MalScore
100/100

Materials%20Drawing%20Specification.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 28/67 Related 2600
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 280.50 KB (287232 bytes)
Compile time: 2018-05-28 13:14:15
MD5: 24b1bb09aebaeb96564b9508f0f13891
SHA1: aff5a6350891eddc0a80860530d5ec69688b58a9
SHA256: eb121929ae103ee146553d8a40b3f8e07d40fc29e3217ceb3b6f1545b8408bc6
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-05-29 04:27:04
Last submission: 2018-05-29 04:27:04
Filename detected: - Materials%20Drawing%20Specification.exe (1)
URL file hosting
hXXp://urganchsh28-m.uz//wp-content/Materials%20Drawing%20Specification.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-05-28 22:17:37 [28/67] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x3a7b4 239616 03d6c9ee05ec088c22fae52e3ecd234c bfd376b829f674666d1a202f39fa0dedc2bae9bc
.rsrc 0x3e000 0xb2d8 46080 96aa91760a04553fd419f3328f5ccd34 2171e70504532a63e9f687528fe45e5a4ff3dc6c
.reloc 0x4a000 0xc 512 d63239df6cf148ab327102eb302a34b5 c8904dd0d2583f44b16e23d516121e77b7768547
PE Resources
Name Offset Size Language Sublanguage Data
RT_VERSION 0x48fd0 776 LANG_SERBIAN SUBLANG_SERBIAN_CYRILLIC
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright 2007-2010 Google Inc.
InternalName: Google Update
FileVersion: 1.3.33.7
CompanyName: Google Inc.
ProductVersion: 1.3.33.7
FileDescription: Google Installer
Translation: 0x0400 0x04b0
OriginalFilename: GoogleUpdate.exe
ProductName: Google Update
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
1.3.33.7
URL(s)
No URL found
Kemas Kini Google
041103a4
Hak Cipta 2007-2010 Google Inc.
2007-2010
044e04b0
L53Y3OcDnFzpp9D9T3UR9zTRbC3dxl7f
program Google
ETdz7HL4Og6HvJUDSPm2kL5
040b04e4
040f04e4
044a04b0
El instalador de Google
Autori
InternalName
Google-asennusohjelma
Google uppf
Kisakinishi cha Google
040604e4
040104e8
Google Inc.
Google friss
Google uppsetningarforrit
Translation
044504b0
Pemasang Google
2010. Google Inc.
Autorska prava 2007-2010 Google Inc.
kQzLYg1LPtDlJ9fnkhqTbRBXL96wlOHPsgyHEUv
040304e4
Google a
081a04e2
044804b0
042004b0
DjXZVhLpKl06R6284skKDeZWro4Ko7Cdg
UcHTGfu8CCiqe9pBWsSzOgzG9kXlfeVa8YQRfj
Copyright 2007 - 2010 Google Inc.
Copyright Google
O5X3AvNlPp84Vh7QWvmHZeiIFpkppNIDG
ivit
041604e4
LegalCopyright
041b04e2
Google G
044904b0
Autorties
080403a8
Google P
Google Y
aUYw09x5XJfMiqDhiVuSrtzPUCJrPmcHItd
Google Inc.
JdBuSDLSq1wlUFBFCkJ6M3CSZUtRZc1XOgmX1Sl
diegimo programa
0RU
jums
2007
Google Installer
naujinimas
041203b5
1.3.33.7
080a04e4
GcAwRc26AXQTSaWwxUifrFFQQviGolzH1cTG
hGmM0F3epHGoq91zdxET0
anas programma
SigfBlGXDjHV9vUPOUfkvQA
ncelleme
Copyright 2007
igustega kaitstud. 2007-2010 Google Inc.
2010 Google Inc.
bas 2007
041e036a
vjkeOeuYq3996UBGKKPM141xKSptsxub
045e04b0
044c04b0
040403b6
tbfsTtgAKsrZ9hJV13LVSGNkG0ne4JWAo8a
Telif Hakk
Copyright
Google
2010 m.
2010
, 2007
Programme d'installation de Google
040204e3
Google'i uuendus
rsla
ProductName
n quy
043904b0
044704b0
avEW1AydwgtdtkCXgCxR5EP1BrlGcFdpUDKF
040504e2
041804e2
041004e4
d7lyM1AE71v3yWYiJlvT5HsDhjWgBm
Instalador do Google
Installasjonsprogram for Google
042204e3
2007-2010
oPafSXzaCcogdCPNDx9Yk0mqmriW
2007-2010 Google Inc
0809040e
KlF5uoFj1W29gUgBZKuEH4hxjXTWux
040804e5
Google Inc
Google Inc., 2007
041f04e6
041404e4
Google telep
041904e3
VarFileInfo
040004b0
gmVpfmnpLFNnUHro70buZa3SnfGnwXqjc98C
Posodobitve za Google
VS_VERSION_INFO
040904b0
042104e4
AGPfI4I26K2aZ1JEBb6P6XWn6
041a04e4
Copyright 2007-2010 Google Inc.
Instala
BxMdakd7G1nwzOBZNfvdpI8
Inc.
Google-oppdatering
YEvqzkHARxWxP5wZTqUI
CompanyName
2007 Google Inc.
040e04e2
046404e4
042704e9
040704e4
Google alat za instalaciju
eozc0Gy97clrU5fgQkfotPCyWGxqwXI
GoogleUpdate.exe
044104e4
2007-2010 Google Inc.
Hak cipta 2007-2010 Google Inc.
044b04b0
ttur 2007-2010 Google Inc.
eYhEgyEYn9opfgla2xtZaC9Xqo8DOe
041504e2
042604e9
Derechos de autor 2007-2010 Google Inc.
ukQncjz2hpcbZvGL90amP5IGHsJ
042a04ea
YSkNXNsYVLaAtoVVxlgK
62wOHBDLv2gQaBw74d8asYRDn7
041304e4
042504e9
StringFileInfo
tala
7qOGImcr9CSEs9CMqXwK
Google
n 2007-2010 Google Inc.
FileVersion
fundarr
043e04e4
Google atjaunin
kleyici
0c0403b6
ProductVersion
