MalScore
100/100
MalFamily
Nanocore

WindowsDefender.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 58/67 Related 2135
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 202.50 KB (207360 bytes)
Compile time: 2015-02-22 01:49:37
MD5: 07121f08945fc8853e60830f694b54bb
SHA1: 09b051524108417a7cf85a8c57542aeee120889a
SHA256: aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .reloc .rsrc
Directories 3 import resource relocation
First submission: 2018-02-16 20:06:04
Last submission: 2018-02-16 20:06:04
Filename detected: - WindowsDefender.exe (1)
URL file hosting
hXXp://cofina-app.herokuapp.com/public/WindowsDefender.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-16 17:10:14 [58/67] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x1c798 116736 60c19671a58224329dc914a933274f8b 0294cf2b2c93272d5f15a9adb479ed40981b3d5e
.reloc 0x20000 0xc 512 fa81a8e21b7ba0db59d9a42aa7a5e570 73c936b34cc7723ee95c73f137c13c4ffafdce53
.rsrc 0x22000 0x15d90 89600 143555d12cf2092a8557009e4453ccc0 789aa3fabff48200ef0e5c3d0b3b3cde4634be49
PE Resources
Name Offset Size Language Sublanguage Data
RT_RCDATA 0x22058 89400 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
No Meta found in this file
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
KERNEL32.dll
ntdll.dll
psapi.dll
mscoree.dll
DNSAPI.dll
ADVAPI32.dll
IP Found
No IP detected
URL(s)
No URL found
]"Q+a-Y6I
$#%#&#'&98:8;8<8=8>8?8@8A8B8C8
#=qWaMf_MISHPEu34of2Bm5$ay6Z6PuaGN7w1jlKYjzwdE=
#=qzRf5_jFnPo03SqY9Fq$uTg==
cK I
#=qEVnoj7wKonGmgnYpK7PNGg==
DateTime
[[Jl
aqz)
@h7s
^ ,G
FindResourceEx
Int32
BQjR
ValidateBlock
#=qHiBdWLOLLVg67b8lN8FRqgmYNWZfcDieu2MH9_zIY6Q=
#=qtDC6IoLr5pnMo1d9qdAc2TBOnWqOdlEZHf8Itbl8cJc=
GetBytes
#=qPNzwB3EyeKwH$TwKjEdAjAC6A3IlGhANCdkUFCgvEiw=
#=qo734_kbse$6lTIlwlz6A8A==
#=qYuHUjnyRYHZqCkKAt0jj_9qFBzmTZKte4i1ou04eBWY=
#=qjcSlrUNMLgvZWN$58FXdrl22$0OjCpoqksNsslRtIFE=
K>`B
SocketError
p>yt"~[sD]k
NcV$
ResolveEventHandler
NtSetInformationProcess
\ S#
}97Vu
get_Height
j Brt)
#=qQbsDS5g6rYgVt4AUW_pPJ8MQlCJBs7uyF9EY8OKREmQ=
3Fds
Ne3C
#=q5MtzoDWNtlkksfPTHs5qXlK2k7ZehKenYzDJQrgdOII=
#=qM4zv780c6Jc3GVu15xhaulIEjuiWD$RKEtosugOXKLA=
"7xM
|w (lf^Q
!{Q(
#=qs1aB65G6$bPi1$cdOrXkCA==
t-j_
]Dz>
WN@_
PLm4
#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=
#=qixBu4j6Hm11f3$mLrzkCcE4AVWtWeNn5nQguwdGbWGg=
#=qqj4vWwKBJgvjF_JTc8V9cQ==
#=q0uUZuMiILVbPeB$t7lx1a0Is1IW4CfkB9ovgW99kERQ=
>\=rl$n
#=qyNgKOA3iTYvKx8QtBmkDXA==
Version
#=qbbSw65PC$nto6DJiWxTawg==
#=qjVLlQtRAzKVOtyLrw5PhiGVVmXqMJJOsTT5DxaenWCY=
}cOD
ebiA
IEQ:
#=quO7UmvJ4RBuIIChSn0jx_M$HL4rBuRuRZnNBEMlpsJw=
p$%
#=qyM$eq2QFDjIwNzxtrtw3WE5gHFsUOsREqnRunYWzTvs=
ReadAllBytes
DebuggerStepThroughAttribute
1aml %]dp
s6s)
% ;Z
}KXE
#=q4kUEXPi93MnvgzV6ySNPRQ==
#=qvX$J24rI0eJ0gWfA6CEdzVJN7bQN_YTuS98N0yyMYPo=
#=qYpD2x2QTNARNJcnXxG0OjQ==
i`zH
PtrToStructure
L^HT
#=qA4f0kKyGXTRnU4z03oji_RIPyVnvoC_BRjpESDLHXqY=
Marshal
#=qw1t7iX7Q4P$CBQxdhg13BQ==
#=qTAs57ZkYafcLC2FZLCGAiQ==
#=qUDQctXsgw3eGxqcYAxP8MQ==
#=qCKX0qzAtjLAL9KBPrJWkOA==
J$
( F+
#=q48p8EJcbwRuSJ9efJfzTZ7uyOBVlFQpnFVv30w93EJA=
lI2lpf
n5hF
#=qZRkZQGrnZUWoFBVE_TP$5Q==
&bpD
ProcessStartInfo
f/mi{
)Z`ao
@aVE
Lu|c
#=qm5VvJvLZD$UcnjvypC5XcA==
QA&F
#v2oE1JZ
)Oz.
(Y
Sp{:
XaX
XaX
#=qP42Tluk0y5t5VrN_nwVhnaX9baaRq2NaLaW6RMHNX_k=
z pm
ControlFlags
B\C?
Y_l_
OpenProcess
,1[Q|
ca X
#=qw42CdKVHw2dycv8VU7DItg==
0(nQ2
$4eSK
&~
#=qFgBBonKcV6U3Je0BKZZdAZdyEla0MkDel5SRrEzLUvs=
EndInvoke
- (/
uXU|
'w7|1
@y%\
IClientApp
#=qRpw30Lh0nfhDryqjhyjikg==
#=qABNlGFDc7nOg_C39swAcLA==
zw]5l
#=qQ_BBkbckkXGbXV1nE4Sw4w==
&ww{
#=q8McCIarwH$XScVz0xkTmJw==
Hc2R
#=qjIje6jGWLd2EOkfZXKqBbg==
EnableVisualStyles
EndOfStreamException
#=qKwlvi80KuDBelBsvucNuhRsqXRtqCfWqVH1dUPmd6_o=
#=qc46h_4WA5z0UkWODs1nwXg==
6Xx*
-*&{c
#=qIKJSaaKraxRzi3AD57FKg9MQkSdmOqUcHNxKjSZFGkg=
#=q74AbaKJhduohKQ4YDrC28g==
25!i
Increment
IClientNetwork
&XU:
.4 W
|9L[
#=qiGEsYAsOSz$jy0hyBv5MGPdLIlePpwWMgCE_Abe_mLY=
\>',1
#=qGqLDylJy8NmMEbMDJmKtoQ==
h :f
#=qyGoc_ssbL9RdagmvuBld1Q==
U.~t
cs99
<5fo_
[O}*
->&~
+DDQ
#=qtRuLPG6CownVXpQS2Jma6EmxR$R$u15FKPRjOSzCUIw=
wUAl
&*&+
#=qDJ4yS7fCDfIiEVFkwyEE6G3$$73HwRgy2_eKZUkxaSo=
Format
#=qalo3zYdlWWh$dYSx9JnNrw==
#=qqnp3i0xG3gb2LwEmwQLB8NQerATuB2G0aH1k$$26lgk=
#=qYGqPwTlQx5HSyCMpKnJtwO$bA4uyJcKD$pA6WpBamRM=
8=nB
#=qKraENZVscKMtH4GMIJjzqA==
#=qUbRtqAPcSxRMI51YgNXGZ9omJvV5BvuqBNocgi7xl6Q=
# I$
w6=s
:8 "
l_vtr
GetDetails
xEwPrK
J- !W
#=qqCUKpKbVq45Cc9OUN5wTXw==
V !*
->&(
AppDomain
#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=
s%dEUK
GJD?'.
afeffefeeffe
GetUnderlyingType
wJ-;
f C'9
ThreadExceptionEventArgs
#=qyI9vgsKRXHDyyks4VCAjzA==
Ynzj
get_Assembly
#=qth3CIdKay4zIa5SBJzx7eA==
Iumu*
q 37(
#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=
'~<i
#=qV4bSY95FY8CPz8U7EzzkRg==
mMr~
OpenSubKey
i!1}
ttpJ
KKzI
#=qsR25pLrAgwps$DwdB_BuUbMipiUFFEDkypROuvRRPj4=
#=qj8dHXOkfX1HmIFktLFgFBNrpDhCGGJk0RPJopDOaBy0=
#=qcDfNIFv7M2KbeeK2ufHf3w==
M$-8
n&W
TextWriter
set_LingerState
3RD `
#=qCN8q7dxuBuds3rgIjZ1oLA==
Z'Wc*
#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=
/#_f
#=qG8K0lOrmHWfP2KExoNv$5w==
tz^py
AssemblyTrademarkAttribute
#=qcfHq18AlWjOy12tBCM8Tbw==
SecurityIdentifier
zIh(
RebuildHostCache
#=qXzNbY0aXEU2Rr2_Jbe87og==
#=q$6Q_u19FhL$wNOun9AB$CQ==
#=qedcCJsW_6aMZb5lO3tR01A==
,;lD
#=qM040QWzx1oySCgUyYWc9zA==
,cKvD` l+
Path
>(mk
#=qr9m9EjuYAP$2E3p2xadfFhcTH6toAhrm0dlfOTldiWRsdXd8UmnkRkYrV_8$1gaA
ReceiveAsync
(-/v
q:{
#=qHtuZg55b91a614FmHMsOMQ==
44rx
#=qI2pAr92bRdzddapVaPVhbQ==
Zc/3
#=qrSKFiRrFo6$kUL7kjfG3zg==
#=qJ8bMKCzzllPDbJIfPSoGMA==
/c T!
R .S
#Blob
Control
#=qgAKbtXqj_idozuy66wPGJA==
#=qTEC8gcgkt672qW159Oe_Iw==
<.|v
QEY
nSM
2<|s
m/}8
#=qCeF2tfSXulrE0bbyPxU$1ik7Jf3avSO4FKBmKNH9QLg=
#=qbYAYBaHwcEbf1CaxjAi1bw==
#=q$Rh_ulnlhN$9Zn9n4fKAsvWT9cisaHT_PgvcGANnd6o=
ToUInt32
NJS{b
#=qVVQJ$z9bl7kHgfvJohZnMPofzhiFJ4f4yMGK7Tpp6xg=
rLg5
ReadSingle
#=qDB62T9X0iP_6WNTXOuwQnA==
#=qp4XZ9Ss3K04S36I$7WhtwQ==
#=q6jLYuOOmC$a9_UySsUlsFA==
Type
X:II@1(
2(J"RUn
, &oh
_)Z-P
#=qphSRC1xHjYarc$NSFAVMID1iP8dwbr6BCaxyrkptDP0=
BaseCommand
`^?%
9YMN*
#=qsYpthruwyrknxFdWaNp9Vw==
#=q$XurN5kwCvUuDGDncP4myluEGVmoB5AfvTb_Ct0PT5c=
#=qraB64nHTnRXCE4d7ffs5aGExarxpEh0COAPaEFI5iV8=
#=q9RHjNFjnLkbqjNKidtUNeAGLmByWXgbKwjLfhcq9NOc=
#=qtWaDSiZ3KDHpQtSfxDZV0w==
#=qChXzjuiVYrb8OlqJPajoUA==
k9kJ
+ +
#=qEqEPF0jj3sUIryvQNEKKCV9boaHFZuHXMROqSn28L3g=
bO_:
#=qEk42FAaXkrNIu2TP76IakA==
#=qP_nucp5xdFjeAVWRfZ2XfmvYhkwWbeeu3y2fkxvS0yA=
#=q7uQjJN4fKJgs403tXnERFbQ1VWp3FBsMW_1ZAWZtc1g=
x4~Z
#=q7b0FP8eSMCctHkHIxEb12w==
c'lp
Item
#=qVqTMYHwCmwUHM6kkpNkbGw==
#=qQRAhbbFlVBfqrgso8zehPg==
"%(L
get_ExecutablePath
9feffeeffefe
Char
ExceptionData
#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=
*&+
m y?
#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=
(a
get_Name
GetValue
#=q9VIijSO53lpTS2jV37$Suw==
2 Ym
- ~V
HashAlgorithm
sUjT[
get_Y
#=qgB3pFGrOVxm7f$sXZD67nQ==
_A2j
gcH0
0s,&
@/o
_Lambda$__3
_Lambda$__2
_Lambda$__1
&+: +
_Lambda$__7
_Lambda$__6
_Lambda$__5
_Lambda$__4
#=q3vPs064Rj1jBOLtFVqV4DA==
#=qrPQtMswclvOlK1AxL1S4K8M$owLGUpQfjJA8CWW$fj1az7m8LFibY8IeMxHKi4wi
_Lambda$__9
_Lambda$__8
#=qQKYqF9uhb3QdjdrkvuxjUw==
.;M`K\
-! Jo
qX8g{8
Y(
+Rmq
dL7J
#=qyU_gXk4hv73zg3zoSZSLhQ==
#=qRHdMxv5xMrip5nI3eHU3Y52nJ9DhG_ImQVoJh$ooupk=
#=qLLh1749MqIyRucx6BFMp7Q==
)KDp-
HlRU
I+E7
(NsP
#=q$7KUBFuOZT85iBmKYeGgXQ==
StandardModuleAttribute
N3`)
Ds1/
x>BHm
seT/]
#=qeWvkoUO61qxfYbQKV$cOPQ==
#=qAkkjpY6IHZssIsQ9hAxzTw==
U#qS
@j?~
GetParameters
s 3{/
oy
3Z+ +
s<}a
jzOD
CTnc
fefefeffe
DialogResult
ToBinary
LogClientMessage
b V{
<&$+
;RC=V
+ C8
.text
List`1
#=qj9swjNLNpEBN8mkOlVmrOw==
ha5eeJ
GetString
#=qAM4ZJ3aDwBm_a3IkqHxLmjdKzHIQbFeE9thLHux2o6g=
<R,Rc
WindowsPrincipal
Component
LockResource
BuilderSettings
]kj+
,$+
GetDirectoryName
r|-NU
#=qqRc2eOIidDtWq4y7W2lAhSyv$pBRJdAsYlXSRUcwizw=
];gh
#=q$mqGRbJ2J2TNgadoLHYnIQ==
#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L
9 ^8
].WeqO
get_AddressFamily
-,&~~
#=q6TsObh1LqPbvVPPz_YjbtgEdyXL$082jRqG42$db3nw=
#=qe9p_PgOCiouYWahOSDKth00dr9CdsTb1R3DYgCeLUBw=
#=qrmavK4kbgFTgX3_IUlEoRw==
#=q4X5fhkJm5XS4LlpLIyB6bA==
"3L
#=qhE2P2k46jiSSjO86g3nB1MkLGC9_3avDpI7iYbUHr5g=
<~JR
^U_u
6lR@
#=q9rPQSTp$UBZiTGc7mKlh7h1QvRgfs0p_mQAaIRjRIsQ=
#=q6OqJPhANvYfkdc5uh_IKsUbLoI4zVFCxs4fpu7Vxr_U=
Single
#=q95w9MpaG4ZcgkGgnmQITOdHr5IaLXD8aC6o3EqtE0PQ=
e0 8&h
#=qABSlSWKh$8sT$UF4sG_vQMmKqh5lDRXHlL1yCp0W8x0=
&`_*
StackTrace
#=q4P1tyVDbmSIMgskx0BrPh5ZxjoQy0earrulDSsNhpg8=
#=qRbDxNN_CBpjdn11hjtWoZg==
Monitor
#=qUVvjDZc2eypEDWG9cFZdTg==
ReadInt32
#=qxYJIjuXFTjRvt41we4akdH1WN2nLMpesVOXXsYuSrHM=
#=qsLIORBvLMZm5c5Lb9Cm$GQ==
">>jP
get_Variables
xg4a
i;kR
#=qZnbTkU5kDU8O8$hMGiNZlQ==
//60
CreateDirectory
In-
PluginCommand
PipeClosed
* +
StreamWriter
;ZmC
#=q4o4zrrzr7uOw3pySDBOwZtAOdlhvudqcbIbhABkQfe4=
g<LJ[
lWKhz2
zy_<
<olv
S(.9~!
#=qnk9x1Gmlq5UZ_X95yAl14A==
)u;t
- & +
nRb<
GetKernelObjectSecurity
1-6)
GetCallingAssembly
WaitForExit
U3hQ}d$<
#=qOWs9MBREWujnaIdYgAI1lg==
#=qhv_9OQaSyr5PWElvgkBxFw==
#=qScWgGHvDwJ0da_7qXoO28aGE1ea7zp5$XjEJLTXkuHQ=
System.Net
Conversions
#=qpSjmalSIZ6iBUAWRLBOkQ5sPqtZAetb$LjkOVwAdUac=
NfefeffeefY
#=qD3hoTFeBJT$SvX_fQh_aIw==
#=qBk9t7p9S5R095rOkFdE8GQ==
%I1<
IrWs
- &&*}
Jp-D
1Cr4
C<j2
[=@r
%(L
v@@t
CreateDecryptor
coC2
add_FormClosing
#=qArVl3RpI3eEiVf0qXoqrWw==
#=qcDgE7pmQv6niirKxFRMj7Q==
StackFrame
#=qpghRvZG4ZfcsmvAYC$o8qN0WjB387Pn9cG$Y9HJ3uwU=
kernel32.dll
so1XjDt`
#=qoT5qP9FYCI8F5V3gKO7eMg==
f f
^J>Ll
#=qL2Az2fdQv6DkEBC_x$bbMA==
GetHostEntry
0:`2w"v\
5a)\
<generated method>)
#=qXyCbQ53pEXrdqhJ6oXoHqg==
Enumerator
#=qlt$K8Ex4tZEPwTl4RuqGMw==
#=qAp_zHqT7acjq$QNiBoq2EA==
#=qfvzoVBS4j9KdxyngOlL_NauqVYLAaOZVw9dutKQSAp4=
DeleteValue
Shutdown
#=q3fzZpU7POi9yYKua762KimE0tXDV2VRrjyJcPuwXgTs=
#=qNdKVs_XU_xYgnUK9ZfVshw==
4#Ve+
#eb]
FA Y
#=q6FX$JRP_bY_ZCQbx1UwWug==
#=qwSPuuWVW8tz$gDazhda2d$myXXX0Ro_wRP7Rmm8JiiT9wA1EeeaPUV2jnUkQOCHa
GQ+X
E%(L
mW/MB
Py{)
a6m=
#=qY9NY2gigPsj8X4CYx0UCT2vGlqkgsq6GuC2fWqP3Voc=
']mh
Akv9
#=qOKSmYE47P2z$UXqGETlnfg==
#=q3_xjz98EYRXgLslROl8imQ==
add_ThreadException
#=qhPbzHXREadcUSl6d6LhVYw==
&+W +
4l;l
t&XJ
jX
?@~w
Computer
#=q$E54nUJeqC5jURP4oCRU9g==
,K+
H n j
#=qV9UIxiLyaOi7XoTx2DUJwr8Ior26OirSZwM3mOvftrw=
IlmCOqm1
]XQN
UW56
#=q0msvLo3fKjQ5ucIFxkdur24Cc0tFDGimgcqgtAeKZq8=
#=qh7diH14jww3Fm9rMJ_jIfQ==
#=qo8RCFr_ecPE9NSA5cyD6QQ==
