MalScore
100/100
MalFamily
Malicious

ymc.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 13/65 Related 2135
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 510.00 KB (522240 bytes)
Compile time: 2017-05-08 05:06:02
MD5: 0be741b4efbd5b0e8e078ca82f53f319
SHA1: caff3532694d31e7a6bddd818fe7bf3beff653f5
SHA256: d5d45ef851033709e6df30b24f104a35316969e85592a05361af247b39622785
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 hd;WxLa .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-15 11:21:03
Last submission: 2018-02-15 11:21:03
Filename detected: - ymc.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/ymc.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-15 09:31:47 [13/65] VirusTotal
PE Sections 4 suspicious
Name VAddress VSize Size MD5 SHA1
hd;WxLa 0x2000 0xd504 54784 70825ad7e78d047f2da8f9e105c5a8ac 954622fcaa48c25829693d017942bf216788bdef
.text 0x10000 0x3dc50 253440 b5fd7a6fec2ee2a6b3ea9ff33edb7276 41988f7fae56f7e872c9c39427b830986885f5a6
.rsrc 0x4e000 0x33a30 211968 af0c1c036ed7a3112a1662e4455c2716 68ff0c27864d96a00bbff08f2c49f5d91d377370
.reloc 0x82000 0xc 512 4e4a67c1ffad72c688ad19cfcdc4fd13 d14eeb3fb7574ba336983085b070684b350f4b1d
0x84000 0x10 512 da8c3884b98792b6bef8967fcff539d0 68e0303f596b209249acb6097527889af6738d8b
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x4e130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x8147c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x81490 944 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x81840 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2017 Duke Energy Corp
Assembly Version: 0.0.0.0
InternalName: ymc.exe
FileVersion: 6.8.19.2
CompanyName: Duke Energy Corp
Comments: ibadaqayubowigar
ProductName: cobas TaqScreen West Nile Virus Test
ProductVersion: 6.8.19.2
FileDescription: cobas TaqScreen West Nile Virus Test
Translation: 0x0000 0x04b0
OriginalFilename: ymc.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
IP Found
6.8.19.2
URL(s)
No URL found
"!,+/.21314151
Assembly Version
VarFileInfo
Comments
9dcce5fc-140d-305
9dcce5fc-140d-304
9dcce5fc-140d-307
9dcce5fc-140d-306
9dcce5fc-140d-301
9dcce5fc-140d-300
9dcce5fc-140d-303
9dcce5fc-140d-302
ymc.exe
ProductName
9dcce5fc-140d-309
9dcce5fc-140d-308
9dcce5fc-140d-3042
9dcce5fc-140d-3043
9dcce5fc-140d-3040
9dcce5fc-140d-3041
ibadaqayubowigar
9dcce5fc-140d-3044
9dcce5fc-140d-3045
Copyright
9dcce5fc-140d-3020
9dcce5fc-140d-3021
9dcce5fc-140d-3022
9dcce5fc-140d-3023
9dcce5fc-140d-3024
9dcce5fc-140d-3025
9dcce5fc-140d-3026
9dcce5fc-140d-3027
9dcce5fc-140d-3028
9dcce5fc-140d-3029
Translation
6.8.19.2
Duke Energy Corp
cobas TaqScreen West Nile Virus Test
FileVersion
%q^
VS_VERSION_INFO
StringFileInfo
InternalName
2017 Duke Energy Corp
000004b0
aaef7058-d274-77
ProductVersion
FileDescription
0.0.0.0
OriginalFilename
LegalCopyright
9dcce5fc-140d-3019
9dcce5fc-140d-3018
CompanyName
9dcce5fc-140d-3015
9dcce5fc-140d-3014
9dcce5fc-140d-3017
9dcce5fc-140d-3016
9dcce5fc-140d-3011
9dcce5fc-140d-3010
9dcce5fc-140d-3013
9dcce5fc-140d-3012
9dcce5fc-140d-3037
9dcce5fc-140d-3036
9dcce5fc-140d-3035
9dcce5fc-140d-3034
9dcce5fc-140d-3033
9dcce5fc-140d-3032
9dcce5fc-140d-3031
9dcce5fc-140d-3030
9dcce5fc-140d-3039
9dcce5fc-140d-3038
"y h
+" Ma
A`vx
Ol e
t3r4
f<XNc<>
~s d
vq(&
p>JMx%}
dj#]3%X
[)8n
X1-pQ{
-Bl1
|U0c
cjiX(
Y62k
PNG
C0Ydp
P@I !
6U rQ
!{PBq
aqum
R\_
i6|9 U8h A'EK|m<r29mIl=3'
ss{8
|arW
Unh
tKi|
g_\#
+%_
geG1
jf JG
ResolveEventHandler
l+6{EV^$
)lc8
|SQg
e)J
u=NmB
:p\t#
84 K
2Mw
4P0z@
GyTl
mSo<P
.:\;
u?aY-1
?uH+
z6F=YVPOE$ v7fr'0!Aw8~JV>
J~i>
faTa:}
eU@(
7=Dq
C98|
" >h
&qZ:
eP>b
| a{
K n:
Rm2Y
?i"+
~fg'
)Svr4
$.^6
r'''
9|xE.
qK^rS0Hrqt[JYJBPGG<$*zKo$
t;j@V
2D@v BPh)~o"{aGCfB\%l$1D0
N~Zu
[m1L
"[/s>c
T#`z
= < < < < < < < < < < < < < < <
CU&ajj)1V
Version
1geA
FB"?~HAY@XM#I?j$\qT%&b6\"
1:$@
"nJ^GF~;Ly'#FW{)q8qv~i@ $
TTp+iy
nqNd
X&nz$[y
I@{[
~Xn;p=s}&<J0KX!XZ5gD4?0q'
.}SB
X (+
a-Qm{
Copyright
M:_G4
set_EnabledCalc
|W$^_
]&/E
<[#G
l9}`
?<*XW
k}
y+*E
z`c?
@/wH3
fE
/ytK
ougBp=
{F#4
c$wN=(~
q%(3)$B
z_$~{cB}F37`',c',z)7;Y`e"
67~/b
Kv9_wgOsWIB:\DoF<[QEp3?%"
DDI*
3hKD9F
ControlStyles
-o.\
/]yP
?!9Is
Marshal
4{}Fi@
Ur7W
dw?3K
p/<hkc{[IAe0~WCJwA<RyhZb
.]7U&
wx3D
JN._g,
YS6DT"
zL^\
-C7]
zv,Z
`YGSt
2<Y<Da%19i@zzR$:S2;4'[kC
|urx3
"!H.V
azQp
+H<o
N7I#
@!o^
he0e-7
Ag;kL
[z]T
rGb
op_Explicit
RuntimeFieldHandle
d;.O
m({(
DuL>
}IDAThC
g-r`6
+j}*
ObjectHandle
}T2H
Jf>X
AQ &
-Uu,
Lv^4<YP
Q0u"a
mscorlib
d4Pwq
yH.:
z{Jv
ZXJX*V
1^-u
r$(,
q5%p
ZXJX*J
Wy@fbQ
EndInvoke
v"ZC
q|ay
TT -
p&`9
;{oZ
Z2%H
t'I-
HVThD
%-
u6c-
Y>{d
_ _9#?
gB'
r k&?
p_e%
_'>!
t%U(
?RM&@H
_N}ut
<"avW
3~=J8|ZPV)v'A8W+HM <s&7v"
(OwON
O'36i3~;@Ez@)EGusBE!$+LZ#
x)p&
|:3B:
PJ#X?knL?L5XP`P7;M]19"~}
+zZwL+
0JG)z
! "}
6Vj?TT=
ohkq]
5* 7
jGnx
8k1coD(qt>(IOykct5Pv5:,;$
nnv
ccz_s(,K;='=H[2$9[vo0S9-!
{D3EV-
g ;t
}>iyu
} p/
set_Alignment
iYu}
+w/b
AssemblyCompanyAttribute
u>nv7K"g8]$,?dB1T/{(v#[m&
Pg>s
+~VB
|SB^8(^3T`IC#M lPsfr` 5+'
o<kSi(
||>b
N?B+
x"gL+
PAuj
RvS}7
-Kc4
1@ev
$V39$+
;>J]U
T,#|;
System.Security
_M.h
\<^L
Enumerable
h4 D
e]",+
>*vm $
s x>
_$J#
A)FHc
>8 Ca&
r~tz};
jEI'
AppDomain
<a=7(ec4!C#,5'lnE5 Dp('B
`]$xH6
5W$~
F^z8-
2JU6AO-fkA",<E1<bOGFENFI3
Vin\-(NvYQt
Z([g
{OYbz5d
cp@s
b~lu
get_CurrentDomain
get_Height
GgD;Sy
uv 1
p= >
$ew`A
y/52%
K|Nc
}\lm
/q'x
F N[
MMc*K
soRn
sS%QZ
Sh-"
6Z@prE
4T#;e
5LpCP
VMM%
Z&-7
&y C
%dZ"*
Ay^^tQL+!![*5oc5CA`Ae\$[#
Bj9t
mT;U
aqFX
DHXn@i
YB>F
T`g%
<P=MgylWr
,tvc
v]0qV
[Z%W
AssemblyTrademarkAttribute
!aA,
Ek]&
qq}r
+j[:q
NLhc
4nWm
R&)?
[ Dr
z6O+
i@l$
nSIz
U0hr
f~!L
EV4C ;
[ ,[
kXN~
QVvzE
r \z
#hx=4
G9GG
%u4G
^-b$[~8_Y+:S@_"e?'y P"Kb
P=dB
l&E>
BQ$six]gV>.
J[&*
"E$F
$O}A
gj6r
2{.e
6U4,
#Blob
Control
%KqlZ%
UALC
GetFunctionPointerForDelegate
tJ_RC@EIbjy>GCf'1jYq'DK|%
GQB
d|HK
)s<^
~\zq
b7*q
OQcw
Vu?>02
Bg}d
TBh
j}UoE
CSBu
UV"O
R.rk
G%wp
tL3N
2DrV>e;N2(pRiSaj*L EWd;8#
L w
O kt#
@C&f`>Q!{X3hj|{ux?PN14DP#
PC+2g+
~6yht]gSyhpVnJ9pAP$c:t44$
+?%W
I%( s
xcY4
`(K.
