MalScore
100/100
MalFamily
Nanocore

35478.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 54/67 Related 2802
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 202.50 KB (207360 bytes)
Compile time: 2015-02-22 01:49:37
MD5: 000311c67d70867fa85d785206de80f6
SHA1: 1084b6ccc6fd496a01ace24f61c64730f0756b26
SHA256: ba7d2c5d8ebfd8225445cf1f1b22457e52df29113837b749ac123274f60a9556
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .reloc .rsrc
Directories 3 import resource relocation
First submission: 2018-04-10 12:45:02
Last submission: 2018-04-10 12:45:02
Filename detected: - 35478.exe (1)
URL file hosting
hXXp://185.82.220.137/35478.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-04-10 07:51:15 [54/67] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x1c798 116736 852d9b59cf385344732168da29c3c2b2 a17c5c9675445078f51802935c1954fa40f0ee89
.reloc 0x20000 0xc 512 fa81a8e21b7ba0db59d9a42aa7a5e570 73c936b34cc7723ee95c73f137c13c4ffafdce53
.rsrc 0x22000 0x15d90 89600 044441b4b1ea8655716186adaf89b6bd 28fbfcb7757148e30d96ae8e8dea1345f962d3be
PE Resources
Name Offset Size Language Sublanguage Data
RT_RCDATA 0x22058 89400 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
No Meta found in this file
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
KERNEL32.dll
ntdll.dll
psapi.dll
mscoree.dll
DNSAPI.dll
ADVAPI32.dll
IP Found
No IP detected
URL(s)
No URL found
]"Q+a-Y6I
$#%#&#'&98:8;8<8=8>8?8@8A8B8C8
#=qWaMf_MISHPEu34of2Bm5$ay6Z6PuaGN7w1jlKYjzwdE=
#=qzRf5_jFnPo03SqY9Fq$uTg==
#=qEVnoj7wKonGmgnYpK7PNGg==
DateTime
85`1
;A Q[
n;S5
cDf?
= )Y
H_,3V
FindResourceEx
Int32
pgcd
;uYl
ValidateBlock
#=qHiBdWLOLLVg67b8lN8FRqgmYNWZfcDieu2MH9_zIY6Q=
#=qtDC6IoLr5pnMo1d9qdAc2TBOnWqOdlEZHf8Itbl8cJc=
OssJx
GetBytes
#=qPNzwB3EyeKwH$TwKjEdAjAC6A3IlGhANCdkUFCgvEiw=
6q"NB
#=qo734_kbse$6lTIlwlz6A8A==
#=qYuHUjnyRYHZqCkKAt0jj_9qFBzmTZKte4i1ou04eBWY=
^<@-M
J89^
tLC
_z*&
&TGNuT
#=qjcSlrUNMLgvZWN$58FXdrl22$0OjCpoqksNsslRtIFE=
SocketError
!<x?
[/ @
ResolveEventHandler
NtSetInformationProcess
>BO|
Rr$,T/NwRu
get_Height
#=qQbsDS5g6rYgVt4AUW_pPJ8MQlCJBs7uyF9EY8OKREmQ=
Od yK
xx ab
V&R
3Fds
V%Sh
#=q5MtzoDWNtlkksfPTHs5qXlK2k7ZehKenYzDJQrgdOII=
#=qM4zv780c6Jc3GVu15xhaulIEjuiWD$RKEtosugOXKLA=
[&`* N
"7xM
#=qs1aB65G6$bPi1$cdOrXkCA==
5gUdK>
#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=
/m#+
#=qixBu4j6Hm11f3$mLrzkCcE4AVWtWeNn5nQguwdGbWGg=
NJ@
#=qqj4vWwKBJgvjF_JTc8V9cQ==
#=q0uUZuMiILVbPeB$t7lx1a0Is1IW4CfkB9ovgW99kERQ=
tN\
#=qyNgKOA3iTYvKx8QtBmkDXA==
Version
#=qbbSw65PC$nto6DJiWxTawg==
#=qjVLlQtRAzKVOtyLrw5PhiGVVmXqMJJOsTT5DxaenWCY=
A {+
(E'O:
T4u]
IEQ:
fPPB
#=quO7UmvJ4RBuIIChSn0jx_M$HL4rBuRuRZnNBEMlpsJw=
#=qyM$eq2QFDjIwNzxtrtw3WE5gHFsUOsREqnRunYWzTvs=
I-pkF)
ReadAllBytes
DebuggerStepThroughAttribute
?#Ae
d2(M
;aBr
g3w
#=q4kUEXPi93MnvgzV6ySNPRQ==
#=qvX$J24rI0eJ0gWfA6CEdzVJN7bQN_YTuS98N0yyMYPo=
#=qYpD2x2QTNARNJcnXxG0OjQ==
S$$F[$N
PtrToStructure
-GYtS
#=qA4f0kKyGXTRnU4z03oji_RIPyVnvoC_BRjpESDLHXqY=
Marshal
uf0J
#=qw1t7iX7Q4P$CBQxdhg13BQ==
#=qTAs57ZkYafcLC2FZLCGAiQ==
#=qUDQctXsgw3eGxqcYAxP8MQ==
#=qCKX0qzAtjLAL9KBPrJWkOA==
J$
SEf&A
#=q48p8EJcbwRuSJ9efJfzTZ7uyOBVlFQpnFVv30w93EJA=
Sm_U
#=qZRkZQGrnZUWoFBVE_TP$5Q==
ProcessStartInfo
1^-S
#=qm5VvJvLZD$UcnjvypC5XcA==
G}m*
gE'm5S
r&u2
(Y
3K/At
XaX
XaX
#=qP42Tluk0y5t5VrN_nwVhnaX9baaRq2NaLaW6RMHNX_k=
xuO
ControlFlags
fFJo
OpenProcess
ca X
#=qw42CdKVHw2dycv8VU7DItg==
#=qFgBBonKcV6U3Je0BKZZdAZdyEla0MkDel5SRrEzLUvs=
EndInvoke
- (/
@y%\
IClientApp
#=qRpw30Lh0nfhDryqjhyjikg==
#=qABNlGFDc7nOg_C39swAcLA==
#=qQ_BBkbckkXGbXV1nE4Sw4w==
$5*4
MPu
#=q8McCIarwH$XScVz0xkTmJw==
e4BIK
n|He
#=qjIje6jGWLd2EOkfZXKqBbg==
S{GF4T
EnableVisualStyles
EndOfStreamException
#=qKwlvi80KuDBelBsvucNuhRsqXRtqCfWqVH1dUPmd6_o=
#=qc46h_4WA5z0UkWODs1nwXg==
-*&{c
#=qIKJSaaKraxRzi3AD57FKg9MQkSdmOqUcHNxKjSZFGkg=
#=q74AbaKJhduohKQ4YDrC28g==
Increment
IClientNetwork
V7T
b0Kur
&XU:
4z(uv
#=qiGEsYAsOSz$jy0hyBv5MGPdLIlePpwWMgCE_Abe_mLY=
#=qGqLDylJy8NmMEbMDJmKtoQ==
ngrW}c
xiHi
b|P
#=qyGoc_ssbL9RdagmvuBld1Q==
{v/n
->&~
$z!k#
F&,KL
#=qtRuLPG6CownVXpQS2Jma6EmxR$R$u15FKPRjOSzCUIw=
$Cd$
&*&+
#=qDJ4yS7fCDfIiEVFkwyEE6G3$$73HwRgy2_eKZUkxaSo=
Format
#=qalo3zYdlWWh$dYSx9JnNrw==
;Q*q
#=qqnp3i0xG3gb2LwEmwQLB8NQerATuB2G0aH1k$$26lgk=
u4O2>
#=qYGqPwTlQx5HSyCMpKnJtwO$bA4uyJcKD$pA6WpBamRM=
#=qKraENZVscKMtH4GMIJjzqA==
#=qUbRtqAPcSxRMI51YgNXGZ9omJvV5BvuqBNocgi7xl6Q=
$X3f~
GetDetails
#=qqCUKpKbVq45Cc9OUN5wTXw==
V !*
->&(
AppDomain
#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=
s%dEUK
afeffefeeffe
m[D"(
GetUnderlyingType
wJ-;
f C'9
ThreadExceptionEventArgs
#=qyI9vgsKRXHDyyks4VCAjzA==
get_Assembly
#=qth3CIdKay4zIa5SBJzx7eA==
>$I.
#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=
#=qV4bSY95FY8CPz8U7EzzkRg==
8Hi#
OpenSubKey
IW gndG*
fGEmq{-R
KKzI
#=qsR25pLrAgwps$DwdB_BuUbMipiUFFEDkypROuvRRPj4=
#=qj8dHXOkfX1HmIFktLFgFBNrpDhCGGJk0RPJopDOaBy0=
#=qcDfNIFv7M2KbeeK2ufHf3w==
TextWriter
jHV6
set_LingerState
#=qCN8q7dxuBuds3rgIjZ1oLA==
>!V0.
#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=
#=qG8K0lOrmHWfP2KExoNv$5w==
AssemblyTrademarkAttribute
#=qcfHq18AlWjOy12tBCM8Tbw==
Z{zO
SecurityIdentifier
RebuildHostCache
#=qXzNbY0aXEU2Rr2_Jbe87og==
#=q$6Q_u19FhL$wNOun9AB$CQ==
2F&6
#=qedcCJsW_6aMZb5lO3tR01A==
0txd
#=qM040QWzx1oySCgUyYWc9zA==
!'_
Path
71sG2E
I}"%G
#=qr9m9EjuYAP$2E3p2xadfFhcTH6toAhrm0dlfOTldiWRsdXd8UmnkRkYrV_8$1gaA
ReceiveAsync
uIc5Z/
q3XLSU
#=qHtuZg55b91a614FmHMsOMQ==
h)!?
#=qI2pAr92bRdzddapVaPVhbQ==
Zc/3
#=qrSKFiRrFo6$kUL7kjfG3zg==
#=qJ8bMKCzzllPDbJIfPSoGMA==
Tyi xx_B[
${jP
n.'8
#Blob
Control
#=qgAKbtXqj_idozuy66wPGJA==
#=qTEC8gcgkt672qW159Oe_Iw==
PmcI
LB{7
8wCb
`nEZ
#=qCeF2tfSXulrE0bbyPxU$1ik7Jf3avSO4FKBmKNH9QLg=
#=qbYAYBaHwcEbf1CaxjAi1bw==
Ic?U
) "'
#=q$Rh_ulnlhN$9Zn9n4fKAsvWT9cisaHT_PgvcGANnd6o=
*"#
asv2uG~
ToUInt32
#=qVVQJ$z9bl7kHgfvJohZnMPofzhiFJ4f4yMGK7Tpp6xg=
Q>.n
S@ p
b]dOX
[Mb
ReadSingle
#=qDB62T9X0iP_6WNTXOuwQnA==
#=qp4XZ9Ss3K04S36I$7WhtwQ==
#=q6jLYuOOmC$a9_UySsUlsFA==
c&V/F
Type
f]S^T
, &oh
#=qphSRC1xHjYarc$NSFAVMID1iP8dwbr6BCaxyrkptDP0=
BaseCommand
$ _3
2$m(
-CKk
#=qsYpthruwyrknxFdWaNp9Vw==
#=q$XurN5kwCvUuDGDncP4myluEGVmoB5AfvTb_Ct0PT5c=
jQ0[
#=qraB64nHTnRXCE4d7ffs5aGExarxpEh0COAPaEFI5iV8=
#=q9RHjNFjnLkbqjNKidtUNeAGLmByWXgbKwjLfhcq9NOc=
vBO/!v2
#=qtWaDSiZ3KDHpQtSfxDZV0w==
#=qChXzjuiVYrb8OlqJPajoUA==
tM4V
+ +
wf,`
zeHq
#=qEqEPF0jj3sUIryvQNEKKCV9boaHFZuHXMROqSn28L3g=
mY-3
#=qEk42FAaXkrNIu2TP76IakA==
#=qP_nucp5xdFjeAVWRfZ2XfmvYhkwWbeeu3y2fkxvS0yA=
#=q7uQjJN4fKJgs403tXnERFbQ1VWp3FBsMW_1ZAWZtc1g=
s s
Dz_H
#=q7b0FP8eSMCctHkHIxEb12w==
Item
#=qVqTMYHwCmwUHM6kkpNkbGw==
#=qQRAhbbFlVBfqrgso8zehPg==
"%(L
get_ExecutablePath
h?%9
9feffeeffefe
Char
Lb'>O
ExceptionData
#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=
I6@pU
*&+
"+EP1
-u|A
#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=
(a
get_Name
GetValue
#=q9VIijSO53lpTS2jV37$Suw==
Dho/T
;Mw
\>tn
HashAlgorithm
sUjT[
get_Y
#=qgB3pFGrOVxm7f$sXZD67nQ==
_Lambda$__3
_Lambda$__2
_Lambda$__1
&+: +
_Lambda$__7
_Lambda$__6
_Lambda$__5
_Lambda$__4
#=q3vPs064Rj1jBOLtFVqV4DA==
#=qrPQtMswclvOlK1AxL1S4K8M$owLGUpQfjJA8CWW$fj1az7m8LFibY8IeMxHKi4wi
_Lambda$__9
_Lambda$__8
#=qQKYqF9uhb3QdjdrkvuxjUw==
-! Jo
Y(
<^61(m}
+Rmq
tdkF
#=qyU_gXk4hv73zg3zoSZSLhQ==
y17x
-\TS
#=qRHdMxv5xMrip5nI3eHU3Y52nJ9DhG_ImQVoJh$ooupk=
H}>M
D` 6
05yc
#=qLLh1749MqIyRucx6BFMp7Q==
\eu=<'*
#=q$7KUBFuOZT85iBmKYeGgXQ==
_T0}xK
StandardModuleAttribute
N3`)
Z=y
(rl
#=qeWvkoUO61qxfYbQKV$cOPQ==
#=qAkkjpY6IHZssIsQ9hAxzTw==
y2>'
GetParameters
S)c(
&E*i
wsxh
oy
JI -
3Z+ +
r?b -e
fefefeffe
DialogResult
ToBinary
LogClientMessage
;h>H
sk"_
#hpx}
.text
List`1
#=qj9swjNLNpEBN8mkOlVmrOw==
F>Gh
GetString
#=qAM4ZJ3aDwBm_a3IkqHxLmjdKzHIQbFeE9thLHux2o6g=
O"?[
WindowsPrincipal
Component
LockResource
T @h
~jSqe6C
BuilderSettings
L*u/
x;_5h
,$+
GetDirectoryName
#=qqRc2eOIidDtWq4y7W2lAhSyv$pBRJdAsYlXSRUcwizw=
OZHF
<><s<
#=q$mqGRbJ2J2TNgadoLHYnIQ==
[%?"h
#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L
qi
E`n
get_AddressFamily
N =)=f
-,&~~
#=q6TsObh1LqPbvVPPz_YjbtgEdyXL$082jRqG42$db3nw=
#=qe9p_PgOCiouYWahOSDKth00dr9CdsTb1R3DYgCeLUBw=
#=qrmavK4kbgFTgX3_IUlEoRw==
#=q4X5fhkJm5XS4LlpLIyB6bA==
{id?R
#=qhE2P2k46jiSSjO86g3nB1MkLGC9_3avDpI7iYbUHr5g=
6lR@
#=q9rPQSTp$UBZiTGc7mKlh7h1QvRgfs0p_mQAaIRjRIsQ=
#=q6OqJPhANvYfkdc5uh_IKsUbLoI4zVFCxs4fpu7Vxr_U=
Single
LOuP M
#=q95w9MpaG4ZcgkGgnmQITOdHr5IaLXD8aC6o3EqtE0PQ=
#=qABSlSWKh$8sT$UF4sG_vQMmKqh5lDRXHlL1yCp0W8x0=
lg_~/
DL MG
StackTrace
#=q4P1tyVDbmSIMgskx0BrPh5ZxjoQy0earrulDSsNhpg8=
#=qRbDxNN_CBpjdn11hjtWoZg==
uU;
Monitor
#=qUVvjDZc2eypEDWG9cFZdTg==
ReadInt32
#=qxYJIjuXFTjRvt41we4akdH1WN2nLMpesVOXXsYuSrHM=
#=qsLIORBvLMZm5c5Lb9Cm$GQ==
]<'z
get_Variables
wgP
i;kR
#=qZnbTkU5kDU8O8$hMGiNZlQ==
CreateDirectory
PluginCommand
PipeClosed
* +
StreamWriter
K,T0\
nQ<1
arpc
4N"W
#=q4o4zrrzr7uOw3pySDBOwZtAOdlhvudqcbIbhABkQfe4=
x4@K
lWKhz2
HE^(
)C@D
#=qnk9x1Gmlq5UZ_X95yAl14A==
PG++
OoQqoT
- & +
GetKernelObjectSecurity
3; I
GetCallingAssembly
WaitForExit
twp>`
o/Q3
Tjpd|-
#=qOWs9MBREWujnaIdYgAI1lg==
#=qhv_9OQaSyr5PWElvgkBxFw==
#=qScWgGHvDwJ0da_7qXoO28aGE1ea7zp5$XjEJLTXkuHQ=
System.Net
,>Bf<
Conversions
%7oT
#=qpSjmalSIZ6iBUAWRLBOkQ5sPqtZAetb$LjkOVwAdUac=
NfefeffeefY
!a2w
#=qD3hoTFeBJT$SvX_fQh_aIw==
#=qBk9t7p9S5R095rOkFdE8GQ==
- &&*}
%(L
c><Q
CreateDecryptor
add_FormClosing
#=qArVl3RpI3eEiVf0qXoqrWw==
#=qcDgE7pmQv6niirKxFRMj7Q==
StackFrame
#=qpghRvZG4ZfcsmvAYC$o8qN0WjB387Pn9cG$Y9HJ3uwU=
kernel32.dll
+axX
#=qoT5qP9FYCI8F5V3gKO7eMg==
#=qL2Az2fdQv6DkEBC_x$bbMA==
GetHostEntry
<generated method>)
#=qXyCbQ53pEXrdqhJ6oXoHqg==
Enumerator
#=qlt$K8Ex4tZEPwTl4RuqGMw==
#=qAp_zHqT7acjq$QNiBoq2EA==
#=qfvzoVBS4j9KdxyngOlL_NauqVYLAaOZVw9dutKQSAp4=
>xg
5RwU
DeleteValue
Shutdown
#=q3fzZpU7POi9yYKua762KimE0tXDV2VRrjyJcPuwXgTs=
3i\:C
#=qNdKVs_XU_xYgnUK9ZfVshw==
#=q6FX$JRP_bY_ZCQbx1UwWug==
#=qwSPuuWVW8tz$gDazhda2d$myXXX0Ro_wRP7Rmm8JiiT9wA1EeeaPUV2jnUkQOCHa
E%(L
Rf]4'^
&4dC6
#=qY9NY2gigPsj8X4CYx0UCT2vGlqkgsq6GuC2fWqP3Voc=
I=Su
']mh
#=qOKSmYE47P2z$UXqGETlnfg==
#=q3_xjz98EYRXgLslROl8imQ==
add_ThreadException
MLew
#=qhPbzHXREadcUSl6d6LhVYw==
&+W +
t&XJ
jX
Computer
.!HP(i
#=q$E54nUJeqC5jURP4oCRU9g==
,K+
`g~~
#=qV9UIxiLyaOi7XoTx2DUJwr8Ior26OirSZwM3mOvftrw=
k<c4G'
(^Y)
#=q0msvLo3fKjQ5ucIFxkdur24Cc0tFDGimgcqgtAeKZq8=
#=qh7diH14jww3Fm9rMJ_jIfQ==
#=qo8RCFr_ecPE9NSA5cyD6QQ==
Yd?_
8v,
MnP5
~A
#=qUomzGDQTZY7jASgBmW35Fw==
