MalScore
100/100

mnm.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 27/63 Related 2135
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 188.00 KB (192512 bytes)
Compile time: 2017-08-02 01:05:53
MD5: 2bbbb520e5c7129f24491d4a6c80df1f
SHA1: 769137709d3fe6b31a6e7a910370e5c8205d6563
SHA256: d671ac1756884d43d98a7e469d9c055f2330da7a6ffa6cf88517eb3519442d47
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2017-08-02 14:21:08
Last submission: 2017-08-02 14:21:08
Filename detected: - mnm.exe (1)
URL file hosting
hXXp://185.208.209.177/mnm.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2017-08-02 03:00:26 [27/63] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x21754 139264 1a92f26228c299d5c240a940336f93a3 2eaebbaa5b5c56cf97bac39d85e0ad51340d1a4d
.rsrc 0x24000 0xa498 45056 f915ccba2b9cbf22a17fb632a78f078a 4fb7cbe76cc204c7ff3908683b535bfa10d9fc7e
.reloc 0x30000 0xc 4096 f451f60c6847d37f7216c9f4bbf318c3 e9c1150586d9ee3f4844a6a5c08732c0a489cd78
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x24418 41064 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x2e480 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x240e8 816 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright @ 2017
Assembly Version: 2.2.4.5
InternalName: sFEdMKaQ.exe
FileVersion: 2.2.4.5
CompanyName: qcfwEVTlg Inc
Comments: yWZvgNhzEjVqmpFvjqJu
ProductName: qcfwEVTlg
ProductVersion: 2.2.4.5
FileDescription: qcfwEVTlg
Translation: 0x0000 0x04b0
OriginalFilename: sFEdMKaQ.exe
XOR
8 60144
1 60144
2 60144
4 60144
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Temporary
X:\GtFbTWVyBpALYjWiVt2GtFbTWVyBpALYjWiVt3\GtFbTWVyBpALYjWiVt4GtFbTWVyBpALYjWiVt5\GtFbTWVyBpALYjWiVt6.tmp
FIle type: Library
mscoree.dll
IP Found
2.2.4.5
0.0.0.2
URL(s)
No URL found
2.2.4.5
VarFileInfo
linkLabel3
System
Comments
textBox1
textBox2
textBox4
X:\GtFbTWVyBpALYjWiVt2GtFbTWVyBpALYjWiVt3\GtFbTWVyBpALYjWiVt4GtFbTWVyBpALYjWiVt5\GtFbTWVyBpALYjWiVt6.tmp
sFEdMKaQ.exe
Username
gCVePxbXejlYig
InternalName
FileDescription
StringFileInfo
Translation
checkBox5
Assembly Version
FileVersion
VS_VERSION_INFO
000004b0
Form1
ProductVersion
Team
Output
OriginalFilename
LegalCopyright
kw'
qcfwEVTlg Inc
qcfwEVTlg
CompanyName
fqbKsuFTNHrfN
oxXaYfBtBIaDWUHRqJi8EsuYctBaEsrwI5
ProductName
yWZvgNhzEjVqmpFvjqJu
Copyright @ 2017
Click
T;}9
!wJuXGXx
T;}6
|8X=
T2C0
#"["[c
x~\y?
q-o.
8xZuWW
3tzC7v~
i;B;o
!w<Z
&0.0.0.
P[t'O
wl[wvswlW
%t p
me \
U{gm
C Y
x[<F
y{jAS{mm
WmPkrrQl[snjg
3a6
^gHwW
r!eXt
x(ag2G
NA<N-U/
R!X!Vn.
(wC%Q
Y u
t]i(C
<!Q)Y3`$q
hW*w
;C j
X9I9i
{ G![
i[:i
H:2o
p`3Y P
uwv7
_^y?G
zhs;
Z?%\
P!Nm
Xqls
r& o
sI h5
FgcyExx
T3F
|MyX
t\|pwe
9G4e
;XuD|
=x#[#
"B+x
` &.c
.v9I
7hwrxcSxf
miux
,9K)Mla1g
o x.
D/u<
wgv'haGnW
EF"S
|kxx{lMwd{
f~7w
n>yZ
6|W6
/+2K2
'kyu
Q&Jl
iWS[
Vx>k
[!%3V\Y
M*j@
IP2X
w$K:
s5q8W
tVwV
K|8S4
}na<o
J++[ A
Jgn{
x1bw
{33h
1$H5
flxuH
04nA*
"Sqzkr{
s|xsuv
System
v/N>
7wx3a3
*B{l
EZ a
]i*|
7hwx
m ^7
:cWue
M&|%
qV1j<V4
t cN G
@6d
W5[;t
N os E#Y
T>T
gg2x)kgGw]WuS
}Zcz
p ]R[
Q3vVF=VNT
F1o9X(X
xuwS
]:d;
W88`
Y'!/E
Z{]lgnj
-3W3
S<|?9o
3N)s*
rS/J0
pwx{mjL{mqkl}{P
System.Security
2h15
<wi6
5O.]
7G7Vscw
/9X)<
" T>T~
mrqiSmV
I<N-U
08kf
wwSLwB
9;"
mscorlib
c8U6U
_Z'7M
xvqu7
;k6\
G!C*x)M5J
N!g,J
v,J;
lrvq
Application
x=0vwgXXw
3q8YS
3Vm8
E.t-0C3c Z
n^9@
t z
eXlvZDv
ew1Cw
f\uI0I
6MGhk
N'u u!Y
n F<
Xw]v
Yius
x\PsV
)2uY
R4f<
e,LP
s+KBt(B
"ghqz7gc
EnableVisualStyles
set_Checked
Jd]w
|/k>[9@
]qph{lmwqpm
'7Vg
5i9c
l>GG
Mgmj{s0Iwpzqim0Xqlsm
ws0h
8gVwb7Ga
,ALs
X\gw8w
Lkpjws{V{rn{lm
[a!N>Y#
AssemblyCompanyAttribute
g(k3SKI
5U7Xd
ws{#
y{jAMwd{
ncN
a4Q;B
ggxx
;u}8evP
wpmj
sK%v2g-
j0nH$c
vuxv
3TSF'F@
Mgmj{s0L{mqkl}{m
]gp7h'
W7`W
o t
\Us}n
}wWs
Z`0E
"3\jY
O>T
|.Ww
nwk5Z
xw5~
n5PyD
vDd:S
8w7{
m9j6
!A._
d.H+
}e6W7W
MSs
ccnt8
5 s4
$y(~Y1I
xwZ'au
Nlq}{mmIwpzqiMjgr{
}XwUec
m>z/J
J#q
Xwc6Hwv9%
w C)p
Zk]v
gYt}yGgvr
>SuE
c=lX
fG la
7k%(w
f7u^
#kNi
S ^&
)a N?
N!g,
B#SL
x[XV9Xf
'M_rw*p
&|kNt
Q<&_ j,g
&7u7eHK
##657vX
w$O L
p#K`
*}q57u
Jlws
'2T7O
7XvX
}qpj{fj
AssemblyTrademarkAttribute
X$k D
j8Q
Vxz 8(t
Vds4}f
iw"J
} ]7
M. x
?/k?
L{m{lh{z,
L{m{lh{z/
xvg;
L4Y,0n
cc(3V
UnverifiableCodeAttribute
ad{8
n?V'
t5~r
._ g
cQ'W
l G:
MTZC"q
w<WW
f|4S
aZ2
&F0c'
USvu8K7
g T&
Zwmnqm{
wv^6W
^4Et
#Blob
Control
Mgmj{s0Zw
m"D>
SjTg
d|0~Z
K%`(
Yx:6xxf>
z3X
v[:[
wvw|
M+Zs.
U7~sn
7uVE
p[2I
7'c^
WhwZ-
vE[yheG
]<wqC
L{mks{Jvl{
w467S
Y Y
%R#pQ*g3W2
CGUn
wUsx;
.hK`~
qc:5
get_Controls
p*kG8~+
!9yr
i[:i(
7lU7
g4z7
m7A
Type
f4M4`
xmw3
2uhc
!"6]
~9}m}
`)o7
"S)V
s3hw
h53Zhz
L{ywmjlgU{g
Ei;B;
-N64
&@!E]
s4x~v
3xMcu0C
~3~U
%sW68
w'3w<
N,]*
{<+N,6
+\6HC
c+(AeXx'T=
l?\I
nwws
K,~A
Cursor
d "G
l](x
i8})M
t578
VgxH{
wfchx
ctwx
p&_&
.SRP
9! #
{icb
