MalScore
100/100
MalFamily
Malicious

diecon.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 24/69 Related 2060
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 632.50 KB (647680 bytes)
Compile time: 2017-09-10 13:37:46
MD5: 2dfb7490cf756d3c2a431b38401dfc74
SHA1: 27adbd6e1eb5bc9331c5865426ff8abb3e011ec2
SHA256: 990ca0a900d080ed4925b0fe0d40e08eab2c08b3cbc81c054401571702d43f57
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 .Of'> .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-06-21 01:54:02
Last submission: 2018-06-21 01:54:02
Filename detected: - diecon.exe (1)
URL file hosting
hXXp://denmarkheating.net/buttons/nedu/diecon.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-06-20 18:02:50 [24/69] VirusTotal
PE Sections 4 suspicious
Name VAddress VSize Size MD5 SHA1
.Of'> 0x2000 0xc70 3584 227329917f12ed2063922b3eee4c5c9d 8fb6b6df27932ed73b77ee72a0243f618654deb3
.text 0x4000 0x9c350 640000 115933ed3c823f1b3aa0af3a8cfe0b13 cccd158cacf4d19434b3b51d4e4d6931e54cdd5a
.rsrc 0xa2000 0x650 2048 59e2afe895415c90954e006bbd0f73ce 4b31029ac74b3227530565973025933e7f97546a
.reloc 0xa4000 0xc 512 952ac1eba00028f4f83113cf033acd46 bf30fd4331fb8f2b79392600465448e2f6411e99
0xa6000 0x10 512 aca58ad185c6676e0be7968db5a2576c 5fa70a0886840e80c869746f08c2e25c879ed548
PE Resources
Name Offset Size Language Sublanguage Data
RT_VERSION 0xa20a0 960 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0xa2460 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 Jacobs Engineering Group Inc.
Assembly Version: 0.0.0.0
InternalName: NFIORLAN.exe
FileVersion: 18.12.15.3
CompanyName: Jacobs Engineering Group Inc.
Comments: br3duo3z34f
ProductName: Streamline hybrid Azure
ProductVersion: 18.12.15.3
FileDescription: Streamline hybrid Azure
Translation: 0x0000 0x04b0
OriginalFilename: NFIORLAN.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
SHELL32.dll
mscoree.dll
KERNEL32.dll
IP Found
18.12.15.3
URL(s)
No URL found
pictureBox2.Image
UE,A
^&2
Comments
YlbQ
e2c4a01f-40b1-9d
T78
[&8
InternalName
nalFilename
LegalTra
3cecd0b1-467c-b55
FileDesc
#"&%
Translation
shIUaZnwJlLjyaOuTsQiMoKMudGk
ileVersion
Translat
;6W
N82
J;
VS_VER
Form3
Form2
Form1
Form4
Yl7_
LegalCopyright
y Version
bc4519c8-fdeb-060
:9i
K=%
-ec
VarFileInfo
pictureBox1.Image
pictureBox1
pictureBox2
22bf32fc-af0c-a4
FileVersion
String
?tu
hI?
\$'
LegalCopyrig
NFIORLAN.exe
P1;
2018 Jacobs Engineering Group Inc.
YKB
Copyright
CompanyNam
cUE'S
Jacobs Engineering Group Inc.
cUE'I
389
27{
x,'
[=;
&81
ProductName
N1#
T:$
+m)4
'=g
.exe
3cecd0b1-467c-b59
3cecd0b1-467c-b58
3 /
k9#
3cecd0b1-467c-b54
3cecd0b1-467c-b57
3cecd0b1-467c-b56
3cecd0b1-467c-b51
3cecd0b1-467c-b50
3cecd0b1-467c-b53
3cecd0b1-467c-b52
VarFileI
Prod
k96
Yl1S
CompanyName
fd*
Streamline hybrid Azure
0.0.0.0
4I\T
`@XW
mApp.exe
/lc
0000
VS_VERSION_INFO
n<2
R$#
18.12.15.3
1i
s 3
r<`
Assembly Version
O10
mApp
|64
tion
eInfo
1.0
}4B
0.0
n"4
?/g
vAE
=y5
0.0.0
S;#
cUE1O
br3duo3z34f
qI8
qI;
StringFileInfo
arks
Name
Asse
ame
000004b0
ProductVersion
FileDescription
Z1#
OriginalFilename
$this.Icon
`X;
roductVersion
N_INFO
Intern
N5!
d,7i
+(-
*K^J
&EY"
t$Q Gs{
>D}D
ScYa
PNG
co]
{l`tricAlgorithm
SsV1
f{aY
f @p
tV<k
-)Is
jr @
t9OaNI=NPPhVrf34Q98
G%
b9clcm
+zQU
Y1nV
af59
%RV+
0RM=
UA]h
B|*R
&gN
;[# q
Psslfication
SU,D
rXBF
l78'
=/b9
[i(qim
7 o#'
U{Ai;~
Changm;~bdksion
TTdB
_Y)8
/uZ
%eC
' Z?
M< "-Yv
wK:u7
0WJy
PYeY
^MC*
WWY-
!g<|
qpxL
f.KY
E E).
=khx
o/Y
Q7%xar
TjI*
>USN
<VO!^
i$(dp8
&kJa{
e)|W
kk`pdS
@)@)
85L5
ds^$c
4DP
UTqfv
=~UtbG
;h[
s4a?^
w2{z
i(IR
eh9I
NO (@D
/8YZ
(8VT
A!F|
`I){Cp
8BM=
Yj,c G
}AWD6
t ~
w"za
A]TD
4}=5
Vemt
[e`nr
J/d;;^
lndex
X9HhX
_dm)
defaultPath
<Tp=
GmnlJrgIrkccHdCACaUaUtHtiCZeb
@Ugr,R
4-U>U
@k s
#*RO
D`&K#
EnableVisualStyles
mo$)py
g f!
SSz:
ulH9MJ
~\"U\
"s7$
RQ))
z[m_e
EmnUa
_Nd
WMmv
{jegONAo1xLv6So6jU
]Ib2
M2Q/
%d@D
-&|-=
/32u
ixUmrows
VmZbCUCYwJZYxNCemFbsBDZRKFvg
*)l
1aL2
{< h"Z
8N<l
>8%I9u>
kh{E$
8! ~
(.W _
SPqlmSrImXQx8e47pHp
$HML
"~(=
<|#
n-"
iJUm
cyH=
KU;!gOt
em5%<4
(<P
>< =KW
\M>d
FI $V
V$iSF
"7onz<
[#n$
3uel
ndl;
p9=Y
- `/k
y-EQPP
Yu#+
bE;Z
zw<K
x .
F\5lNg
NQ:
set_Text
y8>Q
-)?X
]eY\j !
.K+-
U[gv
(|+ .
a}9T
qW^K
.jv2I
`;'{
6J!xa
"q[A
MC+3
"x.;
g,hln
SetA
Start
/6;j
]}3W
;qqa
~D /
mC)[`
]}3Y
i]3yj
]=m9
AmD]&
Ka^>
BVsG4HrsJ mDh0oTbIy
|=e<[
-cb
ITQ]S4,3Q
%h)BE(
NVp#x
xevb3d
G#r_
c#++
]AI 0
Nhy00ororOPNZZGK7Ja
]b2(
YCRR`
UsHV1
Gc+rj>
3HdH
MkA`
9RM=
n!}9w
'S~;
6 vs
f+}/|
IR-y
Un[X
toe4UAQinULOgRQGsb
AZ\m
Zx'v
Char
e{'g
j#zK ?
\)Yv
c u*
y{JW
9YpI
|N=
"`"g!
a1Tj
IJvua
imOh
xl oh
}]]T;r
-U bS4
K!Ny
N%,e4N
yBM=
HashAlgorithm
oaF&
wybC
{[^
S Aq
rtMtAGWGjQKigXPlQflohibdoyyAA
|Jv
H? T
t-NY
oKPaAsJ
aE9E
get_FullyQualifiedName
x 6
~+K3!GG
w)oc
KXA
wr2r
I uslglyName
tsbqory
B /N
_OWCm4FAaJPfUy
F<A
YPK $
\S9q
+~5.
O39hq[V
]ZnZ
}]On:
az:^
b&t7
JxQ=
4C U
XM;&2
'S C
^D* M
*m!C9
.text
J?IZ
i5l"
GetObject
fD(,7Z
AOhzs=
uCfs
vA^i
< Z{
0NN3
!;it
]\|G
f`H%A
)IKjZ
uu+9<
PerformLayout
e''cn
H#{.
I}m.
O-|?^
sKBG6TYSv3N1GAH4F4
:*Kn
)@ |
V~U-
_<\#?;l
[}y<
w4Nk
[roO@**!
wR{6
t.;_
Und[8
e OA
6Ul
wf><
zvCqp&0)^E
'T
BxQ=
' w#
C6XQtIry
h;,vI
qbz]rM
IiIW
ROyl
q<}P&
r~vJ
edldN9%
% !D
W) ci)
o/#e
H[Q#
3$vI+
4.0.0.0
mFTi u.