040a04e4
FileDescription
OriginalFilename
fmbcDmCZesqMZAEA8JLVaZNfjWtGoC
Google instal
Google
041d04e4
040c04e4
2007-2010 Google Inc.
uriranje
040d04e7
081604e4
042904e8
Google Update
042404e2
1u ~
S@Tk
yg?);
iKIF
:<kP1&
6:LY5
)o~Ec(
615t
.jTM
u1j3
RPJ\
!RiUm
2- q
$.h%V
[HH-
=E$3
M/L\
8 ] ;
sjK6l
TK|$
c^=#
s] f
@&d5
# Il
G f5
<V7O
N- a
9@Ha
& ~a
( M 8 M
jA3
B8Sx
rd db
5)Ci
?[q?(
& eH
3W^Nb)k
5Hk}
c#x-STT[
=G(v
p(pC
UnverifiableCodeAttribute
Ur h
zlA-
@\.
-NR3
V4 Y",
"- T
Fi-f
#(~g
M/z^
k1l&
V- ;
Ny ]
,9YE*
Ij :j
URKF
m"__
%dOf
1.z3
%;_GfQ
atWn
33
Y>)
3 *e
XRB{c
%s S
>hlm
y$ET
-Iw|
|7Si@
ER2Z
ee_
Sd0
&uXFo
]:XX
I/ito8
DX4'
Su_I
System
OU 4;
GN-7
MIY0
-2 1-
% 6
H!_
WT%T
{ofOh[
Zeb r^
q#oc
0NU|k
Z IWb0
'P]r
r|6k!
9M#T
>xWQ
eQ|<
/r L
QEz1
~$3+E
'D/Gm
(Z7d
iQMt
6D'wTyi
:@M7X
%_Mw[
*U'2
)jJ(I
Y\835+
'[&J
xdMt
~1cN
90V\
c~P5
I:JX:
~,q9
(;wg
k'Vr
goEJ
? i]9
+#@3
i?v
C la
^_;=
h/x1-J
`39h
_{[2p
O;A}
!O5X3AvNlPp84Vh7QWvmHZeiIFpkppNIDG
Ka8T
sK1%
P<~)J
VsAiX
<ij0
A.?H#
.'ZT
)4cc
^sO
uni<
EW+I
X1;(
[DL%fY=y
JTUG
Q6C&Co
'+nC0
sPSY
dx83H
+ H_{
SL K`
F5p_
1,>vy
[(f!
}lA7
h4Z72}
}$:]|
AT|i
W^x>
iyNW
,C4*
K=BH
yHF$
/{ X
;=b-'
ftzn}r~
&jD6
I 2 0
2Fr2;
.C7$
BAa~M\[
(E/+
i/Iq
{TGL
}n??X
4}!w
:jQf.
x'>|V"v
,0Jajq
3( 5
v}ZYP
tuj/
''{>
;gcb
k!H5
>W=a
AppDomain
U#J'
]x%h
'N!yH
-NSs
]!)}
Ozz%
4i/K
qI[:
dAF|
hF 3*
?@p;
<ktP
f?+lBy
,xw5@o
uO_3Wh
" 7^
%j#y
5tSH
k{[$
*{rr
'l$yOw
3B ]
1j ,
!h)HCO
nf{\t
7$G]
~%~5
;&@O
gK\O)
q+;a
b}r0
iORL
%q8wP
,4? ,
Gy0s
p0 8I
6k]x
TXq
!{bAfa
}:z
< W<+
@[oUu
L|W,
N/6
TTEx
A{g.
=1yZ\
\xjD
4|D
8J*p
l w#E`_
K(;<>,0
Z -:
uq:ME
QU)p
vLMr
C=(OmW"
.H*&
RPO^
yce>
Dda,_
a$&5
spV1
H(^Q
4!6(1
Du'FvN
rDF?t
(k6C
wTxPI
%eM Y
Z=XdJ:
6s!7
Qm'>Iw
~f q h
*-W@
G2=qmK
:}z+q
bF31I
5.S?
Type
eX+N
bT-|$
Tpbu
$ W@[R
vU,9
JMlR
=s@K
W&:@W^
5*^*
>\/
iB hK
#t& d
:Fe
_/l6u
op_LessThan
A6*!
b%K>
dG d
,,I%
fVvZ|Qx
\$q
Iq;r>
>#I~AbA
xR$U
3 I
621A
6oQs
N9=_
KjmD
0Bcsz
4.~CT
Na<4
fs+(06
s'>{
:/?z
_W A
B JdF
)0z`\
7''
Dd#S
v;^m4
rO&
*$WE
s<n
, 4
MQ38
Wc;*F
N%/
uQ:2d
f *m
5)9M
ob gi
" !""Y
BG]$a
Bj+(VN
Nct'GNL
lHwz=
KlF5uoFj1W29gUgBZKuEH4hxjXTWux
hwU{V
?2=R$
~=H~
vEnN7
>32gb
"$ G+~;m
J_wTF+-
UZm?
1A5r
)'PI
w|El
2d(:
wCjD
6MHM
O 0
V8[T
3xHS#
P}p<:
snCn
~\3^
ZCQP5s
Z+\C
3B{e
YEvqzkHARxWxP5wZTqUI
E4*1
"nK[
D:0LB
o'7m
0m!("*
vA+=
7$~N
Da3ap
n2 "Gg>
]7u>
*h.h
mc^E
DialogResult
2DZ
O=P`
u$3g=
6:>:Y A<
3|kR
.text
List`1
e{``
Y_z!9
aj@ k
u"5^
IpT}h
8E0!e
GetObject
k+g;
/)p/C
_9v3
}vX
(I*e
XB@`
)4`GZ
QyK;
YD)
E?h'
e_s(
nlF7 ,
M\TQt
I v
LQ5k
1&U
U0i T
e$3d
49)A
{7w5R
E,uJ
e~`2
fmbcDmCZesqMZAEA8JLVaZNfjWtGoC
).;,
QXLF
<hI:
& z!jE^
iXaTBVG
SkipVerification
qIGn
+2lH
[e q]1
732b
li8sU
je5|
w$7(#
GAKzc
{ MQ
lliAF
.@7H\
ZaER+y6
}xt
mz{g
lF$h
+ec>
+ aG
V;Og
v)Q\1
K<&T
U^b9|
[x+ A$
BA+(l
Yo A
;iF
K.]3
Fotg
Qz=]
*F D
]exa
_r+u!
(HW"
@%qk
Pty-
FNK%
D%'a'
S: 3
cq;}
p*1kb
x3HI
YQ[<
RuntimeTypeHandle
[Y`#
%A&I
4 @k2
|\-n
sne'AM
QrO9
y~*MI
t==6c
OLw]
1H>"
`.rsrc
iMP+mg
qP{#
!*i`
rsnt
$ {Q
^[=nMl{
CreateDecryptor
rz>X
qUc^
)sHX1
kX}+
tzNH%B
@EE'p
c%i|
#9snP
Qi> P
+<Ei\
5DNuX
AH #7>
"Yy$
0eI+
<` V
4_/4d
0w$$
^)N=
VYLJo
IM@b
k#'!'
DFZ
B6!Q
~d AA
?QlK
a!a??h
=O\|(
}/XL
nb9U
[J3`% +Ui
1`,C
= e+
**E
M|;f
~r%B:
2Ees
Fkj/
-Jl
:gdr@lD
sN7<
z'qG
HO-9w
dVqj
y#CZ+'
__Oc
j1R0 m
F 9)
N~m7
JE9~
9y$Sl
RZgJEJ
n*M
Gvj@
7jIf
fATjIa
UV7p
lVmr0O8B
.x@Q
3p{_4%
h'*x
'JdBuSDLSq1wlUFBFCkJ6M3CSZUtRZc1XOgmX1Sl
NdIr
Q '1
o=jl
U+f-
&q V
<rHx
w><s
}t4A
z{,
0P-]
.] xR
/D*,
SymmetricAlgorithm
e <|!
rVX8T
]]G
Cv zq
dN"<
|P[-
|/5J
>v^I
*>uZ^{
iSLIJ'T*
rw6#
BI'*ef;
u pH({f
!)"Kg
?)-W
A;ba
h7&A
\hh7
^rAW
Lir4
Z),{
MeaHG
t^ehn(
9z\0
eDm{
-EZ=C
??Jriy
[]w(
JtgFc
# 4[
|7S
33$Y
`0"&
>N2X
6tT $b|
yj">
k~]?
5d6
."j,
l=tl
J3m~f
get_Assembly
;`*x@
$GcAwRc26AXQTSaWwxUifrFFQQviGolzH1cTG
`Sl/
DxHO
q1+0
My f
fdQJ
w?H[
FlI]
TBwq
Qk:A
l#K
Invoke
FzH0
gyZ%
5')/^
+XU.
qBd#
iPe
^`KO
=Rf9
my02
Bdnv
WB=W
u%({
get_Now
)GfV
nN V#402
Xrnp
,Q<LO1"
TLqNs)
<_<
j6{l
1Hcy
^MK!n
C%5\
'}Gg!&
y.u;
Q:Ho
.IkQ4
rO*C
7$Wa
g*]+
oqI
n_YT
KGe :
7zw<
,}iB/
`ML7v
Uq :R{
,_qN
u rE
|985
G'qC
4"9c
Z0nJ
#e%4
]jfs
j/_;
#v"k
S 9v
,9`@
$HL'
`_ 9azM
Pt-b
Hnv?
$gmVpfmnpLFNnUHro70buZa3SnfGnwXqjc98C
oV>B
0\ G
Wv~M?
$L:^
System.Security
)zYwJ
"t:}
Q';04
Z'=xZ
F:K~
1-|s
{T_4
lS#K
fV`m+k K
Q7 <)
n8z>