d-S)d
8vwh
;0Z .
Z\7i
c}6u
H'a*L
hO<m0w
&r ;r
lV:|w
v'~Iv
I}(68
w\:s
g]vy
7o-6d1T
XVv1;ggw{8
m{_zzl{mm
+e/h:\
GI'N
U%K8kExuc
#6$z
cwQ}
(2I<7
;ip6
^{W^gsX
xwjUw
BH >
y{jAZ{x
5!Op
{GUn#vXr[
!/K&
z_rr\gj{m
/k F
Skjf
gugx
|bV8Z9A
t%C9U~
wT>GZ
sm>x
h:>l
~[7R(b
vL(L5d
I/A(}
OVMp!H"
Gw57
g|xf
{s!=
O4r+J
8#2Kux
<@6c
sw8]
a2|t
G]ZW7FCX
q+J
n:BR
sfEV~v
mDp+o
k9zWR~
jJ3,K
nS<E
RF<o
nP{u$Jc
h,0.0+.),)
>wX!o
BMo;B k
aI;r
M2zi
System.IO
uN4R
wSw4]v
x7ZWq5
#RfrXx(}vSU
:J ~
$@;s
cxXw#S7Q
=W 4
5>T[
86P+IV
c7e7X
LkpN[
#2d MV
jCn,g
h^2i
C,OD3
dW[U
d7vm
)z>Li
.text
List`1
%M-Zb2X O
+ &V
}uuh|
xm=ew
>\%kTp
Ke7G
.D=o
GetObject
m<P
ua|ce
CCBVuuw
OQC
"0t^
u{lp{r-,0zrr
xw*vVGGE6
6hwu.
WyS:
vzXh{
rk{Jgn{
YXWt4
c*.}
}[WK^
ju+N
pFhvzv
@6e
Mjlk}jR
fdR!i
-~61
EVmY8H
"Z2E'`2
L{nr
PerformLayout
Rs:h
lO=d
J] r
q"el
7'K7HU
g8:o
l"F'
R T~
SWegx
{y~.I0v
nPqp[f}{njwqpJvlqim
W:Wss}
Fc6G
@}7N%
~k;Q
rXwt#
u _g
'M$*}
t|Wr
qnA[fnrw}wj
cA\~
y98w
wg8g
u e'
\u!Y
E7Gdc
F'T;
SgYlqkn]qrr{}jwqp_jjlw|kj{
C}gU
q:n
Z{r{j{
7m2S
yySgw
t2k
'7-~W
Ia3Z
x:nv
X h
-%C6R0
8"Cl
K#r r'
AYD
Nlq}{mmSqzkr{]qrr{}jwqp
@&u4a
c5]g}
r{pyjv
Sc{W
9D@,
gf[1
C {
2[9@
"h=X
izsu
N_ZN_ZN
q9i8wa
zwUYfwu
`.rsrc
:Y&W/
8_ `3
!xSw
8sqhxW
de| W
Y?_f2
Ewww}\Sc7w
J^/w6G
csF<i
8[6L
Sfuusnw
Hws6
N(uRh
^4HL
|kxx{l
h|gV
<[PG
}pJ o
V{ew
971P!
?L /
jw}_jjlw|kj{
xt|'E
+'8_
.FTht^8
7ix'x
x<>uy
s3qxHdgwtV5
74o7
MV51
gI,`
wx)
ZG?G
S+dN5#
a*4z
AY6p;
&t'c
8ceq
G>3h
P6}r
JqWpj{y{l
gnFS
V*y=h
xtssv
^PF e4Q
skwn
Qn{pMk|U{g
vx86^0
rn_zzl{mm
{9+
n%C9
g%Sw
Rgx8
T=oN7c
WpjNjl
B]6n6
]3r@h
x~5F
KiU*
? ,>
']8j
x1wU
D!C:
cxue
m G&\
D!C3
s}(u
utL}t
4N\x
Xwr{_jjlw|kj{m
d:K8h
xbxx2kJ\
[d<b
wxB;
O&]_v0i
x;S(
&r rR
5urGx
l{jlg
[fwmjm
set_Text
O O
uqz5
Mjlwpym
H*I1
gww=
XX\/h
e.Xx
c}wvn
]U#f _&
~^>z
wxsc6sS
;c;>}(Ww
W1 d6O
4xUI)Q
s w')
v.63
j0Qw
9xP{
2 /U
{~%T
hwwGawcy
\?Q~
;zi r'
|EP>l
wrE7{hcG
U0R(
V/a0M
fN4}
II1I
3vchz
WWU7
4x,K.d
5H@s g
7YKd
3x'W
#g2TmL
'Z5V^Wha
R)aS
xcxj
qsm8p
D/u9
x`wlw2}'
E=ED d
0JJk 6J
{/F=
u8xS
Culture
>-Ug
F-w.
!T}y
A){<f
vs8X
8F-k
8^Rk5
r2>Nk|rw}U{gJqu{p#|))
6S
zGxhfw&
hrI(N
uW)t t Y
R1w<Z
d\Wu
STAThreadAttribute
7c~'h
BK^N
PdR2u?]
Main
)l$C
)m9
get_Assembly
0WxUxx6
mw}0Z{hw}{m
xw:7e!xK{
$F<ui
W[pks{l
| _0v
kR!N7V&W
}$r@1
Nlq}{mmWz
({<\N
Wx^j}
sS(a
8r^3
hy}zM
x-H*SF
UXwu
~uXy
{ [
t.dC
cgVS
yx~sc
S $l
(vfX
Sqh{P{fj
3X c1
ppqj>|{>lkp>wp>ZQM>sqz{0
d5\B2
g$xX
Vwt7S{K7
Qgzp
'G4E
>d}fgGx
x;5\
`)Be
WrapNonExceptionThrows
y(^$c)
G C
szr;
c=Uxx
cD[ Zz
H'}$
O'T%
b?rR
Q(C;t
x!cl
Y{jNlq}{mm\gWz
nlqj{}j
`3] .x-D
#Z[ u
"~.Nk
SUvH
J2K2fi
Mlrxuc[
uw:W
WxRrp
U5B3
Lxwu
Q_2O
yd p
y{jA]kll{pj
F$U%u
N'r~7
nlq}{mm_jjlw|kj{m
8WW|w
shS.z
zemxfubSys
T5y7L
UUkC6|
h{|&
7o-c
Z0 u Io!
get_Wheat
7e \
)h3]
r0c;
hXSW
?*0,
GqC7g
KRAA
)K;K
(nhw
b3wSt
-lCE<h
Form1
n;]-]
l"{|h
8R&e
]Zy[kC/
vsR}
:+B8
System.Globalization
P$T
m{jAKm{Mv{rr[f{}kj{
S-H=
D%b J>
5^w)
d%Du
YV7Gt
5m d
@&t$
}Ww}XE
7ZZ{
h:RK0O
'6\
\q*s
vxWa
Huu}~
Ww&<}
SgJ{snr
jw}H
I"x!@0@
uUVw
's D
dGZnyPQ[VR0l{mqkl}{m
#/I[
=9_
j,g.
{| \
Z h-y
Zwmnqm{AAWpmj
[#l
<< Z
xw[FH
Mvqi
?( >
wgi[5
X^ p
O?|j
>e}U
Y{jJgn{XlqsV
z(Q*@8w
K{|YR
D8^4;|
dg0I
754w
1p#[
%] `
YC9Q
5+K8-
)HeR
j"E
r#Lp
System.Security.Permissions
S kb
<l)}Oa
v}7gW
x}|{h@
2Q^/t
MethodBase
#Strings
v0u}x
2{"|_
a,K.7
Ze?P
rF D
sX~mz
E_&t
wl8^
XwkZy
r|,R(}
= "p
p8_
e+JgZ&}%l'>o
TextBoxBase
V{rnU{giqlz_jjlw|kj{
[1-f
pz|qfw{
uMGux~X
Sg]qsnkj{l
W+\H
}c8X
uyWh
t-M:K
j'A;r
LgV8
-U>G
|xf8s6(
GiX\
J/M5
Sevkos
uwx8x36RL
fT*y
\wj]qph{lj{l
get_EntryPoint
hm\g
dm,w
nu9w
3eswhF%}s
xxL2
;| u`
E+j^
y{jAMj
r_O.|
us{V
. (Q
ZD(j o
rqyL{mkrj
N @z
wukw+U
xVhf#Wi
[:j^
D%V/a
%v/v
#Y!r
lWS~
J&E=
h*<r
sV:=
. hXO
$E5]%j
`.i}
g8g{g5
e2xVsT
WZwmnqm
RiP}sH
c%n
6m77
t3y&
u \0+
ZIgU
MJ_Jvl{
U-e7
%pus
5w71
2ncw
%U%uj
&\"wB1L7
hhz7
*m9]
J-]-}
KQA\ T
z] h!JSJ
P 3nL
9t?A
wy8Xguws<k
g2X
1w4XY(W
CYk?
jw|r{
7_ p|P!o
x7Vwu8hX
8l7}
WuK'_
`0u!
sV7w
lNlqt{}j[llql
o?RtX
86.O<
>6w|
)J-|
n }
O$~'F6F
<F*qsT(X
8g0Z
h:Py0~+P
V'7xtsw;
~z'`
WXFc
4bCLY+R
p}{AA
!S6u
String
"R(}
set_Location
vr}W2
Color
Y'XuF8vV2>
Dc$o [}q
U3ah:@
[6m z
H$c)
Q7e
E*lO#
Tu`Mwe6
w4rN
ljs{pjMj
#7WiS
pYL8o1
set_BackColor
Mknnl{mmKps
DebuggerNonUserCodeAttribute
I_(#
yaU9]<B
~c3'f
-{;f
`2T7
<T,2Q
S^0qg
!s s
q#v,
A=n;^<
))O2
YZu
W:88
w>vT
(x]Rfe(8
My8S
CJL6g
w<uV
Qk69a
Q M_
HQ"6g :
_pjw
gwNi
hx^W
Mgmj{s0]qrr{}jwqpm
g>EW~(q
3T7O
$V-'s
& ,.
"_)}
CIc-C
%thXW
~3;1T6
Q6sv
wGc=T
8;_|3x;u
q| O
A1A+x<I,^
F3hs~
~=5{[
7J0c
^ing{
~&6y{
zQprg]qrr{}jwqp\
OF?k
pY#0
g3feq
zXspe#
jwqpXr
YeHF5
Mgmj{s0]qz{Zqs0]qsnwr{l
;505n
KG/z
"+gV
&sV,R
t`)b
Y{j[f{}kjwpy_mm{s|rg
{uhGNuq
pQT?Q
hh{qevg
c>TKQ
H)Z" &
O)}9l1
\O ]9
@1#Z"v
SgNlqt{}j
Label
sA]qsnkj{lQ|t{}jNlqhwz{l
t's<y
#Y *\8K
rIh}w!
u\:H
A\KQ
kN-@;s
XWuf
o<f?^.g
#S#sd
>i5, k
5fZ78gv
