Analysis

Category Package Started Completed Duration Options Log
FILE exe 2020-06-22 21:43:31 2020-06-22 21:45:00 89 seconds Show Options Show Log
procdump = yes
2020-05-13 09:11:23,485 [root] INFO: Date set to: 20200622T21:43:31, timeout set to: 200
2020-06-22 21:43:31,046 [root] DEBUG: Starting analyzer from: C:\tmp52sk_on6
2020-06-22 21:43:31,046 [root] DEBUG: Storing results at: C:\LKJujgx
2020-06-22 21:43:31,046 [root] DEBUG: Pipe server name: \\.\PIPE\KhdSqID
2020-06-22 21:43:31,046 [root] DEBUG: Python path: C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32
2020-06-22 21:43:31,046 [root] DEBUG: No analysis package specified, trying to detect it automagically.
2020-06-22 21:43:31,046 [root] INFO: Automatically selected analysis package "exe"
2020-06-22 21:43:31,046 [root] DEBUG: Trying to import analysis package "exe"...
2020-06-22 21:43:31,062 [root] DEBUG: Imported analysis package "exe".
2020-06-22 21:43:31,062 [root] DEBUG: Trying to initialize analysis package "exe"...
2020-06-22 21:43:31,062 [root] DEBUG: Initialized analysis package "exe".
2020-06-22 21:43:31,093 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.browser"...
2020-06-22 21:43:31,093 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser".
2020-06-22 21:43:31,093 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.curtain"...
2020-06-22 21:43:31,109 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain".
2020-06-22 21:43:31,109 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.digisig"...
2020-06-22 21:43:31,125 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig".
2020-06-22 21:43:31,125 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.disguise"...
2020-06-22 21:43:31,140 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise".
2020-06-22 21:43:31,140 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.human"...
2020-06-22 21:43:31,156 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human".
2020-06-22 21:43:31,156 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.procmon"...
2020-06-22 21:43:31,171 [root] DEBUG: Imported auxiliary module "modules.auxiliary.procmon".
2020-06-22 21:43:31,171 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.screenshots"...
2020-06-22 21:43:31,171 [modules.auxiliary.screenshots] DEBUG: Importing 'time'
2020-06-22 21:43:31,171 [modules.auxiliary.screenshots] DEBUG: Importing 'StringIO'
2020-06-22 21:43:31,171 [modules.auxiliary.screenshots] DEBUG: Importing 'Thread'
2020-06-22 21:43:31,171 [modules.auxiliary.screenshots] DEBUG: Importing 'Auxiliary'
2020-06-22 21:43:31,171 [modules.auxiliary.screenshots] DEBUG: Importing 'NetlogFile'
2020-06-22 21:43:31,171 [modules.auxiliary.screenshots] DEBUG: Importing 'Screenshot'
2020-06-22 21:43:31,171 [lib.api.screenshot] DEBUG: Importing 'math'
2020-06-22 21:43:31,171 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2020-06-22 21:43:31,437 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2020-06-22 21:43:31,453 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2020-06-22 21:43:31,453 [modules.auxiliary.screenshots] DEBUG: Imports OK
2020-06-22 21:43:31,453 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots".
2020-06-22 21:43:31,453 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.sysmon"...
2020-06-22 21:43:31,453 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon".
2020-06-22 21:43:31,468 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.usage"...
2020-06-22 21:43:31,468 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage".
2020-06-22 21:43:31,468 [root] DEBUG: Trying to initialize auxiliary module "Browser"...
2020-06-22 21:43:31,468 [root] DEBUG: Initialized auxiliary module "Browser".
2020-06-22 21:43:31,468 [root] DEBUG: Trying to start auxiliary module "Browser"...
2020-06-22 21:43:31,484 [root] DEBUG: Started auxiliary module Browser
2020-06-22 21:43:31,484 [root] DEBUG: Trying to initialize auxiliary module "Curtain"...
2020-06-22 21:43:31,484 [root] DEBUG: Initialized auxiliary module "Curtain".
2020-06-22 21:43:31,484 [root] DEBUG: Trying to start auxiliary module "Curtain"...
2020-06-22 21:43:31,484 [root] DEBUG: Started auxiliary module Curtain
2020-06-22 21:43:31,484 [root] DEBUG: Trying to initialize auxiliary module "DigiSig"...
2020-06-22 21:43:31,500 [root] DEBUG: Initialized auxiliary module "DigiSig".
2020-06-22 21:43:31,500 [root] DEBUG: Trying to start auxiliary module "DigiSig"...
2020-06-22 21:43:31,500 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature.
2020-06-22 21:43:31,718 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-06-22 21:43:31,718 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-06-22 21:43:31,734 [root] DEBUG: Started auxiliary module DigiSig
2020-06-22 21:43:31,734 [root] DEBUG: Trying to initialize auxiliary module "Disguise"...
2020-06-22 21:43:31,734 [root] DEBUG: Initialized auxiliary module "Disguise".
2020-06-22 21:43:31,734 [root] DEBUG: Trying to start auxiliary module "Disguise"...
2020-06-22 21:43:31,750 [root] DEBUG: Started auxiliary module Disguise
2020-06-22 21:43:31,750 [root] DEBUG: Trying to initialize auxiliary module "Human"...
2020-06-22 21:43:31,765 [root] DEBUG: Initialized auxiliary module "Human".
2020-06-22 21:43:31,765 [root] DEBUG: Trying to start auxiliary module "Human"...
2020-06-22 21:43:31,765 [root] DEBUG: Started auxiliary module Human
2020-06-22 21:43:31,781 [root] DEBUG: Trying to initialize auxiliary module "Procmon"...
2020-06-22 21:43:31,781 [root] DEBUG: Initialized auxiliary module "Procmon".
2020-06-22 21:43:31,781 [root] DEBUG: Trying to start auxiliary module "Procmon"...
2020-06-22 21:43:31,781 [root] DEBUG: Started auxiliary module Procmon
2020-06-22 21:43:31,781 [root] DEBUG: Trying to initialize auxiliary module "Screenshots"...
2020-06-22 21:43:31,781 [root] DEBUG: Initialized auxiliary module "Screenshots".
2020-06-22 21:43:31,781 [root] DEBUG: Trying to start auxiliary module "Screenshots"...
2020-06-22 21:43:31,781 [root] DEBUG: Started auxiliary module Screenshots
2020-06-22 21:43:31,781 [root] DEBUG: Trying to initialize auxiliary module "Sysmon"...
2020-06-22 21:43:31,796 [root] DEBUG: Initialized auxiliary module "Sysmon".
2020-06-22 21:43:31,796 [root] DEBUG: Trying to start auxiliary module "Sysmon"...
2020-06-22 21:43:31,796 [root] DEBUG: Started auxiliary module Sysmon
2020-06-22 21:43:31,796 [root] DEBUG: Trying to initialize auxiliary module "Usage"...
2020-06-22 21:43:31,796 [root] DEBUG: Initialized auxiliary module "Usage".
2020-06-22 21:43:31,796 [root] DEBUG: Trying to start auxiliary module "Usage"...
2020-06-22 21:43:31,796 [root] DEBUG: Started auxiliary module Usage
2020-06-22 21:43:31,796 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option
2020-06-22 21:43:31,796 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option
2020-06-22 21:43:31,796 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option
2020-06-22 21:43:31,796 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option
2020-06-22 21:43:31,843 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Rebecca\AppData\Local\Temp\Quotation.exe" with arguments "" with pid 5700
2020-06-22 21:43:31,843 [lib.api.process] INFO: Monitor config for process 5700: C:\tmp52sk_on6\dll\5700.ini
2020-06-22 21:43:31,843 [lib.api.process] INFO: Option 'procdump' with value 'yes' sent to monitor
2020-06-22 21:43:31,843 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\hfrOsA.dll, loader C:\tmp52sk_on6\bin\qrXBObb.exe
2020-06-22 21:43:31,890 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\KhdSqID.
2020-06-22 21:43:31,890 [root] DEBUG: Loader: Injecting process 5700 (thread 5708) with C:\tmp52sk_on6\dll\hfrOsA.dll.
2020-06-22 21:43:31,906 [root] DEBUG: Process image base: 0x00E50000
2020-06-22 21:43:31,906 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-22 21:43:31,906 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-22 21:43:31,906 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\hfrOsA.dll.
2020-06-22 21:43:31,906 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 5700
2020-06-22 21:43:33,906 [lib.api.process] INFO: Successfully resumed process with pid 5700
2020-06-22 21:43:33,984 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-22 21:43:33,984 [root] DEBUG: Process dumps disabled.
2020-06-22 21:43:33,984 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 5700 at 0x6a130000, image base 0xe50000, stack from 0x145000-0x150000
2020-06-22 21:43:34,000 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\"C:\Users\Rebecca\AppData\Local\Temp\Quotation.exe".
2020-06-22 21:43:34,015 [root] INFO: Loaded monitor into process with pid 5700
2020-06-22 21:43:34,015 [root] DEBUG: set_caller_info: Adding region at 0x00050000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-06-22 21:43:34,015 [root] DEBUG: set_caller_info: Adding region at 0x006B0000 to caller regions list (ntdll::RtlDispatchException).
2020-06-22 21:43:34,031 [root] DEBUG: DLL loaded at 0x756F0000: C:\Windows\system32\cryptbase (0xc000 bytes).
2020-06-22 21:43:34,046 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x6b0000
2020-06-22 21:43:34,046 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x006B0000 size 0x400000.
2020-06-22 21:43:34,046 [root] DEBUG: DumpPEsInRange: Scanning range 0x6b0000 - 0x6b1000.
2020-06-22 21:43:34,093 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\LKJujgx\CAPE\5700_7023972483423423262020 (size 0xffe)
2020-06-22 21:43:34,093 [root] DEBUG: DumpRegion: Dumped stack region from 0x006B0000, size 0x1000.
2020-06-22 21:43:34,093 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x00050000.
2020-06-22 21:43:34,109 [root] DEBUG: set_caller_info: Adding region at 0x004C0000 to caller regions list (kernel32::FindFirstFileExW).
2020-06-22 21:43:34,281 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\LKJujgx\CAPE\5700_6220258953423423262020 (size 0x100099)
2020-06-22 21:43:34,296 [root] DEBUG: DumpRegion: Dumped stack region from 0x004C0000, size 0x101000.
2020-06-22 21:43:34,296 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xbc amd local view 0x6BE30000 to global list.
2020-06-22 21:43:34,296 [root] DEBUG: DLL loaded at 0x6BE30000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-22 21:43:34,312 [root] DEBUG: DLL unloaded from 0x76970000.
2020-06-22 21:43:34,328 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd0 amd local view 0x005D0000 to global list.
2020-06-22 21:43:34,328 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xcc amd local view 0x005D0000 to global list.
2020-06-22 21:43:34,343 [root] DEBUG: DLL loaded at 0x74C70000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-22 21:43:34,343 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0FFB0000 for section view with handle 0xd0.
2020-06-22 21:43:34,343 [root] DEBUG: DLL loaded at 0x0FFB0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr (0x6ef000 bytes).
2020-06-22 21:43:34,359 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6E9E0000 for section view with handle 0xd0.
2020-06-22 21:43:34,359 [root] DEBUG: DLL loaded at 0x6E9E0000: C:\Windows\system32\MSVCR120_CLR0400 (0xf5000 bytes).
2020-06-22 21:43:34,375 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 5700, handle 0xf0.
2020-06-22 21:43:34,375 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf4 amd local view 0x002F0000 to global list.
2020-06-22 21:43:34,390 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf8 amd local view 0x00300000 to global list.
2020-06-22 21:43:34,390 [root] INFO: Disabling sleep skipping.
2020-06-22 21:43:34,390 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5700.
2020-06-22 21:43:34,390 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5700.
2020-06-22 21:43:34,406 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5700.
2020-06-22 21:43:34,406 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1f8 amd local view 0x05830000 to global list.
2020-06-22 21:43:34,437 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1fc amd local view 0x65E50000 to global list.
2020-06-22 21:43:34,437 [root] DEBUG: DLL loaded at 0x65E50000: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni (0x1393000 bytes).
2020-06-22 21:43:34,468 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x208 amd local view 0x68610000 to global list.
2020-06-22 21:43:34,468 [root] DEBUG: DLL loaded at 0x68610000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit (0x80000 bytes).
2020-06-22 21:43:34,468 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x204 amd local view 0x75CB0000 to global list.
2020-06-22 21:43:34,468 [root] DEBUG: DLL loaded at 0x75CB0000: C:\Windows\system32\OLEAUT32 (0x91000 bytes).
2020-06-22 21:43:34,484 [root] DEBUG: set_caller_info: Adding region at 0x005D0000 to caller regions list (ntdll::NtQueryPerformanceCounter).
2020-06-22 21:43:34,484 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x5dffff
2020-06-22 21:43:34,484 [root] DEBUG: DumpMemory: Nothing to dump at 0x005D0000!
2020-06-22 21:43:34,484 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x005D0000 size 0x10000.
2020-06-22 21:43:34,484 [root] DEBUG: DumpPEsInRange: Scanning range 0x5d0000 - 0x5d1000.
2020-06-22 21:43:34,484 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x5d0000-0x5d1000.
2020-06-22 21:43:34,515 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\LKJujgx\CAPE\5700_14460581245423423262020 (size 0x548)
2020-06-22 21:43:34,515 [root] DEBUG: DumpRegion: Dumped stack region from 0x005D0000, size 0x1000.
2020-06-22 21:43:34,531 [root] DEBUG: DLL unloaded from 0x00E50000.
2020-06-22 21:43:34,546 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x21c amd local view 0x02AE0000 to global list.
2020-06-22 21:43:34,562 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x224 amd local view 0x68520000 to global list.
2020-06-22 21:43:34,578 [root] DEBUG: DLL loaded at 0x68520000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader (0xe8000 bytes).
2020-06-22 21:43:34,765 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x230 amd local view 0x005F0000 to global list.
2020-06-22 21:44:02,375 [root] INFO: Process with pid 5700 has terminated
2020-06-22 21:44:07,984 [root] INFO: Process list is empty, terminating analysis.
2020-06-22 21:44:08,984 [root] INFO: Created shutdown mutex.
2020-06-22 21:44:09,984 [root] INFO: Shutting down package.
2020-06-22 21:44:09,984 [root] INFO: Stopping auxiliary modules.
2020-06-22 21:44:10,046 [lib.common.results] WARNING: File C:\LKJujgx\bin\procmon.xml doesn't exist anymore
2020-06-22 21:44:10,062 [root] INFO: Finishing auxiliary modules.
2020-06-22 21:44:10,062 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-06-22 21:44:10,078 [root] WARNING: Folder at path "C:\LKJujgx\debugger" does not exist, skip.
2020-06-22 21:44:10,078 [root] INFO: Analysis completed.