BindingFlags
R)f`
}YgM
JPv
Type
;F[#
FmHE
syD7
* C7
[0,
hsYI
[}w1[
y^3)e
V5hJ
$^An
gW]E
E%>E{
PHzhk
XHjd
6[yJ
CAg@
]p4z
@|D&'
hFKw
aYca
3Oe&7
|+YM
! KQ
{Aq?+BW|p47]eNb<>!/'<@DB'
8#g[
Cursor
s_qrE/Zo+FV6_V![/gXr</Dk&
Y|a\
dJY[3
N}f6
Bht"
Riq:
}9 s
JvL
0e(bqZF
A\^79
A k/B
,E 8
*{`#
{ah oV
K"~
n]~g
$I_:
Char
5.~+
pwM|
I[u.
>z1^
W$\P
@ U
0RJZ
s/ud]
/v^5
(-=|
ytO[Zmt'oHid6F|f3O{K]9&u!
C,|<
*x,nV{
-gl$
VyH M5V
iIw1%
CH$
~I3B^
GetValue
muv<
wi8<
f@}V
$EsH
brT#7
2}U!
UePR(
"6tp
LwwwOMM
x6),;
get_X
get_Y
:L\S.
\\s
&@v1 Q
!g=9
"`K~
I^)B
oBty
L' k3R
R}"9
ANZV]
VirtualProtectEx
o nN
get_FullyQualifiedName
'pI7
sog\UJ
Y|X9
2oVy$
df=-
beD4K;
JBb'k=B]D*+#L3t+pwq!Q"QZ*
Z<L[
R&QIr#;=^{= #bI99Un11I"\@
+9<)i
b L'
()qp,&cH
R7`EqO%a
.m~A\
p>4&
faL&P-
m^Ad4
SIO|
n:%z
B-4oP=V
Lvsl
a Ui
v_w6bo
tP%*
wfe0
3b3Q
4 q*
Uk,p
,)7)
:*n56Yy"567?}6j$"SjElK6/#
vJ[MB
n $g
9gP='
urNa
O'X9h
/# J
uaIE<
ibla
;dhk
9#B
8LTy
r/EX
?w.{
GEaj
.text
[ f5
/%i\~*MI3V9R8&9:]4dE?v"$&
I\y)!
YCN7|
GetString
hjE[$
.2;.i
>!+,)
_)2,31z
Component
%"/r
?=>Q
)"M`A>Co
d))_
N[a&
-|k
]O{6>
:6c
q"dY
dHhq
[ngv
3|K,.w-g
<Bm ]R
yU`b)Z Y
G %
QqB{b
W9^7Jdh
r{nx
m2HI
ZMTu*
object
el0c
#$"F
rn{e"k
2|
W@"V
C_!u
B+Z
9*;
E0 6
Ckk/^6
fl7NjC:xE>%XuBzz0]|cq4:]'
?0JT
pk/6s!n9NUP[|4(;+M_3|SeZ"
n`)-
g\o*
i<U4
l>\{:g5-tAM\3i*lj2$~?sXf"
aJZn
#0#:+M/
'3IWZw
%9$}
U0;*
MYY24W
R5]7[
|Dwr
Zf=rD[
AwVuruB
(J"HB<
!X% z
?g"a>
Do x
4 IK)
qfB Y
oRD
p, )
L@3a n
h*L~
aZ
$|9J
qp"<
wzN>+p:i"qV09A8!*VK-o5yk#
9uhID
$|$&
FU2id"Ia1D+0Z\+ h 1^k4Q4'
{j;X
431ss
KkiI
+SNRt
~ '
[~kYBb<f04M%SwFa-^"wT_V!%
HkhI}Ns:3
(F/[]
~T#
W0V36KNR9-bNlf3he180eIPt'
\$)X
V<(3
?b1_
&x)^
m~(
-J|T
|p5{T,)q
sA'
u _
/BWDUBH
PdB6
z&x`N
l? [M
UAM,
toUo
`}>:
m9tQ9a?
!8QG
|!&r\v
0t,_NF
dq|!
t\J!b
a;<Ov^%G!y$<L[Am~f>-<(p2!
f ?=E7K^
$)FA
L9biB
MX'+
SOP*U
B?6v
eAQ3
n 4Q
02E=Q
Q>a|
yiY
`.rsrc
V\tbV
Gc51
VWcl
+S?,
]<5l
(Y@[$6bLAgWLyD~pk?SmQ5%C"
w}.s/
wTc-
36!nDq
AiZW
eO_{
eZ(Cq/gP^L&_$+nfM9DJ$kcy&
get_Default
[/4i
lBOY
H-{?
lD}?
~mPD')
e&g
kernel32.dll
Glez
result
xv !
0.C8k
ey;7
Un7L
UO{oNpBH(!5QdRm_&ZR/Ig]:#
Cn!m
/x=rc
x+hE
g-h?
;B],
3(pdh5%/Ig :44cW>A!e2pZJ&
Vw[o
^{fml,d;"'a$I!V3r[8qVufq!
~Ble
NfWTm!\SBI7acmyX DS>v3iw)
%w%l
}ME
CqV
/,Ls
]pPP
4x, g8
Jxem|
Hq>>]
1K9_
GetTypeFromHandle
}>!&
:S^2
I4Yw
H
F>xd
uRk5
Pw05]
CU(g
XScJ
j' -#
W-\oR
/dw-~
$;8_!n
$-Dt
0(H\P TAsVlWhdRU)<V4cO2A#
'#av
_R O
5]xxn
qyyl
5b*#
XN\\
q'2y
|+L
=rfG
g1Ly
$3op5
D6;@<
G[(E
&]T[X4
x'S]x}K^m)P>LIKs%$3rPRhb!
nOvd
p}rW
EBwy
0<o
T%6un*mN5b ;:S|[,!l:_1D<!
eMMW
:<'J
).2n]A
MouseEventArgs
Dc%e
[QiP]
h36]
xDx*?
QEY *G
tI_@
[nu E$
}lP: mF
ET%.
Q f1
`-R\
s's}* ,jM;wL_3,vl]r8-dU:%
=(W(
uK?'!
A cF)
6dV|m
R,{!
54}F[`
`dpr
B;<L'ME
_N
[C&\=D_$=s/T6W?G`1K~b$z'!
lgdj
RKur r
aJ+y
(
@d`v%
mb!9
0eqF
`wPvd'3
<[Bv
\D;D
k;Y{|
*N5M
V_+w*
6ljc
)F4
tOMs
/=Rn
;qR`
wN&G<
0lJPJ
a}y^
Lrx^
AP%%
epCh
P5O=
d@}u%
pw5x
E*\`
JRqE
X@j &
Tw Lwv
,)I,
XJX*V
;q:,
E}Q~-K
[q'WV 2_;,x-nr7+5;(/#nzf
I]?I91
js"D
Write
#;e,
tsxI
OnMouseMove
qw[[.3D
*8'EE\NKIUJ5+_FcK/ju*"4l"
w QNB
w4~ZZk
M# (q|
9-6
P8Rtl
get_Assembly
TuV
PEuQ
uLJ1
tvH
XKen
_l}!
M` k
F5>`s
eKw;Zbd#+
$7:>
K|^v
RaaxG
*UZ
/:yf
%2GMH<
n]o7&MRI')d^0~3A4AVA9B1'&
\S@ gB
m^#L|6H
k=EY
H1K4
n[h
#_VI
saR|
I<c.
6\OT
z _\[
N=nW(d
(gva8}kc4~?;\keUb:]6X0c-!
9\O'k
RN*3:
25[w
o/R
<@|B
/)W]
System.IO
5GN}
WrapNonExceptionThrows
GzcNg
O\Mo/g1c9#,J3DDw3^LJ80Z9
=q96
72i~
\6.S
%7 1
j,eG
/.a[p
FVGX
d;WxLa
@Vf=N|'
&e(A
;k f7
Console
wYe EO
' }BE
[9)z
y9@i
y,--H*1HD26&2;_;cg!o:3w!'
CaDb
yR+\
ku`kd)$ai!QvU830Bra@ &J "
tf:!
B,Gf&euXn'-x7]tZ]K&\3DEI#
qt5_
YFZm
K'v-
\)-(
0|%E`/(
#d2BW
Z\)~
& q0, m
uC7?D=r-6)RHzSy1d%~JXr*u$
sCee=X
Vn*`
IObjectHandle
RSFf#
\iVAQ
LhO_)
0-@Zq
gj*[
=[ q
](4G
UO(-i kLA
IHDR
~^@R
F16:
3Quoi
System.ServiceProcess
-IE)8-
o yC
-RKOtCW7hP'^PLr3EFOL[= m'
6}[L
"0x]K"Oj{:?i:B@_,^N-bYp<!
I{+ev
L*xm
_}YK{+R0`m4|z%2RGo*p>Vu4
sQ=]
y2m|
'*Qq
H+a&
(3{`
-\nR
]D_`!
P.T'
Vbd
L')hn
$|kDOHke&OC\Zad/n(WsMq4G
nfef=
t,F= n
ALzp!
jB/)
y-ZAV\rKIq9t>='B+7Yg!j\K$
sftN9
"%t6u!
eiqk
d".I
L+_Z
System
EventArgs
-2W5C3 'dGb[+8/0HHx- gY1$
u2WLcvh
Kq
5b<~^9I|-xv%qX@p":3tq)`_*
V)/)t
7z&i
>tLN+HNaVt<oA60)9GE"(Z0E#
d/%B
hb^Y!
CvC^
" 34
_ KF
T8T>
Uj|1
W04w
IOIp{
K Uw
'./
qgWS
2-E!
CUf8
~D{:
'.|PE8
;#~GqqYV8~9~+)=pZvf:-wvM!
>W'$
oj@\l
w|qi
#\a8
dReR
`+6xW*
CreateInstance
iRX!
j:cG
DV46\
`}3`7
n6H2@
Vm~E
VqcN
O.1|c
|7kM
.S5#
MethodBase
#Strings
rtGG
f|> `t
}1K)
|/JD
~ !e
M>)y@-LH4?'gW3'ma%!#,R99%
/KLt
ZXM(!
g-)x}(o1WX6?YdXZ)of*F>3A"
N{(8
|4?W
]203,
24z!
