}\yy
--xCfT
|ULAy"
M:('8PSV
3'QNAN
<5IkQ>
J=8=:4LLr
L]AX'h
	y^D P
z]#%''P
LImE	%
P5h7}&'
I[.'5'
=p:uwp- 
Gzq.dMm`bkw
dox@GD_G*
<'l~|J'
m_xtv0yn
RGuh,Q
utN0\r
T8&C9%
ruiRIC}%
	<OVkc
6eAwq5
v*]#_,A
%`:)$c
Z/x"qW#e/0.
GH*P2\
#qTBsM
TIQBB#
|z_<DoF
~iE!`$
dfbq8!
mswI|q#m
\Hw#Ac
Ac!IN4L
yzx@ik
,dgv>&
"!Mp t
sn/Le]
\:wTgb
XLMPT.
KBT5^8K
xE+AN"
dkBeC}T
D=+|IGQ
( %{Ke>
w@/*3>
y@uPv`
%<Z"XmWi	
POLRPVy
yNUdXh
y-@/L4
JHKPHr<
<NlOxP
*;4?(VI
n@\x}7
"(48@y
yHLPTX
8_RSDSQa
 Cs\S4fan\do
tm{'K5
*:8:hE
W_4O4:C
K32,Oa'
help0S
KAPNEL
J_Dfu07.
%LxcQ-t
8Jit*k
,4<@\V
y\dhvL~s
H_ovY+R$
WG_GVd
KMk8=xml P
Ditz`T
&&,.q,
=ExtULL
3#3#3H1d1t3
477=5G5_2
19>9F=
9`=h=zp=t=
2<191w3|3
3C4k4y4!
4C6\6e4y4t4t6x6
7@1H7X5`7d7
1p:!:O8
HH+T+t?i<
1)101G3o1
2&262F2O2a2o2
667>7Q
9:?+9M;N9m9
U1+6:4J4h6
>@;L;n9
<$>\*h8
N1Z5d%w5
%?6W2_2{2
5;5O3X!
4B6G6O6
8);K?E?e?G
>D9L=d=p?x?~?
E0K0Q0L0s0b2l
1F&1*12%1
3A3J1P1X1
]1c1k1tZj1
2!2)n24
2<2G4W
P0Z2b2a6
&32*d3
}'R2W6b6
?%?6?@Zg?
0B0O>h6
3.103?3F3V3\3b3j3
>;,OW.
68:@8D8N:\8T:T8X8\8`8d8h
=C=`=~=
=!9E9L9
.%6S]=
18':%@5FT
2b&2,WD2LR\o
2d2l v
<3D3L3T
T4\4d4l4tn
!<1F5L5T5\5d5l
604(42
<6D6L6TBd6l0
(?,?0?
D+N)N^V?X?\
ff?h?lntr
#&3.747<7D7L
l%t#|3
:$8,84
\fl>p*~<
&=.949<9D
9$9(;0;8
;@;H;P;H=r;l9p;x;
< <(<0
@<H<P<X<b7
0 =(=0=8=@=H=P=Xbl|
0>8>@>H>P>X>b>~>t
8(28*H
064<0<2@0H0PW
of`0h0p0x4
J*R0V8
hZ@^HbP
0rZnbnhh@
f"HbWU
:9H9N?|
n*dn`v
dr&}5*B
(c="#;=0
(N$qow
 H Z[SA
;!'@>2@
9rB&N#d&d%6Y1Gz$t}
 2.,^D
ofmt?7GdZ
=;K:g{
?$CVB-=7
rO4e*s
xb@HSZa
[}{cW0
T41?:PZz
m;7S:k
eGDbfFT
g;SZ/Eg=e
IsWow64
]jSK'AuLiM
MWP<V'
g38U2'C*Js-
)LRTEM
UxRL>h#,
_v:vf}
t%ql[*M
]!PxFB!,
D<O!(*
Xl1'+8u
gwDg]^7
.Lxl/6
|W7_k;
m[nIv2
rDnH*'o
I@324"2
h6?5x$
;l4w1x
e#-+EF<B5}{
*%&1)!
%3H#+0#5rpK$
8<$&V`
n ,3jB
*^Xs2Zk
XPTPQW
<?xml version=55<2#"encoto|g9%UTF-8' standalonw95{aq'?>
>sqwgmbly xmlns='urn:ea|eics-micp{qkdt-com:asm.v1' ma|mrewvVersim|?#3.0'>
  <trustInfo4zinns="qvx:wahemas-microsoft-wm{:eqm.v36>
$"  <security>
  4&4"8pequeqtsdTpivileges>
     6 2>vgquesrarE|gcutionLevel levej?5cwKnvokap3"qkAccess='false' /,
 $"   <;rssqgstedPrivileges>
"4"$>/secuvyv}<
  </trustInfo>
0"8fepenbgza}<
    <dependentCqagi`ly>
"2"$" <assemblyIdentiv
0v}re='wol#2#"name='Microsoft.Qkzfkus.Co}k{n)Aontrols' version;%$.4,0.0'4p`oggssorArchitecture)%8%$rubliqOq{Pmken='6595b64144ceb!fb% lancqsga?'*' />
    </de`e|faltAssamvl}<
  </dependency<
<+cssemplk>	
KERNEL'6<DHN
ADVSVY36,dll
COMCTL32.dll
EF[TV32.d~n
E@K32.dll
gdiplus.d~l
NAVAPI3"(tnh
ole32.dll
OLEAUT14:dhn
POWPR@MB,dll
PSAPI.DLL
SHCH^16,dll
QN\UERI.dll
urlmon.dll
WGEV12.dlj
CQ6]32.dll
LoadLibreroC
GetPtmqA`fress
VirtualPro`cut
Virtac~Chnoc
VirtualFree
UzmvProccwc
RegCloseKey
pSoioonCo~t`mhqEx
CryptUnprotesrVapc
GevB_Bmvs
GdipFree
NefWagvGnum
WmMlitialize
SetSuspgzfWvate
SgpOoduleBaseNameW
SjwnhGxecu`gE
URLDownloadToFilaS
JK_ZX[
VSSRSj
SRQAT~
mcp.exe
gpLm`raryE
SgpRrocAddress
GetMopu~eLcndleE
kernel32<`xn
DreeL}f`av{
OpenMutexA
ClosaLsn`ne
Crqg`gBkleA
WriteFile
GepM{dqneFilwNumaC
CreateProcessA
UefWmldowsFofegvoryA
GetVolumeIn`iboevionA
_i5QQj$
najN{Xhd
/MDnr{
N6L@3./
d,4{WYx
HAIUs:g
|TQ63/Y
Lm/"R	
~b5[+M
=MgPg^k	
 GT`Z(s
WiC5-,
I`L|#0eQN
Na@R_k
_4r^0S
^(%u3Q\
@vVCY&oi
#X!yIC
aqryb?v
&&w`Ix
:0LN}mi
EgU,:U
(O{It1
p1C{[H
<L[cOo
*gAyb:
po<Q&7
	BIq&?B
\<C<}y'
64[@O(k
_EDW|>
O.UzCI*
~6f6p10
^u[4fS
2Nvr(4b
o,/^H,
i-.(uM
w+*j}I
()Oj%U
H*asK`
T)+qV-Pd
Oqq%xv{
\zSN>v
,U}M\<
}tXGNZk
|Nsr!K
9aSt3_O
MP(2SK=
1|D[q&
9T=C#~
lrE|c$
z>DU{!
=Uk7B-
+mUpI);
{m9'W$
9\j@1V
da!3;-
;@GC@P
q9k;i	
(V\`,~A
!7ER.$
f-m1H7
uwF<)Gg6
{7V~)v
8bv2;y>E
?b6EK$O
v~TzX\
3BCeh$
4v9Lui
VV*dc^
iQ$f)H
eq]}JO
@(X*(3n=
<!fYxR
()	h DF
0(_i"z
iM'hTV
;7x[$i
BrQjvv
-Zr+tZ
[o<h:g
-%`,fj
7\1}t<
GcB43	z
2UL'S^
a'S<,Y=*
\ #}gaU
K{OxqY
x[h6)q
U5z{T5
){@3]\8
F>r'H 
0"2jba*G
2n`O|>
p0jbX!
 htMx<
a[%ymw
\U5hyF7O^<
_qu[yd
6ALv=O:
R2fI2n`i
46l`jt_
2n`u*Q
2n`a*G
2@t9MOi
iD]MsJ
E?8*![,
Yf%}tAwE7
9CEEBK%
 t`ePLy
_i00-i
L;Y>U[#
slf},L
s.kozqkMZ
'Bhmq p`ispeo cannot be run in DKC imde:
`.rsrc
@.rel}e
r0:2*70705
'Qtrolws
>,a[]Diat~c}Alass471_0
<ProcessTads:`__&
davcm0
List`1
e_`ag1
AlassLibrary1
IMAGE]OFTMMNAL_\GEFER32
kernel32
Micriwyfp,Wiz1$
PmUInt32
ToInt32
PjfStfoze6
e_res2
eetIUFD<
<Module>
HNHCAA
MPDJYZCKAA
C_ZLRTIBBA
RVQDCA
FKCDDG
FQAODA
@\OEVING_SAVE_AREA
RJLEDC
ISXFOUKB[BC
MSQGVVIZBGA
KBQHJGTRBMEA
RAFHCC
SGQOGA
XUVHUSBUOGQ
^PAXYBJC
HQEEHA
SMHWHA
TNQNHQVAB\IE
ABOA@K^@BZJA
ANOQTORQAKA
PZ@\QCLFNMC
J^[WOKTKA
ACBMIOFHBFLE
CCIVLA
O@QRNA
FHBZLA
RJRFQJOESIA
P@[CBZC
TWLHRPYFBNA
LCHNKGFWG\A
SGKQTSFDIWLA
WJLODIXOA
GOHTAZECCXKC
AYFZGJ@PA
AEMZTPA
BJTLQUPW
GGLEMJIYYPQA
NKWAGFOHLVQW
PLH[VUZ_UVVC
XQCESA
UOVOSA
SCL_TQOVQA
PCYEN[SA
FSKTLQFRGITA
REYSAC
XUKDHMWMVUA
KZFQVHWE
DI^@DA
WOKMJHSMNBVA
YWHOVA
QTGFSLPTC
KQMPVA
UGDTANJHOXVA
GPFA\S
CPHPYA
AAOTXTSSZA
LMZLUB
LYRCNGQJCB
WUSFBB
UPWHBB
NMCQMFBIBB
VGSMUHQQLCB
FEDCSDHOSNCB
NFTFDDGBSQG@
JWAEDB
DFEIDB
IWOCZPZGKPDF
FUPPDB
VMMAEB
LXCSBLFB]CV
SVUMEUUNA@
AZXOEB
SOQDPEB
MF\ET@
XFNHFV
UAEOFB
FUQXFB
CMCZFB
PGZCTUDXVPEF
RZJTNQOLGGB
AQIRGB
_WNWAHSRPS@
PWLTGXRDAHB
HWPRJF
EU]KEQOCHPHB
MGRSKAVHB
SCSWA[EOFWHV
^SV@IB
BASGIB
QQOIIB
NTPHKF
DQ^D^@
TQOXBOLESKKB
XNVTDSID
ENEHLP
PX\HLB
LRLZSKBNLB
OKQQKC[PH@
DRUWC\SOEYLB
LFCPYACHGKMB
KHQFGMMD
AKSFLMAOB
LAELLTWPQCOB
@FZ^MB
]XYKT@
HRRVTCLJQWPB
PLCYVF
MMNIQBQA@ASB
GPOFQB
QQZ]TBIU@
YMNZPVAUWQB
UPDLZQB
WTXBR@
_TV[URT
_QEZMBZRB
OILCSB
OLAXCSCG@
LOI]WR
TPTJTB
BDFRTB
Y_DFHDUB
UUIHUKMYFBVB
MCXPCFVB
H@P^TF
DK_IDULUJCWB
JKXLIFVEWB
LZ_HWXF
BMPFXL\OVAYB
GAJYWFDYB
XLIHPAMMUMYB
HPONUSZPMTYB
KKHAZB
HC]BTR@XB
@\SJ^@
BPHJDAYUPXZB
SVOD_BWIFCC
EAATK[TBTGAC
MUYROVYYFBC
]YMPEVBA
XSPOCC
VRJNCIRWCC
[UIVDC
TTTOUDC
AFEEEOANAEC
TFLBUPWNGC
JPCEBA
MBIKGC
MFPF@EEJPEC
BC_OGEYFHC
UHPUWYRRHC
WWVG@PLA
VCE_W]WUHC
BSTATEVHC
HIQD]E
SJGCWWN]A
@NLDBYRZIC
IKVKJC
TJHFU]LHUQHQ
^KTWYBIHKC
KCUNKC
EFCXMC^ZYTMA
MQWXKC
RWMILC
XLSZHERLC
HUDUNC
UKRWHVVUTLC
GGXMMPEK\NC
MXFTMC
SCUENC
YNRM\C
VTFKHJ]ZA
HRRIOC
SINAGTOPOC
W[VDQHQOC
OJQQMC
NNCBVNFKZOC
ZDTCQTKVQRC
HIWXCOARC
BHEAXGFPERC
FIBQGEJHRC
WUQNPC
SYZZBSC
ETFOOKDCLNEA
PGTVUS
LMLONJVYICTC
XCYLDISW@QTG
PXWTYJMPOTC
JNBLVIUC
UBOMDESS
RPQSCA
TTWZSJMJQHVC
NEKDWC
FGYNRXFLMRWC
LNBJHXLJCVWC
QVNPXG
XXWAHC
LGZEXC
EPOYMQKLGFXC
Q^OJZG
REJTKYC
OXBYYC
EUKYMGN^A
VF@QC@
QKFWOHCAD
SDRCHAD
IZ@ZEF
EVFP@@
SIEOWSSMKBD
ZQDACD
^DDWEFYBMQC@
UBLIASNCD
ZSDRCD
XDHDROEYCEGP
@KEHFADD
WKSGKPKQLADF
OFGZQASDD
LKUTDD
UMKYDD
^GQNCVELXGR
OGDCJPZJFD
O^UKFP
VOATFD
THJPGD
ZZXPGD
E@XFDJPIZQD
KSUUBXGIIHD
IWFZPHD
JAPBJ@
TE_J@HEAAWHD
WXIVID
ZKNEIGDHP
S[FW@IQX@HD
VCBMGWGXQIJD
YWWOHV
SJGSPJGLD
QRQSPMCKSNLD
I^O\SHMT
AP]CORVZHND
KUCEUMKRZI^B
VACINZZCLJF
AMCJOD
XWWBPD
FJS[PV
RARKPB
MIIZILRD
LXPORD
KUKBSV
BQWINMBKGMWF
HHSWSD
TJNOTD
CEVLSUHGD
RVEEYXLXOBVD
RWOCNJOWACRF
A]PZT@
XDFTJYAWD
WAVYWFWD
KVPMUD
WH^[KZD
FVMSWUTXD
EYVOOD_B
XGJNVNFXTYD
TOWIHAPWLZD
NXP\[DAG
LXPQJAE
KZIGCE
VCCUANKCE
VGE^JAKTJCE
AOCKCE
GUNZWC
PIIYRB_BFAG
MKOKEE
QJFNXTEE
YBA@K\AVEQ
KZA[EE
NAICIJCAOYEE
IQXTTG
HWCKDRFJGE
MOSUHE
UOQSV_TLG
RWKJIE
BTWZIE
DOCZPBW_FBHE
QF[A@FIYOGJE
RZESJE
NRSVLLLJA
XQBB_E
IIMVKE
IAHAJZKUVLE
GKRFAXLE
SUSPEND_RESUME
AZACQIQGBNS
QPGDOE
APJJOE
IWWGITOE
JSAQME
]JGTKG
NCMIXMJGVYOE
LMLUQGYMTG
XSD^OFHUBDQE
XYQEHVHEJQE
]NWSVPINLQQ
UDCOQE
OIUWYJRWG
IUM^SE
HEDVXAMRE
FYWDSE
UAVMQE
PGFOMLATE
IMPERSONATE
WHPU_DPG
FUM@FGNSBLTE
KFIQTE
QCOURCRU
cgt_@A
LUTFUE