Meg
~A
#=qUomzGDQTZY7jASgBmW35Fw==
#=qYiXVlu3YVR5erIxfIIBHo1Gv4y4z4vrtnS$$9CALbVE=
#e9J
- &&
l7as
C:
#=q2c1dOwAlqEVK063i13$4Vg==
W[kr
#=q$P4U7B6$qbq6QJ_QX8MfyNoxYRq3foNT$OZzr5yEqDQ=
#=qonMVJIv_P7bZ29oJ_eSSxA==
lrE,
h-]6A
si"/$
+~L/N
#=qH8FTQLBlM6o0t6zf8SLPUg==
FormClosingEventHandler
1 <@
jJy.
get_ParameterType
m& q
s}pMC
a+3W
#=qQCd2OoCcjOFxsuzhZKv2M7$UnAX8JX19NdffDxgtv3I=
.+NZ
+vl Y
#=qFU5Nq8bBPIPoBGBl$k8ehEhmgSoFzsflrFNnOQsCK6E=
#pA
yrE*
Process
#=qWcYPgOJASLG6mRBDPhOIZERKO3Eig2IiEWCrUa$w_Mw=
#=q6oykuAaezoPWCQHwIFBGYQJoT_doGKMmOjpzn6ZJomA=
#=qb$tFKVReqZMI9M678cKWGdlE1UJqJBfHAfOfQhXuW5c=
#=qWNtQAckY3EoQ$HeRpEQ9MEcj4oiFXpw6QZThgsGNZIA=
#=qp7rlpRCprgGh7RCnHteaLw==
H,
OtXh
'%(L
set_IV
XNGBp
6z[8
2~pZ
[E_j
tT{d
su+y
!}>f
#=qFlM8LWSzwV9qMKMd32mVdQ==
#=qHauijmh2nJ5kHO6fTYBnJFZKkfzkWt5gB4mYS5OLOVc=
CEf;a
NanoCore Client.exe
* o@
* oA
l1{5
v1r;
~Y
,+&
#=q6zjWArzQ8Jv_1waqxSeP8A==
K864
#=qDOdV5duF980CDFSFl8oQpw==
#=qNz_Hz8DMWPqA8pVcg8d0UVymwvCurvyYgdZaMK3OhQE=
#=qYGU8a5KOsYzqpvljkWGWKuQS9mZuJYQa$8g5J6c9rho=
#=qKYm_FHWoJ42y$VrakLgWfw==
UInt16
#=qCgskv3QU4cEy8M7hqvNNBbFyow$DvbmSQrN8A5JJJWs=
Enqueue
#=q_WoKv7McWxMc2YtmbiVaCw==
#=qUZMwlqlTBPLi1iscPEnOdMZqp5jDsQ1UK2Kgux$Yn40=
#=qrWXrfWfqyzD06oY$LsE9ww==
#=qqROT7DfncW7strhZvp0iRQ==
G-LE/
EndPoint
#=qy2xCoaL3Dm6E0MYt7i8x7A==
-G&
c Qd
#=q4d$NdpGCMcL3TaMlT9EW69FacIvNnqDPMFNisgGhmsY=
.}Uu
#=qkzr_P52_BAWJXliKWvb8Z6oiWEishcUAemTNzwiiwkk=
p _ %
#=qCy_StxaanQioOSGQ9LimCF9_Wy9AMBNKclrIIUI0AWs=
System.IO
#=qQJBwIjtEvP$UD5Stcfj2wASGBDPz6YiX1yXx_MSfzPs=
WrapNonExceptionThrows
get_Now
#=q9iu_XWrg9WTOw3hVDQcP8ZcABJLoMYtAY0HfRbaBN24=
l)xgA_
[54
]uZH
o_
JBS&`
IClientNameObjectCollection
Console
#=q637XAKKKpMW09u9r97v4lg==
#=qszlIp3ITaFi0VCgRIaErNg==
#=q12n1704BGxiT9AoOoTNqog==
afeffeefeffe
#=qscQJIcBkI9VH8bZTZtABeA==
#=qWsAxoahmYzeECOO4WB9kTg==
,@&(\
}~mxW
X[+,
.pG2z
#=qpE_mRkS89WMXbQTdLD7bwp4pTt2zrWY_WBF1BLz1fes=
53u
- &(,
zdjr
#=qaSWqhswYp72H_CatHelXxw==
-;$I\
#=qU1g6m1CiJ5yzLECox1hBrw==
#=qvA35ZDPTM3VgF89oJb9AmWFE4pqnIDYGjeV5H4uvblU=
- &(?
:Xw;
#=qPgHNba2TbLgSqrCvG0e5Uw==
s6wzr
STAThreadAttribute
SffeeffefeYa*&+
+ }
, + +
;Xvk
-\&~]
#=q37jfceDpvm0BhKQMkpktNw==
ClientSettingChanged
^:jJ
#=qTfMnD_jfiITiB95ES2nWdLlDTdGOSDVgXEnjKNGkWcM=
C J6
Q)Vx/
#=q_$06eDx4N3eSJzkchUhbnjKtHnRsckM7I4ZqcwfQO8E=
GetConstructors
syp:3
GetBlockHash
#=qf3c4WtE$$thN5QyBMvo3u0lth2VF5hmfUsIv1r8yRkg=
p/P<90
BN-f
/BK!L
rQ~7
#=qksh921Ur22JKhSIAXESSag==
#=q2gthvB62n07fYVTx5fwIqxBAo1t_hs$il9Ac$4FY_Gw=
#=qxG1wJpkOHyc4AD8gtAdxAA==
/{ HBBb
r
r`?l
)>(p
,++ +
-j&&
+ZW7c
System
EventArgs
Application
GgWU
TransformBlock
z:Q1 W
Urp[
#=qdzx0nDkNduYsJ$MOZBFb6jelzyvbyiG7So1vqpZnVLU=
9W~z
- ~:
#=q_UogavoS8ANyZp2cF0B9t7qG1b3QUqGTYeTlmQIKxqY=
,3~?
xS/5
#=qDt_4RPbN$YmUyKsVRrbzrjU6uaXWwjHkaZoJAcuFCCs=
"=sO
E'Q"
#=qQLqXliLS$ujl108DGV7$zv9jo8WyYr7oxBJvAgzllyk=
y]da!
Wx1n
ClientLoaderForm.resources
#=q_jQLaNdtSDa6ovA0VGw50w==
[yH8C
#=q7_KHECinDx5vq1IBX7p8Ow==
( . 4 9 > C ] i
#=qAfx0INrfgWoPN$Cz4VEZYVFcKNxFeYaixc4CaQpU$0g=
#=q5hEV9yBEvglIR94FFM9OBszK4aiazrmJrQshba2kpDY=
#=qAk5SEnvr6iWKzWTaOapTEA_BFwuNkz68xuZLTnuQOh4=
ToByteArray
#=qQtwc_i6uv63Hs$aOrPLxrMU9lMXbhRW79NANZrRxozw=
- ~J
DnsRecord
MethodBase
#Strings
mR;
#=qxLboOdsVFLmyLD939$tUsnUMYRMeFnzOLiWxQdY7sdc=
#=qFBEI0HItLMNpyOY0AgRxSg==
]=0I
System.Collections
u7< 2C
#=q1abXKhVCyzVldE9ra9z81A==
#=qtLsfqPVQ47D3cdxmiwAJAQ==
#=qyow7wBpiCNNIoap9jI9L3Q==
#=qrcOHnfaYxPMN2$QaNhNmcA==
)S*K
#=qrXs2l$bWJlHMZLHncLNYyw==
#=qXuSOL4ETByiwdARI_Ds0Cg==
-"&~k
#=qlFQRS6FW1ex39P1F_VW7Eg==
#=qhYMTmNdkO7UsEcfduWinsQ==
#=q_gCP8hm5SSW7J$3R7xJuSA==
7(eBvX,#
NanoCore.ClientPluginHost
LG n
#=qwogjI4gN1imp1VeWLroXTk41PgYeLQ34zunh6NYu_3g=
Environment
RegQueryValueEx
#=qxO41EOA8VDczxcMMPD9Hv85pbiPnTbukmYyDI5Z6X8A=
[ v)|
#=qWFUoT0l6elO8yn$hIYUL6Q==
#=qF4e058OW__NtTzhWOs1UXEJiHrTSwnIZ3q2u9UaLbo49AZaoog8nMfoDeA9BGVvy
#=qbLBIoIXYNfJl3x9LHqBWNA==
#=q5$hUSQAZNmEXcUcvGVFJrlqtw6IWJBy6C7LN$kOmTWU=
79(/
.# G'
#=qGfiJ4oSCDzJJaNmf22anQw==
#=qlMIFeU84lweg5Ul5iSg2vZUvNnPKw11XA1pEUQfzDeg=
#=qkgpjO3I2rdg6Il4nyqzgDw==
feffeeffeef
#=qdy_NHDvN7XTcQtWWMYxYKbuJqtXHsYJXM_YUEvVR0bc=
_UaVq
AD+IX
!"&]
w9Q
Decimal
#=qfkwtPDg_wfxGVFOXd$WnCA==
#=q2nHH3haw3R0VWVw4qHOwKw==
_K{?
a,^L
#=qWBzgr2CJEoV4DPIbUzdZZA==
8 pK\j
o+bm
zO]".(
#=qnDLRD4lBlfyGeJyuSeq2WA==
#=qOsVShdMttD8jGLf8zW9G7g==
ffeeffefeefa ~a
#=q2wxuRKC7TyzyevfrmeuJ$w==
get_Position
#=q7YEFsRA19ZrxKTBeL$y0fg==
GetType
#=qbOmsEb0zGpdZukI0D4Idug==
#=q0yJsLo0aFpSu9ky8R9f$lw==
#=qZuX180bPJwK7MhIsqenk34Le3ZCQFFLgmBb4sMlYIpg=
#=qwWiTcboLi4zF4ycKWLBprqWhuc6ZDNNDjC8OE8DG1$c=
add_AssemblyResolve
#=qU_UZ3uhfwWgI9uBw5HT3xA==
]3d+b
ThreadStaticAttribute
|B~Xm
#=qRkk_hj7p4gbUu59IVllqeQ==
Activator
&+? +
W( /
5-%m
#=qVHGoZQC06Wdz1fJDKkoeiKu9aci51znqNtMz8dGZQMQ=
\}x<
]#.Hw
J}*`
`Z~\tJ8
|HUU
#{II p
#=qFWCMyHOrl7QbIPkMYdiWJg==
S\ JcmJD
#=qoKX_5NDx$uDAqG3r2Qdnaw==
#=qJEtGIBRUjtEusa67yMyqWQ==
%i)u
#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=
#=qyc0YQPNqWwZHkgNDV8lyIQfgMkEbGZtyDsLzhYmFp8w=
Double
ReadBoolean
qjz{
9rR7
T=b2
o#}v
Dll1
'} .H
? P.K
ProjectData
set_Position
i'`8
AddMinutes
ClientUninstalling
#=qd7oUKLFPI9nt8Ln7RU53xA==
F0kK
#=qWkPc$uBFgJrhuimjKXkFcw==
G<3w
#=qZhds7a6Pui$KE4m8ht8xuA==
Intern
MD5CryptoServiceProvider
8.0.0.0
Clg5k
#=qNc0O1YGwS4NhcbB7sgpVgg==
s= ta0
#=qoTZi9XCxEGJXLELWnV3yfQ==
17xT
#=q6uR3lWd6_aD2reKUDlx$OA==
#=qvLrEXVjSw17e3P6GFPALhrZXcKcfxuk0NupQhKFf0VM=
get_UTF8
0N~;
LTRV
#=q3qYAJGveL_cxux6_2m4Vaw==
OQB0
#=qGvpT_A2MS3Oi797y6jojBg==
+d~,
set_WindowStyle
GetProcessImageFileName
P<P$
#=qruARjy_8oZkz3lsHPGxBMA==
SocketAsyncEventArgs
<@ ]
get_CurrentDirectory
#=qq2h0VNJ4eWuHP5LphH0mpA==
#=qHU4s4cJ8BUWy$MQH9LPGxTniDgLcWFlt1CmhZ7PNRWA=
q,|w
KIj^ 5D
D0
#=qa3EpMqO3KVCTrDUnetWt6fRbeWox1uN3vfSP5v_W_wc=
"Wp&
Socket
s d4
#=qF7qP$SJNVn6Q0z6ARFaJgM2aiYbkFhrfYn4Rl6Odj3I=
^B:X
3+7k
get_BinaryLength
Gz\a
'Pd2
x~-59/
*C7%%jD
ZiXQW
(oHA
#=q$XxqrIH7dyYqacMzR_CjGA5JAR0vUKiq1f0DFqS1mcI=
#=q0xixHwSTS$a9x5dtNZccvebVLuO4euYOepae9m2S64s=
z:y`a ok
Ns $XT
,)~9
-<&~C
UnhandledExceptionEventArgs
#=qek1Oy3FoZ8ULt6r5iL2pEQ==
7]rJ
#=qjM89gxwDLZ9izFxrYPCtcA==
#=qZb1TYPPMMY64aTN2MpcGOQ==
#=q5j3wvJXlnrGmRnKUHr_1SQ==
#=qRNkKSXdFDcR_p8Jbzx9WJQ==
#=qdw5QBoXX8FR0LrkjhWN3qw==
^I6n_
Q# x
t5mJ
-%&
#=q8NzetUGGc1cM4ZGyRGGlug$fKAOwmcPqe4nFzDGKLk0=
#=qay$wDBdxvh$MBWrC9YMhC_f55kIvkv7I_BjPu_7Ajsw=
XE)/X
#=qRtpaHvp1hQcEDS$UubP_mA==
#=qCPeeDj1tZ3_XePWJJx7FTlBzWHbtSGvCe1Je6nRznW0=
CB^/
ntdll.dll
FdlvK
[SZB+T*
-%&&
Form
#=qkbMW3ViV2G4xkJU4KS4XYUwKzC$oNmhjZ49L9c8BrOM=
get_ExitCode
C'&*
#=qi6IJz6lHhd8GI6qygHcvTxSTD2wk_BSYwC2NR2eR0yg=
J?al&
#=qJ2Bo_iSk1Tt7sQHk7C2ESQ==
#=q6wR5WMLGkL9afTpqmWsw9g==
#=qulZN_JfMbEqc2jFbEooALI6mh8tLy9$3NFedHEXAIAw=
#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK
-'&
m= k &
set_AutoFlush
jyJd
#=qBcRYABJptno3$fpXoMXAvg==
wFRU
CreateInstance
M&i
SetBuffer
#=qLYpbsprg$ymVLeNEwEpYlA==
D @9]
CreatePipe
&%(L
)3,L
Delegate
<Nftu
AssemblyName
#=qSh9$w8INPkos7acCjV2yFw==
#=qkFwCVmJ2HhZ6r$uKeVZFFfVLdddj$WEInl9bSgbErDM=
lzg)61~.
#=qmzYu_D9f4dvUPauEaU7zvyNjCyGp_73Xn5SffrcfQAU=
#=qWljP9Wu9miiHAG26c_L7NQ==
%)RyU_
ParameterInfo
-'&~
=(Yb
#=q0f150kYsIx0s3raR3xq1xQ==
y R*@
,%~B
t-4b
`+^
#=qg61MaViIt3ErBjuA0N9Xrw==
get_Unicode
7E )
PUt)
#=qhz4yMg0WDLwu3BJp4fYr0w==
vr0?
(lXy
]_T )X
]/iD<1
-*& r
kB:Q
y_F
TY
#=q9LcncGbDdZaeonfU3943IQ==
#=qJe4Aop6J2k_bK0f$hS3ZOQ==
AssemblyCompanyAttribute
]hP
#=q6odj$nz79NlWTFUK6$Vbrw==
!s m
41Jy
- &~
k:ba
)%(L
#=qDwymJFr9Z$8uhJ6g7so5xw==
#=qiJXCsKWBF9DB88uzW4b92A==
ncuK
Enum
c/P)
DebuggerDisplayAttribute
ParamArrayAttribute
1tUP`
1#EM
f^Pg
get_Day
. (A
Restart
GetTypes
ReadInt16
"z){
#=qJZLeQthAfpiCw0QvZb7htA==
#=qVIikDYmLtr_O$2vZcqLhHA==
+"`
:LA$
#=q2JCFpXLqGkqf10Rox8zrAg==
psapi.dll
get_Length
ProtocolType
Sleep
)%Gy
MaxValue
DESCryptoServiceProvider
#=qMMPHzLKw8_cOGV193acukw==
#=qsUdW_kbiEct8_uosknsYUQ==
/-+ +
#=qXIsqrB8Mw2TMQ5$s7oRSIQ==
#=qQoUfP$jAQrKMjDuqm54QmA==
#=qyxpfolLUhMvFTDE2h_syvQ==
-I&
-+&
-7& E
#=qEnv9WsExz6baZJKRUDupw9eEQbgJVjj69NjcsJ7hrBk=
-)&oN
Contains
, + +
Y> z
fefefeffeXa
#=qRxR4aJg8TX8oM$OpeoviZQ==
#=qsqmAgLqQh_pOiJq5Mcf5Ii66zl6iLnAX8VtqTy$uxhY=
#=qe99VPFgyNENK$KtARK_iPuwvOEw_NRgC00PdG55dmGA=
I%x-&
'uD u
`mk;eQ
#=qN1bIi$08taNozgdgDWdXVA==
ValueType
Iq*/Q
System.CodeDom.Compiler
GuidAttribute
#=q9rN$wEdl9rzJbAMMIiemCg==
r+)m
- &sA
&m0
j9FE
#=qlIUFl2SBYSRov3A1WGimWQ==
ITHVp
#=qFm7s8q151MPpLODhzLizPw==
QVPfV
&w<^
ToLower
0G`l
PipeExists
d t
#=qVEEdpD96A48uRzPJT7G_w60gIZo4tH1_e21GoRWPFm8=
get_Port
#=qxb6WVOMh6wjcZFY_Q0MJOQ==
@]MKR
get_Count
L)b,v
Trim
y\G_
GetTempFileName
L>hM
p]?;
#=q752iy7NeRDzz3UAYRlXXfQ==
Ar&2
#=qikBX_CmS$ZzVAuq$nQJBDwmLm5Gee1iPlPuvI188Ejo=
#=qCaHpjtavBmCU_o5x0kJsKA==
#=q6ARXRSe2PbSpq5u4_c1Rsw==
#=qHJMw55fNEVIiKcc4ry0o7_L9hyz3vS4jgKl3KMX8xGg=
%1QvE
, ~s
h<9'
SocketException
#=q3$9MQ9O56ldzMJGDeTdBZw==
#=qrJaovDbn6146mBrhFbUMbw==
#=q$jOt_Qd3idEY2i2z8zIong==
#=q$yU7aYEYOl8Nz4sJLGQQ6w==
uZ1JL
#=qM_mpCWjOCBlruGH_QcTQHocD7LUJCLuKe8ntf2VtQlk=
#=qxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecU=
gIsew
#=qDH4GuNn5iW6RFhEPrfs$pQ==
#=qsUsGxFgC$BJaO_$VAtZ1Ug==
#=quXVzKqGldmgtXgVm61aLog==
[BJo
#=q8GRQigucU81Rfg9VpK7PVLcjulhhYVPijYKMm9N3PJs=
#=qstAyOBsDsJqFRKDvXIn01A==
9m|w
X;F"
UInt32
f (
StartsWith
y};+
G(B0sJ
q:0#
!\%
dr<z
get_Version
s-M
set_CurrentDirectory
#=qvQfNpqhSbw_$p1TB3UFgJA==
#ru;
ToString
^Lji
#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs=
(4Y/
QAID
~bC;
08}p
#=qWbDVCvJRlY$nWsVAToK13K8LD9gZFcJQAtBUvjDEcyo=
Utils
#=qbwvWShVSL8DgrXXfPQ9kNmpf6pmcj6q57bPfcsBp938=
idS V
#=qZFVU$VkNPSWYii2AVQe6c6mwAUd10Tgqkl1$K5gZz9Y=
\B]1
#=qFYv4oSsEFno3Ujev9_o4Hg==
#=qGxD085Z3RQaUY4iGwWH$xgEmRYVWDAN6hxNjaXokfVc=
EFEk
#=q1vWrLhskrN4OoWzxKuDDSQ==
TryParse
w{g%O
ReadString
Dc"xd
-!& 4'
#=q1t2nN1p2nWkytA1wjQ32JyClWcTGIZMOEV9XOIYf1xQ=
add_UnhandledException
#=qnB6QgyVNIUL$Uq0GD3p5d7LpaFZvHrB3jSqhv3o7qlE=
+( +
W [\
get_Hash
ClearProjectError
7W-;V
#=qZiHVbt3FXowK6_NIyOxsOw==
#=qdPDxrK7XRQZlwY8QeW6oe0AEoOr3qND_WVi1o6l48tc=
Otvl
#=qdwmMObmoGgv5eEpelZDrHiipw5mUgryufdcXXig375Q=
Yaa*&+
#=qCQ9vY8iVniiFr_C0wuoMFHQgjJIll0MjoDGXuPo1hYk=
DebuggerHiddenAttribute
+r6
get_UserName
#=q8FSwXWaEOgeGW7OlBosSfg==
#=q_kGyEn8KrmBmt5M1N9cUSg==
Connected
a]U<
ICryptoTransform
LeaveDebugMode
,(U(
.J%
UXMm
b`*&+
PipeCreated
#=qkWUjAoA_6r2E7qo6NAGuIBq3iKikqBJbioTC25CcZQY=