)p%D&_LC
tc}6be
0T6O
Form
z'k~
Mgmj{s0WQ
g6w^ l 68
7Eo
C B{_H
.:W(H
ypqmjw}m
rb
$QrK
b*M4
zGVO
Y!n9
V_H>5("
o t
,wA[
8vc70Yt%
hbv7
se5w8w
wXwcr
u'pz0V
4b9a
gw7cd
\ s<
I X=
lzSqzkr{_jjlw|kj{
&J:N
97vw
[KwgH6V5W
q%]2
vbWy3
xR#l
qcfwEVTlg
@^ m<
\.|/W
<quq
fY;W5rz
gS~g5tg
xfun%S
Xigx7{2
- 2_
zw.z!y
~Ezw
Mjlwpy
g p"
rr E#Y
h8jd
>g*E
q4|%
\:K8
2|'O
set_Name
b6S1J
B#[#X`
QPY n^
c j,
sy_&EyW5Tru&x8BX:
mXVWw
:,Y d
3u782
get_DarkSlateBlue
m9-O6e
X>l2
TWi;Q
|G.5Xv3
5s4wvg
%O7`
.M?+K8I
FMT0"
uu.%
UhVvrr
wcqwr
DY!p
m X#
ZH_ p
xvha
hXxt
q Z
xW8u
wxdH
s;WU
78`w
9pU=
8utw33
v0c Z0c
7X#k
Z0 r Lr
eWSu^
yri{
T:\
`;cM
wgu5x2e
w)x8
4'm}
System.CodeDom.Compiler
nuBhg
GuidAttribute
Lqkpzm
?>Rf
|-tD3`
SetCompatibleTextRenderingDefault
f*67
)sx8^}?7
UtxuNp9
!o2X r
n/'\"w
t ^5s8"t
j7V&
a0CK
X J
83t'
M\=n
System.Runtime.CompilerServices
='F7*
L&u1d
KD,w
w\Ex6
0Q-n
uu;ug
uW2{~v
=5w3
N4J
swkx8ojqw
|qC({7
@^eQ?R>b
ix%|ehxuyu:
Wh s^dN:] b
6FXyT
vQ}dv
D2H
xVl|
Copyright @ 2017
G F,
N0rZ
6l=?
DJOF*q)
4Q^/
vNlq}{mm
v'.
kHWl
d1V6W
4S Q)
+[+d
RQiHFzwdPWnDfdJxHVg\dXDN
d p%>
xmrx{
O T~
$JXf
Q@I:^
l+uL
WPSSrG
`/I3}
SgI{|M{lhw}{m
|a5q
iuxDN
JG)S
Mwd{Qx
qlg6
y{jAI{|M{lhw}{m
#rx~xmg
8a9Y
oc i
t'M0
EditorBrowsableAttribute
'(Ws98x
mxUxwxux_
set_Dock
ljWpxq
O6x.
H C%_
mgg77
h%){
m_6e
wgGUg;
Vwz{Sqzkr{P
c}'2H
Y{j[phwlqps{pjH
'(DHq
4huT
n)Ga
Xh7q
sA_nnQ|t{}jNlqhwz{l
i:~X{
6vl
n(`}_/z
;<Tw8
\ v%a
U*bOw
-3szR
WBww
jSl e
j{Nlq}{mm
uhs(cM;4Sx
9S3fa
*A$F
J9xh
88~c
textBox1
textBox2
juuk
textBox4
v~1~
Q;x<I
=o^ S q"
H3m4Uk
@S&}
Z>W8
4GWx
_pgV
$v YB
5{}f
j95
8Cub
P2Cp
g2X
d! s=X
faefGK
1k2@n
ws|3]
qwnc
G7gTI
P6d
AssemblyTitleAttribute
Sg0_nnrw}
cXwS
V0b
w%1 i co
y8c3
mg5L5 s
hnv2
w(sq9}e%
^w7*
v"*e
938t
fk:x-R
LCw&
i<Vk
|3U Xx
et ]8Z
\kxx{l
dU#m
@.zg
GgI;Z `
3.hw
wXxU
9\>(
7U~vVxSV
@9 0
add_Load
m%O=
7Vh|
u~SJrv
bj"S
hH*I1
@.reloc
A:s^
\bu01
WySe
&Es55
fz.K)
+APl
Y{jWpmj
S D-M:
|.A4
\YaZ^ufw7xC
!["z
}5>nwgu
vhXr
T`Y p<
s%wh~6
VumpQ
ug}V
W}}5w
K2`<
wxuV
ehZ>{/K
~R#m
xR2k
W7Lv
O p<
wveS
gessEE
E>x*L
A+8|) \
*l'@
hW7g
r3@D
i7\f4M
xge3
a.EM]
Gs^SwRkr
{ W/W
e6O6
k77k
Me7p
<L+uo'M
d8iR
g)LmHX
g'Xa
.ctor
8n}hY
f&AnW5l2{
L*AF*
W>RH
cWw8g
HS#Wxg
d>Y3c3h
,;C4
x;B;
!
WX5<c
i-M:
XM-v
!m F%] `
U4D4
AeK9\
Usn8
^j]@
gyly
Invoke
z{l2>sm}qlrw|2>H{lmwqp#*0.0.0.2>]krjkl{#p{kjl
}/ f-K
wmIN[
Resources
h8h8#gsq
c;zc
|r{N
[ZXg!
MJ_LJKNAWPXQLS_JWQP
x N,]*
j{z_jjlw|kj{
i)Mp?H
}'FX
q[4r9_R
)I't0
*Mgmj{s0I{|0M{lhw}{m0Nlqjq}qrm0Mq
xVew0
W{W)X4
File
|T\sHu&
gwS d
nlq}{mm
A l/
U-U>
CpVHr~
bW7h
z37s
qxxvv
s C
X#x>g
Ilwj{Nlq}{mmS{sqlg
*m'~
:T*y>
m?Ha`
fs87dL
)<D
0-t=
X1<wt
Y{j]kll{pj
ziMwd{
uusX
W_rhfz
f5[P
pmR-|
z_jjlw|kj{m
8887
v!7U#
ug<Z+[ a2
~ER?]
vi3}
L{mqkl}{S
Q=g0
rsXW}W]
F3r Pc
Iqi(*Y{jJvl{
AExe
Sg0I{|M{lhw}{m
ve9a
rxy^fg8
_ a0
%Q R3$
f6vD
t658
<C;l
I{|M{lhw}{m
OP1I6G
q48c>
{k1@
d6_ tR
VHs}
veHh
*o%E
'uvxx[87~hs
Dispose
'7xVg{wG
gx8Re
K^ 3
)!->
o [ZO
A+x<i
i _7
I1/S
7"zl
%,x1
Ilwj{_rr\gj{m
[}cc
g^s|
x'h
Qw'v
wfU7X
wsh5
7R]8
M7;8}#>
Uw3x
W55ZX
&D>wf WH6
x<d4u
_f=e
n~{w
4 GJ
3tsmz
7 t F|
H`cU@\
lw|kj{
iKe h
W2W.|
Z?q[7q:
Y{jJvl{
@a(~
A]ql[f{S
wpXwr{
odR!i
J s7b
kJf4
Ycs[Z
tX~{
7mUzx
X>D S
:WxIv5C8
[3dy
checkBox5
g#'z\}x
i,V12}
x{Q|t{}jNlqhwz{l~/
sW2D
agwy
XHWjD
sUxg7Rwh8
=W8x|wL
Az)Q
g r
x}g5g
3r6x
|gj{mL{
set_TabIndex
W*gg
os$~
>V.,}6`
|8m9
@ B$
0m@&_ bf1W
3r6Q
4DMx
~w>jfw
})MX+
a7hx7
`I w
on03m
[f}{njwqp
d\ V
&G2`w
m%O
F ocx
{ER$
linkLabel3
)8xC
*pg I
C,fn;^<
RuntimeCompatibilityAttribute
scY j9
~aw!
j7~(Xtg
c6r'Bi
Mgmj{s0]qsnqp{pjSqz{r
d @4}
y>nSk6]
Assembly
w 'q
q#J#
CUs7
LLL4M
;k/V
[~<I
gxlsxZ
<] u:
j < 2>
8ZKY4s9
,"!2[
9U4N
t q B
'#*(v
@^e1
w8W3}'
RSI q>
-T-*
sQ!Y
.a/S
L4;]+b S { K
nEqKuNPx
C^ O
:`(%
F8XZU
+r;H
4xv{cjG#wg
X^$q|W&]
uwH%
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
+
~qvw
E#Ar
JqWpj-,
Size
'Xa7
S-gW
0>X#Q
u5#p4
U;W/z
[zwjql\lqim
1'2D
vsS8h6
e>"W}
w*Tx
1k:=~
n\Z@1~
OP6]
Q/f
>VN:
85S8
a$R4
SvgF
_ f4M
GVCi
%K i
8a4W
LO P.
sASgI{|M{lhw}{mQ|t{}jNlqhwz{l
} \6b
K5FV
:w=X
+8W9S2a
j4Z
Th2jjETJF9yt
kfwE
IContainer
k6\
)>X;CDG6z
x7vg
c1r$
Whc9
U jQI
g5^ t Y!
EGU=r
g T
7;]O
^</+.h
jvl{
H+S>
%v>~
Vg8yW
f77#u
q83kX}{
c.~8
)SRO
components
pjzrr0zrr
o}Ox0H0\
5Xje3
3gqX
&WWn
o0L=J
Tj6\
a3t^
d6r'BM:
h#mF-|
Mr{{n
Fwe88
|wR'W~w
GWe5
"7-FU
=D m
EX}wx
CultureInfo
W=l,A
\0w=
sFEdMKaQ
dk!k,v
9f _N7K&\
:\:\~
RRlX8
a*Li
set_AutoSize
m>G>
w828k
+)2Z
u1RH
wv4v>
y{jA[f{}kj
Vxq{
I7u?Q
W8x{
p428^
<U0d
&z=w
?%v2g
{-`{
~#ge
\gj{
%U%B
-N_/D
FPwx
Wg2W5
j^X2yW
Hwljk
s<sYU
RI( A$
uXwX
DsT+N
&vafs
AssemblyVersionAttribute
vvzW
gCVePxbXejlYig.resources
UNYh7xQ
wfjh
k,vP
ghV5WqyX
)cvt
o5l
5z6qe
/] aj1d
(s+K
=7kW
ewtsc}
_}jwh
4&b6S1
;UW<b9a
{9hN
i=y<
{x~w
3WPw
RUnT
~$F
A*E<r
JqMjlwpy
#7;UH7h{
:/h3x
[w @
ws(W
vxz7
2P&+