WSnw
Cof g
CreateDecryptor
9iFG7L
4q*H
ie8
zRM=
swOLU
`vMF
RpGBcSsOlFUFF7v3wy
7F @
.ctor
kLjg@-i
Yp 7+9vz<4
get_CodeBase
{1Ja\<gX"
74 Fp
qKrY
FurrentUser
DxQ=
Ydf|
rRM=
ei@%+Q <
)HJx
@P r
V6ANI
.rnm&3I [*
$4)q
IzK2
MvK#
qt
,3iC
mI%IA

mB3_
veed
&{(l
gfmN
Oje#
>*RZ
JD(m
Et\zeCs
7}m/
Q,hN3
!e[P
,i9+
L5z?T6
()W1
r)D
MQ)#
aWfmh
i2/)
]c:O
e\1 u)Z
2FqIrn
z([vo
AyWIrRNSz
g]{&U
Q8$:
.8TF6
}]5E]
Y&B5
as2
QStWBsNjYbJ@NgDL8R4
7hM=
p+ =
]h+W
O~ G
}]5E=
]L%M
YkQ
AVFr
d.|4
AujC
_B4Y
*^Tp
o-wA#
A-N$
hJLw
'<Y5^:b
ReadAllBytes
Film-nws`
%&joF
| aIb
?q8[
:~%6
GJ\V
GH=(
rcM!
T'le
C6L@
~0ug
;l=Y
get_Assembly
`uoZ
p-<
T{J3ak
9hM=
g$eAE
.U{t/
0oKs=
IdE*
)kcs\
89A
)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@+e
9F #
P8
87TD
.B{L
lFf)<
rAN7$
u"AB
xg5*
x~42
<EtKN
_w+
}LNj
bprI{
p>5N
F'w@
={=q
T ib
Microsoft.VisualBasic&=i{qllerServices
+yDG
G=_9
QG*:z:-AQqe
`":<
;,Jk|
8\Yf
x: l
W[rsO,
"lMg=
{^In
SUv:
QwdW
Zy Ry\8
- uq
XJ4f
bwYLlPJbXRN8WdNvnd
6yC
}NkX~c
FkqrCFrMcPa0Wtin ~y
h@ c
IHDR
/GL$
6?55
oADEfXFghZyXNYuLuHwSWkaPShXK
]n:U[ %W
M[b$
VxxoyY
`UE}t
><Do
[HiH
Qie.:
57-
9}F
@2&8
qh#8
* J
System
EventArgs
Application
o}D.
xL (%o
tt~S
ReadBood
V ay
-W#T
GPU "
%>L{_
<rmR~
J ~M
LMCeJNfzCE1ay54CsLO
v2.0.58I4!
uO$n
q`B/f'
fB3He
,)\4u)
(()cgfM%s
~R56rEpXCCB1gOjCT
i']P
chHV1
y>J
5 G>
J T*
'$4h
Un&'
v,~e
MethodBase
8fDh
V_$L
CBQ=
-C`j
y#\56)Q
)8P
v{ C1D
*-= m
]}1W
?k fE
!ILV
{Y #q'
0Gusj
Q>?;
hVI@
W -)w^C
=+ur
L=ab
GR|(#
wAQ@t
]q4+(
R+=K=
width
/PEF
=%h:p0|
2O ]%9.s
oPX7 |u
@A8|rcXPBNHRv5Fds
KMicrosoft.VisualStudio.Eda idr+SettingsDesigner.SettingsSa
BeginInit
4*FJ
?* %
bdl'v
YQz
yc+!t
Z1dT
inheritHandles
wQs!7PAd
O!j
*BTB
type
Tprl
pm.:z
fvA
uytwceReader, mscorlib, VersiofC481+0.0, Culture=neutral, Publa
B& a{(
Regi{ to
T0Vj
ZJT3
m;#
*])??B
GXE&
um_X
q'p
=nsGB
S]Kz
:'EQ
Xa]f
r#]ME|
C=4k
Nk!
XhY4
Yy|M<7
nlut(B
o@FM
YMVf
Fh f+
x (g
([WJ
MsodT8
HiN(
BK) M
]g-M
Y }C@
Fs.r8
k.e;
VthP
q)Xyc
;'`s
k,{b
HyWDNDSTnoifmbbokMdQEgLHAhcg
?42q
pLD&>
Bm,[
[ Gi
?sP
_Osc
|R_bC
3#..
!/*B
UxY=>
8$+hH
$+zr
z*sPIkTj8
_CorExeMain
.LmG
!Y1V
_fF>
*gc?
uU&Q!
z@/3
l7R0iR
ContainsKey
T^F>
O+]r
Nehz
0^mb
aJBBNRw
[Y+d
u;sZ
mlX
V \)
y3X|
|oQ*h
startupFolder
,ow}C
U`e36qraCooLpD2xE5R
IhQ=
EK$6xYTj
6i~6
e4 L
gnq\
o@tek
]<&ka
K1 s
u zU
uRM=
us\eK
3(H^
mg!
totalBytesTransferred
MF r/
NYK)
shM=
0sFZT)
HYm$
z~WS\
* \9
l8+d
ho T
]WN/
n!y.
27*{&
zr 7U
z*/"
e5/<I
p^>j
}_{ V
address
|7[Xk
*}JIs R
W[|Q
>uV@
},8C
&OQ;`
@6.E%
2H@$x)s
lm.ycZH;
f_!!
)X2X
+ow#
";/h8?
+/^.K'
F,z]
0t6R
XhTkOuFyoNmMCmEDtfNXCqsgJQCmA
&b;x
?Cm8XEn
,2Mpo
y'<x
!ock
I&Df
7F \
v7N(
set_Name
[O8)
I0c)
[S (ll
5/g2
oaer
?AGK%
t?~
9BM=
n1Xm-
Z?UR.
mn:CiR
J@HO,Uv
&kd|
&gJ#
execPath
Y o
X 8G
YCnX46fnynCNlU30k-v
mN J
hR[e
Jc%a
Y<DPH
{~rE
H!k(#
thlFajideXlsQFOJJwgUhzboFpdRb
"
E\y`
W1Q?
j6/dm
DAbs
qUhY*R
qMKto(
:5g'
Ijjm
JK#R Y^:
rq]z
I;G~
'* Q
?5z1
V_W4#jI8
jBP?
sbsdl, PublicKeyToken=b77a5c569G5"d589
N9w5
data
C~
8RM5~>~L8
1Tr[
WQ6v
8X#p
A+X
ej`9
j^Oy-
UInt3:~S_oq64
'_}z
;N C
SDj~k
R$ZDD
3W?|
upNJm7r8fM0OkU1Oh6
cI q
|u|m
$Y1[
p*"d#3
n^ ;=R
] SC
o2>\Kr
Rh%FVZ
\ Cv
cxRpbKey
2 #$
T,)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@+
59C33210F058BD2F5912B0FCC96F07B801862E3A
& ~
/?a.
K1[qx.
%QtC/
K,.
[2[.z
*qYKL,z
tP!/
(Ddvources.RuntimeResourceSet
<p P
D"^r2
<FFj
}3lX
i O"A
W 7Y
Enumerable
A_r]
-[Y
LSirpXrr82BIYtEEJOF
q6mO 6{m
:Y$
nNB1warivHRaWmI
]Zvp
DY6]R
x#I;
Tc&{
Sn {
kq@%
\ >t
mb"S >.
S-Jz
VP;=
]o":
bpRONykGM5JJ6YKDdA
0;]x
^960
jC$K
LNc-
8Af3
lOMN8v
-oZ!
<M{1
).('c(
Dwrlc
H q$
`*e~
jxE\Ej
"\qh
:P t
IVm
E:(Qm
nyf#
}Ji 0T
C&CO
3_?
KVe
AssemblyBuildm Gub`ss
d8W$X
l%!d
p b&
~f~z
V53OIXf7pK1Z
J[VCM
Vd
-Q$
[*RrF@P
D@]?%
~N}G
MsmS
Y'y[
#+"2C
l`ul;@
6-ZvJ
sY%S
^}]E
{I g
z4VZ7
^[$e <N
>:@5R
u9'A5
:SM!
(J j
QX5K
^f87
*We'3
stli
xWV
-Lw6
@q;H
rA5][
kIQ%
W(d/,
g% 5
[AIP5
#tls
b>74
11.0.0.0
]~8=R^\
H$$sQ
cphthTNYEb3uhqMhM7S
YRuZ
Invoke
mgc'
(x1J
hz`F
s3[C2
ZXeJC
-{}
p'y6
: fz
buffer
WV,w
e" . $
WTII>
* wW
NocX
passBytes
J}_=
gi^F
1k_~
Klw5 ME
>\B0
|A"gl?
JM^^
OO3v
Array
^gx'6L
W{DT
* YVGX
P=UW
rjWA
ryxQ
xGjlder
*ik^
Ase
FIo-C
96 4
D4]M
1K;
hq m
oWMt^9^
*v@Szj
-!IRH
j5nFVIf42vaVM2lujPY
V8 (<PZ
+ 4j
`N\w
4 gv
rUH{
}U D
Y-Xqh
94>,
LGPl
Y 6lu
y'v7
HO#?
sOz&
%fZI
N tT
!"V#
I\n6WY
"ZGF
5z#X
; gq=
bgvz
&R Y
) [O
qbI/M
zPV8+o9)
bFMr
g9l"
Z+X\
-!kO
1'-ko
-+`o@Z
pBM=
v[dy
}]e"r
C Fp
jeL 7
J YV
^\=A
HIs6
c~IU
:`:M
%(B<
Runtime\
nbtd
5l}N&
b!eUC
7USG
Zj-
[~'u
d${
F4N+
aOw
YNP{
b"F9
Eo,H
ARQ=.ABQ=.resourk
qY-2q{
O!J!iQ
#6~E
WOn'
x l<
hToken
w}>3
{q'_H[
@RPB *
G.7Q
:vz/%
h2Q%
% ;R@
uKQS
RuntimeCompatibilityAttribute
qHC!