Machine

Name Label Manager Started On Shutdown On
win7_3 win7_3 KVM 2020-06-22 21:43:31 2020-06-22 21:45:00

File Details

File Name Quotation.exe
File Size 498688 bytes
File Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
PE timestamp 2020-06-22 18:37:12
MD5 11eeca4abfe5a57bb459ce5603ac83ac
SHA1 677b4ac15b78ffd701de55e95d810fd71f4d5e6f
SHA256 15f292d3edec1c064cbde19f7d0df8e891cfd3d61a3982f952b3d3d1d39d2755
SHA512 ae73a6503089081dc180cb281a2c2cfc29ef25d54152d30513fd968a4f30ab4f88ccdfc7fb2f68fb6b14aac3f21c2225c626b013aa9c20a30ae4f8f5f68f15f8
CRC32 B6831457
Ssdeep 12288:iDgC+36WOu4nIl9F0BLBly85xinjwhX/maM1tPrcBUrK/Zz:Tz1OuULeiMUhIWB+MZz
Download Download ZIP Resubmit sample

Signatures

SetUnhandledExceptionFilter detected (possible anti-debug)
Creates RWX memory
Guard pages use detected - possible anti-debugging.
Dynamic (imported) function loading detected
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: clr.dll/SetRuntimeInfo
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: clr.dll/_CorExeMain
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: MSCOREE.DLL/CreateConfigStream
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: KERNEL32.dll/GetNumaHighestNodeNumber
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/AddSIDToBoundaryDescriptor
DynamicLoader: KERNEL32.dll/CreateBoundaryDescriptorW
DynamicLoader: KERNEL32.dll/CreatePrivateNamespaceW
DynamicLoader: KERNEL32.dll/OpenPrivateNamespaceW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/DeleteBoundaryDescriptor
DynamicLoader: KERNEL32.dll/WerRegisterRuntimeExceptionModule
DynamicLoader: KERNEL32.dll/RaiseException
DynamicLoader: MSCOREE.DLL/
DynamicLoader: mscoreei.dll/
DynamicLoader: KERNELBASE.dll/SetSystemFileCacheSize
DynamicLoader: ntdll.dll/NtSetSystemInformation
DynamicLoader: KERNELBASE.dll/PrivIsDllSynchronizationHeld
DynamicLoader: KERNEL32.dll/AddDllDirectory
DynamicLoader: KERNEL32.dll/SortGetHandle
DynamicLoader: KERNEL32.dll/SortCloseHandle
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: clrjit.dll/sxsJitStartup
DynamicLoader: clrjit.dll/jitStartup
DynamicLoader: clrjit.dll/getJit
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/LocaleNameToLCID
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/LCIDToLocaleName
DynamicLoader: KERNEL32.dll/GetUserPreferredUILanguages
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: diasymreader.dll/DllGetClassObject
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegOpenKeyEx
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
Reads data out of its own binary image
self_read: process: Quotation.exe, pid: 5700, offset: 0x00000000, length: 0x00001000
self_read: process: Quotation.exe, pid: 5700, offset: 0x000080c2, length: 0x00000200
CAPE extracted potentially suspicious content
Quotation.exe: Unpacked Shellcode
Quotation.exe: Unpacked Shellcode
Quotation.exe: Unpacked Shellcode
Queries or connects to DNS-Over-HTTPS/DNS-Over-TLS domain or IP address
ip: 1.1.1.1
The binary likely contains encrypted or compressed data.
section: name: .text, entropy: 6.94, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00079600, virtual_size: 0x00079474
Authenticode signature is invalid
authenticode error: No signature found. SignTool Error File not valid C\Users\Rebecca\AppData\Local\Temp\Quotation.exe
Anomalous .NET characteristics
anomalous_version: Assembly version is set to 0
Network activity detected but not expressed in API logs

Screenshots


Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 1.1.1.1 [VT] Australia

DNS

No domains contacted.


Summary

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Rebecca\AppData\Local\Temp\Quotation.exe.config
C:\Users\Rebecca\AppData\Local\Temp\Quotation.exe
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-2.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSVCR120_CLR0400.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\System32\api-ms-win-core-quirks-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll.aux
C:\Users
C:\Users\Rebecca
C:\Users\Rebecca\AppData
C:\Users\Rebecca\AppData\Local
C:\Users\Rebecca\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\HSIVBnwpJwlikJMjma\*
C:\Users\Rebecca\AppData\Local\Temp\Quotation.INI
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll
C:\Users\Rebecca\AppData\Local\Temp\Quotation.PDB
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Rebecca\AppData\Local\Temp\Quotation.exe.config
C:\Users\Rebecca\AppData\Local\Temp\Quotation.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Standards\v4.0.30319
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v4.0.30319\SKUs\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SKUs\default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Quotation.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\NGen\Policy\v4.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Servicing
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\FeatureSIMD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_CLASSES_ROOT\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AppContext
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\FeatureSIMD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default)
advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.SetDefaultDllDirectories
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
kernel32.dll.AcquireSRWLockExclusive
kernel32.dll.ReleaseSRWLockExclusive
advapi32.dll.EventRegister
advapi32.dll.EventSetInformation
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
clr.dll.SetRuntimeInfo
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationW
clr.dll._CorExeMain
mscoree.dll.CreateConfigStream
mscoreei.dll.CreateConfigStream
kernel32.dll.GetNumaHighestNodeNumber
kernel32.dll.GetSystemWindowsDirectoryW
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddSIDToBoundaryDescriptor
kernel32.dll.CreateBoundaryDescriptorW
kernel32.dll.CreatePrivateNamespaceW
kernel32.dll.OpenPrivateNamespaceW
kernel32.dll.DeleteBoundaryDescriptor
kernel32.dll.WerRegisterRuntimeExceptionModule
kernel32.dll.RaiseException
mscoree.dll.#24
mscoreei.dll.#24
ntdll.dll.NtSetSystemInformation
kernel32.dll.AddDllDirectory
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
clrjit.dll.sxsJitStartup
clrjit.dll.getJit
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
kernel32.dll.LocaleNameToLCID
kernel32.dll.LCIDToLocaleName
kernel32.dll.GetUserPreferredUILanguages
diasymreader.dll.DllGetClassObject

PE Information

Image Base Entry Point Reported Checksum Actual Checksum Minimum OS Version Compile Time Import Hash
0x00400000 0x0047b46e 0x00083b74 0x00083b74 4.0 2020-06-22 18:37:12 f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name RAW Address Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
.text 0x00000200 0x00002000 0x00079474 0x00079600 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 6.94
.rsrc 0x00079800 0x0007c000 0x00000010 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 0.02
.reloc 0x00079a00 0x0007e000 0x0000000c 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0.10

Imports


Assembly Information

Name HSIVBnwpJwlikJMjma
Version 0.0.0.0

Assembly References

Name Version
mscorlib 4.0.0.0
System.Core 4.0.0.0
System.Memory 4.0.1.0
System 4.0.0.0

Custom Attributes

Type Name Value
TypeDef [mscorlib]System.Reflection.DefaultMemberAttribute It
TypeDef [mscorlib]System.Reflection.DefaultMemberAttribute It
TypeDef [mscorlib]System.Reflection.DefaultMemberAttribute It
TypeDef [mscorlib]System.Reflection.DefaultMemberAttribute It
TypeDef [mscorlib]System.Reflection.DefaultMemberAttribute It
TypeDef [mscorlib]System.Reflection.DefaultMemberAttribute It
TypeDef [mscorlib]System.Reflection.DefaultMemberAttribute It

Type References

Assembly Type Name
mscorlib System.Func`2
mscorlib System.Object
mscorlib System.Reflection.Assembly
mscorlib System.Reflection.MethodInfo
mscorlib System.Threading.ThreadStart
mscorlib System.Threading.Thread
mscorlib System.String
mscorlib System.AppDomain
mscorlib System.Type
mscorlib System.RuntimeTypeHandle
mscorlib System.Int32
mscorlib System.Reflection.MethodBase
mscorlib System.Math
mscorlib System.Reflection.MemberInfo
mscorlib System.Runtime.CompilerServices.CompilerGeneratedAttribute
mscorlib System.IO.Stream
mscorlib System.IO.BinaryReader
mscorlib System.IDisposable
mscorlib System.Text.Encoding
mscorlib System.Byte
mscorlib System.CrossAppDomainDelegate
mscorlib System.Attribute
mscorlib System.ArgumentNullException
mscorlib System.Collections.Generic.IEnumerable`1
mscorlib System.Collections.IEnumerable
mscorlib System.Collections.Generic.Dictionary`2
mscorlib System.Collections.Generic.List`1
System.Core System.Collections.Generic.HashSet`1
mscorlib System.Collections.Generic.List`1/Enumerator
System.Memory System.ReadOnlySpan`1
System.Memory System.ReadOnlySpan`1/Enumerator
mscorlib System.Collections.Generic.Dictionary`2/Enumerator
mscorlib System.Collections.Generic.KeyValuePair`2
mscorlib System.Runtime.InteropServices.InAttribute
mscorlib System.Collections.Generic.Dictionary`2/KeyCollection
mscorlib System.Collections.Generic.Dictionary`2/ValueCollection
mscorlib System.Collections.Generic.Dictionary`2/ValueCollection/Enumerator
mscorlib System.Collections.Generic.IEnumerator`1
mscorlib System.Collections.IEnumerator
mscorlib System.Func`3
System.Core System.Linq.Enumerable
mscorlib System.MulticastDelegate
mscorlib System.IAsyncResult
mscorlib System.AsyncCallback
mscorlib System.Globalization.CultureInfo
mscorlib System.StringComparer
mscorlib System.Nullable`1
mscorlib System.Collections.Generic.IEqualityComparer`1
mscorlib System.StringComparison
System.Memory System.MemoryExtensions
mscorlib System.Enum
mscorlib System.FlagsAttribute
System System.Text.RegularExpressions.Regex
mscorlib System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1
mscorlib System.Threading.Tasks.Task`1
mscorlib System.Runtime.CompilerServices.AsyncStateMachineAttribute
mscorlib System.Runtime.CompilerServices.AsyncTaskMethodBuilder
mscorlib System.Threading.Tasks.Task
mscorlib System.IO.FileStream
mscorlib System.Globalization.CultureNotFoundException
mscorlib System.ArgumentException
System System.Text.RegularExpressions.Match
System System.Text.RegularExpressions.GroupCollection
mscorlib System.Text.StringBuilder
System System.Text.RegularExpressions.Group
System System.Text.RegularExpressions.Capture
mscorlib System.Predicate`1
mscorlib System.NotSupportedException
mscorlib System.Char
System System.Text.RegularExpressions.RegexOptions
mscorlib System.Runtime.CompilerServices.RuntimeHelpers
mscorlib System.Array
mscorlib System.RuntimeFieldHandle
mscorlib System.ValueType
mscorlib System.Runtime.CompilerServices.IAsyncStateMachine
mscorlib System.Runtime.CompilerServices.ConfiguredTaskAwaitable
mscorlib System.Runtime.CompilerServices.ConfiguredTaskAwaitable/ConfiguredTaskAwaiter
mscorlib System.Exception
mscorlib System.Diagnostics.DebuggerHiddenAttribute
mscorlib System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1
mscorlib System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1/ConfiguredTaskAwaiter
mscorlib System.IEquatable`1
System System.Text.RegularExpressions.CaptureCollection
mscorlib System.InvalidOperationException
mscorlib System.Boolean
mscorlib System.Text.Decoder
mscorlib System.Text.UnicodeEncoding
mscorlib System.Text.UTF32Encoding
System.Memory System.Span`1
mscorlib System.Buffer
mscorlib System.IComparable`1
mscorlib System.IFormatProvider
mscorlib System.Runtime.CompilerServices.ExtensionAttribute
mscorlib System.Runtime.CompilerServices.IteratorStateMachineAttribute
mscorlib System.Environment
mscorlib System.ArgumentOutOfRangeException
mscorlib System.Reflection.DefaultMemberAttribute
mscorlib System.Collections.Generic.IReadOnlyDictionary`2
mscorlib System.Collections.Generic.IReadOnlyCollection`1
mscorlib System.IO.StreamReader
mscorlib System.IO.TextReader
mscorlib System.Collections.Generic.IList`1
mscorlib System.Collections.Generic.ICollection`1
mscorlib System.Collections.Generic.EqualityComparer`1
mscorlib System.Globalization.TextInfo
mscorlib System.Comparison`1
mscorlib System.IO.Path
mscorlib System.IO.Directory
mscorlib System.IO.SearchOption
mscorlib System.ObsoleteAttribute
mscorlib System.Collections.Generic.IReadOnlyList`1
mscorlib System.Globalization.CompareInfo
mscorlib System.IO.FileMode
mscorlib System.IO.FileAccess
mscorlib System.IO.FileShare
mscorlib System.IO.FileOptions
System.Memory System.Buffers.IMemoryOwner`1
System.Memory System.Memory`1
System.Memory System.Buffers.MemoryPool`1
System.Memory System.Runtime.InteropServices.MemoryMarshal
mscorlib System.Globalization.NumberFormatInfo
mscorlib System.Globalization.NumberStyles
mscorlib System.Threading.Volatile
mscorlib System.Threading.Interlocked
mscorlib System.StringSplitOptions
mscorlib System.Diagnostics.DebuggableAttribute
mscorlib System.Diagnostics.DebuggableAttribute/DebuggingModes
mscorlib System.Runtime.CompilerServices.CompilationRelaxationsAttribute
mscorlib System.Runtime.CompilerServices.RuntimeCompatibilityAttribute