#=qYiXVlu3YVR5erIxfIIBHo1Gv4y4z4vrtnS$$9CALbVE=
- &&
DW=M
>^5gh"
2R,WJS<
#=q2c1dOwAlqEVK063i13$4Vg==
.QW2
#=q$P4U7B6$qbq6QJ_QX8MfyNoxYRq3foNT$OZzr5yEqDQ=
#=qonMVJIv_P7bZ29oJ_eSSxA==
np%L
1olQ
jI~g
bt5$
#=qH8FTQLBlM6o0t6zf8SLPUg==
FormClosingEventHandler
get_ParameterType
u10vY
#=qQCd2OoCcjOFxsuzhZKv2M7$UnAX8JX19NdffDxgtv3I=
#=qFU5Nq8bBPIPoBGBl$k8ehEhmgSoFzsflrFNnOQsCK6E=
| qs
&}%M
Process
%EgL
#=qWcYPgOJASLG6mRBDPhOIZERKO3Eig2IiEWCrUa$w_Mw=
#=q6oykuAaezoPWCQHwIFBGYQJoT_doGKMmOjpzn6ZJomA=
LK4 ;fq
#=qb$tFKVReqZMI9M678cKWGdlE1UJqJBfHAfOfQhXuW5c=
#=qWNtQAckY3EoQ$HeRpEQ9MEcj4oiFXpw6QZThgsGNZIA=
#=qp7rlpRCprgGh7RCnHteaLw==
Px&&?Mf
H,
'%(L
set_IV
6z[8
#=qFlM8LWSzwV9qMKMd32mVdQ==
}zA'
#=qHauijmh2nJ5kHO6fTYBnJFZKkfzkWt5gB4mYS5OLOVc=
4$0 .{z
NanoCore Client.exe
* o@
* oA
p@Ofv
~Y
w.XT\
,+&
#=q6zjWArzQ8Jv_1waqxSeP8A==
#=qDOdV5duF980CDFSFl8oQpw==
#=qNz_Hz8DMWPqA8pVcg8d0UVymwvCurvyYgdZaMK3OhQE=
#=qYGU8a5KOsYzqpvljkWGWKuQS9mZuJYQa$8g5J6c9rho=
#=qKYm_FHWoJ42y$VrakLgWfw==
UInt16
#=qCgskv3QU4cEy8M7hqvNNBbFyow$DvbmSQrN8A5JJJWs=
Enqueue
#=q_WoKv7McWxMc2YtmbiVaCw==
#=qUZMwlqlTBPLi1iscPEnOdMZqp5jDsQ1UK2Kgux$Yn40=
ZHt,j
#=qrWXrfWfqyzD06oY$LsE9ww==
Gz]7
{PBy
#=qqROT7DfncW7strhZvp0iRQ==
>CAKU
EndPoint
#=qy2xCoaL3Dm6E0MYt7i8x7A==
-G&
#=q4d$NdpGCMcL3TaMlT9EW69FacIvNnqDPMFNisgGhmsY=
#=qkzr_P52_BAWJXliKWvb8Z6oiWEishcUAemTNzwiiwkk=
g$F~
#=qCy_StxaanQioOSGQ9LimCF9_Wy9AMBNKclrIIUI0AWs=
System.IO
#=qQJBwIjtEvP$UD5Stcfj2wASGBDPz6YiX1yXx_MSfzPs=
WrapNonExceptionThrows
get_Now
MRnf
#=q9iu_XWrg9WTOw3hVDQcP8ZcABJLoMYtAY0HfRbaBN24=
(O@X
B%yK
IClientNameObjectCollection
Console
#=q637XAKKKpMW09u9r97v4lg==
#=qszlIp3ITaFi0VCgRIaErNg==
#=q12n1704BGxiT9AoOoTNqog==
afeffeefeffe
#=qscQJIcBkI9VH8bZTZtABeA==
RU u
cgbN
!2]
#=qWsAxoahmYzeECOO4WB9kTg==
,@&(\
#=qpE_mRkS89WMXbQTdLD7bwp4pTt2zrWY_WBF1BLz1fes=
- &(,
#=qaSWqhswYp72H_CatHelXxw==
/I.j
#=qU1g6m1CiJ5yzLECox1hBrw==
#=qvA35ZDPTM3VgF89oJb9AmWFE4pqnIDYGjeV5H4uvblU=
- &(?
#=qPgHNba2TbLgSqrCvG0e5Uw==
k'!kF
7 |1
?.X0
STAThreadAttribute
SffeeffefeYa*&+
+ }
, + +
-\&~]
#=q37jfceDpvm0BhKQMkpktNw==
Y 4z
ClientSettingChanged
,B9Y
#=qTfMnD_jfiITiB95ES2nWdLlDTdGOSDVgXEnjKNGkWcM=
_Byp
#=q_$06eDx4N3eSJzkchUhbnjKtHnRsckM7I4ZqcwfQO8E=
!/Bu
%V0.
GetConstructors
GetBlockHash
QwQW
#=qf3c4WtE$$thN5QyBMvo3u0lth2VF5hmfUsIv1r8yRkg=
OL@^
#H mD
#=qksh921Ur22JKhSIAXESSag==
#=q2gthvB62n07fYVTx5fwIqxBAo1t_hs$il9Ac$4FY_Gw=
#=qxG1wJpkOHyc4AD8gtAdxAA==
r
n{Ga-
,++ +
-j&&
System
EventArgs
Application
l d
-4Nj
t/9;[
` ^9V
TransformBlock
X2a2
9,"}
#=qdzx0nDkNduYsJ$MOZBFb6jelzyvbyiG7So1vqpZnVLU=
E 7W
$f15bad7e-e392-4e6a-bfd9-d59f09e0b50e
- ~:
#=q_UogavoS8ANyZp2cF0B9t7qG1b3QUqGTYeTlmQIKxqY=
,3~?
#=qDt_4RPbN$YmUyKsVRrbzrjU6uaXWwjHkaZoJAcuFCCs=
#=qQLqXliLS$ujl108DGV7$zv9jo8WyYr7oxBJvAgzllyk=
Ul$!
SA-(
ClientLoaderForm.resources
#=q_jQLaNdtSDa6ovA0VGw50w==
5.No
u]M%
#=q7_KHECinDx5vq1IBX7p8Ow==
( . 4 9 > C ] i
(3{|
#=qAfx0INrfgWoPN$Cz4VEZYVFcKNxFeYaixc4CaQpU$0g=
av1
#=q5hEV9yBEvglIR94FFM9OBszK4aiazrmJrQshba2kpDY=
#=qAk5SEnvr6iWKzWTaOapTEA_BFwuNkz68xuZLTnuQOh4=
p:JUb^x[j>J 3Y
ToByteArray
#=qQtwc_i6uv63Hs$aOrPLxrMU9lMXbhRW79NANZrRxozw=
- ~J
DnsRecord
jjkof
MethodBase
#Strings
mR;
#=qxLboOdsVFLmyLD939$tUsnUMYRMeFnzOLiWxQdY7sdc=
#=qFBEI0HItLMNpyOY0AgRxSg==
System.Collections
#=q1abXKhVCyzVldE9ra9z81A==
<38l
#=qtLsfqPVQ47D3cdxmiwAJAQ==
_x^9b
iuGp
#=qyow7wBpiCNNIoap9jI9L3Q==
#=qrcOHnfaYxPMN2$QaNhNmcA==
i^O(4
#=qrXs2l$bWJlHMZLHncLNYyw==
#=qXuSOL4ETByiwdARI_Ds0Cg==
-"&~k
#=qlFQRS6FW1ex39P1F_VW7Eg==
#=qhYMTmNdkO7UsEcfduWinsQ==
#=q_gCP8hm5SSW7J$3R7xJuSA==
NanoCore.ClientPluginHost
#=qwogjI4gN1imp1VeWLroXTk41PgYeLQ34zunh6NYu_3g=
Environment
RegQueryValueEx
#=qxO41EOA8VDczxcMMPD9Hv85pbiPnTbukmYyDI5Z6X8A=
s#<&
#=qWFUoT0l6elO8yn$hIYUL6Q==
2D*
#=qF4e058OW__NtTzhWOs1UXEJiHrTSwnIZ3q2u9UaLbo49AZaoog8nMfoDeA9BGVvy
#=qbLBIoIXYNfJl3x9LHqBWNA==
#=q5$hUSQAZNmEXcUcvGVFJrlqtw6IWJBy6C7LN$kOmTWU=
.# G'
EFo~nts
[h :i
#=qGfiJ4oSCDzJJaNmf22anQw==
\-}w
#=qlMIFeU84lweg5Ul5iSg2vZUvNnPKw11XA1pEUQfzDeg=
#=qkgpjO3I2rdg6Il4nyqzgDw==
feffeeffeef
X'@%p
#d:V3
#=qdy_NHDvN7XTcQtWWMYxYKbuJqtXHsYJXM_YUEvVR0bc=
X.$ i
Ar`PpB
Decimal
S 1dZ
#=qfkwtPDg_wfxGVFOXd$WnCA==
#=q2nHH3haw3R0VWVw4qHOwKw==
DLqY
a,^L
#=qWBzgr2CJEoV4DPIbUzdZZA==
& N.
#=qnDLRD4lBlfyGeJyuSeq2WA==
#=qOsVShdMttD8jGLf8zW9G7g==
ffeeffefeefa ~a
#=q2wxuRKC7TyzyevfrmeuJ$w==
'4V
get_Position
#=q7YEFsRA19ZrxKTBeL$y0fg==
GetType
#=qbOmsEb0zGpdZukI0D4Idug==
g< X!
#=q0yJsLo0aFpSu9ky8R9f$lw==
#=qZuX180bPJwK7MhIsqenk34Le3ZCQFFLgmBb4sMlYIpg=
#=qwWiTcboLi4zF4ycKWLBprqWhuc6ZDNNDjC8OE8DG1$c=
@S8s
add_AssemblyResolve
#=qU_UZ3uhfwWgI9uBw5HT3xA==
SV}*
ThreadStaticAttribute
Y A=x
D=SS
c"@E.P
c4um
+kW
#=qRkk_hj7p4gbUu59IVllqeQ==
Activator
&+? +
7@{f
#=qVHGoZQC06Wdz1fJDKkoeiKu9aci51znqNtMz8dGZQMQ=
$ 1o
@(ex
oSp0
F<Q:
u+T$*i
d;\{!
)FX>
:z6b
eMS/
#=qFWCMyHOrl7QbIPkMYdiWJg==
#=qoKX_5NDx$uDAqG3r2Qdnaw==
#=qJEtGIBRUjtEusa67yMyqWQ==
qv;{pXb
#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=
#=qyc0YQPNqWwZHkgNDV8lyIQfgMkEbGZtyDsLzhYmFp8w=
Double
ReadBoolean
'} .H
ProjectData
set_Position
4#,n
AddMinutes
ClientUninstalling
#=qd7oUKLFPI9nt8Ln7RU53xA==
#=qWkPc$uBFgJrhuimjKXkFcw==
{OzV
#=qZhds7a6Pui$KE4m8ht8xuA==
Intern
MD5CryptoServiceProvider
cBOZ
8.0.0.0
w @"
#=qNc0O1YGwS4NhcbB7sgpVgg==
@c] J
#=qoTZi9XCxEGJXLELWnV3yfQ==
&mrP
lB4~
A:}j
#=q6uR3lWd6_aD2reKUDlx$OA==
.XtSV
c th
#=qvLrEXVjSw17e3P6GFPALhrZXcKcfxuk0NupQhKFf0VM=
get_UTF8
#=q3qYAJGveL_cxux6_2m4Vaw==
#=qGvpT_A2MS3Oi797y6jojBg==
+d~,
set_WindowStyle
GetProcessImageFileName
): >
#=qruARjy_8oZkz3lsHPGxBMA==
SocketAsyncEventArgs
get_CurrentDirectory
#=qq2h0VNJ4eWuHP5LphH0mpA==
#=qHU4s4cJ8BUWy$MQH9LPGxTniDgLcWFlt1CmhZ7PNRWA=
z+L=
[+_d
kG6g%P`
R^x9
S0hb
#=qa3EpMqO3KVCTrDUnetWt6fRbeWox1uN3vfSP5v_W_wc=
+] ]
Socket
#=qF7qP$SJNVn6Q0z6ARFaJgM2aiYbkFhrfYn4Rl6Odj3I=
get_BinaryLength
KCX+
[nL\dR
(oHA
#=q$XxqrIH7dyYqacMzR_CjGA5JAR0vUKiq1f0DFqS1mcI=
#=q0xixHwSTS$a9x5dtNZccvebVLuO4euYOepae9m2S64s=
b9aP
|>.$
\8]^|'
mxY[
,)~9
-<&~C
UnhandledExceptionEventArgs
#=qek1Oy3FoZ8ULt6r5iL2pEQ==
(-4Z
VUl3E
v1By
7]rJ
#=qjM89gxwDLZ9izFxrYPCtcA==
#=qZb1TYPPMMY64aTN2MpcGOQ==
#=q5j3wvJXlnrGmRnKUHr_1SQ==
#=qRNkKSXdFDcR_p8Jbzx9WJQ==
#=qdw5QBoXX8FR0LrkjhWN3qw==
jya#Ga
-%&
#=q8NzetUGGc1cM4ZGyRGGlug$fKAOwmcPqe4nFzDGKLk0=
#=qay$wDBdxvh$MBWrC9YMhC_f55kIvkv7I_BjPu_7Ajsw=
#=qRtpaHvp1hQcEDS$UubP_mA==
#=qCPeeDj1tZ3_XePWJJx7FTlBzWHbtSGvCe1Je6nRznW0=
ntdll.dll
HlV'
FdlvK
[SZB+T*
-%&&
Form
#=qkbMW3ViV2G4xkJU4KS4XYUwKzC$oNmhjZ49L9c8BrOM=
cYE;!
get_ExitCode
MQC`
#=qi6IJz6lHhd8GI6qygHcvTxSTD2wk_BSYwC2NR2eR0yg=
#=qJ2Bo_iSk1Tt7sQHk7C2ESQ==
#=q6wR5WMLGkL9afTpqmWsw9g==
#=qulZN_JfMbEqc2jFbEooALI6mh8tLy9$3NFedHEXAIAw=
#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK
-'&
set_AutoFlush
jyJd
#=qBcRYABJptno3$fpXoMXAvg==
]s@4UI
CreateInstance
3c92%
SetBuffer
#=qLYpbsprg$ymVLeNEwEpYlA==
CreatePipe
&%(L
r2uV
Delegate
NJ@
NJ]+
AssemblyName
#=qSh9$w8INPkos7acCjV2yFw==
#=qkFwCVmJ2HhZ6r$uKeVZFFfVLdddj$WEInl9bSgbErDM=
#=qmzYu_D9f4dvUPauEaU7zvyNjCyGp_73Xn5SffrcfQAU=
#=qWljP9Wu9miiHAG26c_L7NQ==
ParameterInfo
-'&~
p{N~\c<i}+ ?
#=q0f150kYsIx0s3raR3xq1xQ==
,%~B
:\~/
#=qg61MaViIt3ErBjuA0N9Xrw==
get_Unicode
ZBRY
#=qhz4yMg0WDLwu3BJp4fYr0w==
)rkP
-*& r
j_P<bc
=k?uy
TY
#=q9LcncGbDdZaeonfU3943IQ==
#=qJe4Aop6J2k_bK0f$hS3ZOQ==
AssemblyCompanyAttribute
#=q6odj$nz79NlWTFUK6$Vbrw==
x"zp
- &~
)%(L
#=qDwymJFr9Z$8uhJ6g7so5xw==
#=qiJXCsKWBF9DB88uzW4b92A==
Enum
W_H:
DebuggerDisplayAttribute
ParamArrayAttribute
get_Day
. (A
Restart
GetTypes
SaRp>
1lJ#
ReadInt16
&Fy-
|JB+
#=qJZLeQthAfpiCw0QvZb7htA==
5"X{P
#=qVIikDYmLtr_O$2vZcqLhHA==
*i#&
a ]#]!3?W9
#=q2JCFpXLqGkqf10Rox8zrAg==
psapi.dll
get_Length
ProtocolType
Sleep
)%Gy
q?u?I
MaxValue
DESCryptoServiceProvider
#=qMMPHzLKw8_cOGV193acukw==
#=qsUdW_kbiEct8_uosknsYUQ==
/-+ +
#=qXIsqrB8Mw2TMQ5$s7oRSIQ==
#=qQoUfP$jAQrKMjDuqm54QmA==
$9&3Z
a/ p
#=qyxpfolLUhMvFTDE2h_syvQ==
-I&
-+&
h{" &
u]:7
-7& E
#=qEnv9WsExz6baZJKRUDupw9eEQbgJVjj69NjcsJ7hrBk=
-)&oN
Contains
, + +
J,
fefefeffeXa
#=qRxR4aJg8TX8oM$OpeoviZQ==
wG]fR
iWbV:
)Bew
bD%T
#=qsqmAgLqQh_pOiJq5Mcf5Ii66zl6iLnAX8VtqTy$uxhY=
#=qe99VPFgyNENK$KtARK_iPuwvOEw_NRgC00PdG55dmGA=
\AsF
#=qN1bIi$08taNozgdgDWdXVA==
ValueType
System.CodeDom.Compiler
GuidAttribute
#=q9rN$wEdl9rzJbAMMIiemCg==
- &sA
MFv {ET
#=qlIUFl2SBYSRov3A1WGimWQ==
$% 1L9-
#=qFm7s8q151MPpLODhzLizPw==
&w<^
ToLower
L//g
aJ\:
PipeExists
pyjg
#=qVEEdpD96A48uRzPJT7G_w60gIZo4tH1_e21GoRWPFm8=
get_Port
#=qxb6WVOMh6wjcZFY_Q0MJOQ==
get_Count
T}cA
Trim
GetTempFileName
.pzC
#=q752iy7NeRDzz3UAYRlXXfQ==
O'qzBhw
#=qikBX_CmS$ZzVAuq$nQJBDwmLm5Gee1iPlPuvI188Ejo=
_ohY
m-=_
#=qCaHpjtavBmCU_o5x0kJsKA==
FZ{o(
#=q6ARXRSe2PbSpq5u4_c1Rsw==
! Ms
#=qHJMw55fNEVIiKcc4ry0o7_L9hyz3vS4jgKl3KMX8xGg=
]^'1wK[
hq
, ~s
SocketException
#=q3$9MQ9O56ldzMJGDeTdBZw==
#=qrJaovDbn6146mBrhFbUMbw==
|S 2
#=q$jOt_Qd3idEY2i2z8zIong==
#=q$yU7aYEYOl8Nz4sJLGQQ6w==
#=qM_mpCWjOCBlruGH_QcTQHocD7LUJCLuKe8ntf2VtQlk=
#=qxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecU=
jn=y
#=qDH4GuNn5iW6RFhEPrfs$pQ==
DNDg
#=qsUsGxFgC$BJaO_$VAtZ1Ug==
#=quXVzKqGldmgtXgVm61aLog==
#=q8GRQigucU81Rfg9VpK7PVLcjulhhYVPijYKMm9N3PJs=
#=qstAyOBsDsJqFRKDvXIn01A==
k[he5
]zl}
oM~{1,
UInt32
f (
StartsWith
V*k9
!\%
get_Version
set_CurrentDirectory
#=qvQfNpqhSbw_$p1TB3UFgJA==
ToString
#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs=
Wve6Y
=iv\
QAID
.9&)
#=qWbDVCvJRlY$nWsVAToK13K8LD9gZFcJQAtBUvjDEcyo=
Utils
#=qbwvWShVSL8DgrXXfPQ9kNmpf6pmcj6q57bPfcsBp938=
#=qZFVU$VkNPSWYii2AVQe6c6mwAUd10Tgqkl1$K5gZz9Y=
#=qFYv4oSsEFno3Ujev9_o4Hg==
#=qGxD085Z3RQaUY4iGwWH$xgEmRYVWDAN6hxNjaXokfVc=
#=q1vWrLhskrN4OoWzxKuDDSQ==
TryParse
Y k9
JYfd
ReadString
pI<3y
-!& 4'
#=q1t2nN1p2nWkytA1wjQ32JyClWcTGIZMOEV9XOIYf1xQ=
Cy:@i
add_UnhandledException
#=qnB6QgyVNIUL$Uq0GD3p5d7LpaFZvHrB3jSqhv3o7qlE=
+( +
Lp$B
get_Hash
ClearProjectError
#=qZiHVbt3FXowK6_NIyOxsOw==
#=qdPDxrK7XRQZlwY8QeW6oe0AEoOr3qND_WVi1o6l48tc=
FH:BE
#=qdwmMObmoGgv5eEpelZDrHiipw5mUgryufdcXXig375Q=
t1}q
Yaa*&+
#=qCQ9vY8iVniiFr_C0wuoMFHQgjJIll0MjoDGXuPo1hYk=
DebuggerHiddenAttribute
get_UserName
#=q8FSwXWaEOgeGW7OlBosSfg==
#=q_kGyEn8KrmBmt5M1N9cUSg==
Connected
ICryptoTransform
LeaveDebugMode
z&th{
<*nR
J[i6
UXMm
1qI E
b`*&+
PipeCreated
#=qkWUjAoA_6r2E7qo6NAGuIBq3iKikqBJbioTC25CcZQY=
AssemblyTitleAttribute
,DlM
;6$)S>
Aqm ?
#=q$njopRrPblqe$yrs$rsu5Q==
-3;-
KF3
2/bKQ
w=Hc
)e/m
#=qJqkjp9g96yoxpNS2E$BC00FKleto7dZfN9N5mtLDF4g=