!;Op=
(u,g=RA
TiL5!)`]
f Db
Ww)\
ii95
jl`l
&s4&
M=4\`Br6aJArC2rvCvC
U'oQ
5J+&O
@^E7|N
bWuqribute
:YB~
Ot]vG
N>Pw|
nm:
hE b
9\9{
/&K !z@0
. F9
$ l)'
e/[c
r'4F
Size
~ja+L
(y~v
mii=aa#
q5Vo
vvL]
YJ'$
9(O[
y?kO
]P3'
Ju gqF F=
7 *!
3J`c
9"b
/so%
B_p*
y >yp
i6/4
+v>aV=!
[*r
@S@%B
6RM=
wY(4DE
eP4.
#hp#
P| {D
:ybq
uUyxi
'V3N
jEP"
8jFC
IContainer
RMsI
,8;'
,Nl$,x
oB/gx:+Kzz#I
o_G
\JZ }
6GM=
,HPy
Vn?t(]X
i}e
sJd! Ii1
<Yrp
IPQ
PpwU
e< F
2a'x
rg0Tx
>3IH [
=,C6
3%CG@
f^|\|
%jAH
g#>F_l
~;.k
6^F#
cwr`ComObject
%wZb)N
Xppv
z_{#
TG+6
Eg^u
+cnT
d]_.
5-sz
=t'2#n|
'I"\
x2{G
8Hp+
-jVi+
G6'8V
ResourceManager
Tk=F
Q9,K9
}Ua~
mtyV
57iC
V0+
HF^q
D 5b<
eOvZ0
3+!^
8-4(()Px
z2fASbNfmYoLRxJm0sN
dC q05
ContainerControl
fei
;skeu4
AxQ=
YbEimsog5jIn4Q4uIV
qAY<B)
`&6yg
ToInt16
K(*?
@.]riV:
>QUI
sxM=
*JCm
A-xL
6 4Y
~5!U
$u``$
Y$oik
DR:&S
timeout
vR`qa
\C@'w
@^0q
nx1~
VCOF2
vwp c
(9@l
nK }
d(fY
Z /E
W#x*:PN]
VKVW
_ pw
/tu
t&HGEp>
M7o\
e#K.'i[i
p\jx2
7y|+4
(( "
RNGCryptoServiceProvidm
1e`lYV9hqy
'QH
Xz'
-((V3
:lf{
55P6Q
7>vOl#
7cxW,g
\vd&0Agr
P P P P P P P P P
J[gR
?3Qva
5L={
) !
6yJ/5^h
Tq0y
U+=yE4a
Rega rdxSalueKind
59IXY!
c[n@;
}j2#
|L]W:l
k|)fa
== R2
tUaN
nqXW
\rPR
T=K-
"-o9u J
fsfB2jzLLhRcYKt7RO
Close
*6J/u
/u '
'*uu(
)H?A
^h,t
uz1<
^+qG
jIPP*Q*R
EC@8
Iz*5
Iz*4
Cc.wPXn
mHPH^B
>=J-
h>N)
kP\4
CallingConventig
z*Tmt1&^
Z hbhheCompatibilityAttribute
&9c
7,6kK
O-=<
S]lm==
UF^C
3mSs
pPOu
I4i,9p
G f,{
dted
PU EDT0G5
khiyA
Lk9
}M q
<RMLZc
$(&CJ
0VE;F
mhi/I}
Y*&4 4
8QBt
q!=H
/Q5/n
UZoQ8v
gW;%@
eg'W
_cxSb
PBuXYXrpYYSqKwXsfdo~Ts`aSingle
JdLaWZOVgzDOMjcdZJiZOChpczTtA
WrapNonExcep|
[ 8-
h Y#
L+(a
mBv)/
W co
mscorlib
ASU%m-
FileMode
i-Sw
E qKh
N@~2
XS/8
NVYk
VJY<t
T+{\
w}Gs
S>a|y
Ti;ccl
Ek3hM4fpXXQFwLA=ESt
mev3%`
KQ$=
I'4b
ControlCollection
$B}M
@([\
**+ X
c8HkteropServices.CharSet, mscg j
bet_DeclaringType
1f9E
DeriveBytes
]u s
7q |u
Njj{u=,SG,1
f wAY
-(tk.I
<Vy^
Y3cfX
w,e5
y3d aj
]a)
t^D{2*=
%+JJ[O2
9y{9
Ac}s
?8W+
AesManaged
Ci+I
. oZ
=]lj4x
RuntimeTypeHandle
method
o z7j<
j}D:T
BHO#
c)1u1WEX
1Bc%)J
3Sq rsl+Resources.Tools.StronglyTyx
Oss.
^W;wy
vaiKx:
o [N
gwnX
j9,H
@PX`tG7
4JK6B3!
18Bz
C%,s\
+ GlJ
dUEJ
UK2bz
JrK?
'BY)
"V8e
!C5`
nkn?
t,{U
f=ty{
f]Eh
MA,Yp
UGWs
lf2Xh4
f Px
MN/<
YmJl$
!FP6
owg
EhQ=
k8Spntime.CompilerServices
uDyQb
P 940y
j85o
V|:68
e V
WZ\e
*Dn'
>&4B
0sF
\ppV(
@iq!
@EAA{
5= Z?}'
X#[i:
5P<;
,(}"
)<!K
y_,5Mu
?Nc3
]7hb03
C]],u
!v%j
CI3m
@D d
7-B>q
&Et
2*fG
;1O
c5=|
IA$U'x
[ ji
q5;lm
IO=UH
G,7A
&x~Q
cCZ0
.&#l
hWO}qD2FoPLm1c8
\mTU
2 >J6
cW/(
g$1qT
k=H7v
/75)
D[23WryE5Q7pcWCeJp
.":G
S'KUq
8qY>
PdJv
dmAW
=-5O
O5gi
r{58n
5^t:
\| w
Iu_P
(Edfurity.Cryptography
=VVkj
%"U(
W-* x
sHQB
VIR[
_Anb
R|N=
RMuD
)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@+
o0D
set_ClientSize
8tn=
,nc%ji
s|,4|
>9>Ts
ez|+
Int;L
.|Nh
,t}*
AmyX)
bytearraq<
M)r{
H mK
3D4a^
:V *
%gjFF08
-EJQQ
WfB
ngmj
Z:OZC
oY#>;S<
z9W$
5G5$
; ^&SL]
&? rv
&:[Q
'*mt
GN.lp
ulvMm
uK@-- `c
BkqpeVHoiaViaoEMBzzAmTEaRBB
0UK u
oAb'
;INT8+
FdwmissionCheck
ZTBV
H9U/+
v6b
% K?@
}BTS
\Y4:
pP4Q
DVUCWirSATT1cfk9CAc
@<K<I
HW\\3L
^)m[A
KN6iFx
][|*
6v|K
%$>2zY
oe-%
<8$n
d2J_
:54G
G/eS
oOtyp
"QI= 1
`T;5@
d'dra
0)2Z
%?=u
Hd z
CrTw
ec:C
H*_A
7VJ\
Xxncd
*)m k
De#c
R\"\m
GetCurrentMethod
&0Ag
PF7
K0b.j
Ds2C
{7jV
V8X{
2jE]
*)-=J0z
+ tx
Ym1tv
VnwdWI1ITu
ZVJzz
dpkt
g.GV>p+
<Xa{
LsNq
6>lcEp
hMw)fv
+7o?
P#'0Z
Tuwj
' -ax8
0VkQ
@bsXI
F: h
Settings
BlockCopy
S.=.
Y =q
8ki &~
@|&>
m!]-4
#FPF
{X>((
SizeOf
2?d`m
St&A$
Ki Z
%_Q5N
xe;8
Z*[N
EF>$T
Jl&%
@YaI
`(7tZ
BinaryReader
_n>N
.*7a(
hK2
wKy[K
set_Key
:\?
(v
-MKi
_AVV
j<2A
E,)^
vgD*
2hM=
aN>Cc
N>.W
RcbQFmfximDCgG7CJ{L
'sJ$
WMQ#X
R>Pg
M$lW
KN ,
sZ.1
RU=;
6V5z
N+ X
OSqm
rVTr
Q0bV
X(@RPB
MethodInfo
]@Yr)
dn0@$`
[H9
CompilationRelaxationsAttribute
<uvF
hn6)
(1Qi
&}hr
=V('
V@jC
5*
MemoryStream
;.!i mM:
zZ>%C
c"ny
aHK%%
A]()*
W)zi
`owR
"`lTl#-Q1c
S`sourceManager
jXnt
T/r
8CkJ
Ejrb
x@B^
inD&nS
ypf.
)@U
UT?<
?^* M
d y
U@Lu.z
K4[ q
ed UF
I 9r
78t
_M:<
8a9p]1
gePS
)9)e
;.}y
0BM=
mutex
1iIK
-n.@
@`@X
SwNor
IWN7!
N vO
`poR
1lAa
Y<=\k
G"GV6
.Z^Z
v,-sn
@ 6a
L)W5
3['A
pje'z{b
u}7'4-
"7u!
56N&
newPath
N nT
)$ $
8#=@,z
TROJ[u

!!FU
W!9w
V*^j
n6?;
jsfdte
t?kC'
UU)2
l(.`*
5oTp
9+Zs
Concat
[:0rf
z(Mt}U
h I^mkW
Q 3
DialogResult
l)3HaM
xWzw
b.&-py
VU].