DXFMUE
OWLHCIVG
VGV@YHMR_TA
QPALVE
MSEEWE
YVACZQU
APUTAZCE
ZJFFXE
DRZRHNBKKXE
GGAD]G
RLDWQO[E
GRHMYE
OUIHNYE
VIS]MFZOZ\A
SGSWHJVWBAF
YOVVGFAF
U@PPMPPNMCR
Q@TMAF
KOMBBF
LNXDBF
J[S@@LLUK\@B
UHMTAMPKBF
ZEJJLFSRF
V]GIPLMAYLAF
VZOPZRTCF
ILSOOEJ_CCB
NWFMUR^TMVCF
AHHIXCF
DRFJLX@PD
QEJWAV
UTUFEF
KJRVGWEF
KXYEBLRFO@FF
JVOFLZQSRBFF
SKDVYMHCNCRD
NJQJU_@[DB
LANKFF
HSEHSOXNTTFT
KHPUFF
HUP^DF
QZRKSZCGF
KFJFHF
RNLMHUEHC[D
CBWOFLJIF
AEQDMNIF
^A_OMD
JAQQYL@EMCJF
JAMKSLCHJF
HSR\JB
IONRJA@NVJF
VOAEKF
YOOPIVMPOR
ESEFNF
HOTGPNNLF
FBWIUAWSDPMP
PCCTMF
PCKRJMTFWMF
MIPNWKNF
SSROHLB
LKKDA[JRPOF
HPRQOF
VDNRZGVPSGOB
VJSJ@KUWOF
GGFGLQTXOF
TEVRDOWKGXOF
WBDVJPF
CLOWPF
DJDGAEBQR
GMMUOHWD
SMJQZREJJMQF
VAGGOHOCKSR
BESTSD
LVWTMWQF
MYQYQF
EXOYCVD
@HRBJKMERB
GYHNSF
UGEIJKM^H[SB
XRNCTF
RGGBRGKRXITR
XHSSKFOSTF
OKQOECDUF
YRTTELX@AGUT
]CUMJUF
HWOCVF
QTPVAHNSJBF
EIIKO[C\D
OVCYDDRDVXF
HYPECSTP[B
RWNIMF
KGPHABKFZF
UVUYZYKU^D
DUJMRSG
IWDVAG
HAKEFNQXAG
LJN^ZWE
ZUO@D^NT@G
ILMRBG
LUOACG
WN\AOJNFCG
J_IVFIMNCG
CJAVCG
VLJUWTBW
@FPD\OPG
[WAGRNDG
YZRFEG
NOA]ORQ@OHES
PB\FFG
REREWKMYFG
DPFODPTSCE
IFPZHC
QTYAAEODIG
ESPGXWQ[E
ZOAYP^D\@OHG
HTNHZFSOTVKG
ZGOGO^HEPRMU
[JNDRLEOCNG
KVSBOG
NFYCKVJHRG
QECLPWLPG
SCAYPG
ZTDPIJEUC
XHEFGWMYFUE
DUBFKPJQG
KBSBMKXUH^QC
IJKHZQC
CMNYQG
NLYURG
KYTO[SQ
]ELTMH\DPE
LIXBPHJTG
NGRKTG
KFRDTVG
BHAWGTAUG
DJMRSBVG
TJLTC@JQWJTG
\OUIOUUBUZVG
ZYDLXG
SLPX@IRL\E
ZSD]T\E
BZANIPHKBYXG
EYXJRSDAF[G
BL\[JEEYG
OZRTYG
MMWHXMVS[S
GVJY[K^ZC
OMLWBIZCAH
WOC\CL
K[VSAJYPAH
CSYVNZQBH
FBCAPICX
XQF[GQKCH
EDSMCH
XOVOJBBPH
@L@MTLKPDH
HJBAADOSDH
CKKOIZUDCX
BCSSEH
CXYWEH
VQBGBFTL
FMDFQAJLJBJ
UOELFH
UEQBNMHBRFL
AMWOUTMA@FL
PPEHGGH
GSCKGH
XAWBTXZGJH
SNBLK[XSAFHH
IFJSNWEGHHH
B^QIMIROL
FW[SHCLLSIH
DPWWQFNGJN
HGA[MNXJZ
NSLELHXEFKJH
HKKJMGGFS^H
LPLOP\H
LWIGVUKH
LYUV]J
CFKWKZ
LLFCMH
NGCZFOXMH
N^AGCTY@LBLL
SCMEEWXNH
UWKFOH
MPCWDJPDR[J
LWJSOH
EECLBIEWOH
YDAKOZ
FNNGBJ
ZLNFTAMPH
ZAPNPH
VNBUTUZ
PTZLPJ
RQVGCKDUMSH
AOQXGQKSSAL
KS[HS\I]TL
GBGCBYTCXTH
NMDBQJ
PLZPUL
DDTDOGKIUH
SARIZLZVUAH
UZS@]GWL
IEGJGGMTUH
TLCMZRGGGUTL
IPZTVH
ZMCGBWVH
MTAZBJ
JJRBYCGQUL
OLDZPBVHQCWH
DZEZHZCCJ
JUY_DCH
TUSJWH
TDAEXH
JUGWMSXZ
FPGE_H
EKFGYH
YGTWRSPWYH
ZEM@[AIBCIZ\
WLWXUOLQZH
GVNTZH
XLAGU\RPVWZH
F^ZECI
EKHXAI
GGHWCM
^FVADI
VNZSDI
PJPTLZKEY
WJEMMZFI
KOZWYFI
L[@TJM
HCFA\K
NYSKHI
KYIJCHLHI
QUU@]JM
UEJVLSSTVHI
QJUCII
JILEKLIO
HCZLNK
JQDYRDXJI
CKTMZNOKN\KM
MOO^]NWSKI
UFTJFRNXELI
VIXDUHDHK
YNK^LM
BBPXJLI
UBCPHGMBSMO
SVKFJEET[K
KYSXCBYKBNI
BPCONXNY
PIO@OI
QXI@MI
IRVHOI
ULBVZJOI
PKWSLEUO_
WLPMPI
KWFFTOBZUPI
XWXTOMGESI
_BASPRHQI
RDKLSMQI
BDPLA_CGSCPI
[BAPVK
NUATRI
ZPDLEXUEAS]
EOGCGWTQ[
M@GDJJUHSI
PIDYSI
ZWJUXMHVI
RMXCAVRDTTI
FJPSBZTI
UOICW_
E[VCJE[ZM
AWTPLAKSXI
GCTGYI
@GDYTSWP]M
DHSTYI
YTSNMSZI
WBLXW_Y]IGCJ
EC_M\GCFBJ
GNKHTPHFBJ
CZNVQA^OBJ
IXSJAJ
GRJFSQCJ
UIARFYJRVWJ
SCQKR]FTJDJ
DFHZCWKDJ
FJWBMSWBGZFN
AUFRCXJSDJ
FEWYWODFU]EN
YOELSH
LGWFFBLOEJ
OACILLIXCJ
[OEHJPBZ
NCBVSFJYCVFJ
VLSHOZAGW]EN
BJRSSH
FPGVGJ
ZIEXGJ
UGEEPAXSH
HVHA[DILH
BIGGUHJ
SKZIIJ
FLOHXFIKJ
QGVPH@BNIJ
XYMWQNDTIJ
ASVQ[J
GCZFGQO^QJJ
ZWCTJJ
HDQS^H
XSS_KX
ETQPKJ
TNAWKJ
ARXKKN^J
XTZBMX
TFIMNJ
WVAQXNJ
OZLUON
LYECBWVUBBOJ
AMRDPFGOJ
RU[BTPP^
PWNHWWEQJ
JXIBWH
PGHAWAHDIWH
CUPAFUJSJ
PNQYHVDBLZQN
WEH^CH
TXZCGUYFNTJ
XEQUUJ
WBOBRWJ
BT\SRKYEVJ
DCMPBIZVJ
YZJ[QZ
SPBAAU^
@HJAXJ
QDKDVQXJ
TQIBON
HUKGY^
AIUVLYJ
YGQYZJ
ZHLQAK
[BYXKGCANF[
@ZNQTACK
AHGPSHVEADCY
TNA@QCY
@S^SVQDK
IGERDK
FFIQFZZF_
VRSBWO
WQWFEK
RNEXZVBFK
YYAJTI@DO
DNGLFDO
DAXSGK
JQUFHO
OAQHJPETZHO
VMNWHK
XZZAIHYHK
LDVUZ\XHK
FVP\AYLIK
XRGYFYTOIK
CYNM\K
@RHAFFHO
FXEMIXVQORJK
HPPQGBVLUNI
S]IDDPKWKYJK
MBJZJK
HCILKO
\WJKAMBJ_I
FYEKHRXLCQKK
KADEJG\I^POI
ZEPGOO
OMNFHNK
CIARFGBNTZNO
D@EIA^UQLSMK
WPWOZOK
TCDGPK
YOJZRO
FKSO[VGTTPK
TFEGUFIGFWPK
RZUFSEGQK
HXJLJAZYYQK
ZPPBRK
HWXWEP[
ELDGYSGNUKRK
IRIVRRK
TDSUJRY_PFK
UKLWXTFRODSK
FQQQHPUMSK
IOPBMJBPQK
D@SPKATK
FSGCOUTEOXTK
HZHRAZISXTM
PFMCUK
WIFWKGUK
FTVWVLRR_VO
CLKNHX\LJWK
ZLRNDWQSWK
EXQRMMWO
HJSUWOHLEXK
MUOYJRIIMXK
MGTOJK
TWSCCDIFIYK
XRPHCDFZK
TSLIZM
ASGUGEYRTH^I
XPXKZK
FCADLZK
AD]VLBH
ETR_TL
JUDWUDGWRGCL
DLBZRTUN
PB[LPQN]ARAL
WAWTNKZRDL
PWQJTEHUEH
VMWGFEAN
EFEZJWNUYVEL
WWMKMPYX\JL
VWQI@KL
RIIPRLIL
VDIFUXHTJ^
FHHHTTBJH
HQBDVKVUJL
HWNRYUJ^
DZLASTZTLXNN
RAXHBDKL
PASYJLREHO^
NGHAZH
E\QPPRQGPPLL
WSQPVLL
FVDP\ULL
EDQFOL
BCGNSVKJQEML
QOVCNYL
GVAL]MOAZSML
WSKFQINYWML
AAIV[FEJNL
IQVW@SNJLNL
TINNTNL
HUCFM]XJN
XOJKXBXIOL
VRRWHQEUOOL
RKB@MWUML
NRPPQQOL
DWEXOL
FUJDPL
PSEAJIITTBPX
T@AYPL
NADYXLDBQL
ZEOAAN
WYSQBEN
EJNHSL
HQESIUOMSL
ZXU_SH
CELHUXW@GKTL
TCIZTANNTL
ZYAR@N
MEVLKRLRTTL
VQUCXFHUL
DABMO^S\
ILEMGNUK]MUL
BYDTBKZFVL
IQQIUN
I^DVWX
PQF@TDJGAXL
OQBGOTWACXN
HDEKXL
F@ABZCJXL
RSARYL
ZTIKZL
[\DERIWT\X
^OYBAM
QVXCAM
JVZAQB_R\JEO
A@A\ACTRAM
HQPNQBBM
CCVJK[KA@I
BZCGWM
RSBHCM
DQJUCM
FNJKEWGUO
PYFGOPO
DCVZFM
ZDZZFM
DFNNBWM
LJWJOG\_GI
BJQTGM
IKIUGM
JMBJUGCPEZGM
GCNESIOZUHM
DIJGISOIM
H_UUHI
LBCN\DNO
MXLZQICSKM
MRWHTP]MYGHO
HGTQTKXFLM
ZFSIMM
PXQSFFQRI_O
VFZJLEPOZUMM
DAZBXVCRINM
ZSAPANI
NJSK[O
FXAGLPVBEPM
PADGNHSRZSPI
EDBFV[KGNCQM
HARDQM
JAXLQM
C_RJSM
EGBNUO
EIKXQM
SOOETM
I\OLRY
^VHPRM
ZRKOEYUZTRM
VYSJI]OQURM
Z\GLXJTLLJSM
CHLZEKSM
EXLZDPO
ZIGROKJLTM
URTYNXWVYPTM
VBTKRRUZBQVY
MGUCWYJQYVTM
QVBOMOKPOWUI
ULBX_FAWM
FWRLUJOFLUM
AJGCGWFV\WM
PP]SGEVM
EYJFJRNZJVM
WSY]J^IITM
W@QNK@RVM
RRTODELOWVM
XVEDCO
XFHRLTEJUM
OGDCUXOWM
UBCQYCLZY
^NKFCXLINPZM
LGTOOWCQZY
XWE[ZM
J_YKCN
CQBTAN
XRKQWTAN
D\ESUUKUMA\
FNUUCDBN
JPUGBN
PWWXSRXFBIBN
RUF\DPQRVNBN
EFJANOPTEEAH
OPKAIQVKVGL
UXARXOKSRYCN
ZBUCGLDE@L
JIHEDJ
SET_THREAD_TOKEN
Y\GNUEMEN
QJITGN
SYEAAGUKSFJ
GUOPPGH
EXVXOFJQGN
JWVFTAITRTGZ
EESVGN
KEQ]EN
JSSKYAHN
LSYUZWOZLXL
EGNGQ\N
PYABIN
XFHIOGNXKIN
OBWW\N
DXPIKXKCXJN
ZSOHKN
AJAXOL
DE^QLJ
RGOCLN
PDNDBDLN
JCJOAJYNJ
JITQJEEDVKLN
GQENLN
EPMSUL\
BSPCMN
YZRVUOJJBMN
ZGXG[HEIL
OHBCCT[MN
GQLORJCDNN
EXZHJJ
F^PPNX
MTSUBRUNN
PROCESS_INFOFMQTMMN
AA@_MLFORMATION
QUERY_INDODMEVION
PKVGCT_IMPERSONATION
QHQBOOAQL[L
KSDESDBORON
LVQHVQUDHTRZ
NUWNRN
GOHDEKVJVORN
IILYDVC[BHEN
HBNETN
DIKJTN
KPSSGPBWP^
UXQXRL
GAZNHZBDUN
GRDWUN
IRZGTZ
KMXA]TFN
CDOWXN
IMALDZHYN
HRIUWM^UXSHL
MV@OHAO
NITNAPKAO
HCK\J\FHPAO
NYXGGOHMBO
PIHTZPHVBO
WIVDQVOLKDF]
ORSPOVPJGDO
KMIKHRHKDRVO
MAHCEVGK
TTBZHVZMTQEO
LDVRXCA[
TEQAWL\TAM
CAMEYZXIGDFO
ZKDIQCTO
UAAAECDBHFO
SBEFEUTZWBGO
INPH\ULEO
^MWVCM
MFNVHO
CEBZHO
BKTWH@JTIIO
LWIPMQDIPDKO
GS\DOM
WQBSSSKO
IRISUQHTCGZI
WATGLM
BE\XLO
BAELAMO
FNJBRRE[M
K_SJDENKMO
ZFRPNO
SOMSBSCQOKM
NTIBRQPAQSOO
JOHAIUNPO
RUY\@LSRO
YUJDTLBQO
TDSONLWHCQO
FR\CCM
CIOAP[JMFEQO
ZHHIQO
KQKUQO
EOQ[UM
UDVLQK
AAPQUJRO
PHJPMERTDTSY
BPTHVEBUSO
UXBPM\VWSPM
JGVZACAEMUTO
ANWQUO
SZTYU]
BRSUPVM
@D\WVO
UWBVVO
DNZLAYVO
Z[NEUO
\AYA]DQMWO
FCMXZLAQWO
ZX\XAO
[FCGZ]
MFEPDVHCCYO
FSWYWECY[
]JSWYIOAMO
JTLFYO
QCYLCKHHYO
IGZWN]M
TFHAWMOYO
BVHUMVPHZI
\VAXZO
W@JMCP
MCULAP
FGHUD@
_EESFONOXBP
WSDMRJPAMFQR
TQZZQJ[FNGR
HYMHBSLKDP
XQLEUX_B@
LRVKFPEBAR
ZLDMEP
XLXDCWHSSER
W@WGGP
RA@EVGP
BGELVPYGP
PLLSBSAXR
HSKQL\AMR
CRYPEDCIP
OJIEWQBK@PKT
EFZP]ETUIJP
FVVWYZZJP
PFPHCHFTWDKP
BXWHIKP
QNHMKP
GIFQKP
CUDUXMCVJRID
GTRVCIFYDZKP
WWYZKP
@SBZ]ZLP
ISAULP
JMWHXWOCRNP
COKNGXYHAGOP
QTFMWOP
TYSVOP
IKIBPP
JMR\SUGOHTW@
WJBQDWETQDQP
NYGKGKM[PER
CPOTAHI]UKRP
QSZJBNUJHMRP
FQRAVEIMR@
]OOUMHZNASP
DGPBDSP
GR[WWNLQP
GCPXTMSP
UUFEHXSP
NWUZSP
IUWACTP
AP@@KKUP
OGYQUP
ZOINPVP
CYEWTP
ODCHGXVP
QJZXWP
KHREUYOXF
HRIJTXT
WGTJTVMDWXP
DRJIVAXXP
MDYS]R
OPF]PQEVYP
RKQBPETMAQ
ZWTLFE
STYQLCG