#=qd4_A7Y1qGQ8QAgHfK8_ssQ==
CompareString
#=qmbdg4P9$2ouafwS8nEs4lA==
System.Security.Cryptography
;En
Create__Instance__
MemberInfo
'jN+
# P)?
ConstructorInfo
f}D@}
@1N(s
Start
#=qjYgYU6Lnx_W1ikVtBmjm3w==
Combine
#=qukf_DyAYprvhLsdhT4CGuA==
-l&~s
Q]'rW
r*+a ~a
ac~#~
#=qaPkEKJmdD7BgG18R0WsnHA==
#=qtcl57G6kPr7DDYeWeY389w==
e$oKLB
}-P=
#=qChHxg92yH05lHO0u7UrDcPo$UK1nFXIjb2DI3pyR0FE=
+Dj]
#=qnonybcfG2jzQ4kHK5lGw3g==
TdmAc
#=qEIPcndOLrV2GJmno7zKtBA==
#=qtz1ayBjdbHAw$ecbWtEnYJXs5RBd798kqoBvIJunFxc=
add_Shown
#=qCA$7lFkUlfYTBh0Hp6uY4w==
#=qVQoZlgR59_v4NYIa4CBPQw==
#=qlzCbqLxFuzycCPDZStFfAA==
~V \
#=q8Bp27fhtrXMmonNxf$9qLbuQQehIBQTdOPDQw07FUyI=
get_CurrentDomain
Data
TLC
#=qgW$Sn0ALOASuZcEZHxiZDaj3mNXTljqLa5onSc7M0U0=
RegistryKey
o:N l OpA
A *{
#=q3p_D2U81K1hW2D54P32yDw==
GetFolderPath
#=qKaOsg8ghd7KyYDCm3RhDg9KJrf7McwaH92TdOJzSw6s=
V"o"
feffefefe_-
ZRyR
ConnectAsync
Client
Int64
#=qoa807UEkAFejsz9ub3crU9Uahxxj5JIyAtKhnrEn$dU=
#=qwNkTTorgPauZQTT6jiqLIA==
k_%H
"E9E
69fI~
3+Nw
wm7m
~:}ew`
JO:u
/Ou/I
_q*Si3ZV_f
.ctor
oH
|*V"dQ
#=qU_ZXXWlv_8PtJY9coDWiH8$dVbE9S$EoqFVRvxhPtE8=
kPl%
, &os
#=qWszclzYrfU2ikD2Jo7BLiQ==
ua#A|
mscoree.dll
CommonAcl
1uRl
pQQ>
CommonAce
#=qru2ORBLxmt_CUDya_FEQGA==
"f66
#=qd7RJPnCy4YddvoQeTJhlwA==
y<o>]C
#=qfPf03rjJVGFkLtYSr7zDRw==
#=qecBuZmXKFD$jZa5T0d0L1w==
NwB"
3x$K
NanoCore
#=qREZQml1AE$F8eb3teEaUmQ==
+g"k
#=qr5qpvOPnLxLp6aGkfAM7wQ==
Invoke
&+U +
#=q0U3u45cUl83Kicjfx0RmVA==
_)mN5]D
#=qs4p7qYamgHyRCYZsTKM03Q==
#=quOBOxPeAl_kjKKx$REI6dA==
(
hR!Z
#=qRvcNy1bY28C6xYdCX8MF7w==
- &&
KlKNh)
#=qP5B75c4g32E_HsewCKc$Ig==
#=qRxKU0X3UfYwXoOTtDpEVW6z4XRgE1s4V5zOQsfCCSqM=
* 8|
#=qhRDMBTieg0MID1DJ88eKUA==
~VQ]y
=SpIL
Ac4Y
x.fo
se9E
#=qgN8fDYnB$J$X9QGGYQsYuvA6BpDT4GE_ca7JiOh661Q=
+kR
#=qeMVJwq86lZc4hsNJNMQJVYiQqG94mfqhBGc9gH9UUgM=
Myh<
}K"vfw
+,~^
#=qN6ip4UNq3TKArPG3ZZy$zw==
}%Uk
-4&{c
get_SocketError
#=qkrqC_kLD0I$zOgfqD$aGaA==
Array
u.an
)FyD
#=qsY8nKQa1iMT2g$sVoLy8u9jrLGP9DMATpaFjFx3wjNU=
!f9vR
#=qZbWC$V5YeersjeRitYkSUw==
-Nv.G8
, &8
#=qCeJ_QwVb__fbuEImkTXwSg==
#=qtussAh$DpHFmu7sm9TXJyZsrjeJ6Xm9c2y22v4wQG2s=
op_Subtraction
#=qOplsUBML8x2xteEBilOycw==
< 2T
#=q$fGRvwQxjFKeY$SH10p0pyPTU$R77VMKr3CcLFQeQ2Y=
&&_3
#=qDJ0VTVPWfAWYghKX_DdnsQ==
pxSg
P$=$
nc(:
EntryExists
#=qvRKdouixzy3mopZ1VtjZRIxbtiSW2GAGLD$37iVLn9U=
}@kB
BR 6
AKj
#=q5W7RemVArrFCeEyFuvU4Hg==
,!+ +
WriteAllText
SpecialFolder
Byte
get_Chars
#=qxp6ct4JGLaMDbwg6fkrIEw==
#=qovc0J7K6b9Eq_C0K46rbmg==
][rE
k}$0
b?,t
=s({G
MoveNext
#=qwHAjqAoc2lT8vaebbsWerg==
2+qG
get_MetadataToken
s*%Twk
get_ExceptionObject
#=qB8Wn1MJrSNWupWDx0sYcAQ==
^Q].
#=qzB1OZ89gRpxcPckUn_afNY2d0beSpEyl40_4IarIxzM=
v@}p
!K/f
System.Diagnostics
#=qh42qYul4hj$aa5mluadvLA==
?+!B
RegOpenKeyEx
rqy(x
dM2B
\}1
#=qeXI2ChPq1TaKaY8cTwWe4uWAyXSGUqAWxM21uH$6gYc=
,KHe(We
Z7z
\q?Th
#=qnDc3CmkCB1QeN2dXbmqV1Q==
vU2W
`xn0
BcuNB
Ctah1
~~%R
o"s/
q1c]
-oI@
^CM0y
sh%q
#=q9M64o5ghSlB001vxhTt2kVIQeNtcHtzTvRgoYr2$PVs=
1r i
#R!
MessageBox
Y@5\
`%,h}
J8XK
TimerCallback
S (
wHx%>
#=qi3LnKomYQ5KrkAbxbJpKCg==
_)hE
#=q0REOJwjO1qsE01G_RQE1TQ==
AddHostEntry
V b7
-Qb#
7$lia
#=qzI8efPARogp2CZcGB2UtfAz2tJs0A4fM9fKvuTKYqi8=
#=qO4hvdkAW0_yOcwEk_VD$lw==
t ="
SendAsync
#=qDEcM8KorEdChS9luywSNQA==
Z+^v"u
#=qtT$P2Bo4VHFu60OU4VLf1H20c7M2DlURuyfb_XJDYaM=
Directory
#=q2V8VN1ZqnXOBhkZZr6w3VA==
ua ~U
Uninstall
"AS
#=qFlfDskRbjMOXZPvSw2W2UA==
Rq0
-tuh
5 :<
get_FullName
ConsoleApplicationBase
%00nX O
#=q1kCP32T3CbXwL6JS3UekkltOicB4KjO4W45iMQoNvNk=
#=qJrzYsTPKAwT$ubz_aq99mw==
}!xR
#=qu0EIqDRT_HlTe4PqaMKdozL1lQ0SgTtqFucuF2vFq50=
get_Item
ReadUInt64
#=qxQTn_t1ZFKKNm77mQ5vH9cInicm2Cv9jGtv9vmIpksI=
RegCloseKey
2Ak I
A)i`l
-2&~}
FileStream
h]p
#=qxe_BfLLMHqYa_KBeLsRfpw==
/EjC
XS 3v\
$%(L
-!&o/
ffefeeffefea(
#=qRUXz_3fP21juNHWjDYL16Q==
,$&s:
#=qxHMqkcY5ri8Rsxs7KCJ8ww==
s<_K
set_CreateNoWindow
Y 8
{$}
Assembly
<4<i{
w{Pq
w":;
ClientLoaderForm
#=qA$TQXn2i$KwpdqxTX6vvVw==
-3& (a
#=qfHad4tglpNfnMqZ6nFkPPA==
-,&~C
2./i
B e{
r,Y_
#=qgBCfMYp3J4fCYU13EId5uw==
^m_\
#=qZ8pysPk74rQ5GX0s5CkOJQ==
T9[=1
#=qwrVB2mw7gzmYRanSJvSoPg==
K4ki
#=qK7tJUw5nsLE_rt2JHgqYI6_vH0s$mFFB1QifRuMCr34=
SocketAsyncOperation
8Ti^K
Dequeue
j)Bw
#=qafzQcMCK0eVSctI0IcD2PA==
#=qEQtWieYw8BPdEE4hbsjTLrq$BwGjJOBoaDYJmV9xVgE=
v_/`
-&+
WindowsIdentity
mp%{=M
#=qEbf5uxiH92v$7mL0TnmsnA==
#=q5OunwTi_tYTGCTkAtZ8rARxlhmXbFcAf_e1GiEt$FEA=
[=/p
#=qsA8D04owIGYHILF6yPa43A==
LsbN
^nA)C
#=qzjMBSDJWeEdkUWCBxYatrQ==
Size
kacM
-'&~C
/@Rw"n!
^Ds>
{x!#
WindowsBuiltInRole
)Udn'
#=qEqBb19ZxrWpMC8pwAc1v$Q==
#=qpNR_LpdLu_eSOZVgxbr8UFRlKjbiBX7LOuGAbGS07mXUJI3AAilu14uPN_kfaTpW
-?(R
fefefeffeefa
#=qw9FR63zXVj$omVnwg0u37A==
#=qnY1InNbQmfgiJXdGVH6rvQ==
F$ a
oy
22P@
#=q5WXECfTJPQIQ2JoJDGsf9pTFKCPzQGp3$QlyT_g_ZCY=
" uq
Void
#=q66hvvPDVbMv$MYStXtnb6Q==
(p?-
#=qQR2R27CtTwLSuNC54_JY1g==
H$#\?
)4S
- &&*}b
HvF"
_E(8
- &~{
#=qpXfSNxR7J3tqOHyqT6s_Aw==
Resize
#=qP3lBpu0cs5q3Lf$qXSL7q6szA7E5M9NqMzkAFV6l4CI=
#=q1uJdtbJoEKhZjOld7SeHjw==
7u8U
Clear
#=qAySeqCaPs9tWWTa_P8M4Zg==
k3 q
#=qeAvM9D2ZXEFg7Zo1J5PeVA==
#=qr6ouJTA2RwDm_3Z$eUP6TCvbpSA$yAFGnut7D4kG2$I=
tL99}
Z U]
TNNo
mJ=/
ymTmRl
qTb>h
B (
-IUU
GetCustomAttributes
#=q6W8MK4LKkww2JvseikWqeA==
}JPv8
#=qnaTZqk95Z1a8JBLdKiF8aw==
/np^
- &&*}&
- &&*}(
IPHostEntry
dd<U
#=qqLNJOrQl$9SirTNF5ZKaLA==
#=qClMnNCTDhIIGUYHmdm$xCQ==
#=qYQagvH1k4NeWsCidwFRb$sQTZXPGouROQfmoImiPGDo=
+"
hgx.
D}_)
BE{%
5 r
ReadBlockData
:8;<
trr1[
#=qOicuy1VnndMMXIrDqqx3EA==
$ y
IClientDataHost
h5r~
{:8m
Qs[3
#=qIrsTmpVUMRgxokIHlpGfmLtKeqxo7vQsjSkKUKFpH4k=
#=qDx8yS5wU6EQSawGC841xnw==
#=qJBJs_Q6YmbNTnGoWFx0s8w==
BU^1
/Vd 1T
DeflateStream
IPAddress
Change
HRB/
ToLongDateString
2CW7
#=qyMcWoZuG7jRWeztMnp6fPmxxmqfVgP7DLzGs7HeF4Mo=
_lbACU
"o&\vN:(
a{$=V?'
LB'i
YV= J
#=q4rZJEBSRFNm6PYOH7NOLUg==
#=q65znFg0_234nfnhL4I8yRSIMDpdjAosbzeDfyRZVW08=
#=qmuy0ee0GJl13ksvWRbOSbofOCTPf0dv0HYdjJq9H_Es=
#=q8SIEDcn4WoT9RcZmFK9tzQ==
(8j'
"~5Q
+,k&
RuntimeCompatibilityAttribute
#=qP05CRmbt2pJg10eRU50wu1vx$mfteEn$pCn9SEbehP8=
GetExecutingAssembly
#=qTKJrybVS3pgV4uZ4KNtp3g==
,GPd.
7GA"
#=qNQZrJgmZwpZh_4yrtaf9Gg==
#=q2X26s_rFZ25AY$hOcf_6zA==
( *I
#=q0PMcXQJxcLLr1sYO0fpyhPjUwjQtInL_vJPQSgCsfio=
#=q8nWzev5go3NKhN5Gk9NzTmM91eKwrK00n3U6GWmH8Kc=
"~@]@2g
1L}Z
#=qXjNBjXFhVcOvrRAG8alfq96_gJ4jOa0wwNOaztY3QjLWnMT6wXGDzBnHuUkef5N0
Y +# S&
#=qpXMe_UDgWsOaRVi$02jxzg==
?F^A
#=qXkgpfghvTKDZGlXBGI4x9veQO4JfjF7GW2ECw9$L3EvyKZGOnziwXE2Xr1EkpRwe
#=qb0tmyILenEyH_R9DXJFwB5rGNfkKkR0Y5sGtBRsV3YE=
dnsapi.dll
jb+i
U}Kr
#=qCSC3Khfzx9$ef45TjPThpcJgh1Y2yjEovdFzCbywzqU=
#=qGWcF1$SkVAOkK9Bjc82XDg==
ArgumentException
HE]w%
5L^oB'
=8|&Z
-/&~J
#=qfsxP7vyadqL93mAkiQXr1tsUC0B$7Gp0ZNAPpjNxIG0=
S9B
MyGroupCollectionAttribute
~}
.hapux
#=qy_aVo5ze7CCnCYXCQvhVBg==
~s
#=qCSH0DtnYKogitTpLw_M85GR1jr6BVuF$16hm8cfUYWw=
#VKa{
Dhyw
#=qhPT6K66KztLE5cE8YZMEsw==
#=qmLTtz8OEDrkzFTzYkI_Dg1dvKwiGw9blNcZSU_QqMsg=
ConnectDone
#=qbn24Ox5i732BM_T_R4Q3RtK1pEoSIYmxE9Rba9DDKEA=
MessageBoxOptions
#=qhwyNa_lhtuoyuJK5j3BcF4xu5fY5XhFlgzkM1Cgy6IA=
/c}f
G3feffefefe
#=qA5pFz5LZPgfUa5zon4beRA==
ReadBytes
5L+'
fTPy
#=qjAD5jc_8Kg9x$NoAqFAvpA==
Interlocked
#=qGCYL9FviWCrv0prWZC8VfgL34V_6XyB$buFX2LkjbCg=
#=qwVGSEK8LoRuNWEOYfq8$hq39mmxHzM3pIeoRef7XNt8=
-Z!N
GetCurrent
SendToServer
feffefefeY
#=qrYH2MBQ1J6Wu3hhoHHVW0JQwxTYC8hYBTLbQIYHNBds=
AssemblyCopyrightAttribute
#=qKqE6jaRKu5jJvHl8RwywXQDv4h_f2ISEaHK__Drdd$M=
#=qnOTCmwQWr6BtiNf9ta8BJg==
~,
#=q$sTc1AZMnHRC7q_PL2hWs4JIEJoo88_IAFcWtrdNt$4=
#=qrzlCozsOJIqLxGzoulKftCL7kUWSuMYFdc1ca_yCcBA=
o*}w
, &&
0\t3
^Ky-5
#=qcMb6hxBpdyTwCjvpzaQcC5dS3wbplPqOta7ERz_lMIo=
|l}fc
get_IsDisposed
ClosePipe
vsu~S
.c4WE
zg5}y
k xV>
#=qVl3h61LTPSW_ew_st_OlTAm7x_6Xu4hQK$pi2fSiEIs=
#=qYfWGXuhZd0cmWjiCvW2EPw==
N]r!
ClientPlugin
FCDC
#=qK$702nkzQ4rQ0lJLQZ2zaw==
Operators
B>1m/
- &(a
OEI
je=dU
#=q1r$Sd9Acbw6KsKv_F9uYTPvvGAfiEwUnai9OGYAUQBg=
#=qRxyF5FV01AHvUkR3BeX8OA==
#=qAoRzrFi9HiHjyPL0ixkVXA==
)L6gc
DeleteFile
#=qOR7qPTYp9qHTyadzUKgUYg==
%%(;M
-&&s9
6_A-
#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q
T@V@
(#*Xs
#=qIe49uN8SyHwjwKdv9N2r$A==
#=qO7YVPb8fjfyGw81pHcJjnw==
k~u
LingerOption
Adu=
7=~<
B6C>
#=q3S7bY847GmpPliI1m7tZaAVifJNdeHclZJyeY2JTxN8=
u1$o
IndexOf
#=qSJAMGBE37IZjr90jS4_MYNWNa1$s8PXhOErbnAhK_ZI=
#=qwyLCYYp4MoTtTA6T$fEOIg==
#=qpQiSeXaCc6qGNX49vDbcMYyzv_UpV$YoUyrH0l6FW6Q=
Close
` Q]_
74\
_x+ FD
&+` +
_&_
#u7
%M2*
#=qYhk_OkZkBWola80M6EUqow==
IClientReadOnlyNameObjectCollection
#=qQkx1bBZns8hPde7$PcvfUl2fAairj6t_H8ve7nJO2s3BIB3t7PXd4ZR9h0JHyxrX
#=qEn9Mtg$AIqWbq3whj1y5N12e3KXi_NwIIcl2i$FXNSk=
#=qZvjD49iuetyLKBIiF$ZmjA==
sOJr
#=q_$JrmDHg2uq9s8cQVRi8Jw==
Read
4zxX>
#=qTSoRMaNGYiiBNK9Yfq59T$2z3sNScYh9uxoeWlhnD_A=
XVPv
B26[w
#=qdupfYLPCEHNi$xwR52i0Lw==
V!V
.Q-I
Mm=6
-O&~r
Delete
value__
wjLk~w
#=q6Xi08r0$lOOnXtoBHhfMuQ==
get_Value
"Dm)
#=qrQRxQdT4MC1qfwOd4n14uA==
#=qJRbhy7_BbunS1O6hH3MqZIufpnZboV6cb5Cv4qZI1D0=
i'1V
P'J=
n5E4
lr 3D
#=qmTxGiMA05lTEtoPPV6RFOih4DYS0uxrxPO4vA1H2j6U=
Ae W
C>T9
AddRange
EFBB-
v= s
FNigRt
Decrement
uR5~
SocketType
|x}I
#=qLSPQZXlXixhGX8Gd10$ph8j0p3_XdW2xwrfqz3nO7MY=
2cJkq
DiscretionaryAcl
R&{u
x*yk
<r8+a
UdMUX
ConnectionFailed
CLSCompliantAttribute
C$ N,
.cctor
AsyncCallback
#=q3eIsVMg85$T5I_yeach_tN$TJG7$vFUaeExZx7tMHps=
#=qquFMi5Wa$w8aN9GGlN4H1Q==
a_ V
mscorlib
#=qyzEuYsQ6u9hwZeR0HeWqvA==
FileMode
]PQ2
#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct
#=qd92UVUgmlXoQZdJDkVvBpfqQ5IrxjaeWORyWFC422PQ=
PluginUninstalling
,AtMDQ
FpC[0
t&:t
#=qVxXNKnhAcArgJoGGYXiyyQ==
GetMethod
#=q7Tql80HUgCLaL3e0n4j7ew==
GetObjectValue
L:u3
#=qiIt1yNcUYn9ksB4loCZmUQ==
#=qN76bQl1CQ6EpIJzS4bbSnw==
p lQ
#=qGjp0Vb6efONwANkcKrMTkIBxJvr9AleFfJriudyTw3c=
#XT-K
hu$"7I
#=qEoM$dAPD9j9L1YOZU2B97iwm0vZOJe13LDB3GayWQEo=
#=qp9IgcHwNxIVh4GZl4S2tcJtSz0NII67aXwFNDcdhP63JHe9MNg0kPsAos3IUd98k
#=qFY80y4KcMQywRNP$ttVIXw==
AllocConsole
79T0
+K +
Guid
weN
fE)]P
#=qvJN63xerlaB42Q0XUG621g==
#=qfLFZgbR_r0GETPSprP6O9w==
#=qA1_qolTI9aVdwnEde3ubqM6zKBigTZiyb5_iHpeZQDI=
Disconnect
Cc|D
None
get_Width
Iw3b
-!&
-!&&
jR7<
ContainsKey
z^!s
System.Reflection
#=q5bws5LlHvLK62TcSJadQTw==
,v s
<YKL
v (
NnT\
ffeeffefeXa*&+
DnJ3
RuntimeTypeHandle
#=qP9qYgJs5_O2GP2pI$ho4ZSa8wQkwNQEBMg8VjNRrUWE=
#=qxWp4ETQRrgcfPChnmxhivyMmb5p6MuyluC9Tc_Mhkec=
2p)^
^ (>dBk
#=qui$hq6ka6v3VYA7sCjpJmcmNECKESf33DUzrmeSOmg8_E_GsgWi7VMMVWUGuO5wH
#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8
EYnem
wu+
z%(L
#=qL_Q_RdUm_wJ7VeVwUqRXbA==
|<K^
#=qObBSq08BLhHK8B6pYQSLOw==