1Ux]7j
J-B3T
M"O{
wY@f
p ,
2SOD
f3y(
h^sP*|
; U,
EQHqU
$ B
qMm)
`x1b
NU[f
g^+
m=B 2
vAu
%"J_
xs!
5MI1>
q+F1D
!'\V
bC36
$=92
wWMvY
=3 |
ak#^
@c1f
wk>~2
,f0l<
CKk`J
;Kes
;JeAG
2u h
p HZr
5^ 0~
6_SU:Ov
Bu}F=
_WMC,
1HDk5
c. W \?wi
;mN:*4
TUo)
corq
FWMZ
7)Y<
MethodBase
#Strings
'pz "[
2-Hc~
YdwN
j% 6
#R88
%aQ:K
[HM%
#S'1rT
VX2d
c]7>
1BM*7
{&o?
R1c J
BA4h
^"DM
p2)lI
KcG+-
9n(
W 4.
3{/
j[z"
n&x(
@CQ?>
hIzq`y
kQX\
X+QN
'wD!
3?MdET
,lpH
3RAL
]0EB
7kxY
").H te.
9~mI
;G}m
[)>U
5#pg3
D<Q4b
%J])
hQ"s
R" `
sit<".1
rR*6
!3N];
k)eF&n1
iX;u
o'L n
5_.c1
T 8P
`KTi
<0:(
Fg.A
ah ]
L"[;
kD#Z
>+[
v>jm )N
( 5 @
h>e*
HmhT>d
w:?
Bp'%
> c]R
-Jm/$
`d ?
;6/R
%;$5
C"dR!m
o^Rz
g |[~d
F] )
u7{Dk
PCfs
5>Zd
#*B<_
!C jxQ
K";<*
0.8A
"p Y
6vJ3
xo qe
dw0E
GgpvV
> 6
M!FceK
1yz.
cc;"%
:MBk
L=W`
L9$,
6u -
OS2}3f
%}3*Cw
e1h j
^X)S*/
C% *
VfN4r
5.*yq
pPDi
K h)F
\1 `
[[/x
gVa
|0_@?
jwXj
~KH+tj}
lK z
25%o{
sOK3DR
a/ *
mbE K
b,T+v
\\Y7
System.Collections.Generic
ap5I
M a
@ @i
LW+P
fh
9_TH=
G f<
0sgHt
|*5E
64bE$
Uw
/[mP
O,:,J
'EV
5!:[N
ap K
wA T
c#;P[
i86
GYN&
g /3
[&$k
v ;
Ys9w3T
=6B6
D =1%
1!Il%
(&*#
&4&Fs
JPg$v
-8B3
]c D
%Fie}
+^lT
>0#6
@"IN
;Ihiw
4"(x
sEBM
sMT2
iHS(
3bWKejig
4lK &
Zxrb
r^0E
q5>8
2HoG
23uj
L53Y3OcDnFzpp9D9T3UR9zTRbC3dxl7f
M,<7
MdK$
RuntimeCompatibilityAttribute
o@tP
<-{:
LH$<EL
[\hxn(>
^fp tQ
(g:H
9s;$ 9
AVr~:i
G2l6
zCaVTQ
YUQe
TA|g
UNPqh
GMrl
_ "z
}<NE
O H!
s1}?A
mWqP
qKT?F./
/00M
3@CB
a1Fmd39
sI=S
XjHU
E$L$
o5;P
mS6t
B?:X
0 M * M * 5
<7=C16
9x,@
7.W,
g@e]^
b8 -
[)Au
lY!j
uiJ2
X[\1%Sz$)
u9
f3x&
P7Cb<p?
|WRe.
@ Zi
{OXr; F
<02a
J&HC
B$BJ
?4 Q
_Q %
m@STe "E
a$FW
QPq Vt
^o*5
68=h
x(,7
q# wF
CELKo_
YXU}
Oq {&se
"$
Zz2C d
h+PHDW
BE o[Q
9m'S
1:rNs
V2Xq4
GIm-
Lv7R
fr5_
FgB
L>v Ke
Dw>2
H S
;wTt
OM\V
$n@
1Up
7OZ[
M+:AHy
M`tP
7M$\x_
#JUo
M<o~5
cUoh
mZU,;
Iw>+
J+Ly
VKn^
h 2 `5wgW
K96r
d%un
i pK8c
d}3W
+]m &i
Ig2sq
31t8
c^cr
|hl#
h8kY
H-14
W*2y
|E), *;c8
cMn1p
~hat6
)8RVv
}a2x
7-3k
Sf@6pK
Lc8's
M"6
' Z\=
$;a\n
CW32"
eeT'
UW f
xO aJ
!f%{
u'4S
x\Z@
'fj*
S8TEJ
$Zuax
Wk'T
-K}"sB%
qI W
/W"5 Q
|t I#
MX*!M
2i)~
/.t5
}[]%
Az$B
bTVUt}/U
z5(]
H]eL
8 $ M , > ' ?
iI_.
Mr2P
HInbt0
p*3h
3QI
Z `q
D#tg&
)5gn
fltic
NUv5
> r|
Lx@D6/I%4]
Xfg
-zlC
eohd
Ke_`t
32Ph
.oR`&
*t/1
>wa0G%<
g]GG
3rGDs
|A(Z
4! )=
wwaR
d.'r
Sqes
n Br
)n[8:
WP7m^
DeRx
vyZ.
o}:m
X\#jp
68EG
Ya'V
TE8g7v;,
1(0B
O;Ep
e $y
G)o f
^ #,
VRW8
BHEwR
$PIl
k S.
[4b
: n
Hjh<
lVPs
,)",
| 5/|u\
M{bk
!PA\
O)rIec
Xjsl
S:4<
TZ k
h&Hm
KP n
p6v,
&5fx
=R79IW*RK$
WH&(j
6i*
c)eD
HKzFF4
y?KH@e
`nKSCd
\t ?
9Py`
&lV]
tQy^
?"KD
E`Su
v/]Sb}
5y{X
{\uh^#
7p@t
w/4t
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
JG|1
{EQp
c4=
~1!k
6;/T6|
G[OV^
/NO2
R ){
>_qv
*]IMU
)h5
KwLC
<z}*";
}HS}
ICryptoTransform
mg*#
c?Xvr
m6NpL
r,GGUP
myD~
bC(1
&G<(
t<T9[\
K")&AX/}
>a A
O?4o E
8_/b
TNs9
Sjy=
(Enrv
Xh~C
%J0n2&V
\a,;
r<Ms\
c9P
lc4,V
m{0%
nIl_
cLGE
iv2 h
P"nKL
AgU.
1-5+
^>%}l1/F
C%!.
r(;iX
dli ?
AF#
@0^%
Mm#?Zm
v ;6T
Mb.2
t w"5,
Tx3}
b$5F
W+?;t
R I;
\\uc
sJ5C+
QRyl
2`_[
9[xy3?
tnY>V
qK Jb
^u[)
]e3@cw@
[/U6O
N/A]
_; `
nnKVU
*Gc&
US`NX
/mI -
x\CFV
|InK
><VnHW
Q[+5
,d ,I
kWn
}AuL6
Czcg
_r,4
*0t
$2 [M
TMz"V
'w,w3$
aBR_:
MZ"&
h 9K
B y!2
get_EntryPoint
8M/
eSin
OfTq
.o3|
f, S
~|!2
.ctor
x^Vf
D6i8
j@3f
=Ufn
k^(Ms
V=\gH
y{;r
Ro+g
pvk6w
]_hR
m+xx
B 82+
8ef
I6=/
k'!3
'o-m(;
Y{M
8zQ_
^Vr\
<f\_=
d=]F/AXz{1
pZv!
-B2,
1~;U
}MYG
mJi<
#Tm"
Ya-!
64Cl
e!:=
y-m4m
J I@
|[;>
/T+0
XXz/`
&d
PnR
z^-O
-Qk\N
|6Hga
BC8Xb|
Eu4+
1zx&/l
.{T4
:@|v
wz,F
uV+d=6
,Gcn
^wn^s
i#3.
v->#
Okl
N/JiR
1?0vDN
> * @ 0 H
{!Cw
w5a\
a'iD
yJ.Rn
Bm[=
r_A#4$
8E)X%
4m3e
o(/BK
BXDl
@.reloc
{B"X
hVr*|
k:*O
1[+F
jczf
=N~J
4~ZY
cb5R
dph^
3v&6
(Q0P
/qn3D
IcEt
!5{W
no?>
Load
WrapNonExceptionThrows
tS&w1
jzMV<
Iew(
q@m4
|S 4
/_)/G
&WR^TTU
VU,'
YEf0#
qEw@
D5wL
dHHv
;4O!
{$a>
ckB*
%_8_
gPk-
48?E
#=mK'2q
jheIa^
_KZq
g!oG(uj
[N9sl
LDs c,
\E^
K*|J*
.I/w0
-#47
kUr
`l>
"W9<
;=|Q+|T
RqglLh
u ?N
5}f(v
7}D,
DI_9
4Qz7mmV
b_rmb&
8/@m!
.`'*5
'wi_
vp2s#G
w7>Xe
l%]N
MessageBox
06ly
RhzM
U|sA
>-14
3{uP
P.|
~4f+){
Uaw
GF)4<
WHZ:
uPYa
aq
x 5Lg
ygD,
;9ql?Xl
=#|x
hsU\XA
fPUBgt
*- Acb
v#:i
90K)$
s-}l
NtVv
ny-RV
|O1
0-Kn
/x!0
hL2Q?o
`*9V
"mw+
\~}aC
% +
HphC
!\WZQ
M'UB
JQz{
J9 B
R}*%
M
g\Xo
o;\}
yo1xx9n{
@c[F>
^uZL
YPQJ
*iAG
[.xs
M|Mp}
VZ Z
g&qD
|%_Wx
Y(sZFu
Z6M>
&aG!5