AssemblyTitleAttribute
*8H(y
;6$)S>
A7qW
L*~n
#=q$njopRrPblqe$yrs$rsu5Q==
,`9#
*'U=,
Rm1.s/
T[M
Blth
#=qJqkjp9g96yoxpNS2E$BC00FKleto7dZfN9N5mtLDF4g=
#=qd4_A7Y1qGQ8QAgHfK8_ssQ==
H-d|'M
CompareString
#=qmbdg4P9$2ouafwS8nEs4lA==
System.Security.Cryptography
6eEv
Create__Instance__
MemberInfo
ConstructorInfo
1q0
Start
#=qjYgYU6Lnx_W1ikVtBmjm3w==
Combine
#=qukf_DyAYprvhLsdhT4CGuA==
-l&~s
r*+a ~a
#=qaPkEKJmdD7BgG18R0WsnHA==
#=qtcl57G6kPr7DDYeWeY389w==
S P
#=qChHxg92yH05lHO0u7UrDcPo$UK1nFXIjb2DI3pyR0FE=
#=qnonybcfG2jzQ4kHK5lGw3g==
#=qEIPcndOLrV2GJmno7zKtBA==
#=qtz1ayBjdbHAw$ecbWtEnYJXs5RBd798kqoBvIJunFxc=
add_Shown
#=qCA$7lFkUlfYTBh0Hp6uY4w==
#=qVQoZlgR59_v4NYIa4CBPQw==
#=qlzCbqLxFuzycCPDZStFfAA==
J&Gz
#=q8Bp27fhtrXMmonNxf$9qLbuQQehIBQTdOPDQw07FUyI=
~'_
{Oa:~
get_CurrentDomain
Data
RMpy
#=qgW$Sn0ALOASuZcEZHxiZDaj3mNXTljqLa5onSc7M0U0=
RegistryKey
#=q3p_D2U81K1hW2D54P32yDw==
GetFolderPath
#=qKaOsg8ghd7KyYDCm3RhDg9KJrf7McwaH92TdOJzSw6s=
feffefefe_-
ZRyR
ConnectAsync
Client
Int64
#=qoa807UEkAFejsz9ub3crU9Uahxxj5JIyAtKhnrEn$dU=
#=qwNkTTorgPauZQTT6jiqLIA==
H"4"
~:}ew`
|w>K`
/R*2.
.ctor
oH
k<*.9E
#=qU_ZXXWlv_8PtJY9coDWiH8$dVbE9S$EoqFVRvxhPtE8=
, &os
#=qWszclzYrfU2ikD2Jo7BLiQ==
CiZh
mscoree.dll
CommonAcl
3p#m-
1uRl
% 7[*
CommonAce
#=qru2ORBLxmt_CUDya_FEQGA==
; sX
#=qd7RJPnCy4YddvoQeTJhlwA==
#=qfPf03rjJVGFkLtYSr7zDRw==
#=qecBuZmXKFD$jZa5T0d0L1w==
NanoCore
s.JManz
#=qREZQml1AE$F8eb3teEaUmQ==
#=qr5qpvOPnLxLp6aGkfAM7wQ==
Invoke
&+U +
#=q0U3u45cUl83Kicjfx0RmVA==
'k R
3l*.
#=qs4p7qYamgHyRCYZsTKM03Q==
#=quOBOxPeAl_kjKKx$REI6dA==
(
F$g
'*Wz
hR!Z
#=qRvcNy1bY28C6xYdCX8MF7w==
- &&
@,s@
#=qP5B75c4g32E_HsewCKc$Ig==
#=qRxKU0X3UfYwXoOTtDpEVW6z4XRgE1s4V5zOQsfCCSqM=
)mZ_
* 8|
#=qhRDMBTieg0MID1DJ88eKUA==
#^2Y
/t,p
se9E
#=qgN8fDYnB$J$X9QGGYQsYuvA6BpDT4GE_ca7JiOh661Q=
#=qeMVJwq86lZc4hsNJNMQJVYiQqG94mfqhBGc9gH9UUgM=
VM4r
+,~^
#=qN6ip4UNq3TKArPG3ZZy$zw==
-4&{c
get_SocketError
#=qkrqC_kLD0I$zOgfqD$aGaA==
Array
2]V]
X7n-z-js
#=qsY8nKQa1iMT2g$sVoLy8u9jrLGP9DMATpaFjFx3wjNU=
rvi:
08`g
EDpuS
b=0"
#=qZbWC$V5YeersjeRitYkSUw==
XAp
Q*iHE
, &8
#=qCeJ_QwVb__fbuEImkTXwSg==
#=qtussAh$DpHFmu7sm9TXJyZsrjeJ6Xm9c2y22v4wQG2s=
op_Subtraction
#=qOplsUBML8x2xteEBilOycw==
#=q$fGRvwQxjFKeY$SH10p0pyPTU$R77VMKr3CcLFQeQ2Y=
j5dT
)82(.
#=qDJ0VTVPWfAWYghKX_DdnsQ==
EntryExists
#=qvRKdouixzy3mopZ1VtjZRIxbtiSW2GAGLD$37iVLn9U=
6I)~$
#=q5W7RemVArrFCeEyFuvU4Hg==
,!+ +
WriteAllText
SpecialFolder
Byte
get_Chars
p*0"
uU~Y
#=qxp6ct4JGLaMDbwg6fkrIEw==
7&rt
#=qovc0J7K6b9Eq_C0K46rbmg==
MoveNext
wB;b
=].:
#=qwHAjqAoc2lT8vaebbsWerg==
get_MetadataToken
s/Y
get_ExceptionObject
-nUq
#=qB8Wn1MJrSNWupWDx0sYcAQ==
E&xpu
#=qzB1OZ89gRpxcPckUn_afNY2d0beSpEyl40_4IarIxzM=
3sV Tt
&<_1
System.Diagnostics
#=qh42qYul4hj$aa5mluadvLA==
RegOpenKeyEx
$_,;~B
`nBgq
#=qeXI2ChPq1TaKaY8cTwWe4uWAyXSGUqAWxM21uH$6gYc=
,O2sf
#=qnDc3CmkCB1QeN2dXbmqV1Q==
k= e^
T<o<W
hwaNp
+Dn?
cexMH
Z {2
hZ=
#=q9M64o5ghSlB001vxhTt2kVIQeNtcHtzTvRgoYr2$PVs=
$gBa I
MessageBox
`%,h}
TimerCallback
S (
$ M,
#=qi3LnKomYQ5KrkAbxbJpKCg==
.b%B
&jW
#=q0REOJwjO1qsE01G_RQE1TQ==
Tw z
"V$Y
AddHostEntry
#=qzI8efPARogp2CZcGB2UtfAz2tJs0A4fM9fKvuTKYqi8=
#=qO4hvdkAW0_yOcwEk_VD$lw==
SendAsync
#=qDEcM8KorEdChS9luywSNQA==
#=qtT$P2Bo4VHFu60OU4VLf1H20c7M2DlURuyfb_XJDYaM=
Directory
#=q2V8VN1ZqnXOBhkZZr6w3VA==
ua ~U
kS~B
Uninstall
dX'zR{
#=qFlfDskRbjMOXZPvSw2W2UA==
3,@1
b#d,
get_FullName
NWsx
ConsoleApplicationBase
HB-]
#=q1kCP32T3CbXwL6JS3UekkltOicB4KjO4W45iMQoNvNk=
#=qJrzYsTPKAwT$ubz_aq99mw==
|CK'
#=qu0EIqDRT_HlTe4PqaMKdozL1lQ0SgTtqFucuF2vFq50=
n $1
get_Item
ReadUInt64
#=qxQTn_t1ZFKKNm77mQ5vH9cInicm2Cv9jGtv9vmIpksI=
RegCloseKey
#/zGq4
-2&~}
FileStream
#=qxe_BfLLMHqYa_KBeLsRfpw==
$%(L
-!&o/
ffefeeffefea(
#=qRUXz_3fP21juNHWjDYL16Q==
,$&s:
dw\M#j
#=qxHMqkcY5ri8Rsxs7KCJ8ww==
set_CreateNoWindow
Y 8
Hb3d
Assembly
E9)B
7^@|
ClientLoaderForm
#=qA$TQXn2i$KwpdqxTX6vvVw==
-3& (a
3=ZW
#=qfHad4tglpNfnMqZ6nFkPPA==
-,&~C
* ^CQ
&>t|>
zCoy)}H>
#=qgBCfMYp3J4fCYU13EId5uw==
BsY
#=qZ8pysPk74rQ5GX0s5CkOJQ==
"K/t
#=qwrVB2mw7gzmYRanSJvSoPg==
%`a{J
#=qK7tJUw5nsLE_rt2JHgqYI6_vH0s$mFFB1QifRuMCr34=
SocketAsyncOperation
@ &%
h][rv
Dequeue
(H[z
q <2
u'rsT
#=qafzQcMCK0eVSctI0IcD2PA==
#=qEQtWieYw8BPdEE4hbsjTLrq$BwGjJOBoaDYJmV9xVgE=
-&+
WindowsIdentity
#=qEbf5uxiH92v$7mL0TnmsnA==
lP"l4
#=q5OunwTi_tYTGCTkAtZ8rARxlhmXbFcAf_e1GiEt$FEA=
#=qsA8D04owIGYHILF6yPa43A==
ZKyrB
#=qzjMBSDJWeEdkUWCBxYatrQ==
Size
-'&~C
60i[|
1s/
WindowsBuiltInRole
#=qEqBb19ZxrWpMC8pwAc1v$Q==
#=qpNR_LpdLu_eSOZVgxbr8UFRlKjbiBX7LOuGAbGS07mXUJI3AAilu14uPN_kfaTpW
fefefeffeefa
#=qw9FR63zXVj$omVnwg0u37A==
#=qnY1InNbQmfgiJXdGVH6rvQ==
Ia*T
67Ymh
a/j
#=q5WXECfTJPQIQ2JoJDGsf9pTFKCPzQGp3$QlyT_g_ZCY=
Void
#=q66hvvPDVbMv$MYStXtnb6Q==
~aI#
#=qQR2R27CtTwLSuNC54_JY1g==
>p I
L}1U>Y
- &&*}b
| al
~P(<
- &~{
#=qpXfSNxR7J3tqOHyqT6s_Aw==
Resize
#=qP3lBpu0cs5q3Lf$qXSL7q6szA7E5M9NqMzkAFV6l4CI=
#=q1uJdtbJoEKhZjOld7SeHjw==
<K(>
Clear
#=qAySeqCaPs9tWWTa_P8M4Zg==
#=qeAvM9D2ZXEFg7Zo1J5PeVA==
4p5
&LBH
3 AL@y
#=qr6ouJTA2RwDm_3Z$eUP6TCvbpSA$yAFGnut7D4kG2$I=
G3]&5dz
~^i-
B (
GetCustomAttributes
#=q6W8MK4LKkww2JvseikWqeA==
y EY
#=qnaTZqk95Z1a8JBLdKiF8aw==
*r,Bp
- &&*}&
- &&*}(
IPHostEntry
a an
#=qqLNJOrQl$9SirTNF5ZKaLA==
=LpG
#=qClMnNCTDhIIGUYHmdm$xCQ==
#=qYQagvH1k4NeWsCidwFRb$sQTZXPGouROQfmoImiPGDo=
+"
9o{W
ReadBlockData
#=qOicuy1VnndMMXIrDqqx3EA==
ZnX6\C
8\ 4IB/
$ y
IClientDataHost
]luS#.qN
CKqo~
,f96B
#=qIrsTmpVUMRgxokIHlpGfmLtKeqxo7vQsjSkKUKFpH4k=
'cJ$tT'
#=qDx8yS5wU6EQSawGC841xnw==
$/}j
CGnI:
#=qJBJs_Q6YmbNTnGoWFx0s8w==
|ebD
DeflateStream
IPAddress
Change
ToLongDateString
d?+-j0
#=qyMcWoZuG7jRWeztMnp6fPmxxmqfVgP7DLzGs7HeF4Mo=
f?^p
NoU2QJ
YV= J
#=q4rZJEBSRFNm6PYOH7NOLUg==
#=q65znFg0_234nfnhL4I8yRSIMDpdjAosbzeDfyRZVW08=
#=qmuy0ee0GJl13ksvWRbOSbofOCTPf0dv0HYdjJq9H_Es=
#=q8SIEDcn4WoT9RcZmFK9tzQ==
BfNo
^.gS
RuntimeCompatibilityAttribute
#=qP05CRmbt2pJg10eRU50wu1vx$mfteEn$pCn9SEbehP8=
GetExecutingAssembly
]$%OweC
#=qTKJrybVS3pgV4uZ4KNtp3g==
v_1"%
);W
#=qNQZrJgmZwpZh_4yrtaf9Gg==
#=q2X26s_rFZ25AY$hOcf_6zA==
#=q0PMcXQJxcLLr1sYO0fpyhPjUwjQtInL_vJPQSgCsfio=
#=q8nWzev5go3NKhN5Gk9NzTmM91eKwrK00n3U6GWmH8Kc=
#=qXjNBjXFhVcOvrRAG8alfq96_gJ4jOa0wwNOaztY3QjLWnMT6wXGDzBnHuUkef5N0
Y +# S&
#=qpXMe_UDgWsOaRVi$02jxzg==
#=qXkgpfghvTKDZGlXBGI4x9veQO4JfjF7GW2ECw9$L3EvyKZGOnziwXE2Xr1EkpRwe
#=qb0tmyILenEyH_R9DXJFwB5rGNfkKkR0Y5sGtBRsV3YE=
dnsapi.dll
#=qCSC3Khfzx9$ef45TjPThpcJgh1Y2yjEovdFzCbywzqU=
#=qGWcF1$SkVAOkK9Bjc82XDg==
ArgumentException
g+HR
-/&~J
6-NhhA
#=qfsxP7vyadqL93mAkiQXr1tsUC0B$7Gp0ZNAPpjNxIG0=
4E7W
MyGroupCollectionAttribute
~}
}.W
#=qy_aVo5ze7CCnCYXCQvhVBg==
~s
#=qCSH0DtnYKogitTpLw_M85GR1jr6BVuF$16hm8cfUYWw=
o94c
#=qhPT6K66KztLE5cE8YZMEsw==
#=qmLTtz8OEDrkzFTzYkI_Dg1dvKwiGw9blNcZSU_QqMsg=
ConnectDone
#=qbn24Ox5i732BM_T_R4Q3RtK1pEoSIYmxE9Rba9DDKEA=
MessageBoxOptions
#=qhwyNa_lhtuoyuJK5j3BcF4xu5fY5XhFlgzkM1Cgy6IA=
G3feffefefe
#=qA5pFz5LZPgfUa5zon4beRA==
rF}j
{&zUl
ReadBytes
j;TB
#=qjAD5jc_8Kg9x$NoAqFAvpA==
Interlocked
#=qGCYL9FviWCrv0prWZC8VfgL34V_6XyB$buFX2LkjbCg=
|>}ns
#=qwVGSEK8LoRuNWEOYfq8$hq39mmxHzM3pIeoRef7XNt8=
-Z!N
GetCurrent
:x!hl
SendToServer
feffefefeY
#=qrYH2MBQ1J6Wu3hhoHHVW0JQwxTYC8hYBTLbQIYHNBds=
AssemblyCopyrightAttribute
ut+ h
_ER?
#=qKqE6jaRKu5jJvHl8RwywXQDv4h_f2ISEaHK__Drdd$M=
Ni"_
#=qnOTCmwQWr6BtiNf9ta8BJg==
~,
#=q$sTc1AZMnHRC7q_PL2hWs4JIEJoo88_IAFcWtrdNt$4=
#=qrzlCozsOJIqLxGzoulKftCL7kUWSuMYFdc1ca_yCcBA=
, &&
20]\ W{
#=qcMb6hxBpdyTwCjvpzaQcC5dS3wbplPqOta7ERz_lMIo=
K=H^
#k J)
get_IsDisposed
ClosePipe
,!3C
T|K
o2rt
#=qVl3h61LTPSW_ew_st_OlTAm7x_6Xu4hQK$pi2fSiEIs=
#=qYfWGXuhZd0cmWjiCvW2EPw==
*pzF
ClientPlugin
FCDC
#=qK$702nkzQ4rQ0lJLQZ2zaw==
Operators
- &(a
Y'> ]
v!`L
A_LCy
#=q1r$Sd9Acbw6KsKv_F9uYTPvvGAfiEwUnai9OGYAUQBg=
#=qRxyF5FV01AHvUkR3BeX8OA==
#=qAoRzrFi9HiHjyPL0ixkVXA==
DeleteFile
#=qOR7qPTYp9qHTyadzUKgUYg==
L2*9
-&&s9
NH0O
#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q
#=qIe49uN8SyHwjwKdv9N2r$A==
#=qO7YVPb8fjfyGw81pHcJjnw==
LingerOption
Yb,Y
7=~<
;'3$0v
#=q3S7bY847GmpPliI1m7tZaAVifJNdeHclZJyeY2JTxN8=
+SIY
ou=
RD140
IndexOf
#=qSJAMGBE37IZjr90jS4_MYNWNa1$s8PXhOErbnAhK_ZI=
#=qwyLCYYp4MoTtTA6T$fEOIg==
#=qpQiSeXaCc6qGNX49vDbcMYyzv_UpV$YoUyrH0l6FW6Q=
n)d5=@
Close
mT![%-
jwqD
&+` +
Qc?"
t3:~
#=qYhk_OkZkBWola80M6EUqow==
IClientReadOnlyNameObjectCollection
#=qQkx1bBZns8hPde7$PcvfUl2fAairj6t_H8ve7nJO2s3BIB3t7PXd4ZR9h0JHyxrX
A^Fl
#=qEn9Mtg$AIqWbq3whj1y5N12e3KXi_NwIIcl2i$FXNSk=
-Zr~k
#=qZvjD49iuetyLKBIiF$ZmjA==
`l/`
wd<]
eo24
#=q_$JrmDHg2uq9s8cQVRi8Jw==
Read
ylv-U
#=qTSoRMaNGYiiBNK9Yfq59T$2z3sNScYh9uxoeWlhnD_A=
tv@L
#=qdupfYLPCEHNi$xwR52i0Lw==
XE"9|t#
-O&~r
Delete
C\
value__
#=q6Xi08r0$lOOnXtoBHhfMuQ==
get_Value
#=qrQRxQdT4MC1qfwOd4n14uA==
#=qJRbhy7_BbunS1O6hH3MqZIufpnZboV6cb5Cv4qZI1D0=
8y% :0y
wI]@
#=qmTxGiMA05lTEtoPPV6RFOih4DYS0uxrxPO4vA1H2j6U=
F1oF
!c >
hz(9z
AddRange
S($6
Decrement
y: @
SocketType
UqAU
pyti u`
#=qLSPQZXlXixhGX8Gd10$ph8j0p3_XdW2xwrfqz3nO7MY=
X ,G
DiscretionaryAcl
v:[]&
SEW<
$l;`
<5Q*
~'Gz
ConnectionFailed
CLSCompliantAttribute
3Gof
.cctor
AsyncCallback
#=q3eIsVMg85$T5I_yeach_tN$TJG7$vFUaeExZx7tMHps=
=\s9
#=qquFMi5Wa$w8aN9GGlN4H1Q==
mscorlib
#=qyzEuYsQ6u9hwZeR0HeWqvA==
AxB"
FileMode
X\L-
I~,R
#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct
#=qd92UVUgmlXoQZdJDkVvBpfqQ5IrxjaeWORyWFC422PQ=
PluginUninstalling
#=qVxXNKnhAcArgJoGGYXiyyQ==
GetMethod
S s;
}EBB-
#=q7Tql80HUgCLaL3e0n4j7ew==
'Ev#
GetObjectValue
#=qiIt1yNcUYn9ksB4loCZmUQ==
#=qN76bQl1CQ6EpIJzS4bbSnw==
#=qGjp0Vb6efONwANkcKrMTkIBxJvr9AleFfJriudyTw3c=
fEK)
#=qEoM$dAPD9j9L1YOZU2B97iwm0vZOJe13LDB3GayWQEo=
#=qp9IgcHwNxIVh4GZl4S2tcJtSz0NII67aXwFNDcdhP63JHe9MNg0kPsAos3IUd98k
#=qFY80y4KcMQywRNP$ttVIXw==
AllocConsole
U+6o
+K +
Guid
Rm .
#=qvJN63xerlaB42Q0XUG621g==
#=qfLFZgbR_r0GETPSprP6O9w==
#=qA1_qolTI9aVdwnEde3ubqM6zKBigTZiyb5_iHpeZQDI=
Disconnect
`H]B
hD&e
None
LKve
get_Width
-!&
xKn
bwV9h
Qo?Y
-!&&
r,{XRS
ContainsKey
System.Reflection
XS_4p0HI
#=q5bws5LlHvLK62TcSJadQTw==
h@rs
v (
S@t_3
'}dx
ffeeffefeXa*&+
RuntimeTypeHandle
m/v-
#=qP9qYgJs5_O2GP2pI$ho4ZSa8wQkwNQEBMg8VjNRrUWE=
#=qxWp4ETQRrgcfPChnmxhivyMmb5p6MuyluC9Tc_Mhkec=
#=qui$hq6ka6v3VYA7sCjpJmcmNECKESf33DUzrmeSOmg8_E_GsgWi7VMMVWUGuO5wH
#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8
IiL:r
i5SQPPq,
7 Mj
w] ~
z%(L
#=qL_Q_RdUm_wJ7VeVwUqRXbA==
#=qObBSq08BLhHK8B6pYQSLOw==
#=qhiSO75CpxncaWptyc0vAMQ==
"P;l.
UInt64
8HqT