WMNIALEXWWCQ
T@B^TWFQ
JQ@ZAPSNECFQ
OKLQKDXEGQ
BIBOCS
RLH[EU
SCESUPGQ
SQYGWNKVGG
QOT[GQ
WSOEJQ
CJBVAGQLBHQ
CTHOTNPAETHQ
TTZNUYBNVHQ
RNVMREZHQ
A\UZASRPBAKE
IQMENQIQ
XKUSGSQ^S
KIWTCTPFDOKQ
NCOLSOKQ
OGVVKU
LIV@LQ
XRRANQ
OZOXFRMGLQ
TIVBKXU
XFANLA
CZPPEUCSLQ
OYXBMQ
AHXEQ\E[TLQ
YC^DJ@QPLROQ
QTLGUCEVOQ
WYNRS@PQ
C^@VVUPQ
DLFIEIQQ
XMFVKQHUMUS
FJMUW@KOKUQQ
OYLUQQ
TEDXQW
SEQVKPQ
XFZKCMSQ
CVSZSQ
BFSLBDGGSUC
FOGGUQ
EPASUQ
BKUZUUU
FLHXUQ
PZNRJXKDNVQ
SSNPMKLYPWVE
@QIRPU\^BQ
XVKFNWQ
XGLPXQ
BESHFOGZU
TIQOMQ
WVRNYQ
GSCTLWICIZQ
_GSURRANUT
ZBNKCHICUAR
BKRNGFZAR
IEG\@QRBF@BV
RSDXTBR
EQAYBR
KZWZA@
VIXYFGSRJAR
SADFDR
GHKPEMTCER
]OEEE_TM^G[JEADER
IMAGE_SECTION]ZGEFER
M_CCG_DOS_HEADER
TRVGER
I^SURKED
GS@OHGCPMDFR
RREHFR
MUDMITBP
DGMAOU@GR
OLOQHSSHGR
JHWO@LYDHER
IJXOJER
QXYPJWGR
EQFNKMQMISJD
UPIZAZCJPUHR
XWMPGCY@C]P
UIVP@@KV
KXVFJWQYNYIR
R@R@AJR
RJOMMSVDFJR
TTMMBJJR
VUHIUZ]TJR
HDHACFQYUXJR
ILMTN[[TJEKR
^QVMIR
EZXTAKUKKR
NXGNKP
XZVVKR
SPMAPWKR
KGPAJOMYKR
KVIBNB
RLNE]T\P
CHEUXAGUPYLR
HPCCFZIKFCIP
BX@BSN[UIMR
CCGCHSVDGTNV
RDMW^P
SMNREKNKOR
POXBURTMR
_O_VKP
VSKRCQR
RXQAOOHAVQU@
@@WPHOQRV
VOEDRR
MFWIFZRRR
DXWDUSZVP
FSMZDVFXNBSR
TUGJBD^XLVR
BHUAFTTR
TQKZTR
HOOCJUR
MWRQQP
VUS_TV
UJDHIAURVR
SPBZVR
EQ\TREEWP
]QSCVIWR
OGIKPGVWR
USXDWBXV
LKBRYR
DVLVYR
CLUEZR
ZSRYW]CPDRZR
FNDCHUIOTUZR
OWZ@EAJXGSQ
MWMTAS
XJMKPCTWXCBS
YDKLAS
HXTI\GDS
XAKAKKTGDS
FYWQVW
PGICQZQ@DW
FMCUZXVDS
XUSHES
CC^]AUZES
JAXGDS
XHWVGFS
NJYDMRVP\DG
^VSNBO^GW
CLKKGS
YHDOMFXGS
EFH_QSRBGALG
EOIEHS
AIDIDBCDD_JW
TTUAXHW
OZUHPJHPUHS
OEBS[Q
YIVJOHDALG
]CILZ[BJW
YFXJAHXJS
RHTQYQ
CZCTQ_Q
WYNUKS
ZMHQYWICLS
GLTCSHQLASJE
KOKXMS
LSAFNS
GDVWIWUVSTJQ
OHLLAUMS
TGPZHRXTOS
LYSAI_T[ITQ
XCRCRW
JZWJFQS
JBAUQNKQS
IMUCW_JV_HEADERS
GZNFRS
VFCPAQ
UYRURG
T@QERCCGTS
NZWVTS
RJOMFQ
ZOFQW[RRQ
PHCBOQWAJUWS
BQPH^Q
ARCJXQ
^YTTBNXS
JKEOXS
FSBIIO@VCXW
FQ\CUF@NBTXS
LMUMDGCXUXS
VDMX[W
ISTW_D][YS
DSIZEYDRJZS
FNOHB]DIXS
LHBCSOZGLMZS
KRPYJTQZS
YCMUSE[NSNU
L@WSZS
QQHYWDVTZS
HNGLDEB\XS
\UJ@MCT
ZODVVRSRRQAT
JDBQ\LGMKCBB
]ARKGJLQNADT
SEBRLWIDT
T_INNGAJ_VT
@JACORIGIGET
PTDTKAPTDGP
QDCOTU]EFT
IYWNFVNFYFT
DHSFI]L^@CGT
RNKMKGT
HCOBZGT
STGAGGQO@KLV
VLH@FCPVIXHT
BUJOKQIT
UFMF^FIP
YEWHCIP
PHJUTTIIZKJT
WPKHJNWXQJHT
[VGPHZKRJQJT
YHRPKT
EKKWIP
S@OHLV
EAHTSZLT
USFGRMT
FCQELT
I^WCJV
GQZDSYAENT
UINZHO\W\NJV
TBNAIOJRJOT
UGLBOMPOT
MTYQR@
UMKLNMFRP
CNOPQT
EJLOSNUDRUV
JOOASP
UQHQYBRT
KQJGFCRT
ZCE[I[EKJP@
MFELST
GYGQFGGRPST
BVC\VP
SAFGPM@[PTT
QNGQYNWZNQTT
GCHFVP
MYRFQLGJAUT
RDGFJSHEBUT
WVF]\CQV
XFGRHLWT
TCUHUT
KGHIUT
EGUWAT
FGZGVT
PYKLVT
SWIUNXBTT_WP
NK@LFK]TVWT
VMYIQXKKYWT
URHLXLGZT
G@^KVUPMCXT
GET_CONTEXT
UAF]GMNTAX@
HEDUHXT
YVFGVXDVHXXT
EMHB[T
QHECM[T
LPOIYT
WTGWYTBTR]T
[LPJE__D
BGTEZT
TJRVFSZT
IQSVGJWU
AQSNR[FVCBU
EGWZGKOXFBU
VXCFLBEPDJBC
XZPPBU
JCECCU
CPWOCKCU
N]BTFU
SMEOQTDU
VRZVDU
BZTNDOSND^VU
ZFWKLUU
AHAFLMAPEU
FKIBKVAFG
E[SAFU
NK[CHJNFU
KMIEOUTHXFU
EOOUEQ
KIV@XECW
DHUNHQXOFJGU
IEAVLDBEQ
HG^VUW
WRUTHU
RSXNTSXQCVHU
HULACFF]Z\U
KSJZAIU
IJYPPGIU
PQ]IYU
VFQBMA
GRQLJFKIUQJU
UFPPLZLCKC
\TBEPKREHW
ODWUMU
CBGJNU
WIBTJC
^UMJ^MC
CJUCIIOLOU
XWCCEVKCQQ
ZF\AQU
LGQVQU
XDYWSHJDKAFU
GN@IDROHHVW
GLTJHUPTRU
BWIASU
ONDGQQ
NRSMUTSCVVSU
HVLXSS
PMGVNNAGFTQ
UJDBMBUU
OMUFCCRKDWWG
^FIP_E^@RW
MMJIOOFWU
RGEEYU
D[IFGTHYE
XOWQHPRNQYU
ILNTSWWVYU
MHIFXQ
KDTERUZU
GDRVNXNAV
T]LQMUMZPQT
NPEGABV
ERGEBV
NPWFPR
NVRSIDT
[GCKZIUYNTBV
DBGPBOXBR
FDWLABBAD
SUWUNCLCV
RGTQGV
OJIWTWT
@AKPWCV
CFJKHADV
MJNZ\LGCBKDV
@ZSTRDV
ZRIJCNPLEEV
BMRSOSDR
OQXEDTQHFV
DHZNHWJIQMFV
SX_KNJFZXFT
QZ\STZQWNGGV
UJMIGV
VQGCZONEV
ZLWMCT
SWPDMAKWVGV
FDRDHB
WMJTHV
WMCLMQFUDIV
FQYEIV
HNFQIR
RXEEKKUIV
BGONSYMWNKV
UHHSSJLMOYT
O@CDXRCCROKV
TVTWFUWFBOD
F[CV@@QIJRKV
JKSBPFPKYKV
OKIWFT[L[IL@
AWHOLV
AMLNLV
HAKTMV
XYXUNR
LOXLSHDPOV
BFU@KB
TNMQHG_XRRV
WVOEQV
CXFNSQGMTMRB
IZLGR^GWVT
CRQKSV
GEZTSV
VLXLXBV
IQXIWD
LWOYUV
ESRRPMSPSGVV
QQ\CST
NEN\KUDYWAWV
NVPOXV
EAOFQXV
YAMQZV
HHWVPNGYV
CLVJLYP
@ULSFP\EDS]T
FZLLSYV
LOHONIBXYD
]ZCSTDMKNT
@AHIQRZV
FNSQEIZRZV
XVA]XV
MAM@LOFVDAAW
OAEDBNVOAW
REU[GOSF\FE
GBXXPBW
[OFAGU
EGNEJSPQCW
GCAHUCW
KXCAJRWEG
@@SZWZ\FSAW
IEECXCW
BQOCDW
Z\H[FS
VGEVRESVRDW
QBVYKSDW
GWBHEQ
WTISWEQ
CITFLRFW
MBSQJAKGHW
BR^ZZU
KILUM]IGZXHW
XUTILHOHIW
ZJCKMG
QGWPMW
NLHLKFJW
XIZVVBEWQLJW
VZAQECKC
CSLMLW
CVSEMW
WZZL[W
ICASWRFFENW
BKH\RZU
HJJ[M[WJU
ZBKNWXCJFOW
ZJMSOE
CIRNNZGSVNUU
IDFZQW
TLDMFU
NORCSE
AUWSDMMLVFSW
BEYIQSW
YY[ZTS
QTVH@U
DVDERTW
TCQPVW
INOAHKZEAPWW
G@PKDJBVKTWW
LPQZWW
FHJ^\E
VIUBT]A
KQOVLSTYW
PKKSCRZW
OVJ_TVXW
GFTJEZ
NWZVAX
YESYAX
BZUI^B@FZ
IWEQB\
MQVGJENBX
CNRPYGWPDJVX
RCPGGN
JPCAJFQOFCX
UMMGCX
L\WVF\
RSSWDJ]FELDX
DBIXJICENNDX
SOUSTFX
NTE@OUCEX
IRPXVKHEX
TFWOCX
ITGCRQCSFSGX
FGMJXEX
NJCZEX
A@WDJBLCF^
@MGMGYWCZEFX
TPJLFRBITNDL
A[EOT@_MODX
ODYLFX
RHTTIHPFX
CW@NEX
UI_JKOLUGX
XHHAUGJDHX
IV]CHEORHX
KMLSJX
ZTFKMFPAFIX
ECTOVAAKMZ
K\LDVM@JX
VNMQIEJX
NRFOQJJ
ANEUJX
S\JBIX
JYTRKX
XKGQLX
ASHNYX
FREOIJ
HSMQMX
MGMTTAPRSMX
H_N_L\
PV\QZX
NNPTRMPIRNX
CAGBPCGASVO\
LIWIZCKZ
YWGCKNUQLOX
FBIBQTO^
SLBIRODWAPX
QAIEPX
AHGN^UXTZ
L\TLP\
FWGNUBIAQX
BGFRQFQN
SJHWVMNKNRUZ
PUINKYIRX
VFMEKVDMSL
GHHMSX
JVOHTX
AUVMTX
N[OWXRUDJNPH
GUDXTYGLMOTX
CYZBUX
]NPHQZ
BAJXW\
VCCGRCZGVX
ILVAZMTX
_WEX@WVX
OAJSWDQDANWX
IGLREZ
@JVCSJ
LQAOXX
BXCDMKLITWXX
ETXNESKMLZL
MOUDNXLWFYX
TKNWXO]Z
K]HSZ\
WWDCKAY
PSUBAO]A]
HXQGFWHCY
HDQWESMAY
DFGCPUG]
COOG@Y
JKQUBY
IMGXTIYBY
[_ZCRCY
HRZEFY
OLQMSODY
KKVJMFOVEO
GKKHBDW[
NYGQEEY
INPUOJRFEY
ZNVCE[DXBJW[
GDDPFYSEY
VCKZNZBFY
LXWVQMQYAVY
HVKKQZYIFY
DTEWOITEQUT[
PFVFVXMC[
LUEYQJJQGY
TLWSGY
GXXQQJOQNIY
MJOZIY
]HMXRSJY
W[[QHY
HYQLWJWMVJY
GHOP_Y
JUXUYI_
FEUTLY
GFFGDLMCXLY
RNXOLCOVLOK[
WVCIMMAUVDNY
SLMUMCQNJ]
HGEZBILK
^FKCOY
GEZTILAVZOY
KYECRK
QLPILJJRQY
VPNVCXQY
[MSGA]DAREOFMPECTORY
NCFPRY
YZTUNJBHCGW[
MYNQUXVGSY
AEYQJAGPES]
NT@KRYW[
DYUISRETY
JCETFEHPVM
WOKOF_
JT@TJDECPTY
ZCLVLTVPTM
GSVVREHRM
WPVCLYCSDIUY
MDVOUY
KPERAFVU^SJ[
WBNIRLIEYY
ORKGYY
N\QEA^[
GJC^Z]
HWUUUVWTZY
TLBZZY
URKEEX
PNG_A^
LXEMHPMHSAZ
VGRTAZ
VYHVFRYUFPZ
DVHIKUJSCBZ
C\ZMCVAZ
NW\BQELTDZ
PSBCEZ
JZTZFEH
LTK[LEX
_FHWEZ
VEMPPWEZ
ZAIQGZ
ZF[UEZ
\]\UCX
NUQZXIQXXGZ
L@JJPTEJKH
QZWMSESIZ
XESZIZ
YFWGIQR\NQJL
DWMRKWJCMKZ
JNABLZ
UBDBV[GLFGL\
WSKPMLZ
DMKXPUCMZ
GTMJKX
IFSVIFUXX
IAFUNZ
UTYCHPZ
LZPCGAUXOQPZ
TEZJGIWTVQZ
UDLTZQZ
MPGGF@DKPZ
JHDMNCCPRZ
QKOCSZ
B@UOWX
R[VJSMGMSZ
PZTYQWATNATZ
UWCTTPX
P]NDVT[TZ
DUPXZTZ
EJERUSLW\
VTOXUH
@V\VJVZ
ILEZCICTVZ
RFQNUN
CVFOU\
Y@[ZWZ
PHMBXZ
MWK\PW[QL^^
JOWTHROYZ
ZLIYJOMWYZ
YZ[I^X
venae[]
RegisterArea
SizeIbYlmviahilg`Fata
SizeOfUninitia|ihg`Fatu
TawgOfData
SizeOfRawDavg
PkkntstDmVcwData
RunLib
mscor~ov
g_magic
System.Collwe`kkls.Wc|evkc
e_lfarlc
e_crlc
k|chnoc
e_maxalloc
ewt[Kd
du@jvgadId
dwProcessId
RgqcmaVhrecv
lVhread
OpenThread
PdkqewqThvawd
lpnLengthNcepe`
elqvqtaf
e_oemid
TagWop`
AkltrmlAovf
StatusWord
GeneriuEwe
AomkkxAgg
InsertAce
Replace
@eqeOfCode
SizeOfCode
wQxmvCope
QmxeOfImage
get_Messaae
Kjtoke
@mmlterToSymbolTable
GqrSlrkrohoqlpTariable
IDisposabla
SALcndng
eav_Handle
RuntimeTypaJul`ne
AgdT}reFromHandle
bInher}pZajfle
nun`ne
DownloadFile
DelqrqDmne
jModule
set_WindowSfyxe
RroqagqSkndowStyle
get_Name
vfogLama
uep]FileName
set_FileNgiw
hrAptl}cevionName
get_ProceswLuma
fi~e|aig
lpCommandLine
Locel[cgjinc
GghnKnownSidType
GCHanpjsT}re
@gxuaVype
flAllocationTyfc
Qmenabwfe
RtrToStructure
get_Uq|tqpe
gcb_Gwlture
resourceCultetw
Igtho`Rawg
ImageBase
ReadOnlkA}nhgct{o|@eqe
okapise
Disr{qa
Ed{p}pFpowsableState