Assembly
<*VXW
U^^[
x=A%bP
'p;5
ewjL
O(P)
,[1r
Q Y5oa
ko]7
GvE^=V
+fbU
MzDF
t$&.
BTc0
:jJ
R?h[
[7{
Y\:W3
l'V'[t
hG]j
#4X$
V~|~:N
*lqOyq
wch:5>
]EY\
yO-
:|8J
qp> 7
cqWC
@2:
rbgT
abE\
"q K
vpsSw
yo7?E
9Lp`
`q~ (
7l#j\ sM
pC;@*
cYFv
9^
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
R/vC"srlt
-OG
wt$pf
$jV7
h9S
Q^&&
e27
d*9@
(RwU
8N~k
>HBU
: )Fk
ac=
eYhEgyEYn9opfgla2xtZaC9Xqo8DOe
_oDS2
=KU|
2 )6
& M / $ (
A4k!A
ukQncjz2hpcbZvGL90amP5IGHsJ
Ll7`
F{y^
WK
SICnPr
ZVOv^
",
C0G1l
kA)
zhWJMzvv
>;#[
^&E+
aJ )
ocW,
/*Ta
dd<o
lk.O
/Re|A
'D__'
\2RVs
'0a*0
B5<|
3y2+
D~W]
:=h+
sX|d
9ulx
h,+Q
l3EJX
!DjXZVhLpKl06R6284skKDeZWro4Ko7Cdg
EPqq
I:7oI
C[Bb
Y+P/
"$6)
W'xe:,
O.E#
eV'(g
dzJ[
_d*Z w\
(`Ki36
9K u
U|X
cbo"
0,Lb
aCA3
0\hFdC
0$'n
CfCr
yK )
s;h5!O)
(-c1
RBD*
cG87
h{#,
` eE
ev07
$E1G~
WiTd
rhZZX
@TR!1
rR@5V^
Nsf984
#Blob
jj5]
w-;jDi
K f{
< &
mDZwBs
h|:rf
2alK
~z?IL
q5wr
+])o
X!=I
b66vI
S#vHF
_9WS
Show
CS6D
kc Hu@u
S&vno
"IX,,
~`]o*
>IV7k2=
9VMpn
R|^7
G;HV
Q%t\
( M 8 M
B[/{8
6<"i
H.n| zS
LbD#
z_59
PnwY
Xt'$
t(g5U
-4+K{!
/3}u
hGmM0F3epHGoq91zdxET0
?,A5z%gW^?
2V!L
1;NK
!a
F1}q!
glbK
^K;$
w:qy
* {LVQ!
%i$]
$q n
K_kH
:Iaz
!qT!
V*m?
wW G[
M-&d
S'&C,
bx|{
[>'+
yM56?
D$'M
-3~7
L J
Kk8a
?Rrzx
_laH
-PSZ
{G ]^
TQT"
;cyI
Dnx W
} KUm}[4
0p,H
b3,f]l
9t8@
jeev
|>rp
lJ5j
K B?
F_9gj#
(/IT?
+YP7
X yg
6BwBz
OE;=&
U{<
D ui
#TOh
n8h
( te
YYB)+
yY$$"X
~GM%
6>sU
#o8
FgYO`{
N sQz
zj6
Jl8.
8 M % > *
)X^=
n=0),
|#h
tJ4H
F.k(
x`OP$
yiY5K
qJl
Vh8s4y
b W7
F`-%ZJ
] H
Onfi
E45
System.Windows.Forms
;i(MG
M2Y0
Z[I!
ICOY
Bg%z
v kt
T592
BU.Zgw]
bhX&G
}=sW
)~[;
uai$
@-6$~
b4^`
|yf%
LJWc
$g{/
> 2 0 M
71$e
g$;v
}Tl m
B,;Vb
ca -"
:KcR
H\H0
sQ3|
Yy6=
u n.<
SYHB
^Hb8
^J 0
Pa1&&
W1'en
=*Ay
5}oY
KC63
"s]W\
aG% y
Bt^<
W]:A
'{!a
y) xFG
TQkp
t/ R
4}Y
yJK <
SPe=*|
K{&T
IF-
aGEAu
! sS
t-8r
y>FW
r!N?
+,3%
,GweX
Wttu
Rf)u|l
VMKq
q]FL
hV2!
A(8h\
ltQ$
1i0
$avEW1AydwgtdtkCXgCxR5EP1BrlGcFdpUDKF
#V9w=[
6Z?r9
4]lS
nRtL1
S+E'`
H]Xa
N2QI
]_((J
^]4jv
B-Io
.gw?
hl|j
AddRange
m?@N
>"HW
H0JOy
M*h*h
qN5[
jQ\8
qq*^
:1f7
khmG
j}At
> 2 > ( A 8 C $ . >
]VM2C
>i^81
I63N
Q`l >
cf?]
udN%
D)Z
_82r
&u%v
><0A
8khC
"iM -]
s7Bz
M4 4
>DX
/,EB
_>A6i
"R84:
7[,
K+c,U
lN?,
o F sI
K2 MU
G}@$
oIg
q(J?
Lscz
/f*_N
)|l{
Oh4B
lgI}
KxRaH!p
\5lH
OK5[E l-
&aG[
Gt-~_
_s,a;'
>~!fazO
; Y)
F:4G
}` Nm6c^A
^Z6O
Pm}q
Nt-R
"?U&
$GI&G
ttpf
gj{6
tHxI
+@-3)
g;` \X
Bl/K|
Ed8/[
F>B~?"
GT[HS
%I ,$#
c7<' {d
>yqp
Q{eR
System.Reflection
3Bar
FUX81[& N
Z;rm
R:mp
.Kd@
E^mZv
l%EA
!o)Ct7
XCxt
YWtuXI9
h=D[
j5[_
_' *
L@"*
pt.[T
}>:l?V
DateTime
<\uj
45X"
lt/Zb
/U, 0
CTQ@
c'9j
K_Z<
Iy7S
kzkML8-
Q\ Z
jg3P+'
/g2
>X+
uqm]
8kZP
System.Runtime.CompilerServices
l 9RI>sN
feW.?
.m[{
wT0
wvB4
LODVT+g
Object
WA#M
-~e(
n%_s
[0vs
;T&U
L~+Ps
:keQ
LpBj
bH:C
[Cn&^`
* ! G
X?8O
z)Y%U%
N2nm
\ z:
_&*>
RoPe
(V+F]]K<2
o! m
/ V[
|+TT
b"VM
q-
vcL9
%T $
b'.05
'<"x
{mQrj
2]6]..
26+7YJ
4^LE
*&*t
{1QQ
*l&m5
x:L@
|NEw
4-N".
eutR
hPa
yW;\N-
_>+4
Jn%$
?wpN
%,%C
tw`1
b?S V8
VxCJ
5Z[Q(G
kUA}
@f[6m
7%ZRA
!Z4
Wy{V
#sHj8
JSdZ
J@iE
I * @ 0 >
h3S
OG3C
k&6<j
KVpU
(PFx
)L8^Y7
#Oi~
b/^f
Ga?B
P;qE
Br?3
5y?BP
WG!
` EI
6f!I
z #_
FLK5
zne6!
?k`Y5
%o;e
yov{
g`f,
wf P5n2
kz;T
@Y.}
i a
Q>yv[
wc*7
>4i#'
4f=`
`"GY
]^ W
rq<$
Dor o
^\0q)
get_Message
!This program cannot be run in DOS mode. $
^39l
&"i
`n*0
:t&h@
m~")
S #$
of djl
!3J#^
[o)W
jvD#v@
39Ts
<0*r
AI&g>
+GP=2
fk62
TwRXN
q-gZ
P @;?
81ZR>
I/N3<F
9Cl*w
}AM &
(oyU
>3~-
/1MF
R{W&
nm6|
(S(XNE +
), P
`tyxHu
_fC(
T#25
)9:
#N[0
v[:c8a
M +[
S(+H
`yT_
s# a
~K_xZ
0q\.q
5^9B>W
I\U#{
`>PJ
H`O*
M(<T
n}*DqJ0(5
f:2'
l?.F
p<kY
7=S7
Mdh_})*
A2R
eOiSP3vK
yP$j
havyE
Swnf
#GUID
#Z-h
=E,X
I`<u@
nQRy
H IR
rLfnCr"
-zZ?
4P5r{
.Rl4
Apc_db
cp j!!Y8u
3lXT
Y<4q
fLt)
Ms'\
\System.String[], mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089PA
BSJB
tY@s
vfNWm
: z5=
eXg
/)Kf\
emTZ$
@ S|
5f|)kW&
:, S
iaXw
MN~b
V QJ"1Z
% lhs
kEF"
Mpoi-E
-#R<
9,;J
C&qw
I|{f
^>zQU
xI1kp
edTi&E
)`Eh
?4B!C
}\=b
?N<<
TdE;
kn<L<
*[ Q)
*ZL9
-BtC6
w 6.+
(*=G
N%$<
Btl,%
6~T~'T
?)JZ
m+~ O
o0kMc
[`0F5
D3pS
y3y%
FJ"L
\zh9
mlupM<f
h sr
!OJS
I G_
}"R#u2
Z@R,
7{kW
I<#A
?d9,#
FhwE
: oF
w,jF
[RERr
2(M7
H;~*.:"
}1z9
q8-b
@\I0
nRJxymO
=1s({N
!c' x'
x]bX
YLE^
& m
,WQ
0*3+
.)0?'
]x3A
aDDW
BUT
9?6F
RijndaelManaged
;lGI<
N1NF4kX
9c~F
, Fs
5o%0