Fc
ToInt64
oB
#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq
IPEndPoint
p+H\
#=qmiBgFZvSMQ4WgT0UQIJlEGkYZhWP0gsBGd1anIAH4so=
p^NP
#=qq_SehjaC_F9U66vu1NLqjA==
set_ShowInTaskbar
#=q9lvTmS27dN6FAh4mbOnRsQ==
Rfc2898DeriveBytes
F fN,
q>E
op_Equality
e4yTw
#=qw2XWrJCQCyTO0Iwdbz8TWw==
#=qxH0vEx09STdEljqb$W1E7jvc94T2TeZBAEeRdiG1_PA=
Wpua
#=qO0bmWYqIZnaB7Udo1OTvUuiP36Q9Z_7hz6URm1Yr1hM=
#=q_0gCRmXint4znUKVJR_bzg==
#=qQ9gevS7b4oTsdxtV36c3$A==
.%(L
bUJ5
XMd.
#=qAzhW8LcEnUCELlhG4klMCnw00GcHco1N61RthSA9zQU=
*81C
#=q85afbI_HcqBFOZnC0iAqsNghLb3LsuyjFtpLEYYoPX8=
#=qh9KSqT0kHBFSDanZ7gXkKb1vdDfzZS3JIRcUnMfcljE=
0fqd
NanoCore Client
NewGuid
get_ClientSettings
AssemblyDescriptionAttribute
\)Zc.
#=qW1UvUJT2hH$HRJ6kt_DhXQ==
9X!"
k`g]7M
)BGA
#=qUzL7S_0eXIkbwTon4AS_WA==
#=q5C_es0qgtlVCNxzfPQ_idg==
|sw7
#=qeADSRAqxC2FlJbA5Uc5$2A==
6/(_aBl
P x%Z
k.S>
fefeffefeef
eOot 1
8_v^
IClientNetworkHost
/Z6eV
#=qa9HOmSrK7mjt1ZxVRncCgFoJUA6N3DmB1Rc$YUfcSKM=
HQvl
#=qe5qrWacQXGv9g0P5D_mRuQ==
#=q5grPwgEurSn6KutVLS5_oPClPR_aCEdSRk5nKP5bDm4=
tj{1V
#=qLEtx_37WeiIPQPYSN8vY0qTNiL_L6nA6vkFQwNlcU2Y=
#=qKKh2V4W51UBGXR09J__pug==
qbL.
b9M
~^*w`*
O@5o
$E:+
HS:_
#=q8fYxP$_i6Xk0$6OlSwUHKcvhrevHxLXqXqvszBe9OtM=
P d
GetResourceString
H[:J(
-7&s
&q4I\l
|l}'w
<)>O
#=qN9Enun6Rlq30xNdBjhzY0A==
] P^
ValidateSource
#=q97ilq24aAenhk$hG8MzEMQ==
#=qikOQWBxvreUKIkKm4o4DoA==
#=qc7QknLi4DrEENw9hVJyfaw==
#=qBhG6LJNfmJspOR5A5YrkZB3a_dWOpJYSj4Mo9vfL8qo=
Y Z~
ConnectionStateChanged
#=q1Ld$ycQpy0q1QvYRFk1k5lwgysKVR2tJyNFjakVtbYY=
6 iy
#=qoTNlk$Wngv$bqPRyj4mJig==
#=qsWAbPBa1yptbB97zoAjeSA==
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
, ~?
#=q7wsNZ$btlm7uRzkYXMkJl8JrBCKSYJt4if2WiKQrObs=
AKz
+ +
NanoCore.ClientPlugin
#=qSLl9utb6ViD7fbZHSox8oSv7PZDBMO5b6MBr_gzzHF8=
#=qtNbB44E34Ui_i5yJYQ5ntw==
- +
#=q$c3lXLbhl3Qzil6Z9hYEopCTRdsG8WE_1ZuhF2KQELQ=
#=qu1CivWngdicjZHEJYKM3dA==
*%(L
#=qenWi8guqQrvoGB55djo0ka_844yTmViBn5_Fr2X6HAceO7AJErk_Rh7nfkfqtUbq
QfT`
Variables
get_Message
!This program cannot be run in DOS mode. $
* +
System.IO.Compression
mY;:
File
IsInRole
get_Offset
GenericSecurityDescriptor
/ n$'u?T
Dispose
#T> ;
#=qx4AWw22LafncEy7CESjbGQ==
#=qwTOYF_qEkI0dXowKJYtI6A==
GetHashCode
#=q5uvtKo7rLfT5wGY5TBS4ixmbpGEL_B71rwbORlBpBKA=
:l.&
o*\z-P
G)g
#=qFNeaOBvMHuebCbgh$0IKkw==
GetCurrentProcess
\g9B
[=Nk~L
qY:/
iEXx
-,& oy
#=qudwGeEjJDUB9pt$_k0YOgc30ZWMo1bIGmdknk40OWog=
2DL/u
[:qa
#=qWgd5i$rED0nEbfExDCteKBL09U6dKm2BW1AXqZVXCWk=
`2c `r
al6a
#=qnoPzE9XMA8S7X5JX6ycJ7w==
#=qB7XWHK8gygwSs$Fj70FiWw==
#=qDBRodZmvuO0qLafxHA9KMQ==
#=q3d9CqFPpPy$rBhZvyFIRs_ElAFMHTo4ZZuE_g$Nfrnk=
AppendLine
#=qOgNXWEIS3IQJCnff_sTmrA==
^&uv
#=qnIGrpAn2e$qTqbA22$ONbQ==
# `
#=qfoMVJHfk0BnMs4x6mHO77Q==
5jy,
- ~@
#=q6NenfQbzQYLSZe2oYrhKsEGeaR69wF$W7VvfZPx7lyg=
!ApX
H}4v
#=qbbzTfwYbEfmovMRrVY462ipA8X_tt3oO3M_wSSE0I_A=
get_Key
#=q2Sd$5fx_doPt8h$UdBacAA==
, ~[
#=q23tIFHA2cbwzlg6YDYhwLkXCJGgIhllZCGmc4pRC8rI=
DisableProtection
T4@+o
#=qXKuFJhTO9qh0nlK1iXbbSH7y8Djn0mggfIDxOoarDyE=
#=qXO4A8$YrN_OoPhFOn$Hhtg==
#=qeE3S$kdx9R0s10U9GzzcFw==
#=qaWedjkiL7CWj9EfMXrEg6Q==
#=qFxElXT3T_$sB_0gpbmQGIA==
SetProjectError
BSJB
#=qamR76KZ1klLpv5s7oSbjxA==
AGeh
_c^Y
z{lX@s
'MX'~
rV7W
get_DeclaringType
#=qc3tkHe_7v$eGA2x6krh72Q==
#=qKdZKgyAqL_iP0GUSJkXePw==
GetManifestResourceStream
#=q6uKQziMZIL8_PaX2KpbPTA==
- 8 J U
#=qE8a8ikTp6zyXXyhNYzK8Wg==
BitConverter
#=q7$Vba9f7UkS7OwkHeUGtrn1ymWXBIMnyiJbrBxyOPBM=
K1C?
#=qL6PdpQwMNSdyVKw3FgboNw==
#=qM9NIml9iDZh$Fjh9MocFWw==
#T7[k
get_X
PADPADP
#=q5esm6BVWqrzEai7Zgw0cmQ==
k):"
IntPtr
P4a%
IU {Xk
&j+.}
c>Ek
b(z'
#=qwSqLSPEuM8lJy4sOeuH92YjPodcLquqdG$OodozwC60=
o4`Cz,
''<]
&+# +
&smv
#=qKxYY$jYG8_7mT_7R0n5jfw==
TRRv
#=q9Dmi1iXzL1JAj2RiS$Q5mw==
qHV'`Y
#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA
#=qHy8pXlBCL$mvAXWQDJUnVpxgTTYNWuQ4Z7NdFPUhcZs=
#=qyo6slTMfgD8IrZ7nr6inHA==
#=qul8YRvQj1pWpo4_UxgOSzOBvtncEE$VPCzTeLK_rIz4EnXxineVkwF$lTxruKPxr
#=qJtsKc7ccoU8jRrRMGJWqhA==
#=q4fCxMFfzJ9KgfK61DJRvZ5wDvDfYnqR8bhY6TGq9aRk=
C Qb
(4 mz#
Microsoft.Win32
h4,oA?
ffeeffefehah
-$+
+G~Z
7q[
#=qee1h2XwRBJvy2g__X40enQ==
rQ^/
#=q8eJA0L4q0RMnuOJCvpFj3133vZRxVnxvHST9vysUWYQ=
#=qm_Podb$DJ6CfxMwMnaj6heXfc210URbSx7p$rJGFPmA=
#=qt0$GxMKBUHqpa$X5z4IJNA==
ZX)++OH.
!)@Y#(9W
#=qJLXxSZzWSVDQjBBC8RxpqVbwxFaxTu3ygaLrjLvlmTw=
#=qs0qPjhSgxy3k5gj_gt12EQ==
:F8Y
#=qbWN2780y2PKcyDt_4uktmA==
InvalidOperationException
,>~,
r[D}E
#=qZHoyzaJ9rjmsFI5qWuYXUQ==
U`FW
#=q7wyeNFqtiGUhQt6sicod9g==
#=qhq3FXVXLOItNPwDlpFnTKHk3JkInaJiiSE3uR3jtGH8=
?/)b=
moa
xmla
System.Net.Sockets
RijndaelManaged
3Q_B
#=qEIGjjvppBA3BShbdBfMkQQ==
#=qoTGj8$mBoje$u1RSJ6obYA==
hvTh
s`5:
FileInfo
-"~Z
#=qGzqsy60d_qAVRip0TvyGow==
#=qSJci08l8EqyD9KF0joWzSA==
&+6 +
#=qAR9aFFQPEovpFzvfokoGkw==
,2Eij
LogClientException
&+: +
w6m54
87hU)S
h8rA
UnhandledException
#=qr1BSJWWt4_gjKhDM1XdrUmEEDWmH$7z1xaJvthJ97EQ=
%*UQ
#=qXzCb60v8h3v0rPCrGf606Q==
BlockCopy
#%yW
#=qdZqWoaYN68rlMOX4HkTLdA==
TimeSpan
GetBinaryForm
B$7>2
#=qWfwpJtKOXBFXf_1zpmLUrQ==
Mutex
#=qjlBNihUiUO2oBJbOEbdB4u8xmfTL9EQ3AEFa$nrdzJY=
ffefeefeffe
Ya h!
,=d !e
JW1|c
#=qChPTKc$8xcHrcle7anHYNe0wH_TweGkex2nGe9n8WDs=
#=qLKYxZZVHP8wT4ocBxnjPXg==
=onS
#=q3LvM$oW1poDdLKDT_N_s4w==
}~Kh
FormClosingEventArgs
#=qAsxHG9v$MAI6$NruMbxEjA==
& {(
fefefeffe(
, ~:
w=L9
J6K&
#=q02vg4rlYSKrSiDNi4xWbtg==
BinaryReader
5Y .
#=qAlVTP0_ZXWJdoW5RI3VoXQ==
#=qccx4d_xNMPrZUHpmyYb7fIKkXAFa5XEyOIxXg$XLtBw=
set_Key
a?3~
3BDk
#=qVvEn7vdm6JlvG9koG0JUIQ==
%.oV
@Li{
uiNP
#=q$JqWZLd6UPV3jmsDHksd2EmkHWISQtPlvGx8vZ7hHXE=
fEjY
#=qg9gWuHgvaa6cHg9wj9NSQQ==
fefefeffea
#=q9DR9MBj4z9rQMPU2Q48EqjtFhU8AMGWHK02_s7IakJ8=
Boolean
w R`%9 #YDN
WOmk
#=qo5Pv9nXCIU9X_B8SJDUR_qgp7npNK2pA1rGP0GNQ51o=
MOL!
set_WorkingDirectory
12U&
#=q6Aboe3ONIkez7GgqcdWPi0_vrT_i53_89HUeagGM6MThXvFkvl8hpSeHO1UJawKN
#=qYI$MiBdzcplbf7GqrUf7Ig==
:o?Ki
.3+
0*6s~a
#=qK4wGebauvtmTKO0oAyLFzHLhr9rU3HNJmU_ur7Zop$YvLzV4HzmIQ45YslW_q1Vc
-m,Ol
0,1Uf 1W
~Q3@
O $c
#=qFv$qWif57TCUNsu_O3F3gA==
- &{
#=q5XjI6hZlPIrXq2h2btB_pVJgDh_o3RXkWrFCxLCG1E0=
uZYz
+ +
:T^<hh$
StringComparison
#=qYCS3QLrXk$FWhHR$BIzDXQ==
* +
f72nc
CompilationRelaxationsAttribute
znv l
#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=
, +
ReadUInt16
ReadUInt32
A@%7""
#=qeeDSInMnFASKK3QXGIKUxuxDb8FgGi0XLXRlZ2oJdWM=
- &(
#=qP6OAxyfxw$Mj0oVKCDnh2VZfwY2Ap_uDBmUyxkn98Eo=
(TT}$
#=qTLmFjOt1Rq5$fqQEFVZ2zg==
jqH!$
,+&&
ResolveEventArgs
- &8
#=qeKiN0Pwa0MwkK0uB$Ook97TrMQC$LNj1jgF6xTuSA2g=
VSg#
E"Iuw
#=qmvGJ0E7$XHigSQAtHtZ6z$on2iAwFLBiFtrUR$DFhQPAtVI2LIgzNztIgPvlO9K$
#=qhVWucYSqOmMmp4RgG95tFA==
-?&~]
QueryDosDevice
Random
+ +
#=qoStPOR6UymX3IGbwW$iFxA==
ThreadPool
#=q51SFR_Fbl10nUMKjGTtHqA==
h$_(
#=qrWKlHKCxTKueolOR4ohc7D_cBhjLv1zNIcftgcigaGU=
-'&oN
#=qKoyC_0Y6bPLCPvDcJr2y5A==
<Lyu
Tw
^^P%C`
;EWg@I}
hyTI
&*}%
osS-
S"FR
mTkj
#=qqReemZdhHj1veATVZbU2_Q==
#=qd8WIZO8f6IRqdUmvxawj1w==
)4,#
b)@h
HideModuleNameAttribute
Q9/S+
Xa ~a
5;'\
mmNi
h`oN
qD-|
4%(L
=> a gK7Q
Microsoft.VisualBasic
kx7'
#=qehEpCuPIxZRbHczlt$dAWi4yWi9o1_noSvuo$Wzvtyo=
Qy^P
WriteAllBytes
ArgumentOutOfRangeException
EnterDebugMode
Z5na
--&&
X*]x.
HostData
#=q7rZvZ5LmWDFo52hBeGb87g==
TG,)
set_UseShellExecute
#=qokX_wSaMFvPLXvDQY377gw==
zi7w
#=qrpluguOr5I7WIqr51cA8ZQ==
#=qtxvtUAtG5kwD1CbaXqZpxrHWaxR5CiRO2OiaCLfsbSk=
&h#
AxR}
#=q2XZFEYqbf67s$PRf9Xyx7Q==
}ht)
[J^p
H<xW
76 A
<W+_
Rectangle
#=q5QHPwKvqpNRA$cKFBj8i9w==
#=qUaHlQloQ1heHsricyshXiA==
zx'J
,d~9
#=q7EIL8N8VWglyI984D7TGpzIPvdOcvYIRRwfMeKNyDDs=
#=qMoRe_p4fasg7BcMJcnicWw==
#=qsx3W$FQbKM7QI$Z1TXWW5A==
@'-0
+. +
Concat
yXO.>
#=qkxzumuLbzy2O2XsBlM3j$g==
{Pqs
#=qGHv1IOurZ6januU0XCThS7E6H0kqAtBD9d30RkoHFXM=
#=qNsyg$dsR$GJkSvK2TftGTNPuC8S809j_UmmfNnXTTOo=
StringBuilder
#=q2WFu5tRyicebO6UkQga8SbXrngw5YigfLTTVJqQy1qI=
/-gC
#=qhbsl5nSqHjmKK5u9FniHoA==
#=qo_N0HkUaMUQFRCOsgr2ciQEl_IzgJy64oQzCRnN$Qy4=
ReadDecimal
#=q9tI5WfBIFIPW_84mZnHV05cJ9fSyOCl9wA8lwPxs3PQ=
B.rsrc
- &~L
#=qiO2giJomMFK1wa5$389nVw==
S2.N
5^Kg
r[[\
ffefeeffe
#=qU0vjurWIhbfq4$RoGXKKVfTj5MJBenZeu2wAtoCJAJY=
~qXyG
S=
3?1"_d
ReadDouble
#=q9WHClFSp7T8oS_DNFEbAHQ==
!pFS
#=qHj$POo$6pkhWHVC5cES_2g==
CompilerGeneratedAttribute
#=qORcQ89THKgijJ1sWRyjf4hLd1g4H_sosI9t_gkVfZ7g=
'B1Dk
#=qcyVktfYxc51I1XopnwGNjQ==
3TK
Main
#=qKXbEtqEIo3E2xdYWIElxIQ==
#=qb_soGTESOxGbPyWr9RZjig==
t|R5e
#=qKpwDTqgBVuprqflj1$7QZw==
#=q6k7flm9GMlPIija7ZH1xJg==
AL>\
#=q1t2S$ib6pQFvBWAJfG9B1Q==
T j1
GuAdg=
cP5Mo
,z S
ep&C
2&
Copy
#=qwGMLoIBYlotM6E$y2KTAuQ==
#=qzTUdhpx_l8oNrXik8Q6a51kZkIp$waiEMbjMOU1bFOc=
#=qC6KOBEMWwIsQr_847d$S8A==
AssemblyFileVersionAttribute
#=qZDHx38VzWszDP$NdqQpGo3ak_Z$zbLpODJse1_Sr2hk=
Transmission
System.Text
GetName
#=qcCYGLZOh9EpzU$sjJG8ZyQ==
#=qHtBOSXbLfhirIdzL218uOQ==
afeffeefef
hb93
H% P
#=q60UcvJzzgao2Rv_stV3rQhhxCdm95L1Gb83mKGH1VxQ=
WriteBlockData
#=q8WaW5L3_NY3KPDRN6V9mCI08mHUZbTcARcexWvaAL6A=
\x[)B
MessageBoxDefaultButton
#=qJMNT6BwQKSi707UHw9_x7oci6egKjto_AgHYlITH34c=
,4#
#=qmcl1D6lgUOLuKGFFyxMamg==
?aE
Collect
c>(aA
RuntimeMethodHandle
rzL{
?A_W
#=qWFEttW6Y2i$LC7_zLCNdFCiHtPH1yR98w7TbmrS4vUE=
#=qa6Qg4SaIgpIknX0EmOdEQg==
#=q$6NbEg0Hb4neXdXPgEgHJA==
IClientData
*P L
%6EE
z1EI
DjM~
3YJv
#=qWQUgmvsTzj15wSjWQHZnng==
#=q8Lz$o21atQxw0qUwF07ufqfk8jjJrspNc$L9E2y_kjQA$2GQzuj5BmjDMXRcd0oL
#=qfozjXlIKX6LyHHXB6wCG9g==
#=q$bBbU_xpGfMMkAvp45SBRg==
#=qFikK0kKzvE4fvbzxpsrllMMR8oLIJtNPAGP1lZZ4prs=
g$S=
;l43
1.2.2.0
D:wZ
#=qsOMWyP3LvE9$utIXVnRnmQ==
#=qlV3FbiF00r5Vrp5nqoncyxDHZMuHB7yuJa7xS77K3BQ=
W`r
S=,`C>
50uD
#=qrEy8UTPh_zjKUNPlgJ2H5vQaVxSgPloAxSMCkFttuk8=
I*6l
#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=
#=qk$cpdn6seqbcKjxGnztc4w==
ma
#=q62cZqzG2QOltpyG5v7exPQ==
PGbz|
#=qO$LkcjIVULy0PGjvpOiiEw==
Initialize
#=qqLLpPwpASXA1wqOuY2RNlU8CTc57bQGBfHWaLDgrCKM=
GetAddressBytes
uo -
#=qPfVuk6552RtecCgHDnGSkA==
#=qSyCMza09ItB79lrZlFBuQQ==
get_DiscretionaryAcl
#=qXfm3QhQkyfcZgbFdAZgHHmadm7n1N0mfKcKBqrdfAk4=
hBF]e
mC9x
(a
RawAcl
b#9?
#=q2Xp4jW9C8Ta21HxmpVVhKkrHyOAsktLziyvL$pPr$5o=
}:ZCG
set_Verb
#=qXCUD4SfDr7DmFI64sweGXTg5Ns_ZxTOZPqBRcEKWTQk=
#=q3C4Iol1nMl5AFLWNdE6nxB2_kG0uXzx35vvsn$gQzt8=
O.`V
- & +Q +
Show
3\D
aAdw
]Kvi
%miN
-
yUm
/SV;n
#=qEWXagqzV$_PB$92aNfTAHdvK2qw2uvSxy$UVh0K_lso=
Y(w
$0 IL|
#=qdiuHngY4wejUsgFY5u7CtQ==
My.MyProject.Forms
!FJ)
#=quFACL_$e$cUEIexpzPXS7w==
FirH
SD~$~
yWVe
(/@C
QU>L
#=qwnMPoJqYBxCKR$s5x3I3EQ==
FromBinary
( '
$fcde7731-4783-432e-83d0-227093e54de2
@^oN