uWaxV
|k2T7
73{s7cdG
n;@Bt
k2XZgLf6
@%"j
$'yG
P1p_:r
7{wmX
Mgmj{s0]qsnqp{pjSqz{r0Z{mwyp
'wxi
5fmz
Qz4M4`
[Z~y
ghKuwX
F_ `
0j{fj
v8Xc
uLqhjUw(v
^x7sy
wt~uHW
}kll{pjZwl{}jqlg
|/hSQ4g
P1A1
#;VQ
))GvXgv
i0fh
Xx7VV
7.[2j
M4/z
2|_ .D
Z{mujqn
\;~_
Wpj{l
F?q`
J n r
C%E])P
D(w<Z
`3w"
nlq}{mmWpxqls
&Ee.x7J
XwwA
r!e0U7N
R,}X
w8S&7h}G
F d?;
Us&t:
n!']
#[#tC(G:p
Sy7|
|X5g
eyuW
1c X!X
h|Ws{h
=#8te~
"Z#dZ
'`9W5
g r
Jvl{
G&"}
jwqp
op_Equality
j)z>LB1
iS7Mv
}&a?P
textBox4_TextChanged
/l2
fVvS
Aww7gsx7
aXb&w&
set_BorderStyle
xV86w
*q,d
sU5S
kaX|TX
k>HG_e
fWbjix45w
v }
xp7xxpV
O-TQ@
thAG
14u5e
BorderStyle
Zh^ m<}
X7WhU
+i X4s
set_WordWrap
7wu6t
}Sw}C
U4D%
$565a96a8-4e3a-4d58-b183-d42fe9bb68e2
}>@<P
D3U/
w.b{} \"C
}Vu(
3;<R
C 4
~;{1T
<lxUFZX
EaD0
m7;d
Mn{}w
zs64w]uu;
2+E8
tAx%
D{lq
J 9zT
t[rv'ud75
O\. P!N)
y{jAP
Adf
/=Xt
(N4 r:
InitializeComponent
&C"R
J#nJ#l
6`5U
D c
L A7
sv8Gj8RWvsx
0wWvc
9hK6O
N/_/
vdF&
v\^N
C#&d
jwqpM{lhw}{m
/=X;
*S(
i8TI2M
&{#C0
=M*2 f
X4f=[yt
gWw9RU
eK}ws
wpgw
{)@a
=\rq|
9@/u,]--=W
&n#m,R
s}|x
df>,p
nlq}N{lmRQ]
c Tpg~
Xw7!X;
m{lhw}{
rW9|
LinkLabel
x*Ws
J[.z
wx6E]U
.h C)
.cctor
v8Qh
[hmG76
f6O'
Q/.A
qsz8
<:?
\1!Q)x
kchg
l#E,
13wu
7WcgW
@9M=m=
}2_1{
>\/,
.u-t
iN9b4
veyP;
F >D.x
&scR
[?vw
fX6cx
]$p
(vf17
E/r(<e
n^xu>usx
G" ]
u;E
_M[^
&%a4Q
|r{_jjlw|kj{
F >x
avuGGG
Lkpjws{[phwlqps{pj
]qsnwr
(j:
ControlCollection
i9{n)}
y5G_k?[
Xv}>
c x1XksE
cR&#B
w6Wv
"q=[
Zcu<W/z
'KQ T
aWk]Tzf
z;6R
sswn
<o*G"@9s
9=W*
7\e<
87yk
value
6Cpk
G=8vX
&u.x
hx#w
n5eSw777u[G
20?<
{39:3XX
HFwvXgxs^Uzts
System.Reflection
8v&bv
_5^ IkeG<o
W5d,!y
+I r g
V3O*P
S {X
C,j!G
F/76
H8H
RuntimeTypeHandle
Cs7w
9xR-x
z)GHE'u
[5p8K
u:wH
>x+E
U}\~^
S9r8m
FwWR
L%c(R
MjzWpnkj
w~|Sk
%7JU
SecurityPermissionAttribute
y{jARq}
d0Z M
sender
7~5h;Ww
xWc7
Fg[b
y{z]qz{M{}klwjg_jjlw|kj{
a9Xw
UWc '
G"n+
i=E j
2VUusx
|hZ~
6 /_
!s%U_ d
Mgmj{s0M{}klwjg0Nlwp}wn
y.p}
~?O?Pz6
!'s>
gw3x
Qwt6 gwd
}9H,
/$B`
z~sGuwsw
TW[X
4~VG
h\8C 0
r_rrq}[f
<6X'5Z
# 7N
"l)}
7~gy
p~n&( w7F&w
vv{5
H]i^
\4l
K E.t
5smQ4I0
q(n7
vs3U&X@h5ffVH}|w{X
pzr{m
MO"~
TextBox
"Q?6
5Xw]
AssemblyDescriptionAttribute
f3P!N
B0F
Dw,Mu3w
X8))
5d c\-y
M{j_jjlw|kj{m
4ya
Mgmj{s0Lkpjws{0]qsnwr{lM{lhw}{m
sm}ql{{0zrr
fh3vE
x6c'w
O:}7
0}}jql
linkLabel3_Click
SystemColors
>WHM
X8Ww
|a2K
f Lz8c V,
b:B :
1gg3r
%6_
p#7z
+L2-H
|^hJ5xx
EzXh8sbw8$>0
ewvwv3
v r&
kj&&
L{ywmjlg
v$-T
o 8
u3xc
xWd8k
z)q$@"_ e#l _6h
a3b+
6@"A9
c5 SW:[[
JnYulj
R0m
O-Z+
:_%lL
s5Xfw
8X^ b$o
py'v
v B!
wmIwl{Mv
/^ 6
]cU3r6P
i;B;xy
U3yV5
SzTf
^qdS
R5d@>|
jyvS
y{zJgn{
6w>l%r
@/3t
)H;B%
8"wg
Lkpjws{Jgn{V
w|t(
0m |
1v8R
+oHU
1P&\
_"z/}
@z9_
7fZ}V
8O>E
gw8\
oLxV
^Uuhgv
6M R0h
$K F
mscoree.dll
!This program cannot be run in DOS mode. $
h!H_
#A8j
x>Z|
N'u uf
JqWpj/(
Ufarzh
9q7N5}
S2B2b
y{\qf
sm}qlrw|
1"zj
6|cgwdGy
N:b^8
4gjun
W>T%R*
0}jql
m<R
Pr!e0U~I
)%{(
dvww
|gj{mIlwjj{p
6f _
U75uH*qv
&c?Z
2~6j7d
MjzQkjnkj
7Xh3
Vw?c
rXqrz{l
{s3}g
]3V]
b1IX
r_m_jj
e4.
G}CW7|
n]ue7~
m^Vz^71
&Xv[
ItL_ F
d7@g
# Q0
;^4}
set_ClientSize
&S#t
l,i=X:C
q"f2W9D
!p=Yk6V
wxrw
(6ufi
|9/}
O(J)
<Yx"{
rX1p
2[lx^x8
G,v/N>N
qcfwEVTlg Inc
~S/W
?@N(V:a
mw;q
XsxVtx7c
Smy\qf
w$]$
%AhJ8I
xsSrea%
C =v
W8sWbxq
;f _
.x6e J
M(bj
76%SW
v z*H
2R)a
|-Db
Y{j[pjlg_mm{s|rg
n6uXi
8e{Gu76w
\M4W
VGx6
b1u
BSJB
5x2zS
,N~x
resourceCulture
r Y6p;]
\;i @
Qgfh
=YKWZ
LZX e
l[
S6V7e L
+X7q;
g7u=9Ex8
/Y uC
\.`;
L'e4
\& )
S n E/
;exq6
lNWZ
m(`.6
&\"[c
3H?]3^
>o6](y
GI]>x
=Mjlwpym
k},G?j
i3j { [1b&s
H<[^
o5l } ]7d u
>x=gd
8%G:]ro%@
3@;q
Xl1u
T?g>'_/A+@
8vcz
%+dj(o*/5
p%Z`
\w{x}}Xv
PcCeU
Y977hN
Fi'~
)8R>1
X2aRE
SQ!p
zAU:Q
3* z
k0t!D&d
?Jvwm>nlqyl
N>Y
{yu E B
>c;[
-fz!O6;
IwpzqimNlwp}wn
[1pt!V
w{sg
5c9Pd
d:XP
Q>x3U
fxw*h
w(5w
$+j^9
Ki6j
WmWpLqr{
/h:\
Skj{f
e*L6
]qs|wp{
87f6g
8m V/`
w"b]
wqWUx
uv`Q
vu[S[
0xsc
gg7{VSt
=3_7
V,T
EpWv
fW'MIj
Ti0f
j{5P+
@!8
u&b7
w'XWG
&KQ T
W~uh^
add_Click
=z2U
g)|S
<m&p
>9W'xu{
[fer
@ 5m
hq|t3w&
(S*~
cx6u
xf6v
gqkjUwpz
D2`'v
DockStyle
%k qo,o7WOa
32*K
{ ;k
pWuv
5f%wxH
7xtx
}q1ywd^7
%4^5
x7tz
ruu0
m+m&p
N /J
W%xsZvd
{U={0V
k>W2H
r7c H
U$6 V
{SW8
a{7xldlX
Smy\qfMjgr{
'u bt
g=4}
nnrw}
bzv7N5
X13K
set_Visible
c86ucvx
VQSp
'% x
'q"l
#V,%
!f6Y@
B{4R
pzr{
@V32
xxg
(jt
Vh5{rV
t&_&r
x3:y
%5b!8n
,\ f
=C0HB({
u-o\
(Cr8
e {(C
vw^WEv
Uf0w}
H'n7\g
sFEdMKaQ.exe
Uvx8
fzns>
]X<<
x]~7
h]fx=
bh.]
X}7ss
U "["
Form1_Load
_ u Xkf
'<e,w}*A
V jQM
CompilationRelaxationsAttribute
oEm"k6P!p=E
8s}W9Y
h.T2f
&D5m3S
xw^{w ~
O%|"
f2X r
L4)p
q#Z#w
KCAFTCemTUTJULGYjs9akBVXVmFwjIRZBScLtO1
gg|EV^
)|!V
\5l ^n
wxXzS
5w68
Jl8@
s*;;;[
Gwug
sC f<e
JqRqi{l
jF^$w
h:qsvi~J
0 T,c
z
Nlq}{mmMj
l7gSU
Sg0Km{l
i6]6`
&y~w
KVE,N
xvY<
_ lE,w
\$k G
WxpkC
<`D [
g6=g
nVjjn]rw{pjNlqjq}qr ]l{
h{X3
[fjl
hS=7
utghXzg
z)AF'W
V3~JSw
^0l{rq}
m{jAXwr{P
1a (l
@U<B8
\Xfh
H.l {
V~7hgG3aS