>_77
2]e;M
ph8 H>u
j *{
2SG5
a+Y?
vfLX0
t >?b
-psA
GG4
9$oY
[ J+z
iXl]-kuq
}#xc
\8mN
j Kj
.yd
kDybC4
J*6z
wWIAfcr0NGYyQWVd2Dp
m'>T
Y =-9[
8xM=
;m/e
$k-_3
%g+K
JIp
mWe
oQ.w
;pAB "
g~vb
! i]8O
FLttNsfykbktv0jrP6s
E>M6
UO3-FZ
_NiX
V1b1F !
E7 fRl
yPHW
RJukB
)fNV\g
(rNq
f9tr
Cjzs
Ju>+
OB%iu
rf8h
Dw9X
a=sd
*Xiahi|@
\U{x*
H#?5qV@J
FGQ,
<$WT
PR:9
RTl1
~D!Fl
GTsy
cjRcHpfZY1ZTQPCoRZG
%D6dt
k<X|
cd<wo_7<
+>k=
tx-8
|ZBZK
_j9Y
Y ?s
/Uil
&e1J
9cbGlleNameWithoutExtension
#g^M
/D|
4=bc
f\iv
VR::
4~+
" )'%
dytW,
wSiQr
T [E
~\mi
Z6SL
qH\
M#=*
K*}3
w'~T4
i'~-?R
|,K+
$KKy
#wr$
|/v$
,m\Bt-
]3Pi
z Lu
Zu _
-qLP
U;[W:=
P P P P P P P P P P P P P P P P
Om(-_
Z?rh8
eHQ$ney
DebuggerNonUserCodeAttribute
'C N
fZDD
i-9 2z
rF9g
YAT}
cuD{1
vLX.1
WMH6
C'2!M
a*^N
$$!8;
/qYV
DebuggingModes
A,8x'
CPm9gNfCcOKQODii0Mp
Mnz>
/|NI
V1gb
wo>E
eZ&M
%do
U:+WR
H\gx
td@R
(B)!
uy%s
4l#h
System.\
vy W;
+#n
ToArray
,Bn2
V!GJ
nYpX
Tj*~G
}]]Vi
8Wqt
0\Z&
Su7&
<xWt
,{SRg
vP f
L_ke
f7V=
* A\jd;
/K/u6
! )y
*''h8
":2J
J@QX
8_*V
<ebmemas-microsoft-com:asm.v3"6s 6!% <requestedExecutionLe~
WRUdydzHYqHUhIdmRdxGuGlNHEKF
)!8
h(hhb
F6o9nKrfwh65FsL60cq
Sy{ c{/Aiagnostics
kN!,;N
Cx@8
brkh
xdrFile
3eGq
xf3 E,
[?HZa
lQJH
93 U-X
rTxqes
q 79
soc;
get_FullName
7w o;
4mq
Z_ z
B/15 K
=1SDY
i-s^.
!pt,
S=DtdaD
N}jYk
RmGs{}
emJu
NBI'
"*H#
iOwME
WCOR14mx
4?>x
7U= l
PH$W
/7}C5
w$*@B
q@qg#"
WU?Xj,
_?CK
NtK2
v Ok
iSlWH
Q F87Bi
r 6b
=nr3OKqPU(
&^
^Q U
.hh9
o#,WX{
1Q^l
%GJ 3
OT[<
fhMa
\ XHH
0b2 ^
C,VzJW
%! P
fy?T/
u)(J|
tR#zG"
ZcIg
FRQ=
1VFR
Yl&r
"A <
Z^h^
y 8?]C
m#wL
|2rx
p]w*
8gps
eE8w
[X@0
Qs*S$
oi+{
Tqa;
1I4q7
88V$X{
?Ep9
Ewj4
Fi_7
k%cc
}U5C
G084
6z:NO
ES :M4
@(u!_
g ,3DMF0
TwCQ
8O,p'
[aj>
joBjnfigurationAttribute
^}w
h+}5$ntn{
MyW{
Et[a
7tyF
d6Lb
+\Ocb
>R}c
IPEB
get_Nae
]-L'fXYN
Olo3r354pk49PBwYxG~asuZScan0
ky nal
Cy<:
MvbBZ7fQ
%%v:
:R\B}IP
'jKV
Y pW
J2#f
5YrV}~ 5
Dn*F
S!+m#
cM+:
1.0.0.0
2A_T
QDAS{
~|UY
wU0q
8sLE
4r]VpJ
SA'p
Bd/D
'tFW
z_zSX
Stream
# %G
'jK.
>%Gc
x2Ok
%''L;
!WCN2
;m4U
sRGB
+'q<8z
yTkZsJ
$3r6
GetAssembly
""@$
9RzO9
ebhjns.Generic
K)k:8&2(3(_
eDtM
"7{D
~ MU
dEX,U
sz@`q8
(l5v
r_X`
IFjO
vS6U
NF8p
optionsDelayTime
=[>P/
VInee
VbyYa
*N+
[P[;1!
Q`al
uL9 *
/<$]
q$u@%
8^g4
iCJDQXkBewOfeXqJyEOJoUBKTlvoA
WgH
1/ES
^$~w5
process
w^Ie
Gk72i
M[Oi
#"5*!v
y''l
[NG>5
ABp7+
Wg`lT
_! CIW
s=[k^
+{ LT
$<sKO&
h!H3rrFcMQTdYmPTOd
0 ~1
7okGI
gGD>
~&"m
CreateType
^N7t
.nE
CoAyt6rzRui2e0PyD7y
\1 a=
eWYw
CP2K
P^!"
T5J^
+V]a
K$b-
KhX|
O=.:V
CGCK
Gzxc
UUe*
BR>q]
TX_#
14Ie
WB6o
( WY
o'If
mEm]_
<I[,/
VyW#
OGQAv
R$H+tt;
Xfgc
=[~M
57 EY%M
yAbjFBb
OpenRead
)f(x
dW8g
7}/J
A%m$
J>OK
)
FD@D
)V9dV
AUCQ
)tJ?}9=0
_5)k
V<66T
set_IV
|M{#r;y
%AI<
%AI;
pxn
K-<1
hx8YTirxYN_75rm4Js9
*9
System.Drawing.Imaging
saO6
}*vw
4a}W9
*J+ X
O\ ]
kernel32
78oB
98%G
y\3_
CHI-]W
-JB
A< p
Z7I
"K)i
7f
qJ5 1S
0 ~5
uqKx
}Qlx+*
@{'wU
N8db
iAOUu
VJW:
i:M6
_/k i
bnP)
%#Uw
SM[0
,;T ,y
vw x
Point
"2RVaq
~(vm
)<7(A
2RrJ
MSq=
V;."
";r*
Sq rsl+ComponentModel
W1Qt
B vl
g0wD
!A:Sy
w,FNd
}U=B
FNO#
^z@
:NLPf
-QsSN-
3$O.
vEzU)
yx};^r
aikAX
/Z#>
5(Gj+
t s6s
69i#
#G]7B
V_XmW
Id$6
BZq^J
JV<
SmLvv/
CcjAR
=jry
CXj?
XtZ}
@P_
()*
e5nE8Qrd1YdmCtEANre
;1|9
XH?(
;t+it
1rqj
()]T
BTUng
Iq! e
Vrcu
8h\dUg?
Vv'O?<#P
C I*
]rb.S+#[
(O.b
heqN}
ZR@Q
P889V
C "'
v{Hb>VGam)O
&3E
ld &V5
Zwc8
_>l#
?Zs:
6qU3
T NzC
UI)Y
Ca>/w
QWhzs=
\>y*;
\C1EZ5NpNMY5fkJVKSa
[#^K)
snUHjlfTij5DF1hmsXL
Wh$v
Mp!4
_5an
JDt(@U
,sT81p
BFM
oh4~
6p3;
hM87l]}3W
6bt-
r1j
?T *
5BM=
NoXA
handle
Va0yU
No'jiR
)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@+
-LSh4
YA_W
!Xj$K
s MC
5NtNh{
}IcoCP
g /W
K7g*/
hNO*
|CB*RC'
hNO,
4\kDTc
MD2oNOfmKWtxb6tobbQ
4St5
cA$
US@yv
icuM<
}g_F
e }
z'>6onW
MW0>
=fmz6
" QP
Sko=
=k,j:
hH.wX
r hO
xcnj -
dGGOBy
lfz[Y[
qCJh
wKkl
iZo,
!!!`
AssemblyDescz
> V!
@jNL
n*m|
IDisposable
Dyn4
YOIo
GU(Z
'sN:
<x|k
op_Ey gzhqy
%nG;
r]HK
9q=j
4y-8
'%e:
u'%P-r
\JS :*
hkx
;DVK
Vcl5rtXD70e223B
z!l#x
V `k
WOEf
\*[Q
'W r
xuGL4eN0QlnMhMVUQAE
^1{,?
$$;{Tp&,v
K-v0
/Mpm6
\=
GeneratedCodeAttribute
Am[dP
fYkq1DfrpYD9jbiKRqj
{~ga
U?b2P
%{f$
4{r9
2rn=
d#&Uar
T "
:~ {
#1 0
)~{Wq
LV<* 4]G6
}\+Ny[4m
nNs"
S,n7U
=M%E
get_Exists
VL/(
j!|L
W=?o
,2ZyC
#GUID
:#_l
qBM=
9$+oD
:VXpc
u/I
a2]
J*v
N" "
set_SizeMode
W>[h
j!|4
mgkq
Coy/z
tO! $
qxM=
3#nn+
Idw6
dcsZKG
s[#6Te
$47dd77a1-7696-43a4-a14iSc%`a1fb3bf60
+RYe
kqQA
}5m8a
(YR
$<Va
Y=r 1
3RF,
}]$T
qlEM
SL%g@p
s%W
mHyT
|%ImiW
NH iC8
s=&i
"<;S y
~{rEj{t
_p,CAQ4
E@-E
**C:
fQ l
dvuG0OfsiF0aQq6N2OI
Jr2r9
@QH9P
dy-hhh
gAi
r];( a
>J~j
J /
q~*?0
I\wxz
o;$p
c"8W{
!@>&
,H{m
kZ@
{ f
M#a|
/J3;
R`qeTime
EbWd
#hu*O
5Ud[M
Dp w
xrY2$
doe]
2soPT
!c BT=c5l
JAq1
C]h?
jBe[
5?dvv#
WaitForExa
"q7
-y%j
ge,hicrosoft-com:asm.v1" manifm r@dwsion="1.0"> <assemblyIdm
j# vF
9<k6
@ $Nm
_Kju\
R9D?