v#<
#=qhiSO75CpxncaWptyc0vAMQ==
UInt64
8HqT
ToInt64
oB
rZ}%
#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq
IPEndPoint
/xim[
#=qmiBgFZvSMQ4WgT0UQIJlEGkYZhWP0gsBGd1anIAH4so=
9HTE
b_=>
1 k/
CH3A
kfUd
#=qq_SehjaC_F9U66vu1NLqjA==
rJ'8!
set_ShowInTaskbar
#=q9lvTmS27dN6FAh4mbOnRsQ==
Rfc2898DeriveBytes
v0_2
op_Equality
#=qw2XWrJCQCyTO0Iwdbz8TWw==
#=qxH0vEx09STdEljqb$W1E7jvc94T2TeZBAEeRdiG1_PA=
e|JE
#=qO0bmWYqIZnaB7Udo1OTvUuiP36Q9Z_7hz6URm1Yr1hM=
<% O6
>sH
#=q_0gCRmXint4znUKVJR_bzg==
#=qQ9gevS7b4oTsdxtV36c3$A==
.%(L
#=qAzhW8LcEnUCELlhG4klMCnw00GcHco1N61RthSA9zQU=
#=q85afbI_HcqBFOZnC0iAqsNghLb3LsuyjFtpLEYYoPX8=
#=qh9KSqT0kHBFSDanZ7gXkKb1vdDfzZS3JIRcUnMfcljE=
NanoCore Client
NewGuid
get_ClientSettings
AssemblyDescriptionAttribute
#=qW1UvUJT2hH$HRJ6kt_DhXQ==
T<~p
#=qUzL7S_0eXIkbwTon4AS_WA==
#=q5C_es0qgtlVCNxzfPQ_idg==
#=qeADSRAqxC2FlJbA5Uc5$2A==
it5:}@^
fefeffefeef
z8$Q
IClientNetworkHost
vMiPV
#=qa9HOmSrK7mjt1ZxVRncCgFoJUA6N3DmB1Rc$YUfcSKM=
q 1v
#=qe5qrWacQXGv9g0P5D_mRuQ==
#=q5grPwgEurSn6KutVLS5_oPClPR_aCEdSRk5nKP5bDm4=
Z#5um:
T7#x
#=qLEtx_37WeiIPQPYSN8vY0qTNiL_L6nA6vkFQwNlcU2Y=
#=qKKh2V4W51UBGXR09J__pug==
L[0
R?DWuy
qPLE0
hwQaPC
#=q8fYxP$_i6Xk0$6OlSwUHKcvhrevHxLXqXqvszBe9OtM=
@3=f
bNLW
P d
GetResourceString
tSn
-7&s
\# #7o
#=qN9Enun6Rlq30xNdBjhzY0A==
N%LXQ
ValidateSource
#=q97ilq24aAenhk$hG8MzEMQ==
Vj _
#=qikOQWBxvreUKIkKm4o4DoA==
#=qc7QknLi4DrEENw9hVJyfaw==
#=qBhG6LJNfmJspOR5A5YrkZB3a_dWOpJYSj4Mo9vfL8qo=
Dl 1
ConnectionStateChanged
hIQ-<
#=q1Ld$ycQpy0q1QvYRFk1k5lwgysKVR2tJyNFjakVtbYY=
#=qoTNlk$Wngv$bqPRyj4mJig==
#=qsWAbPBa1yptbB97zoAjeSA==
X7@]/f3 8
d;*7/
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
, ~?
#=q7wsNZ$btlm7uRzkYXMkJl8JrBCKSYJt4if2WiKQrObs=
8v7
RAgu
/0<)
hX/5@
dEJ
+ +
NanoCore.ClientPlugin
#=qSLl9utb6ViD7fbZHSox8oSv7PZDBMO5b6MBr_gzzHF8=
#=qtNbB44E34Ui_i5yJYQ5ntw==
- +
#=q$c3lXLbhl3Qzil6Z9hYEopCTRdsG8WE_1ZuhF2KQELQ=
#=qu1CivWngdicjZHEJYKM3dA==
~['X
*%(L
#=qenWi8guqQrvoGB55djo0ka_844yTmViBn5_Fr2X6HAceO7AJErk_Rh7nfkfqtUbq
:#(O
Variables
get_Message
!This program cannot be run in DOS mode. $
* +
System.IO.Compression
*Otrd
File
IsInRole
get_Offset
GenericSecurityDescriptor
IBVK
)ho
Dispose
#=qx4AWw22LafncEy7CESjbGQ==
#=qwTOYF_qEkI0dXowKJYtI6A==
Y &<
GetHashCode
#=q5uvtKo7rLfT5wGY5TBS4ixmbpGEL_B71rwbORlBpBKA=
ePN(
5 bC
Ozzu
#=qFNeaOBvMHuebCbgh$0IKkw==
GetCurrentProcess
AupG<
-,& oy
#=qudwGeEjJDUB9pt$_k0YOgc30ZWMo1bIGmdknk40OWog=
yL}/
[:qa
#=qWgd5i$rED0nEbfExDCteKBL09U6dKm2BW1AXqZVXCWk=
upPh
#=qnoPzE9XMA8S7X5JX6ycJ7w==
#=qB7XWHK8gygwSs$Fj70FiWw==
^0*04qA0
b@C"
]|<y/
#=qDBRodZmvuO0qLafxHA9KMQ==
~m0P
~)eV
#=q3d9CqFPpPy$rBhZvyFIRs_ElAFMHTo4ZZuE_g$Nfrnk=
AppendLine
#=qOgNXWEIS3IQJCnff_sTmrA==
#=qnIGrpAn2e$qTqbA22$ONbQ==
#=qfoMVJHfk0BnMs4x6mHO77Q==
d";4z
- ~@
#=q6NenfQbzQYLSZe2oYrhKsEGeaR69wF$W7VvfZPx7lyg=
/>Q9
#=qbbzTfwYbEfmovMRrVY462ipA8X_tt3oO3M_wSSE0I_A=
$~e.p
get_Key
#=q2Sd$5fx_doPt8h$UdBacAA==
, ~[
NuW5j
o# 99
BXVj[
#=q23tIFHA2cbwzlg6YDYhwLkXCJGgIhllZCGmc4pRC8rI=
DisableProtection
vx H
#=qXKuFJhTO9qh0nlK1iXbbSH7y8Djn0mggfIDxOoarDyE=
#=qXO4A8$YrN_OoPhFOn$Hhtg==
#=qeE3S$kdx9R0s10U9GzzcFw==
#=qaWedjkiL7CWj9EfMXrEg6Q==
#=qFxElXT3T_$sB_0gpbmQGIA==
URwL
SetProjectError
BSJB
#=qamR76KZ1klLpv5s7oSbjxA==
(V (
/*5)
gj+pd0
eU+m
3@;?
2JMmM1O
,+Ej/
get_DeclaringType
#=qc3tkHe_7v$eGA2x6krh72Q==
#=qKdZKgyAqL_iP0GUSJkXePw==
<MPBi
GetManifestResourceStream
#=q6uKQziMZIL8_PaX2KpbPTA==
- 8 J U
#=qE8a8ikTp6zyXXyhNYzK8Wg==
BitConverter
#=q7$Vba9f7UkS7OwkHeUGtrn1ymWXBIMnyiJbrBxyOPBM=
xh}~
#=qL6PdpQwMNSdyVKw3FgboNw==
#=qM9NIml9iDZh$Fjh9MocFWw==
li`d
/J(e
get_X
PADPADP
;)i:
|-D7
#=q5esm6BVWqrzEai7Zgw0cmQ==
IntPtr
`q ~#
z-cJ
@=8Q
#=qwSqLSPEuM8lJy4sOeuH92YjPodcLquqdG$OodozwC60=
?)]'|
&+# +
#=qKxYY$jYG8_7mT_7R0n5jfw==
#=q9Dmi1iXzL1JAj2RiS$Q5mw==
#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA
#=qHy8pXlBCL$mvAXWQDJUnVpxgTTYNWuQ4Z7NdFPUhcZs=
l2)#
#=qyo6slTMfgD8IrZ7nr6inHA==
#=qul8YRvQj1pWpo4_UxgOSzOBvtncEE$VPCzTeLK_rIz4EnXxineVkwF$lTxruKPxr
#=qJtsKc7ccoU8jRrRMGJWqhA==
#=q4fCxMFfzJ9KgfK61DJRvZ5wDvDfYnqR8bhY6TGq9aRk=
} di
Ug#F
Microsoft.Win32
ffeeffefehah
-$+
+G~Z
7q[
#=qee1h2XwRBJvy2g__X40enQ==
#=q8eJA0L4q0RMnuOJCvpFj3133vZRxVnxvHST9vysUWYQ=
@Y}`
#=qm_Podb$DJ6CfxMwMnaj6heXfc210URbSx7p$rJGFPmA=
#=qt0$GxMKBUHqpa$X5z4IJNA==
#=qJLXxSZzWSVDQjBBC8RxpqVbwxFaxTu3ygaLrjLvlmTw=
#=qs0qPjhSgxy3k5gj_gt12EQ==
#=qbWN2780y2PKcyDt_4uktmA==
InvalidOperationException
,>~,
r[D}E
fJ`>mHV=F
#=qZHoyzaJ9rjmsFI5qWuYXUQ==
#=q7wyeNFqtiGUhQt6sicod9g==
#=qhq3FXVXLOItNPwDlpFnTKHk3JkInaJiiSE3uR3jtGH8=
"j:&
OM!p
System.Net.Sockets
RijndaelManaged
#=qEIGjjvppBA3BShbdBfMkQQ==
#=qoTGj8$mBoje$u1RSJ6obYA==
`dj/
FileInfo
-"~Z
#=qGzqsy60d_qAVRip0TvyGow==
#=qSJci08l8EqyD9KF0joWzSA==
&+6 +
#=qAR9aFFQPEovpFzvfokoGkw==
oj n
ei,\
KK(%
LogClientException
&+: +
5.6;,]
H LE> e
k]o5+0[
UnhandledException
*0]H
#=qr1BSJWWt4_gjKhDM1XdrUmEEDWmH$7z1xaJvthJ97EQ=
iKUv
#=qXzCb60v8h3v0rPCrGf606Q==
BlockCopy
> G:
#=qdZqWoaYN68rlMOX4HkTLdA==
TimeSpan
GetBinaryForm
#=qWfwpJtKOXBFXf_1zpmLUrQ==
Mutex
#=qjlBNihUiUO2oBJbOEbdB4u8xmfTL9EQ3AEFa$nrdzJY=
{W^
ffefeefeffe
+u5$
+C`^\
#=qChPTKc$8xcHrcle7anHYNe0wH_TweGkex2nGe9n8WDs=
#=qLKYxZZVHP8wT4ocBxnjPXg==
/h4Q`
#=q3LvM$oW1poDdLKDT_N_s4w==
.f#Y
FormClosingEventArgs
#=qAsxHG9v$MAI6$NruMbxEjA==
fefefeffe(
, ~:
hWW?
)0n>
#=q02vg4rlYSKrSiDNi4xWbtg==
BinaryReader
#=qAlVTP0_ZXWJdoW5RI3VoXQ==
#=qccx4d_xNMPrZUHpmyYb7fIKkXAFa5XEyOIxXg$XLtBw=
set_Key
=.<'U Y
!me
#=qVvEn7vdm6JlvG9koG0JUIQ==
EH hD
H><Be
+Kw
#=q$JqWZLd6UPV3jmsDHksd2EmkHWISQtPlvGx8vZ7hHXE=
E t.*
#=qg9gWuHgvaa6cHg9wj9NSQQ==
fefefeffea
#=q9DR9MBj4z9rQMPU2Q48EqjtFhU8AMGWHK02_s7IakJ8=
pBg6'
Boolean
#=qo5Pv9nXCIU9X_B8SJDUR_qgp7npNK2pA1rGP0GNQ51o=
set_WorkingDirectory
#=q6Aboe3ONIkez7GgqcdWPi0_vrT_i53_89HUeagGM6MThXvFkvl8hpSeHO1UJawKN
TrxK.f
#=qYI$MiBdzcplbf7GqrUf7Ig==
.3+
:a89P
/If3
#=qK4wGebauvtmTKO0oAyLFzHLhr9rU3HNJmU_ur7Zop$YvLzV4HzmIQ45YslW_q1Vc
-m,Ol
-5X!
#=qFv$qWif57TCUNsu_O3F3gA==
- &{
#=q5XjI6hZlPIrXq2h2btB_pVJgDh_o3RXkWrFCxLCG1E0=
+ +
iT18vM
QCO7_
+Z~8
StringComparison
#=qYCS3QLrXk$FWhHR$BIzDXQ==
* +
CompilationRelaxationsAttribute
4wIm
#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=
YaPWZ
kDj$(k
, +
-t\r
ReadUInt16
'/&6
ReadUInt32
#=qeeDSInMnFASKK3QXGIKUxuxDb8FgGi0XLXRlZ2oJdWM=
- &(
#=qP6OAxyfxw$Mj0oVKCDnh2VZfwY2Ap_uDBmUyxkn98Eo=
MfzS*
#=qTLmFjOt1Rq5$fqQEFVZ2zg==
g8LI
,+&&
fA8i
ResolveEventArgs
- &8
wF0[`
#=qeKiN0Pwa0MwkK0uB$Ook97TrMQC$LNj1jgF6xTuSA2g=
< w0
#=qmvGJ0E7$XHigSQAtHtZ6z$on2iAwFLBiFtrUR$DFhQPAtVI2LIgzNztIgPvlO9K$
#=qhVWucYSqOmMmp4RgG95tFA==
-?&~]
vQY;-
QueryDosDevice
Random
|PzF)"
+ +
#=qoStPOR6UymX3IGbwW$iFxA==
ThreadPool
#=q51SFR_Fbl10nUMKjGTtHqA==
#=qrWKlHKCxTKueolOR4ohc7D_cBhjLv1zNIcftgcigaGU=
<O"o
-'&oN
wy%7B
#=qKoyC_0Y6bPLCPvDcJr2y5A==
VDl
&*}%
`tyY
hw<b
7h*?
#=qqReemZdhHj1veATVZbU2_Q==
#=qd8WIZO8f6IRqdUmvxawj1w==
Y-, Zm
HideModuleNameAttribute
Xa ~a
U=VF
gHsPX
`YF
a[R'!
4%(L
Microsoft.VisualBasic
mp}:Ym
I"Q
J1y
PGoz^
*m#_j
#=qehEpCuPIxZRbHczlt$dAWi4yWi9o1_noSvuo$Wzvtyo=
Qy^P
dV8om
?cbH}
NM+W9
WriteAllBytes
ArgumentOutOfRangeException
kaO)9[
EnterDebugMode
S^O-*
--&&
X*]x.
991c
HostData
#=q7rZvZ5LmWDFo52hBeGb87g==
J%%fs
n}6jF
set_UseShellExecute
0JZp\
#=qokX_wSaMFvPLXvDQY377gw==
#=qrpluguOr5I7WIqr51cA8ZQ==
#=qtxvtUAtG5kwD1CbaXqZpxrHWaxR5CiRO2OiaCLfsbSk=
#=q2XZFEYqbf67s$PRf9Xyx7Q==
VI2\Vt
Dlr;{
Rectangle
#=q5QHPwKvqpNRA$cKFBj8i9w==
#=qUaHlQloQ1heHsricyshXiA==
v+e_
,d~9
JB'6
uVoB
#=q7EIL8N8VWglyI984D7TGpzIPvdOcvYIRRwfMeKNyDDs=
#=qMoRe_p4fasg7BcMJcnicWw==
#=qsx3W$FQbKM7QI$Z1TXWW5A==
YCGAj
+. +
Concat
#=qkxzumuLbzy2O2XsBlM3j$g==
[{d
?F]Hj
?xf
#=qGHv1IOurZ6januU0XCThS7E6H0kqAtBD9d30RkoHFXM=
#=qNsyg$dsR$GJkSvK2TftGTNPuC8S809j_UmmfNnXTTOo=
StringBuilder
#=q2WFu5tRyicebO6UkQga8SbXrngw5YigfLTTVJqQy1qI=
1:CN
WF}K
#=qhbsl5nSqHjmKK5u9FniHoA==
#=qo_N0HkUaMUQFRCOsgr2ciQEl_IzgJy64oQzCRnN$Qy4=
?d KD
ReadDecimal
#=q9tI5WfBIFIPW_84mZnHV05cJ9fSyOCl9wA8lwPxs3PQ=
B.rsrc
8,!iP
- &~L
#=qiO2giJomMFK1wa5$389nVw==
tb8d
5>7^*
bPkc
B *;
ffefeeffe
#=qU0vjurWIhbfq4$RoGXKKVfTj5MJBenZeu2wAtoCJAJY=
38 a
k9 uP'"
>Qrj
ReadDouble
#=q9WHClFSp7T8oS_DNFEbAHQ==
:`2t
#=qHj$POo$6pkhWHVC5cES_2g==
CompilerGeneratedAttribute
#=qORcQ89THKgijJ1sWRyjf4hLd1g4H_sosI9t_gkVfZ7g=
#=qcyVktfYxc51I1XopnwGNjQ==
x(E4
Main
#=qKXbEtqEIo3E2xdYWIElxIQ==
#=qb_soGTESOxGbPyWr9RZjig==
Yn b
6.,X~*
#=qKpwDTqgBVuprqflj1$7QZw==
d5+x
#=q6k7flm9GMlPIija7ZH1xJg==
0`Hm
>)2F Q
#=q1t2S$ib6pQFvBWAJfG9B1Q==
1`c
VY$A
`!?y%
"? bD
qvV.%
%?A$
T)I/
C!bs
2&
Copy
#=qwGMLoIBYlotM6E$y2KTAuQ==
#=qzTUdhpx_l8oNrXik8Q6a51kZkIp$waiEMbjMOU1bFOc=
gB.e
#=qC6KOBEMWwIsQr_847d$S8A==
AssemblyFileVersionAttribute
#=qZDHx38VzWszDP$NdqQpGo3ak_Z$zbLpODJse1_Sr2hk=
!8'v>
Transmission
System.Text
GetName
#=qcCYGLZOh9EpzU$sjJG8ZyQ==
#=qHtBOSXbLfhirIdzL218uOQ==
l2:{L
afeffeefef
#=q60UcvJzzgao2Rv_stV3rQhhxCdm95L1Gb83mKGH1VxQ=
WriteBlockData
#=q8WaW5L3_NY3KPDRN6V9mCI08mHUZbTcARcexWvaAL6A=
MessageBoxDefaultButton
-y'N
#=qJMNT6BwQKSi707UHw9_x7oci6egKjto_AgHYlITH34c=
#=qmcl1D6lgUOLuKGFFyxMamg==
;/!VcfP
:~,t
?+hp
Collect
RuntimeMethodHandle
U{4>
#=qWFEttW6Y2i$LC7_zLCNdFCiHtPH1yR98w7TbmrS4vUE=
#=qa6Qg4SaIgpIknX0EmOdEQg==
#=q$6NbEg0Hb4neXdXPgEgHJA==
+K+t2
IClientData
"F:r4?
z0i[
thC=p
*P L
o3P8
Etw.o
#=qWQUgmvsTzj15wSjWQHZnng==
#=q8Lz$o21atQxw0qUwF07ufqfk8jjJrspNc$L9E2y_kjQA$2GQzuj5BmjDMXRcd0oL
#=qfozjXlIKX6LyHHXB6wCG9g==
BWk\
#=q$bBbU_xpGfMMkAvp45SBRg==
(DFA
#=qFikK0kKzvE4fvbzxpsrllMMR8oLIJtNPAGP1lZZ4prs=
< p
f^:b
;l43
M%y<
1.2.2.0
'19z
#=qsOMWyP3LvE9$utIXVnRnmQ==
#=qlV3FbiF00r5Vrp5nqoncyxDHZMuHB7yuJa7xS77K3BQ=
#=qrEy8UTPh_zjKUNPlgJ2H5vQaVxSgPloAxSMCkFttuk8=
EX';>
#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=
#=qk$cpdn6seqbcKjxGnztc4w==
'>e9
ma
#=q62cZqzG2QOltpyG5v7exPQ==
#=qO$LkcjIVULy0PGjvpOiiEw==
Initialize
#=qqLLpPwpASXA1wqOuY2RNlU8CTc57bQGBfHWaLDgrCKM=
GetAddressBytes
*u5$
#=qPfVuk6552RtecCgHDnGSkA==
#=qSyCMza09ItB79lrZlFBuQQ==
get_DiscretionaryAcl
|U
x++(
*oacv
#=qXfm3QhQkyfcZgbFdAZgHHmadm7n1N0mfKcKBqrdfAk4=
U{ Ey
{(9A
(a
RawAcl
#=q2Xp4jW9C8Ta21HxmpVVhKkrHyOAsktLziyvL$pPr$5o=
}KFm
set_Verb
t]Ca
#=qXCUD4SfDr7DmFI64sweGXTg5Ns_ZxTOZPqBRcEKWTQk=
#=q3C4Iol1nMl5AFLWNdE6nxB2_kG0uXzx35vvsn$gQzt8=
O.`V
- & +Q +
Show
02Hb
$K-^
(||$
-
e]A3
yUm
#=qEWXagqzV$_PB$92aNfTAHdvK2qw2uvSxy$UVh0K_lso=
Y(w
;N6Y
#=qdiuHngY4wejUsgFY5u7CtQ==
My.MyProject.Forms
#=quFACL_$e$cUEIexpzPXS7w==
W6
~g_T
V.c0, U
#=qwnMPoJqYBxCKR$s5x3I3EQ==