3Doa[4[<V$mPg5`v?Vi>+iu=
y?h
1;yq*
N|$ \<
cC9m(8
1Cr'f
!fW2-~Jf\oxdL|pRhV[3:R*k$
zAZ}
) g
Ebm +
~cF)
c%;*,
q'jk
YU~E
Environment
get_EnabledCalc
_or;
I]jN
VirtualProtect
\RGa
<)<^
WtTM
/]&51yc
3'^FY,ju
/PER
7 y:wf!
*kpy
7:1c
W"zM
twHw
v.h
[s0-
8vu$
>zZz
{6XR
8[;P
r19>
lTt-g
P HI}
fNi)
get_EntryPoint
zok|@_
T wTz
Z.Ae
XdYH v
^bJT
-% 7
x~KYL
-X&%
S,Pu[
R!K{
/t*tw
$lER
{lE[k^
J[?V,3
X3;k'2U
|"55O
CW)7
? 9
@6#n
;@3N
GetType
y{L]
PhJl
M#}g
vSW[UEj
Bc)vZG}v:3Pa+]O*uH4;U,>f"
R)c)
add_AssemblyResolve
J[zR
;5h4t
bh((5
w~ /
i"6O
IDAThC
>"0[e)n
.j!GLF
,CUC
|2gQ
d:}n
tmm3
[ 1E
QGDC
s?ER
set_OverIndex
YBJb
ga @B&L)
$p$~+"*3,){zg"=q"50C?C7J$
h yM
lWn?D
?zKC
N/Ub_
6)e(
:yZi
:iebpGp?dkWHYD w%[cRBAR+
*0by@
#X}d
/~_R_0
eb!F
%&3t
N{Bd
v3b&m
ez7h
~H-C
,jtb!Z[/d
ImFSQ;
TabControl
1SW}
L0a.
mX1`{OO\|U't^aU3u$$A>cAX#
HMiusH^pO+eh# "e*g$JMg+/'
k:S,>R*6-fO* QB=4y#cGWbL'
<O/@
~)6v
6g%?
ohG}`59
."@[
IeC"r1
jTzu18U1mU&?R&9Zb*EP@'zH)
MwwwOo
LJn{
4(F^
N(3Z]
<"No
=)%%
~IDAThC
@|h"ZL~3z55(S4q;V(l`aW=y'
L dW~
/h1>
i[#)3Qwud20KP<U1l(Vv5/5-%
.ncL
o`u5
Color
FY"EO
#'Gt@j
F]n>r
^a Lg9
Intern
W ^i
}}~v2
System.Collections.Generic
)]6cp
frYv
\2+5
>:0h
N#. E
P{ql0j
set_BackColor
+tqXu
ufi1'
QUpN
8ycy
!fCM
t f
get_UTF8
o!w
get_Width
4{FG
+q [?]
Puq_}
J"N)=F?a-E;i!3\G=HqYHJ85"
kIG`<
9wU`
m y2B
XGsZ&8<r[Vx'U=Fq4{AB,""%)
ZX {`
|[i@X#MEGJ[bi#P}\Hy>S2B{%
-[ST1`
|+lf
YgxB
8+XD
Kro1
get_Revision
3,t<
s5*3
J,C#$
yQy"7`
+~Ar
'_D-O
D6q]
F:f(
Ahmc0WeWW{Z(Kqg r$&}yxM;"
Qv_3
:p(cz!
6yzl
K EI
O/XS
7}%L
o*Ws
i&NMN
= n%
u7[#
.Wms
Q!#!
r=Rf
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
5?9d
6#oz}Hp
%H"#
i ^x
3MH
OI&'
qwA
=H{I<
j-K?
fh d
p'Vv
u$K"SKQc\Op8EaA&{:ZHKOT"!
x">4
LY1&
x0Tb
);W]
+ 2`(d
F\r2
?%[BC
K<Pkm
! :[0
sR"6 /
p'5I
&S^N!o|4^A:'N*\ Miro|70`"
TkTw
!` I
JewiYv
>g*C
ixe
gf]g
L5+]
p<.(
wSE
Ahv
y<CO
TId ?.
Uj<d
#Wml
U)Lhc
wtRE
y) q.
H/}(
wkyw
BblMS
fYCj
@cJ0I)
~4#q'u&)j\NJ(l%-,Qc5jrB,(
&2!Zi\'
m?[/
GP/z
KR$E
System.Core
8zcA
wb?F
5zB>$-M9JQ"9a)7D>NYlZ2Y*)
f*0o'
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
L[Y!
-T+8
:Rel
g[D ?
?Td_YX:oKmt3L/p#rz?Z=@;B!
uB?'G&~pnC0:O*Wk)4%YJ4<,+
gz!k(\
;#zw
_I;
m%N%
c ED
ozZb
iS|W
S0;ola
p>.M
tfW `
/R Q
jR50
K%K
Vb1;yH
(Wk{0
!{PtN
w0XtqR@t#Ra+!|u"n[~0;$`L"
`cB[
^Miy
a@\d
X +4(+
5Y=6
^t~\)}
6?r
g x7
uDdf$9)r
;\'GkZ
L~p9
0 i
8[(^
%V 3
M@O$
aTU9
R!Jx
!RpLKJ+3gtP-gv$AYS2Fb"Nn(
9[m&
ModuleHandle
^VG:
u{7.9G~
YAm}2
H7Oorj;9"p`yH[wH*mqrI==o
8MFI
hdp7
L8j+2
*:Hh
IXPi
i e5dm
.-,d=?
)1yZ
,{P/
gz*Wq
b:I=
{IDAThC
Z0LV{M~fu](]&0XZ3M8k,4/,'
k* Z]
S'ww
$m,[Y
g` *
,T
{Eo0O
tbxx
wZj@q
'0?O
>dq<2
J[X@
g}y$
biW 5
UH{?BNz^pI`NUU?*0<\x4?4o&
>\(
dq/%
927^
Ky#
7Ub0
=a[A
!)$xn Qz_Vg;tL]jxZtUH0C,#
xk(i
,A+q5Gr
~Z
MSWqm
J] !R
set_DoubleBuffered
R3`U
rdu0
(GR,
/i;F
ic|y
s2Put
oX<)
R-R(
>O,:%%%6Q[n*aYY\qG,al9-!"
eyz%s
PZ @$
>ovn
g_q_rF0fKi6@<{@6R6 ^q++}&
myeqv5)yC>ub ES3@J55FUir"
fqzo\`zYs4Q+`2%`n2Jp^L[S
x8[Q
', V4
z jK|
i/$jZr
^*ilP
`BL5>uw5Rhi58B+O!1zF_1R*%
a?+|
0$=6r
7i}F
[2W4
Contains
(:WJb
4*R9
AU,3}
<[*"
vjy;c
:+^`c8X'R;ZDI4TR*WST$']&"
c&9!
4n$I
<3;Ef*-i#sl0!l,]!=&>t0W}#
_I|m
ValueType
I]?]
E6ENe
cS7)
GuidAttribute
467W
4A(99ON<JPj:+4?F<[')zEid$
i~3+ E
,gO@
OLYTw$j^iI>#OB7*'0{w=&(]#
i6&a(
7K x
;$iD\E#"4L|iNp|#(YAMSL3k
}/
P=X|
X>WNbs
(ISC
x i1$7
%I36mQT2K]p+~+9>JUs@]IXT#
\Mqg
wACX
5j(r
ru8#
get_Count
s.:.X!;
:v8O
* PJ
=y M
% U h z
BOY'W<YARBw~my%SVxV#o^:M"
;g4A
jz|y
~ jD
mg]q8
oD<@
U {=
VVr]
trx?
3SUR
h4V*
|8b$s
Oyy1
rNzi
>vs+
hlJY
&Y ]
?>](z
@3Y&Cg^
a1S-
]t~F
X/b[W
sh4$|
95_Y
fTR4
5o!E
gN'<R
Y5Y9
wl B,j'5
}%e+
_Ao<8
G[1y
l$n
y`{+
c?bs
Q?`k
f^b[
a?%p
$R6
HxUp
*E4
p\a%
JH87
Jt,
8XR3
( iFHwN
=tkTy?
,h+B
\(7Mx=m
yw3
LR
UInt32
J?XK
FUTr
swO
@|#rd
Xn<d)
KM+N
T"YL^"wKX&JX0B;w^|Pn3E%e"
get_Version
UtNB
Q9{f
a8hu?
?9.
C h{
s.\;
#H
)oA
2 . U
TG,U
yr<E
4{7$
7]iwG6*p-Qd9xTGrW@wt\d@k'
T=A~
[N}I
o2\jp
(}?<
B/. \;
Cursors
+x6$
Sh B
_~AB
.L R
o8Pk
Ai,1
B@j@x
Gf!+
LHK
8YGr
ServiceBase
Q!ijr
zV<sk
>}) 9
Y`"`XY
!7"5Hv+
z\w}
,YKM
R^\
q;+P
%A@X
UVI7
P#z%
JDJI{s
</P{*
$;M0
DbN/]
6<LT2d
s0J#
sVV>]
iiG
^1G
,!0zJ
I<bN_
HF[w%
%F_
i7;f
rWTW3
u12k`9GUx~Du:qFr2'q4"|F('
kw-#j&:U4O(I3:6$rw2E^^0K(
fj/w
DT qr
SNS.
::ow
n[ym
AssemblyTitleAttribute
H|)Bo
igc/
y"k[
>%I*
!0x)
q BK
/{}Ud
(|z~,:g]zmoJ8ZynL~[!`p5y&
*5+F
MA/K}
e)ZC
&.8Rg
uX#G
a/MZ
=GI)
-+|K
7xH1
SI-Z
V1.5^
o%NK
PKtCO
-/|8
Uk f
DyvM
5n ;
'}V[
<w_~
MEq!kl
TnT^
J8 gm
qf]<
#fOQ-a
y91Q
kB? >
S C
/Y&L
jXx]
krx\k".