B8Du
)_ #d
<PrivateImplementatig
CA&6*
Ve9ho
get_Size
B9G;
oldFid
(%D+
KPz'
:rrj
*=jvE
?6BD9
processInfg kwulon
S +z*;9mc3
$h`=
] 6Ksi
*Zr
+1bj
Z6e.
*gi\
(pp>
XoG r
TpLk
e'8*
qf"b
IfL&
nzk"
rwzV
]~8=R{[/
rG-
X-kl
^<)`p
OA*I
Me<E
`xZA
7 lIb
:S1"
qhBKH
'MBz|k
?p[ZY
9R;6
((\C
AG&\*f
<sPN
u 8B
NK((
(=jtD
RqIDATx^
>L.9sL2
;pIB
\$*b:
f H9
U@:2
=ZZ
IRQ=
dh}%
R2"3
^IdA_NtY
"~L=
jTKF\
6IQg
^ g>
n eC
|*'J
;kh+Q
U| m
L ??
M(;9Q
x|/[{6
UD~~;"
2_
NqNAAbFVLEOjXuWRUkwwBScEuIMEA
MR[w
.n f
!<pA
s&TaN
^trk
W]1f
sK?c"
N>|T
shell32.dll
3,"&
-S[)
W<bdB
WQ*JC
QR@O
%H}2P]
w]G"
:+ X
p50,
I[qnAhRwH
-N;p
#t7_
pz&r
oGY
S5Dq0
cZXK
!lT5
Me-=*
q 0Ss@
3EueSd
>e/u
"*]#w
":>Q
KqlHlHxppzFjyhaEvmUXbWDHILKeb
DTB(
apzYujynPQbHfEVKaCGPzUxlJpecb
eiRbLQrjIElrinN8waZ
qc'p
g.2U
sNHY
G[$U
4]YK
Wk=%
+/C8
xqq!
v!E)8Vk
xiic
u]2Lg
6M%)
2Cf*0@q
4*(E
J.EmJIIR
|VK\u
[e%
yl<[
VjV
MudU
l?]*
qg7n
2X*."
uuv,
q 1H
i2[*
w2lDAGfdcc1QYf
vF|6
vt<?
W+7
OAA :U
R%0R
wBM=
p ,h
$Ir<HWi}\
Ebj"
)@)@)@)@)@)@)@)@)@)@)@+
UidrSet
(j>k4
q<5Eh
Ol
LcYSPd$gr
)*es
4nvw
nVJVeW6qPD6h988|:2
h7Xcr
A9>p
Ci76okNVwYuJU9soRgY
r2I'
RUD)A
$#kaeJ
4#qvtMgEap
Marshal
jRM=
S}#m
GQe8Mj 4TXVeL9RmHV
'@amj
$9v8
EDCO
r~m"8e
[iCnx
s8y{
EqL]8
AP5!
Z2@[
SUz:
}UO(
J&
mJj-
I@HW
CxYG
>l:;
hunaing="UTF-8" standalone="ye{\9(
total
ue[G
~8 6
3-~(N
y_>
riiRd
94`&O 95
i8P|
.kH|
#5.(
<1wo
3_%%
Oa}H
CEGWapydZ9MBaV7sCr
A!H@
oq^
1][E
/]jY
iSw?
?K?
DN360{
Gbuwibute
8!Qx
(
-.T-
W #x
rc,q
H'vH
d*Ln
le4"2"
} O $&
co7S
Q/nxx
a}LGH
M=gGw
startupInfo
sD,9
&4h$
h>v8
9mS I
t/%~7f
j.]`o
3wJuG
S| oxfFomparison
OGWX
$nPe8S
Z3N@
ZO5M9
>U9,
da]_
oQl[
#29G
p af8
&!YV
'CH=
AppDomain
cUnpnt
Z3N
$Y-1!
\3fn
TY6DGo
NS9+
Multica{ Bsm`gate
4)`6
PJ Q
8zM_
RY.4W
PADPADP
O~=g
Z7[?9
W(lv
ProcessWindg Ubxie
X]Ru
P%17e
^%
_8 r.
( '
SysteePR~s`ading
QHNz0
x .3
Jrr4vANkbwme71xn3G"
Jd{:c
PT^33y
:Er1
nkq 9'
@vS'
<p q
$h]6~
H V/G*z'
M_{+Ed
Dr0[
afM~+
rOoiF
W>&L
L.=#
* 5[z
u{E*
zw h
VWGQ4
Control
I]9<~<
m4p]U
wvao
xrI7
7)ty/Jm
u{8Q
N5h6
j=,ik^
J0Ht
ToUInt32
CharSet
list
^{U,
./A|jR
'B(U(-
E$!0
RoHvW
Type
d3?@
1bZ{
]Q{b+
TRIMo
{J|'-
{iUy
[G:A
sTG8;,
wDg=
@+}I
A?Mw,
9^o!h
wJ#Lh
?RX;
HdMl
LB B
(52+3
G>Oe
a80x8J
NXmM
L- $
c8*Y
0Js|
&+'$6
8geRa
,')Z
+ BU
|*9H
0t%9
Ohzs
Ohzp
7|!B-}
q'h)
ISEf
H,,# BK
*J{
qg
X?];|
I >3
vOC
sLh}oo!!
U%.
jT!qR
?'q;#w}
f!MJ@Z
dyAGAaGpGRYVcPrlHLntesfCpVfqA
GK7d
Nj)*q
S*X
qYY2<2
ltj[
)'IDATx^
m\Gq
V9|tF
@eNigjjLW
8B/J
1_1E
71i
^eSEdA
z=^\z
iIn7*29-J
zq?U
:wKV
Lcc
VE[1
<?xml version="1.0"(
L>&1u
jwulonRelaxationsAttribute
Crg3#
w=GOw
\u8 u
()ZH
~F:D
1+Ww
#g!
% oT
GtL
;M'o
D 92
8+3T1
mApp.exm~:[naule>
86dBK;-
ADF'
@z?V
qnKR
7HUr-3k
{Vj^
Q\>q
T9J%
5r&K ]
H}Isu
1Rc _)
N8`p
%h2
nPE932ruGC5t2REVSZ6
i|/7s
I vi
vNFTr
n6_>Fr
F7eT
(C{U
@|geI
0>DW=
PW9~
td1>;
BZ7yQ
;1#qj
$CFrst
""B
YV$W*w
k=>!
PKx(
.*REE
D9I{
}ZK`
FEvgnXwCAUlcCkRxvyhQgdMMCoFY
Monitor
byED
esqqion
Q*jj
Q4.&
K,Q:
9.Q-Q
pLzL~
z*#:
+IG<R
7wY0
%ASy
"y$P
`DE=
q;DE3%
JPWjBHt=
dWK_7
Q=3LX
FFGvE=
)- e
C3ZWK6
*NVq]W
MiVc
UfAO
U+/'
WYmWn
R Tg
qR K
V+ r
lhnR
%~./
`.rsrc
OJOT1TpfqsViEJ6FJg
+{)?+{
}JZh
lpNewFileNi
wslOO
?3Qv`U
#=K/
8aQK
#y`Mq
VS m
?3Qv`D
Cw{Y
g6#R
p`#<J
-J9<PF
8y~#"K
!.,{bG~
S{+k/O
,~0-
XHPKaNSHf1Z,g`HQvN
*L>A
2_tpnr
W {
N]F~H$
bB;O
M0{\8
1I%T
<nIC
rr`t
zFP*
nNJG-
7I @[
3] ?
H Y
0q ]
-y6,$P
/%Lo1
'uG*
QQCKi
U^Z
asr; </security> </tru{ Oxgj> </assembly>
{M{b
FormClosedEventHandler
EXap
y |z32
PictureBoxSizeMode
YWEeQvfj3mNHPAyLOx0
et@B3
A#$c
NWxZ
efHK
m=2,IE
gu>oC)g
get_ParameterType
B@#5`kv9
QQ2m
cQno)
j,W8
DigB9B
|T`ok
Tc ^
~DCG
)V%FGZ
q'#
kT u
PEfZ"
&0GCl
\$4w%`
QvRS
rN 4
+TvGY
H.Z6pv
,3Rr
set_AutoScaleDimensions
QJR8
R {#
4GL1
fBb4
..{))
7bd:N
uAHY
ZOVVS
06 O
%0 @
J^~
Ge|;~sbptingAssembly
Jg%'
iHUj
Xdn6
ABQ=
/ [4N
:k}

.FwL
cd`qedCodeAttribute
<T@N
Q'CI
o)<LE
3V|
%Z{P
o_QK
|C6F
Dispose
2 W2
-?l
i$5*5=^
lpData
\(U [
m vg
nWhRv%
i .`
P28r5
uFzV7/8
wPz@
Read
_ .{B#
r1CHjA
-d-I
Ur6ugNsCKh5wmhSXZ
Ikv1
oQ1f
gGw(
k=al
4Tbr
k}E
;BxA
p qz
IconSize
Ck>p
b2bs
^| >4b
Ttcfer
System.Resouz
sRM=
p<xc>
- NK!