#=qEhveuZChxbRj66Cj2kCGjw==
@QcU.
`:\(
s
String
=~ 5r$
#=qyZOtLxFf9zA2x1ff4_5cOg==
#=qSYke1CBEgOP5WhDQ2wCOhA==
_CorExeMain
t@i_
#=q2n0wwv9OpsrMrxVUVHoqGw==
M$w
set_Visible
*3eq
g^0 YC
SearchOption
#=qw39MYiiaN1XJbqsDq$LgQw==
kmA
:$v~
KeyValuePair`2
zq=#
HostDetails
#=qB4sApeDyjGxBivHLwR3FTJejGBlbih3hr3f3TS7BFbY=
Timer
#=q79YE7jk$t8I7uIUVykHcVA==
,x@<
D.(7px1
wO]9
173Vr
&+T +
GG,k
#=qsAejPkl5V6B3npq6homyUA==
Fr)d
-&&~r
&)('L
1=Ka
Microsoft.VisualBasic.CompilerServices
#=qluYNp43cwlAh9yLdLZolDw==
B=WO
KI zbO
_U#
X=C|/
-\&(#
get_BytesTransferred
#=qUUt$Zm9DEy7746wMpw0nOgKcClljRPRKWyhQ21GyaOQ=
EditorBrowsableAttribute
add_Completed
*Jc*
get_InvokeRequired
#=qS8syUoAGHVUW8$eQd6_3_g==
#=qGGQk9IvbDfVOJG_jRDHqOA==
#=qUvO$SDWQpHm3uJq25yzwvw==
})._S
AS&@38
ztKm
"qV
#=qOYQA1S8VHR$mOO6XXuyF9Q==
-(&s8
#=q91nKS7P$i0qKCqvUAPW9EQ==
jr<wa=
xHWQ
#=qDJlWEiuGwuVXAz8yc8z7OaMssRYN4hP9AHespNOmdYHus6_1XkNOC0rqgHeRZksg
AceFlags
#=qsB4PatedVyMOyo9s5n1OTA==
User
"l-?>
get_BuilderSettings
nk48
#=qqIzVXHiNuUY4ZNiSxkqEGQ==
*nIQvyi
DnsQuery_A
4System.Web.Services.Protocols.SoapHttpClientProtocol
get_LastOperation
get_Buffer
u)P_
+}(
FzIm`1
#=qKtJTKEkNf2mJVHcZzSW8iQIcsBglzcJJOkX7V_uB55w=
4 CD"@
set_WindowState
Load
8b$
#=q8VTskDJ5TyHJcDeWmklddw==
6$t[E
!v 9A
#=qjryTBW16mUfo_ItH9KWoGQ==
FileCommand
#=qzRcQ_b8FoTlpKT_BObsgBl2bj71wU5HcYdpIIgiTJ5c=
9l$}
#=q3cm0QwDyNYr2y$xvkCk9bGbohRfuMuxkahGwLy466GA=
}-?N^Gn
#=qaRJX6K2L3xhR1w3zuwE79w==
System.Drawing
#=qfGQBFs$OKLefNYKSta_Lbw==
nbNL>.
#=qN$clRL1tbKGnARF7__FwJg==
Ii7
VFk+[MW
20qr
CurrentUser
#=qUWYBucdXrqr2Ksc_3qKZcA==
#=qJOtLSdKNdNGjNNoElacScY2TTWmLUvN6XZsl_FLfP4o=
#=qRIR1iTmdtHs$eBwEdoKphw==
"z B
v;xS
#=qhA4OqIvVSMpJakxtoytoCw==
Ya ~a
Dictionary`2
GetFileNameWithoutExtension
BeginInvoke
ToCharArray
?#9?^
xVz^
y:1o%
~utVN
get_OSVersion
utN
#=qGqugi8s64S3wxXEod1SSyA==
Dispose__Instance__
) i ^
,-\
#=qbpvfREN3OwaXBj6J3WBAim$AQyJ99fz1ef01qn6kVrs=
0:p\
?yb$
#=q0pfW5T3uO1I6LyXSPFW7Qw==
#=qFZ8xm69Cd0C55Ip2ORf7Ng==
AddressFamily
. c
get_IsEnum
lA[?j
&+4 +
X4O{
#=qXULhMbqiur_al62NrjaiXWJ8rme0bKMO8KkV356NZwk=
p#8_
#=q5mGK9suCIiUDZgS_YSrSQg==
,-
zfMj}}.
.V T
#=q3TG8MLoZf1Y44PREVW$6m76IGmuYE_BOhC_OTjkQJFtYWwRtSeFqevP9hiteuLfz
#=qxG$Aklpbf6gyBfAqTMmORA==
AY`k
'_<j!
RuntimeHelpers
gfGE
+[~u
- &oi
- &om
- &ol
- &on
affefeeffe
#=qOxeV7mwtJT4AH3HtBqNUXw==
- &or
G1;4
#=qTMXjZFh8G1ehMXQzo1c_k7izR$ZNvDyCJY5aoZ0yOe8=
ox+u
/( W
#=qdObzsTSX0MpvDi$OPjsFh219oh6Iw7DshgNWGveAvBQ=
#=qwK7$pNtMfqKNZt8gGYd$pw==
] b_
VariableChanged
\ D"h
cCKL
OL8
#=qxRbSDXwo6eARhpCjqJa2Fg==
#=qBpzegr6XzkmtwALf7kKPHV3RZVAWYLbYE79PiG2zXYs=
#=qdDrSQoelY6gHzRt_ma5NQg==
WellKnownSidType
Q<'
RawSecurityDescriptor
Object
#=qCI9CHxEGVm3HnYdn52IpdQ==
ReadByte
Nx,n8
#=q0QKFCbf0u_IpV5ISOWOl$Q==
Registry
note!
#=qaxeBDkuvv4PncQ$UM0p8ag==
IQN P
G31M
ComVisibleAttribute
1Dem
SB*X
#=qzAgp3UwWT0075L6Sh4PfZA==
L> Z
<in8
t!.R
E*~U
2jx<f5
#=qA32zcbPIWwOaURCE8zDGfw==
-1&
.yi-
OCYz]
E|ojw
,.&s
d-
QrV8
#=q__Bys7JTXmAiG9F9QC$wjw==
#=qAsEDmMyJR5b6o5oAn_4$qhqe51JCfsU9Gffe156c8UU=
5-9!K]]
#=qMpgSfrZ_Z1PFlMpqVHDctw==
EditorBrowsableState
#=qUlcwHJCewxIUk2tiKMDjXYc$Hb1k7TCZCyGdm6C93UA=
#=q9x6KBL_arYpQC$zFf4pEFQ==
?>y:
1A )
j)'
#=qzDzg9a$HVGG1G5cdhqbdwO3OG_SFijGXN8Towa37$TQ=
#=qQyvT61RAfdEUvn1jBvcx0Q==
#=qg$lb3t6abG6vgSpzSjJlb_$AIzqYfos5cl9DWFolUwM=
lJma
#=qDTvHA26pSwiGBDknUzewBVNt3YGW7YeSiQRH8F$_CMA=
C"4=
#=qiCTCgJQkyH_Kzq$FT43G4Q==
`.reloc
Z[\p
98"!
Hashtable
#=qYMGXxffne_DlG2tyCliUw119RPUt2rJt6SWle_TPkBA=
#$CP
- 9;U
#=qy7SaTx6mT2Pix1CP6ET1Hw==
fX/%8
}=%\
4 ')lY_
#=qiY1B9yU2oVkPHxhn$y67SFTP8x1Jb0botGqdUGkdpQg=
o 2
@/y'd
sY9~
+N 8q
#=qdsDfPo0zxdY$R7euM0a_vw==
#=qI5Vms5JVXaVkwalJFV3L6w==
#=q99eEsMLSp2$EVfl66Ua2d1YMqB58RPj30lLgJzJJ64o=
}U.{
#=qzx697Szk1moqO$yUynaioQ==
, (g
Stream
@gpa
#=qBuMzaVqxpYkDVtTnLpbYyjTfZNKm8_4JkuoFHPxOBFo=
V{dD
pzohd
,
System.Windows.Forms.Form
IsNullOrEmpty
'h=E
#=qW1Ty88cS3yMuRwgBrH3qpw==
-$& ,'
^YkG#C
,0&&
*+E
; !>l
Exit
quI.
cG,'
I*Zy
1Lz
#=qhWn12I_bGxHfrIrnto3QAA==
- & (
#=qs77tphQ2NXlLwCZkimhHsowpXGqSYmOGtKiGHHIs4aA=
#=qy1cXcK8A6uRpLlCz7UKkNw==
#=qGjStw3GYbvUue5kapeAzmPJAl5$UDUb723PSvMiCGdU=
#=qR0v_DeAkzbUr6_Md5tN4PQ==
v!lS
#=qFaxhQMbuEyPeOadTfKIzX7ulwKfSulnteVvHU$QDlcs=
#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=
bZwq
#=q9c$dxNln4J1nxxC7UNVnfSKvSgKS421$zTS6z9ahlusddEno_MZclU7Qbfc$Fyw5
Je
#=qRCCuvWFd9_O8CfEZhkJtSA==
+}MO
R,'}
L@uH
#=q5s6lzZCgRNNe2Z9HZfa94HOHkpUfSnAwZsGo$hzh7hY=
#=qwdHHpd7UWv1_2lcOeunA18XKUsrG9D8S$xli$tkAMlI=
#=q5fG5Wo3pzujuJKotO2WwDQ==
X xJ
Jv)g
#=qS8q1FyJsn2_ukKh5ONBATg==
#=qQUdl15sQ0xTV$45YaAtVB9Bx2NeRc0CC_5Lr_HuNXwU=
#=qxWNhTH3aUmlSLTvydVoCIQ==
#=qWCa2pDyuMnzTMLUOIIx_zqZ1n0nAbCh3XpyakFsKTbQ=
^[-e
{/C}
#=q7Kx5VWqZvUxLZ2L5c7WH8A==
#=qbzig1$2CwLluEJt5uPtpgqPx5y_2S$GoPgJP36N8bTE=
f+7U
Vk>\X
#=qJ598Vnr_RIwGnHqFfQsYCw==
|ST
Fr1Hr
#=qRLk0VFphuSTh16H1MGZUv_HwKU6b1$OQZ0l10zUjPKU=
f],H
nOY$:/
? tgz
#=q8uMGC19QD5WGzpkzUOu0SQ==
1t>H)l6
=R7
ZN9C`
Details
~8CJ
#=qYVgYkiAmhdTmisXUMVHYlJUHzcBdggj3Sn3nLI_MDJ4=
T4 "|
r%_u7
],1]G
&* +
4%B3
Lnya
ExceptionHash
r)v',/
{8?<
XaY
m ,rjb
#=qJpz_ygP5AiHfhtTxRulSsw==
WaitCallback
OperatingSystem
#=qQ7tSKwAULKz8TSFsLbtapA==
MemoryStream
-#&
(I=TR#
OBEu
Zero
&+O +
0%EW
EventHandler`1
j {0d}
#=qyYejfncvZCW4q4y4GEV7QqOL4Aox1NSDqQmcpM4TQVA=
uAR!%8
#=qd5f1i4cDO3tAO_bEb7g1cw==
#=qRYSdRGBC6LM4UFJJGQnk7A==
XuHx
GetFrame
#=qN9oos_gePS4akhGX5rjcOjS2FNZJlTAkUnO0Ykgu7Rk=
K(H:
$zFmT/
System.Threading
#=q1ZcUbkVKv7wahbk_Am8y6A==
[]N_2
-Jfi"
#=qDJ8UKTQIGM$_7XkvuUdssA==
MessageBoxIcon
SetThreadExecutionState
3 ~]
9V~=
uqa&
eIS8q
UnhandledExceptionEventHandler
#=qz5nGZygXT2sWR5FWGAcAzA==
n|;XR
#=q5WjY_m3ubVFfbJuyu7GMxA==
-|W
+u_r
lpGG;
:7lp
#=qmL2H5Qgs6vv79mCqS$t3qg==
GetEntries
#=qfXdNdmKHZO9pILMTQ4gUIFhfl9KPJm2rU8y_LQsTH4c=
#=q$YUIMaEFO5IFZXBvo0kclw==
2M%F
-F&{
#=qhnLoeDP_EbzJexQQPp_LLA==
8tkOD
&+J +
kOpS
'kHo
#=qk77uxMCXAcR_2KMKgZiSng==
-T&s,
#=q8d8q1KZbTCKTAZreko1Lug==
Buffer
get_Current
b%
#=qkxH2pC1tIcRyW8E4TCtfHw==
W,
m q
|txmy
NohY
awuaQ
S2oF|
0d?,
#=qJY6uBmA7bjB3pfI3CAMZ7w==
d2.u{
[nY
#=qfpNcQ8IYoPRIQgVc_nBfXzVjxVN2nY_mFz$PcDXaKKw=
Zh3
#=q8T1neNU8Flp1WaNsBKnRHQ==
#=qX52fPnzDspvxDLERxqgnmVyN3O6kmNVEBrlqQ9OVPeE=
\3@~
get_RemoteEndPoint
t({f
#=qQqZpewiWxGMAW$tQ9Rz23Q==
#=qgPQkZ3GBDc371jzhubcNPqmxfqhr7b78DNmenmuxGa8=
1Ai+e2
#=q4kB_KjL2oo8adT7lfnt6ew==
LoadResource
/SW-5
Microsoft.VisualBasic.ApplicationServices
#=qOmCJCQ4xVqqqlvNEZD66Wg==
" #|
CloseHandle
#=qiNB6YyqAJbx2uPAiP1Ihw9dTNEtwaZElmpYLZcGO64Q=
Ecw|@
~}6
W_RX
'Q{R vZp
+
Next
AiP_
% *f
R~ks
{f<8
+
#=qEDU5bqS$T9T0k2xHaznuPTNI8j4z6II52ItUe0wjyZ4=
#=q4P_5NYDHZX9MPbDZuNFOAbRpAmJ2c_TFz8M5ulhIFApTRNfzn3_E1__1$MVw8$WV
#~l#
#=qMMkhBs_8vtf4989qCM6TUw==
#=qSbcOBh8Kf7zb$IciDxPlGw==
#=qwBDUI_NSPNLYbPH4gy$3uQ==
Z\sc
YO$U
#=qVCHxDTr$$bwFMb6i9vBKRZciaa69edA3gsLNOty0RAzCorWRBUh2v0PgySYBEvZ0
MDC
NK*s
c`o X
XK 8
Empty
get_StackTrace
#=qhufLjssUmkN_mXHuWOXl8gUDxidnVdWY$tHhp2HS0ic=
\!Gu
"Tm
#=qeAiPMWOD6_wvQ4$bYsFv9GLgsem$trQFsnkw3WN9igk=
_w\D
glkb
#=qe0mY$R_rBsPIZZv3hPLS4g==
I8J{y
AceQualifier
#=q2dXdGRU_h62YVIUhgXBQJzEnralpXNvp017RQs19jjo=
VJv|ex
get_Major
#=q0M0RRypoNIjajWAugf6WjbxM$GiKS9VjK_mg6sI0TI8=
#=qVXB_y3eN_sp1$Md9UoJeYQ==
#=q9heLrZy3cpWSk7do8VVthg==
#=q_ux9H7Sh7a2A98b6QB8m4w==
}n LA0
#=qJdNCQZ8JQCfthL12ut8Zgnr9$rl3CuJQ4GAn54E6CXs=
#=q1A7nXYgjUuxh_0aV4fZMB87On7HuSdbeS8x$mfXfW2c=
#=qhFV5jkshUI$uRxypI6oecQ==
qf>9#
-f&&
0 + +
#=qSl7F7iXGTH9iNXHds05fxcgA7Cydd52A6vZtHH_41F4=
u(g2qt
#=qvJ_V3lJRnVEW6EI74n63zg==
#=qOTqiIHVN4TWDu4_xhgbifQ==
v2.0.50727
SetLength
#=q3VDCpnvucWhkt3J6zytXBA==
#=qxUvHfLZKZiUmPXUqPV8Vcw==
\f8L
@t s
#=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA=
rX;p
_Lambda$__10
#=qvbTNBihG2zARsewkRIFTSQ==
_-?cM
)[2.
t7"_?
set_Item
ToUpper
WNLY
z{iZ
#=q0zLeEY98tybLc8FS6iVEWjGp4MNZxETphcH7ohzBXuY=
DirectoryInfo
#=q6tJHosKuF0IY3gGxjaveNw==
AQx$s
Y_ + +
#=qtkqHWk1kvmO5zt3tTCyF2Q==
Hr;
#=qbNq0eOj9Pw66KrsrDd4qnA==
#=qSpdFO0arrQmbwA1JpPKL4TCAmwZYVDNVmpRQ6ryTPgs=
#=q7O26Wc9N845khaV1IlgZGg==
F ,x
L|1D
fe@^
v[%U
Exception
#=qG2DPieaEKCS$j6T6yTf$qg==
@=D
#=qIOX_rwHrS_RLFL2igzRsUQ==
Q}&&
jbV
C%(L
\6|KB
#=qLJcloNvItceT7R54Ssv5HVCoj0j2JUUq_dQXQpFZZjM=
d ;L
_VM9
#=q4KMIX0AcXAdYuUiSKvyy9Q==
& oC
! H O t
#=qR_QBxpRX$xZ1vjqVv0afDQ==
& oy
#=qbFnmVfulgLVjclcqmmhqFw==
#=qtIl3MhjXHsnCHvTVFi9hFg==
5\0B
#=qFMsFc_zvkhu_B2YTPJt9Yux7Vq8aZNOr3FA$mEdAzCc=
wQRZ
*B}r"?
Z6-yS
Z e p |
GetTypeFromHandle
IAsyncResult
M>0
#=qT9sog7FujhNJZHxxUXVGPg==
set_BlockSize
B,IK
#=qqsKAc3v0igxVSmn4Feg8q$1tNTWiqtCBpA_xMlgU$f8=
K Ua-
{8=SMl5
get_Connected
~@
#=qpaOobmVTnUS0322VEUTQd53tn4HeMWSoV2XuTUOmp6U=
GetEnumerator
~J
SymmetricAlgorithm
#=qEKdoqcCD2XVb2atXAIOmL$Gnnk$r2oNLDVsEymHbxMo=
+d<q
#=qOgcjmweVxeuvMU4cvcFOmg==
'RM4
<generated method>
#=qzjreg8z0D4BPrx4RxUJBoQ==
jiqX/s
MessageBoxButtons
dRaH
Int16
~t
#=q8r1xTCj7grAlhMxU0cmrbA==
ClientSettings
@BBz
#=qo8wG17V6QHcxsU4R0xmY_Q==
ComputeHash
_b)Xa>8
3?~Z
:1fk6
#=qtcncUaS1HcVKUD5AEGHBokWqEL$GDDjoAu8asy_oLis=
#=q1BpeNGUQvsUFoXPmB6q50A==
* 2 q %
^s,; >
ReadInt64
y|{t
b_6._Q
ClientInvokeDelegate
#=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
#=q1tLM5Gk001IDETj3RhJ2ESaIo2XgaV2vMWhqISqSHy8=
#=qkcPDXy2$GrSLn1ykhNxS$A==
#=qqn0Pbku3c3j14idd7rNOJmIbi4WueHDQGNjxpToWe9w=
Enter
/(~,
cvMn& '
.&`w
GetInterfaces
/H}p
B:
FileAccess
*N(A
~2
M*6 P
CommandType
-0&sY
' 0P
#=qRACckQ0ejzlKZgeXX_CPJUyKbl7Zu7QfhWW6eMM03VPusMYB8LREfJZQVcTGHBm_
ZsX\1
#=qGgXamaT7IeK3DM0oRfGI7LZg7FrEWNz8CI_5MUlFEJw=
5iav
get_LocalEndPoint
#=qcyp860KJctHXULF8nCr1oMRR0y2kU8XZrQHqsInbsAM=
zsX
#=qZ79zrlLw6T9kJCHt$e306HkmYpQl8J1ugf3bmy8tycE=
#=qTYemjRfvVDuBO5lrz3Aq6g==
#=qyEH54IW$f9fUJb7FOR8r3vj6e$onLGrpm2VGycjbl9TZJEqkwtA4y4bL9ExOWpiA
System.Runtime.InteropServices
kw [j
nwa~!
#=qqMkZyGiL$PHkYblZrq1S69029tlEdPXkxbM_smmrcRU=
zsJ
n|1j
RemoveValue
qqS%/
GenericAce
Math
#=q4N2IYJkFi2VWiCVDKVND$8gixU$DXUcX8F2LiLBxLHw=
Fj3G\
W Y)&'rC l
&&*}o
- &o
- &{
0dSE
{
Ad ^
#=qKY90T141DaVDQT0DHaMEr8C6aPEoolamkqMM94Ir$TE=
advapi32.dll
#=quRXaU$OHlRs_89kacdiUMQ==
- &{
- &o
#=qxybSLhWq6EDNDl0$FuPN8g==
avSA
#=qos7yzAcb5jR$ypc0Qk3OWQ==
u I/
Ho}{
System.Runtime.CompilerServices
#=qVcF51voQmyGAgyAUz3313w==
#=qgHxgiBgB0FhzEGOOs2Dqnfh3XnJ7nEmajCNqRqFR3Fg=
SuppressIldasmAttribute
{>1
IClientAppHost
J|*pg
#=qgbI51haY38WJ4NumXDqnLC_uKv$aRHAyD63c9HgGYzlsFjikAASqT8RCSswEMouz
- &&
SByte
@ W \ g l
]/77
Bl1[
I,P(S