)LoP
Ww;QN
2\I
7(5yDG=
Cou og
:9OK
"$)u<
["8t?
eKqxu{
5^`:
W\-n
R+6{
,aAS5Y&`To_`(uV!^`z7j"a>$
>L"g
(Jbi
`1nztA||
`yZ1j
fgZlg
\ UN
Xk?
;7q\/
Hvdy
3`i
S\3BX
Data
xgAA
z=/>Ll
k0}Q&Iy2;<yw_zIQv!wfc/QV$
aY$^
;!(sr
1xDhx
0 xLO
jd){
fPi/4[
Enabled
yR u
G> (
K2c=L
Z;_ C
z'k#l?5
`sc
"qgw
ksd|Tn
fSq
E]=B:1tNzYyp-,+4PT5RhT8k"
HsGL
U:Wo O0
7*rP ;
Kg%(=
UFX}
m8ZP
c>\d
Z~ 1
-e;><w
N E:8
3z%;zBb]6q i/Qh<636'J;=L0
vCs?B
H2ZC
t_S7hZc"V-H[qMwX}~AOh1pM!
SLH|
pHYs
.ctor
6w'?
&dJh
VPc
LR%'
y6@6
d0{0
!AuF
get_SelectedIndex
AL+`-
IPEW%-U
(Q[<E
get_Message
Container
w?4m
b$B$
K/Kp
b<@
j_mMa
Uq$ /
Ef n+
7pF
BEfQ
Main
emeq
c>#@Gh
}(/"E\b<_x
nswWp4qKtwr3kbBLl]RB%]A=#
]- #Q
nEx=
Invoke
X[t
zp o
ZXJX*
2m:y}
xfB"
A_:8
VL .c
u_Eq
K-&m?
37g}
(ZF$
'p>"6I<4%n3&iWK)~,cbyO!*(
X@ 0
E?s(
ES>NR
}s_l
Y?0
\P(
5a,
FMoCY
F'Lm4>H*M !38@M#"A$\&8{yK
c+|e
q@P;t%W'
2(9h
|Cxs
v AR|"A=*>m+zV|&tY=6M%<>%
rUFF
dR'4
H}Bk
~t4"
"D|^
[aZ1
!bPQ
w9Kt
Module
&XJ(P6
a9z{;
Y2R]
^bjF1
C-6|
xshW
Array
jm^
O"KL>
-! 0
!,IC
j!:
HBOM
H #76
@.reloc
ZQ8d
$&G cq
of$9
)oc~o
o[ra\}
B KW
o+|v
'b{fE,
czE-
aD,-
x!41R
F< 6oU
'Tghk6xV7idn+s#@(wZ%NY5/!
VuGlhow
q.4L-
x"_KJ^`WT>&G8W`/P`I-{1wO!
TYCG
N kt
%vxcxp~
=erM
Q2S
~U H/
\9|pu
TabSizeMode
vC-l{*~]u/YC,h\j]AOG7R[M#
[8'
Byte
get_Chars
<b0i{<~T
G3>!
wLR|
v7ox[
LVLM
#/SN
V2ZrkZtXK!}M"/htfRS MJXQ$
cp]XN
ubzV=n
I_SJ
Av`m
_<~=.
#Ws@HepTC'RaR9z_,Gv~^R~m!
~xHkg0
%m_'f
)y<lGY
u"N0
v05h
rd@n
6l&1 0
o;qV
QgTo
D'b`
L6Wj
cx')$
o\V
lg#8
N*e
)(~,
)+.^
+0/p
suH"
&eK e
u8*
j OF
f#U4x7y
r(Fh}p
h!5.
LV(/
@{ptr
VF;i"
_at
9 (<
{#FM
<0r"
.B@U
<WAVl>sH59~{gNWcV[}HSoSw!
Zqf2r
(<(7
^xX^
!Nl'
jitt
0g>
M,wZk
Se v
get_Location
iz X
frd:9[
XB|L
9P//
!XK^
fMVL
9["tHv
|x%
(,2.
5%=)n]
8EX ?`
?a/pE
!'qv
iS'N;
qgv3
c;+U
Wm7b
~T|
kVK
+1m
yZ~;c
VAi}
FreeHGlobal
V c84
L#A/
25Kz
ops/H
CRO
{e]C>E:]@xz7<}3A?qSsUkg#
1t:4
nw.2q
WV9u
qg`O5n
ZQMt
~y@#
}G$b9%
3k@!
]Wl.
ApQ<rcQ
o2!'FCCO u-LD&,HB#lsU0`'+
D?+Y
L}?o
WF>Y
+OiY
yf1>P
Y,535WC
>Oc%
_%bm/$
k|27o
$MX}b
m84 s
l2rgH
)?RI
+ka<
H-R
~C\q
RuntimeCompatibilityAttribute
"7*4`1g
Il:uQNwe
[N*w
7 r(
q: cH
+R(+
9VK-
e-Aq
.eNx-
8:cz=3
Assembly
ix?44
xcdL
Be!0
^hd<
;=`*' *
.i>r
x5|]e
~.5*
N`Vj
mf">
"*6I
&.zr
ew&
nXwsk
XORQ
x qR
UVJK;#n
9R]W-!(g
-^n,/&924?B:|\R'L)g1v3Ui5
gI~|/
^3:
u [&
1NB6
whZc
}=N'
w6C
lL"K<
q|s6LG
^e$U
z v(
Invalidate
]=!{
`*."
o vL
`m/y
%K\2
g=xu
twwN
*f I{
(Z\}
[r]e
h j
Kvue
K1FYpF
4&[n
~dEBIe5:p5):crTI19 CaN17#
MVwQ
8x[?
]$l`
lVz1F
Size
m3&A
{mp.
.gf1
NewGuid
^lz& P=%MZ8`&&j%>dF_&F uB
l]#q
V49x
4v O
tF@ONL
set_AutoScaleMode
~q1m
dW54Vg
yL|</9}
oMx7no
thzUS
{ ``,.X|
Ri7
Nx_V
[;|Y2
G/yl
c_8e
'>&%
&rVly
Ww'`
mFOY
CzY])"
MMkAA
\<eS
N< T
`3bQ
X&|
)`$Xk
-&Q=Sx
.}0%f
_O7
0RW:
)u aw
&a+)
l^yqo
&O\?h:AK_1Kv/-N /!W=z E<&
)Wr+cgSVCb3,/`Auv,W`C,{,
ftA2
`I]+
0jsU,>mC/#_0JCH"R8jd-RXe$
PvE#
bK:/h
H{6~
#BK2
Adr-
CFt#
/k^m
7ldHG+J#J&jTLMBa>uP7XoNO"
Y -r
Gb%3,
/-e{x[qT$UT[ xkw1(joy00a&
2I6ft
rn8en
'Y3^
/AB>
!Otz;
"qo:
4Yw!
0#up$^tE+~'J"USN>nFJJFO|(
@4wt^
teF2,/
?RWL
6JSJ9;>hn0%s-h{E;KQ@Yk(A%
58M'
+^0O
: _b
":6r
O"sM
Xcee
uby:J{~=K%;g;1<A>9@SNkOx
X `
F Ck
Z(1
!A g
_["bEa
>~Rlics7[(/3Eeid(}UPdI<;$
uR_S
2/m}+
yC=l
1wj
B J\
2Oy<
~di}
x^9%
s}U'
Le[9i[
v3B!
BorU`/p
Z/[K#16Z[ 5FA`-,T&R7/)c3%
@s*i9
neF $\$
:|q3w
]3j9
7?9#
F,*Srl
get_OverIndex
'iit
0_`k
{-`F4
0Zm-%
OD"uq
/zXjA*O$f6EK#I<&?Q$piZQz'
t3Ra
MLM3
Rq~){[
H#Hw
!/^
5Ivk/
`Fat|
DEs^(
\0HHhk
FzdHW
t'tm
W|Q
k ihK
jn%T
JYd,P
$!Y>;
%9(O
s2{39
)@E"
QI\0fX/@!mJRg&eP"^V{~I3w
CG|G
QW(
nCx)
IqX3
ContainerControl
j]/.
zJnGvR*
.:irT!
H<a,
g<o`%
?%|s
c5d;
n ^O
9 K
?tV|
>44op
gQT }Y
Vq=E
a\7>
ZUL#
qjmg
ReadByte
pZK P
v&U9
u{o&T$d
e"6O
n=}e 7N
uZU0
.yfcPc
?5Ny
( h~
!?U!u&^>$*4UP>dOD1FY,)Nd(
aIBr
HGyk
1+Pi
3F1764884A245F1B3FA91DEC2E25339F23787561
ISltv
LSG1
tY){
<:b~T
neYl
qn_s\XQ~51~kN,#AW7+6m,&O$
Zx}
S4_u
+@w|Ij&C$f|cscgzpY45N*+Q#
B_Zi
MZX5
*,0
s VG
AllocHGlobal
n4Nq
\xaiQ=}&;+*@>ZB%99un0UAg#
}R4;
!I:g
kHG`
AssemblyCopyrightAttribute
WnrjF0f`$#)#`bbY_Wp{ky9o
cnzU8
(kKd
-{Z\0
u:"2.
o/e1
S L%u
?KCtm2U]*6U?o|`-8h6jY2_($
tOv?qM/PbW,EikC9>i}=x`fD
Os||
$V"%
|L|~
Dod"
Lavg
?*fI/
|FA#<
1km$!~&cA
x9O=
zffn
*!nbe
W|D
,sJC=*Jhm`L(@\ 8tur1by 0$
Y[dn
He i
fa8qP
mu9g
bvrijQv
20r
S!A|
y.l@jQ
(Bv3Q
my`0qA
]|NX
v L$`
k{/5
][~3
Cr<(
cb&%
D-i,
aq*
6-A4
S Om
9Ix<
Y 3-
# mS=
}$z5>vsY\3c+J;PUoSAwHjd@
sx@g>1
R0^l
;oma
?"`~
op_Equality
dJq\
FWu{h
E"F
:AY^YvA@2f(B9O%AAM=,ek}O!
]c1=3
_.=1
X^iMdMz
p;6?