x ZJ
t85Rh
ZG0m
xY$_&t
6[#[Vp
ZXw6
zuwxz
9yv7
GZ [
Y9F#G
e \g
|E,|9
-~:|
Gx5V
wexhxu[wgW
SgcU6
hux[87V
\qKS>D
#Y'n
IGRypNjWVSg|}
^f>W&88
/#E<
/O<MP~"g3WhY
.^ y
x2UW
<u+'
3t{m
7e8;#
E'z A>
Twe\[%
X\XE]S
Mgmj{s0L{xr{}jwqp
k;ke
S sx
=ws}fWwx
bU5M`
wv6%xwXv
vhVfw
o;JwxcSXU
XKt(
Jwjr{
RQiHFzwdPWnDfdJxHVg\dXDN0{f{
Z TF
gqkj_jjlw|kj{
wjXql[fwj
pzRwp{
V}[?
4(k w
H79x=x
1b58
hewu
^^_ g\U/K&\EV
rk5]
Z=lB
i=E l`3
M+I0 c
sAKm{lQ|t{}jNlqhwz{l
l%Pm
a7XJ
sw>wI x"w
wLVg
{,Ue
K*x'
Wswuw
1E j8
8f5i
"-w.0
.?F<
P*e0
g4p%
_0v*
hYwx
4b [
8bu}y
5vw]XS
7r&e
Y8~-C
jqY1c$
E.ez
set_DisabledLinkColor
d/U-v
gYKs
B.),
NAP:@
MU7'Mn"
2H.{
Y{jLkpjws{Zwl{}jqlg
og.]
}4yy
Xl<E
A+]Y
set_MaxLength
xGZw
g,J0
n5m
Eg>m
# F<V}
Uxvx
CompilerGeneratedAttribute
DS*`
/M\l$c)
s}fFw3{
)}
<Yuwg
a1jY
@N|
ebg
r VlZ
NLl c
[p}qzwpy
#L=j
7!'A
u&b7R0K
e<EnT
n^9k
z^<M:
D]-] g
~0lml}
VwqS
y{jA_nnrw}
[pz_nn
h, m
XRwvvv6
7g ^
7yW7@
y#zb
AssemblyFileVersionAttribute
cgWx
` " 'Z<
z_jjlw|kj{
X r:
}MqS
\8fgex
{VXXV
"Lo /
BN[ Q>U
G7(6
z*n;
k r!
=_4<
System.Resources
medu2f
q a-
wGxv
s2Z|
?m\+
vgjy
0%\"
2v (.
7Y3#
j{AAWpmj
'wC8T
7u|vwxH
6{f5
VUx
m0|q
,]*{DK Y=
z2~?F
-(vwF8
nXdq
8V'T
[bCdw
sD!h
;REm
y{jA]qsnkj{l
Y{j\gj{m
x+n|xQv
Z4g#6
#d.Ha
~gs7
p?#*
lRq+v
}qpxx
3<Uv
70 D#
WtyU
7C{tx
get_Info
|Xzfe
\-a/
SvsQ7G
o !H
vw-SfhEsXw
5BD}
z]qpj{fj
SiSxxwexr6
Bf<U
sWUw
>k \%j
xwxg
>{gb
;^8~-
(ei'#GG
Y{jQ|t{}j
M}Yx
~qzH
bb;
ResourceManager
{E)q
7xsC
]8\-G*l/I
j;Z!b
hexxUux
v=`w
t ER k
'xx8
Rez{wx
cQ0F
/r(Fm N%w[
wu0U
P;P8V
8|q]L
y{!#
wx\wR
n`1I1
|X7zxq
kc;e<
BJg:@
N @&v
U0c
#pNc
_CorExeMain
Z#Z?
;h-/c
nHw{iQxM{}jwqp
s^x~LG
8W.}
`;c
U3xZ
D C5O
`7Ng
>R"
pgKQ>T O
s6wl
ARse
ew3|
}/8-y
R)=i
7 >;p
{pf88
f\ n
Yiw?
H^/\
<, Z
Zh^ m<R
'gXf
;G=t
rXX$
CtgwvV
# _'
5f#-a
BX)V
op5|
!7R1
j{z]qz{_jjlw|kj{
ToArray
set_UseSystemPasswordChar
U?l(}e
AR S2B
rZ#Z
Q9
V/a
CheckBox
2 s$
*M?
o-I(
mw}0]qsnwr{lM{lhw}{m
]6e
x7r`_
Zwmv
-uK+P
(G'Q
[8I6
zx=sy]uk}x
u8wxkwSUw
>y=?
z)m8]?F
xSX8
Cursors
*.sE
w"5x<
e3sC
Ta/F=;H=
S*SL
]qsnkj{l
htV3
9Ww7
wm"5
~8Tr
2.2.4.5
Mwd{
?C a">^.^
>O<Q{9
R(y
yL&u
resourceMan
Y{j[pks{l
ksq}0y
sm6u
y)$
xWV6uWw{
k20qN
7ew*>
YxW6h
D<[<
%U%V|
4$}f
=_lg
Load
l pT3F8
Mjz[llql
xS8{
!q1vW-d
Fc3T$T
X]5B33A_R
=; z
,LnH
: :
System.Drawing
]8V'
`5P2K
Vtw86
l{S{jvqz
xV^h
#|sjx{e
z]XN
2O69
c X!X
E?[p;
s{_jjlw|kj{
nnwV[:g
{5Pu~
F Z<Y
O "G%_
C<:q
%`5P
K.L5g
SkipVerification
Z{|kyy{lVwzz{p_jjlw|kj{
3Xeus
Bz s!H*9
)=y-
}g^zX7
>=$<9X 72$J!
f%@
O>Tr
HK-W
H`.L
m{jA_lyks{pjm
*\F
}]7h
&P=o
h>N:gx}v
Sw}lqmqxj0Hwmk
s EPh
b"E<r
&cqGe
]qsHwmw|r{_jjlw|kj{
+~->=h n
2]Al
=lvl%@
7Y--
ZX:|&@#
]Rh7N
2<Z!Oh
s[vk{
add_TextChanged
_5.6#
\4o7
t6Wwx!7ZE
Sg_nnrw}
Y6ah
t _0v=[ `2K2f
[Vzuv
P"o(z
jS+v
'hxYA
x6x~Vg
l\\m
Scp~
3VW+
} @+s,U%W
x3S&l
u \0
GRJU
fw<x+
H6&O
RTTK^%m
2_%%
nA\'o
y\52xv8
|8zti=Y
GxWW
EE3` Y
F,g4
}Grhs
Object
`:{w
M+4-$]$
/m/h:
fW^f
rMgmj{s0L{mqkl}{m0L{mqkl}{L{
hfUH4
vX|CH
):C
6gwV
'y9h
66 XX
g2XUn
{@Uh
iNkVYZAj6qheFl
i3m{T
Wchn7sq
/z?k
:HL6
3System.Resources.Tools.StronglyTypedResourceBuilder
e6r&C% u
h\ n
]M[>T
System.Diagnostics
lxwX
y4!q3
b7Lv<
3msS
kQVXHy}W
wuxv
K(d
rW Xs
Ry)-
{q(V
h$ClA#v,Jq!f _
*h99s
yvWu
nCR9W
x%s{wn
gjSujJ
"5U8
y-I(
:M=m
=`yh
{txw3
"C3
P]8Z#q'$
[ i/f
Uwrr
jwqpm_jjlw|kj{
5L5Bz
EditorBrowsableState
5wOVh78
ah8s;
MethodInfo
T-f%
Y{jQ|t{}jH
xC;77R
\_,'G4E
gUk}r
A*<t
get_PanWest
:g^~1
fR|8
~9|\
Swm}
[phwlqps{pj
Q5T2`<
O"RV
`&m
w87VT
5P+c
W"Fj
kh>5wu
t3t=wtz
aT7O
set_VisitedLinkColor
dvUu
02u?
d+M7~
\1M,R
Uxj6q{
@W(*M
>\~Ew
=|cvlk
#u\2a
;S>D:
s>|)N
=;376x
J#p4
w#8Wxn
r A+
e#h
;,k-f
ffx<lfPP
y5u>W*`
]\ o
'~%K i
&hTg|g
3?WV
\:\~
1UeX
M*`r'B
YT; R
w7wSXMwZ v
mm%O
S|1;
sAJvl{
[6Lc
hu uhR
VmRH
'gW4
Exit
cUgUV
K*`yV,R
`^ uWE B
fx8(
ghsxX
R)[
Dg V
#[3O
S{mm
nlq}N{lmNWZ
w2shskyW
eF!H8
7Vwvww}
B3Z>d
hr#w
M{jH
i6gv>k
n qV
A)x>:
K3KRV
Z8s},F
uw<7
^fh1
!C:Mb
Smy\qfL{mkrj
Sg0]qsnkj{l
A p50
`WX*C
4m_U/\-
uutVdwRl5xxY
s9w8Uwz
";b
-\ t;
}NI6l
SecurityAction
VbRPD_
kIk6V
V(P&
u#7^~t V<gA
E1~s
b3cX1lvx
^9gD9h>
8XQXy
Qn{l
c0[
xg{7
Wy~I
(r+/
d-V
{1XhXw
<t4!
n28 A.
nwW7cM[d5
\%kTp=V
p5/B
hXvwgkG
z ~6
fXeG
85dIf
lc &
*L5:
$y J
e7p0b
GIr*R
mzn4Z
,Tf/D
n7p6g V
iF;I
BTC"Y
'p>k8P
>H+m&
jwqpL{r
AUu3Z
AssemblyCopyrightAttribute
V3z
ljknWpxq
Y{p{l
P{fj
Q4V/}
RY?m
m7x{
3rw6q
}qsn
vvSpWwwi
?d;f Fl
7H 6{
}qss
#rh8
Mgmj{s
Y5n;^.!u
w858
>kxwsv3
=r{xu
3f<Z
-w vvW'gt
e{sF[n
fX8~
b&sa
tMh8T
R]hS
9m h
2#mc
| [4
u:se
[7x,
}$0f
)a8h-`
z]xWuv\
xs;jGH
m{jAH{l|
EZr7
hUXVSq
Wgt7
en5g
hUWv
ec_%k
set_ActiveLinkColor
hWsXr
Wwwu
2W/.o
Ng78H
Vmtv
Y{j]kll{pjNlq}{mm
z.~$
`Z V*
ufx8
Iqi(*M{jJvl{
_mm{s|rg
wpv{lwjV
W[#*l
=[ `{
ofsc
P"t)}
877s
\6l"
Jqa|$^
l#E?v
x'7r
~ur[
f&A8
]B!Y
'F&_ b&m
\J"e
=[kV}5
^WsgZ
8j='
k/z`F
xgl!w
C6Gp
guXxtwu
Vxy L
/O<M
S=x0
f,D