FromBinary
N?Gv-
th d
#=qEhveuZChxbRj66Cj2kCGjw==
D@bL
n~S2
!Jp{
}M)0o
&|P7
String
#=qyZOtLxFf9zA2x1ff4_5cOg==
#=qSYke1CBEgOP5WhDQ2wCOhA==
_CorExeMain
#=q2n0wwv9OpsrMrxVUVHoqGw==
set_Visible
aZ5
SearchOption
8V.
#=qw39MYiiaN1XJbqsDq$LgQw==
kmA
^jf
S0cg
KeyValuePair`2
9r?
c) {L
HostDetails
#=qB4sApeDyjGxBivHLwR3FTJejGBlbih3hr3f3TS7BFbY=
Timer
#=q79YE7jk$t8I7uIUVykHcVA==
gTEb
&+T +
u|mh
sdf{<
#=qsAejPkl5V6B3npq6homyUA==
-&&~r
@/x/g
Microsoft.VisualBasic.CompilerServices
ZRp\
#=qluYNp43cwlAh9yLdLZolDw==
^* 7#
KI zbO
y`;`
P =B
-\&(#
get_BytesTransferred
#=qUUt$Zm9DEy7746wMpw0nOgKcClljRPRKWyhQ21GyaOQ=
`nYU$
h'!C
EditorBrowsableAttribute
#k56p~
add_Completed
Jrj]
get_InvokeRequired
#=qS8syUoAGHVUW8$eQd6_3_g==
C,]
#=qGGQk9IvbDfVOJG_jRDHqOA==
#=qUvO$SDWQpHm3uJq25yzwvw==
M(;zri
-0%&
,%G
#=qOYQA1S8VHR$mOO6XXuyF9Q==
[o6)H
-(&s8
#=q91nKS7P$i0qKCqvUAPW9EQ==
#=qDJlWEiuGwuVXAz8yc8z7OaMssRYN4hP9AHespNOmdYHus6_1XkNOC0rqgHeRZksg
AceFlags
#=qsB4PatedVyMOyo9s5n1OTA==
User
get_BuilderSettings
1eVa
#=qqIzVXHiNuUY4ZNiSxkqEGQ==
xp#9
@*)?
&5'-
4 Q
DnsQuery_A
,<IVUM
4System.Web.Services.Protocols.SoapHttpClientProtocol
get_LastOperation
G\;(
get_Buffer
V x3[
#=qKtJTKEkNf2mJVHcZzSW8iQIcsBglzcJJOkX7V_uB55w=
Ii%R
set_WindowState
\E$_
Load
#=q8VTskDJ5TyHJcDeWmklddw==
#=qjryTBW16mUfo_ItH9KWoGQ==
FileCommand
#=qzRcQ_b8FoTlpKT_BObsgBl2bj71wU5HcYdpIIgiTJ5c=
#=q3cm0QwDyNYr2y$xvkCk9bGbohRfuMuxkahGwLy466GA=
r(#l\
#=qaRJX6K2L3xhR1w3zuwE79w==
System.Drawing
#=qfGQBFs$OKLefNYKSta_Lbw==
dMEtA>!
#=qN$clRL1tbKGnARF7__FwJg==
CurrentUser
#=qUWYBucdXrqr2Ksc_3qKZcA==
#=qJOtLSdKNdNGjNNoElacScY2TTWmLUvN6XZsl_FLfP4o=
#=qRIR1iTmdtHs$eBwEdoKphw==
YQ.{_
_B8'
#=qhA4OqIvVSMpJakxtoytoCw==
Ya ~a
Dictionary`2
GetFileNameWithoutExtension
BeginInvoke
ToCharArray
z8 ?h6
~utVN
get_OSVersion
#=qGqugi8s64S3wxXEod1SSyA==
Dispose__Instance__
yr#W'_
#=qbpvfREN3OwaXBj6J3WBAim$AQyJ99fz1ef01qn6kVrs=
"@@X'
tLs~
#=q0pfW5T3uO1I6LyXSPFW7Qw==
D Jt
#=qFZ8xm69Cd0C55Ip2ORf7Ng==
* f)d,
AddressFamily
get_IsEnum
'/LK
&+4 +
#=qXULhMbqiur_al62NrjaiXWJ8rme0bKMO8KkV356NZwk=
yI?_u
#=q5mGK9suCIiUDZgS_YSrSQg==
,-
>< j
3dOt
#=q3TG8MLoZf1Y44PREVW$6m76IGmuYE_BOhC_OTjkQJFtYWwRtSeFqevP9hiteuLfz
#=qxG$Aklpbf6gyBfAqTMmORA==
)B4F
RuntimeHelpers
+[~u
- &oi
- &om
- &ol
S pJ
- &on
affefeeffe
#=qOxeV7mwtJT4AH3HtBqNUXw==
- &or
#=qTMXjZFh8G1ehMXQzo1c_k7izR$ZNvDyCJY5aoZ0yOe8=
MS}r
]AGJ
#=qdObzsTSX0MpvDi$OPjsFh219oh6Iw7DshgNWGveAvBQ=
#=qwK7$pNtMfqKNZt8gGYd$pw==
H(6?
9 0$
VariableChanged
1Os'
>Kp4
#=qxRbSDXwo6eARhpCjqJa2Fg==
PPn5
#=qBpzegr6XzkmtwALf7kKPHV3RZVAWYLbYE79PiG2zXYs=
A~uc
#=qdDrSQoelY6gHzRt_ma5NQg==
WellKnownSidType
RawSecurityDescriptor
c7!~@
Object
#=qCI9CHxEGVm3HnYdn52IpdQ==
ReadByte
ze 5
#=q0QKFCbf0u_IpV5ISOWOl$Q==
Np &h
Registry
h[kI
note!
E7( 7w
#=qaxeBDkuvv4PncQ$UM0p8ag==
;y]r
ejVN
ComVisibleAttribute
VA B
EnAn
[Dq ;
#=qzAgp3UwWT0075L6Sh4PfZA==
)jk*"b\
69/l
ut@T
m"??=
bb;.
q=9\
E*~U
3B322
6: *'
Pl 0}
"/u)
#=qA32zcbPIWwOaURCE8zDGfw==
|YQ6
-1&
vbTy
m]Y%O
,.&s
#=q__Bys7JTXmAiG9F9QC$wjw==
#=qAsEDmMyJR5b6o5oAn_4$qhqe51JCfsU9Gffe156c8UU=
>>Z
#=qMpgSfrZ_Z1PFlMpqVHDctw==
15FV
EditorBrowsableState
#=qUlcwHJCewxIUk2tiKMDjXYc$Hb1k7TCZCyGdm6C93UA=
#=q9x6KBL_arYpQC$zFf4pEFQ==
0NxI-q
e|cQ
#=qzDzg9a$HVGG1G5cdhqbdwO3OG_SFijGXN8Towa37$TQ=
#=qQyvT61RAfdEUvn1jBvcx0Q==
4KaY%l
#=qg$lb3t6abG6vgSpzSjJlb_$AIzqYfos5cl9DWFolUwM=
#=qDTvHA26pSwiGBDknUzewBVNt3YGW7YeSiQRH8F$_CMA=
,fPB
#=qiCTCgJQkyH_Kzq$FT43G4Q==
`.reloc
8Cbp
Hashtable
#=qYMGXxffne_DlG2tyCliUw119RPUt2rJt6SWle_TPkBA=
9$^Xtj
{i- [
#=qy7SaTx6mT2Pix1CP6ET1Hw==
JxO]9
#=qiY1B9yU2oVkPHxhn$y67SFTP8x1Jb0botGqdUGkdpQg=
PZs|V_
+N 8q
g%Jv
#=qdsDfPo0zxdY$R7euM0a_vw==
#=qI5Vms5JVXaVkwalJFV3L6w==
#=q99eEsMLSp2$EVfl66Ua2d1YMqB58RPj30lLgJzJJ64o=
#=qzx697Szk1moqO$yUynaioQ==
, (g
Stream
L W{
#=qBuMzaVqxpYkDVtTnLpbYyjTfZNKm8_4JkuoFHPxOBFo=
,
System.Windows.Forms.Form
IsNullOrEmpty
#=qW1Ty88cS3yMuRwgBrH3qpw==
sc7O
-$& ,'
!s'C
~v/a
^YkG#C
,0&&
x]5+
gP,_
3w]R
Exit
%*)pG
:by b9
#=qhWn12I_bGxHfrIrnto3QAA==
- & (
#=qs77tphQ2NXlLwCZkimhHsowpXGqSYmOGtKiGHHIs4aA=
#=qy1cXcK8A6uRpLlCz7UKkNw==
#=qGjStw3GYbvUue5kapeAzmPJAl5$UDUb723PSvMiCGdU=
#=qR0v_DeAkzbUr6_Md5tN4PQ==
3C'DN
PywVD
#=qFaxhQMbuEyPeOadTfKIzX7ulwKfSulnteVvHU$QDlcs=
#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=
#=q9c$dxNln4J1nxxC7UNVnfSKvSgKS421$zTS6z9ahlusddEno_MZclU7Qbfc$Fyw5
#=qRCCuvWFd9_O8CfEZhkJtSA==
#=q5s6lzZCgRNNe2Z9HZfa94HOHkpUfSnAwZsGo$hzh7hY=
#=qwdHHpd7UWv1_2lcOeunA18XKUsrG9D8S$xli$tkAMlI=
#=q5fG5Wo3pzujuJKotO2WwDQ==
X xJ
)x
#=qS8q1FyJsn2_ukKh5ONBATg==
#=qQUdl15sQ0xTV$45YaAtVB9Bx2NeRc0CC_5Lr_HuNXwU=
#=qxWNhTH3aUmlSLTvydVoCIQ==
#=qWCa2pDyuMnzTMLUOIIx_zqZ1n0nAbCh3XpyakFsKTbQ=
s)$"}J
#=q7Kx5VWqZvUxLZ2L5c7WH8A==
#=qbzig1$2CwLluEJt5uPtpgqPx5y_2S$GoPgJP36N8bTE=
POv#
#=qJ598Vnr_RIwGnHqFfQsYCw==
0haN
R,'V
#=qRLk0VFphuSTh16H1MGZUv_HwKU6b1$OQZ0l10zUjPKU=
f],H
XyyJ
%3 "p_
0 )K
m1+k
#=q8uMGC19QD5WGzpkzUOu0SQ==
P*%z
=R7
Details
#=qYVgYkiAmhdTmisXUMVHYlJUHzcBdggj3Sn3nLI_MDJ4=
L@`+mg^Ix"
{s"Ic
&* +
@*4
GEs }\
bzk6
ExceptionHash
XaY
7OF5
#=qJpz_ygP5AiHfhtTxRulSsw==
WaitCallback
OperatingSystem
#=qQ7tSKwAULKz8TSFsLbtapA==
MemoryStream
-#&
~5X
K!SL
-7( n
Zero
&+O +
OKg&
g`2`|M
EventHandler`1
ORbl
#=qyYejfncvZCW4q4y4GEV7QqOL4Aox1NSDqQmcpM4TQVA=
)6h+#
#=qd5f1i4cDO3tAO_bEb7g1cw==
#=qRYSdRGBC6LM4UFJJGQnk7A==
m}CB
GetFrame
#=qN9oos_gePS4akhGX5rjcOjS2FNZJlTAkUnO0Ykgu7Rk=
d< 4
s3lx
8 UCe
System.Threading
#=q1ZcUbkVKv7wahbk_Am8y6A==
OfXa
gWQ7
lLmV
#=qDJ8UKTQIGM$_7XkvuUdssA==
MessageBoxIcon
SetThreadExecutionState
3 ~]
5Q&L]
UnhandledExceptionEventHandler
#=qz5nGZygXT2sWR5FWGAcAzA==
rV:
vUK|u$I
y]=u
OefN
YsF:
5'*?[
#=q5WjY_m3ubVFfbJuyu7GMxA==
+u_r
Qq(+"
*^A$
#=qmL2H5Qgs6vv79mCqS$t3qg==
9+ s
GetEntries
#=qfXdNdmKHZO9pILMTQ4gUIFhfl9KPJm2rU8y_LQsTH4c=
#=q$YUIMaEFO5IFZXBvo0kclw==
-F&{
#=qhnLoeDP_EbzJexQQPp_LLA==
~Slo
]!'R
&+J +
[We[b
Gw;
#=qk77uxMCXAcR_2KMKgZiSng==
<p jY
-T&s,
#=q8d8q1KZbTCKTAZreko1Lug==
i|v|~
CG^Tz
Buffer
get_Current
b%
#=qkxH2pC1tIcRyW8E4TCtfHw==
W,
m q
|txmy
4zsG
0d?,
#=qJY6uBmA7bjB3pfI3CAMZ7w==
`Uur
#=qfpNcQ8IYoPRIQgVc_nBfXzVjxVN2nY_mFz$PcDXaKKw=
E39)
W*M!
#=q8T1neNU8Flp1WaNsBKnRHQ==
4JSx
#=qX52fPnzDspvxDLERxqgnmVyN3O6kmNVEBrlqQ9OVPeE=
get_RemoteEndPoint
n7o[
#=qQqZpewiWxGMAW$tQ9Rz23Q==
`!30
#=qgPQkZ3GBDc371jzhubcNPqmxfqhr7b78DNmenmuxGa8=
Wj(!0
V3#4
> zM
@OG$\a
#=q4kB_KjL2oo8adT7lfnt6ew==
LoadResource
Microsoft.VisualBasic.ApplicationServices
#=qOmCJCQ4xVqqqlvNEZD66Wg==
CloseHandle
#=qiNB6YyqAJbx2uPAiP1Ihw9dTNEtwaZElmpYLZcGO64Q=
Re~^Voe
^bpM
EL0x R
><"%
m=<;
k nS
+
Next
AiP_
~D\~"
$Rvv
{f<8
+
#=qEDU5bqS$T9T0k2xHaznuPTNI8j4z6II52ItUe0wjyZ4=
5x O
#=q4P_5NYDHZX9MPbDZuNFOAbRpAmJ2c_TFz8M5ulhIFApTRNfzn3_E1__1$MVw8$WV
\t6[
#=qMMkhBs_8vtf4989qCM6TUw==
|[Mt
#=qSbcOBh8Kf7zb$IciDxPlGw==
#=qwBDUI_NSPNLYbPH4gy$3uQ==
)t<S
Yv*"
#=qVCHxDTr$$bwFMb6i9vBKRZciaa69edA3gsLNOty0RAzCorWRBUh2v0PgySYBEvZ0
M"&O
Empty
get_StackTrace
d JM
#=qhufLjssUmkN_mXHuWOXl8gUDxidnVdWY$tHhp2HS0ic=
#=qeAiPMWOD6_wvQ4$bYsFv9GLgsem$trQFsnkw3WN9igk=
#=qe0mY$R_rBsPIZZv3hPLS4g==
AceQualifier
#=q2dXdGRU_h62YVIUhgXBQJzEnralpXNvp017RQs19jjo=
7 WB
get_Major
Ace_
#=q0M0RRypoNIjajWAugf6WjbxM$GiKS9VjK_mg6sI0TI8=
h_po2
~ J,WQ5
|IYU
#=qVXB_y3eN_sp1$Md9UoJeYQ==
#=q9heLrZy3cpWSk7do8VVthg==
#=q_ux9H7Sh7a2A98b6QB8m4w==
@&`w@
#=qJdNCQZ8JQCfthL12ut8Zgnr9$rl3CuJQ4GAn54E6CXs=
#=q1A7nXYgjUuxh_0aV4fZMB87On7HuSdbeS8x$mfXfW2c=
#=qhFV5jkshUI$uRxypI6oecQ==
-f&&
0 + +
#=qSl7F7iXGTH9iNXHds05fxcgA7Cydd52A6vZtHH_41F4=
#=qvJ_V3lJRnVEW6EI74n63zg==
#=qOTqiIHVN4TWDu4_xhgbifQ==
v2.0.50727
C1u)
pdC&
SetLength
#=q3VDCpnvucWhkt3J6zytXBA==
lbn~{
#=qxUvHfLZKZiUmPXUqPV8Vcw==
#=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA=
YAjt
_Lambda$__10
#=qvbTNBihG2zARsewkRIFTSQ==
set_Item
t}Yq6
ToUpper
(N<;?
>aU
Ztj6
#=q0zLeEY98tybLc8FS6iVEWjGp4MNZxETphcH7ohzBXuY=
DirectoryInfo
Xn ^
#=q6tJHosKuF0IY3gGxjaveNw==
Y_ + +
#=qtkqHWk1kvmO5zt3tTCyF2Q==
#=qbNq0eOj9Pw66KrsrDd4qnA==
#=qSpdFO0arrQmbwA1JpPKL4TCAmwZYVDNVmpRQ6ryTPgs=
#=q7O26Wc9N845khaV1IlgZGg==
=w5RbVgt
g! \
Exception
#=qG2DPieaEKCS$j6T6yTf$qg==
#=qIOX_rwHrS_RLFL2igzRsUQ==
=]RF
C%(L
{F<_
#=qLJcloNvItceT7R54Ssv5HVCoj0j2JUUq_dQXQpFZZjM=
u=DAe
#=q4KMIX0AcXAdYuUiSKvyy9Q==
Y% %L
"|f
& oC
! H O t
h/m
#=qR_QBxpRX$xZ1vjqVv0afDQ==
& oy
#=qbFnmVfulgLVjclcqmmhqFw==
z3KW&
#=qtIl3MhjXHsnCHvTVFi9hFg==
#=qFMsFc_zvkhu_B2YTPJt9Yux7Vq8aZNOr3FA$mEdAzCc=
Z6-yS
;oe
Z e p |
GetTypeFromHandle
IAsyncResult
#=qT9sog7FujhNJZHxxUXVGPg==
set_BlockSize
Tw--
#=qqsKAc3v0igxVSmn4Feg8q$1tNTWiqtCBpA_xMlgU$f8=
get_Connected
~@
#=qpaOobmVTnUS0322VEUTQd53tn4HeMWSoV2XuTUOmp6U=
S:8*x
GetEnumerator
~J
SymmetricAlgorithm
#=qEKdoqcCD2XVb2atXAIOmL$Gnnk$r2oNLDVsEymHbxMo=
#=qOgcjmweVxeuvMU4cvcFOmg==
kSj=
=e)
L]"xx
T%<4
'RM4
<generated method>
#=qzjreg8z0D4BPrx4RxUJBoQ==
MessageBoxButtons
o$MkA
Int16
~t
4M:C
^2`f
ElkB>
#=q8r1xTCj7grAlhMxU0cmrbA==
@Rm{
ClientSettings
#=qo8wG17V6QHcxsU4R0xmY_Q==
ComputeHash
3?~Z
OXiH
P*er
W5Zo
#=qtcncUaS1HcVKUD5AEGHBokWqEL$GDDjoAu8asy_oLis=
#=q1BpeNGUQvsUFoXPmB6q50A==
* 2 q %
mACJ-
FvA|
ReadInt64
Q#|Vt
ClientInvokeDelegate
#=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
#=q1tLM5Gk001IDETj3RhJ2ESaIo2XgaV2vMWhqISqSHy8=
7^`T
#=qkcPDXy2$GrSLn1ykhNxS$A==
#=qqn0Pbku3c3j14idd7rNOJmIbi4WueHDQGNjxpToWe9w=
Enter
*24>7
/(~,
vd/-
GetInterfaces
5 H-
4{v$
FileAccess
8X+^
*N(A
~2
CommandType
-0&sY
#=qRACckQ0ejzlKZgeXX_CPJUyKbl7Zu7QfhWW6eMM03VPusMYB8LREfJZQVcTGHBm_
le> >
A2
VMr)p
#=qGgXamaT7IeK3DM0oRfGI7LZg7FrEWNz8CI_5MUlFEJw=
get_LocalEndPoint
#=qcyp860KJctHXULF8nCr1oMRR0y2kU8XZrQHqsInbsAM=
zsX
|/(Tn
#=qZ79zrlLw6T9kJCHt$e306HkmYpQl8J1ugf3bmy8tycE=
:#jd
#=qTYemjRfvVDuBO5lrz3Aq6g==
=OXx
8'IV|
#=qyEH54IW$f9fUJb7FOR8r3vj6e$onLGrpm2VGycjbl9TZJEqkwtA4y4bL9ExOWpiA
System.Runtime.InteropServices
#=qqMkZyGiL$PHkYblZrq1S69029tlEdPXkxbM_smmrcRU=
i+jN
zsJ
pFc3
RemoveValue
GenericAce
kOC#
Math
POs+
Znva"
#=q4N2IYJkFi2VWiCVDKVND$8gixU$DXUcX8F2LiLBxLHw=
v(4v(
_5ak
>&_rY
&&*}o
- &o
- &{
{
a(17%u
<"dM
#=qKY90T141DaVDQT0DHaMEr8C6aPEoolamkqMM94Ir$TE=
advapi32.dll
u[uV
#=quRXaU$OHlRs_89kacdiUMQ==
$8&U
- &{
- &o
#=qxybSLhWq6EDNDl0$FuPN8g==
&5nq
#=qos7yzAcb5jR$ypc0Qk3OWQ==
X,[
HTPl &
System.Runtime.CompilerServices
#=qVcF51voQmyGAgyAUz3313w==
#=qgHxgiBgB0FhzEGOOs2Dqnfh3XnJ7nEmajCNqRqFR3Fg=
WS:(!
SuppressIldasmAttribute
.,H,X
IClientAppHost
#=qgbI51haY38WJ4NumXDqnLC_uKv$aRHAyD63c9HgGYzlsFjikAASqT8RCSswEMouz
- &&
SByte
@ W \ g l
H "c
Bl1[