|Hi 2
5Hk/}^
zs+0<2u
v:&|0
['2
W|zt
a{<^
V2ny
0e N
*Cy'
)G:}uFO
nY9O
w?L@[
= Ro
T26
\4 J9
<g}S
b9*{
\ ~W5
o fLH
=rjaI
{ )5
A(1s
Cn]p5
*IR~=
g3 x
7&k
UB!h
[\3.A
!!~[
!j@m
0Sos<
g=Oed
IsG<mN
!>0t
set_Key
tj0\v
<+Hj
v}:b
o[I|
Xl
hl$F0
1p7?
vh t<g
$K
!A+*G
w3/h
F^9~
2}iN
~[!r
8yfH
+`AW
QG8R
bsf4
b@(`
LsWHA
S6u3
6;,wh
knzbe
JV'DC
{Kes#
8T i
T:3I
(} T
cx~{
MethodInfo
UZ66h
#eO[
$t:1 R
[RT2
N p0
_BA4
4Vr%
{+J/
peI=?
?wq$
_\{hk
3tLi
p ^h
K}`Hy=
sC(
3vHB+#
%6Z
.PDl
6I0ox
LFG
QO9j
O0FH
% $l5
;`}v
[BMA
]>p`8k
""7h
I>/[
FR+}
9G5
L q
SGW$
W]<0
.!5G Mz
WcN]
?wqf
L|Jr
10 wE
9UE`_j
q<e
;C<
FT3[
~L}'
] R*.E
0ii~/
]H
L()=O
J_>4
zHGS
'5$c
Tg>G
yIH#
HNfN
r_`"a~
SP+f
W$VM
Qz m
wj}k
~]Ew
LyA"
1$SC
2WGa
_V3]
I[6oPS
<ac
\>Oi?,9}
>pV)n
tA_te\
W>-)yr
y;3
AXHM
PfLk
^T`;
ihk
uT7 i
R.AhU6
(cr"
kCpC4
|jS
jy]
G_{@_
*`}V0
` BZ$
k FL-
fi`7
?q[Nx
2s S
.*LiF
V|!2
$.PC*
3oU`?~#
78B
"0QO
2k R
!bT8
v[ufN
f#H
$v34
RUd*
W o40
F4>'B
Cx@l5
'@cg
F$6p8
aaC+
oPafSXzaCcogdCPNDx9Yk0mqmriW
S97G
jefI
:`uZ8l
eqE3<
7;1
V:9:*
pkS=
5u``
r]DH
.TNSVW
;wr$H
`qLz
GNw@
%MrO+TT9
V1 g
bS;9
5]*:QR
8D20
Q?&[
9NVt
DdHMCd
?)`Iw
Ta u
>$0X
L?M3
8Xc;
~/x\x
l ^l
_C4&
od!`
vt:
H~DW
%V!l
$4WB
YSNo
=L2;y
Ri!%
8gG9
Y$] p
7hrq
bMCI
R73FNP/#k
KsCU
+&XL
5gM{
N`v(
15"g
.!37q
9vRo;
*w-#
lkK7
9wo>3
] 6 *
b!Wv|
!Wl?
YSkNXNsYVLaAtoVVxlgK
<MH@
t~KE1
ob
X"N9
#&gX
)}jo
nUH}
4^Ed0A Oe
bGUn
Z'
Gj=*7
I$uQ
x2H|?8=
~KJ,
9 0h
pv;$$
System.Resources
|N$y
X|Ek
b>qF
a#Yf
2duA
fk\z
MuUJgQ
7L{4
^[Jn
+#%>
&$IQ
d #$
LFT+
/2]E `
))/l
R;Z
5#7r
l_ o7
@pc\c
gpBk
URR1
CompilationRelaxationsAttribute
B -~`
z% ak
7P;a2
>qt?!}
dSAs
uKMC
`@c#
jwDO
P Ts
v^,l
& M _ $ (
Z%v?#
W*)4
'3-S#
hE^M
,*m_
g :>/WY
5H`Y
(D)'
= gW
3X"
eo#
Rnt3\
|@Qpr
.({T
'|7P
mwvFH
&6w'
TULw
"4.5
<M~b
"o<*
{)QS
ndwl
WKpk
n:s{Bx
0ZGk
ResourceManager
oCt8
d" j
O@UG?
Cnr;
UTVl
XH7
x,O>
{(/d.Q
Nz!c
4KQC
2=sn
RoY+&k
`R6z
R`be
K7a.
h];u5Z
L`;XW
% (A
aJ0NB
HBV%
j7CW
-{]=
,n`sp
> 0 2
:,-U
< !
kRif
$,Sv{
M gN%
3f3w
+T|v
RYga
GrCc
oxd6!z
SPq;
nV%JU
K> b
8yQ?`6[2>XS
aB-}VW
d3~bx
_CorExeMain
_46(D
=[J@
}TY
3F=T
RB _9
z74
nz/^3|
[$Y`
0]B\
Iz(\
<R@h
!\ V4_
N8!|
4Rou
G!-%
;G37
(IG|
osP^
EA7LR
4&&V
]jB{"
@^
_PaF
xr+>
w:*6
%\ 7
z,':
$'4%
7zd\'_
pWP+
x1%/
<-
mD(!
^Hic<
7W=k\
$@/5
umlX
/L 6
y'&Zg
D%Uy
9*]d
_PrN-
X}X>'H
o k}
ToArray
{eK=
$g)[
d#\]
jq8p
F,4tR
n3T7
-+4gp
IEnumerable`1
6 >/
GpjS
\4hCRU
Y~# .d
& a9Ob
hp6n
0HgVu
U|Ot
P:Q@
7}Be
`[T[
0MN<
YZ~#|
-",R
4L{)c
,LpC
V!?C
=vC$-
e;|A
Fl"WQ
1V<C
YU=%eN
bA4V
mvyh
=s W
M9"!J
KR)0"w`
ryVZHtiT
&Z{w
{Pp#
/r!u
YW`Lmq
yb=}JR
-eDB
8Dts
r]l 8
gaVSha)
7qOGImcr9CSEs9CMqXwK.resources
%[3y
!-_Ft
Gfr.H<
P CZZ
!,B{f"$
0J #
Q0Y8a
w_#7K
|tW?
,3(#
~' R
Y 6e
i;Q6
c]A]
OW?8
_h .
\~V%
/Nn>~
lBV6H
Materials Drawing Specification
E]R"J
61{63
_+y
HE@2
S3q9
6029
:![wT
AeNDq&
2s$a
KW+)V
~a#Y
/`%n
N<LL
s?iS
2*#nS
>f$H
\!,x
TMI~Z
Ub+4}4/&
Bt{\
g2kt
c@yjc`XY
E>~$
?\k4
>4sf
bi%/\-?
{6C@}&4O1
izCk
S[.b
$m%A
`p 65
NO73
5_oe~W
-M8
(-cZB-3
&/5,
ETdz7HL4Og6HvJUDSPm2kL5
1[g(
CMfh
0{E\
= XH?
{k m
d-s#^II
Q^jsvQ
u1.v
kX\j]W
|=Z$
:m4W
BxMdakd7G1nwzOBZNfvdpI8
>QZa.;
!JP+4
Cn?<V$K!H
RorhN
pmKvs
.Upr
f:Or
B}72
icA)d
[R ?
@a>T0
fn|)
.St:
K )s
jj_k
GjP+
-]E-
YJ@K
-ag
/R4q
[iJm
O'1y2\
fEJCV
/mOk-
%YS
( M 8 M 1 M 1 > 3 0 M
/=e;
}u5~
`*jNV
mg0R
ck++
;1)9)
_c;+
.6}
_Nz"
hxE-S
r7#5
%vx/
,-Eyb3
,^$ g
?.ek
r^>/,
*h{T;W
?K`>h
P\N f
23; k
oFKx
-aRj
Z83f
3|]Ci
e7A
JAa^m
u@)@
|$.]
-D$q}
c{fodh
]8f%
(Qp.M
^/Em
HE4FC)
LbR{_
V;_6
Zio{
oQm J
0M%]S
3f k
) qJ
<Ni.
XVXF:
P1^E3
;_wT
M#>W
"C$ {
=oU(l31\
e`K=
%04s
0 #
34O|;
+3.ADT*
!;9@
'xOf
j(H1s`
=B$k
I=Js
!u*Mkz
cbg6'B
aY]{
>ZoA
*gw
wRW{(
N[\N
~2E}
6a5$I^
6hB.
X'v P-+S
<=-n&]{U:
tp(o
>wMb
c7+=
SE &
~4.K
-i=q=
De d
7Ks%
zxH80N
+$e
h%_
~e(H
%V)I5m
wz4j
O&*3
t #,
54he
"_)m_
=N8!
*mr@9
M^PNT\
2nk*vW}
F ;q
puG8uZ
nl/v)
qsM
0~!]Hqz3@(u
BT r
w1AVS
wZ_z'
+#*K2
8/HL
x. sy
9&b-h
A"=v
fVJ>g
g2/}&S
"! P
b5Zg
+OO&
>)Ac
$G)l
|QZJ
Q8/=
5 I
7N'a
t*){
p-\`
`2>4k
[#bt
yk)8c
pQb]Y:#w
)SC
+yb
uMj,
eozc0Gy97clrU5fgQkfotPCyWGxqwXI
|*7<
obyY
I#fK
[3'A
zhBs
;Kc+
jo#?
YnkD
5wp-T
Bcp
j1=
f]e.
n\M|
x!'&
% IP
>y.)
[3(e -9
R3U+
o?E:i
"f]t
c!/
gVw2
0[DEU
ZB?1q_/dI
LH X
m 9>
_VHI2Y
K+9E
c7!_z
u-oTx
36,Je1N
CFL`R7>
?W W
22nL
.\8z
g/ql
EKD *
>|cF-
y:sbx
-S
dn+f
}3+ a?
A" &
X*bg
qB*|
(5<0S
eKi_C
RSff
'P Yo
n2gs#