2h[,
6=Qp
F c
]2 xks
KUs.
[T$r)
fgw|
HDa+
rCP2P
"M[8
sHmm
e&xS
1pVN
SL ^H
u0L>
u5);
gK
ControlEventArgs
j{ J
+C#%pN
r2)
'/jr[
6xru
/&biD
$VYZ;B8X
r:/H<:
01yzcv
{r-QGLpA7P-&]= EXHyltrun$
GR6K
)oJ5
`f{U1-EPKJf4@r*#@N+0Z9"b'
5; =
lGrl
01qT{
set_Enabled
+c"H9%
sPs#
GpC
F:BM
Rean
8od4
?* &
Read
i[q]
W4\n
w .!7Gf
W/|r
?IrO&D^:JDGT]\Th(:cAA6~
l}UM
&je`
{Opn
IConvertible
FI$g
> $5vG
Km0p^)
%{?XwGb(~?)kW160opjLq;7h"
zRjh
uVuy$2wn?}F5ZPT/wKYHV3lS"
})`
[ q,
DG=6*
get_Value
$/;
"*7r
u$(6b
6l7+
wef%
(vC:\
*sqE rK{
(~K/
r&, [
;isn>
py s
s_uM
{HQ'u
5~\Y
v_^mF7
I?}_
-N|+-
DGV2
Hkwz!
.GJv
gAMA
93014fcb-1cdf-6f.Resources.resources
W?k~U
6\i|6V
qywb
`?-k
K$6%+
D^9z
]$<<
&,&x~d
%%}:
8fb !
AutoScaleMode
`eg2
{'e
28xkm]wrM,4n|(DP$f7m8E2Z#
YXZEP
x#LF'x
xm#C
PLz:^
~h_Dn
MarshalByRefObject
=Vsh
cI!&
,6d p
t`YX
gD
.cctor
s@c8c
AsyncCallback
9z1k
J{ B
y\}!
D:f&
zLj}
\;Y
b%"4
.f$EX
!qIM
v.Y !
:vI0
_%Z*
M=Y?
$u&#h
9= h
,LT,
:O+{sB
TBhNf
.p[Ku
gbdXY0
&3SFh
wVJm
= Jk
1^r
qG1%
$JIIN
get_TabPages
<f p b
'LiBo
mEFN~
yub?)
X [?
l2a"
\EDS
|k3y
]P*CFL8!\U6jN8WK}tn#fF$Q$
ick\`
Guid
{o[+
w!F]q/
yU(t
ER;H
9 6
@d\@~
HA)n
a&fnLR
3Ulaa
9Kp?y
5aLe>
FLY4$
Aw4&
2}Yrv
!g;?
p/M]
S\ 0
d3Oh~
<M)^
System.Reflection
DVQ?V>|
Va.9
[3?L9
0FE:
E|wM}
`myX)<R'W2"5F)QsdbMvW!k_,
v[Fq
5e8u
RuntimeTypeHandle
=/y.
po@I
5QTHv
Q:yB
'6
Up6PZ
M\/'u
%CW5
~R `
/f6@&
<jca
,<7#N`L[@89JUR]>Y@em}I"n%
j1>n
0+#$
O5=L
uxU<
ZX1|s
2H>2
0aYt
~'?\
F* =
`I/
sender
,<#h8
)$f,u
u;l&4=
.dm[
n@[wJ
8tI"
oiaPR
]d:=
\L2
) Y}
l!>H
Append
reVi
^wBD
-}L}Q
*I5To
zlLS
[$s
08bD
^v&-
5&M&
!xGW
k&'47ZFpsHE5le! <:{,x]R6'
im}br%,80*"x)@Y\0c`u\!m+#
PBBm
X2D=Z
Dzq$
s\dC&
m$%<
RJG<7
E)D
M Q
f c>
ZQ h
5,tdqj
mmzc
/ S@B
b05x^#B
}c(`
xMUE
6H8&
4 B
,R2yR1G:0e`[1"K"(Rl%;oKD"
^NWp
dd<H:r
oecb
t+w]}
,^\H
&pZ
Y:HXrqFgYaQY\!{lCL&~Qbhh"
>+c
Gu17
AssemblyDescriptionAttribute
{wRiu
4O?8<
^j{.
K1Zsxt|W
C4]M
"*i,
e6;VG
%L3 g'-S
MI+5
?9u
)yf[!
,6q&
3d (
9gj+_
C7yC?-
kx\~
OgF.
D0OTN
FF8m
|qyN
.Kd{E
)b+YN
O>HF
WH*R
z'61
( P:vq
0[,b<
yr\v
b*Ym{a
e0mW
n!0h
|oeA
KFP
Vn!j
C!+>W8
-1c@
l}3`
e\A
d]kb
U'eYP
t'??
OfWqo
W3<c:
.e+o96&
)z\c(
p- m
i*?:
M[29
sNx/Z
j8j)
\X0
0bR"
8 >2
M~%9l
Jb^qcF
FLKZ
MZuY{?N
)I ?
VH6
TSP
Vti#v
z\K/L3bW<{
~"T
'Tn
@ap]
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
K?Fz.
-|URn2
]&n|
IQgGQi
@ f@
_.c8
-MQ{
/WWY
Q]\&~
*%(w
\yI3
R5J]
qR P
NZB#
~zRQU
\}Kr
lz7',
mscoree.dll
!This program cannot be run in DOS mode. $
bSXd2J
callback
Xx:H
ndqF
b0Cr#
%{_Z
de=13
;yx_
#.,HQR
^*3 $nU
Pu[H'
5 ]EO
gK"O
fDk
rcu2i&R
h` W
=F.GT
\E3@
Pc/#/
KOl}
Dispose
3K~O-
rz y
OP%>F
8:tx<
g%7c
R+V^
K `D
<wVh
fa8X
kVZC/
{*rJ
4E2BE99140D24066CADC84F74FA899FEE5976B68
HFe~
5|<HO
e#cUW
TjLy
,h&c,HrI2k&"u jV6iO+s$p",
eu^
25"uL6h8,R##:3@ZM`dZ+o]f%
Ta?B
oIvh
J]50 *
F a^'
b8A\
gF&C`wSrc(;^SXn n&z4jPC1"
jy38l
:^tm
nAyA
2hoU*
i./I{
t2%M8\+bR!N1DAAG{tGw_:7D%
FA0FD$
^@eP
[)aVk}
P [Z
NJ!e
= ]#
y^@=
xZmmGq:g, :JqvRL<\"L'E8q#
x!sl%3&vo_M{SEyK'Al;E@E8!
~(a[O
I^ k
o`9T
6(}\zB
cR|vgV7nyi9V#@a}!f5=-%%5!
`0M
9|puS
X_tP8g
p,t:]
iz>D
@SI
)TCt`
Ju1]*()'M[<F}7`:/{~MXI|p(
%v\u?
g;NV1r<h@D[AL7-_(| 7Gy[B#
kFvz,t[_t^40mSJVL-):15f%
.h#K
cuHSR
KNdu,
suCRU
X=t\
sb=)
mRNAy
e-`a
.oZW
v'MO
7@=<
N{o"h
N<q
9jrg
p/>n
48+F$
|&dk|2G9JpRj5%5BfUl0d-c|!
BSJB
Wh<.
yz%zU,
NVn,HV;nL#B1,!B_,ff}^K=s'
PxAg&@
wjAsv^
+ BI
a 1i5
=c;v
2qxcb#BoR)L3}NE@^kbi/\j+%
?][_
v4p~
\gl+
IContainer
:qW.'
N!4M
.RAX;
)RJl
&<b k
4q"i
lLF>dU
-6v/
get_ModuleHandle
[rOp
y#8QFS"
m2lI!8sCl](8F'"m^Nxx"Ts>$
f:$$?_^
`t#1` 5
?+< #
H}'ju"CI]-{03>:+(i$G!7Z'"
)6_w
-x29d
.zr<
S8g y
IntPtr
v1$QqI
h5]
{vz,M
O>Ex
c']3 s
wZEfsxeO:rai;VTTODo_`~#9
J:B?
B 13
<x_2{
%85n
pgxh
o+u,
Vte&
|!$''
Bdh/
U~&7H
Zpo2IX6Jvj2QHvp+kE6]V>cc!
wlH5
#7};
M(lL
zm.s
zwK ^
0r{@
bwHV?5@S9hTa?@xJA@LgG_{J!
?<TV
j;@q
[0Y3
;Z|fW
x4^L1w
f1cpE?eXgO'*G$2'&W66nMl<2
@DtnnC
#a7
System.Linq
Um5o
2DgF
? RY
C708234F139063BBE3CBE2208BB6ACFACBC50333
9"-9!
Bmc|}
lm%j
InvalidOperationException
g~w}
:'oz
qqd[
mP`L
b Ysk
&"BT
j]ys
] |(
XA{i
)hqHlxT4J
f#6
ZnYO
{!jY
uh>A
hgV:
'a[Ko
fw1%^m
kWGn
S Nv
. g,1
M {%
4Br`y
WEJ/
2-p0
wY"~
}z0x
kA+~
%ou&
X{fD.
BlockCopy
E"cpVIyUrQ &vjD*C>kHB!>O)
=Lc5
yr&
ayEo
ndW>
A XF
[R=-
%mg>
u1(x
!?"jr
GRHL
"(b?
^JZ^
`l84^>.
|DSGkIh
Axd~/
[uL
u)(6
KJ_m
x;HC@
Zp>q
K=x=
I_kqw
ta=e
+1eFN
NGoviF
cI I
P*N
<;c!
W 'nF
G3h=
k !1%vS aO
T}SM
Lcc;FHS
"KR8N
2ak rKU
x)=`
Yu}Pq:0%wK~P32^sbw/b)uDI!
>|%mnN _
zQ E
,x#a1f1
CwHt
g "k
hAZ&H#9B
yNv
< yRD
8^"?S%1\<=/$jlR1+$9\yq,~-
3n'9@:@hX:)-q/^_D|]iWD}k&
<IgC
)dW/"
j8E?
#& &C
; Z*
@'X;
-d8#
j0};
YJ *H]oS
(#/Z
Ni_];
<#7l
!Il,
uEMi'
# v]
JN\I
"r~P6Q
"c8{1d(Q
20]HT
!m0'.