!This program cannot be run in DOS mode.
.text
`.rsrc
@.reloc
l.#+n
u.A+b
svp9o
r-mhc
4ekr
nli& <O9
j`]r%r(
gPcoG
ejcoB
<1Ms~
`zY:U
l*`0U
kpfrm
*9Kt|3
m"n*f
l:./f
2xd'f
3~.,f
.n e*
a?e f
'h$e-
T$r-f
i8g8f
m3m8f
c8i'f
0l7s-
CF:wyP
fHFPsy
F?<uy
l$~7K
\,J*l~
9UtO3
u>c-f
o5e8f
A.2l-
3A.2f
m3m(f
T>r.f
e8F"f
r9c.f
w;r#f
l?z.f
@2xd-
KjnhL
Vp$Ak
Lp'Fx
`*h0S
A-3se
xpi(4
Kp|oV
|*p0T
sp~9K
\*Ir2
Lp`9x
\*P0n
spZr6
HpP(j
kpd9H
r,Hr4
t$d7H
kpd9H
m&Dr{
xpB9s
HpP9j
y,S(T
xpB9s
Vpc9k
HpP9j
y,S(T
xpB9s
Vpc9k
sp~9K
kpd9H
r,!sY
HpP[j
j*24V
!lhzs
pgoerIm
cXnVog _e5rwn
iI }Ok ~oYe;
8`=rNrv
rBlVc8
<*W=a
jA^'/|
1qVl/
0f\SN`
i{r9/;
;PAY*J
b\DKI
]}ar/
f{`l&]
H7.UEE
^Z}56v
iXP|M
ETk'B
t_1~}F
y$fzL
f r%V0]{
y4r!j
b;aMk,
ZVvej
}S940
\6u82
ZMt;P
ou6"+
7at9D
eCKP-q]r
%A'dL
9(^e/'
I0A,]Q
~_FGtWGgn=
9{Wid
KtdRI
IhK36
MfB"A
t#(a2
SbM]u?L
mE"`-
jZMjGu
<,P~i'k
"Toyr
6v|X`
/pjn5
`!D-Q>C
}DNYN
/O}:RF<
ahT+8
+;dl<9[
T^ZL-&,I
Z?W{M
oSI;H
Ze"c;>
@qy(}
H<HCj
*K+"8[>
EyA29
HiKYt)
Pm=vm
hq>3'
5v{#*7(
w|!`"
<g u0
0;U*N
|>T-ec
$DPak
Vp<_\
!R]4I(
dV0i9Nm7
r47Z6
>bs6b
b%LNn
1=C5W
)[+v4
t(OxD
^sh_P
=m^)&.
.0P1tq
A5{v-h
wEF\p$
EF=Db
Iy4{
#euQ:@
tCqj0?n
X1MFp
^wMKJ
1G-xG
Xjg/f
zk&~<
^g,'@
o1>\z'|n
%B2 +
a~\>Q#"p
X[?_Z
GIn|^
1j3;Y
!g4>h<3
xG3jv
LOVaR
AE^K^
3BSMWr}
.?# 5
l~8?,
Zv]hH"
aUyrV6v
H~U{;
Jmy%+
\k.;;<
%?K{uS
}=xH=
V9'~H
#@{~]
=|@=~
rW^%pd0
D;mK5
wI?6S
|5;,<
ypaZH
TgVQ"
F](-R
|]d.Q
Ldz4n
Sx}ylB
[dK{8
+l{Rz
2X~R0
6T(BE5c
#;CVP$(
9|\(J
%ts;3
+h)Qf1q
tbi[Y
jbab!
"@}SY
~HsP;
p=Qy|;
R]um|
2W!QV
:]tV4(
LiL>#_
:~ONa}
fZyLv
X.[%)\F
)q<s$
fF!A!
Hq'$W
;clvA
yHC]V
&7+eq_v
KFZnr
@t(8
2B"\?
pE0P'
Miq655'
VVb*%
mSAsD
6Fc[B
YW%kGq
tbfJY(
[A\9})
{m >AN
d3FIw
@-WX$
uS%w,
M=]ch
p?PR
LYStG
FE9iS]
c >zR
p?LJr
gKaMpi
@}5R=
uO :U
'd%EM
YaB+'
DOZ/$
1do%{@e
UrSF
,-Qw}
O45,m-
e>"t_
DV1Yi
]?3?;
R*}!I
I3,IH[
oO:=0
&U*E?
mx$KM
jAD-A<
q*CZM
R.N^9
]cJ7s
WD~.x
dCBFi
Lg4mW
?Fk^@
:'p$)
_")S5
q}xT6p
K/i:n
^>u&bJ(
#4V+9c
< 9T]
bTORT
Vgx]yR
)~?&j
"Sr<^8
]G]e]
njsp%"
{/JjD
g)']1
*)ess}Bb
_#N}6r
.jG_Oa+
x4k z
dVg+Uc
h,g{*
Bmlz=
Hk?3[
/2,ud
FaAEQL
lT_=P
m}b-~
8e1!e\
#J6Wk
Lw#<g
gEa[V
RJhM~Q
9T<T|Z
v<K8bv
mr$n"
RE;O2
0%uSs
&P?`10
}=Gr|
+xQ*@
-aIYH
eoq&
$Og->p
GU%A5
un?cK
7uH N
IC?aR
!g<a}
JP!/
d9k?V
i|tHK
67l Z
"VJ`D
b;]S[]
:C~vFB
dV/7Q
'cuIw
O.$%'t
E4nN)
b4/#^
G,9N_
j>7Fh
edrbcqS
v&V'3U
mOXs*
R,i*LJ
)QR*?
*'Zj#
@\PY`
vcOcPV.
*sk(=
>Xc#n^
j|O*#nr
{jd&9
2"rMGw-
= uZJ
|Pr8q
5wB. 8p
{EjI8c
"Gr +j
8dJ}s
efa:w
#**0>
wb~**0>
c YEk
?{Gr8
KQQZ"@
$ir Z
Z5>2Q!a
} \
~~yX e
Ly&I8
295a:
UIZ"H
( ncB
DCSI
8 UrF
"wZ"1
c o78z\8J
= -!|
( I> hb
fZ3#=
' 7x>
#**0<
1"5{a-}
h Z3^*Q
c_;:g
|WO H9
$8|- Z
$jm8M
[~HI8
'XDr;
M"NXuAa
ZtZ3bt
8 =JI
*^ra+
8Ynv>
#**0=
<**0;
-**0=
9 eYF?g |jPAI8
c tn7
W? m3bDI%
' +-m`I H
#vr Xi
CLX I
9 "m&z
0O ]>
R!a-n
?b w1Z>t8
' (|p
8p|~=
X wnyZX8
U} _=
Z3/mT
8p;T=
uYbd
b Ei7
)UXc
} LvjDr8
5q*Na
;mWF8
Z"y]l
W~Yb
-**0<
= :b[!
$/' G}!NI m
BZ3{(
@#F8v
8%;O=
"9*Y8
8%;O=
$/' UZ[
(- rB
5/8 u
+/9 1
'pV~8
'pV~8
Q0t8_
>)C`c b
en]c8
VGF8V
C} wX
&E Nq
N]=PR
3n5dd q
Cvy\8H
(pH~9
/_!?a
c Krbn\8r
q~"a:
L&a+R
3*?*8
1AI q4
j9%X
? g!=
Z)}Z"
5w^tR8
(^bz9
"M[F=Z
c a=G
} =$x
8#yp:
gg Qa
8p;?=
'p/(}
O :G=>F8`
' wn=
f{iF8
'p/(}
'p/(}
bmO w
<"Lg
4lar
~ Y8v
Z"nPJ
5"FP5Z
y0X} &
5fAb
[6p"a
u F_&
} s}5Nr8O
JaC &g+JI%
5(G!&
Ua 1g
&g+JI%
8_>o#
[#I )[
=z9ka+x
)jI S
)I nM/4c8
} <~j
mNUa+
ZNvmZ3.y_
9_*/=
!/ea:
#**0<
)FMF8q
, ''=
{&Z5p;
, '0=
> S*9
# 9%<
(pHw8
" 'B:
D3AZ3
Z"#G;
VINa6
\)} M
8%;O=
K/aX%
8p;?=
Z5/b7
- y8;
1 97;
6yr8Z
Pg %
Lc1 )
II}t8
' ,~~TI
>*R4=
tsW{"v
X *<M
0-pX
6h0Z"VZf.a
:S} &<
( 7w!Ib
fO @<8
KII X
8 \Q/eO
+-9 )
do>Ea
|SPZ"C
O7_a:d
5BTwAZ
+!3qX
+#3]s
g Ij20I8
A?Xc `
N4I8\
&-' <
?*?*R4=
*\^F%
sri5
- 9T;
TT^a'
T<vbZ
TT^a'
UO kZ?
p$ ji
I iz`
8%;O=
9 c&v
$KI8N
1 SH>
\e.I8
. 9G;
' D~c
Z"GWX
> 'I:
yQ/8#
5"v~O8
=MDMX%
MKMF%
8%;O=
5 0l<
7_=RR
! yb;
7*=RR
8%;O=
" 'a:
( ga:
}r<+
_5} K=
:!{I8
9X;
2 SX>
8p|~=
u:-&a+W
' @I9
2 S[>
e*uZ3
, gn:
. 'm:
b$Tb
knDX8
}O Qw
mZ5j?
]sS<a-
(rp *b
+r ~:L
Jx5,Z
$Ca+K
= p2D
])|\Z
?*?*RL=
&X0Z33
4 tHS
- gg:
x7I8w
tYI8W
B10b
0TO D
- 'l:
' 80tRI 1
8^V(=
>q-F8V
9p.(V
7B[a+
vI -:
]aWI
2$qc8
U} aB
( `3o
[j-i
wCIZ"#o
b <a~
"#69:8J
$$V,Z
XAWa-
cP<wI%
2Q66X 55
" 'y:
`b +rb
(p1(|
8 l[LpO )@nOF8
'p5 <
<yb\8^
FXZ5#
=]/;"
( TQslb
dbr F2
<I TN
8 k2[S5
,GFc
8%;O=
Y\FX Z
0!Z58]G
X `96'X8q
,^g
1*>*RL=
2H+v
X wPW
\X L/m
8^V'=
c 7y[
Z3o^77a:
' 1^e
X 1y)lX8U
]L(b
/Aot8
= ;"g;r
mO .z
Z5$q8!a
8p|~=
}B&F8F
|)O `;q
!*>*8
&R*a0
5)8 *
4"(".
msZ3k7
5)8 !
UEZ"5_
(')'|
"VZ"w
$)' J
)( *_
5)8 7
w?F8w
4&(&.
4&(&.
5)8 ?
(A} B
XAMz
Z5vlZMa
).I8W
G :5k
3Mqh:8,
tZ5 ]
ZZ3=K#Ca:h
9 |?Ljg p
0?m%a+
Z32[.Ma:
w+-I
-'a:j
W6%I
p'r 1
8vrWZ5
]\yc8g
U&a-z
qw5&
o#6~
2'Rc8
=h5g z
&x"UZ
oPI Ud
q8ea-G
=g @'
hk_Z3
Nda:5
v'O 6^
g >gx_I8
).Q a-
.*"0=
8^V0=
d8b6a
&"-"M
Z".BoYa
= b0L
(^b)9
; O5i
CcZ5}
w^r w^
# c %_+D
De8X8_
80V59
P}I8,
#**0;
#**0;
|-fY%
D1(r
GS$Y8
D$0K8
qc $<
( '>N
mO <J
A:Z37r7
) 9 ,
5 8 b
DO *D
( EY
k} 5YG
8%;O=
[E\8<
+ 9
]I)PZ
Or #j
Q'I 3rDSc8
XJg W
8 b)]
L"[} '
QI\8
8%;O=
hM\8?
hZ5X'
8_Z_:{7
T*3Z"
OeQc
kr S}^
>jJ6:
g CE*5I8
1jT6;
"XnHYZ
GqY8Z
C;~b
1jT6;
nJr "V
(^b69
(!d8D
fj[6%
"Wf4 Z
CZ3%u
1j-6<
6 t%IN
dFC0Z5
6Ha->
:*vJa6
fjGX&
8p;?=
HKc8*
<Z3<|
M<a-z
!n.jg
Yqg :
w{FZ3[\
$YI80
'pV29
<{6Ra+
f~!r u
3)p4^Z"
b B<aet8
5%#duZ
V&7Xa+
*,Y8[
)R-a:I
O #l.rF8
*P\9=
:P|z<
C,bc
*P\8=
Z5SlC
Z5`C:
*:*TL
g T?:{I8
U>sDX
-**0>
V'Ja+
-**0?
2aDK<
Y6X8Q
|b B~
\anK9
**0>
rhr @
/ iK=
?Rl8i
C-{`X TB
!n1o[
3KyBX(
)G7d
4ZLa+
-Cvr
c ~Gu{\86
EEc!}
XMJX8\
b -fn
r!iI ?[
0;527
6GWIl
6BnoJ
> q !
c"t"/
`*z*5
B0*!t
,1Z&*
#1K&=
v91!)
v L m Q
!`!g!R!g!
>MGdRl\>8
c[t|r=
mNczrniJ
qaUu]TjpX
FyqtMm'c9z8n
.KtHr9h8m
OJjBcM
S\rBaT
ky`tXm;IM
Fn9aA
rc=n}
{f(yQ
@x8yv
Qp'cL
Do9cS
pr=cy
aq(cC
Ww8ny
Ft'yR
Fg9aK
rp=z{
cq(aS
Xf8zb
Fc'nL
]s9zA
il=zv
xu(zP
Cj8cg
]r'uU
Dx9c_
fh=ux
Lt8uq
]x'u\
XiarGsHfM.ni`u\lWaqiK
fpIlQcrtTo{BcsM
jiZrWs|fI.CiquIleaJi[.RpMl|cctAoIS\rNipeN
CGmWuMeJ
^i^rzsmf\.qiJuYlQaNiv.Fe^iDeJ
mbCzmru\eUO[j]cgPOocifeZ
J_xpHOqjXcaPpo^iCeK
U_FsXrZbheKtwrVvQdvr=Ufep
E_jyneZSvrKiveqOJjBcMPJoeiYeg
ee\_doTpMtvr=gpt]AXpKiZaLi|n=gpt]U[eU
^eL_De_SprtiKeT
Nj8w|
@w'hT
Qd8hq
Oe9hK
P_AhpeIdttXtQcEaQup
ee\_`eMIVsgaScp
jp(aIh9zPp
zuj(zPo9zOk
zul(zPq9zOd
zub(zPf9zOv
zue(zPg9zOs
zoj(zJo9zUk
zol(zJq9zUd
zob(zJf9zUv
zoe(zJg9MMtvx=SlsveE.shKeYdznZ
~eLLrsII{pwtanAo9uKea3
@yNtpm,DZaPiWg8I~aZeVofeKIIfV
ky`tXm;Dpa_iIg
IUatiSg
IoaOeaoKmYt
aaf(aDv9a[x
aag(aRh9aMr
EQaesgdmvBnMAJg`
nyftgm
TNm\rK
aLNsM`
@yNtpm,CGlKeZtQo}s
GpngrAc'aSf8a|d=adb
leKeMe~i
e=kprleD3
RevMGdRl\FQlvN\mpA
aJv'a[x8aqe=awg
MGvBFPl]EkW=aws
aJp'a_v8aux=asp
a^x'aOe8aes=acp
aMg'a\s8avp=gpt]C`
TeM_{H
WTt}EteFtTVXlMe
zld(gBtfkZH|oV
fev_CbooVk8z}[email protected]
zFv'SMrQntBHiydgr(S^sMeU.GeEt
iIdVwlekt=z{x
zFe'zWg8z}[email protected]_eSgah
eaWVPrLurlvel
xn`mRrGcBsJMWdflXs
pqaXi
dUl8zjo=zlk
zQr'[email protected]=GptOoLuKe
iTe]aPePx
zQv'G\toi}dRwAhpeIdwrVc]s`IY
TeIKpy`oIrCLXyWug
Hspr12(z^s9zAp
TRU{iaoLebx9z[u
zaw(zDm9z[j
zak(zDr9z[l
zwk(zRd9zMf
zjj(S^sMeU.DiSdzwq.noUmJ
sejs=z}o
DbjiBe
dJT|mg
_q'EWuU
eaQup_]
gpBrXtQntSDsaeoNImB
irWcvsNogNcmM
fmVuVt\fpexopy(wC
Rg8k`
mafsuoZd'g\tgPrsNwzrfHIsO
^eL_CaNsbopd(sBtfPYs`wRrq
TaDuB
Nt8wq
Er'm\
Hl9oI
|d=oe
ir(kK
\g'TQr]aw
xxpNcmM
Ud9rL
ff(tW
waLieeji{dmw(fW
Ox8bu
neaCniXbHaKdnivwXr
Jx'CQaVgvCQiebmaZddhXiV
qe=br
`s(SBn]M]s`aZe
Nv'fA
aYdJCjaFgBd9oZj
rXmzvg_khFn^e\
ug=ff
UnLPUoZ
ue`s\gp
DiFaKiCe8vv
Mwl\iDaJt|e
eZaae
AapgMtjeMhWd
BXg|nKn^oLe9Iysjn^Rpswl\
[eId\r8DvlXgttgCIlKbXcS
WeQeraveis^nZSLage=E{dKn^oLe9D]lvg\tpAqyFcueJuTt
ISvzkg
Ps'aCg8ais=W]_IEqBhAkDgL_
uCJAATaOi
nMgKVYyOBN
We_lE`Uh
DMbSLSIEqDhWw
oMLSdS^E[Ux
iIdVwKH|oVEm
@s9gH
PaQl[ezt`oHk|x8sc
hn}omk
iIdVwKH|oVEm
Fd]_sejDRw{
peEoQefK]yWoJn
afdwKBylp8rvmRvp_IeQUW
^g'vRCWdv
NctnAoLe'fUa_s
fwmxSrXIVf|
LNK`FxEaT}NWEy
YLIHn_nNsE{TVD=LYKJFwAkT}OoN
LqK]F]Ux
Qp9K]y
nkoCe9whaaaP
yPcrIm'zSs8z
s=zyp
zYd'zHt8zbb=z
zGr'zVs8zxr=z~s
zCp'zKl8zaq=zgx
zZe'zUt8z
b=zdf
zYv'zHg8zwx=zae
Ml5'[email protected]~.nevupi\y
CKyHt|gOaeh{
rev_}sBrwaUe
sXtJUqeZNFm\
_eg_hRY
qe\_rRu
rzwqeZ
TeM_zr|wNeg
zIIex1
iatBm
QIgeP3
zte(zQg9LQsg`
QAnE#4
wCq'nLf8nfe=n}m
nEe'nTg8nyf=n
nGd'nVt8n|b=nzx
nCd'nKe8nbe=GptRrAvFt\PJouiQeFtpiFg'nHg8nbs=ndp
nLt'n]b8nwf=nqv
nLx'n]e8ngf=nmg
yKk'yZt8ype=y`w
y]r'yLb8yfg=y}j
yBv'yVt8y|b=yzf
yGv'yVx8yxl=y~f
yDx'yUe8ybd=yqf
yLv'y]s8yux=yse
yNg'yOs8y`p=c`b
[email protected]'cQt8c{p=cbm
c_j'cNd8cdt=cbb
c_x'cTt8cyd=czq
cGd'cVs8cab=cde
cNv'cAs8u{r=ubo
u_k'uNg8uds=uxb
uBd'uVq8uxl=u~q
uZq'uKd8uae=udg
uYs'u]e8uqg=usp
u^x'u\p8uts=hbk
h_r'hNd8hdt=hbx
hBb'hKx8hae=hgg
hYg'hHs8hbp=hqt
hLb'h]x8hwe=hqg
hLp'h_g8hus=hmg
hPs'hAp8w~d=wxt
wBo'wSk8wyl=w
wGk'wVt8w|b=wzf
nKs'DPcLi|n\rl`0
XoxiDlF
ioKtqoE
AhwnLeUbPr\
@e\MznieQ
alVcS
Ql\c~HcwC
dy[eJF|x=KXeneGn'IZe{ag
mayeOoGn'IZe|rrgRn
WctMraoA
]VMrTiVn8_XeDs
Kgy~aKu\PYia`
rev_~eUsPoV
`eI_CepsAoI
^eL_XeDs
sgtwKByJ
esaxe
w^e'wOg8wes=wcp
wPe'w\p8wts=wfp
mBo'mSr8myl=m
mBk'S\qMe}cX
\nveOeU
{iLSgrTnr
Mc\eSSMrQnt
OJjBcMI\e}tTf|ep
fTApv
bLpneh\
xo[j]cgs=_Qava(gBtfTApv
Nea_VyXe'g\tgLvnZha
qe\_keWgPt
gXtJo`jMcSs9s]tLo_jpcvs(gBtfDYtr
Nea_Fa\a'mVl8mxt=m~b
mCf'mRv8mxx=jyp
mCe'mRg8mat=mgb
mZf'mKe8mag=myq
mDd'mUt8m
v=myx
mDe'mUg8m
s=mqt
mLb'mOp8mke=mpp
mOs'm^p8jxx=j~e
jCg'jHd8jbt=jdb
jYf'jHv8jwx=jqe
jLg'j]s8jgs=jap
jJf'j[v8jeg=jcs
oaMlgOMe{VcuDt'vXuTtplT.qln
~aRlMCTo`eka`lv
EaHlaFpeM
ka`lvEFuJeKaLeEaHlas
jOs'j^p8j`p=o~r
VIuKt|nMmvr\tpIveEs'oRl8oxq=o~d
oCt'oRb8VruQtRevI\eJ
FnYesileL
eoVl]a}
nhzrv
rnJi_nvdtna
Fo]bKe9SLrznZ
li~enttmr
xrHt\cLewAOrty
A\tUi[uLe
Pe[oRrZe8IweSt|t{
iuSh\nLipaIog
waZkYgvSTd
Arp{tFrM
ypcESd
jdp(SDh\mYIw
MsoCpeLeItPaTFaiXnql{NImB
IR]s|uOcpEneEeIt9pqdvnIiayGlMmBnM
HAftUe{tkcItHr|l]mvnI
_aNtXofiNiBd9dOF
duPZoWeKtQe`CRu{t
pxrHp\rLyVlXmpnvs(jQx9jNe
S^hpmcEDeJeWtqd
kfg(kCs9k\p
kvf(kSv9kLx
ont(oKx9oTe
osg(oVs9o\t
off(oCs9o\p
odx(kUq9kJd
knv(kKx9kTe
knp(kVd9kIx
kff(bFs\NYmv
gou_Ad'cVnLe}t=ogp
i\eJ_MyHe
iIex_laEe'aJtYb
ebntmg
ZoHtfnMm
sLlJsva\eJeWt8rbd=rdt
GMtqoUuUeZn[ogmctAoIA9rIb
rsv(rVx9rIe
rss(rVp9r\t
rvf(rSp9rZf
r`x(rEp9r^v
rtp(r_e9kNe
kve(SFf\HYnwlX
FyqtMm
RLnLi~e
I{tgrGpteKvQcvs=gpt]I[IIvXlQd
RXlpaqe`aIdUe8kgg=kas
k\p'R\gwpvnvelEz
idQaIi
k`v(kEx9kZe
k`s(RBgzlWsvKXy
k`p(kAv9R]gBuXrlVcl]ebx9k^x
kdg(kAs9k^p
bgs(rTp9EVc|dXUAF:
noUc\D]f
aIi{g
b^x'bOe8beg=bcs
b^p'bAe8bkg=F|lgAKcBsJ
bnZo\i}g=ldd
lYt'lHb8lbe=ldg
lYs'lHp8lwf=lqv
lLx'l]p8lgb=laf
l\v'lMg8lgs=lap
lJf'l[v8lqe=lwg
lJs'l[p8luv=lme
DItBTPm]
{tHr\
|eul\tp
jeMhWd
FTlpncmMIIZPp8FzlXS|zg
koJpKeKsvdnioe
HMaCeKO^f`eI
SinegfAs\t8HvaYegSkzM
^oYisyViEe'CVmUe}t=rrs
fPe'EkRwRLShCVEQS(BdR`Pl_CAy_ESQ
jCuYiTgPRDbOTER
jCuYiTgKVYbDTTC_jLhBfMyGZC=BVR[P|_hBsE{TLLxNRTJ
jCuYiTgC[AtNJMMDm_`Ct
zCAYmTJAWT`_sA~_tE]GiH
BARqPs_zHyI]IsGJMMDm
eCkYhTLKxYJDCTi_eLvB8BPRdPA_CE{_fL~OjIGHp
XS]PzIjImInELPoOCIFEz
eCkYhTLAhT]_OOlExCqAqNLC|LYS]FdA`
{CjYCTbI[IV_iUsHfMwDV_tNSO]VmRtIvN8SGAiUF_CU|HxTxGgMZSpAACJ
{CJyctrppnClOoUiMhUPaoKiqep
JcUyIt
l=fms
fPp'f\g8fvs=fpp
Bkr^pMCTo`e|lropi\hJPKoNiweO