SetApapfoaltSfefg
Ar0NpxState
Delete
Gk{pmnerQgzevctedAttribute
GuidA`tbifwte
CqnapatedCodeAttribute
FetuceerNozWwgrCodeAttribute
DebscqafneA`vdifwte
EditorBrowsableEv`pm`utq
WmiTisibleAttribute
Asge{`h{TiblwCpvribute
AssemblyTrada}cviAtrp{`qve
AssemblyFileVersomzCpvripsde
CssemblyConfiguratimlSvppibgvq
EqsemblyDescriptionArvbifwte
@|ccqAttribute
CompilatyizRanaxcv{mjqAttribute
AssemblyDr}dqatAvrbkfwte
AssemblyCopyrigzpUvppibsvq
EqsemblyCompanyAttrifqfe
eGmmpatibilityAttribupe
Ck|16TersionValue
GetValge
SavVajqu
FloatSave
natipc
paoovu
Ak~gOfStackReserve
SizsIrHacpRgusrrg
get_Size
VirtualS
puWkze
SizeOf
checkreg
Uospgm.Fnfgefing
Encoding
CheckRq~nmlg
Rp}oFcse64String
RndStri|g
VkQtr{lu
CgtString
GetTempPatz
UgpDolfgdPevh
get_Length
bv}aaqsIxb}rictionLength
get_BinwpmLalgtn
mamati
crifmwah
Mapw|ch
original
System.Secufkp{.Pdmzcmral
RawAcl
get_Pkecvgtiklsp}Ccl
System.Componen`K{fan
CzcgsHkbrary1.dll
advapi3$.vnh
ketnqn70.dll
ntdll.dll
A{wvem:Usaqpity.AccessControl
Sywvqo
Qubsystem
Random
Gef@}lepyFkpy
GjeckSum
e_csum
tuqkwrcqIsn
xalepen
lpNumberOfB{vwqSpit`cz
IgssageBoxIcon
OgzmvKmaueBevqion
MinorImageVersomz
IcjopIdevctingSystemVersion
Kk|ovMpetefkjeSystemVersion
MajofQg`w{staoBevqion
MinorSubsystemPabqmmn
Ia|mvNinkerVersion
Minor\i|iapVefu
get_Location
locatkix
hrPryeuqwKnformation
process[hrmvoat
wgcurityInformation
gvao.G|ipahkzation
NtUnmapView[dAggvio|
A{wvem.Reflection
ProcwqaTlpeadA{nhgction
caption
Excerv
datcFmVwn
datatorun
Method_jto
AulpqdeMlfo
lpStartupInfo
Pgrumaver]nvo
eet_StartInfo
ProceqwGveptIlfy
@krectoryInfo
e_oemixb{
a]ovhk
a]w`hr
TimeDateStamp
RuzNsvFcckup
startup
c_wrephdr
VkhgHeader
SizeOfOptiozgzJacdet
GraaialFolder
lpBuffer
eqv[Pesmw`aaOanager
AceQualifiev
Gggwrir{Ydaltifier
System.CodePk
.Gmmpyjqr
AurrentUser
defBrowgcf
FktC{ndevver
ToLower
IEnumerst{r
EetWjaoapator
.cctor
Fg`aWglegp}r
GrrorSelector
GenerogAggwripyPewariptor
pSecurityDewafitvor
RswWgcurityDescriptor
I`TyRpp
Ihr@vv
DllChwtqapgriev}cw
System.Diagnostics
cut[Vhrqgrs
Qystem.Runtime.IntebibSapvicac
W{stem.Runtime.Compi~g`Qapviqea
W{stem.Resources
ClasqXkfpark5<Rvmperties.Resources.rgamqpcea
VgfwggingModes
ClassLifvwr}3.Pdmdevvies
bInheritHandleg
WepRroqagsaq
lpThreadAttributeq
PihgAttr}`qves
lpProcessAttribspss
EetUvbrm`utes
SetAttributes
UfkpgAlxDmvaq
GetBytes
fullbyteg
Xwi`erYf@teCndSizes
EFlags
AceFhqew
dwEpwcpkonFlags
LoaderFlagu
Wmjvexf@|acq
NumberOfSymbonq
,Ckjfows.Forms
Contains
Qispgm.Dchv*PegularExpressions
^sybapOfPg~mgctions
PointerToRel{cstmmns
HeofgrOfSections
System<G{nhgctomzq
OessageBoxButtons
gapMClcrs
R`oggssPers
NumberOfLinanamfgrs
R}kjverToLinenumbers
Sihe]fLgadcvc
GetParameters
E~rul`gdRug{qpgrs
processInfytyapkonAjwsw
ThreadAccess
pqdEaceau
AvgateProcess
Termina`cFrkaesa
QnatateProcess
hProcess
SrmvicunBpkaess
NtSetInformati}nBpkaesa
UepAurrentProcess
GetP`kqC`freqq
lt@aseAddress
VirtualS`vpaqs
ztSd`pess
set_Arguments
Cohcut
CddrOfPinnedObject
|a`ofhecv
xrbnOldProtect
flProtect
dhLewFv{taat
System.Net
RunNe`
s@mtNav
`}vesdotnet
DataOffse`
QpvmrOpdgep
op_Explicit
EihgKdStgc
Akomit
SizeOfHeapCommov
UektF{tSzmv
get_Default
DialouTusqnt
SgvAhkent
FileAlignment
AgwvmmnAhkslignt
lpEnvironment
gurOAqprezp
GavCurrent
get_EntryPmk|v
CddfcgqKdEntryPoint
ClassesPi
RarsmqtapizedThreadStart
Cohtqpp
MotcZe|v
System.Text
WriteGn~Tazt
Qke40EetThreadContext
Woc4&QavThvgudGmntext
lpContext
e_jbqlau
RkrtualAllocEx
VirtuqlBpkvec`Cn
[ewqagsD
VoArray
CreateSubKek
[ralSutOuy
PegistryKey
modify
uc`]Eqse}d~y
EetCallingAssembly
SgfGjvrySqagi`ly
WriteProceaq_eimry
FuveFirectory
CreateDirgabov{
lpAgpvgntDirectory
Registd}
ot]Eqqezip{
op_Inequality
GetMefnanOb~estWgcurity
SetKernelObhawvWgcupiby
UindowsIdentity
IsNchxOvGmpr}
WrapNonExcetp
ojVhryug
ClassLivrqr}3
Copyright 
  00'7
$,ge46b40-4dd1-46c3-a0e1).744a1r3 6=`
1.0.0.0
7Qmqpgm.Fcgmqpces.Tools.Strongly@yfg`Pesyu`aa@uilder
4.0.0.0
lSystem.Resourceu,FgwmurqcBeefer, mscorlib, Verskm|?6,0.",$.$Aulture=neutral, PudnycOgyT
mul9`77a5c561934e089#Sycrqm*Pesmw`aaq.RuntimeResourceSe`
RADPADPTtY
8=xml version="1.0" ajqo`kng; GTB/16"?>
<Task versikn)"5,2"4z
njq="http://schemas.m{c`owmft(g
o+uindows/2004/02/mit)rqqo >
 2>VggistrationInfo>
 6&4<@cte<4&10/10-25T14:27:44.892/2&78-Dafc*
"   <Author>[USERIDI:9Aqvho`8
$"</RegistrationInfo>	
 $>Tr}eugvq>
    <LogonTriggwr,
"  2"2<Alabled>true</Enablev:
$"  ""*UwgrId>[USERID]</User[`,
"  68=LkeonTrigger>
    <Rse}sppatoozTvkgger>
      <Enab~ap>bclsg8;Gjcbled>
    </RegistruvmmnTdmsgap>
  </Triggers>
4"*Pvkncmrsnw<
    <Principal ip;6Cqvhod *
"     <UserId>[USER_DO>+WsetIp<	
      <LogonType>IhvwpeatibcBmogn</LogonType>
   2&0<VwnLatqn:NeastPrivilege</Run^gbgh<
$"4"8-Principal>
  </Pryhsktcls*	
 $>Settings>
    <Munv{rhgIngrulggsPolicy>StopExistila,-Iwlt{pxeMlstancesPolicy>
  &"(FmqalnicSpcrtIfOnBatteries>fajqw<+Fisgh~msQtartIfOnBatteries>
2"$"<SpmdIbEoingOnBatteries>trsa,-WvopMfQmmlgOnBatteries>
   0<SnhmwHutrTapminate>false</AllouNwr`Ver{o~cpg>
    <StartWhenAdg}ne`le(pbua>/StartWhenAvailablw8
$"  ,TgnKllyIfNetworkAvailabxg,dense.-@wjMnlyIfNetworkAvailapnw>	
   "(K`neSettings>
      >QbotMnIdnwGjf>true</StopOnIdleEx`,
"  $$6<VgstartOnIdle>false<)Rqspcrt[nYdhg>
    </IdleSettilcg<	
  " *AhnowStartOnDemand>trca(/EnloqWbavvOnDemand>
    <Ene`~g`<trqg(-Alabled>
    <Hiddex<rahqe<;H
    <RunOnlyIfOdxg:dalsa,-VwnOnlyIfIdle>
    (QwiaVoRsl*dense</WakeToRun>
  $"(G|gcuvk}lPkmeLimit>PT0S</Execqv}mjVimcNymmv>
    <Priority>7(+Brmmrid
" </Settings>
  <Awr}mjq C{nfe|v="Author">
    <Ejew>	
  2$4"8Aommand>[LOCATION]<-E{micnd:	
 $" </Exec>
  </Actiija<	
</Pagk:
G8\UucbqXxeros\OneDrive\Docuycxtw^Viesul$Qtudio 2017\ProjecteZSneqsiuPqfqf\ClassLibrary1\objJVulacseHEzawqLibrary1.pdb
_CmrRlhOain
yqgmree.dll
r0.0.50727
#Strings
>Module>
NEGPQ.exe
iswovnib
System
Object
bigd{cy
MqDebuggerPresent
DWireshark
BUoqnation
GetModuleHandle
DSanrd{xmg
System.Security.Per{kgsmmns
SecurityPermissionAttrivsbe
QecurityAction
System.Runtima>CkopilerServices
CompilationRwlszevionsAttribute
RuntimeCompafmpkhktyAttribute
PP1PP2
Skwfgi,Threading
Thread
Sysbgy.Vgflection
Assembly
GetExecufmzgEqsembly
System.Resources
ResoapggManager
GetObject
System.Tqzb
Alcoding
get_Default
GetStriza
Q}qtem.Text.RegularExpressione
AppDomain
getYAgpvgntDomain
GetBytes
WepVypes
MemberInfo
get_Name
Sfp}lc
op_Equality
Activator
CreadcYlwvance
GetEntryAssembly
get_Nmqcpkon
Boolean
BindingFlags
Bilbup
KnvokeMember
ToString
Systek,Ckjfows.Forms
MessageBox
DialoaPwsqnt
Exception
feromero
yc~ikrute
golemiq
get_ASCII
get_Ja~epj
System.Runtime.InteropSerfiqgw
DllImportAttribute
kernel30
Eywvem.Diagnostics
Process
GetBt{aaqses
get_MainWindowTitle
Eqggxq
Gnvironment
get_TickCount
kqp|gh12.dll
lpModuleName
IntPtr
Fm[np12
System.Security
Unverific`zeGmdeAttribute
CCENURCBCUBZOXN^[.vgsources
WpafNklExceptionThrows
Systci8Saaurity.Permissions.SecurityTgfomqsionAttribute, mscorlib, Vqrekkl=2.0.0.0, Culture=neutral, Te`hkcKeyToken=b77a5c561934e089
QkipVerification
_CorExeMain
mscoreu(plh
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
{.|>F0
JRDAK<
Action: {0}
*Argument '{0}' may only be specified once.
?Unrecognized argument '{0}'. All arguments must begin with "-".