- &&
ffeefeffeefhah
#=qKi0KrAcAGUOMcS5S$2tJyg==
- &8
#=q00kXQ$0a$SV9DIgRtf4NWQ==
#=qXOmEbR_8DUzPz6sW4Kmd6kaKUIQOYZdTpvq2CkB17PTlG1zEUgI_P4skJXU2VwtO
-J@]
ljw9
vBFn
FormWindowState
Sw?MO
z6`"
0rVC9
- ~0
- ~1
!6tG
#=q3rtw1eBB$yyPLXzQW$mDOw==
#=qbmVTgf9cRSZkM_UgFSJrlQ==
#=qWsrg06gTzsE5hhHu57fJFw==
RestoreProtection
TransformFinalBlock
@PZj
#=qKXWwuvxG9klNObPbc$UF0LIw0aZIk7Z0VPIncl8uFJQ=
PW<f
%|9?
R[(645
get_AddressList
System.Windows.Forms
0(1I
<G[i-otb
UIntPtr
KP;P7
#=qH7CAcg5aycQv61Wo62XDpw==
#=qglhcKpwNlOshaHMfwiT0UA==
2_A^
#=qi1H2yZDbCxvPo0ia9nVnuw==
#=qvz1sVA0ePAgs1nzIHQTFVtjljpeJ1QO1S19vLxn8DMU=
get_StartupPath
#=qK5Mf9uxDCjwDRfyJQ6kp8A==
S DN
#=qtBt$1AtaHrrce6fc6LOT3axuBNxZ$SQPty78qYGi1os=
IDisposable
Tq@\
j?\}
Exists
System.Security.Principal
#=qKU0J1fiP8KA33eFK1owekQ==
&+P~
sn%j
#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=
!%b&
*JK2
# R+V
ReadChar
iE_3j
#=qD_C1_4vUU8j6eQSUvsJDw_O6DZliNi$NDCaON05RwdmBpVqAu68W00hmx80mCKp6
UobQQPM
g&d,
#=qv1Nmoo$HMwdd1A0cX75UdA==
O:j
\(>)e
#=q1AWpt7Zq4Tx0wGx4hVFZRg==
OpenRead
#=qFTBwGADWl13TibdOa5ODk_Y2qcfMGC4lp4rhrZcE84kZNE6dU4EqEk2ZYKuJAWo9
T"$-
CompressionMode
E"Vb
_>Kt
/.ffefefeeffe
#=q35mMBfMcRRKrjeZsPOCz3A==
!pz-C1
KeepAlive
AssemblyProductAttribute
#=q0qLVKF4NbQlcaunYsixITQ==
#=q6CxZjTl3_v2RHWKegcqMWw==
924**
-&&
#=qkcVkJskuGA4o7kGuN79i1w==
Equals
#=qWrm21vQ8CBMZP_RBTwpusA==
t^w'
#=q3_2_t217j7pS3JjemZNI07w3dukMmHXPSE5$LTnvGS8=
z Mr
<Module>
#=qD4n8L4W9wQXrF7w_31K9bjmy3jeB41mSJJrYkh6lpiE=
y$2d
#=qtS81hD$ORACBvdEkFyqaXA==
d KT=
+O +
#=qNn8WS2rooUJUoMsG84mQ7PkK4IQF8$E42cyDjfL7Kqc=
MulticastDelegate
b`h*&+
#=qYKspnFhL3rrV8a6zSvXJWA==
""U/
#=qPYtEwg1BZk5tP9KKNl$36tqIdWilqjeWcpWKL2Zxnug=
#=qcp_YDS3uDXZMDFWGeFYphA==
#=qGPdnFVTlqnS4tiFpuQulXa$2eC7Pe6YqVeImkUGsMl0=
#=qaysgaPdcuRrUvev6__tYEA==
feffeefefa
maYxJ
#=qJT4I5hOweIk$xYFEeDszbikglXCuquUd$v9AXtyq2ns=
-,& ~(
&e,P
ToInt32
fefeffefefea
,'TK
#=qVqLFp2u1the0Txg1vhieSw==
#=qoGHQsKlZ7jK$YeTeBpzDNYYM4Z1FIrOpXaDV$VTAdfM=
#=qJAZ7is41tIXMNDQIkGLgjRC15Eis_QBrdFx8JT2Rx54=
#=qQ3JMSE9km3mGmL6lmUfRHw==
#=q98hMbgVf4fBR3MKeaM4uQI$YRLQdIr1biYYF5369cW8=
#=q6pErmyx6x4$YkotXXEXGCt_ysi5JdNm1fpNgnUvZ9LE6EtA8E0TapqXrPnqyBO1x
#=quebj1wBCmruzAKmg6Y4Igg==
^>g#
BinaryWriter
get_UtcNow
Lx,en#lwJYeN
#=qQrBlfreeUYUGyN3hPOorGA==
#=qoKFLFqm7bb3VWsU2QKXIQ4_6anGbTCWiZAfrNlgq8fc=
&&*}#
#=qFZLDtLWdUONY4B_gU_jjJi4BgFANcRLPMuWuQINdRLc=
f!4R
#=qgSHqO_KLHRARFg70SGn_Mw==
get_Exists
<!j_
SizeofResource
1R8!q
BuildingHostCache
CreateEncryptor
.Cj9
ProcessWindowStyle
C1 ^!
&&*}
ThreadExceptionEventHandler
#=qHdV5wMNiXS49lDrqJF3pqA==
&~0
&~1
#=ql4R4vy5H067cy2C3KkF7Mg==
#GUID
#=qhSKaq9YW4A_ja0UC7Difmw==
#=qtxap8xCUFH7z14nNy3cjjw==
- &~7
- &~4
#=qhme1CFqs_evb4VXik7N4x7lNdqSfuNy3r3OUWZ1V4Zk=
O/iV
get_Exception
hXsi
&&*}n
feffefefea
#=qaCmGqb7phy5lq$DAzhK3vB71XCZSvhKm3BtGKq_xBto=
&&*}c
&&*}e
%%BN
&&*}X
#=qKxL6kQaUyB_6jIG3mQUGOw==
#=qrjPq4iPb$PLckcObsgRE1Q==
DefaultMemberAttribute
Ci_; m
h-;2
#=qxOFsoGbvlBlUujyS9g3fPQ==
?qV_s|
9`z>
#=qo$DZvhC1PKdsChUToY52NA==
#=q61s8d6EIAdSsDLLjqchw1w==
5h4[TK
ToInteger
9 9R
Q! z
Write
b+
g##Y
D/m"
GetFiles
TA.{
#=qbMe5UnnXEF8aurHaZz6klA==
GeS^
-*&
9zf&
#=qs202XG_JxpBwpKhptOZhRA==
O)q{S
>M`?
GetPublicKeyToken
#=q_5hmJXim2EG1abw3Kju8nMffXDIbl5na4zXqclsRK_s=
#=qOsu3u3mLIa8ikCCuCoOv_w==
EventHandler
-,&s
Thread
#=qMWVV4JCreo65oWvwYJqZWobqlgJkr$K2AUIqF$weF5s=
Nvbl
#=q1jj2Lo3UBKUZkdI2bLcg4QlXuNGNWZ$CYnK9VTZNEsA=
#=qd3Itd1ELDPHJxhLvt0y1NQ==
#=qoygY$KIlhsLDneTXkJ_L9A==
#=qvPYkN4Wli543LScsy6rh$bZ0bDIN0tYd5zlNUibOEKfBRc13v6NIDRtsxPOZzKpX
Microsoft.VisualBasic.Devices
BOR
MyTemplate
#=qrIbbxniIme2qLTdRw6i0wDoZFMH5BWs03iMeSnjojQU=
#=qb8Z0_4AS4r8OSPknVYvDfA==
NnIU
Y)&d
InsertAce
SetValue
Encoding
Td b
< 3,bDD
QueueUserWorkItem
get_TotalMilliseconds
SetKernelObjectSecurity
tk('Eu
ReadPacket
IEnumerable`1
#=q44BQlEuOnjFd0LbnzKKIIg==
#=q9T406SLBpfhYfDTkCrB28g==
#=q2LHISsr6oVwPjyrC2AFTD2_CdAouK60pDkoTs0efRSU=
ObjectFlowControl
z~}
),(S
-#&~7
ReadAllText
hF'J
;FnwZ
?V^:
CheckForSyncLockOnValueType
B ?4k
;tIH$
Lz>k
w7 4
i!C.w+s
#=q2l$b42bR_hlbzUjQTk6vFw==
ReadSByte
#=qfOXLv$ej4ffVoa9QN8Vke8O9DCKhSHEsi_sqFk8Qf0o=
hbBA
@c2_
IClientUIHost
)B\o
9'sL
3/*
y:`,
5Tij&ryed{
ToArray
#=q8xbuK7pqyq7mWB67vviBtOo1WSCccuR7xEQnGnyxMyQ=
#=qCJD3QzeNpOG7t7hUNPqgxgwPhMjv4aui2ikN049iz28=
#=qbUu2Y2P9FL2iRkWyb62gww==
L}|hY
cMo)
XaY
#=qwGYG3$xqr6oMjxRyF4i0Uw==
Replace
#=qFWLbBQgFiIpy22HFbhF9GQ==
#=q0g2hVR4CYkiIvLHeQL6tUkW2KQhRibG1DIo1pReSOj8=
System.ComponentModel
#=qKKJCW_KTAsIH3uNlP3Z4Tg==
LocalMachine
#=qWLKNBubktRcyu8vI4dIAJNOqajvyL7NccmUEC4QD9y8=
g9tB
-b&&
#=qfjs2lYYPRWKuXjeHrc8Rtg==
==az
#=qHamFicykpD9fQKnU2wtqJw==
\ FP)0
?D> ,
get_MachineName
#=qPbvCT$UNIh_DPMt5F02Hyw==
0D2T)
5V Z
TargetInvocationException
-?+
K%(L
iVhIpT
#=q0FQ_PiagXHm_B8aG8Ji9Dw==
zqT`
#=qIZP8IX60gSYF82kuZejmg8pOoXfEBczapTTwgrWM$fM=
[vg)\
#=qzzNUaijPluPyLfyxwDObxw==
DQTF>
#=q_NLac$XJ5lIxZMpXsr_nBw==
#=qlsj4Kl0M6SYgZMJLZ$QkSw==
f2ri
,&+
v}Mc>m)
#=qFlz$$vhlrnZb7YOji0eF_QZBzkOajT0w3UoQbgnXVIA=
#=qGS6wNk5u54YEpqtjtMFIpQ==
#=qvvhgGCgMlZiK63M2bP1Kcg==
,,~M
#=qnnmAgQGEsJw4dsVn9gN4wJbRL4WqsDa_V0QuBPM2E4A=
#=q0EPYqANhk$fGDlTztPFu2jRCdUruoFdUMwStI_GHseI=
System.Collections.Generic
q S
+fc5=
Compare
4,V5
/t|e
Queue`1
#=qOn6YhA2JjwnYZ_7D0fnnEw==
k( R
#=qG5YZbexfSlZk_cwFxKFh4HaY$Krp4rK2HdCH8OIs4EI=
#=qXCoQdguduOewiATPKLDvyekx3X3r68VNkZOPBX9O5lY=
- 4 ; U g
l`'M
#=qPjPHWXGbaA$51Cna2ZaMpQ==
( [
yitX;ZGV
)iCY
#=q63A3zH9hQ$3c53x2wqU0Qg==
#=qibDx9sEkAVZroec7HmNu4g==
XB6:TLE
O"/L
IClientLoggingHost
*hsO
#=qcrlhteALkcfYnKFH$UWw$HzZqj8gdN8_KwUKIC_ywUo=
#=q0myQQ6i89t9SZyjYDXZrBLa9ljWEUD7zAwJyyFZowQc=
WriteLine
System.Security.AccessControl
|QWw
`T;l?
Kv 7"
#=qTawRDksY2KFvY5V2vw1_pA==
-b&(?
*N(;
#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=
:hu'a
F=Vy
gv%m
get_InnerException
- &* +
^`:
{mxt
#=qNzt$mJakh1Nxv4vDRDjTsa1OVDKMAlRCO__qncxMoXRz8jNE7AWvE0B4WIqANR1p
A}p
GeneratedCodeAttribute
#=qgCcrNFC0iLB8hKTy5iNnsw==
#=qhg8oaKg1xx$HC$DKnlbXQpibwH2HXqMGSlGv30vEUsU=
2V~s
Remove
8tQSi
#=qi_z83UuaQZa6UsXCAahbTQ==
,Z7
#=qURIxMOG0HImwEP4A6zEiPg==
^pPZU
-p&~C
#=qTZGarPS37Dw3Z3Ipg_AFug==
#=qXz2OER2RItZOjngvYurWLQ==
?^Y<
|SG8
#=qSoHRCAcaypsR55EueXBy1g==
ehpi'
set_RemoteEndPoint
!a=^Q
#=qNZVIIdU4QECigaum94nwLctVkDSuRt$X4_IjuFpWVuY=
#=qAbQ42UrUbGpmkYA2zun7Tg==
w5XD
&&*}
~h<f
#=q6V4Kle56uZFNUY$zkrrKJQ==
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven03_64 Seven03_64 VirtualBox 2018-04-10 12:43:48 2018-04-10 12:46:41 173