QCOyetEe\PUoIeJtj
zCayMtFevPZoWeKtA
jCUyItqmcoOt^e{
tzly(a]nZ
Yz}u=BVr{p\DBsMrWyXeD
tzlh(a]nN
zCayMtPnarQpS
czFo'aCnS
FzWq8ainY
tzlt(a]n[
Yz}f=BVr{p\DBcKyHt
czFx'aCn]
FzWp8aiy^
tz{u(a]yQ
Yzjw=bpp
p[zfl^I\
pbnayt
bOs'I}iKp|s\bye
d_IIfVV]r`iRn
p`NGnDe9cZN|n^e
p`A]tODXtY
pb|uahFa\a'p[TYg
c_Ttg
pJMFczoVtvxI
c_ATD
cJDFtX
fts(dPMPnte}gIh
duMIxkeWgLh
dJI{cpeEeIt9fNp
p_Ltbgl(cELXb]l
tz{k(a]yK
Yzjl=aoys
IzDm9aBcy
czKs'aCcH
FzLt8aiu_
tzwf(a]hN
Yz{m=aoht
IzOx9aBhv
cz_j'aCwW
uuSZoKTAFubFxC|XqBrqVDUOFTiN9GMiwAItgi`u\e'CVmHi
aIiznPeDa_aMiWn`AItgi`u\e'[email protected]~.ou{tkmM.doTpQlvrnegvkcMs'RLnLi~e~oxpctAbNlPtAAgtOiwuve(GBn\rYtvd~oqeCt\rNbLt]
@yNtpm,CGdBDVm
C|mMiyep
mdNtVrzr|wNawlgA\tUi[uLe
SDsaeo.koJpVn]ngMRdpl
ELiSoKBJods\byeQtItB
}eZutgXr]ifdMnftMrQbftX
FyqtMm
DPa_n|sIivs
HAdBMVdMlvN\mpAvtZiEuMe8SgaSdtrfMGdRl\ALtai_uae
MAcUoJo^t=VTs`anBIsNc
CWmciQegSgr^iDeJ
pvelwmrLAStKiZuge=SlsveE.doTpWnvnIMzdgl
DBsPgV
^yzrzurCGlKeZtQo}AItgi`u\e'CVmni`i_lpAvtZiEuMe8C|mMiyepGMnBrXt]dRtIr|bwtM
[email protected]\t|cCt\rNbLt]
Rc^efsgd|hUoLgPPaoMegt{A\tUi[uLe
SiAAhpeIdftMrQbftX
Slcg[AStKiZuge=DpfcuDtqaUu]AgtOiwuve(SRpIr]s`USmtncgMddo]ekepuOiayCt\rNbLt]
@yNtpm,SMcRrPtA
AeQitbklAt^CVnLrrcIAatpiJuSe9SAsgeP.GultAmB.zoVsgr\i{efEPeDuMiWn
CRnfiqtMnDy9C]r
P\rtmCrZa^AMtJiquIe
UKn\3
kuVtzmXHplreZs'IWiLirlTzpAprIy'AKrYy
RHnaioeniBl]HYnwlX
rev_}Ta89G][email protected]{g
B]fAeK
zl|cVCzp{
jySe9AKsvm_ll
Qy[tBm
e^t|ol
oeSEAe[ugiSgTsqeEbKy9G]tPaQl|neA[sBm[lA
AiWnqagl(CUeXt]
@yPmptpiKAKgVrQt{m=spt]KMy's\tgIE
tCgyrtGTUaWs^oam=TgalsNoUm
BQovk
ggtwLBn^tP
Mcx(WUiMe8Gvtrb
eat~aKu\
}qfaQs
Ggt`aThzo\e
GXtAyrenrHmqaVd
e=R`nviEesyIepa}dQe
TmS\rNn^
ycgiKaaop
krBaMeqn`t\nve
SDeBp9PJopeNs
EzcMpSiVn8RvgTsar{KMy'MPcJo`o[t;Wkn
2'TPm]r
SDsaeoIFfHrTaLi|n=gpt]CGmWuMeJNrmX
VolcIt'EWvQr|nPe{t
GMtbnOiJo}mXnaVcrAaEl\
lhae\dFtcr\
TeM_qsQa^krrmuFd'SMaJt
IStprcc\iHn9SPe
l=AepUiFSSyUe8OceOaaops([email protected]{g
gMtxLVcYtzoS
}xzsIs
CpeItBDPr]cgoOy
DkrMcSoKyqnuo=F|lg
xaSh9G]tUuQlEavh(GBtirWcvsNef
ee\_jaPnuowuQe
PpoKeTsto\u
e=gpt]FAlBNXm]
PpoBeDt}aLa
SXtErmjMcSEKrWr
CQetrRrGjBcMEJr|r=DplgtM
doIy8Svt|tarkb]tBs9FQlvAItgi`u\eT
ke_i`tOy
CwrZeItls]r
OMe{Swbce^
jeLVrlHe
Cno[e'CVnNeasTo{s
TGIIt\g]r
sXtJIltMrQaU
Keg_xntbneL
so{oWlvaS
TprlAcFtPoV
Plcp[eCEOeVt[aSdyep
IdC_|lYp`eY
Be`CDiBnM
ky`tXm;Ngt(GBtmeUpCaIh
DmwFlHa]FQlv
M\ntggmMnSO[j]cgSXagcjeZ
jaWa_e~eStZbheKt'MXnYgvmXnaO`jMcSCVlTeptTo{
[email protected]\bWevtGn]mBrXtWr
gXtJOQF]lKNXm]
RevEFuJeKaLoa
poceLePt'g\tgCfrOe{t
MInFg\m]ngB\spO`jMcS
~eLPaoMegt{VIlRe9g]tLTRttlRhQsNcXlue~oOy
UKn\6
zoVvvrNizn
VIl'CVnNeat=TzDmuJlB
koMnw
zeaCwrZeItirWcvsN
rev_xrHc\sKNrmX
rev_ad'G\thr|cXsfeqBQNFm\
egIPareGnKoCeKs8gvtbFzroa\Ic
^eL_TuTd
or_mqRaUiLy
RXgpx
SQsSeT.lekt
RpgwlIrbxIr]s`iRnf
QpDiS
keYdRlQBltgs(THBXs]6'SIr|ne
zeWlXc]
teI_[ou
orFpQi[s
ESczdgr(EIcVd]rCaOaxeveZ
bnZo\eaP\rtmgtMrT
{iLmrp=S|zg
zeDtXn_lv
mo|nv
OeS_jcJevn=SvrgeF
@eM_zofnYs
ggtwWNdMh8gvtbHpieh\
vuXlQtj
ioTrpaQ
doIy~r|mncgegn(FUoTIUate=Ixaee(SFv\
Keg_mofiviGn'g\tgJceZ
rev_xaUaT
uaasUay
QiRehf9g]tLTTc~CmuFt'MVnQt|r=E{tgr(E_iM
jerd|lyTgx\
}spaMeQava{tUiWg8AcpXnqAnl|e_t9S]reeOCzmru\eU
^eL_Zn[o
doWcYtvn\tpO`jMcS
zoVtriSs
DglMtBVXlMe
FIpBe`RMqReJt8Wvboedugs\
ieMwWrxCOeqeltAaK
JeL_PrXdpnviIlT
pCJeweSt|ans(NBwuaLeQiSd|ne
daSezaTl
GXtWyve[
ioYolg(sBtfCWngeStYelg\h'G\tjebuXsaSvrMaJ
pnL3!
qaaeQe\CHmIl]x
CayMtzSgr^iDeirWvzdXr
IAoDlBcMiWns1=gpt]CGuIt9LYtvISdpxEe\
jo]OZjvcI
Fu`tZaDtvbRept=gpt]I\eJ
JeL_ZtXm
TmGMnBrPchaaaPeaep
liQi]ewbye^t
VoopIrBO[j]cgLXsf
Lo\OEj\cL
PoSd|tkoFaKCVmHaaerb
eatorBaMeJ
ZESuxepa\oU
jyKtvm
CzlneKtNoWs8E}uPegavoZ
`eMFWlweOPttj
{pBcPaTF|lYeg
AoEbNn\
tE{uoeZaEl\
ydwR\nre
ImnRm\rYb
ArpMnCLPn]
CneIr'STtHC
Qy[tBm
N]t=M\iy
OaAlfd]r]s`
pa|lOe[sFg\
ytga^hxelt(CHnMeVtGyMe
S{s\eJ.weL.^iPe
ggtwAStXcPmvnIs
AvtIcOm\nLC|lQevtkoF
doUl]cgiRnu1
SQsSeT.{o
lXcaimn[.hbSe[t^oYey
QeFd's\tgI`BRdlHvmD
TeM_zowy=spt]PGrS
JeL_[oNt
sgtwEIa[l]S`l=spt]U[ece_aMlgCOeqeltAaKs9I{rvdXnaicl[B^HVsL
teI_VoltMnSDPsHo`iIizn
CGnSeWt|i`pRs|tkoF
TeM_~i
esaxe
sMtxM\dQaGyMe
sgtwNFm\
Keg_nuwjgc\
koZaTMrcUi{e
DMlBt\SMbXeD
RXg|svrQPUoAy8MzcOofodt
VNsLaTBrsTc;M{SMrQiZeK
AeZiftpy~aKu\KQnw
Zea_GxMcRtXbTeCaIh
ggtwMNlUiKepoSd
otMpoeqRXq`eqt(WBbkeKp|nNe
SvrMaJR\a\ea
Nea_WsMrfg\nL
`eI_^egpilNv\
Keg_iixemu\
TeM_yl
oJA`tmRMdNr\cL
@eOv|cgPGiIttaVateO
fev_{eDuKiLyCrRtzcml(SBcLrQtjPOoaoaoDT^p\
{rvdXnaiclkaDh\
_eg_yesawl\CUe]eVtzaQs
sgtwMFxPmMmRuIoxaviKRBdPr]cgiRnf
Ee\RBsIoVsv
zeaRgsXoIs\SLrvaP
Gecd|obn]
~lfsU
rev_klNp[oYrw
GXtAezt(GBtirWcvsNBlIf
anSPMr8gvtbHtnflM
ee\_daIa[igy=F|lgVMrTiVnqnuo=GptTeZsNoWIVf|
Zea_RrGdRcMNYmv
ioYoueZ
solpHea
Zea_IeQbHaKd8Kvy_otrf
OeS_xlLKvyyobn
gMtxCXpKL|cV
rev_{hNfMK]yWoJn
ggtwCSrUK]yWoJn
EIcVdQnt
pD CpyXtHS\rNipemrzvkdMr'HXsPA
gRr|tjm(CHmIuLe[aNh
TpiXlBD|S{rjpIoFepvAcBPKoNiweO
ArkpDecEj
Keg_maqdknO
wa]dQntMRdp
qe\_jo]e8CzpUegMmdM
dr\aLeVn^rlpvoZ
arVmza`e
4FtpiFg'N\w
uzd=DgiteanAo9G]tWrTvps
gMtxIJR]awy=gpt]NImB
^eL_WrTvpT{pM
crPv]TjpX
RevFAlBs9EVd`WTt}
Ee\DNr\cLoaiXs
FklMS^sMeUI}fR
fev_itSrPbMtvs=gpt]TGtFl
DiDenn_o8GvtxxaelsAoI
zr]agerb
eat(GBt
iTe]aPeBivhGuSEAt]n`iRn
WeQerave(RBmVv]
PrXaaeRaZaJs9CJertXHtnflM
@eM_ust
Zea_UPIrFm9g]tLLmagao
reUo9G]tGyMe
Pvr|ottKu[tfrX
RevMGdRl\s8M|dHlp
Ee\HnNjTyNPE=TzIlt
2'oI_qnvqHayivy(GBtkaVd|m{iyeLaEe'G\t|iae^tzr{NImB
reAC|lQevtkoF
`eMFQlvN\mp
Oa\cO
taLc{eN
rev_orHuIs8GaoHpVonlMcSiVn8GaoHp
Ccp\uUe9g]tLV\l`e
MInFg\m]ngCQafs
EEpSy9G]tZnNttnae[
@eM_hr|pXraigs(PUoIeJtjD\ttCmlDeDtPoV
CrRpprvylaSa9G]t\bWevt
AXpBn]
egP\rpnv
OeS_iaJe}t=gpt]F]lKNXm]
_eg_yesawl\
gMtxSLc[e`s=PgoveKtBd}aLa
USpgoveKt'DXtYPaoIevtkoFSDoIe8FzeQd\ndo(gBtfOkVvrNizn
VMrTiVn8C|nYiaimnIldoTpYrvO_jpcvGZeFt\r}qfaQ
VoldAtNoWaTC|mMageMbBeDtwoLEbu\l
TmIFt
49CWngaTnfKgy(gBtfSQzv
zeaVcl]e'G\t~ivlY
GecdanS3
jerdtna14
kepuOiayKdMnSi_i]r
SDsaeo.{eDuKiLy=POi{ckpIl'R\a\I}tmtg
RtZTHSMrQntUSi
SgaZcOOItQo}
zeaSwbce^NXm]s
TOixEld(VFlLe{o
lXcaimn(RBa]ATl_iSef
ee\_qaUu]s
RTj{dceDMFnXg]d
R[c'8;8leUiOezygeN
Yave{eS
|s[ace=gpt]S\aUtpn^o
POoveqs{tFrMIVf|
Nea_UiFdHwjtAlv
mrzcgs[WNn]oOSgyQe
sgtwAUgLm]ngs=spt]CZeFt\NWWznYob
ee\_ttXn\aadruapwt(sBtfR]dzrXcaSvaFdFr]OMtcuI
fev_}sBSQeTlVxXc`tg
oJEkiI
PntiZoI
jtJi}gN
VoopIrBM\tPow
anttK
loQyIe
S{s\eJ.amT
KmQDzcwmMnS
amTN|dXL|sv
pmKNVd]
ggtwCOiUdvoweN
rev_atBmvf8X~lxlpmgn\
@eM_qn}eOTpxv
OeS_lnQc|dX
GeqiRe'A]dwbye^t
Ule[cFp\DYtrSIr|ne
noUmXt8gvtbC}aps(IId\xwf
TRC}apAZrFy9IVf|rPaaimn(UeoLn\
UiQeFyqtMm'DPr8FzlXAatpiJuSe9CPrD
ntgilg{pKiMOHtzoSs
XmrgbMeZt8T|CUag
PaFdHm9CWnwiIiznclkoJpXr]OqjXcaLgs[
doWdQtzoSayCmmXaUevbReptxq`an
niKejtJerm=F|lgMGdB
DlGoU
pnQtzaQioe
DMcHd\r8Gvt~htrq
oeSCQaJC|uSt
GgtleDo]eJ
QiICznteZtBr9TWI}t
ggtwEIdvfktae\m
RgaLLNn\
haasX
FtpiFgdoTpYrzsRn
BknIr^R\a\ea
rppnPeId'g\tgBrsXSargaE
toKt8gvtbAFCKI(TUiT
jeeeOsp
CpXeId
oJmrt=C`lvuZenn_o8SjsIex.ElGbFlPzYtzoS
rev_anQaKiYngCHlaupe(NRm[eJSgyQef
KFGrJaMPJoeiYeg
[email protected]@eOv|cgPZoQi]eJ
[M|CFHC1(CHmIaJe\bWevtLo\EVuXl8A}drb
eat(CHmIaJe\bWevtGq]aK
zoUprrXOwjgc\GUeXt]r
OOOwjgc\
ceZiUa
QuJtUaZt8MflIiel{
|orIWt
gXtJBkgmnCiXnmnzcRdp
AoEpFr\
loFISt$6
U\iKs9CWpjAOrty
TGUkoWg8I}t
LVrAm'CVmHaaeio
Hgx(CUeXt]PaoWevtGrZoU
^eL_UiQeFyqtMm'FPl]SjsIexPpoPy'hXn\lv
zeaElcGdNn^
_eg_~a{SgeC
nnOaTiwOMegaviGnbxZeHtzoS
\ntaDiCDXtYEkcXpaimn(GBtuaKtDrTtpTkmM
ciKe[t|rDSppcrItHrzhYr
L\saIldMxhf9g]tLPRs|tkoF
solIVt 2=SptArMaSiVnli~e=SptNa[tprPt]TzmX
rev_kaIWKiLe
DXfyave{tUeXm8SjsIex.KO
CHmIr]s`iRn
CmmXrBsJiWn^oYe
te\kwrzgTn
Mkn(GBtmeUpUiQe[aoe(MHv\
kegLXnrtj
OeS_je[o}d=gpt]MAnRt\
_eg_uo`r
gMtxDXy8gvtbMznvh(gBtfY]aa
oetdWIFt
29R]awUtna14
ilKoZH
l|b\l
FpeMH`lVbYl
COyetmgZaWhPc}xpeMt|ol
t(.'B9C8r
O(p'e9n8A
r(i't9h8m
v(i'd9e8r
f(a'i9l8e
i(t'h9 8s
u(s' 9c8o
{(0'}9
B9C8r
.(B'C9r8y
e(t'P9r8o
t(y'(9)8
t( 's9i8z
f(a'i9l8e
i(t'h9 8s
u(s' 9c8o
{(0'}9
:U5T+Y$
l(o'g9i8n
1(2'39485
9(A'B9C8D
H(I'J9K8L
P(Q'R9S8T
X(Y'Z9a8b
f(g'h9i8j
n(o'p9q8r
v(w'x9y8z
e#-6dIe
ct846
.WaaMNznGxKeWtPoVT{rRwf
^yiexpna\e 8
CVmHugeO
&M^.xpHlzc\t|ol
>MA.FsXr
4Qy[tBm
W]b=SXrciae[.wrVtWc|lN.Focp`tSpzlQe}tmrztmcGl5CKeYtv_bI{svaFcB_f
|i`pRsp_]IFsSaWc]_L
!k[HWox
5%= 8
5)> :
:9591
5|+|-
:|, 9
bCzrGxMMFiW
UspoOep.flD
:S Br
4D0]3f3z9k
PS"r"n
PB:o)
V)n;p
J>jxr"v
rbe0exP
r7mKA
p%r-M9I$
'h$e*d*c/e;sxP
ssE8t9y;o%n<
P9i%t
bsS/s?e
t%c)s
;r#t-c
K)r&e
c"S.c
mxS.c
r%t1.9c
r?t2D
s/r!p
4e"P9o
i<t'rxT
i8a?e;r#c-s
K3r%e
O.j-c
8e8P:o
s e5u9i
rVT.r
i"a<e,h
dVO;e
T$r-a
C#r9e
mxD"a
n#s<i
o5e8skC o;e0a
eVS2s
r?n,B
i d-rxG
t&s3r
eLG-t5o
eLF!n
P>o+A
sVG.t-i e
t3sKr
l3W"nkR)g!s
c'D-f
ssp?dKP
o/e;s=x
sVd.c
y%t.mER)f$e
b yHg
o#r(e41LV!r
l2l:o(
o#l,e
R3s$u
s9u9c
tss"a9t>R
r8R-gxI
n8i%gkD)l-t
?n8tkG)t
u8E0t
nVM*i
U5EjG6T
THS=T5C<N
I6F%R>A
Y'I$F<R
I$NLS
T'T"R6A
M(E8S<N
T'I'P6R
NHS!N)H!O
D9R._!I
A;C/S
R=A>E,P
E8SLP
O;E9S,C
E9DjP!O
H9N.L6
U=R3_:N
(R%C6S
I5I>E7_
N>O8M2T
S+_9E'_
C=S9_ U
U5EjP!O
I6A>EsP
_7P/R2T
S+_<M,R
S+_<M,W
LHW*I>E,D
CKW9I
O/N/RsP
L'A)C6S
o'eHI9s
R3s>l
)e+i&I
eVs.c
r%t1I
a"i$nkp
y7e%c9i
t#rHS
S3r=i
i4u?ekn
o5e8s#a"d$exM
s*t8r!b
&n;a%a
e(T1p
o5e8sku
x!t;o
esI8A?t
i.u<exd
e2A(c
eLd?T
c)s;A
csf:a,skh
hLl8M
e9o$n yHh5o
eVp9o
e(u:e6a
esl&F"l
a8hHr
hVn*m
-r/sxU
m&r.s
t)sHa
A2d9e
sLd?S
a8i'n,y
esf:P9o
e/tHi
tsi8s?a
l-t!o
tLm-t
a"aKc
l b)c
u:tKS
s8e%.*u
p%l-r+e
c3sKC
m<i$a
n!e:a3a
i#n;A
u"eKR
n8i%e;o
t?b"l
t5A<t
I=B"w8J
k9M<.9i
lsg3t
s/r-t
9e!o>e9c
4e8e9i
A/lHg
u8tKG
1e?_"dLg-t'P
eLS<r
6q#a'skP>o+e
l)c<i
a(sHS
c8i'n
n'y(o l-c
n1a%eKI.n9m-r
rsG3t
m)r)t
e"tHP
dLM'v
o?a*l
/l I%p
t$i)u
eLa,v
3A.2l'
)y8eHS
n)n<M
lsW?nx2.x/e8t
e$n.lX2bd$lxG
u>i<y<e
i&t$rkg)t
L3n,t
e>n-lK2Dd
lVu8e
3~.,l
r9s$f
i%t9ykR)g!s
yVL$c
K)yHG
eLG-t,y
esR#n?i
y8e0a
eVG.t?y<e
d:eKo
ysT9S?r
dLI&tK2jC
n e9tkI"t~4xJ
i%s"o
C$e+kxC
t3S>b e5
eVP9o
i$e6a
ess3t
g9m-n
o5e8s<i"d'w+t
%e?_<i"d'w+t
%e?_(r)a<e6o=i
d9wKs
oVS?a
I;p'e
e"t)t
t7i'sU{
6=EY7^D
1z-_1
0e9;4(-C3e6y8\F|B~1
p?l.r,e"e:a
t$i)u
eLV)l
a8i+A
y:n?t
i2eE8[9D
h#dxxN0Z0C17-z
9u"t!m
e$sKA
r-yHR
H-n,l
t?a'i
P"rKZ
o;ykD)l-g
4e"D.l
g-t-F
c"i$n;o%n<e
b-lHE
n;e%tkS<e+i
d3rKG
hVC$n
M9d>l
+e<_5a
n>o2u'ekg)t
rLS8l
a i<yxE
t)sHS
n?f.s
R)s'u
)i"a:y*e
rVg.t4L)n/t
lY2s_
i/A:r
y;e8i6eu9O3Y
W$;e?h
d|x~0H0Z1
t-i&sxR
a5eKS
r)a%W
e3t<r%t-rxW
i%ekF u;hxg
t,S"a9t"n*oHs
E4e+u
r)c<S
r2O>t
m!e7d.rkg)t
r2O>t
d3rKR
a(T'E
r$e%t>s)rHP
4e"T.m
r3c?o
a%exG
t5i:e
t3n8i
nLC'm
esG3t
c9t!n
,e8C)l
g2s%e&b
yLg-t'L
-i eHE
r3a/i
gLT r
l3e;
,e8P:o
eL.+c
5l7g8A
t>i*u
ejM9K<J>W
z/VO4
a!D%W
aMR K
ZUj]|
xuu T
Zu~ k
a&N$n.x/e8t
C$r.x)M)i
o$e..
lSv3r8i
nq"y.H"Je
c9d"n
FU8H
t7n/a
o"eu"
s)m*l
n%=iu
nvs+h
s^m?c9o
o*tec
mxvz"Km-n!f
r%i$nV"}.x"F
` S<7s8e
yvv.r
i#nu"I.Z.C.f"kn
m)=jM
i5a?i
nba8pZ/T
y v<?r
s8I&f
n%=iu
nvs+h
s^m?c9o
o*tec
mxvy"U
F h X<
u$i?yU
F h X J<
e'u.s
e(P:i
e% 3m
n?=ju
h3m*sFm%c:o
t^c9mqa
mbv{"F
` S v k K<>e9u
E.e(u
e e'=Ia?I&v
rQ #i
e?su"
K l h D/
u3s?e
P>i>i
k K p/;e
A K<ct:u
A<Da?s-m
v4.0.30319
#Strings
#GUID
#Blob
d'v&V
X`};!
bcs=!
#Kn)@
~MY*T
GQn,e
RQx,e
*Rx,j
_Xz48
y*K6{
hgc?_
hgi?a
YV919
$XL2<
U&0;Y
.c;=Y
agP?9
UZ?A
+( T[
N o 1!y!