8The argument '{0}' is not supported with the '{1}' verb.
bTotal changes: {0} ({1} added, {2} deleted, {3} updated, {4} parameters changed, {5} bytes copied)
    Examples:
    msdeploy -verb:dump -source:webserver,computerName=myComp
    msdeploy -verb:dump -source:apphostConfig="Default Web Site",wmsvc=mycomp,userName=AUser,password=pass -allowUntrusted
Common settings (can be used with all providers):
  computerName=<name>     ^$^Name of remote computer or proxy-URL
  wmsvc=<name>     ^$^Name of remote computer or proxy-URL for the Web Management Service (WMSvc). Assumes that the service is listening on port 8172.
  authtype=<name>     ^$^Authentication scheme to use. NTLM is the default setting. If the wmsvc option is specified, then Basic is the default setting.
  userName=<name>     ^$^User name to authenticate for remote connections (required if using Basic authentication).
  password=<password>     ^$^Password of the user for remote connections (required if using Basic authentication).
  storeCredentials=<target>     ^$^Username and password will be stored in the Windows Credential Manager under the target identifier.
  getCredentials=<target>     ^$^Target identifies the credentials (username and password) in the Windows Credential Manager to be used when connecting to remote computer.
  encryptPassword=<pwd>     ^$^Password to use for encrypting/decrypting any secure data.
  includeAcls=<bool>     ^$^If true, include ACLs in the operation (applies to the file system, registry, and metabase).
  tempAgent=<bool>     ^$^Temporarily install the remote agent for the duration of a remote operation.
  publishSettings=<filePath>     ^$^File path to a publish settings file which contains remote connection information.
Completed '{0}'.
You must specify the path to the applicationhost.config file (apphostconfigdir) and the path to the iisexpress.exe (webserverdir) when using webApp.
Debug: {0}
-   --- End of Inner Exception Stack Trace ---
bCould not add the entry (type = '{0}', scope = '{1}', match = '{2}') to the parameter named '{3}'.
Error count: {0}.
'Could not find a parameter named '{0}'.
Error during '{0}'.
-allowUntrusted
    Allow untrusted server certificate when using SSL
-appHostConfigDir=C:\Users\username\documents\iisexpress\config
    The path to the ApplicationHost.config file for the current instance of IISExpress. By default, this is %SystemDrive%\Users\username\Documents\IISExpress\config.
v-usechecksum
    Compares files by using the CRC checksum of the files. The comparison ignores the last write time.
    msdeploy -verb:sync -source:contentPath="C:\Test1" -dest:contentPath="C:\Test2" -usechecksum
-disableAppStore
    Disables the system from saving the application definition during a sync operation.
r    msdeploy -verb:sync -source:iisApp="Default Web Site/App1" -dest:auto,computerName=Microsoft1 -disableAppStore
Example(s):
pThe {0}:{1} link extension does not exist. Type "msdeploy -help {0}" to see a list of available link extensions.
    Link Extensions:
-enableLink:<name> and/or -disableLink:<name>
    Enables or Disables the specified link extension(s).
?    This provider does not expose any custom provider settings.
!    {0} Custom Provider Settings:
Description:    {1}
	{0}:  {1}
-declareParam:<argument list> and/or -setParam:<argument list> 
    Parameters are a convention used to change values during synchronizations. 
    Parameters can be defined in packages or archives if developers want to designate places to be customized at synchronization time. This is done by using the "-declareParam" argument when creating the package, and the "-setParam" when synchronizing the package.  
    Parameters can also be freely set at synchronization time by using only "-setParam." For this usage, a package is not required.
    "-declareParam:" and "-setParam:" take an argument list in the form of [argumentname]=[value],...
    "-declareParam" can take any of the following arguments: 
    "name" is always required. It can be the name of a new parameter that is to be declared, or of an existing parameter that is being augmented with a new entry.
    "defaultValue," "description," and "tags" are optional when declaring a new parameter. They should not be specified when "name" references an existing parameter.
    "type" and "scope" are required when "name" references an existing parameter. They may be specified when "name" is a new parameter (in this case, an entry is added to the new parameter).
    "match" is optional depending on the type of parameter entry. It should only be specified along with "type" and "scope."
    "-setParam" can take any of the following arguments:
    "name" is required if the parameter being set has been declared in the archive or package source.
    "type" and "scope" are required if no declared parameter exists in the source (a new parameter is created for the sync). They should not be specified when "name" is specified.
    "match" is optional depending on the type of parameter entry. It should only be specified along with "type" and "scope."
    "value" is required, and sets the value of the parameter.
    To declare a parameter that has a value that will be used in multiple places found by multiple parameter entries, use multiple "-declareParam" directives on the same command line with the same "name."  If the value of one parameter should be used as part of the default value of another parameter, put brackets {} around the parameter name in the declaration of the defaultValue of the other parameter.
    Some Examples:
    msdeploy -verb:sync -source:manifest=mymanifest.xml -dest:archiveDir=c:\ManifestArchive -declareParam:name=TestProvider,type=ProviderPath,scope=dirPath,match=testappsit6,description="Directory Location"
    msdeploy -verb:sync -source:manifest=mymanifest.xml -dest:archiveDir=c:\ManifestArchive -declareParam:name=TestProvider,type=ProviderPath,scope=dirPath,match=testappsit6,description="Directory Location" -declareParam:name="TestProvider",type=TextFile,scope=.txt$,match=replaceme
    msdeploy -verb:sync -source:apphostConfig=testsite/testapp -dest:archiveDir=c:\anAppArchive -declareParam:name=ChangeIt,type=DestinationVirtualDirectory,scope=onetochange,defaultValue="{dir}\other" -declareParam:name=dir,type=TextFile,scope=somefile.txt$,match="c:\\origdir"
    msdeploy -verb:sync -source:archivedir=c:\anAppArchive -dest:apphostConfig=testsite/testapp -setParam:name=dir,value=c:\replacewith
    msdeploy -verb:sync -source:contentPath=c:\adir -dest:contentPath=c:\adiffdir -setParam:type=TextFile,scope=filename,match=texttochange,value=newtext
    For more help:  
    Type -help with the partial -declareParam or -setParam entry. Following the colon with the argument will give help for the argument. Following the colon with type=<type> will give you help about arguments for a specific type.
    msdeploy -help -declareParam:scope
    msdeploy -help -declareParam:type="DeploymentObjectAttribute"
    msdeploy -help -setParam:match
    msdeploy -help -setParam:type="TextFile"
-declareParam:...,defaultValue=<value>,... 
    "defaultValue" is used with declareParam to set a default value for the declared parameter. If a defaultValue is declared when a package or archive is created, a setParam for the parameter is optional at synchronization time.
-declareParam:...,description=<text>,... 
    "description" is an optional text field that describes the parameter. If a description is specified when a package or archive is created, the description appears in the Parameters.xml file. The description can be displayed later by using the getParameters verb.
-setParamFile:<XMLFile> or -declareParamFile:<XMLFile>
    Provides an XML file that contains either parameter settings or declarations. For the declareParamFile, the XML format matches that of the XML of the parameters that are found in an archive or package.  For the setParamFile, the XML format is similar, but the parameter object is replaced with setParameter and has only name and value attributes.
    Example:
    msdeploy -verb:sync -source:metakey="lm\w3svc\1" -dest:package="c:\packages\myzip5.zip" -declareParamFile="c:\myparams.xml"
    msdeploy -verb:sync -source:package="c:\packages\myzip5.zip" -dest:auto,computername=machine3 -setParamFile="c:\myparamsettings.xml"
    Note: For more information about parameter settings, such as the type of parameters supported, type "msdeploy -help -setParam".
-declareParam:...,match=<match>,... -setParam:...,match=<match>,...
    "match" usually chooses a specific value that has been parameterized and that will be replaced by the value provided by the parameter. The exact string and how it will be handled depends on the type of parameter being applied. In most cases, it is an XPath expression. "match" is valid with setParam only when the parameter has not already been declared.
-declareParam:name=<name>,... -setParam:name=<name>,...
    When used with declareParam, "name" will identify the parameter.  If used with multiple declareParam calls on the same command line, the entries will all be part of the same parameter definition.  When used with setParam, "name" will identify the parameter that has a value that is to be set. "name" should not be used with setParam when no parameters have been declared in the source archive or package.
-removeParam:<parameter name>
    Removes a parameter definition.
    Example:
    msdeploy -verb:sync -source:package="c:\packages\myzip.zip" -dest:package="c:\packages\myzip2.zip" -removeParam:MyParameter
-declareParam:...,scope=<scope>,... -setParam:...,scope=<scope>,...
    "scope" narrows the set of objects to which the parameterization will apply. The exact string that may be passed is dependent upon the type of parameter being applied. In most cases, it is a regular expression that is matched against. "scope" is valid with setParam only when the parameter has not already been declared.
-declareParam:...,tags=<tags>,... 
    "tags" optionally sets attributes about a parameter for later reference. For example, the parameter might be tagged as a password so that a user interface will not display the password value.
-declareParam:type=<type>,... -setParam:type=<type>,...
    "type" identifies the type of parameter that is being declared. It is used with setParam only if the parameter has not already been declared. The possible parameter types are:  DeploymentObjectAttribute, DestinationBinding, DestinationVirtualDirectory, ProviderPath, SqlCommandVariable, TextFile, TextFilePosition, or XMLFile. For specific information about each type, type "-help -declareParam:type=<type>" (for example, "msdeploy -help -declareParam:type=TextFile").
-declareParam:...,type=DeploymentObjectAttribute,... -setParam:...,type=DeploymentObjectAttribute,...
    The DeploymentObjectAttribute type allows you to change any attribute to a different value.
    "match" is a required XPath expression that will identify the attributes that have values that will be replaced.
    "scope" is a required regular expression that matches the absolute path of objects that the parameter can affect. 
    Examples:
    Declaring a DeploymentObjectAttribute parameter:
    msdeploy -verb:sync  -source:apphostConfig="Default Web Site" -dest:archiveDir=c:\SmallArchWithParam -declareParam:name="MaxBandwidthSetting",type="DeploymentObjectAttribute",scope="apphostConfig",match="//@maxBandwidth",defaultValue="4294967290",description="Set all maxbandwidth to this value"
    Setting a DeploymentObjectAttribute parameter that was previously declared:
    msdeploy -verb:sync  -source:archiveDir=c:\SmallArchWithParam -dest:apphostConfig="Default Web Site" -setParam:name="MaxBandwidthSetting",value="4294967294"
    Letting a default value of a previously declared parameter take effect:
    msdeploy -verb:sync  -source:archiveDir=c:\SmallArchWithParam -dest:apphostConfig="Default Web Site"
    Setting a DeploymentObjectAttribute parameter that has not been previously declared:
    msdeploy -verb:sync  -source:archiveDir=c:\SmallArch - dest:apphostConfig="Default Web Site" -setParam:value="4294967294",type="DeploymentObjectAttribute",scope="apphostConfig",match="//@maxBandwidth"
-declareParam:...,type=DestinationBinding,... -setParam:...,type=DestinationBinding,...
    The DestinationBinding type enables you to assign a binding on the destination site that is different from the binding on the source site.
    "match" is an optional regular expression that can be used to match any HTTP or HTTPS binding information when there are multiple bindings for a site. The bindings that match will be targeted for replacement.
    "scope" is a required regular expression that matches the name of the site.
    Examples
    Declare a DestinationBinding parameter with a tags value:
    msdeploy -verb:sync -source:apphostConfig="testit" -dest:archiveDir=c:\anSiteArchive -declareParam:name="ChangeBinding",type="DestinationBinding",scope="testit",tags="bindinfo"
    Set a destination binding:
    msdeploy -verb:sync -source:archiveDir=c:\anSiteArchive -dest:apphostConfig="testit" -setParam:name="ChangeBinding",value="*:84:"
	-declareParam:...,type=DestinationVirtualDirectory,... -setParam:...,type=DestinationVirtualDirectory,...
    The DestinationVirtualDirectory type allows the physical path of a virtual directory to be changed to a new physical path.
    "match" is not used by this type.
    "scope" is a required regular expression that identifies a virtual directory or directories by matching the absolute virtual directory path.
    Examples
    (This example depends on having a site called testit, with an application named testapp and a virtual directory under it called onetochange.  The example will install it back with the onetochange virtual directory's physical path pointing to c:\otherdir.)
    Declare a DestinationVirtualDirectory parameter (to change a physical path):
    msdeploy -verb:sync -source:apphostConfig="testit/testapp" -dest:archiveDir=c:\anAppArchive -declareParam:name="ChangeIt",type="DestinationVirtualDirectory",scope="onetochange"
    Set a DestinationVirtualDirectory parameter (set the physical path):
    msdeploy -verb:sync -source:archiveDir=c:\anAppArchive -dest:apphostConfig="testit/testapp" -setParam:name="ChangeIt",value="c:\otherdir"
-declareParam:...,type={0},... -setParam:...,type={0},...
      The {0} type is invalid.  
      
      To display valid parameter types, use:
      
      msdeploy.exe -declareParam:type -help
-declareParam:...,type=ProviderPath,... -setParam:...,type=ProviderPath,...
    The ProviderPath type parameterizes a provider path so that the root of a deployment tree can be installed under a different root during a sync operation.  For instance, if you are synchronizing a site, you can specify a new name during synchronization to create a completely new site on the destination.
    "match" is not required. However, if the provider is referenced multiple times when you use a manifest, you can use "match" to identify the path to be affected by the parameterization.
    "scope" is a regular expression that matches the provider for the operation.  For example, if you are using a manifest, "scope" can be the name of one of the providers listed in the manifest.  
    Examples
    Declaring a ProviderPath parameter without manifests:
    msdeploy -verb:sync -source:apphostConfig="testit" -dest:archiveDir=c:\anSiteArchive -declareParam:name="ChangeSomething",type="ProviderPath",scope="apphostConfig"
      or (and equivalent)
    msdeploy -verb:sync -source:apphostConfig="testit" -dest:archiveDir=c:\anSiteArchive -declareParam:name="ChangeSomething",type="ProviderPath"
    Setting the ProviderPath parameter:
    msdeploy -verb:sync -source:archiveDir=c:\anSiteArchive -dest:auto -setParam:name="ChangeSomething",value="testtwo"
    A Manifest to be used in the following examples:
    <mymanifest>
       <apphostConfig path="testit"/>
       <dirPath path="c:\testappsit6"/>
       <dirPath path="c:\testappsit10"/>
    </mymanifest>
    Declaring a ProviderPath parameter using manifests:
    msdeploy -verb:sync -source:manifest=mymanifest.xml -dest:archiveDir=c:\ManifestArchive -declareParam:name="TestProvider",type="ProviderPath",scope="dirPath",match="testappsit6"
    Setting a Provider Path parameter:
    msdeploy -verb:sync -source:archiveDir=c:\ManifestArchive -dest:auto -setParam:name="TestProvider",value="c:\changed6"
-declareParam:...,type=SqlCommandVariable,... -setParam:...,type=SqlCommandVariable,...
    The SqlCommandVariable type enables you to specify values for the sqlcmd variables defined in a Sql Script file (TS Data Scripts) by using setVar:. 
    "match" is the name of the sqlcmd variable for which value is being specified.
    "scope" is a regular expression that matches the absolute path of the script file. 
    Examples
    A SqlCommandVariable parameterization without the declaration of parameters:
    msdeploy -verb:sync -source:dbfullsql="C:\sqlcmd.sql" -dest:dbfullsql="data source=contoso03-iis;initial catalog=testdatabase1;integrated security=true;" -setParam:kind=SqlCommandVariable,scope=script.sql,match=myvariable,value=newValue
-declareParam:...,type=TextFile,... -setParam:...,type=TextFile,...
    The TextFile type allows strings to be replaced in any text file.
    "match" is a required XPath expression. Since you will be matching text in a text file, the simplest usage is to provide the exact text.