11 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven03_64 Seven03_64 VirtualBox 2018-04-10 12:43:48 2018-04-10 12:46:41 173

9 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\35478.exe.config
C:\Users\Seven01\AppData\Local\Temp\35478.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\35478.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Users\Seven01\AppData\Local\Temp\35478.INI
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\run.dat
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\Exceptions\1.2.2.0
C:\Program Files (x86)\UPNP Subsystem
C:\Program Files (x86)
C:\Program Files (x86)\UPNP Subsystem\upnpss.exe
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\UPNP Subsystem\upnpss.exe
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb
C:\Windows\symbols\dll\mscorlib.pdb
C:\Windows\dll\mscorlib.pdb
C:\Windows\mscorlib.pdb
C:\Users\Seven01\AppData\Local\Temp\35478.PDB
C:\Users\Seven01\AppData\Local\Temp\35478.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\catalog.dat
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\storage.dat
C:\Users\Seven01\AppData\Local\Temp\ClientPlugin.dll
C:\Users\Seven01\AppData\Local\Temp\ClientPlugin\ClientPlugin.dll
C:\Users\Seven01\AppData\Local\Temp\ClientPlugin.exe
C:\Users\Seven01\AppData\Local\Temp\ClientPlugin\ClientPlugin.exe
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\settings.bin
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\settings.bak
C:\Windows\System32\tzres.dll
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\Logs\Seven01
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\Logs
C:\Users\Seven01\AppData\Local\Temp\Lzma#.dll
C:\Users\Seven01\AppData\Local\Temp\Lzma#\Lzma#.dll
C:\Users\Seven01\AppData\Local\Temp\Lzma#.exe
C:\Users\Seven01\AppData\Local\Temp\Lzma#\Lzma#.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\SurveillanceExClientPlugin.resources.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\SurveillanceExClientPlugin.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\SurveillanceExClientPlugin.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\SurveillanceExClientPlugin.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.exe
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.INI
C:\Windows\Globalization\en.nlp
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\35478.exe.config
C:\Users\Seven01\AppData\Local\Temp\35478.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb
C:\Windows\symbols\dll\mscorlib.pdb
C:\Windows\dll\mscorlib.pdb
C:\Windows\mscorlib.pdb
C:\Windows\System32\tzres.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui

Write Files

C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\run.dat
C:\Program Files (x86)\UPNP Subsystem\upnpss.exe

Delete Files

C:\Program Files (x86)\UPNP Subsystem\upnpss.exe
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\UPNP Subsystem\upnpss.exe
C:\Users\Seven01\AppData\Local\Temp\35478.exe:Zone.Identifier

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\35478.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5aa75839\10fdf3
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\mscorjit.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Drawing.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Windows.Forms.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKEY_CURRENT_USER\Control Panel\International
HKEY_CURRENT_USER\Control Panel\International\sYearMonth
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|35478.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|35478.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|35478.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\culture.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_CLASSES_ROOT\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\diasymreader.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\4ecde57e\31d9ddbb
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\a054161\46043f61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\219e9581\29613036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\219e9581\26d59603
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\InstallationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Data.SqlXml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Library
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\IsMultiInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\First Counter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\CategoryOptions
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\FileMappingSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Counter Names

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\mscorjit.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Drawing.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Windows.Forms.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKEY_CURRENT_USER\Control Panel\International\sYearMonth
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\culture.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\diasymreader.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\InstallationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Library
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\IsMultiInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\First Counter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\CategoryOptions
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\FileMappingSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Counter Names

Write Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX
Global\{cffbe2ba-22eb-4431-9029-d3454f586d54}
Global\.net clr networking

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
kernel32.dll.QueryActCtxW
ole32.dll.CoGetContextToken
kernel32.dll.GetVersionExW
kernel32.dll.GetFullPathNameW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
user32.dll.RegisterWindowMessageW
user32.dll.GetSystemMetrics
user32.dll.AdjustWindowRectEx
kernel32.dll.GetCurrentProcess
kernel32.dll.GetCurrentThread
kernel32.dll.DuplicateHandle
kernel32.dll.GetCurrentThreadId
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
kernel32.dll.GetModuleHandleW
kernel32.dll.GetProcAddress
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
user32.dll.RegisterClassW
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
user32.dll.CallWindowProcW
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
uxtheme.dll.IsAppThemed
kernel32.dll.CreateActCtxA
kernel32.dll.GetCurrentActCtx
kernel32.dll.ActivateActCtx
dwmapi.dll.DwmIsCompositionEnabled
user32.dll.GetWindowTextLengthW
user32.dll.GetWindowTextW
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationA
kernel32.dll.SetConsoleCtrlHandler
user32.dll.GetClassInfoW
kernel32.dll.GetStartupInfoW
user32.dll.GetWindowPlacement
user32.dll.GetDC
gdi32.dll.GetDeviceCaps
user32.dll.ReleaseDC
user32.dll.CreateIconFromResourceEx
user32.dll.SendMessageW
user32.dll.GetSystemMenu
user32.dll.EnableMenuItem
user32.dll.SetWindowPos
user32.dll.RedrawWindow
user32.dll.ShowWindow
user32.dll.GetWindowThreadProcessId
user32.dll.PostMessageW
ole32.dll.OleInitialize
ole32.dll.CoRegisterMessageFilter
user32.dll.PeekMessageW
user32.dll.IsWindowUnicode
user32.dll.GetMessageW
user32.dll.TranslateMessage
user32.dll.DispatchMessageW
user32.dll.GetFocus
kernel32.dll.GetModuleFileNameW
kernel32.dll.SetCurrentDirectoryW
kernel32.dll.FindResourceExA
kernel32.dll.LoadResource
kernel32.dll.SizeofResource
kernel32.dll.LockResource
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptCreateHash
bcrypt.dll.BCryptGetFipsAlgorithmMode
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
cryptsp.dll.CryptGetProvParam
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptSetKeyParam
cryptsp.dll.CryptDecrypt
cryptsp.dll.CryptEncrypt
kernel32.dll.ReleaseMutex
kernel32.dll.CreateMutexW
kernel32.dll.CloseHandle
advapi32.dll.RegOpenKeyExA
advapi32.dll.RegQueryValueExA
shfolder.dll.SHGetFolderPathW
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
kernel32.dll.CreateDirectoryW
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
kernel32.dll.WriteFile
kernel32.dll.DeleteFileW
kernel32.dll.CopyFileW
advapi32.dll.RegSetValueExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
mscoree.dll.DllGetClassObject
mscoreei.dll.DllGetClassObject
diasymreader.dll.DllGetClassObjectInternal
kernel32.dll.DeleteFileA
advapi32.dll.SetKernelObjectSecurity
kernel32.dll.GetSystemInfo
kernel32.dll.CreateIoCompletionPort
kernel32.dll.PostQueuedCompletionStatus
ntdll.dll.NtQueryInformationThread
ntdll.dll.NtQuerySystemInformation
ntdll.dll.NtGetCurrentProcessorNumber
advapi32.dll.GetUserNameW
user32.dll.GetForegroundWindow
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
psapi.dll.EnumProcesses
user32.dll.GetKeyboardLayout
kernel32.dll.GlobalMemoryStatusEx
user32.dll.RegisterRawInputDevices
user32.dll.SetClipboardViewer
user32.dll.SendMessageA
ole32.dll.CoCreateGuid
ws2_32.dll.WSAStartup
ws2_32.dll.WSASocketW
ws2_32.dll.setsockopt
ws2_32.dll.WSAEventSelect
ws2_32.dll.ioctlsocket
ws2_32.dll.closesocket
kernel32.dll.GetFileSize
kernel32.dll.ReadFile
mscoree.dll.ND_RI2
mscoreei.dll.ND_RI2
kernel32.dll.GetCurrentProcessId
kernel32.dll.GetComputerNameW
advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW
kernel32.dll.LocalFree
kernel32.dll.CreateFileMappingW
kernel32.dll.MapViewOfFile
kernel32.dll.UnmapViewOfFile
kernel32.dll.VirtualQuery
advapi32.dll.CreateWellKnownSid
kernel32.dll.WaitForSingleObject
kernel32.dll.OpenMutexW
kernel32.dll.OpenProcess
kernel32.dll.GetProcessTimes
ws2_32.dll.inet_addr
ws2_32.dll.bind
ws2_32.dll.WSAIoctl
user32.dll.WaitMessage
kernel32.dll.SwitchToThread
ole32.dll.CoUninitialize
ws2_32.dll.WSAGetOverlappedResult
kernel32.dll.FormatMessageW
kernel32.dll.SetThreadExecutionState

Execute Commands

Nothing to display

Started Services

Nothing to display

Created Services

Nothing to display
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven03_64 Seven03_64 VirtualBox 2018-04-10 12:43:48 2018-04-10 12:46:41 173

1 Host(s) detected

IP Address Hostname Reverse DNS
51.254.93.85 France yesilseo.com.

Host(s) by Country

Hosts Country 1
1 France France

#infosec #automation

TheSystem Itself @ 2018-04-10 12:45:04

Detected family: #Nanocore

TheSystem Itself @ 2018-04-10 12:56:02