- &&
ffeefeffeefhah
#=qKi0KrAcAGUOMcS5S$2tJyg==
- &8
#=q00kXQ$0a$SV9DIgRtf4NWQ==
wyvUo`
#=qXOmEbR_8DUzPz6sW4Kmd6kaKUIQOYZdTpvq2CkB17PTlG1zEUgI_P4skJXU2VwtO
HA_CE
3=\4Mj
;jx|
bI&R
uos
FormWindowState
- ~0
- ~1
!6tG
#=q3rtw1eBB$yyPLXzQW$mDOw==
<yGb
#=qbmVTgf9cRSZkM_UgFSJrlQ==
#=qWsrg06gTzsE5hhHu57fJFw==
RestoreProtection
TransformFinalBlock
#=qKXWwuvxG9klNObPbc$UF0LIw0aZIk7Z0VPIncl8uFJQ=
2r~ :"<
c$|c
0|c
get_AddressList
System.Windows.Forms
N"!U<
ne]5
UIntPtr
VA H
#=qH7CAcg5aycQv61Wo62XDpw==
c"<Dq
_K9e
i_v2
#=qglhcKpwNlOshaHMfwiT0UA==
x)Eu
#=qi1H2yZDbCxvPo0ia9nVnuw==
#=qvz1sVA0ePAgs1nzIHQTFVtjljpeJ1QO1S19vLxn8DMU=
get_StartupPath
#=qK5Mf9uxDCjwDRfyJQ6kp8A==
Z!e'
#=qtBt$1AtaHrrce6fc6LOT3axuBNxZ$SQPty78qYGi1os=
IDisposable
# $
A ln
Exists
System.Security.Principal
#=qKU0J1fiP8KA33eFK1owekQ==
&+P~
#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=
m^Sd
0e!GLl"
*B +`
ReadChar
ErQO
DDgB
#=qD_C1_4vUU8j6eQSUvsJDw_O6DZliNi$NDCaON05RwdmBpVqAu68W00hmx80mCKp6
=0vo
#=qv1Nmoo$HMwdd1A0cX75UdA==
l!7
#=q1AWpt7Zq4Tx0wGx4hVFZRg==
vO8>.t
OpenRead
#=qFTBwGADWl13TibdOa5ODk_Y2qcfMGC4lp4rhrZcE84kZNE6dU4EqEk2ZYKuJAWo9
CompressionMode
E"Vb
/.ffefefeeffe
#=q35mMBfMcRRKrjeZsPOCz3A==
Z! 9M
KeepAlive
AssemblyProductAttribute
gr_>
#=q0qLVKF4NbQlcaunYsixITQ==
#=q6CxZjTl3_v2RHWKegcqMWw==
-&&
#=qkcVkJskuGA4o7kGuN79i1w==
Equals
Yup
#=qWrm21vQ8CBMZP_RBTwpusA==
b@Nq=
#=q3_2_t217j7pS3JjemZNI07w3dukMmHXPSE5$LTnvGS8=
<Module>
#=qD4n8L4W9wQXrF7w_31K9bjmy3jeB41mSJJrYkh6lpiE=
V./{
[<%:.
#=qtS81hD$ORACBvdEkFyqaXA==
d KT=
0Rr_
6M >6
+O +
#=qNn8WS2rooUJUoMsG84mQ7PkK4IQF8$E42cyDjfL7Kqc=
MulticastDelegate
b`h*&+
#=qYKspnFhL3rrV8a6zSvXJWA==
]/y0*x
S"B4m
#=qPYtEwg1BZk5tP9KKNl$36tqIdWilqjeWcpWKL2Zxnug=
#=qcp_YDS3uDXZMDFWGeFYphA==
#=qGPdnFVTlqnS4tiFpuQulXa$2eC7Pe6YqVeImkUGsMl0=
#=qaysgaPdcuRrUvev6__tYEA==
feffeefefa
0Ea}
#=qJT4I5hOweIk$xYFEeDszbikglXCuquUd$v9AXtyq2ns=
xd#|
AQNG
-,& ~(
U@.@
(uI|
I/#feZ-2P
ToInt32
fefeffefefea
#=qVqLFp2u1the0Txg1vhieSw==
#=qoGHQsKlZ7jK$YeTeBpzDNYYM4Z1FIrOpXaDV$VTAdfM=
#=qJAZ7is41tIXMNDQIkGLgjRC15Eis_QBrdFx8JT2Rx54=
#=qQ3JMSE9km3mGmL6lmUfRHw==
#=q98hMbgVf4fBR3MKeaM4uQI$YRLQdIr1biYYF5369cW8=
.m#|}
pS>)
#=q6pErmyx6x4$YkotXXEXGCt_ysi5JdNm1fpNgnUvZ9LE6EtA8E0TapqXrPnqyBO1x
#=quebj1wBCmruzAKmg6Y4Igg==
}geRf
BinaryWriter
get_UtcNow
#=qQrBlfreeUYUGyN3hPOorGA==
#=qoKFLFqm7bb3VWsU2QKXIQ4_6anGbTCWiZAfrNlgq8fc=
&&*}#
#=qFZLDtLWdUONY4B_gU_jjJi4BgFANcRLPMuWuQINdRLc=
#=qgSHqO_KLHRARFg70SGn_Mw==
get_Exists
SizeofResource
Y6u?-W@
BuildingHostCache
CreateEncryptor
ProcessWindowStyle
&&*}
ThreadExceptionEventHandler
#=qHdV5wMNiXS49lDrqJF3pqA==
&~0
&~1
#=ql4R4vy5H067cy2C3KkF7Mg==
f Rp
#GUID
#=qhSKaq9YW4A_ja0UC7Difmw==
#=qtxap8xCUFH7z14nNy3cjjw==
- &~7
- &~4
#=qhme1CFqs_evb4VXik7N4x7lNdqSfuNy3r3OUWZ1V4Zk=
DY{C
get_Exception
&&*}n
feffefefea
#=qaCmGqb7phy5lq$DAzhK3vB71XCZSvhKm3BtGKq_xBto=
&&*}c
0nJV
&&*}e
%%BN
&&*}X
#=qKxL6kQaUyB_6jIG3mQUGOw==
N u+
#=qrjPq4iPb$PLckcObsgRE1Q==
{?ee $
DefaultMemberAttribute
vh/)4z
a)KR
i Rl
#=qxOFsoGbvlBlUujyS9g3fPQ==
F)PO~
9}{l
#=qo$DZvhC1PKdsChUToY52NA==
#=q61s8d6EIAdSsDLLjqchw1w==
ToInteger
vzCZtD
Write
jpv~
b+
h68)
e&[d
GetFiles
;dNu
#=qbMe5UnnXEF8aurHaZz6klA==
;Xa!
-*&
9zf&
#=qs202XG_JxpBwpKhptOZhRA==
a'x(-
GetPublicKeyToken
- HN[HR
#=q_5hmJXim2EG1abw3Kju8nMffXDIbl5na4zXqclsRK_s=
#=qOsu3u3mLIa8ikCCuCoOv_w==
EventHandler
-,&s
Thread
#=qMWVV4JCreo65oWvwYJqZWobqlgJkr$K2AUIqF$weF5s=
}>Os
#=q1jj2Lo3UBKUZkdI2bLcg4QlXuNGNWZ$CYnK9VTZNEsA=
#=qd3Itd1ELDPHJxhLvt0y1NQ==
#=qoygY$KIlhsLDneTXkJ_L9A==
#=qvPYkN4Wli543LScsy6rh$bZ0bDIN0tYd5zlNUibOEKfBRc13v6NIDRtsxPOZzKpX
Microsoft.VisualBasic.Devices
MyTemplate
#=qrIbbxniIme2qLTdRw6i0wDoZFMH5BWs03iMeSnjojQU=
X73a
#=qb8Z0_4AS4r8OSPknVYvDfA==
InsertAce
SetValue
@in]
Encoding
o{D1g
eV?,WU
< 3,bDD
5O 9
/ b{
QueueUserWorkItem
get_TotalMilliseconds
A^;(]w
SetKernelObjectSecurity
ReadPacket
YK 2X^ '
"cyc
IEnumerable`1
#=q44BQlEuOnjFd0LbnzKKIIg==
#=q9T406SLBpfhYfDTkCrB28g==
fK,w
#=q2LHISsr6oVwPjyrC2AFTD2_CdAouK60pDkoTs0efRSU=
deWj
d_?W`
ObjectFlowControl
z~}
n d r
-#&~7
ReadAllText
#B&,
.7DB
Q/C
3eP4
CheckForSyncLockOnValueType
|}]Q
ue,l
xs<z
cmA!
)A}LBb
cB@3
#=q2l$b42bR_hlbzUjQTk6vFw==
ReadSByte
#=qfOXLv$ej4ffVoa9QN8Vke8O9DCKhSHEsi_sqFk8Qf0o=
L; av,
IClientUIHost
j= Y.
3xk
Ia}*
eW;]1
OZ\t
ToArray
#=q8xbuK7pqyq7mWB67vviBtOo1WSCccuR7xEQnGnyxMyQ=
#=qCJD3QzeNpOG7t7hUNPqgxgwPhMjv4aui2ikN049iz28=
#=qbUu2Y2P9FL2iRkWyb62gww==
f|Xp
GX6\3
XaY
cAOt
Zv\R
#=qwGYG3$xqr6oMjxRyF4i0Uw==
Replace
#=qFWLbBQgFiIpy22HFbhF9GQ==
#=q0g2hVR4CYkiIvLHeQL6tUkW2KQhRibG1DIo1pReSOj8=
System.ComponentModel
#=qKKJCW_KTAsIH3uNlP3Z4Tg==
LocalMachine
#=qWLKNBubktRcyu8vI4dIAJNOqajvyL7NccmUEC4QD9y8=
eZ+
-b&&
#=qfjs2lYYPRWKuXjeHrc8Rtg==
DyOO
# &m
#=qHamFicykpD9fQKnU2wtqJw==
get_MachineName
(ift
#=qPbvCT$UNIh_DPMt5F02Hyw==
0D2T)
TargetInvocationException
-?+
}S_=
K%(L
-<rY
#=q0FQ_PiagXHm_B8aG8Ji9Dw==
#=qIZP8IX60gSYF82kuZejmg8pOoXfEBczapTTwgrWM$fM=
#=qzzNUaijPluPyLfyxwDObxw==
%xpW)
#=q_NLac$XJ5lIxZMpXsr_nBw==
#=qlsj4Kl0M6SYgZMJLZ$QkSw==
<Gi^
,&+
#=qFlz$$vhlrnZb7YOji0eF_QZBzkOajT0w3UoQbgnXVIA=
#=qGS6wNk5u54YEpqtjtMFIpQ==
#=qvvhgGCgMlZiK63M2bP1Kcg==
]}Ip6
,,~M
#=qnnmAgQGEsJw4dsVn9gN4wJbRL4WqsDa_V0QuBPM2E4A=
#=q0EPYqANhk$fGDlTztPFu2jRCdUruoFdUMwStI_GHseI=
System.Collections.Generic
ei7$
)GBy
Compare
8,#^7
w-/p
Queue`1
#=qOn6YhA2JjwnYZ_7D0fnnEw==
g/ q
#=qG5YZbexfSlZk_cwFxKFh4HaY$Krp4rK2HdCH8OIs4EI=
#=qXCoQdguduOewiATPKLDvyekx3X3r68VNkZOPBX9O5lY=
- 4 ; U g
Bp$V
#=qPjPHWXGbaA$51Cna2ZaMpQ==
#=q63A3zH9hQ$3c53x2wqU0Qg==
#=qibDx9sEkAVZroec7HmNu4g==
O*A0+
IClientLoggingHost
vC.<E
#=qcrlhteALkcfYnKFH$UWw$HzZqj8gdN8_KwUKIC_ywUo=
#=q0myQQ6i89t9SZyjYDXZrBLa9ljWEUD7zAwJyyFZowQc=
WriteLine
System.Security.AccessControl
nG\j
#=qTawRDksY2KFvY5V2vw1_pA==
-b&(?
*N(;
#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=
:hu'a
get_InnerException
- &* +
#=qNzt$mJakh1Nxv4vDRDjTsa1OVDKMAlRCO__qncxMoXRz8jNE7AWvE0B4WIqANR1p
S?v
GeneratedCodeAttribute
@HgB
_BN~
#=qgCcrNFC0iLB8hKTy5iNnsw==
#=qhg8oaKg1xx$HC$DKnlbXQpibwH2HXqMGSlGv30vEUsU=
6|s3
2V~s
Remove
2y}G p
N!dR
#=qi_z83UuaQZa6UsXCAahbTQ==
#=qURIxMOG0HImwEP4A6zEiPg==
-p&~C
#=qTZGarPS37Dw3Z3Ipg_AFug==
#=qXz2OER2RItZOjngvYurWLQ==
S +*
#=qSoHRCAcaypsR55EueXBy1g==
set_RemoteEndPoint
D#G)
#=qNZVIIdU4QECigaum94nwLctVkDSuRt$X4_IjuFpWVuY=
#=qAbQ42UrUbGpmkYA2zun7Tg==
&&*}
[m}5
#=q6V4Kle56uZFNUY$zkrrKJQ==
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04b_64 Seven04b_64 VirtualBox 2018-02-16 20:05:02 2018-02-16 20:07:52 170