A^!w
k= m
][1U
)W3A?
RM;-
:Bz]qre
MethodInfo
UOq=
w#|(jL+eUMpHZ*aAAmfj*23$"
PA},
k7(<
T 15{&
Q!WL
CompilationRelaxationsAttribute
oOdj
TwIC
VD'/
|a[]
$=$+8
TabPageCollection
gHP)
W-rg
|5J
\rdF
}/6UN
MemoryStream
-;1A
-\M[+X
[ 9'.
'^xjW
ResolveEventArgs
7#G 1
rg[K
esM,i
S*9]f-0w%d04I~JyVxv8-q,o$
D5 I*
lZ+K
sNwr
`qu5
`"g oD
-(>;
9idE
F56D a
OnControlAdded
L7.p
=bz>
%_lp
%q/+3
V]WCS
Q4u w
0M@l1^
,dE< Rk
a`Qmrf
yx9
+{lR
'-Se
zZ.
_f }
-f
e*7's
X ]/
w V
'JkX/
2P<g
4|?RR[HUUJ8<~m3+~j xV6n1!
foM)N`g/wqBjpo_k;,Fkc50
>o{f
QF|@sPKDqgT!<@V6K+`&Q:9N*
Ge@
3'@
Q}v v
k_|Ja>R;A6FVZ"aqrZXqY[B5#
RM=Z
8;zv
IEND
U@N1C
.&}&
#1|{4D
!^za
F4gx
/^5'
)QKMP
1+jH
g~Ov:
k4g|
9v jK
es
W_.x
iYZT{
|*u i
zcy]3
$}om
<y~)
qv,r\
sjc7bP
Q$w%}W
#)|#
)}b?=
2%: h
]nq2
gKto9
$=1~
':`:]eF2"3!6_6r*x8nxe73^$
EBl`FKHo ldS5rL&LeI;Xl>4&
XB~,
#d~N
Lkp
r~8O
N3

:q`b
(#`D
Mutation
7Zx(
bM!=
I"}9UET^UpSB!)#:%9=+:A~5%
Ijs!_
~?~d$1gcX`k@B,S4s\"?i4Mr#
Xcv%3$F^J8Q%#)[4XMd)/8gP
nr0Q
Rectangle
-$2#qyA
2+}9
p+8n
20O
get_White
_.=B"
eFh1uW`Fs{[CGt)jh9UeQr=Y
fy@W
2IZe
+ '27=
28Z6
u?K(`qfc
Concat
7+>O
g,,}Z
8>QT
h 2CE
X5zq
j%z*c'
sF6*bg
StringBuilder
9t56
kOL=
vrS<
PI*U
u_YzR
K~w,
x .?
n$ OM
lBC'%l
.S#^
Stream
cuy_
oY x+
= S>$
s#$u
7 }Qn0
~Q .
j6)$
/]Aa
AO6iX~
s|d+"
WXs
PU%|YB U(x/6p&#aST3s(9M''
get_Hand
{ !sZ
]7}U
XX'fVr-
tjcN*/n'*|kq;@3_,G~16(s1+
p9mL
`sdX
2k-jB3a
J;Ix
N/-
B9Kv
BF\d
JaH|
/a }
H?+p
7tu
'fm,wX
a]=
=6:u
)e7 th7t7vnRHtE1LDH;XnV?#
0+weWL
d S~N
K CT
<6MU
KbF+
.:'g#
h$I7
G7N~
$S:6
ae6$
atH
=Yxx
wsSZ4Y
L6sV
eqj$
+|?m
JE,:2Tr
.!HMY
O*~r
7h q
)~Xz
GX qfTX-q7EK64<TM?vM@`M0&
k"\t
Vl7
gTvG-
0`H
AssemblyFileVersionAttribute
bJ<*
;eDS w]
System.Text
1g*X60`Kee>sNYbVfQU(x48'#
N3V1
:K`'
i#+}
OQ r[
J#!HI
G! [
!JPJ2
0?|>Z
#iVb
Kin^*
:}5|
Y u#
$G}P
>Bnw
+#b3
*g"S@vN4%U8/ Zhl*iur-KS)#
3k{~
bB`y|
>A;R2
fVq&
Q &.
`, CP^
/H'@
Lk{l
}>Y|
]Fv4
V2 Q
O"+xY_q6zZq
C@l
,8F%YN
J3-s
GetElementType
NL*
#1d
.:Z.l"
GOK4I9^hjYn!x?dS0f+]Tr2;&
\zi_>
rQ9D
4|NcXBPpd6C?AYt:Luv'*BO/!
(+
f#2A&t~
XO(R
stww
3Sm
g'AA~
-p8y
*3y2
$2Ax
dFr=
7Fmz
agg7&9
]aSv_
~S $
C?n,d
y }$
{Ur
<N:l2?
q0/g9
h,nK
V6oY
jQS[
wN.38
qv.|"S
-|aGk
+/6}
q,aG2Nt{_9RTv}<#=:zyg78?'
TCn;u
AIXF
1An4
Rl~F
FcE%
aYoeMm
[UI\
o3X H1
B@cL
/bITn#$D(cM$b_u>dQhDOlc6&
6x6r
"7BH
-n{$
#u_0UdEqOy?+w}YZaUQKd4r\
.~+G
fx@8
sn*m)Vg
9_>
lh>^i
3wx8
yUB@
y*=7
4-q_
!-)H7
D*>R
(!;
FieldInfo
Font
T,'c
RAKq
SrN6t
^L'P:
jYWf
p/Cy
Zi~l
0
?MGb=
7:CP
(r, ^
i:<Na2\
mJ9H
}dAw
0[[
y C5
!r)k
Tog|
sN?I
,-a.
String
eA?*
Qv)j
|#9L=Re6@>+HR7~7>cbl\Y82"
_CorExeMain
hH%{=Y
]sf"k~?TBf42ALLh">Y{?(Yc*
NW66
TZe
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
b{IZ
$l3)
{G]f
_ n^e`I
::mK
kZ ETu
+J2\.
btZ3xT
1\?0uu
/-(7~TAe]vk")[)k?<KH^{MS!
fYgU9
3L$\
A(%4(9YckXe%=c<RdBU#J3NB)
jD;ma?yZ2W"=[ulN_3?2LJi\&
Df[y
*FB+.
|( #`i
w;nB
InitializeArray
r:Th
Z]/O=
a@NWFW)z*mxT>5d5d=:*te:Z$
% r2
."<*
4O Hh
=U$$
E|UMV
4]h;B
)0(w+
{dPg
0~&5
Kl =s=H
UhOl
KeyI0
$"~>
B6)T
i+.K
jIZC_
ToArray
mp@c%
XDOD
OnCreateControl
*-4.#Q&
FF)p
%=d +QT$eTh3VaIg!p9s]vtG$
wP"
P&!>
_*c@
,Q0~
RL?X
d6YB
Ya/l]
+HNW%(xHgrHe@5&JhH;)^mDH%
\]jj
MKut
tNnUuF
MHAQ
U0`k
bWt#,
1Slm
}{pz(@v<P{'w;lMUv}Zm(Tb^$
,V8gj
St6D
("c6
TO/P
get_Hovering
0%JR`YhD gg?dA)dF7L~lgb;%
kaoe%
h~x &
]\\'H
88GncnJ
]&\Pr
;e~I
u`K5G hS
y3 A
N4 e/
#? m
4U9(
=]oY0
y[~ 4|
$dVzj8T=el
+* h
W@xR2
id|i
t)l3@/Aa]#-V \lX"jUky#gN,
`jV;u
^>JT4[
_0+:
1ccj
Load
{|a.s1
Ryti
-< ui
&=@X9F<GJxboQvJ}w8(G;2Z&!
^k8)
d5W
GePk
System.Drawing
NwM~
"g2a
' `8R
UmR|
sut;'
J+TY
get_FullName
>&L-BH-kME%_573y`wX~*VW"+
AZ~a
J?uqq
x^D2
Zvyq
OIv
D7|+
dzF78
f#9;:bILDy3%?2nc&YOEJVqX-
pFI#
;X5
[#:Q
Q{hg}#DU
BeginInvoke
2VP!
NdwD
ppmhs
og+k@
> `^Ky
O.a
z]Xo
GO64v
xaDH
X@cE
Ef{x_
S?e?
l18=HyOl4zF%k_Q\_q8r:i7T!
lK$k
IIEg
FB
}]R}
)*|>
&DTb\UgKwv ;(dQ+tRqg9]>@!
d?nA
f At
i1z*
Y,lL
-Z-n
cw{
@QW.
''Kt
}/q&
P[>A&=
CDdK=x
Y16V{5
j.v|n
>M-,&{
ftc C
L%'>
T >B
oNP/
9NzA
G3C"
RuntimeHelpers
\t ~
iQ_C
/*}]+@
(1:N
ZLO0
c=JV
!l){
wu x
UserControl
9r#%+
0o<ML 3
SVhf
get_Enabled
R1fQo=ElV
A V
0|+E9C$(~pS6RdXi^9Eg?wGt%
[Ly[
/e%u5
+a]u
)BSN
Y c#
C&:-
gLf7x
K6R
\ VVk
`>\N
TL&\H^m-$=raveG,wVjsN:iT
[5O
T3Z4
&M62
-=5L
>$!
TW3N
85&\^i6Dcxe^?dbepJp$]MB3
&1|Kg
;A,\[`C
hm$
q9@.m=
P{cNE<G8
JN4S
Uz$3t
m<q,
,,^*
Object
@Qeu
H O3aI
X8L$Worj
JWy.d
Y;l:
ComVisibleAttribute
[T33
XV SA
get_Length
M{Gu
z*-k
^4T?::.f
BW)|^
mu 6
0m7V
WR6c%
("DCD
=!\I
/[
D}%[
m24$J
])^F
!;7at
Pg}b ]
#q+o
I*g-O5w0A
dZs S
m=k0
GZjd
3Fm3
Eadv
74=:
%N.I
u4^f
@tG
`R*:m
:6yT
iw<I
<+_
;&"y
b}I*(
i-aa
YM$
kPVd
AssemblyConfigurationAttribute
NG9f
@09m
/xgo
\I)I\]
3trZ]
7C`*
k.%&
20 .