T+O_x
PUVCLB N
[&#qn
bV=ux
~ *n
`~B-|
9+N(
`'82v
4b};E
GV,
ZK}^
h&3
COQ_U
F8`
j>_fb
p-tW
D7i i*6
ETTW
mr*y
K\qYG
D6_4U
>/w:
j7o (
*s^Kl
mFn,U5
K:EH
;V~x
Zu`f
fpKP
tDhP
sGB9
XmS=0o{
RX<!
Nrz,
Ri":
-K!L4u
yhpj
M<|E
io3!
?EyW`
y~k=.
)2?hlt1Tl7
"iR4CY
#1X]X
&UcHTGfu8CCiqe9pBWsSzOgzG9kXlfeVa8YQRfj
rHm_u
j'=C
@ \"
TZ tk
i"Mu
}WZS:E
JAq%
X` ei{!N
V7~lO
qZ:g"
set_IV
g'.
p?3H
](*Xml_t
e$=,
?zM1
FAA9
=&V5
F{+0
|Pz@
""2y
.sl}
=P51[
adcK
^@oU%C
{x]yU
H@Rz
~BB/
: TLXe
Ive8
nRv7
|z$^
bT
gh@
'5 7i
3^M}s
%
] qW+
(9j
Ud1P
>^&O
j]%_
^bp
(f `h
Di$&
c,h- uZ
g"ehT
_|'B
cl<0q
Rk 2
-:X]
BNcX4qD
_+fW
.VG_
l,{emqfD
- Jk
E<4:P_
q_!e
AddMilliseconds
D*Ce
#V)@
v2.0.50727
=[w-
]Io'
NZs{GIw
X-<|J
Ym0@
h#Y7Ol
')ZxO`b
~( o
u8%<
cq$I
iafv
-5e0
^<H8
Y#f
*t=$u
`s B
cbC|
VnB6
v`cO
"j=*
#/#jUsqnQ
X( HO
CUR}
AEhe
NUWN%
2UJ2O
5aLo
sAHx
4z`?v
d!2{
qZU/
Exception
DfN V
.#IRL
wh@9
0&oFOwW
G)6H
[)[j
T<;x
{#'9
g Nt
h>mLD
@!E"
&TCj6
YT@ow
:sZ>
K+T[]RK
',FG
`tjm.
Lj E
")p9
C`#`
QD4Gv
pRL{
GetTypeFromHandle
Vy H
99.v
<Ww)sE
Jkz
~g%7
:5)a!-
(y<jvY
g^kk}
-Po0
.uW1
9'*b
+d<s
]a`M
2` a!
sc"r
?A"SSt\
jWk.
8p/-
`//SxQR=
<&&q
-#ZJ]
qNI|6n
}vXp
H9-H
ouLZ
M'KC
62wOHBDLv2gQaBw74d8asYRDn7
t@S
C(6I
asC(
0rz(r
Shi~
"0T=
^Ow\a<
D2PE
ZAN)
mu?T>
|W
M7, zJ
#tbfsTtgAKsrZ9hJV13LVSGNkG0ne4JWAo8a
[BbZ
r7j
#JK1
Dq4Y
[oR
0P&G}|
;ka 5
c `f~ 3P
Ac;w
O7%Hz
.\Kx
7vI|
[ <d
}z$!V
}A@C
MM]WP
Su1K
,m-:\
,%]"x
UO#&YC
T(XC
YAQS
\zYT<
,N\q]?=
rv2K@`
X&j#
*G -l
^q0^
ksyLL
C>wg<`
\ [x
L@G
)t 4
+CP>\(
Hnk>=
HrCg@b g
\% ~N
6C %
l4=3:
'^8i
(&f{A
AbVq
-Qwu
Z{}Kq.Q
;~/q
Ws#r
;%Ws
&y^A
(WM=
kl%1cYB
aD6G
8jNzc
']{O
g+C V
plS9
d?`F
~a7:
dp4)
7mF8
Ilvm
z}b#B
TjHYE
Wx 2
+>Z(
d=lE
n3N4
bDFE
(jMS (
O Urt
}2P|
b-Oc
x M`
$.-u
xzGf
R1ks&
D 2 }
N.9f
.WbY
, c;d
EI-{]
)I#'
QA]k
VG^8
ftu m
8O+
Et8G
npBH8
K*g8a
l ";4?
>j`(
Q%P/
:O}@
<4aD
@Q%pw
~d #
=2-D
R<d>w%N5
f&@Z
79UJ5
TransformFinalBlock
td !my
,39"
#7UY
{FR4>
fws!
0UZ
M}Um
uCAO
xc/S
_:>uG
S01 :w
pIpu
=R/)E?
p2~H
@(f?
#T5O
4_tg
w iM:
^OvF
36b2 :
F2`'
~/HD
/+Cq
{Bq
z $T
dg]5o
vw`r
W/!rd
"+%{#W
+k_I
IP=<(:i
}s=W?
o>r=
1:4R
MM2>6
}^<o
F:4
6[Qn
2,es
*S=5
H'tr
>H%V'
6V3K
OKZd
NEk<l
?(B@:
k->1
B4w:
mscorlib
x<a3
q1r2o+
|?o)?8O
5*Ds
if\ \
vKA
|L{!g
g*RB
@y!v
;eFD
TffS
3~T9f9w
< y;
;;{j=
Lvi y
"Bg_
*nY!O
C.5T+u
cSV$
If H
HumG"
AGPfI4I26K2aZ1JEBb6P6XWn6
a(d+;
OiY
Wkjr
"f5m
=S!y
Wrh?
)n?Y
UHu1Y
'xD j90
'.h
%K8\
OiCF"
FH.gw
SY?%
{N?n
F3d- 0
ORe1
s*h'
69.h
sshe
*z"Q"
nY|2[
J@|q
QT b+
8Xe!
Kl*-bN|?
\[ f
A?Nm
jm#B
xzDHV
+: ~
m5d_
qdg
Xyr
9~1&w
E _Q~
H%,vi
Vao
\l'7
=FKS
g\g0
PD
YwT,g
oop
A<Z"q
;qaN
J bM
@PE[;
w|cL
S);T
gff+
)Omd
'kQzLYg1LPtDlJ9fnkhqTbRBXL96wlOHPsgyHEUv
L< aF
@i4_
{XB_]^j
MT"N
>xj=
lEE(
^Zc2G
pQ32b
Ui.C
A.>W
^L(2
f{)^
NAde
?D dE
G_9$
; %u
G3 HjN
`0 7
&,Id
Lm#n W
R$}>
7yp5
.=\*X
;= ,
eWUH
cXP(G
Y|uR
5`3^kK
]U32
~NP*6
[2<U
iu5"*=
(B@g
3i P7M
WE9r
88MH?
)X7W+
K:YSn
5yN;
rq;
/ T3
v\zW
z>`/
;Y#H
6wfQ
&C"'
k)Qd
@Sh/4
zv91
Kf;dCz
470?
fw-R
lQ5n
T+^
$`+&
% $95
5hr8
`WQb
cz=s
:!{{
AT)Z7E
=F>F
|)_T
:~{,
xfT4
a|> HG
KQ|T
86a;
RkfE
i.Mm'
27I
\0!]^N
YRs5
-C,P%@@
`b=
:YADc
get_CurrentDomain
2B]7
2ojq6
\^R
Y;jj3\+Y:K
[-NM
f}]p
a09k
szF9
2P6Z
& I ?AC
SO(d
5yZ\f`
,+%<
wN+]
&\n*
wKha
-z)KKk
..=zY=
Nl1%
8 M
GVu}
yAx;9P
LJX`
[`ZK
M>!UR
G|iv
61!D{
Ng
^clu;
iJ!p
z),J
LJX[
8"<L
KGN_
.},,
.f>S
|KWA
n$uQ[ 8
jXI@
PjS(@;#
0^{6
uOx_
xPx]
7N
6/(d
ZZEz&
/hRb
!'<B
6I{=
uP n
-DIHm8
]^t,
q<Oj
aQLv
_i\tv
owE_.)
OX`L
032 P5
5.FL/[
77!B
@]"|K,
"}1;Y
P+*:
=bgY
x5#O
,zsG
vJD)
U_RH
/@Ma
wFPy/
mscoree.dll
L-Sy
U/CPo"U
t{m&
& N
System.Security.Cryptography
[hn1P
Zll Hg$
gx^+t
mY6!
Z3|*:!
"HVR^
> \t
q4{Pj
'_Ie
~qX$m
#/ \
j )W
uCuQ_
l!kBk0Q
Ou+hyy
\]@;i
zwY!
|0G^,
:Wc
vjkeOeuYq3996UBGKKPM141xKSptsxub
yH p8
%-U&E
cuY=
td t
~J
=r+I
m7P&
Dk__
AjjF
& (f
PfuMjW
.( a
}cj4
~mVO
"qL'E
I 9ps
} J\-!
U;&k '
R=3L
_1RF
#m;*i
"8~
4>(UmFa
?:a
"sv
w`LEao
N9(|
oI Yj
(aUVq
Y"AD
|6g:
Oh"c
!uQ/f
|gVl
2|7BWPb
{mxk
W b!]
_O!,
5_K
FH[K
%&04k
p:~`Z*z/W)
-s__^&
,p?))1o
0\:)
/3Q Rn
hpsx
|y" =
]apM
s[^l
(C>m
1zcI
3Fd
c0"6@0/"
& \4D_
COY*
j$1kV
ld.W!
l/?9IR
sIyzs
Gm'~
:V{$
QE[2
^ uj
AA7X@
t;m+
0hG
nhlv
fuR|
vFVD
:nXz`
p *.?:`
hQF
srm8
.^^D
ps$F~W
SNTh
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04_64 Seven04_64 VirtualBox 2018-05-29 04:25:08 2018-05-29 04:28:03 175