t%,u-M
(EA4U
~F@'Z
Y{jXqrz{lN
z|&@
AvhX
eG~m
"^<D
SVeWv
Nlq}{mm
Nr /}d.
~Q{GRwe
;C jML$
5|Y#p
TY i
v7zb*M
0T/g4Q
+ _'Mk
Nlq}{mmV
;smv
H1HH=u
s\+t
Hwzh|
(R)a3W2,
</*=Ut
L AO_
isY#
<(-8Z
4.0.0.0
mw}0_nnrw}
w{u&px
M$t1e
m>%]
dxhh
vUh[
Htzc
g \"
vy\_Q
|H9)
`xX6
qe5_
set_Culture
get_ResourceManager
;wxu
]qsnwr{lY{p{l
Xwr{
K83cw
{x8N>
R;)P)E
0P`>F
Ms8P
wcuj
IwpzqimWz{pjwjg
DmuV
&4p"*
wSfZ{W
Point
wWEuu
x,I%
ResumeLayout
Y K9f
ix*S*~
7]/'
{ {+A
v2.0.50727
V{ua
0V7G7(
-t_'_
-i<`D
}Ws^x
u5xG<'
e4XU
n X!X
}8gv3
w%\%q F Z
t4.6WOe
Program
Xv`^
xHs'rkg
i rQ|
get_Default
8L/l
8uPIs
uuSp
>wvy~
]qsn
hu[:A
Bo#E?
o s
8|)}]%
uexs
s zk
ssx]o8
e7N7c
|w~u?
4N-U/nd,K
d[7`
* )z
x8uvsx
[wWG
J5wucs
#9\?
HZTj1i
}2WGCs{
xAm_
Sw}lqmqxj0Iwp-,
75PW;
S{|w
p4 n
>7}(s
gNwxvxw
a r/W
?xy`
jqlm
Iwpzqim\kwrjWpLqr{
set_Size
GetTypeFromHandle
pqdw7
46w0
?b8V
&p;s
\6U
(:~(
Mgmj{s0Jvl{
\wuX
cwJhwgywv%H
i0P P
b7LJn
(nc7dufhww
Y{jJgn{
UwW{
W#Xy
cmzUw
~tqL
}xvW5
GFK5O
6k.|
KW;g
whH>w
Y:&u
u E'L ]Cc
3Xw#
$c6S1
f4JV,
R jg
a2[
6Tuxd[h
8n7ww
Wx86z=~s
x}%5
1i"q]9X
d*,2Y
t7'vL
{;7x
U%}'7
X6 ^
7w1>H
>vx}
zNlq}{mmS{sqlg
zxcv
k?ty
y{jASqzkr{P
7wv=
j:PH
ss}W
`]P2K
:9\'o
s4R(a
s388uw
{">r
M{jJvl{
T)PG%pc
.n4R#
sh6fw
y{jASqzkr{m
+B0A
yWZvgNhzEjVqmpFvjqJu
l#I3z9
#P!n
Km{l
"- p!
v-;RM
Xv~f}v
dy|v
+Std]3=
uEy%{
WL~T
B8qd
n%2l k
q- d
Q)'y
$%DG2z
Q(n%7
W|vD
Wh1}UWg
System.Runtime.InteropServices
f)N<w
{5d{)p
YquB
EventArgs
r !N
\rq}u]qng
lUe8w
s7Gb
vF$Ul~
1q6g )m8]D
Y?.d8
-.,.6
Gp%
qjU8l
y{jAMgmj{sZwl{}jqlg
^RUW
%@&s
gcEf
X78Vw
Sevkos.Properties
m>z/J(Q
W9T
iHB
2' *Z+
Uxxvw
h%~Gf8
8 A1"
>w{s
zwpy
>TKQ~
8uq{
<zYe
76G.X<
OAz2J
td*~
@T$tk
2@6cf
b6J{
8xi3
8>='y{7
Q|t{}j
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Mgmj{s0J{fj
3dZF1dx
*p5a
{qC*x
Lkpjws{]qsn
O f-
\:@ b8a
]6cw
M`D.L2g
# 5^
7U,#
xzT;
/l{m z
EvU:hv7
set_ForeColor
pzqs
]<L<
6VzT
1UxdYX
)J8a
Y(bC
{m&5
f 6v
uv\*:7(
g)a wG`
_nnrw}
>.W8A
o?Z {
L\ f
87h3xve
5|ms
(A(J3
s-zw
Mnrwj
6s:%
r 8r7
|7;w
XU-F>qb
|r{Mj
w}ww
zzl{mm
D%;1F
U{]5h
y{jAKm{l
'u
hq %
dm`6
x>,CB
U }5
\KQ~
IDisposable
xx6w
Exists
Uc4g?_
-X`Y
CkIm98x6Ql
}/5/N&v
'Q8[2wa2S
ZrrWsnqlj_jjlw|kj{
@ P
Y!Y
mv]qz{
%p~P
*p)H8H
R|I+Ej
#p2:u
;E4z
T3F
mF5eG
h shI
J"p p$\
{ecxWv
s6zAj
uKWWuv
quv%
m{jAIwpzqiMjgr{
oI;Z X
AssemblyProductAttribute
"A+y
f8[#
'u4H
X6w86
%ggq
jwqp\
8xWcfGHwC*vuD
x+r8vw
<Module>
7$]%
%Uw3
jwqpP
cgS?[6L
@s3y
u5WEht
NLQ][MMAWPXQLS_JWQP
d>8d
6_.D
yww(yP
%huG
c7gg
\5-x
7r|x
YkhDc
Nlq}{mmSqzkr{
HXVg
E>;_
0c V
]x+S
hQg7
Ru{ z
2CP`
ITMa0\#
n9g_%t
4@mA
h>F
c5w6v5
cXxM5
Fu"}
"H/V
IG_](x=
wv]W
Z5wV=
e7p%
PA s=
{phwlqps{pj
# T>T~
a7~c|
set_Enabled
l{Mjlwpy
XC~gG
r E,
p}{AA Zwmnqm{AAWpmj
K ALt Y
6P3K
XuX}w
D8'Wvhrw
jq Q
89 p
iWvx
;`7}c88fWQ'
'~uV
O6 / /U
Ww7w1
%q0V<y
et}xx
< @(
3Ux(
w.6WwHdW8
SVwQ
#GUID
C` [2
v88yw
e4x{mWlgA7~Gs
1s6S
c7uQ
z|\*c
|m\S^qg
k5T$T
4sYw5x57}
wg68s#d
q(GC7
]qpj
Ujx7>vG
wx\xc
xc6wwc
,qghV
KJ_j
kv1S:vQ$
d=72g*VQ
e5G} Y=G
WjhV
]qp}
\xT4
j1i
4/0
$R/}
9H1~/
5E2YH
{Ry8
P)|
y{jAY{jWpmj
p"(k
ZM:K
M{jNlqt{}j[llql
u%?l
wRfw
l>*U
Y{jNlq}{mm{m\gP
y@X}hx
s'CHrYz
qrzx
Mgmj{s0M{}klwjg
ux5egw
|7{y
xX6G
_} u
-Fm8
q p"Kba
c[RN _Eh
X0k3
-we$
EventHandler
jw|wrwjg_jjlw|kj{
!)2B
,wg:
k-w[
x>7xw
x1KO
z,N,U
n=y,K)P %c(V
7c H
gwf}
@[)O
n u'=
qqUa
X0kZ
Tx9uIWvwkwz2Hxx
1p]"j
8%w6q
xsb{
hwGS
^qv
e&0fX7v6x:
&]8C
:'mU
z2'c
;90)
rnxrQrzNlqj{}j
67}c
C<\&
9(*)
u ^a2k{a
g}ITwfI
=tj7
p"M
Y{jH
Z%%7Sn\
Y9Fm!@
w)m8
p He
+}+(/'-*{.&'=Mgmj{s0L{mqkl}{m0Lkpjws{L{mqkl}{M{j
wmXwzzr{l
PwRa
U>\-
Y{jS
5f =
Y{jV
4f O
#t{u
_8xb0
M{j_n
Am=W
x+S+
r)Ut
g5WxZM
8~wV
bR8x
F3WWS7*
n|Uw
/ u$
sTXc
T; *x
wkuG
\pg:\~
;z.I
yr93
[Mn3p
wxWg
w6mMs
Wwn6w
9B;o
GV"S+|
5c<s
c.k?eI
System.ComponentModel
@)AY
U0Cx+
u]Wu7c~Eaw
d ^5}
'u.xPN,
P j
u'xw
xrP{iNlqj{}j
}jwqp
hXv4
X^tevC7W0>
Xh5W
PjKps
Nlqt{}jZ
-*H9*
:~4\
E`1(
_o>g
x7Vy
w[QX
l ^7
w}zt
p*p)-
(J)Q
H&_/
(E s
W}k9
\System.String[], mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089PA
x73x
vfx=o
P)g>
X23x
rNlqj{}j[f
\MT\
5{38
7=ux
1I!(\ Ig
Qx(N4
tHU 38
jgn{
R:}7
Axzv
System.Collections.Generic
u=u'
}/h:
1t<?
m_M=r
7qw0gX
?B t
tnl=X
wvSc
^5o6W'W
O f.
-H*@P
Xu7jW
d9X s Y#l w
}/h
x5]r
YHVm
System.Windows.Forms
GSg'~Gxrz
set_Cursor
Hu$y
Mgmj{s0Lkpjws{0Wpj{lqnM{lhw}{m
x@=^H5
W f?
h WE
i&@:s!>
Wv~xc
vM6 B!Y
_ w>U
A#n
W.Ui
c]}hwV
F @a7J
cjk&
wWwhr
"I#v,
8]*{
j{Wpmj
w73~
7WYj8
t&b$
w6w8~u
WX8XUhi
<~-E?
LSH1S
{WrRcp
XY&"[
DFNM
6~ E#
GeneratedCodeAttribute
disposing
Hv2wgh
A/9sH
GB7 u
K#yr
wshw
L{mwd{
Ilwj{_rrJ{fj
sW\s
get_Culture
.Sq7V
#U,U
k pV8
}67ue
e,tl
d;f
|0y&M
+ W
'jewdw4
"mWe{
z#&76
U&`5h
YUg1su'6Wl8rg
g 7n"
}vwp{
3ir^
b`^]
29<i
Wpj-,
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05_64 Seven05_64 VirtualBox 2017-08-02 14:17:15 2017-08-02 14:20:03 168