);K'
IM/F
UW U
i=3k
O[ 6y
.fb-wv
n)>R
5nsO\
q>q?
$ 6R
<).M
mpz|
[@UD
<F+ G
YI|^
6 pb
JJf6
}nAJ
j*)-
\vzL
#Strings
W<Q
w.ieS
w!>O*
?a0q
lczMM
]?OH
Image
=_ch^
1B ]
U'@i
ZAok
568DTd
gDiV
[eDq
F:gUH
cbO
Y Mc
d^n(
nZs
()+YZ
sZj5
OVN+
XK/o
!*RE
YneE
Xl!x
zTbQ
XY'rF
_rKullOrEmpty
aZ]
Z{Fa
D:b+
f|.x
7 4&2
O'u[
j 9.l
C\{D
W?)Z
hU,!
5mryLD
\..[
!7k[.8
~I{Hl
jR *GXI
y+Iq
dew6
;@BZ #!KRd
y[aQ
(mV8
ktm|CopyrightAttribute
z|O<
G>5Z-c
:yzf
pXF:
&"]d
E_nv
!m*( u
D)fr
p[iz
? `]
9I$ l\
c!Tb
System.Cof
!E)Q
XNXl
48 c
7!tT=
e]mx
xlOBZqb9eER|
eFL5}?`}UDBNMgqYNUH
?5qca)
+\5;
C:2pH
N|)Ht
R; e
U.IM
AOhzs
(U'I
IT'k
])!+
SCg'
8@D
G8md4
WfEhDogOMmXsRddiSnlBPQdmmXPA
T)Q/c
Aefault
lLrYKd
HMF}
H\L;
yu\
l1HZ
`\W3
(PemNc
76&8
MdeBsFCHaIaiFHJBXFZmjZYMckOW
M#5E
G255
1s ;
[ks91kG
uM;q
YAam
FBQ=
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
K.OQ=
XMdb
rTv06
W~}u(a
BitConverter
o?YP
e")Q
vhM=
,kj&?
p.FI;
%)i>
DQjuO
Ewmiback
!H!]f
]%:.
*M%l
aJOcOX0^][AlmGUYG67
ujnS`
Form
3WXew
Fore
|us'
Bq*KLH
VU%
.^Wy
@K@`
\dub
d qpcX
1YE|Wy
WB Ih
lpqfGB
bUdJ
] J`{j
^k\r
9Mn2
SE^
eEO2
fn{a
%_#]#
aO%\w)
9UiF
[ie\
Jmn %jr
pP>=
8%;Yss
6OGJ
sD5-
n_KU &
rz$q
0hM=
j l3tu
lgtK
d;\T
+=gc
j% 6
G=MTL
M][1SQ$
SQ-I
jeWH
^qR|
inX/6,
3g]5
DT+#
l)'r|
a $
F8>{*Zs
NG>y
B)}r
:T"!ID@R
j? K
v0VEN
F/:^
2BM=
>%X`
RUZ)f}#\
*AAK
:jm!Q>
{Ckq
A=KIrq
g_`X
Qly
>Y'c
ResumeLayout
jh{>
K#&.{
HuVK
Ym^s;
Qs1eR6fSp7sq0RuAVsP
DA@AG
G^H\
BA<V
ValueType
tazH
System.CodeDom.Compiler
set_TabStop
G<}GK
^1TH
kRXZ}M^
SetCompatibleTextRenderingDefault
U;U?o
bW3j#
KJ8P
PHEIREN:I@ K<Ndy4fK
3-3J
e5g8
6j/m
@~l +
ZOJz
BzC
R8dw
a_N<mM
lx0U
Ms~]
]"\n
&-/8
_>gJt%
HTwFtNQLzhmhJVdCqAaCAJPboxjs
|j^z
" D
X{V\
M>.]
j$Xo
ys3!
G)9>W.
(ISy
54po 9
hcBt
{H*/J
n> d
,foh*K
C?+^4Xx
n&Wg
GJ;-
[a=_
6!30 I3
Zf+L%N
dKI S#O`4SVSCDlYjmw
==g\
8yJ7T3
k+bf
]0%/o
m/Ke
XXm*
$i?EF
]@1%
n#8l/
odEqm
'P0!>
F;Iih
xhJ
ToString
^~V?V
DR}S
^2zn
hw~S
wK"|
z_R6
v7xl
FormClosedEventArgs
!88>
avEeSiNrzuxaTigivorhFLdnCkdV
na-%c
/xEC
YYzn
U j >j
bbKJ[F
JAJR
[L]O
:YsB
qJo8oDrY
azdCileGenerator
l8FtQCz ^N[qu8M9JMl
uE9FZ8
DebuggerHiddenAttribute
Bnnen=b77a5c561934e089
;1J6
daYP
]G[Kt

qfOW6ErA5XyYFkP
[((<Ul
BbQK
nZ}/'
A$S0=
b*\S
9V>_
g98R
n^H<Hv
;x~{2'
|"ut
wPx'
B+U,
5kR;W
vzdhentationFlags
!^M ?2
3kyd
9ij1
Z6ORc
T.)@)@dc
L>|^
y[KX5
[CT7G
JyaD$
'p*
k`pq
@\<>
O(<
l\7.
?EoK
Ph=9
.vv]Tm
ro/Uermissions.SecurityPermissa
+ChI
r ShIR
JZla)
IDATx^
3=K@
2JdAJozY
[gdb
*R*cK
/&Sy_
(IN+
`4-k
~%J4
YfxvqV
%TN{
vN%
B`[w
R}]c
vN2
* O#RB!
g6nH
nr6kdf0ewFs9bJtiBj
kFci8
wn>D
>';`I
vdrG
;A*N
V7_:C
ZkRT
#g,U;
p5"8t
AssemblyTrademaz
0)@*
pCH'
3d*"
{meb
y-Uf
.2
U-Ue
uc).:y
w$Nq
rz_
jFF_ 1
yJh}
u*$)
pp@PPbUw
7bS1
(A')
@G,`+1
V k6
FH!9
bdgMqWs6tVJ7DsyHvMf
$q U
7g7k
BRQ=
FvrI;<V
`1ar
]oi ^
Y(U{
3:2YS
ParameterInfg~GfqAomain
#7kp}
SSMO
% #\
$F7A
v"Ja
sr~
9 u*`
6;X
s}uPt7s
qMqi
Module
?EUB
Y|mh
oOth}%
o=_
loY~
^d5t >
gKrm9;F<K
)`zE%
5z|7
8 A<
@.reloc
x#,1gf
CkYjcMuUFbjGGhgpkdmKeoODuwYRA
9|u$M
Asyf
$o PNQ
A^ wu
74+nAAT
UgqiqcNSmgCxVjj1(
C]T}
NVzt~
zBM=
,b pe
c^dipers
5[c.
3Q :?
,&T#
x$gx
GaD0
Ty$lg s -K
%NG8
iNHR
qXreE
&tml
RWlq
p6H;&7
rcskType
+1t,%
"<)S
du?Gw
IpBk
iXr2
+@)R
totalFilm-old
ZKF
{V O7
}]Ku
UPjX-W
AsyV
LGPEp
"Cem
0kC,
n_Ha
z?6H
{4h }
parame|
qN!$
eKL<R
u| version="1.0.0.0" name="Mq?vfmlcation.app"/> <trustInfg^~{mks="urn:schemas-microsoft-cg
ZuEE
bkdnR
vOuL(
7#h
:H'&xq
GetMethodImplementatig
zb. N\
Hashtabd
L>|I
<DG<
YRT
T[8]i
VTx-
a \e)->
*>+
+w)k{%
C< =
wObh
PSEd
e[Fg'
@)IH
?q5,
set_TabIndex
H33@}
@O0 k
\!Y<EJ
oM9HBZNwmT0
GSNI|
Qgsuqekxr.exe
~!5
'-VRLQ
# ]'
4Bg?e
qP4.J
Z@s
="7",
FileStream
FR>7
``iue
QVD@D
S<
$W <v
kxq$n
set_CreateNoWindow
VG?$
cbdwizedThreadStart
A]_&
MvH=
z'ij
0y/D
fdBK=
\iT=
%;`
vvB*
scu@
WK|Q
l@d)
ReadToEnd
ze9l
i]-'
Synchronized
H=%\n
b:y0
i {f
:p\
$lH_
dPnGH
)s%A\r21
KmpdrWfFVg7bCb61OSR
7|<T[
Y,DE
c{Nv
[s:Zr
L4kV0aNJEgLd6rIDZbf
bW2TTdqh2AhFb4Mg2F
^zMO|
'v:S<
u0 )
; >L
[+\<
^qTy
UUQAGi
>w5x
.i<w
EYa
TU9R
z@$v
Ec|;(
oEx+
EdqtingsBase
ft)h
RE$m
PHQI
^E@0X
Pn l
gmmF
*)@)@)@)@+
TM&?
Ge|=i{ldndLineArgs
6*P*
~a:o
J< ;
>uQER
;z`B
Wl{<|
;G8'p
}ggu.l
get_BaseAddress
X'va
p( ~
ibhHcafM0M_Y0KcoQXt
#$dT
jcdQype
+e;_
tT6.
jIzx
.<O}H
E rsy
p3ARirN8qoKatdjl 7F
F`f'n
1XnD
* "~
zT&c#!2
.[mD.
[.:z8$
K4@8
Unk50dS
l1i.