L(`a(Y'
c>iJ@[*I)g#zJ;+)xFF7_>8y!
/of KnN
>{Td
{>'ND
OnMouseLeave
$#"d
pLH"
9 `)
,F_~
1.0.0.0
XgT3BI
%<w"JNu&Ff"IjT:Pn"1},3,n!
G&3o
WYSg
b5Hm
T~3f
|^&2
c ;H:4
6j1L!
lU ;
W/h /
oZXr!
OB}v
$1n
@4Y*%
5"<Y|
<FaY[^9W,m(48YC6mvcoocIJ"
%60"
q$wk
$Z^Df1oU
JvrA
oTR~
`b!/
fGrx
6>W/
{3D~I
Hhmn(
ql3G
2oZ{+3)-BKlg>B"A$:&bC;o2+
O&t)
|"Q@
EHU4
wcO;
wR|=
CO= < < < < < < < < < < < < < < <
sRGB
5q+R
=Hi8Sd93TS/^w\7,^-@{BY@I"
mv!e
),Xx
|sX>
t U'\4
uJtZ
vh*v
'_cx
C->v
mu5S{57g|8i1( OauCcS_^2#&
eoBl|
% 8}C1B
U{C39a6H
}%%v
E|ElNy
CreateInstanceAndUnwrap
Z(dfSOy,}^~Ioq-+>Kom,Sg8!
Jz1A
yg:
{n(a\2KSMANSTKk-;KsATBVh#
OSz79
< {;
'V I
i8I yK
XN[~
{_]%
TqsN
X}A8
<\.'x2
W!("'
/ n*
get_Control
yR}(
Xu,1;
}HeR"a^
HlZa
Ow'9h
Confuser.Runtime
K/hYH[4"?Z9PQX_`2<c_b^^,
yiW!
]M|-
/2tvB
<OO0-^
G3y'
NrF9J
0{GD`QK5K"|Sp-E="JI>2iCE$
3aiK
CdrU
hron#
4t9#
u!+-
a^S3
llyJ
^*'<
emqA
aT!)
vAa>
gt$X!
>Zac
v f\T
h(p
( ;j
3Ut1j
Mx@f+
1vR7_[e
[/|F
`*>q9ne
#89I
v Un
P/G
{ti $3
T`Nae j>MToFxdKn[EHIWti=!
T"}q
f<9P
?fxz
GL ^ryf
96M@
Z9NN
SIm~
}$Bz
/ONL
IEvidenceFactory
set_ServiceName
/ux`
pG<z
!-O}
`'E%m
xb7koBm,j!a/*kHCsjW80/^0'
pO<>
{lw~
xaAQ
SK.
kE.o j
Lw:5I.
`cXT
:?%q>
[BKvGL""ab7VM?kC )b=CH1A*
2q!'>>EtrqzZ*n<&H@}Uj49Z%
w^$Q
"$B$
>5ER
Oj<w
T19P
7V}]
%"l_
,I_L
_tfn
c~gW
y3l>
'>C'
?BU;
iM?zI
&>+d
{GHY
uZbW
H^7f
;tNG^
yEO4W
t4M~
d6Qq
(C;i{8C*sIkNycu'*f\LVPc_"
mdav
`X;V
FrE+"qT"Pe[BEVRF4C9x(/Eb!
}Ju-
V*PlH
B3(FY
`8$g'zi*MQw"rs]RRN$0uuq#!
U(mA
S<%a
,.d rb
GN(.
$P G?Ww
:^\&
&BFa
\Ot"
N7;#{4BJb^]\c~auZ\=pt(Qc&
Ya3!
2|Fh*i
,1Zf=~Q
<=r,
APCD
!y\~fG85Q
<=pe;3qLl2]F=/%$b{ZS4l?/#
aBI-e
or@)
aA+_
!`w`
%J t
PN7AW
GetHINSTANCE
S3}o
51 @
qV m
Ilam
YG,!H
Buffer
MBMcc
'H}q
(CX
eD/`
*5 6^
dqW1
x^&>
yrFT
vE'
;/ S^
%E1T
$S4
1NXj
vTtB
`3N6&z
]dsu
[b}[
>b>WT
UZx)
3nzpL
<OZ0[
p3dn
I^-6
+ ';x8h-K
z uj1
8d*hdC>,72DkJi^u& 3OQ[\F'
j_h:
H\[!
y9j!9
.!Vh
>r}/87*fm4`cEc~x_x"*1^Z5!
l 8q
t (HK
d@rM
)(0
56d
nN_R
K30`
Vq0F
SrR"
5d3?
gY1%
o7}h+1
:^{[H
5!o~
.Am3JkhF7!
R.R
i- a
J2\#h
?DHSJ4T%bR('?cC$Pw`7j&S01
wDr
N*$&
t>M
Uz^ 7I
0W-1@
x ;i
O)HW
G)j~
0 0!q
^6AH4
YjU?W\Tz]OC9k-#^[%>B"aJe$
Na n
iCP\^
L=C0
{L0|
`l`E0
}K W
f i:
tO;3qz
MW=Y"<N
';nb7
M- G
z$Z3
G;"]`
oD"iC
T'b}
rP
x#NL
? yQ
'04r
=8~?_
K+_K
I%!_
ArgumentNullException
FIGK
Zr9l
?t_X
;L$o
get_Major
LmEXz$
hAE7
DFtf
> ?k
\\OHF
En +
FXeS
Point
;[6]/_R
,J(+
!wy!
/@Css
y`S_UYHW
^"4
Ua;I
BX>G
$g~i
F"Qsg
2##j'b
<DQ2
#]39
Lms$i
v2.0.50727
qmo>/F _
/hBx
ehSk
5o /
4zo'
/$Z#
4ecFY
k Jh6}
8H%I
G:( bn
N"zr
8|uN
mo Y{$
p@fk>Mg"A&M8Yd?<c>+Mb;6/#
eHk
+f]e
h?so
K<A@
H C
ws`1RV7f[(K*-+oM,6%]e10_"
)rcs
QodO
CsF@up
=b"p
@nqk]9
>i?:
B7N?Y'#_#emSSRu=N>b@p:<j!
)_j
PK+M
'x|a
QG;c
A~Bqt
? Mk9)
_-;8
\7~g]
Z=) J
Exception
^:u.?T\
v] w/R$
7Vgn?
x' uI
GQk=
m*ZY
L}DK
`6vV
OaIuC
*klE
TYXr
I%Xw
4BVj
C.c1L_
\Ff'Y
?i,VP
Gf &
< < < < < < < < < < < < < < < <
< z2
Wf^QWP_9pVMd)_y"K+?ee7U2'
14
~2t^`
LD|B
Rz'T2LxN%3EJJhFfD&<ISUu9
\e+\
>H`N
c C~
A\M@
set_ItemSize
IAsyncResult
.(e4
} 5o
;Q5ew
M<pH
J\lapO6sEZE
P]1f
[}QP
!IE0
KChh
stKw
System.Runtime.Remoting
g1 i,
RUw
9E Wx_
iz48
GetDelegateForFunctionPointer
t[X}
~1n<J7V
}XXxjU
*V`o
3n`o
XU#bJL_P,+a%F!p`6c*%rkO/"
UaVF
@1;(\
zyU9%W'C
9".
^1;ev1
JB M$
S0Xx
;M|j
T^01
3Hr>
u5L.
[ xd
w%1Y%
yM|Vhn)
H'X*
%NZ,
AbvT
Q-#c
X-T{
I|g}
Ui 9
A-VA
mB%(
9Ah`(8
7w62X
Wj4w
|+B<eX@^y:zOIz^po&>30}>$
.Hm
~5sB
'<l<
FD]G
4j Wa
m7Fw{
yOir
z \4
^$ch
:%N%
& g~
$wU'
Ixw.
)KlB
g]*E'
N<uU
B70X
5 \eb
hzU&
:Vc ~
~tq,
\a,GH\TL
aO)>
Q=:/('
Rq8V
4ZQL
}V{N
K3\>
;>,B
#f$Y
+M:& o
XK(.
&mgl
oN[)Us
System.Runtime.InteropServices
eBS7
X+Z
X5r{ ...M
1do8sQ
sXwv
hNV`i
,DLVn%Xwx9^8{c2CQSA_qb?t&
*(eLeAPQ{k}Vpw@NE&&_x<A&-
J^ x
Math
2q\,"
%]p<J
lYQX=
zV4
DF,?
h~=MjV
qH{?)
GetField
G^2!9
&d)a
"l}Y
]BB,
'b*20+#%Jo83:FZA54z00Zll'
t"p'
T */
?QAL
_,uZc[Q{sfc BFS$GHiw{qCG#
;+V>l`
A9 e
System.Runtime.CompilerServices
%xGM
`S`{
_ *t}F&!;1_o@e@+5T]7l4R'
SuppressIldasmAttribute

#%>.
zIDAThC
;QXqFD?
lr2\
uF(d`9
S~q/!
hNz%m
+}zz`*}
$fe
UoYw0l<
E`ed1P^MjZ1@l""{A;l]d_-L
_[qx
}nic
zYR$
F"X
(}-&
UgJE
Iqn|
d '_P
0g15
%`[R
V ZR
'2ULC
kD]e
~@Ks
>u<z^dO@ k>!\!wUw#w<3HqK!
]97-
fsyv
(@lw'/
d8u+9
k[%m,
_xs>
0wMG'
;I-i9
3|)^
XLpC
t{bu
CZ"
]%5[
`-JP<
\-f\
set_Font
y"YhGS!E:x[2#~zm#9JN=(@1(
sNo%
'!pi
!J7q6Bc9;Y!$ Mu:(R`;1VA_
0/baQqZ
s)3e
j Ul
FL'&-V
]f((]l*b1]d=E{Qo//=sxsbq
tpyc5
GHq d?T
KMJ4&
HOE|k
XZ8~2w
F?{.