5 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04_64 Seven04_64 VirtualBox 2018-05-29 04:25:08 2018-05-29 04:28:03 175

8 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\Materials20Drawing20Specification.exe.config
C:\Users\Seven01\AppData\Local\Temp\Materials20Drawing20Specification.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\Materials20Drawing20Specification.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\Materials20Drawing20Specification.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\System32\tzres.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\Materials Drawing Specification.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Materials Drawing Specification.resources\Materials Drawing Specification.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Materials Drawing Specification.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Materials Drawing Specification.resources\Materials Drawing Specification.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\Materials Drawing Specification.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Materials Drawing Specification.resources\Materials Drawing Specification.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Materials Drawing Specification.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Materials Drawing Specification.resources\Materials Drawing Specification.resources.exe
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly
C:\Windows\assembly\GAC_MSIL
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Users\Seven01\AppData\Local\Temp\RunPEDll.dll
C:\Users\Seven01\AppData\Local\Temp\RunPEDll\RunPEDll.dll
C:\Users\Seven01\AppData\Local\Temp\RunPEDll.exe
C:\Users\Seven01\AppData\Local\Temp\RunPEDll\RunPEDll.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources\stub.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2384.33640906
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2384.33640906
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2384.33640921
C:\Windows\SysWOW64\ntdll.dll