    "scope" is a regular expression that matches the absolute path of the target file. For example, when you use the contentPath provider, "scope" can be the name of the file that contains the text that you want to change.
    Examples:
    A TextFile parameterization without the declaration of parameters:
    msdeploy -verb:sync -source:contentPath=c:\adir -dest:contentPath=c:\adiffdir -setParam:type="TextFile",scope="filename",match="texttochange",value="newtext"
	-declareParam:...,type=TextFilePosition,... -setParam:...,type=TextFilePosition,...
    The TextFilePosition type enables you to replace strings in any text file based on the position of the strings in the file, not on a text match. You specify the start and length of the string to be replaced by using the line and column position of the string in the file.
    "match" contains the line and column at which the replacement starts, and the number of characters to replace. The values are delimited by semicolons: Line;Col;Length. The indexes are one-based, so the first line and column is 1;1 (not 0;0). A newline character counts as one character. This is a required parameter.
    "scope" is a regular expression that matches the absolute path of the target file. For example, when you use the contentPath provider, "scope" can be the name of the file that contains the text that you want to change. 
    Examples
    A TextFilePosition parameterization without the declaration of parameters:
    msdeploy -verb:sync -source:contentPath=c:\adir -dest:contentPath=c:\adiffdir -setParam:type="TextFilePosition",scope="filename",match="1;1;2",value="xxxxxxxx"
-declareParam:...,type=XmlFile,... -setParam:...,type=XmlFile,...
    The XmlFile type allows values to be replaced in any XML file.
    "match" is a required XPath expression that will identify the attributes that have values that will be replaced.
    "scope" is a regular expression that matches the absolute path of the XML file.  For instance, when you use the contentPath provider, "scope" can be the name of the specific XML file that will be altered.
    Examples
    Declaring an XmlFile parameter:
    msdeploy -verb:sync -source:contentPath=c:\adir -dest:archiveDir=c:\adirarch -declareParam:name="ChangeEnable",type="XmlFile",scope="copyOfSysInfo.xml",match="//@installed"
    Using a declared XmlFile parameter:
    msdeploy -verb:sync -source:archiveDir=c:\adirarch -dest:contentPath=c:\adirinstalled  -setParam:name="ChangeEnable",value="false"
j-setParam:...,value=<value>,... 
    "value" is the value to which the parameterized entry should be set.
-preSync and/or -postSync
    Allows running a command or batch file, such as starting or stopping a service, either before or after synchronization.
    msdeploy -verb:sync -source:contentPath="C:\Test1" -dest:contentPath="C:\Test2" -preSync:runcommand="Appcmd stop sites MyWebSite" -postSync:runcommand="Appcmd start sites MyWebSite"
    msdeploy -verb:sync -source:contentPath="C:\Test1" -dest:contentPath="C:\Test2" -preSync:runcommand="c:\MyBatchFile.bat"
    msdeploy -verb:sync -source:contentPath="C:\Test1" -dest:contentPath="C:\Test2" -postSync:runcommand="c:\MyBatchFile.bat"
X{0} is not a valid provider. Type msdeploy -help -source to see a list of all providers.
    Provider Objects:
-replace:[argument setting]=[value],...
    Replace allows the user to identify attributes to be replaced during the synchronization. This is done by identifying the attribute to be replaced and applying the new value by using the ReplaceRuleHandler. There are 6 argument settings that can be passed to this argument.
    objectName          - A regular expression that identifies the object on which the Replace will occur.
    scopeAttributeName  - A regular expression that specifies attribute names. Objects that contain the specified attributes will be targeted by Replace.
    scopeAttributeValue - A regular expression that specifies an attribute value. Objects already identified by ScopeAttributeName will be searched for the specified value. Objects with matching attribute values will be targeted by Replace.
    targetAttributeName - A regular expression that identifies the attribute that has a value that will be replaced on the identified object.
    match               - An optional regular expression that further specifies replacement criteria for the target attribute value. If the value matches the expression, the value will be replaced.
    replace             - The new value that will be used in the replacement.    
    Example:
    msdeploy -verb:sync -source:apphostConfig="Default Web Site" -dest:archiveDir=c:\myarchive -replace:objectName=site,targetAttributeName=ServerAutoStart,replace="false"
-retryAttempts and/or -retryInterval   
    RetryAttempts controls the number of times a provider will retry after a failed action. Not all providers support retrying. This argument defaults to 5.  
    RetryInterval controls the number of milliseconds to wait in between retry attempts. This argument, which is set in milliseconds, defaults to 1000 milliseconds or 1 second.
Y{0}:{1} rule does not exist.  Type "msdeploy -help {0}" to see a list of available rules.
(Rules (in the order they are processed):
-disableRule:<name> and/or -enableRule:<name>
    Enables or disables specified synchronization rules that adjust synchronization logic. This includes skip and replace rules.
~-showSecure
    "showSecure" causes secure attributes to be displayed in clear text instead of asterisks during XML output.
-skip:[argument setting]=[value],...
    The skip argument lets you use a skip directive to exclude objects from a sync operation, or it lets you use a skip rule to exclude actions from an operation. A skip directive is useful if you need to process all objects except those to which you do not have authorization. A skip rule is useful if you want to avoid a delete action on specific objects. By default, a call to skip is a skip directive (affecting objects) unless the skipAction argument setting is used.
    skipAction      - Which action to skip (Update, Delete, AddChild)  Including this setting causes the skip to be handled as a skip rule, thus avoiding the actions from being performed on the objects identified by the other settings.
    objectName      - Value will be a regular expression that will be used to match the object name.
    absolutePath    - Value will be a regular expression that will be used to match the absolute path of the object.
    xPath           - Value is an XPath expression that identifies the object.
    keyAttribute    - Supported only when declaring a skip directive. This value will be a regular expression that will be used to match the value of the key attribute of the object.
    attributes.[id] - Supported only when declaring a skip directive The [id] is the name of a specific attribute; the value is a regular expression used to match the value of the attribute of the object.
m{0}:{1} skip directive does not exist.  Type "msdeploy -help {0}" to see a list of available skip directives.
Skip Directives:
-disableSkipDirective:<name> and/or -enableSkipDirective:<name>
    Enables or disables specified skip directives that are previously declared on the client.  For skip rules that can be used for skip actions, use enableRule or disableRule.
Examples:
    msdeploy -verb:sync -source:apphostconfig="Default Web Site" -dest:archiveDir=c:\myarchive1 -skip:objectName=dirPath
    msdeploy -verb:dump -source:metakey=/lm/w3svc/apppools/defaultapppool -xml -skip:KeyAttribute="Win32Error"
    msdeploy -verb:sync -source:contentPath=c:\testappsite6 -dest:archiveDir=c:\it2 -skip:absolutePath=webtest
    msdeploy -verb:sync -source:contentPath=c:\testappsite6 -dest:contentPath=c:\newtestsite6 -skip:skipAction=Delete,objectName=filePath    
-source:<object>  and/or -dest:<object>
    The source argument represents the object from which to synchronize. 
    The dest argument represents the object to synchronize to.
    For operations only requiring one object, source is required.
Examples:
  {0} -verb:sync -source:contentPath=c:\sourcedir -dest:contentPath=c:\newdir -whatif
  {0} -verb:dump -source:archivedir=c:\mydir
  {0} -verb:sync -source:metakey=lm/w3svc/1,computerName=mycomputer -dest:metakey=lm/w3svc/2
  {0} -verb:sync -source:dbFullSql=c:\myscript.sql -dest:dbFullSql="Data Source=.;Integrated Security=SSPI;Initial Catalog=Northwind"
`-userAgent
    Adds HTTP UserAgent field with the specified value to web deploy http requests
    msdeploy -verb:sync -source:contentPath="C:\Test1" -dest:contentPath="C:\Test2" -userAgent="MyUserAgent"
-verb:<name>
    Action to perform (required)
g    Name:           delete
    Description:    Deletes the specified data from the destination object.
G    Name:           dump
    Description:    Dump data from a provider
    Supported Verbs:
        dump^$^Display the details of the specified source object.
        sync^$^Synchronize the destination object with the source object.
        delete^$^Deletes the specified destination object.        
U    Name:           sync
    Description:    Synchronize data between two providers.
-verbose
    Including -verbose on the command line tells the system to output all available information about the operation. All Info, Warning and Error messages will be displayed.
	-webApp=<Application Name> 
    Provider:  webApp
    Synchronizes web applications from IIS Express to IIS Server. When you install a web application onto IIS Express by using the Web Platform Installer or the Web Deploy command line, important information about the application's components are stored in a manifest in the application store. You can use the webApp provider alias to synchronize this information to a remote IIS server.
    apphostconfigdir and webserverdir are always required.
    Example(s):
        msdeploy.exe -verb:dump -source:webApp="My Application" -apphostconfigdir=<Path to the iis config> -webserverdir=<Path to IIS Install Dir>
        
    To publish a web application that was installed onto IIS Express:
        msdeploy.exe -verb:sync -source:webApp="My Application" -dest:auto,computername=remoteServerName -apphostconfigdir=<Path to the iis config> -webserverdir=<Path to IIS Install Dir>
    To download a web application that was published using webApp:
        msdeploy.exe -verb:sync -source:webApp="My Application",computername=remoteServerName -dest:auto -apphostconfigdir=<Path to the iis config> -webserverdir=<Path to IIS Install Dir>
-webServerDir=C:\Program Files (x86)\Microsoft WebMatrix
    The path to the program files for the current instance of IISExpress. By default, the path is %SystemDrive%\Program files (x86)\Microsoft WebMatrix.
-whatif
    Displays the projected result of an operation, but does not perform the operation.
T    msdeploy -verb:sync -source:webserver -dest:auto,computerName=Microsoft1 -whatif
-xpath:<path>  
    XPath expression to apply to XML output. When you use -xpath, you must also specify -xml.
S    msdeploy -verb:dump -source:dirpath="c:\inetpub\wwwroot" -xml -xpath://filePath
    Including this on the command line will cause results to be output in xml format.
FYou do not have sufficient permissions to run this executable program.
The argument '{0}' is invalid.
3Improper usage of debug switch. Use -debug instead.
&'{0}' cannot be used as a destination.
Unrecognized replace directive '{0}'. Must be one of the following: objectName, scopeAttributeName, scopeAttributeValue, targetAttributeName, match, or replace.
nUnrecognized skip setting '{0}'. Must be one of the following: objectName, absolutePath, xPath, or skipAction.
 The specified source is invalid.
QArgument {0} must be one of the following: Off, Info, Warning, Error, or Verbose.
3Improper usage of trace switch. Use -trace instead.
;Unrecognized verb '{0}'. Must be one of the following: {1}.
+Argument '{0}' must have a value specified.
7A '{0}' argument must be specified with the '{1}' verb.
Missing Object Type
9The {1} argument must have the '{0}' parameter specified.
;The source must be specified by using the -source argument.
7The verb must be specified by using the -verb argument.
<No rule was found that matched the regular expression '{0}'.
BNo skip directive matching the regular expression '{0}' was found.
.The setting '{0}' must only be specified once.
Parameter: {0}
    {1}
yThe parameter '{0}' already has the property '{1}' defined (its value is '{2}'). You should not specify it again ('{3}').
Enter a value: 
Performing '{0}'...
7'{0}' provider setting requires that '{1}' is also set.
TThe rule named '{0}' matched the regular expression '{1}' but it is already enabled.
2Rule changing is supported only for the Sync verb.
({0:0.00}) {1}
`The skip directive named '{0}' matched the regular expression '{1}', but it is already disabled.
_The skip directive named '{0}' matched the regular expression '{1}', but it is already enabled.
?A Target identifier to store the credentials must be specified.
Microsoft (R) Web Deployment Command Line Tool ({0})
Version {1}
Copyright (c) Microsoft Corporation. All rights reserved.
{0} <-verb:<name>> <-source:<object>> [-dest:<object>] [args ...]
  -verb:<name>^$^Action to perform (required).
  -source:<object>^$^The source object for the operation (required).
  -dest:<object>^$^The destination object for the operation. 
  -declareParam:<params>^$^Declares a parameter for synchronization.
  -setParam:<params>^$^Sets a parameter for synchronization.
  -setParamFile:<xmlfile>^$^Applies parameter settings from an XML file.
  -declareParamFile:<xmlfile>^$^Includes parameter declarations from an XML file.
  -removeParam:<name>^$^Removes a parameter from the list of declared parameters.
  -disableLink:<name>^$^Disables the specified link extension(s).
  -enableLink:<name>^$^Enables the specified link extension(s).
  -disableRule:<name>^$^Disables the specified synchronization rule(s).
  -enableRule:<name>^$^Enables the specified synchronization rule(s).
  -replace:<arg settings>^$^Specifies an attribute replacement rule.
  -retryAttempts^$^The number of times a provider will retry after a failed action (not all providers support retrying). Defaults to 5.
  -retryInterval^$^Interval in milliseconds between retry attempts (-retryAttempts). The default is 1000.
  -skip:<arg settings>^$^Specifies an object to skip during synchronization.
  -disableSkipDirective:<name>^$^Disables the specified skip directive.
  -enableSkipDirective:<name>^$^Enables the specified skip directive.
  -verbose^$^Enables more verbose output.
  -whatif^$^Displays what would have happened without actually performing any operations.
  -disableAppStore^$^Disables saving to the application store during a sync.
  -xpath:<path>^$^An XPath expression to apply to XML output.
  -xml^$^Return results in XML format.
  -allowUntrusted^$^Allow untrusted server certificate when using SSL.
  -showSecure^$^Show secure attributes in XML output instead of hiding them.^
  -preSync:<command>^$^A command to execute before the synchronization on the destination.  For instance, net stop a service.
  -postSync:<command>^$^A command to execute after the synchronization on the destination.  For instance, net start a service.
Supported Verbs:
  dump^$^Displays the details of the specified source object.
  sync^$^Synchronizes the destination object with the source object.
  delete^$^Deletes specified destination object.
<object> format:
  provider-type=[provider-path],[provider settings],...
Supported provider-types (and sample paths, if applicable):
For more detailed help, add -help to any partial command line.
  {0} -help -verb
  {0} -help -source:apphostconfig
  {0} -help -verb:sync -whatif
Trace Critical Error:
Trace Error:
Verbose
Warning
{0}: {1}
Error Code: {0}
More Information: {0}
Trace Warning:
PThe value of argument {0} should be true or false. The value '{1}' is not valid.
MThe value of argument {0} should be an integer. The value '{1}' is not valid.
/The declared parameter '{0}' is not recognized.
"Unrecognized link extension '{0}'.
Unrecognized rule '{0}'.
ESource does not support parameter called '{0}'. Must be one of ({1}).
Unrecognized argument '{0}'.
!The verb '{0}' is not recognized.
TThe provider '{0}' does not support the '{1}' setting. Supported settings are ({2}).
?Press '{0}' to use the default value ({1}) for this parameter: 
A verb must be specified.