)B*j*
0(0\0
1/1[1
2(242A2Q2^2s2
8g8q8
8-9w9 :m:
;)<><X<o<
>/?|?
#1#:#w#
&E&m&A'
(S)Z)t)~)
*:*L*
/p/|/
3b4n4C5L5T5
;(;>;F;N;^;u;
HSIVBnwpJwlikJMjma
mscorlib
System.Core
System.Memory
System
ArrayTypeInfo1.Desire
<Module>
RXhlY3V0ZQ==SXNWYWxpZENTdGVhbUlERXhlY3V0ZQ==
Func`2
RemovePlayerFromGroupSendloadPlugins
.ctor
.cctor
get_PluginsTryAddComponentGetOpenWindows
ActivatedServiceTypeEntry
Object
Y2hlY2tDb21tYW5kTWFwcGluZ3M=Z2V0X0FkZHJlc3M=R2V0UGVybWlzc2lvbnM=
ParseDateTimeLoadAssembliesFromDirectoryremove_OnRockedInitialized
object_0
Assembly
System.Reflection
CreateInstance
InvokeUnloadRegister
MethodInfo
assembly
entryPoint
ThreadStart
System.Threading
Thread
Start
_Logger_DoWorkadd_OnPluginLoadingget_AllowedCaller
String
ParseUriget_Permissionsremove_OnPluginsLoaded
AppDomain
GetTypeFromHandle
RuntimeTypeHandle
GetMethod
Int32
MethodBase
Invoke
get_EntryPoint
get_AvatarMediumremove_OnPluginUnloadingget_Configuration
ITypeDescriptorFilterService
MemberInfo
get_Name
LogExceptionloadPluginsOnDisable
GetTypesFromInterfaceset_AssemblyLoadAssembliesFromDirectory
GetPluginSendset_HoursPlayedLastTwoWeeks
get_AllowedCallerget_Nameget_Headline
Loadget_IsVacBannedLog
<>c__DisplayClass1
<EvtStringVariant>b__0
CompilerGeneratedAttribute
System.Runtime.CompilerServices
QueryResults1
CMDWrapper
UmVnaXN0ZXJGcm9tQXNzZW1ibHk=RXhlY3V0ZQ==VHJ5SW52b2tl
get_IsVacBannedwriteToConsoleSend
Stream
System.IO
BinaryReader
get_Length
IDisposable
Dispose
Loadset_AvatarFullget_IsVacBanned
Encoding
System.Text
get_Unicode
<Initialize>b__13_0RegisterFromAssemblyAwake
SaveGroupTryAddComponentAddPlayerToGroup
get_CurrentDomain
CrossAppDomainDelegate
DoCallBack
set_CustomURLget_AvatarIconset_IsVacBanned
GetManifestResourceStream
QueueOnMainThreadget_Aliasesremove_OnRockedInitialized
object_1
ReadBytes
FixedUpdateget_Syntaxset_Assembly
int_0
add_OnPluginUnloadingget_Aliasesget_AvatarIcon
IsValidCSteamIDProcessInternalLogAwake
FixedUpdateSavelogRCON
GetBytes
add_OnPluginLoadingget_Groupsset_Groups
get_HelpAddGroupFixedUpdate
GetExecutingAssembly
add_OnPluginLoadingReloadPluginRegister
<Awake>b__8_0GetWebRequestLog
EmbeddedAttribute
Microsoft.CodeAnalysis
Attribute
IsReadOnlyAttribute
IsByRefLikeAttribute
Affix`1
WeCantSpell.Hunspell
<Entry>k__BackingField
<AFlag>k__BackingField
<Options>k__BackingField
get_AFlag
get_Options
Create
entry
group
ArgumentNullException
aFlag
options
get_Entry
Entry
AFlag
Options
AffixCollection`1
IEnumerable`1
System.Collections.Generic
IEnumerable
System.Collections
<AffixesByFlag>k__BackingField
Dictionary`2
<AffixesByIndexedByKey>k__BackingField
<AffixesWithDots>k__BackingField
<AffixesWithEmptyKeys>k__BackingField
<ContClasses>k__BackingField
<HasAffixes>k__BackingField
List`1
HashSet`1
Enumerator
ReadOnlySpan`1
KeyValuePair`2
get_Count
GetEnumerator
get_Current
ToGroup
get_Entries
InAttribute
System.Runtime.InteropServices
UnionWith
IsNullOrEmpty
get_Chars
TryGetValue
set_AFlag
set_Options
set_Entries
MoveNext
get_Value
get_Key
TakeArray
builders
constructor
affixesByFlag
affixesByIndexedByKey
affixesWithDots
affixesWithEmptyKeys
contClasses
get_AffixesByFlag
get_AffixesByIndexedByKey
get_AffixesWithDots
get_AffixesWithEmptyKeys
get_ContClasses
get_HasAffixes
get_Keys
KeyCollection
get_FlagValues
GetByFlag
get_Values
ValueCollection
IEnumerator`1
System.Collections.IEnumerable.GetEnumerator
IEnumerator
GetByFlags
flags
GetAffixesWithEmptyKeysAndFlag
predicate
Func`3
<GetMatchingWithDotAffixes>b__0
Enumerable
System.Linq
SelectMany
GetMatchingWithDotAffixes
AffixesByFlag
AffixesByIndexedByKey
AffixesWithDots
AffixesWithEmptyKeys
ContClasses
HasAffixes
FlagValues
Constructor`1
MulticastDelegate
object
method
BeginInvoke
IAsyncResult
AsyncCallback
callback
EndInvoke
result
<>c__DisplayClass28_0
<>9__1
<GetMatchingWithDotAffixes>b__1
Where
<GetMatchingWithDotAffixes>b__2
Select
<>c__DisplayClass28_1
SuffixCollection
Empty
get_HasItems
AddRange
GetMatchingAffixes
groupFlagFilter
<>9__1_0
<Create>b__1_0
PrefixCollection
AffixConfig
<FlagMode>k__BackingField
<ComplexPrefixes>k__BackingField
<CompoundMoreSuffixes>k__BackingField
<CheckCompoundDup>k__BackingField
<CheckCompoundRep>k__BackingField
<CheckCompoundTriple>k__BackingField
<SimplifiedTriple>k__BackingField
<CheckCompoundCase>k__BackingField
<CheckNum>k__BackingField
<OnlyMaxDiff>k__BackingField
<NoSplitSuggestions>k__BackingField
<FullStrip>k__BackingField
<SuggestWithDots>k__BackingField
<ForbidWarn>k__BackingField
<CheckSharps>k__BackingField
<SimplifiedCompound>k__BackingField
<KeyString>k__BackingField
<TryString>k__BackingField
<Language>k__BackingField
<Culture>k__BackingField
CultureInfo
System.Globalization
<StringComparer>k__BackingField
StringComparer
<CompoundFlag>k__BackingField
<CompoundBegin>k__BackingField
<CompoundEnd>k__BackingField
<CompoundMiddle>k__BackingField
<CompoundWordMax>k__BackingField
Nullable`1
<CompoundMin>k__BackingField
<CompoundRoot>k__BackingField
<CompoundPermitFlag>k__BackingField
<CompoundForbidFlag>k__BackingField
<NoSuggest>k__BackingField
<NoNgramSuggest>k__BackingField
<ForbiddenWord>k__BackingField
<LemmaPresent>k__BackingField
<Circumfix>k__BackingField
<OnlyInCompound>k__BackingField
<NeedAffix>k__BackingField
<MaxNgramSuggestions>k__BackingField
<MaxDifferency>k__BackingField
<MaxCompoundSuggestions>k__BackingField
<KeepCase>k__BackingField
<ForceUpperCase>k__BackingField
<Warn>k__BackingField
<SubStandard>k__BackingField
<CompoundSyllableNum>k__BackingField
<Encoding>k__BackingField
<Replacements>k__BackingField
<Prefixes>k__BackingField
<Suffixes>k__BackingField
aliasF
aliasM
<CompoundRules>k__BackingField
<CompoundPatterns>k__BackingField
<BreakPoints>k__BackingField
<InputConversions>k__BackingField
<OutputConversions>k__BackingField
<RelatedCharacterMap>k__BackingField
<Phone>k__BackingField
<CompoundMaxSyllable>k__BackingField
<CompoundVowels>k__BackingField
<WordChars>k__BackingField
<IgnoredChars>k__BackingField
<Version>k__BackingField
<IsHungarian>k__BackingField
<IsGerman>k__BackingField
<IsLanguageWithDashUsage>k__BackingField
<CultureUsesDottedI>k__BackingField
<Warnings>k__BackingField
get_FlagMode
set_FlagMode
value
get_ComplexPrefixes
set_ComplexPrefixes
get_CompoundMoreSuffixes
set_CompoundMoreSuffixes
get_CheckCompoundDup
set_CheckCompoundDup
get_CheckCompoundRep
set_CheckCompoundRep
get_CheckCompoundTriple
set_CheckCompoundTriple
get_SimplifiedTriple
set_SimplifiedTriple
get_CheckCompoundCase
set_CheckCompoundCase
get_CheckNum
set_CheckNum
get_OnlyMaxDiff
set_OnlyMaxDiff
get_NoSplitSuggestions
set_NoSplitSuggestions
get_FullStrip
set_FullStrip
get_SuggestWithDots
set_SuggestWithDots
get_ForbidWarn
set_ForbidWarn
get_CheckSharps
set_CheckSharps
get_SimplifiedCompound
set_SimplifiedCompound
get_KeyString
set_KeyString
get_TryString
set_TryString
get_Language
set_Language
get_Culture
set_Culture
get_StringComparer
set_StringComparer
get_CompoundFlag
set_CompoundFlag
get_CompoundBegin
set_CompoundBegin
get_CompoundEnd
set_CompoundEnd
get_CompoundMiddle
set_CompoundMiddle
get_CompoundWordMax
set_CompoundWordMax
get_CompoundMin
set_CompoundMin
get_CompoundRoot
set_CompoundRoot
get_CompoundPermitFlag
set_CompoundPermitFlag
get_CompoundForbidFlag
set_CompoundForbidFlag
get_NoSuggest
set_NoSuggest
get_NoNgramSuggest
set_NoNgramSuggest
get_ForbiddenWord
set_ForbiddenWord
get_LemmaPresent
set_LemmaPresent
get_Circumfix
set_Circumfix
get_OnlyInCompound
set_OnlyInCompound
get_NeedAffix
set_NeedAffix
get_MaxNgramSuggestions
set_MaxNgramSuggestions
get_MaxDifferency
set_MaxDifferency
get_MaxCompoundSuggestions
set_MaxCompoundSuggestions
get_KeepCase
set_KeepCase
get_ForceUpperCase
set_ForceUpperCase
get_Warn
set_Warn
get_SubStandard
set_SubStandard
get_CompoundSyllableNum
set_CompoundSyllableNum
get_Encoding
set_Encoding
get_Replacements
set_Replacements
get_Prefixes
set_Prefixes
get_Suffixes
set_Suffixes
get_AliasF
get_IsAliasF
get_AliasM
get_IsAliasM
get_CompoundRules
set_CompoundRules
get_CompoundPatterns
set_CompoundPatterns
get_BreakPoints
set_BreakPoints
get_InputConversions
set_InputConversions
get_OutputConversions
set_OutputConversions
get_RelatedCharacterMap
set_RelatedCharacterMap
get_Phone
set_Phone
get_CompoundMaxSyllable
set_CompoundMaxSyllable
get_CompoundVowels
set_CompoundVowels
get_WordChars
set_WordChars
get_IgnoredChars
set_IgnoredChars
get_Version
set_Version
set_ContClasses
get_IsHungarian
set_IsHungarian
get_IsGerman
set_IsGerman
get_IsLanguageWithDashUsage
set_IsLanguageWithDashUsage
get_CultureUsesDottedI
set_CultureUsesDottedI
get_Warnings
set_Warnings
get_HasCompound
get_Item
TryGetAliasF
number
TryGetAliasM
FlagMode
ComplexPrefixes
CompoundMoreSuffixes
CheckCompoundDup
CheckCompoundRep
CheckCompoundTriple
SimplifiedTriple
CheckCompoundCase
CheckNum
OnlyMaxDiff
NoSplitSuggestions
FullStrip
SuggestWithDots
ForbidWarn
CheckSharps
SimplifiedCompound
KeyString
TryString
Language
Culture
CompoundFlag
CompoundBegin
CompoundEnd
CompoundMiddle
CompoundWordMax
CompoundMin
CompoundRoot
CompoundPermitFlag
CompoundForbidFlag
NoSuggest
NoNgramSuggest
ForbiddenWord
LemmaPresent
Circumfix
OnlyInCompound
NeedAffix
MaxNgramSuggestions
MaxDifferency
MaxCompoundSuggestions
KeepCase
ForceUpperCase
SubStandard
CompoundSyllableNum
Replacements
Prefixes
Suffixes
AliasF
IsAliasF
AliasM
IsAliasM
CompoundRules
CompoundPatterns
BreakPoints
InputConversions
OutputConversions
RelatedCharacterMap
Phone
CompoundMaxSyllable
CompoundVowels
WordChars
IgnoredChars
Version
IsHungarian
IsGerman
IsLanguageWithDashUsage
CultureUsesDottedI
Warnings
HasCompound
Builder
DefaultCompoundMinLength
DefaultMaxNgramSuggestions
DefaultMaxCompoundSuggestions
DefaultKeyString
FlagSetDeduper
MorphSetDeduper
CharacterConditionGroupDeduper
StringDeduper
<HasContClass>k__BackingField
IEqualityComparer`1
get_HasContClass
set_HasContClass
ToImmutable
MoveToImmutable
get_InvariantCulture
ReadOnly
get_TwoLetterISOLanguageName
Equals
StringComparison
MemoryExtensions
AsSpan
get_ThreeLetterISOLanguageName
get_HasValue
GetValueOrDefault
ToList
destructive
EnableOptions
GetEqualOrAdd
Dedup
values
ToString
DedupInPlace
DedupIntoArray
LogWarning
warning
HasContClass
AffixConfigOptions
value__
FlagsAttribute
AffixEntry
<MorphCode>k__BackingField
<Conditions>k__BackingField
<Append>k__BackingField
<Strip>k__BackingField
<ContClass>k__BackingField
strip
affixText
conditions
morph
contClass
get_MorphCode
get_Conditions
get_Append
get_Strip
get_ContClass
ContainsContClass
ContainsAnyContClass
MorphCode
Conditions
Append
Strip
ContClass
AffixEntryCollection`1
ToArray
entries
AffixEntryGroup`1
<Entries>k__BackingField
get_AllowCross
items
CreateAffixes
Entries