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\Materials20Drawing20Specification.exe.config
C:\Users\Seven01\AppData\Local\Temp\Materials20Drawing20Specification.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\System32\l_intl.nls
\Device\KsecDD
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\System32\tzres.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\SysWOW64\ntdll.dll

Write Files

Nothing to display

Delete Files

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2384.33640906
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2384.33640906
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2384.33640921

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Materials20Drawing20Specification.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\338f4e2d\48f9b42d
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\114dd8c4\1866862a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|Materials20Drawing20Specification.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|Materials20Drawing20Specification.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|Materials20Drawing20Specification.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\114dd8c4\5b984910
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\4ad60644\6f323003
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5d1b2185\235dd0a9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5d1b2185\9e47f51
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
kernel32.dll.GetVersionExW
kernel32.dll.GetFullPathNameW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
bcrypt.dll.BCryptGetFipsAlgorithmMode
kernel32.dll.GlobalMemoryStatusEx
kernel32.dll.VirtualProtect
kernel32.dll.GetEnvironmentVariableW
kernel32.dll.SwitchToThread
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.GetProcAddress
kernel32.dll.DebugActiveProcess
kernel32.dll.WaitForDebugEvent
kernel32.dll.ContinueDebugEvent
kernel32.dll.DeleteFileA
advapi32.dll.SetKernelObjectSecurity
advapi32.dll.GetKernelObjectSecurity
ntdll.dll.NtSetInformationProcess
ntdll.dll.NtProtectVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.GetThreadContext
kernel32.dll.Wow64GetThreadContext
ntdll.dll.NtUnmapViewOfSection
kernel32.dll.ResumeThread
kernel32.dll.SetThreadContext
kernel32.dll.Wow64SetThreadContext
kernel32.dll.WriteProcessMemory
kernel32.dll.ReadProcessMemory
kernel32.dll.TerminateProcess
kernel32.dll.CreateProcessW
ole32.dll.CoUninitialize
oleaut32.dll.#500
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister

Execute Commands

"C:\Users\Seven01\AppData\Local\Temp\Materials20Drawing20Specification.exe"

Started Services

Nothing to display

Created Services

Nothing to display
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04_64 Seven04_64 VirtualBox 2018-05-29 04:25:08 2018-05-29 04:28:03 175

1 HTTP Request(s) detected

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
  • Hostname: www.download.windowsupdate.com
  • IP Address: 13.107.4.50
  • Port: 80
  • Count: 1

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 86400
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com

#infosec #automation

TheSystem Itself @ 2018-05-29 04:27:20