Iec8
IH8
$)w8
*WUS+[!
e.n[
iJw5
iP].4
%)Z
{R~d
System.Cold
Show
:NeOts
Vpq^
CLSCompliantI rdhgute
^u 1
+C)>j
-i M
s6A!
BetObject
nJUUjQegssjExntIDvoHcDzRJppU
[{wV
;"}[
|[WR
^>V?V
xJ/(n@
XU r
%S O
yZ,K
#&V1sk
p[?{
}];r
}];q
}];p
tBM=
)bA%
k/633`
+ cO
pssvions
.,oDw
dwFlags
W:&8j
1p@ {i
get_BlockSize
3Bp9
w N}\
}}{$u%$
yX5w0GNtevwo61M37nr
e@q
h!FP
)2!rg0
>n@VT
S%:7
7!+^8
k{Z#.cv
oT]E
+}5A
oPJ<M
B1 r
G *
6c(g
17Jg!x
}]5Dv
-2V7+
KjP<
Z6=V
T6wk:Wpp59N6UGJuITA
Dou`sTransferred
F<H9
jW %
zZw:
t]#d
op:'
kXm *
[R76
K76:}
T11
2E^I
)IPC
P7|(
_ta+.!
W~fZ
eJvOW
^ia}
#76,
a{sg
kAZAxA0C0C8q`(^@1<
iSdq]
y ":
ejH(
fGd{SGX
4,UJ
PAMQ
%7f bIz
U>1$G
EB;E
YcOw
]pMv
.-[R
);O
j[m)8;
Qnt(n
8(+q
sCM8
@Xm9p
8.pM<
/uIeOFb6<
IB$2
zp/'
YXj9
Cqq,w
h[*_jI
@`=@N
[ [m
ix?4
};ov
mNXZ
q#Rxf
`-up
{mgy
[M.
h'{\
v2bY
7VCM
hyrz
3=8M
gAMA
{6#?%
uGRr
"DyM
[x7[
\d1f
&G(A
iFvL
2*H7KS
VXj.p67>
XbaC
//ozz
filemg
HBQ=
Z2vn
1|?1^
Rs m
Og>%.T
2|yeP5
valueName
~`P/#
G#Z3
f`t_Item
{F~j
4r7Nn
^/W_
u?dN
/RM=
^N|I
compatij
rEOq
wH6xdlfaiIO1BBCinyG
=b5>
1&:M
TN78|
\< w
K!
YmgxWr
CpmD2
KjHa=
f986
Ya]W
pF3X;6
+}*\
Nq()D
MYK_
r G=
G#*XO
vMdlN
]jC+: }M
ASS%u-
HRQ=
#8>5
=[+Q
^i^8
Z'xC+n
uVT6
R]At(
UeK[P
BOP8e
oxfFonventions
e|d&Mr <
l#~<
zMz7M
T.+g
>(s2
G]gg?V
ETLU
:* Q
9$c&
0* 1Y
m^{O
4wpR;p
QX0iCNf1RVCyiyWimCp
T.+1
#slF
EJG
T.+=
T.+'
T.+%
O5"ZM
k-c)5#
|k *
BXQl
E<OK
Jz2"=
yW>K
XV}b
Y73Sy
ys k
m> .
D Ce
IU`,:
(g;G?
3Mgd
[y2 &QT
f!pg
,:y1
StreamReader
McQ8RorTaewsvhN39kQ
IntPtr
0UgE}
ku,v$
Y$pk
ZhreOdHvNsTLWLsEXZfIPjzhmUhtA
b _U
HUA7b
J/+F
BZ 5
+bn\p
NMQY
j/-$M
G2l;
/z@R
*\)Rn
zWN>
&B,'
@SSH?
)w9J
DebuggerNonUserCodm?rbslbute
hVx0
Alt
W{5M
mn w
~+>N
/v#F
'b;U<
@99-T
3dT
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
GetNonZeroBytes
.P[r
V{g,
e6le
PPI''y+>
UAG+
-'MY
ujJBIZ<
v=_^
mscoree.dll
vsIdndle
/1!O
TW xc
zZVSma
j E1
bA.)
f9vCvUNF0lClBgMouDF
VVR
;Zi])
)8;U
U.(E
taSF
Bi9O
q+2R
%l{K
,w[AAZ "
<assembly xmlns="urn:schm
)GQZ8
\qA)
N>nn
4/ H
+R<=
jm,L
ZwyJ
>j""@
foldm
<jUE
-wn:
Ejai
MMo|
K@\5
rSp`J
O3\6Z
"3xM
'_kd
(6zV
*2fkk
#ddg
<3Y
68Hd
h^ !
Wg%+ R]FF
nxoF
*#lq
Wtv9@
D{511
Ow![
i;)v
2eA-<
(
V9|&
BindingFlag{~D
6E18
e:(#
zls8
=RRTJ
5C7E
~fAqZJ
-KBw:
,<'^
M_:2
K---%
8# {I
klvR
NzAP
eqg#
reason
p OR
YfA.@
((!i
Delete
W\{8
)AqK
IDisx
BI8I
(X/=f
DQ0iuIrOBw14t3l1r6w
H!X}ffKWkrgcg1Ce7i
` _cHb
F~oS
)C1\
Xj!E
1FE<
dKSa
pVz7q
aVKZBTcqtYPnXmMDIIvmprfwFwyeA
xoZN
mOC0
WwYtwtrvV1SPDvCsMrg
(Nw*O
\ Q<
chm6
}MB:
9w=J
!@APv
|YwR
h `7
gfy"0
%i2Y
KLy(
4y#8
+]%M
LI.&3
D .Y
k Key
8g9Q
vKW+
(6pY
d9<M=
^5m
I cC
(k_
5|TY
~QH;}
B.oH
NV,Z
n9 zv
=Dsb
7>CkK
JNKnJl
mApp
^yb:$=
[\3.\
fz[{#
MshhJ
ugQN61
H}b{aY
8khY`
" [\
xy@ v
c*)/
=\~[ F{
|spc4
)I^A
LHe6
Lw_LU
8 Y
(y)V
QS3'q
:ftS
6i 2
N {fd
q2_
dKS#
!akHi
|;Qj]
OjY6
L6%7
);'n& 0
z}^
w \{@tb
pRM=
Fj[Lw|gmAmrZke80VUD
pQgu
=syD W_0
#3G~
F!A$
RlIDATx^
)@)@)@)@)@)@)@+
1pLX
:_&R
d'bq
9-vW
XMS_==[c}= olQ
PP[qV^V
ndddd
l"_Q
bi$0W
cG[l
OGP^X
Random
.w.-pm
Ux@H
utvc#
3~%
VD@D
V-Ox
-_,T
5;BN
"ATe
u.B1ZItcqP6hOfiWB
]jy#
O!SP
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
hwYN
r>5y
J= 5
---E]c
Mo&
0y@T
A^Ri
uC ?
Pari
* ;e3`
]q' K
x+ s
" 5Cvex
Yi[M
M)V.4
C`ginInvoke
W].1.7
{V{f
=9 ;
+OzW}
)X;=
lgmv{
H[/b
;y9RY
TYIR
W <Mn
@0(!r
FpT8cMfPb:FK
jiOi
g|):6
-w8gg
l<VCQP;
ZTI/u ?
*.+ X
MtbVD
15.0.0.0
fM^1-
wV^5
HvvFqlFE7MyOsgyXOt
+.k7g
] Kd$
k0{O
E=n2
8Ud^F
i<7+Mx
#=^g
hCx'
@[R$.!]
ciN8
nP
Unmi
packi
=*mH
fO&lIQ*
at^9
[nZh!
ReadDouble
+l Y
F3YW
R|stem.Drawing
YKE? hXOlm3HgstV9LZ
esb#
fS)V
7\i
|\BL0t}Z
;=$X
UE S
^Oys
wnY,o
Bd}tReader
JH+S
4[tZb
x:aPWUfl0IUjMn2eqGs
f$\b
r5;3pSdu,WX
K9U|G
'odq
UTh3
8e|
/)8u '
W)?z
*:+
-TU1:7
;8:Q
yT7y
Vx%@
`_L1ls
) 8Q;
!+ N
WAS-+
ReadInt32
TNS>T
jjh1
(/d)
{ ,mP+J
IT;|H
sq68
'n~P
:q|<
(=jv
(=jt
i>RP|
9Uca
pV R
M-=L.5
yo9;Q
ZD;xA69w
C3.8
bXb
NPB &N0
(2dy
^^vnCZEf
.7W^
Fz:
_f3.
[z@Lkl
jQSd
3}&X
tQ`V
h*'{
z_ l
&B^ a
O`xtBytes
W])\08
DpZm%.