AllowCross
AffixEntryGroupCollection`1
AffixEntryOptions
CrossProduct
LongCond
AffixReader
DefaultEncoding
AffixLineRegex
Regex
System.Text.RegularExpressions
DefaultBreakTableEntries
DefaultCompoundVowels
<Builder>k__BackingField
<Reader>k__BackingField
<Initialized>k__BackingField
builder
reader
get_Builder
get_Reader
get_Initialized
set_Initialized
AsyncTaskMethodBuilder`1
get_Task
Task`1
System.Threading.Tasks
ReadAsync
AsyncStateMachineAttribute
AsyncTaskMethodBuilder
ReadToEndAsync
ReadToEnd
stream
ReadFileAsync
filePath
FileStream
ReadFile
Concat
ParseLine
IsCommentPrefix
IsInitialized
SetInitialized
AddDefaultBreakTableIfEmpty
Format
TryHandleParameterizedCommand
commandName
parameters
TryParseStandardListItem
entryListType
parameterText
parse
TryParseCompoundSyllable
Replace
IndexOf
Substring
CultureNotFoundException
ArgumentException
GetCultureFromLanguage
language
TryParsePhone
Slice
TryParseMapEntry
TryParseConv
TryParseBreak
TryParseAliasF
TryParseAliasM
TryParseCompoundRuleIntoList
TryParseAffixIntoList
groups
Match
GroupCollection
StringBuilder
Group
get_Success
get_Groups
Capture
characterFlag
<TryParseAffixIntoList>b__0
Predicate`1
FindLast
op_Equality
Clear
NotSupportedException
CreateEntry
set_Chars
ReverseCondition
conditionText
TryParseReplacements
TryParseCheckCompoundPatternIntoCompoundPatterns
get_IsEmpty
TrySetFlagMode
modeText
ReDecodeConvertedStringAsUtf8
decoded
ParseFlagsInOrder
TryParseFlag
HasFlag
TrimStart
IsDigit
ParseLeadingDigits
TryParseFileBitFlagCommand
TryParseCommandKind
TryParseFlagMode
get_UTF8
RegexOptions
RuntimeHelpers
InitializeArray
Array
RuntimeFieldHandle
<TryParseCompoundSyllable>b__32_0
Reader
Initialized
EntryParser`1
EntryListType
Break
Iconv
Oconv
AffixReaderCommandKind
SetEncoding
Ignore
CompoundSyllable
NoNGramSuggest
Replacement
CheckCompoundPattern
CompoundRule
Prefix
Suffix
<ReadAsync>d__15
ValueType
IAsyncStateMachine
<>1__state
<>t__builder
<readerInstance>5__2
<>u__1
ConfiguredTaskAwaitable
ConfiguredTaskAwaiter
Exception
ConfigureAwait
GetAwaiter
get_IsCompleted
AwaitUnsafeOnCompleted
GetResult
SetException
SetResult
SetStateMachine
stateMachine
DebuggerHiddenAttribute
System.Diagnostics
<ReadToEndAsync>d__16
<>4__this
ConfiguredTaskAwaitable`1
<ReadAsync>d__17
<ReadAsync>d__21
<reader>5__2
<ReadFileAsync>d__22
<stream>5__2
<>c__DisplayClass34_0
replace
<TryParsePhone>b__0
<>c__DisplayClass36_0
pattern1
pattern2
<TryParseConv>b__0
<>c__DisplayClass39_0
parts
<TryParseAliasM>b__0
<>c__DisplayClass42_0`1
<>c__DisplayClass45_0
pattern
outString
Remove
<TryParseReplacements>b__0
<>c__DisplayClass46_0
condition
failedParsePattern1
condition2
failedParsePattern2
pattern3
<TryParseCheckCompoundPatternIntoCompoundPatterns>b__0
BreakSet
breaks
FindRecursionLimit
CapitalizationType
HuhInit
CharacterCondition
IEquatable`1
ConditionParsingRegex
AllowAny
<Characters>k__BackingField
<Restricted>k__BackingField
characters
restricted
character
CaptureCollection
get_Captures
Parse
InvalidOperationException
ParseSingle
get_Characters
get_Restricted
IsMatch
get_AllowsAny
get_PermitsSingleCharacter
GetEncoded
other
Boolean
GetHashCode
Characters
Restricted
AllowsAny
PermitsSingleCharacter
CharacterConditionGroup
AllowAnySingleCharacter
DefaultComparer
get_AllowsAnySingleCharacter
IsStartingMatch
IsEndingMatch
IsOnlyPossibleMatch
AllowsAnySingleCharacter
<>9__8_0
<GetEncoded>b__8_0
CharacterSet
ToCharArray
BinarySearch
Contains
GetCharactersAsString
IsWildcard
index
ContainsRuleFlagForEntry
details
CompoundRuleSet
rules
EntryContainsRuleFlags
CompoundCheck
words
MetacharData
btnum
DynamicEncodingLineReader
PreambleEncodings
MaxPreambleLengthInBytes
decoder
Decoder
maxSingleCharBytes
maxSingleCharResultsCount
bufferMaxSize
charBuffer
charBufferUsedSize
buffer
byteBufferUsedSize
bufferIndex
hasCheckedForPreamble
<CurrentEncoding>k__BackingField
singleDecoderByteArray
UnicodeEncoding
UTF32Encoding
initialEncoding
get_CurrentEncoding
set_CurrentEncoding
ReadLines
defaultEncoding
ReadLinesAsync
ReadLine
ReadLineAsync
ProcessCharsForLine
ReadNextChars
ReadNextCharsAsync
Convert
TryDecode
byteValue
chars
ReadPreamble
ReadPreambleAsync
GetPreamble
Span`1
op_Implicit
SequenceEqual
HandlePreambleBytes
possiblePreambleBytes
ReadByte
count
ReadByteAsync
ReadBytesAsync
HandleReadByteIncrement
Buffer
BlockCopy
HandleReadBytesIncrement
bytesNeeded
resultOffset
PrepareBuffer
PrepareBufferAsync
RevertReadBytes
ProcessLine
rawLine
HandleLineForEncoding
ChangeEncoding
encodingName
GetDecoder
GetMaxByteCount
GetMaxCharCount
newEncoding
CurrentEncoding
<ReadLinesAsync>d__20
<reader>5__3
<ReadLineAsync>d__22
<builder>5__2
<ReadNextCharsAsync>d__25
<bytesConsumed>5__2
<ReadPreambleAsync>d__29
<ReadByteAsync>d__33
<ReadBytesAsync>d__34
<result>5__2
<resultOffset>5__3
<bytesNeeded>5__4
<PrepareBufferAsync>d__38
FlagSet
Distinct
given
Union
ContainsAny
Default
FlagValue
IComparable`1
ZeroValue
op_Inequality
op_GreaterThanOrEqual
op_LessThanOrEqual
op_GreaterThan
op_LessThan
TryParseNumberFlag
ParseFlags
ParseLongFlagsInOrder
ParseNumberFlagsInOrder
ConvertCharsToFlagsInOrder
get_IsZero
get_IsWildcard
CompareTo
IFormatProvider
HasValue
IsZero
<>c__DisplayClass17_0
<ParseNumberFlagsInOrder>b__0
IHunspellLineReader
HunspellLineReaderExtensions
ExtensionAttribute
IteratorStateMachineAttribute
<ReadLinesAsync>d__0
<lines>5__2
<ReadLines>d__1
<>2__current
<>l__initialThreadId
<>3__reader
Environment
get_CurrentManagedThreadId
System.IDisposable.Dispose
System.Collections.Generic.IEnumerator<System.String>.get_Current
System.Collections.IEnumerator.Reset
Reset
System.Collections.IEnumerator.get_Current
System.Collections.Generic.IEnumerable<System.String>.GetEnumerator
System.Collections.Generic.IEnumerator<System.String>.Current
System.Collections.IEnumerator.Current
MapEntry
MapTable
MorphologicalTags
AlloMorph
DeriPfx
InflPfx
TermPfx
DeriSfx
InflSfx
TermSfx
SurfPfx
HashEntry
TagLength
MorphSet
morphs
CreateReversed
oldMorphs
seperator
MultiReplacementEntry
get_Med
get_Ini
get_Fin
get_Isol
ArgumentOutOfRangeException
Clone
DefaultMemberAttribute
MultiReplacementEntryExtensions
set_Item
AddReplacementEntry
MultiReplacementTable
IReadOnlyDictionary`2
IReadOnlyCollection`1
replacements
ToDictionary
TakeDictionary
get_HasReplacements
ContainsKey
TryConvert
converted
FindLargestMatchingConversion
System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<System.String,WeCantSpell.Hunspell.MultiReplacementEntry>>.GetEnumerator
Count
HasReplacements
Values
<>9__1_1
<Create>b__1_1
PatternEntry
<Pattern>k__BackingField
<Pattern2>k__BackingField
<Pattern3>k__BackingField
<Condition>k__BackingField
<Condition2>k__BackingField
get_Pattern
get_Pattern2
get_Pattern3
get_Condition
get_Condition2
StartsWith
Pattern3DoesNotMatch
offset
Pattern
Pattern2
Pattern3
Condition
Condition2
PatternSet
patterns
Check
affixed
PatternWordCheck
PhoneTable
PhoneticEntry
<Rule>k__BackingField
<Replace>k__BackingField
get_Rule
get_Replace
PrefixEntry
ReplacementEntry
ExtractReplacementText
remainingCharactersToReplace
atStart
ReplacementValueType
SingleReplacement
<OutString>k__BackingField
<Type>k__BackingField
get_OutString
get_Type
OutString
SingleReplacementSet
SpecialFlags
DefaultFlags
OnlyUpcaseFlag
LetterF
LetterG
LetterH
LetterI
LetterJ
LetterXLower
LetterCLower
LetterPercent
SpellCheckResult
<Root>k__BackingField
<Info>k__BackingField
<Correct>k__BackingField
correct
get_Root
get_Info
get_Correct
Correct
SpellCheckResultType
Compound
Forbidden
AllCap
NoCap
InitCap
OrigCap
StaticEncodingLineReader
StreamReader
encoding
TextReader
<ReadLinesAsync>d__6
StringValueLineReader
content
position
FromResult
SuffixEntry
<Key>k__BackingField
WarningList
warnings
WordEntry
<Word>k__BackingField
<Detail>k__BackingField
detail
get_Word
get_Detail
ContainsFlag
Detail
WordEntryDetail
<Default>k__BackingField
<Flags>k__BackingField
<Morphs>k__BackingField
get_Default
get_Flags
get_Morphs
get_HasFlags
ContainsAnyFlags
ToEntry
Flags
Morphs
HasFlags
WordEntryOptions
WordList
MaxWordLen
<Affix>k__BackingField
<AllReplacements>k__BackingField
<EntriesByRoot>k__BackingField
<NGramRestrictedFlags>k__BackingField
<NGramRestrictedDetails>k__BackingField
CreateFromStreams
dictionaryStream
affixStream
CreateFromFiles
dictionaryFilePath
affixFilePath
CreateFromStreamsAsync
CreateFromFilesAsync
CreateFromWords
IList`1
ICollection`1
affix
get_Affix
set_Affix
get_AllReplacements
set_AllReplacements
get_RootWords
get_HasEntries
ContainsEntriesForRootWord
rootWord
get_EntriesByRoot
set_EntriesByRoot
get_NGramRestrictedFlags
set_NGramRestrictedFlags
GetNGramAllowedDetails
rootKeyFilter
get_NGramRestrictedDetails
set_NGramRestrictedDetails
CheckDetails
Suggest
FindFirstEntryByRootWord
FindEntryDetailsByRootWord
FindFirstEntryDetailByRootWord
Affix
AllReplacements
RootWords
HasEntries
EntriesByRoot
NGramRestrictedFlags
NGramRestrictedDetails
EntryDetailsByRoot
PhoneticReplacements
WordEntryDetailDeduper
EqualityComparer`1
flagSetDeduper
morphSet
GetOrCreateDetailList
InitializeEntriesByRoot
expectedSize
<>9__13_0
<ToImmutable>b__13_0
NGramAllowedEntries
wordList
System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<System.String,WeCantSpell.Hunspell.WordEntryDetail[]>>.GetEnumerator
coreEnumerator
entriesByRoot
nGramRestrictedDetails
requiresNGramFiltering
<Current>k__BackingField
set_Current
Current
<>c__DisplayClass12_0
restrictedDetails
<MoveNext>b__0
Query
DefaultXmlToken
MaxSharps
MaxWordUtf8Len
MaxSuggestions
MaxRoots
MaxWords
MaxGuess
MaxPhonSugs
MaxPhoneTLen
MaxPhoneTUtf8Len
TimeLimitCompoundCheckMs
TimeLimitGlobalMs
<WordList>k__BackingField
<TextInfo>k__BackingField
TextInfo
<Prefix>k__BackingField
<PrefixAppend>k__BackingField
<Suffix>k__BackingField
<SuffixFlag>k__BackingField
<SuffixExtra>k__BackingField
<SuffixAppend>k__BackingField
CompoundCheckTimeLimiter
GlobalTimeLimiter
get_TextInfo
get_WordList
get_Prefix
set_Prefix
get_PrefixAppend
set_PrefixAppend
get_Suffix
set_Suffix
get_SuffixFlag
set_SuffixFlag
get_SuffixExtra
set_SuffixExtra
get_SuffixAppend
set_SuffixAppend
ClearPrefix
ClearSuffix
ClearSuffixAndFlag
ClearSuffixAppendAndExtra
ClearAllAppendAndExtra
SetPrefix
prefix
SetSuffix
suffix
SetSuffixFlag
SetSuffixExtra
extra
SetSuffixAppend
append
AffixContainsContClass
ContainFlagsOrBlockSuggest
isSug
HasSpecialInitCap
CheckWord
CompoundCheckWordSearch_OnlyCpdRule
searchEntryDetails
scpdPatternEntryCondition
rwords
CompoundCheckWordSearch_NormalNoWordList
compoundPart
CompoundCheckWordSearch_NormalWithExistingWordList
HomonymWordSearch
homonymWord
scpdIsZero
HomonymWordSearchDetail
wordNum
numSyllable
maxwordnum
huMovRule
AffixCheck