4 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05_64 Seven05_64 VirtualBox 2017-08-02 14:17:15 2017-08-02 14:20:03 168

9 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\mnm.exe.config
C:\Users\Seven01\AppData\Local\Temp\mnm.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\mnm.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Users\Seven01\AppData\Local\Temp\mnm.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\GDIPFONTCACHEV1.DAT
C:\Windows\Fonts\ahronbd.ttf
C:\Windows\Fonts\tahoma.ttf
C:\Windows\Fonts\msjh.ttf
C:\Windows\Fonts\msyh.ttf
C:\Windows\Fonts\malgun.ttf
C:\Windows\Fonts\micross.ttf
C:\Windows\Fonts\segoeui.ttf
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\oleaut32.dll
C:\Windows\Fonts\staticcache.dat
X:\GtFbTWVyBpALYjWiVt2GtFbTWVyBpALYjWiVt3\GtFbTWVyBpALYjWiVt4GtFbTWVyBpALYjWiVt5\GtFbTWVyBpALYjWiVt6.tmp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\sFEdMKaQ.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\sFEdMKaQ.resources\sFEdMKaQ.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\sFEdMKaQ.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\sFEdMKaQ.resources\sFEdMKaQ.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\sFEdMKaQ.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\sFEdMKaQ.resources\sFEdMKaQ.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\sFEdMKaQ.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\sFEdMKaQ.resources\sFEdMKaQ.resources.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
C:\Users\Seven01\AppData\Local\Temp\it-IT\LOwVXdizNIpZxzTfVHyBzFZP.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\LOwVXdizNIpZxzTfVHyBzFZP.resources\LOwVXdizNIpZxzTfVHyBzFZP.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\LOwVXdizNIpZxzTfVHyBzFZP.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\LOwVXdizNIpZxzTfVHyBzFZP.resources\LOwVXdizNIpZxzTfVHyBzFZP.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\LOwVXdizNIpZxzTfVHyBzFZP.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\LOwVXdizNIpZxzTfVHyBzFZP.resources\LOwVXdizNIpZxzTfVHyBzFZP.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\LOwVXdizNIpZxzTfVHyBzFZP.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\LOwVXdizNIpZxzTfVHyBzFZP.resources\LOwVXdizNIpZxzTfVHyBzFZP.resources.exe
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2340.3658609
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2340.3658609
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2340.3658656