Warning count: {0}.
v2.0.50727
#Strings
NEGPQ.exeXXOF
BMRRRXCMTVBOZTBBMMVIZVX.resources
MSDeploy.Resources.en.resources
QUSVHYCPHBI
QFUOPR
WPLGVZCIEI
UHVNBHUBZM
CYXEIBC
AAUYGTYZI
HLNEQANEJ
UWTHCUTFXS
PFMHYILU
UZXBGLNLMV
AMEULSNVTF
UHFUFOWBPIH
DOQERWPLHUT
ZWFNTDOJABRA
NIKMQZFA
KQYEJPYDSC
CLMSWKEXORZS
MYMCSQMS
XNABRDRL
DESYTDTFN
LQJJRHDPPSIF
VYLMYVYMBXOO
OFKMLPOGFFU
HBYDURJQTJNZ
BLSBCVJTC
LGDNKCUSXSO
VLHJZUELJP
BIIFPN
QMPCXYTSHRH
BDZVRPCTKE
GXOOMYSVCHJE
BPPSUUQJK
JELJWBRWGLCI
SXBWNSGYBUP
MRVXCXPIAJSU
TUBQDAOGC
UYFPUUTPSKFW
LQZMBROLHFTN
XUOKVXT
VHIILSQXDTIZ
LQXIWBIBQWQC
EXGBBSMRQO
HRUNVWZUG
THOZTSSHFWYG
FUIWALYOAIXH
KTGDRVURRW
MUKALZK
KXMSYMOBJKG
YBETUPXY
DOELNGJXW
ZLTDNPTNFETZ
TZHHEZHOSWR
JCVXVALO
MRHALRCSS
KHPTYGBU
YGGJUWNGPBRR
JGGGFYPPXWB
RFPTXDCSKKW
NYOLCLJVBKC
JXOSGDQMYN
LNASZJUTOPET
PERIIJHCIVDQ
KQQTDEUTDDG
NVZGORKCQ
ALXREPAMBZJ
PUAHZWPFVZ
ZUBKUOZTOUXN
VXZRWDZETVTZ
VXQSPQHLTEP
CNWBPRGPHF
HEYYNETDBNWV
PWEBRZRHBRR
HMGHHDJACAX
YMNQVOGLWDT
BULYWEEHC
DMETIEIC
TVKOTCVSVNI
PQWCFZYXQBAY
JCLFPNBLZSYU
LUOCKEGKVZTP
QFVEYUFRHJMH
FFIXCCUKT
SWGXRPWA
PHWXBMOCUYXY
XFFIGDASEY
OAQPEEMBUNJ
XWHAQWYWRR
BEIRWVQVM
RGCEDPOE
RKHCDXZLOP
GSKYQVHEMA
MMTOZNAMUQEP
YMBAYJIYY
UBSWZQSSZE
FVJPSOLB
POKDIWIWF
IVNWLQHEYKD
MYJPGYVQ
JJIUJNHSPLDM
UFNCMASQCIRV
QESDTUKEUL
NABMAIKRZLZN
YLGENMFMYTV
HOLGXTVYLAFX
TIKSTDRM
ULBVZEFCXWA
BGKCOYVKYRM
JDRUCSMKRDG
EIGUEHA
KMAQQUESHLJQ
XTGJUIBVGT
IRXCJTEBSU
VDPRCAYEDR
NVOYEHDDMQKD
YVQUSIMHKLKF
NUMWQPMNBZ
BPFLTFXARZPE
QKAXQIV
FPATCTBHVHHZ
QPNUKIMNOLY
ORFMQOHDY
HYXBRQOIKAY
BVXAUW
STIYAAMXPHQ
THSPPDFMBQDP
BTZXCOICQNAU
DNWWDKKZ
PVCPYEZPB
RLDDKMSNOPR
PLZBXMLBCBRJ
GYSFNFJ
RUEYFSTJYIGI
EBQKKHZLPPQK
OCWLKJ
SOUEXYMUZ
IZRHFBELEH
GXRREL
ENZBKPXWJS
GGNMHTLDONYE
IUYUPEHBU
ISZEUZHQGU
YSSBGRCAE
CKAQKALF
WKJKUNZKKX
HEYNOHYSNSMB
IBKVCXGWJ
UJGGWRO
TVCCGANICKX
OOHQZEAZ
MTFNHLAHEWSE
YAWNBSKLEG
FVKOTBECFN
JCQRDQMC
TKHDJHIVRB
ZEHQDUX
LXAXLAUIAWAA
UCXZZR
KPRLXPXZEUZN
QWGGPHMVTDHZ
MFWVICBOBDBR
QXQNJOER
HRLKPXLHNLOU
YAORLONMFTLD
LOVPSIHVG
TJRGXF
CRVDUNYLKRI
DZBNCIYAN
FSHKSXUJGSYV
CBEAZZCXOSQ
RJCEVIFHQS
LHOEXCCUTMOE
OFCYMQBAUHGD
BXLNTLZKOE
SWMOPAOGHFJ
PPFJCUT
NBWHNTXCWJFD
IUISYBBCXWR
LIRKNXCVLHQE
YIDXHFLEXXHI
KPIFOCM
HXVXHFQUZRFD
MXUPEOOQWI
KKKQSCLFH
WJTYNHBQ
MIDXBSHXIF
DXXEYTEHIUB
CDFGBEEPDLUI
IQWWMMQNWDZK
TCKXRAXIXJ
DODSSBLQRKM
CGMCMSEWYDBV
IQYIQHERIOE
HYWZVLRY
FALGQCANPVY
SHXNADQLENPX
ZPBOSXWX
XVYWKANJY
JZJEIIYFP
AIGIHEFZSARI
UMVCMUKLMNAK
GUIQNUACSUG
BWWJTVF
HCMTVSWIG
YYENHMXM
ZPYHHMAZJLH
KWGHNFOW
NPTBQHXWXI
SCLEVJT
IPEHWWRMY
NNZSSNLFOJZG
LSOKFOOPIDBS
GEVKMBLJLEYT
ZOYZHKCGURGA
TVUMPLJCIOHO
IAITNMLQRE
VQKYEDCXVIVV
JEETAWTLWY
KJDPDGGOZXJ
JJAWXMKKML
OEYAGTPLUONJ
ATTJJYFJCTR
EMVNPHYXA
VIBABYDDNOBY
RSOBERUNW
NJTYYOMIJW
CCEXTQF
HOJSBXYZSBGH
MGJUJVMMUKIG
ACKMMGBWTD
KAMFAEPGBMZJ
UKNUCDZGP
BEWYZCQPFI
FJTJAIQMXWIK
AQIFTQZ
UBFMOXVWP
NSSDLPLUPIS
KHPJBZMCRPJ
PZZWWAKDVXEG
EXUQVVZD
XIIWNHPGWHWR
GTRZJIAMFXZT
DSXSJSRHBQA
AERYBOTUEHG
QLHDDNCWKVNF
JGEDPMODUQTQ
QIDTBGOGYIBW
MYLOHTCCVVS
YFQBVDPW
OZGMSKAS
JRRSSXJZXTT
JWKYHEPWB
PCPUBU
SHXISHNRUZJZ
ICADEWSCPZ
OVEFWZPGBJXF
MKJLEZMDGH
GHIFFWFYXJF
IYIEAKVVV
AWVEBKHMZDLM
RJAJHAOXWVZ
YMQZBIDFQCJH
HKICXEIMYBQA
FALPHGPEVA
VHOHXDPGRH
PNGCVDASJPT
VDWVMETUHSL
IVWQDMDYJNPK
ATOCEPVY
JHNXVSRDSBNM
TVJIWYPOLHIH
KMFKDTPZYPOZ
UMMGGKZFZUMN
THUIFENQN
QETSFAPYMYLL
GUOJXDJPYUA
FEUKZCFMIIF
AWPZPJBQJJSH
AHKQNVQGYX
HVXGVPVZJZL
ODZXNOMFEFNJ
ZYHEOBC
ZTXIHQENADAU
SRBSGTTNMBKC
MNAZWLNJZCPD
ZGNSTULAS
IMIEYTPB
LWNHHIYVGSOH
IBBVXUJYU
PJQNKCKDMSJI
DHIWUWQSBKED
WTNQIDVT
RXKVAPLXXSB
DXLZDQYQHLAG
EHISDDGJSBCA
JYBQTCDZG
FOZFFWCHHYP
ZYUCZGPVK
MSCOLHAPVL
SJAUZETNENZ
OQATJGCINUN
IXYDULNSRRDE
TIOGTPGBAQE
MRTNVRRJAMNA
GBQUGUYTFX
WTUNMRPXXPAC
EPCYZUNXEUNY
DTDMKOEIHVNF
VYGTWNYK
ODSAMUUCKYK
WEBERBDPMEK
GBHGFIFONYU
YFLGVKYXZUY
ESCJNBQTQFY
ESMWSEBYS
ZRTKYDBWODL
TRNOQEYQXB
QIZSXNOBIELY
PRIAEETKBS
JQKUXRONHQPW
ANVUYQUWIZO
ZBBGKQWHXNIL
PXBEWDXID
VQNIZOXI
LCCPLNZ
ABWLHYHNWXXY
RCYNGFVMW
WVPEHCADNPEF
MTTDQPTOASKA
WGIMWYNIQGT
WNIJRVSUIXWB
FEIEVVQK
JYQSCHXOLPG
XGMTGYTPTLH
CNOERLAIPUHL
HZRAHWISRXQ
WXQRPJZES
AGEUOHSTP
QZSQRFREBK
AMSMRGHWZLEF
QVPAJUD
TJVGOVAVMNRG
ZFWSKGIUARS
ECUTXDLQCYQM
ICAFKNY
QACETNBIHC
FGRTFO
DYFFLTEMI
OTDQTLEB
SDJBDFQFW
UORZVVQHLD
DKJEUANHQSD
BCKYEHTUUDB
PFVTRXEESNAG
TMTQHMZQYCT
HTZAKEUJ
VZTVLBXD
MCJKIFWWZWVI
ETAHHMPWZCFQ
SXPYKXZKVLCK
YQNIQUQXAZ
OHOIGFVCAT
CWCROVTMV
KPJNTDGLAQ
ZCDHPKYFTTYT
AXXSRCXMFOYF
FVWWLFTC
OERHHZQUINNH
HPATDMZNX
XYKNYMJIOOKN
BJTEWIGOU
LGZWBJ
TFCZHTEOPAG
PMYFXMCRFYF
FBAVEFUX
TLEGRRVB
TEEBLAX
SSIWQCAVEZ
IHBSHPDN
VIQMQWWHNUPF
CYUMMCMZUWTB
UZTRHYVASZJN
IWCUHGT
JASFWFPWLKW
EKJRESIAQVTO
LLJDAVFIKOOC
FKXCSEDC
PKTTEVBNKNBX
RZRSUOEPMP
SSSTEBGPM
GCZOUMVCOKBI
JRJJJVMNEPC
BYGXNDWNBCH
UAHCLGSOCJ
AJTQHAAJ
APHTVKRY
SUDFRJTJX
MKOFJBTG
WKUKPUUSQUYO
OWESKETDPB
OVQUPYQUNFPX
EPQKPGGGQFR
WMGFLMPOQIU
RWDLIQUZS
SKBAFXBYTIDW
QZVXFIQVE
ILATEGGDPVXY
IVOGGTXZFJGG
SKBZOHYTZKAC
maikati
JGMYVUNOFIL
JOIMGHTWZHB
CAVXLUHEOILV
MHYHEXVJQBCZ
azbest
ZCFAJCURKL
RAFGDNDPEXW
JHEZTZVPMR
KNZWBLJLENLB
GGDUNKTAEMUF
YVMJDIIMYTE
SDSZNPTZHXSN
TGKUHXBNJPH
CZTJPBQGC
KTJRROLREKJ
YRAAOQCLJA
ZZSMMYLBKMWF
QMUYLEIATO
GetExecutingAssembly
GetObject
get_Length
get_ASCII
GetBytes
get_CurrentDomain
get_EntryPoint
Invoke
NEGPQ.exeXXOF.exe
YSZESC
HCYCFLGEJBL
ABSRVAXL
SWWIEW
JDWGCSFG
LXYWJCNB
OUQKRXYNQAUH
JOBRYZ
GDQBJDNQHK
DUJEXMWCAU
BXIXKDELWDXD
EZIHAC
PXJLTZI
PWCMCVLWS
MTBRDIKMPN
YAVVTZ
PPOQEKTGTPE
XGUAPSSWQUXU
LYQNOYKJLDWP
TIXLYN
BPTWVCE
RZGFGNVKTGFK
ICXYQWMSZQJT
XAVKMA
KDJCVDTLWWG
SKKWKJH
CXULUKLNWZ
HTWVYW
PNCTZYNUDGK
IMIBKBRVL
ZRZSQIDYYBH
FUGSJK
AMKGMKBFU
HAEKPBAH
KRDZZYBFSAXX
OHDPTF
VDQHKVEE
GKNAPE
LKODID
CVFHCW
SZEMHOU
UKNJBIGZGG
KOTAJLLVO
CFZTBF
ZJWASSFJN
EMMESWGLNG
DIDGBEADMN
WIPHNJ
THDGVBLOEF
VCBLDRATHU
VMVXRV
ZQYJFW
FVBGKUHI
FKIICKS
BHVZTE
YDXOKZJ
XMDMIU
FTZHXHNXDMN
ZGERQC
TQSZHGEU
QDQKWBKJWADW
GPSWTV
GFLFTCQBH
QOJSMBINYG
ZNSJZOPFFFH
HCVJJP
OBGSKIQHDNO
WQQXDCG
RRVIKKRBE
QYTEKZ
VABFQX
JSBGXGZWTO
LTFFSC
QNMOPUN
FDZFUCORB
WYJVLJ
NQAMHRLY
ITVSRIXUKQGQ
SNUNWB
ZRFJTZDD
OGILTCZLSUN
NILNVG
TNKFZU
GSMXDCSFYY
UYYHSE
DORUYGSFOSV
ZLVOYV
UDNWBYBJPZ
HXIETYDGUKP
QTQXVKJHJIPC
QYMQFA
IOCODULAIBAC
PQVUSH
KYJSCRHYPEG
PQFWZT
IWENCJDURTCY
ACMVJQ
LBOLQLJOPUY
GGKPFMTMDN
BAAHOP
ERQATSNGPDN
TSYPBKRVHMMW
BAZUQN
HTVGUZSGV
OPDXYVFZP
HLQBMBVVBNNS
OCKQRM
UFYFZRZZQPF
IGDMLCQSRPF
PVEXNBSQRCEW
VXFNHO
RCGJGA
DAYRARBIZ
BTRQDKJZPEV
HNWOVX
FXZQPGYOGT
AVCZOOKS
SXBCFQJQPGEJ
FHZPTA
NUPIOPMVT
TVUHDLWPQXZ
LFQXTLYKUUEK
EZJZWS
KFDFWTUNSYMT
EAZPFLMEWFI
MMZWOSAS
CDOPAX
JELLNUKFTW
HLLCVKDQLBCE
IILYFZ
SGGOETH
JOPKGLQIT
QMEYMC
QKRKSUUMQZLS
CBQZZNSQHO
MRYFJL
VSBSEDI
RSJAHPG
EJJSIUABSC
NYUOSA
VUZQDLODAY
ODYDFIOEZQOW
MNZIFWRJRHCI
MACGAK
HAYCOFHS
JCWUZIJB
UCPSTLW
SCAROE
UKTFVJT
ZOMLHAUMFVS
YKAZVSLFNSBW
HDSPBH
BFHXEDXQFO
RGBDWFDGV
FAGPPP
COVRWEXUQAZW
XIACANLQTN
DLHRSNZWBCQH
HQZUKY
YZIHEYP
WDCLUWCA
SUTAQCQL
ATVUKW
UVZBNTBMNEAQ
XPTIHQ
XRASOJOZEK
CFMQLJ
MNQFSUG
DWHFACDC
HFXMQU
LGHWPN
TCTBHI
MCLSAYAYAK
DFTLMU
RREAPTFJEAMH
TPFWTRJFVT
KUTMHA
LXQCPA
IXCUEBRNAI
UZSALHPOANU
CDWVIB
GLGHYKBC
OOTGYOEXPH
ORBPNZTG
DNBKFA
KONTMSHQD