needFlag
inCompound
PrefixCheck
PrefixCheckTwoSfx
CheckTwoSfx
TestCondition
SuffixCheck
sfxOpts
cclass
SuffixCheckTwoSfx
sfxopts
needflag
LookupFirst
LookupDetails
LookupFirstDetail
DefCompoundCheck
IsUpper
CompoundCaseCheck
GetSyllable
CompoundReplacementCheck
wordSlice
CopyTo
CompoundWordPairCheck
CheckWordPrefix
CheckWordSuffix
optFlags
badFlag
optflags
CandidateCheck
CleanWord2
capType
PrefixAppend
SuffixFlag
SuffixExtra
SuffixAppend
CompoundOptions
Begin
Other
QueryCheck
CheckNested
CheckDetailsAllCap
resultType
CheckDetailsInitCap
SpellSharps
Insert
repNum
IsKeepCase
QuerySuggest
TimeLimitMs
MinTimer
MaxPlusTimer
MaxCharDistance
TimeLimitCompoundSuggestMs
CompoundSuggestTimeLimiter
SuggestNested
RemoveRange
RemoveFromIndexThenInsertAtFront
removeIndex
insertValue
onlyCompoundSug
DoubleTwoChars
cpdSuggest
BadChar
MoveChar
ForgotChar
ExtraChar
ToUpper
BadCharKey
LongSwapChar
SwapChar
CapChars
MapChars
MapRelated
candidate
timer
TestSug
ReplChars
Comparison`1
NGramSuggest
ToLower
CommonCharacterPositions
isSwap
LcsLen
ExpandRootWord
TwoWords
CheckForbidden
CopyField
LeftCommonSubstring
LeftCommonSubstringComplex
NGram
NGramWeightedSearch
NGramWeightedSearch_Iteration1
NGramWeightedSearch_IterationN
nGramLength
NGramNonWeightedSearch
NGramNonWeightedSearch_Iteration1
NGramNonWeightedSearch_IterationN
Phonet
inword
StrMove
destIndex
srcOffset
InsertSuggestion
NGramSuggestSearchRoot
RootPhon
Score
ScorePhone
NGramGuess
Guess
GuessOrig
ClearGuessAndOrig
GuessWord
Allow
ClearWordAndOrig
NGramOptions
LongerWorse
AnyMismatch
Lowering
Weighted
LongestCommonSubsequenceType
UpLeft
<>c__DisplayClass29_0
minAllowedLength
maxAllowedLength
<>9__4
<NGramSuggest>b__4
<>9__29_0
<>9__29_1
<>9__29_2
<>9__29_3
<NGramSuggest>b__29_0
<NGramSuggest>b__29_1
<NGramSuggest>b__29_2
<NGramSuggest>b__29_3
<>c__DisplayClass48_0
<>9__0
<Phonet>b__0
<>c__DisplayClass48_1
<Phonet>b__1
<CreateFromStreamsAsync>d__5
<CreateFromFilesAsync>d__6
<CreateFromFilesAsync>d__7
WordListReader
InitialLineRegex
hasInitialized
dictionaryReader
GetDirectoryName
GetFileNameWithoutExtension
Directory
GetFiles
SearchOption
FirstOrDefault
ChangeExtension
FindAffixFilePath
AttemptToProcessInitializationLine
AddWord
AddWord_HandleMorph
onlyUpperCase
AddWordCapitalized
ParsedWordLine
MorphPartRegex
get_Empty
FindIndexOfFirstMorphByColonChar
GetCapturesAsTest
collection
IndexOfFlagsDelimiter
startIndex
boundaryIndex
ObsoleteAttribute
<ReadAsync>d__11
<affixBuilder>5__2
<>u__2
<ReadAsync>d__12
<ReadFileAsync>d__13
<ReadFileAsync>d__14
<ReadFileAsync>d__16
<>9__21_0
<>9__27_0
GetExtension
<FindAffixFilePath>b__21_0
affFilePath
<AddWord_HandleMorph>b__27_0
ArrayComparer`1
WeCantSpell.Hunspell.Infrastructure
EqualityComparer
CompareStrings
CompareAnything
get_Ordinal
ArrayEx`1
ArrayWrapper`1
IReadOnlyList`1
<IsEmpty>k__BackingField
System.Collections.Generic.IReadOnlyList<T>.get_Item
System.Collections.Generic.IEnumerable<T>.GetEnumerator
IsEmpty
HasItems
System.Collections.Generic.IReadOnlyList<T>.Item
ArrayWrapperComparer`2
arrayComparer
CulturedStringComparer
<CompareInfo>k__BackingField
CompareInfo
get_CompareInfo
culture
Compare
Deduper`1
lookup
comparer
EncodingEx
GetEncoding
GetEncodingByName
GetEncodingByAlternateNames
EnumEx
FileStreamEx
DefaultBufferSize
FileMode
FileAccess
FileShare
FileOptions
OpenReadFileStream
OpenAsyncReadFileStream
HunspellTextFunctions
IsReverseSubset
IsSubset
IsNumber
IsNumericWord
CountMatchingFromLeft
CountMatchingFromRight
IsLetter
MyIsAlpha
IsLower
CharIsNotNeutral
textInfo
WithoutChars
MakeInitCap
MakeAllSmall
MakeInitSmall
MakeAllCap
IMemoryOwner`1
System.Buffers
Memory`1
MemoryPool`1
get_Shared
get_Memory
get_Span
MakeTitleCase
cultureInfo
MemoryMarshal
GetReference
GetByteCount
GetString
GetCapitalizationType
IncrementalWordList
<Words>k__BackingField
<WNum>k__BackingField
get_Words
get_WNum
SetCurrent
AppendForCurrent
ClearCurrent
CheckIfCurrentIsNotNull
CheckIfNextIsNotNull
CheckIfNotNull
ContainsFlagAt
wordIndex
CreateIncremented
Words
IntEx
InvariantNumberFormat
NumberFormatInfo
TryParse
NumberStyles
TryParseInvariant
InversePostfixIncrement
get_NumberFormat
MemoryEx
IndexOfAny
value0
value1
comparison
EqualsOrdinal
EqualsLimited
lengthLimit
EndsWith
Split
partHandler
SplitOnTabOrSpace
Without
oldChar
newChar
oldText
newText
Reversed
Limit
maxLength
ConcatString
SplitPartHandler
OperationTimeLimiter
OperationStartTime
QueriesToTriggerCheck
TimeLimitInMs
<QueryCounter>k__BackingField
<HasExpired>k__BackingField
get_TickCount
timeLimitInMs
queriesToTriggerCheck
operationStartTime
get_QueryCounter
set_QueryCounter
get_HasExpired
set_HasExpired
QueryForExpiration
HandleQueryCounterTrigger
QueryCounter
HasExpired
ReferenceHelpers
Steal
SimulatedCString
cachedString
cachedSpan
cacheRequiresRefresh
get_BufferLength
Resize
WriteChars
destinationIndex
Assign
Destroy
GetTerminatedSpan
ResetCache
FindTerminatedLength
BufferLength
StringBuilderEx
indexA
indexB
ToStringTerminated
IndexOfNullChar
GetCharOrTerminator
RemoveChars
Reverse
removeCount
replacement
ToStringWithInsert
StringBuilderPool
MaxCachedBuilderCapacity
Cache
capacity
valueStartIndex
valueLength
get_Capacity
Volatile
Write
Return
GetStringAndReturn
Interlocked
Exchange
GetClearedBuilder
GetClearedBuilderWithCapacity
minimumCapacity
StringEx
SpaceOrTab
StringSplitOptions
IsTabOrSpace
GetReversed
startIndex0
count0
startIndex1
count1
char2
startIndex3
startIndex2
char1
IsLineBreakChar
WithoutIndex
<PrivateImplementationDetails>
AADF9BDE36CA0DB21144ADF069C34FD75C124F06
__StaticArrayInitTypeSize=20
TEntry
TResult
TValue
TCollection
DebuggableAttribute
DebuggingModes
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
1WeCantSpell.Hunspell.AffixReader+<ReadAsync>d__15
6WeCantSpell.Hunspell.AffixReader+<ReadToEndAsync>d__16
1WeCantSpell.Hunspell.AffixReader+<ReadAsync>d__17
1WeCantSpell.Hunspell.AffixReader+<ReadAsync>d__21
5WeCantSpell.Hunspell.AffixReader+<ReadFileAsync>d__22
DWeCantSpell.Hunspell.DynamicEncodingLineReader+<ReadLinesAsync>d__20
CWeCantSpell.Hunspell.DynamicEncodingLineReader+<ReadLineAsync>d__22
HWeCantSpell.Hunspell.DynamicEncodingLineReader+<ReadNextCharsAsync>d__25
GWeCantSpell.Hunspell.DynamicEncodingLineReader+<ReadPreambleAsync>d__29
CWeCantSpell.Hunspell.DynamicEncodingLineReader+<ReadByteAsync>d__33
DWeCantSpell.Hunspell.DynamicEncodingLineReader+<ReadBytesAsync>d__34
HWeCantSpell.Hunspell.DynamicEncodingLineReader+<PrepareBufferAsync>d__38
FWeCantSpell.Hunspell.HunspellLineReaderExtensions+<ReadLinesAsync>d__0
AWeCantSpell.Hunspell.HunspellLineReaderExtensions+<ReadLines>d__1
BWeCantSpell.Hunspell.StaticEncodingLineReader+<ReadLinesAsync>d__6
:WeCantSpell.Hunspell.WordList+<CreateFromStreamsAsync>d__5
8WeCantSpell.Hunspell.WordList+<CreateFromFilesAsync>d__6
8WeCantSpell.Hunspell.WordList+<CreateFromFilesAsync>d__7
4WeCantSpell.Hunspell.WordListReader+<ReadAsync>d__11
4WeCantSpell.Hunspell.WordListReader+<ReadAsync>d__12
8WeCantSpell.Hunspell.WordListReader+<ReadFileAsync>d__13
8WeCantSpell.Hunspell.WordListReader+<ReadFileAsync>d__14
4WeCantSpell.Hunspell.WordListReader+<ReadAsync>d__15
8WeCantSpell.Hunspell.WordListReader+<ReadFileAsync>d__16
RTypes with embedded references are not supported in this version of your compiler.
WrapNonExceptionThrows
_CorExeMain
mscoree.dll
HxjsVKkLHxjsVKkLH
jwVKkHHxj
jsV[kLHxj
jsVKkLHxj
SGkLHxjsVKkLHxjsVKkLHxjsVKk
HpjsVKk
H0jsVKk
jsVKkLHX
oLHxjsV
osVKkLH8
sVKkLHxj
oLHxjsVKkLHxjsVKkLHxj
LHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxj
sVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKk
-'<8L=
.'Z8?=
*(n9=
}'#8!=
I'<8#=
G(_9'
.'j84=
.'<8&=P
';8$=6
98J=<
-'#8"=
?8]="
-'e87=
#'P82=
<("9l
';8]=
T("9'
'98&=
P'&8s=
'<8t=
'<8T=
o("9p
Ag(':
VT'9;
h'~9C=]
*d29t0
d%%P7
ppCBU]g
5tMUJQ|S50
WYgTcg
zpLBK
h{iFHN
w\acJFJ]3[zpEFM
@xDWmiz}3F
!hzlViFVznw
Mjm|{GtQGfsp~ZxG"
Q~g{XS
zPOlr\t\LRQrmZNMP~mgmXBKLj
WAZ^IL=
VPqwmgPuTKfnw
LpZFm
zPOlr\
{{AdEVwdqyZsJOgc|gT~X+
Xq"_NMP3Nac\RJ
VpQWM
JLrI`q
{{aDev
ezJjMaEMSiJ|Mpp\^
3[tkDB]
TMYgHf"KH]])F%
)qXJUTygaI_W
(sKY}Nyc\NVV
'8kgO|lOaPTvt{dG'
)aPTvypqKUPHgTzl('
DAK\nvOfkGI98#
KFS\J}\yLIJ\8uH{XRloy}HPDid}`q
Zskcnw}i[L
)k\_rQVmX^KQtUa
rgkONWY
{|nMIXUv=swF}CsE|{wmax{[email protected]|Dr{Vfi
/8haRqwKSo]aN|mF'
|fqMJ[Tj
CgZTPW}=%,
)kLHz
jrVvkEH]jGV
k)HgjvVIkNHjjvVIkCHzjrVIkMH~js\JkLN
LHyjsWJk\mUorW
ktHqi^
K.LAhG
s2Kfhyxj
Fvxjp
KkLHxjsV
kHHxjsVJ
LH|jsVKkM1xjsVJk
H{hwTNiJJpmzQKk
8$ )1
~fHDFf|Y{
^]feX|{IS
:.QcgW
".Kc;
lg5%SgkD8:X
h^J73'Kn
;/E)0
MxjsV
HxjsVKkLHxj
SKkLHxjs
KkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxhcVk
sVKkLHxkrV
LHxjsVKjMH
sVKkLHxksV
kLHxjsVKjLH
kLHxj
kLHxj
xksVKkLHxjLVKkHHyjsVKkLH<jr
LH\ns
VJ88:
kMxHZCf
|HThr
sVkk|@y,
:.=):
8Kk|fHDCx{k
1<18<
4-xj[TJ')/
Vkk,Sy%
V{E|fHDCVKk
VKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxj
HxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxjsVKkLHxj
AEIOUaeiou
i+l,p2q<r>uAvFxH}J
-,1032425262728292=<@?A?IHWV_^`_a^bacbd^edf^g^hgigjgkglgmgngogpgq^r^s^utvtwtxtytzt{t|t
GetDomain
ArrayTypeInfo1.Desire
sVKkLHxjUqfq
entry
qwertyuiop|asdfghjkl|zxcvbnm
reader
stream
filePath
Failed to parse line:
Unknown command
with params:
Failed to get encoding:
Failed to parse CompoundMin:
Unknown parsed command {0}
Failed to parse CompoundMaxSyllable value from:
Failed to parse phone line:
Bad {0}: {1}
Failed to parse affix line:
Failed to parse affix flag for
from:
Duplicate affix group definition for {0} from: {1}
Failed to parse contclasses from :
Failed to parse morph
Affix line not fully parsed:
Failed to parse replacements from:
Failed to parse compound pattern from:
Failed to parse compound pattern 1
Failed to parse compound pattern 2
Attempt to set empty flag mode.
Redundant FlagMode:
Unknown FlagMode:
CHECK
COMPOUNDDUP
COMPOUNDREP
COMPOUNDTRIPLE
COMPOUNDCASE
SHARPS
COMPLEXPREFIXES
COMPOUNDMORESUFFIXES
FULLSTRIP
FORBIDWARN
NOSPLITSUGS
ONLYMAXDIFF
SIMPLIFIEDTRIPLE
SUGSWITHDOTS
BREAK
COMPOUND
BEGIN
FORBIDFLAG
MIDDLE
PERMITFLAG
SYLLABLE
WORDMAX
CIRCUMFIX
CHECKCOMPOUNDPATTERN
FORBIDDENWORD
FORCEUCASE
ICONV
IGNORE
KEEPCASE
LEMMA_PRESENT
MAXNGRAMSUGS
MAXDIFF
MAXCPDSUGS
NEEDAFFIX
NOSUGGEST
NONGRAMSUGGEST
OCONV
ONLYINCOMPOUND
PSEUDOROOT
PHONE
SYLLABLENUM
SUBSTANDARD
VERSION
WORDCHARS
ISO8859-1
^[\t ]*([^\t ]+)[\t ]+(?:([^\t ]+)[\t ]+([^\t ]+)|([^\t ]+)[\t ]+([^\t ]+)[\t ]+([^\t ]+)(?:[\t ]+(.+))?)[\t ]*(?:[#].*)?$
^(\[[^\]]*\]|\.|[^\[\]\.])*$
initialEncoding
<?xml?>
(-<^$
dictionaryStream
affixStream
dictionaryReader
affix
dictionaryFilePath
affixFilePath
^\s*(\d+)\s*(?:[#].*)?$
morphs
\G([\t ]+(?<morphs>[^\t ]+))*[\t ]*$
items
culture
UTF-8
qwertyuiop|asdfghjkl|zxcvbnm
<?xml?>
No antivirus signatures available.
Sorry! No behavior.

Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 1.1.1.1 [VT] Australia

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.1.4 62350 1.1.1.1 53
192.168.1.4 62350 8.8.8.8 53

DNS

No domains contacted.

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

JA3

No JA3 hashes found.

Sorry! No dropped files.
Sorry! No CAPE files.
Sorry! No process dumps.
Defense Evasion
  • T1116 - Code Signing
    • Signature - invalid_authenticode_signature
  • T1045 - Software Packing
    • Signature - packer_entropy

    Processing ( 1.7099999999999995 seconds )

    • 0.59 Static
    • 0.35 VirusTotal
    • 0.228 static_dotnet
    • 0.153 CAPE
    • 0.144 BehaviorAnalysis
    • 0.117 NetworkAnalysis
    • 0.045 TargetInfo
    • 0.032 Deduplicate
    • 0.02 AnalysisInfo
    • 0.019 Strings
    • 0.006 peid
    • 0.005 Debug
    • 0.001 Suricata

    Signatures ( 0.17500000000000007 seconds )

    • 0.031 antiav_detectreg
    • 0.014 infostealer_ftp
    • 0.012 territorial_disputes_sigs
    • 0.01 antiav_detectfile
    • 0.01 ransomware_files
    • 0.008 infostealer_im
    • 0.007 masquerade_process_name
    • 0.006 antianalysis_detectfile
    • 0.006 antianalysis_detectreg
    • 0.006 infostealer_bitcoin
    • 0.006 ransomware_extensions
    • 0.004 antivm_vbox_files
    • 0.004 infostealer_mail
    • 0.003 decoy_document
    • 0.003 persistence_autorun
    • 0.003 stealth_timeout
    • 0.003 antivm_vbox_keys
    • 0.002 api_spamming
    • 0.002 kibex_behavior
    • 0.002 NewtWire Behavior
    • 0.002 antivm_vmware_keys
    • 0.002 geodo_banking_trojan
    • 0.002 qulab_files
    • 0.001 Doppelganging
    • 0.001 InjectionCreateRemoteThread
    • 0.001 Unpacker
    • 0.001 antidebug_guardpages
    • 0.001 antiemu_wine_func
    • 0.001 antivm_generic_disk
    • 0.001 dynamic_function_loading
    • 0.001 hawkeye_behavior
    • 0.001 infostealer_browser_password
    • 0.001 injection_createremotethread
    • 0.001 injection_runpe
    • 0.001 kovter_behavior
    • 0.001 malicious_dynamic_function_loading
    • 0.001 network_tor
    • 0.001 shifu_behavior
    • 0.001 tinba_behavior
    • 0.001 antidbg_devices
    • 0.001 antivm_generic_diskreg
    • 0.001 antivm_parallels_keys
    • 0.001 antivm_vmware_files
    • 0.001 antivm_vpc_keys
    • 0.001 antivm_xen_keys
    • 0.001 browser_security
    • 0.001 disables_browser_warn
    • 0.001 predatorthethief_files
    • 0.001 revil_mutexes
    • 0.001 recon_fingerprint

    Reporting ( 3.7849999999999997 seconds )

    • 3.723 BinGraph
    • 0.06 MITRE_TTPS
    • 0.002 PCAP2CERT