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\mnm.exe.config
C:\Users\Seven01\AppData\Local\Temp\mnm.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\GDIPFONTCACHEV1.DAT
C:\Windows\Fonts\tahoma.ttf
C:\Windows\Fonts\msjh.ttf
C:\Windows\Fonts\msyh.ttf
C:\Windows\Fonts\malgun.ttf
C:\Windows\Fonts\micross.ttf
C:\Windows\Fonts\segoeui.ttf
C:\Windows\Fonts\staticcache.dat
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

C:\Users\Seven01\AppData\Local\GDIPFONTCACHEV1.DAT

Delete Files

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2340.3658609
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2340.3658609
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2340.3658656

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mnm.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\625dcf01\659c3934
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus\FontCachePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_CURRENT_USER\EUDC\1252
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\mnm.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\EC534788
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\mnm.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Microsoft Sans Serif
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\13cdba17\32acc823
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|mnm.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|mnm.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|mnm.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\13cdba17\4ae4cb95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6d101d8c\309ccb61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6d101d8c\305119d7
HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{3697C5FA-60DD-4B56-92D4-74A569205C16}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_CURRENT_USER
HKEY_CURRENT_USER\Keyboard Layout\Toggle
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Language Hotkey
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Hotkey
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Layout Hotkey
HKEY_CURRENT_USER\Software\Microsoft\CTF\DirectSwitchHotkeys
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus\FontCachePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\EC534788
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Language Hotkey
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Hotkey
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Layout Hotkey
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX
Local\MSCTF.Asm.MutexDefault1

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
kernel32.dll.QueryActCtxW
ole32.dll.CoGetContextToken
kernel32.dll.GetVersionExW
kernel32.dll.GetFullPathNameW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
uxtheme.dll.IsAppThemed
kernel32.dll.CreateActCtxA
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.RegisterWindowMessageW
user32.dll.GetSystemMetrics
user32.dll.AdjustWindowRectEx
kernel32.dll.GetCurrentProcess
kernel32.dll.GetCurrentThread
kernel32.dll.DuplicateHandle
kernel32.dll.GetCurrentThreadId
kernel32.dll.GetCurrentActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
kernel32.dll.GetModuleHandleW
kernel32.dll.GetProcAddress
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
kernel32.dll.GetUserDefaultUILanguage
user32.dll.RegisterClassW
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
user32.dll.CallWindowProcW
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
kernel32.dll.DeactivateActCtx
kernel32.dll.GetSystemDefaultLCID
gdi32.dll.GetObjectW
user32.dll.GetDC
kernel32.dll.GetCurrentProcessId
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
mscoreei.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipCreateFontFromLogfontW
kernel32.dll.RegOpenKeyExW
kernel32.dll.RegQueryInfoKeyA
kernel32.dll.RegCloseKey
kernel32.dll.RegCreateKeyExW
kernel32.dll.RegQueryValueExW
kernel32.dll.RegEnumValueW
kernel32.dll.RegQueryInfoKeyW
mscoree.dll.ND_RI2
mscoreei.dll.ND_RI2
mscoree.dll.ND_RU1
mscoreei.dll.ND_RU1
gdiplus.dll.GdipGetFontUnit
gdiplus.dll.GdipGetFontSize
gdiplus.dll.GdipGetFontStyle
gdiplus.dll.GdipGetFamily
user32.dll.ReleaseDC
gdiplus.dll.GdipCreateFromHDC
gdiplus.dll.GdipGetDpiY
gdiplus.dll.GdipGetFontHeight
gdiplus.dll.GdipGetEmHeight
gdiplus.dll.GdipGetLineSpacing
gdiplus.dll.GdipDeleteGraphics
gdiplus.dll.GdipCreateFont
gdiplus.dll.GdipDeleteFont
user32.dll.LoadCursorW
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationA
kernel32.dll.SetConsoleCtrlHandler
user32.dll.GetClassInfoW
user32.dll.GetSysColor
uxtheme.dll.GetThemeAppProperties
uxtheme.dll.OpenThemeData
oleaut32.dll.OleCreatePictureIndirect
ole32.dll.CoGetObjectContext
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
user32.dll.GetIconInfo
gdi32.dll.DeleteObject
user32.dll.CopyImage
user32.dll.UpdateWindow
dwmapi.dll.DwmIsCompositionEnabled
kernel32.dll.GetStartupInfoW
gdi32.dll.GetDeviceCaps
user32.dll.CreateIconFromResourceEx
user32.dll.SendMessageW
user32.dll.GetSystemMenu
user32.dll.GetWindowPlacement
user32.dll.EnableMenuItem
user32.dll.GetWindowTextLengthW
user32.dll.GetWindowTextW
user32.dll.SetWindowPos
user32.dll.RedrawWindow
user32.dll.ShowWindow
comctl32.dll.RegisterClassNameW
uxtheme.dll.IsThemePartDefined
uxtheme.dll.GetThemeFont
uxtheme.dll.GetThemeColor
uxtheme.dll.GetThemeBool
imm32.dll.ImmIsIME
user32.dll.GetWindow
user32.dll.MapWindowPoints
gdiplus.dll.GdipGetLogFontW
mscoree.dll.ND_WU1
mscoreei.dll.ND_WU1
gdi32.dll.CreateFontIndirectW
user32.dll.SetWindowTextW
uxtheme.dll.GetThemeInt
gdi32.dll.GetLayout
gdi32.dll.GdiRealizationInfo
gdi32.dll.FontIsLinked
gdi32.dll.GetTextFaceAliasW
gdi32.dll.GetFontAssocStatus
advapi32.dll.RegQueryValueExA
imm32.dll.ImmGetContext
imm32.dll.ImmReleaseContext
imm32.dll.ImmAssociateContext
user32.dll.GetFocus
uxtheme.dll.EnableThemeDialogTexture
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
culture.dll.ConvertLangIdToCultureName
kernel32.dll.GetACP
kernel32.dll.UnmapViewOfFile
kernel32.dll.CloseHandle
kernel32.dll.CreateProcessW
kernel32.dll.GetThreadContext
kernel32.dll.ReadProcessMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.WriteProcessMemory
kernel32.dll.VirtualProtectEx
kernel32.dll.SetThreadContext
kernel32.dll.ResumeThread
user32.dll.PostThreadMessageW
user32.dll.InvalidateRect
user32.dll.GetWindowThreadProcessId
user32.dll.PostMessageW
ole32.dll.OleInitialize
ole32.dll.CoRegisterMessageFilter
user32.dll.SetFocus
ole32.dll.CoUninitialize
ole32.dll.CoRegisterInitializeSpy
ole32.dll.CoRevokeInitializeSpy
imm32.dll.ImmLockIMC
user32.dll.GetKeyboardLayout
gdi32.dll.SetTextColor
gdi32.dll.SetBkColor
gdi32.dll.CreateSolidBrush
user32.dll.GetKeyState
gdiplus.dll.GdipCreateHalftonePalette
gdi32.dll.SelectPalette
gdiplus.dll.GdipSetPageUnit
gdiplus.dll.GdipCreateMatrix
gdiplus.dll.GdipGetWorldTransform
gdiplus.dll.GdipIsMatrixIdentity
gdiplus.dll.GdipDeleteMatrix
gdiplus.dll.GdipCreateRegion
gdiplus.dll.GdipGetClip
gdiplus.dll.GdipIsInfiniteRegion
gdiplus.dll.GdipDeleteRegion
gdiplus.dll.GdipSaveGraphics
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetMatrixElements
kernel32.dll.LocalFree
gdiplus.dll.GdipGetDC
gdi32.dll.GetCurrentObject
gdi32.dll.SaveDC
gdi32.dll.OffsetViewportOrgEx
gdi32.dll.GetNearestColor
user32.dll.FillRect
gdi32.dll.RestoreDC
gdiplus.dll.GdipReleaseDC
user32.dll.PeekMessageW
user32.dll.GetMessageA
user32.dll.DestroyIcon
user32.dll.DestroyWindow
uxtheme.dll.CloseThemeData
user32.dll.EnumThreadWindows
user32.dll.IsWindowVisible
ole32.dll.OleUninitialize
ole32.dll.CoWaitForMultipleHandles
user32.dll.SetClassLongW
user32.dll.UnregisterClassW
kernel32.dll.DeleteAtom
user32.dll.IsWindow
user32.dll.DestroyCursor
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
cryptsp.dll.CryptReleaseContext
advapi32.dll.EventUnregister

Execute Commands

"C:\Users\Seven01\AppData\Local\Temp\mnm.exe"

Started Services

Nothing to display

Created Services

Nothing to display