9 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04b_64 Seven04b_64 VirtualBox 2018-02-16 20:05:02 2018-02-16 20:07:52 170

8 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\WindowsDefender.exe.config
C:\Users\Seven01\AppData\Local\Temp\WindowsDefender.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\WindowsDefender.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Users\Seven01\AppData\Local\Temp\WindowsDefender.INI
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\run.dat
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\Exceptions\1.2.2.0
C:\Users\Seven01\AppData\Local\Temp\WindowsDefender.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\catalog.dat
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\storage.dat
C:\Users\Seven01\AppData\Local\Temp\ClientPlugin.dll
C:\Users\Seven01\AppData\Local\Temp\ClientPlugin\ClientPlugin.dll
C:\Users\Seven01\AppData\Local\Temp\ClientPlugin.exe
C:\Users\Seven01\AppData\Local\Temp\ClientPlugin\ClientPlugin.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\settings.bin
C:\Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
C:\Users\Seven01\AppData\Local\Temp\WindowsDefender.PDB
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\Globalization\it.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\settings.bak
C:\Windows\System32\tzres.dll
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\Logs\Seven01
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\Logs
C:\Users\Seven01\AppData\Local\Temp\Lzma#.dll
C:\Users\Seven01\AppData\Local\Temp\Lzma#\Lzma#.dll
C:\Users\Seven01\AppData\Local\Temp\Lzma#.exe
C:\Users\Seven01\AppData\Local\Temp\Lzma#\Lzma#.exe
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\SurveillanceExClientPlugin.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\SurveillanceExClientPlugin.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\SurveillanceExClientPlugin.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\SurveillanceExClientPlugin.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.exe
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.INI
C:\Windows\Globalization\en.nlp
C:\Users\Seven01\AppData\Local\Temp\dnsapi.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\WindowsDefender.exe.config
C:\Users\Seven01\AppData\Local\Temp\WindowsDefender.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\System32\tzres.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui

Write Files

C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\run.dat

Delete Files

C:\Users\Seven01\AppData\Local\Temp\WindowsDefender.exe:Zone.Identifier

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsDefender.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5aa75839\10fdf3
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\mscorjit.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Drawing.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Windows.Forms.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKEY_CURRENT_USER\Control Panel\International
HKEY_CURRENT_USER\Control Panel\International\sYearMonth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\4ecde57e\31d9ddbb
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|WindowsDefender.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|WindowsDefender.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|WindowsDefender.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\culture.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_CLASSES_ROOT\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\diasymreader.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\a054161\46043f61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\219e9581\29613036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\219e9581\26d59603
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\InstallationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Data.SqlXml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Library
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\IsMultiInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\First Counter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\CategoryOptions
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\FileMappingSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Counter Names

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\mscorjit.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Drawing.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Windows.Forms.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKEY_CURRENT_USER\Control Panel\International\sYearMonth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\culture.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\diasymreader.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\InstallationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Library
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\IsMultiInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\First Counter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\CategoryOptions
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\FileMappingSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Counter Names

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX
Global\{349e2349-7cca-4ed5-aba4-76d0f3b6f681}
Global\.net clr networking

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
kernel32.dll.QueryActCtxW
ole32.dll.CoGetContextToken
kernel32.dll.GetVersionExW
kernel32.dll.GetFullPathNameW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
user32.dll.RegisterWindowMessageW
user32.dll.GetSystemMetrics
user32.dll.AdjustWindowRectEx
kernel32.dll.GetCurrentProcess
kernel32.dll.GetCurrentThread
kernel32.dll.DuplicateHandle
kernel32.dll.GetCurrentThreadId
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
kernel32.dll.GetModuleHandleW
kernel32.dll.GetProcAddress
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
user32.dll.RegisterClassW
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
user32.dll.CallWindowProcW
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
uxtheme.dll.IsAppThemed
kernel32.dll.CreateActCtxA
kernel32.dll.GetCurrentActCtx
kernel32.dll.ActivateActCtx
dwmapi.dll.DwmIsCompositionEnabled
user32.dll.GetWindowTextLengthW
user32.dll.GetWindowTextW
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationA
kernel32.dll.SetConsoleCtrlHandler
user32.dll.GetClassInfoW
kernel32.dll.GetStartupInfoW
user32.dll.GetWindowPlacement
user32.dll.GetDC
gdi32.dll.GetDeviceCaps
user32.dll.ReleaseDC
user32.dll.CreateIconFromResourceEx
user32.dll.SendMessageW
user32.dll.GetSystemMenu
user32.dll.EnableMenuItem
user32.dll.SetWindowPos
user32.dll.RedrawWindow
user32.dll.ShowWindow
user32.dll.GetWindowThreadProcessId
user32.dll.PostMessageW
ole32.dll.OleInitialize
ole32.dll.CoRegisterMessageFilter
user32.dll.PeekMessageW
user32.dll.IsWindowUnicode
user32.dll.GetMessageW
user32.dll.TranslateMessage
user32.dll.DispatchMessageW
user32.dll.GetFocus
kernel32.dll.GetModuleFileNameW
kernel32.dll.SetCurrentDirectoryW
kernel32.dll.FindResourceExA
kernel32.dll.LoadResource
kernel32.dll.SizeofResource
kernel32.dll.LockResource
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptCreateHash
bcrypt.dll.BCryptGetFipsAlgorithmMode
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
cryptsp.dll.CryptGetProvParam
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptSetKeyParam
cryptsp.dll.CryptDecrypt
cryptsp.dll.CryptEncrypt
kernel32.dll.ReleaseMutex
kernel32.dll.CreateMutexW
kernel32.dll.CloseHandle
advapi32.dll.RegOpenKeyExA
advapi32.dll.RegQueryValueExA
shfolder.dll.SHGetFolderPathW
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
kernel32.dll.CreateDirectoryW
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
kernel32.dll.WriteFile
kernel32.dll.DeleteFileA
kernel32.dll.GetSystemInfo
kernel32.dll.CreateIoCompletionPort
kernel32.dll.PostQueuedCompletionStatus
ntdll.dll.NtQueryInformationThread
ntdll.dll.NtQuerySystemInformation
ntdll.dll.NtGetCurrentProcessorNumber
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
mscoree.dll.DllGetClassObject
mscoreei.dll.DllGetClassObject
diasymreader.dll.DllGetClassObjectInternal
advapi32.dll.GetUserNameW
user32.dll.GetForegroundWindow
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
psapi.dll.EnumProcesses
kernel32.dll.GlobalMemoryStatusEx
kernel32.dll.SwitchToThread
user32.dll.GetKeyboardLayout
ole32.dll.CoCreateGuid
ws2_32.dll.WSAStartup
ws2_32.dll.WSASocketW
ws2_32.dll.setsockopt
ws2_32.dll.WSAEventSelect
ws2_32.dll.ioctlsocket
ws2_32.dll.closesocket
kernel32.dll.GetFileSize
kernel32.dll.ReadFile
mscoree.dll.ND_RI2
mscoreei.dll.ND_RI2
kernel32.dll.GetCurrentProcessId
kernel32.dll.GetComputerNameW
advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW
kernel32.dll.LocalFree
kernel32.dll.CreateFileMappingW
kernel32.dll.MapViewOfFile
kernel32.dll.UnmapViewOfFile
kernel32.dll.VirtualQuery
advapi32.dll.CreateWellKnownSid
kernel32.dll.WaitForSingleObject
kernel32.dll.OpenMutexW
kernel32.dll.OpenProcess
kernel32.dll.GetProcessTimes
ws2_32.dll.inet_addr
user32.dll.WaitMessage
dnsapi.dll.DnsQuery_A
ws2_32.dll.getaddrinfo
ws2_32.dll.freeaddrinfo
ws2_32.dll.bind
ws2_32.dll.WSAIoctl
ws2_32.dll.WSAGetOverlappedResult
kernel32.dll.FormatMessageW
ole32.dll.CoUninitialize
kernel32.dll.SetThreadExecutionState

Execute Commands

Nothing to display

Started Services

Nothing to display

Created Services

Nothing to display
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04b_64 Seven04b_64 VirtualBox 2018-02-16 20:05:02 2018-02-16 20:07:52 170

2 Host(s) detected

IP Address Hostname Reverse DNS
8.8.8.8 United States google-public-dns-a.google.com.
8.8.4.4 United States google-public-dns-b.google.com.

Host(s) by Country

Hosts Country 1
2 United States United States

#infosec #automation

TheSystem Itself @ 2018-02-16 20:06:06

Detected family: #Nanocore

TheSystem Itself @ 2018-02-16 20:12:02