POTTKMZSP
JOBZMTUGWNFX
IXGHNU
CAFMCLJ
JWDWYXTYTRNP
IPWWBQURTDI
QCLCSZ
BSKZBME
TQDRUTUJR
KUFHLCOHZKTE
TRJUGC
USHJTMQF
FZDMWRRGJ
WQIOBIHPI
DEUFBX
FFGTPZIRQ
HSMCDVNOIER
CVTNYRXOGHHD
FCLZPJ
FCKMYZ
DIIEZKDM
RFVQXNO
DHQKSX
NICXAXHEZF
TGDQRBOYAKWA
XWBGRKHIZ
YEMFWN
TGYESBTR
XAHVMJU
RWJMQJTCXUF
KBVKDK
NSHSRTML
QCNFVXXK
KZKMHBCKJMZ
GYUQLO
JFWYGFRKPA
EXFMPEVI
ZJMKUD
SQUQBDUKU
FWUBYR
GPLZCJVYYQM
FSWSHA
XLGROSE
KUYJYXF
YHVWXSOHM
QXZRJZ
WPMTRFHQHMMY
QSEEWIOTJQZR
FPUPHAUFOGWJ
HKDQHD
YJIIBI
RGEDWIYWWEI
WYEURPDSSKEM
NBUCTR
GRHAMKHZWHM
KGONKHUEBS
URKWCBUIZ
JTVKZU
YGIPWMSEY
PBUFEHG
NWYDRUPAPXY
OCLNKG
DJVXXLJEIIFQ
OIQZLAD
DUOFYSQXOTF
KJCQAU
WOCGDW
EWIONPPM
APYRLMCDUOWA
FUSANS
XTFTDYW
MCPHHBV
KIJRKPAVPLEZ
GKOSDV
LFUAOITYIF
PPHHTVGZFFQL
GPHBLVDUPN
NTYORI
EMTLVKINZRH
LRDLHPFWQNZ
WHJRDB
VMYWVKRBTOM
MFKDGFAXAFBL
ZMMBHC
CNZVBIFMQNJN
GZOBTYJVBP
OHPXNUNMTNV
LUVSBP
VWXEVW
FBSUYOL
HCSNMX
EFADWN
EQUCFMIO
DELXPTCPXOKP
AXDCWP
WNQFSOZQXDW
HYGYOJ
QNRFATIAXKT
DHNESTDWU
CYVJZBKHXZG
DBUPDI
TJPIFHQ
DVSMRYQBK
KPGGQQRBIXH
AFTTKP
NSRODONXLJ
VTXTKGIB
DJPVKJMABTJ
HAGSOV
JLGZALDDFTLQ
PRGABGA
CZKMJSDKKK
IRMFYQ
DBCABTDS
TITKCBA
BTKBIGSHOTWG
FGYCOK
QRHCAVFB
WSVKMN
GIYLGCVQL
YPBYMTVUANDJ
BJVPVYDIZ
YJAZCK
EULCPSWDEN
MHVFAYMB
LTSXQGWLIIDG
AWRZEZ
VBQOCDXFHBTX
GGQEQSS
EKZHQXXV
NBQFWR
VCCJKSZTUE
HVBONRBREAZ
MXRIHJ
YLOSAUNMXMHW
HOIIMFZB
ZEWLYLGSWSCN
MCKSYY
ARVQYFSFQT
FBQDGKLCT
PIVWDHVJBR
DKDDYU
VGSABONISI
JLFWJAMHLJ
XSMADREEXK
INZORJ
ZGEGWDYZ
DKLCEELBLFN
AJHCVP
GJHOYD
MQEJUJAOBSV
UBUWUETBGRN
WQQRPR
AGJXWDBWA
MZKECGIUZWD
GBMBSI
URAJIXJYS
LUVCIIFASGL
BVWGTCXORGZ
VTKKXX
XYUOUTVBZ
JRZIYLKMCEX
MGJRBX
IDJVTSLBFOZE
BBBAUTEEUIS
WYXAERJHNRYY
UJUXZR
IZOZRSYZ
SUBNGMCMU
QSTGSERZE
VEFQKB
EIHVJNVSPG
EBHVEYGD
MIWMAUXMPMSU
TMAOCQ
MPUBUOJ
VQJXVHWBH
DEUJQPEFKZ
APPXKX
YUYCYWA
IPWPAHOTU
PKEPNWECN
OOKAXY
BIKFRHVRBU
OWQDPHKQDJMU
LXRQAH
ZOVFBVQYIFA
GYPEJKXGPUM
NJZVYBGSPSBA
DALWFL
KXZAJFIBR
TMQLLIKEPXI
QGEXBMIWRLV
MRQJYH
GZJAUBMI
WLDZISZFESOY
PICKOC
NHUFPNZYCHXT
MZPIFQ
VUNDQDLUNKU
NHYJJV
LAUVRF
POYQXAQUUXTD
ZDGNXH
YGKHZWVR
MXIFRXZYEXQG
XRQWKY
FUHJKUK
FDHKIGOROGMX
ZSYLYJLFSSPD
ATVNNO
QSJJUZFEOOMD
QGCBMSJHTUNY
ZNQNWI
MPXBGZC
BVFPZONERW
XGFXCKHJII
MWABVJ
CBWQLBZHC
JAETUX
VFOLJPPERDB
VCFSLF
HDROYAJPORXA
JABTCINOTTQJ
ZFYEZK
IDBRJFAC
VLIRTBYNYC
YZWRKALPP
EKXKBU
SMYNESKB
YUOALHU
FXBWLRLMXAF
YWPIPE
WCODAMAOJ
YMISRFVACJ
ROVGYYSY
AKNWUR
QQMFTTDNQALH
DSDUMA
MGZNHZVXUXCM
DUOCVY
YGUADUUQ
MWXEPKGTUZA
ENUHWMANKQWG
IQCVKM
MLKYAZUAP
QPAIYHQKQQD
WILSWE
MWCJSOTSJ
FVJODKMMTG
WPKCCKWEPHTJ
RNXSJF
NJGEGAEEQWQ
OOWMVVC
WKMTQLMYGIND
YTNEKK
USTTVKYSZD
SHYCDYDRTPF
FAHZXD
THRIAK
TDEUJJSGSUGH
FNSIKBCGBQLT
VIAXJV
RUBSBTXHIH
OIJLJUSUPYIG
KJNNBR
PIODENJK
FGUUEUCUJB
PLRMYICFQSZI
ACOLWT
FKHDULBYEK
WORJLDQBUN
UDOUZLYDMZLI
PZPKDX
YWGRQZO
LIEKMUA
ISUSAEHFCZWV
RVENTV
CHQYIPMRKP
DZQBKK
LTVXKVRZU
MTRCFIUF
NFWMDNZBHTUS
HCFSTM
BEKPSGVQRM
TPZOWHSNL
BFDSSPXLSQM
PBVGMX
KMBRJMWTHDQN
AENSDLDP
HTYLMA
QNEZGTDF
XUTIAMIMNUJS
DJOWCYIKHD
HDFNWD
AVXMZDB
PVRAPOJORG
WZMIPJPWKOGD
EWYPLN
LZXWAJ
YCZWBYSLXXI
FVTIJZ
LFIJALMSU
HKJOIH
IZTQXWQAWKU
SLGWYC
GUWWZOPBFUX
DOIYBZJAW
SMWSYQXWAJ
VFYBFC
ZBEVHW
HNMRUS
WZMDHPMRADW
GZJKXO
XOQFALYRH
YGDBNFVK
TFPLACW
XFBHOF
GAAUQAQSI
KOHCDSJVGX
CZPUNNCYF
RAIJNI
YIMQHXJTIDEN
XPKSOJXCJB
WLLZHYIYGDQZ
ZTUKLA
TGPKQGZZKBSA
ODTBZCLPXC
LTKKDYNXMZ
YHGYMF
IOWBFCJKPD
TKQVUT
MDRUFQPAXUR
ERPTVF
JLZYXQ
IRORTN
MJWNXCBDCRKJ
LNQZCT
UXKRTEXHKVL
DQNIQB
IYRYKLQPUWBU
TKVKDC
HLQWGVYKGLB
FAVMHXMLA
QZJLMRONSAUI
MJVRZK
CBRFDK
JQCOEKPYUGL
OIKRPCXGFE
OCVJIV
WXIQOX
DYCXZVQD
SZTIAR
FDJFSDQNP
MRGPZNAYIDX
JFWZVSTZDKVE
FVYRAK
WKAHSIFCGOUP
HTTIHDWRAZ
AKFQXHEFNFMU
BXEFMM
WPWRVESYKVGH
LIBJWBFW
HEZCREZKOOK
CVLJGB
JQLQYKWALXV
VOGZMMV
KZQDSXWNX
HUYAMP
TSNGFJIWF
ODCEWRZIKVB
OSXQSQ
CAJWES
MGWOYS
EPCILKOBGOT
CYHVPVSSMWOB
VEBEMY
LFDDAB
XMGVCV
WLNTDO
DUANMP
IXXQRGACIILZ
BZRKMIYKDU
SEBIPP
YYSPYTGEYE
FFGSQOBSNN
LFXUWBVGIAU
OOWEUL
QELDRXI
JFCWTA
VTUHFBWSL
BXXUMK
PDOFQUHU
GZIWZKZDMMAM
ZAUQUNJ
AZXRTT
HXDQVSYRTAUL
KPUQOT
BEGHZOPYBP
PDNCAN
SWRSLNIVQ
QZUMUYZYOMWO
KHHZISIHNLR
PHHGPJ
OLOEVSEPEJ
SPPWLJGZ
GSOLAL
SUCMAGQFF
NLKBFDVUJWEC
JCXZEXKZYCNI
GIVDEY
PLIGCOSQ
GYFBXJAGS
DTCFXWOCUMXR
TMMEDX
HBQFIB
URVAYOTTZ
DOSLQY
ZHLPPD
NNVCEIJ
RKVCDISCKB
DWXLZG
YJJYKNAILY
IDWJNYAYPQL
FIVOFJWGMEJW
CPCZHV
QMTYTMRQGDKH
OMGPRBK
VIQMTAH
NNXKMU
HTXSHQUEBLMA
EOWHTNX
LRQRLJYJZSWM
ZQFZIR
OWAYIEARJNBU
NPYOIAS
NVFQIGJ
YOJAIP
WSIKXYAXRILK
YWEQIBLTSN
HJLOJDNQP
NYBSIC
NKNHFA
UGQYAOFLXUW
NGTFDBW
UFHXJF
XPLOMWNPKLO
AWETFYVSL
QQQIODWM
TEQZNQ
PQYBTYZS
LOIHQORC
DYNCPOVNTG
CTZYVJ
KFJJYYNCU
ZQFKBTHOKEG
OKIELT
MFZRGJWVUZ
SIPCAI
RQVLRMYEGH
TOSKCL
DNBPZOTYAIFS
NZHDQP
FYHXWCRBQZR
VSTRTO
NNNWCC
IKFNAPRD
DUWNZAQJUTYD
CNURICBMXNUTVTBCNVMZUCXICMXTICONETNOINUNTIVRNERBMBZZBRVZIXBZINCCNBEROTTUIROTTTOBBVCMZXOZMEBNBCCXIZIRNROVVIZIO
VUEKFA
VEJVOBTEJWLU
QHXGTI
NJWEWCWMG
CTRSBE
UHNDKXNMILX
PBTOEI
APQEYRS
YZEAWFYSRKLR
ZYCPSL
HETULHWQJ
EIXNYICAYL
MAWAJJ
NYWFAOTADPE
OESRWNMW
UKIJNELUI
ZHRBUK
RUDDXIJRXP
GLKESERL
NIRPNUODGTWU
EDPCIF
TULLCGQFSFA
MVRUUHEZXW
JVWLDQKGOT
MHFXXI
KYAWINWMQG
OQPWCETQQY
JQBTTS
UFWWYHTC
UKXXRHKINOP
QGVYRJXISW
BSPMKC
NAOKHDDTFYFR
GBFLMDWAQY
HWVEAP
KEYBWY
LMRERDGW
EMSAXOQ
RQZMCF
TQPVDOS
SMAVLH
FRYKIQWFMIEE
EBYYKP
HDYNIFIJDTA
EHBLOX
RUUBNXYYGYM
JKYJDH
KWDGFANEYIIZ
QKCHGPQMJC
NMKWULRVJH
GBYOEY
PPBFFVMYSJFH
BDBLUCSUD
LWMHAZDNDEPM
VYASRF
NIJKCNLGV
QBKDLPIJA
QGNLAZBBV
SHZHPO
BPXWVNYOW
ZHVCPYDCSMWU
HEJPERKCT
OHZXMD
FWWXXT
EWOXAFARGCUM
IQJEPC
TSVPWWPWNE
PKNQDEKQW
LMIYAFFCOG
OKHAXU
DJEMJTYNOY
CPMAKG
TUTWIQEPLZ
KIVTPP
KKLHDYAKDM
CUJYPMZIUJ
AXCWLQXQVGGP
PUYFEI
HSKAABHACLSL
YWCYHSHXNGV
QNQZSVFWNFMO
YFDELA
KXSSHFBC
CMGZLHZ
USFRFVNBJOI
KGWRZQ
GSOOTDD
VXYXCLFYRDEC
SKYQTXQDC
MEXJQP
MKNVRVJLE
YQBYHYMQZXD
RTCCCFCXXQ
IWTCTL
HIESVM
XDRLPUAA
BXXXXJGCTU
VFGSKA
YOQLFHADBLX
BMTOGEABPRY
RBDDCJ
KJUNGMRTBB
SWDCIHICVJKD
OQZEFA
DTEWAJQVEBG
OECCGCVO
BMZPJXIDVJ
BRIQOV
HNVFTNQRHE
SSTDSLSVLQ
CKMLPNNJOYCQ
NOUMLB
SRCAMLZ
AQFOHYIVEINN
VFLUAVIA
UUAIVF
QSVBLC
JBLQFYM
ZISNXENPYZF
PLGQMO
NGRGRD
RJCMUAVY
mushmul
VXVXQKJY
CXTZJQ
HLZQYOPHVFOB
UKRAABIGRHK
QJBCJM
LWXINCFWXHCZ
AJEXMGBDSSFR
DLCAVGOFGB
SNWTUY
SVZALDP
CPSBPVVXZ
HEALBXPBXMP
HJKCRA
LYKCGUQOHQM
ADNBRV
IGAPVJCVESN
LFRRTGLOHF
DCDCKAFMCM
AJMCVP
CBIJQTTBXE
QJHQZZC
KZGCCV
OQZCMVTEU
LASYBBFRRQ
VLRHJMUINY
RXEMUF
VDTJLOZZYWHV
DLYGINLYCNGI
YQWQRQU
JSBBKS
ZIJHVKCK
NSABACJVK
shiban
<Module>
ZMZUUUROMBZCZMIIUNOBVXZZ
XVXMININNTMUCNTBENXTRUINRTTZCX
System
Assembly
System.Reflection
ResourceManager
System.Resources
Encoding
System.Text
AppDomain
MethodInfo
Object
MethodBase
UnverifiableCodeAttribute
System.Security
AssemblyDescriptionAttribute
AssemblyProductAttribute
AssemblyFileVersionAttribute
AssemblyTitleAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
CompilationRelaxationsAttribute
System.Runtime.CompilerServices
RuntimeCompatibilityAttribute
ComVisibleAttribute
System.Runtime.InteropServices
SecurityAction
System.Security.Permissions
SecurityPermissionAttribute
String
mscorlib
0.0.0.6
WrapNonExceptionThrows
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
_CorExeMain
mscoree.dll