!"2H
IDisposable
z(&:
<;2:
(JP8_
\EF4
i_KY
$<y6
j@pq
y|2o7
gywo
MTdX})$#9{B@ekLQS8=\^qPw$
k]P
3WX!
p'<w
COfc
@B{O
umks
qh'sU
7GFa
PSa}J0i\&CyBqFRI^#)\@*U]%
tN5#3@W#
!wZ?3
OO7tF
_J}{
A;e;
(NgC#
<B\T
#wbq
I>vm
AssemblyProductAttribute
\*[B
@[a
cQly
7zXHnmUqz1K~K%~r]5c[,w84
5N1n
V1`F
DJwDj
Do\*
hm[\kE
9Hcn
[W4@
]UeKT
<UyDnV+3,oj9-@LGp cA@X|
J 8s1[z
<Module>
8QC:G Q
151q
CZ`tK
a@s*V
H $p,
)2Kr
-v\.
DD(#
}{Oqw9k
f{[
pc'Ngf
MulticastDelegate
~*B7E
%"X
-UL?
u2VCB
^JM{+
b1\k)$ j$
61uhn(t#R[A,%-oP4+q~L&x2+
t=T<
da2%
FF
1r/ mS
!m_pData
`$>x
}lX:
0Rfv
value
AGQQN9>
xr]
2018
a$Ih
[7TY~
(1>,"8
;/j(
-)9rHw
9<cim|wY=^/!!bNk'00Eq7$T#
(%b!
Oi$?
K=y7P
YL*G+m@Pc(F~7,8BU:L!+|~|
CV*)
Q? fH
sxmqC
k1w|
*6u.
.Or#
xU9&P,`0nMz7'O:84?"X#(3[(
bk~\
TkE"6
OnMouseUp
/c=x
+(.!
TBE ;
tgp9)a2> t~6B+Lw-,wXYO_&"
jGEQ
EVB(l
eDvD
jE}N~=-*oVT-3,Vc^/*t[8l$&
R JP
lB~ :<
C @o
/;2X
Z@NYrl
bSc?
^}E$
M_ Z
P;b~
oi77(<
*g]C0
?ojDc
CA3zN]V0C/(/*M8G7q)aj"/x)
!6;r
#GUID
:)]k"
qC`
#?,
"[Cvp
21O-
uRqno 3w
q%X!
nO7Re
~F8/
set_SizeMode
jj\i<!
^/b"
:MW%M
xy'm.
PO<]
d?Q
yn 2l
W, 9
CU(`Eo6<8]h0,:zFudtcg4v~!
U85t
yIDAThC
%S(!=
?gE
m@<)Y
oE~Q
1eY3
RnU`
choql9!{1zO([/vBd*;m>=w>$
%ef[
QQh|
ToString
2 h
cC[9e>f&
'V:@
+b$H2:\TgnX\6BZz_!Z;~y&#"
2@DH
SL~: 4Q
k),19\ejS#};%e36ubX^hOZ*$
#RXT
='ltR
WY3
+B%H
?6Z{r9:
&P M
o_ &x
>n]:*3e%
X +U
`x/e?3
i[S>i
,cV7
gbIO
Nullable`1
o)~/
>b7g
n}[bC8
?9J&
Bl =
bMCC})&hAHv3"{"}`RR?z0Jc&
~>Mb
%J7cmZ`"&W<'w\x|5Hu CGi!"
0wP>
cD [
jNZ1
p`&F
e2jC
(C x
>'O"w\F0Nk$tc#w?^i+ikIeJ)
%:aPVEP+jKSrY~pKQ'^=Hm& "
-f%4
Y;2}
7g&n
,yc!~e(
get_HasValue
aQE]
Delegate
6>gV
-NSY
.bud
h5$[
>jG]zhwC
[7h@
_I l
5 75H
Q4J
^pF o
J].X
(jGA%
qYJo
A4l@.
-V6U
kypke3yWF_}j8"S69st($zrw!
Z)cBm%
/FiZN{
G-YdF
Encoding
9># 1
Sr3X
rmhd
Kh^g
Gv;){
E( x=:`8rU|J9r^-@I!5X$"~'
)(}XyZ
W%xx
5`;!
Y$1H
/$}o
v`'&M.UO
?bZz C
IEnumerable`1
:5?Dy
U')&
w)e)utKr0V^JH#X]3}PQGHF9'
uQ9!y'v@k8C"}J20YY];=r\|"
n8 T
aPqr
mS&ZTEe3WJU0,/3D SYq&Td~$
$O*]
get_Module
^ =V D~
TabAlignment
MU @
#RyE
+r

0G OSE
P7<!
jy7}
{Y\
murO
\dF0O
Ya*S
(WG
]HnJ
_bOU#
<U,*`
s"k ak
5)f;
VrHw
4\M>3
Ng^P
Cs?w
,*.)
X1c^
+%Hk
Gz R
X
N1D=
fRVat|
%?p(p
get_Size
LtyM
DgH
LusJ
t"($
:<:NT`
._'h
6^A#
#Z}s
ve3j
)t78
mr]P
axTo
W5j
System.ComponentModel
zQZB
e&W<{Y3
Ark.exe
$Y(V
]+"R
*4Vf
$M$.
!).[X
n}ru
436534A617CD86B8557AEAA31D433ECFF38B112F
_~Ng3
U0Mg
Y*q7
EG|a
Q:ET
vFj7
IDAThCc``
'+7,I~%
`HO3
(T)7!Q(b@<y%</Gc];m-pS_6%
]E",
FKHi0
C_tp
DisplayNameAttribute
Ots_
% 1
qoR6A1s-,yS?SJj:N$p2a;;I"
;J(J
Ghza/ V
7> -
$7 (
1G^i^9
d>%UCa|
X:B^K
PT=0
\;;8'
C648C0E55DD0A71600A3C979FEC05C180303B2F7
$G8r
!QJX
y*nkJ
wPBsb8
-}?O
#w(.
^-yZ
t7HJH H
dLTm
uP4N
)YC~Op
"[EW
ntud 2
Pjme
)<-`
mw/s
:Or<
`FC"m
'Ls^
1eop
R -k,
m3(M
W{/#
R|l
P&Sm
|@{*
(S$Q
l_k
Biuc
IdHy
`o@j
!9 $
*OuFr
+8<m
K9nd
Kku} 8o
Lzn1
|IDAThC
n2+C*
hQIe
System.Windows.Forms
set_Cursor
J QQ
I-aw
6rcWt
rR j
Tw7l
S6yC
/p*&
U~ZJG
kB3IJnf)uC*<:A 5gCCx>K:v!
Ww>IiC
Fgx5
82Wro
u$Ju~
)cS_
9nm#g
"cBCz
GctYlI&N>nOdZEiH!jtyc,^*#
ShA<
WriteLine
9$R.
System.Drawing.Bitmap
QPfu
f -O
o`E
DL$Dyk_
buq}
wm.}
'Y&
'*9HM<?j A8Mo)}@x@wJpjV6$
V2e2
29.G
Uyav
1w'W
SetStyle
gEzP<
\C)t
YK(I
aNV $
HI|,u"2l8k$<wte']?j|_!=E-
^~!|
D;[_R
disposing
u/7 {d9
n:+ x01A(@+7t7SA,f!@9$3K(
RR#m
Kj_p:
&MQ4K
)r>a
9+{>
k)y
$3y&
R[:~
j~`m,yoKP`
*I5+'@
n 9r
T =ck
D*0_
GetTabRect
3Jg<
(9vx
ipcf
9zqg
H OW
2{~e>
VJ;&/}J
` -nfMR
@J"[
V I?}
aRTD s
73 v9pWi*
u[\F
^/B`
qg%[
h5rbl@
L!,QJxE8Dxv<:F]7Hp)`(R?6"
$f32102df-c9f9-46dd-850a-353cc588adcb
K6ke (
z]v6
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05_64 Seven05_64 VirtualBox 2018-02-15 11:20:35 2018-02-15 11:23:27 172

9 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05_64 Seven05_64 VirtualBox 2018-02-15 11:20:35 2018-02-15 11:23:27 172

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\ymc.exe.config
C:\Users\Seven01\AppData\Local\Temp\ymc.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\ymc.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\ymc.config
C:\Users\Seven01\AppData\Local\Temp\ymc.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Users\Seven01\AppData\Local\Temp\761456ae-ade0-44d8-8952-7c04814f8259.dll
C:\Users\Seven01\AppData\Local\Temp\761456ae-ade0-44d8-8952-7c04814f8259\761456ae-ade0-44d8-8952-7c04814f8259.dll
C:\Users\Seven01\AppData\Local\Temp\761456ae-ade0-44d8-8952-7c04814f8259.exe
C:\Users\Seven01\AppData\Local\Temp\761456ae-ade0-44d8-8952-7c04814f8259\761456ae-ade0-44d8-8952-7c04814f8259.exe
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\ymc.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2564.14461875
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2564.14461875
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2564.14461921
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\9fa6902c-14ab-460a-9d67-c2aa3c0e5504.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\9fa6902c-14ab-460a-9d67-c2aa3c0e5504\9fa6902c-14ab-460a-9d67-c2aa3c0e5504.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\9fa6902c-14ab-460a-9d67-c2aa3c0e5504.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\9fa6902c-14ab-460a-9d67-c2aa3c0e5504\9fa6902c-14ab-460a-9d67-c2aa3c0e5504.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2752.14465859
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2752.14465859
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2752.14465859

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\ymc.exe.config
C:\Users\Seven01\AppData\Local\Temp\ymc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\ymc.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2564.14461875
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2564.14461875
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2564.14461921
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2752.14465859
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2752.14465859
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2752.14465859

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ymc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3035fc5a\375c7a1a
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|ymc.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|ymc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|ymc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\3850e7bd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\1b71387b
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.VirtualProtect
kernel32.dll.GlobalMemoryStatusEx
ole32.dll.CoCreateGuid
kernel32.dll.GetStdHandle
kernel32.dll.CloseHandle
kernel32.dll.DeleteFileW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.SwitchToThread
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
gdiplus.dll.GdipDisposeImage
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe"

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-02-15 11:21:05

Detected family: #Malicious

TheSystem Itself @ 2018-02-15 12:10:02