U9+eKSle
+*.k
ImageLockMode
Y&\r
)BOo
1h&q
s \
y)^8
C(li|
GKHJ
5Q~R{
u[0u9Pbp=*
`3fY
MvcrB
;{.o|
lFy|
z5aHyLoX
*ESTx
tG{p
huLcm
<PT8
c3Lpl3N6skKXB80RX43
hJ7:
s&[.iFl-
U.{C
2s^F&-
uD.[
wjk-
fSystem.Drawing.Icon, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3ahSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPADPBj
5mM=
9g U
m&HpO7f5VNHbeEmrANE
nw}i
D$[y%RiW
!<"y
6i"7XNpJ}
Sti7OJ
@ZhR
8Ato
hKlV<5>nVGx2xHbCAcx
[bE\
{28
()pVdfPcKN
#xAB
T+>'
==*K
P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P P
i_~~N+]
tCof7
pP >I
p<;
qW}e
O%w2
x/.kv
X8$U^
DVNB
o )\T
"6'lp
krpC
\ZF
amC%
qJKY
h``]
z r}
k'82
2 gY
7 7=7-=
Ny00NsKjt5XeWf41eF
6|!}
o>nk
?BZ<
H'h)
b_ r
^P6$
1@;NU;
_:K"
ee JF
&,<_
Zv#.\`)*L
Ashampoo Snap 10.0.6
MsxQoken=b77a5c561934e089#Systm
E'Bi
"TWT
m'sAvI
Wag2
:~fq3Z
me#Hp/h
Zp-cpq
::D T
.+'p
[*;c
469j
d[I 8X
QBA9W
i4Uo
\W}
E{MZ
NOqa
5j.vv
.='_
ncl4
%p -{
&?{"
_csQj
M= 8
s$fC
Zdw%
GetFileName
ComVisibleAttribute
T]oV
7P;n
r_Te
L7E>
f_Vx
?Bai
5mn4
;Cn{
@7 b
%jRyc
{-4 o
q>S
a tz
zihcpsNQQ0u6X IRdAD
jA805uNRDtuuWc0PiKG
.\"$
;Q&T
6@N9
CE{kW_
wOLU
G9;p
,^7e
Pj\?
Ga_C
O?V+
]lSz
#7-a-L\
xIZ
W#`i
YI+e
+ d
V _3
G 6=~
6 j.f
) S}D
1#zK
9WfF
ra ~v>
?Qjv
O'fU
{Xmf
=;L3
wpq>
d%\:hYs{
'8BqQ
g mY
, Y<8^
}$io
[.ZZZ
`:iR
CL:?
`>e-]$
xGx2
S5vB<-J
k#o9H
$y
njGfTp
oSC1
tW7TbrLRhdaf7li1JD
PZ"Jg
]Tym
e^?#Ho0
]>?H
P t/(Vv
dwCallbackRea{
~N1
d \C
6.eG
f C8
r_=s
jWlrvKfiAAh4wLVEjR0
W5 Dp
_`d7
.t$N
' ;s
Z}lM
oy^\
+AVn
''=xg
Pap9
86
v*vu
9 ia
izBE
,xCd
-.-
miZK8
1hM=
YQx^
4C~
1S!/9#
+4"j
GorM
}=4\$\
!l;8t?Up
pERNU(*
T] c
(SN8Z@{
d4&=
shIUaZnwJlLjyaOuTsQiMoKMudGk.resources
zy.}
>-;]<$
WRwM
g+ r
HkFV
Z.4<
jF-S
RN8U
#7BSUWu
U,'Ovs
VJO8wPUqD7OkAkQs@
UIOBgZfud5w2ktqoAdF
mF O
\;/W
[I&6
f(~k
%ILx
p(` ~
n%|Rt)
w n
j>=k
'a:H
GetHINSTANCE
m3\`
mz4K
\VKK
-%b[-
3 G[
jtWKxW1WQ7
Xk)r
e0z
)B9
5Zuj
"DCRs
Y zn
>^La
AGd:
yT1i
(%HU
Hj4-
1E!JO
iTls
H^E9
2c5"
xOxtq4Wfov2SDtt1JB
mF$Q
klui<G*
/3KE!
(u.u
]s];
L+/?
p,5 l
ku^\|$
d u,z
hSourceFa
he [
CBx -LY4`
! >jU
fk]k>
sXlI
n@C=2
&A(E
T@tI
A* ZP
iGe.
]5m=
yIs"
8>p}
binaryReader
2vx"V
@r%s
D`q+
?$d{
Cc0g
bRP 11!
%3@M
RT O
Copyright
:5
Z!1
8`+nnr
c#&fw
6C=x
9cbU`mpPath
@z`bs
(2bC
dZOuXrY3J35Oq
evDT
DeuHSjNrdR5Pdvo
W{R?
>bb@w
|'v
'W_tu
set_Item
;Vk0
mg5"J
+j>+Z
yip8
d2;<
P)jw^G
7 +P
,jcN*
3456T
|IBD'
qb*V
L9eQnwrtGn8alCEt3tf
Exception
Cryx iEuweam
i}(]X
^&]9
)kI(
^g[
S<~N@
^&],
<:DlN
XHxp
yd_
%9nxnX
}+ +
2xM=
b8.7
mJWHNP?=1Qj4Dn4ZmG
O=4{
GRQ=
{~5lz?G
W .Rm
qXG
./99
&x;/
!)ma*V
xekZy
rgeCaHTeeaekzkswqwHYaTugiilIA
^+=B
f}F.
Nb "
Te3#
lcH
EFw.
mA<X
jYc[
.v#^
GS v
xn\B
JFVPjlxChvyClcgEaEJRVopfXmpq
zn-M w
K*VFTEen
h I>i
JTg<
Enter
,IpouDp
:Fwr
@6 l
]~8=R}u
xBZx]
');l
FileAccess
RTQ
|.4G
9F#[
;g@w
w)l[
Sw&L
G9}%
ZEMIi
O>&V
c8;
UtHh
8Eo
P=:0.
H/?o
}]5C
7U73&
jgWy
Assemj
p2w Lx~
.hx
1*~(5S
mj41onNd3tDQK9i30qW
KN&6r
(@Un<w
*$WZf,
}4ls
p'`JP
Xm&A
JOrSR
BH-9
i:0ou1
a VF
\&=^l
noB=
nmu3
^%g7
>Y?x
v#*T
~,/G
}7W i
}hM=
aroZ
E_{j
:VT'
],U1
V\#k@'h
g_'S
7gq;
WaitOne
:2:W.Gn)
!Pyux5
L!y c
B9+h
DB *
,MgB
F rZ
m3TS\
*`'
LjM;
se x
e<u0
K+.j8
D@>bV
)V EA:
z]$
(/o_
],B*
e)BP
|%S#~
.iq#k
TZ`D
uF^i>
1\/8
-z+k
RA !
-h8#q
3GBO
GC%0
aS.2
LBQ=
A&:f
H'wH04vxxnbCC
9(RN8
+Dbb
F:YD
2B*#
5W*:
YpJa
-\u iq
G}}&
-51_
iv7F
mV<x}5
<Module>
4r6L
ISm%*
o%{nv
dDw@I
ENap
MessageBoxBu| ixr
H}b}o
=4tm
uH|
drKYUk
,AST(
SizeF
2L<?J
TtCpWrOhVdOMJEsMVb
Sis6
5E5UC
.gQn
*~+
nLk"
m)tp
SGY=
Ei=M-3
l-Yu
Sys|
odry
@R6zA
!}gwt
RQf
A?5JYA<P1
81&|
'qJV
U]erv
$7~
<9.X
b96
H$xk
CE)q
^[D>N?
M!&^= s
LI$1
;d2}
w^sg
mn}u
O>^[
N7a
Qq;xP
?zj-6/
4BM=
!4$X
3!bBY!
,Ei.0
N9) rZ
,+qC/
WZH+
J* a
#Xu*/]m
[e6b
AQ]O5
? *r
ydz]
set_Icon
set_Image
5TY
{di%
get_Assm
R]jc
l SW
Systm
&$z}9`
I$gp
~FQ4
EventHandler
Y#{N
oa5Q
[$2
s 3"
cESMvD2YwT
HAW8
j=a"
$.+(vMQ
SetValue
8zf
` nU
.LX$
GQZ>
bR T8
DLY<!
!nFB.
W=EJ
d$q!aTC
@[M2q^
@64sbsrN4mQ6SbtlhxO
|6{i
Cgjx
{r13
BXKh
Bjpy
P18V
=BhF
4yjB
~ e{
VG';
88C2
phM6~
-{HB
V%$>
&[9B
X*Y8
mVn}1
HN(t
V>>M
H@VFII
fileNameA
8dyOR
Q vxl
>\|
$60590dfd-fdd5-4883-9455-1e008161389a
FApubkNvGTXnPerI?
'zrr8
Meu/
WpaM
>+ X
VF h
5sB,
HTey
r>z&Z
Rectangle
YbwZIljn?wR6FCbMtL
f;s\
iEq-
O27GXS
'WE}`
TSK
KIP9g
Y,5 _~f
!JPa
XAR:
CreateInsti
_}4VJ
H'kREq
[^uI9A
[ gujCrame
a_`;>
MUZJ]Mk
|.X
Bv\Y
6fZ
.o;Z6
K'>D
)e#)
5iME
%D~w
$% $
HH)Y
*#.v
]Prn
VoEm$
'$w `
E[|g
1?}R
bXf!
System.Windows.Forms
].NQI
}l#+
~}>>
9<2x
nV+0
^qS_Q2
W'Gv
b/ e
P,lt
;Ge7~
vxM=
/p;gxv
/Rn6
-W<W*m6
oIeQ `J
|{S(zS
><Mz
StringBuilder
dP6
ya+!
caOz
s` ?
w=
dMp2
uzmQ
jL 8H
k>'yW
/fr;
YV$W:i$
XX| U_
{u lj#
V*xw
@ Q^s
uBM=
#)
"9|]
-Lp
H]kvM
[K7&
G,S9
+1li
Invg
*>+ X
rVK>
Bsudils>
c1sdh
"spN
.?f}^ROw
[~4u6
J/E)n
_ &Z
auB4
9oI:
6zs
?wTe
m sn0
#nXd
GQi'
cVY#
`}6K.
vIjS
v(J^@
e7Y a7W
VTH6
}'Q]O
abXTyQj8
a>Uk
mZ|8
H'9
vud`
$+yJ
get_Controls
^mP
'Z.R!
vskMWlengcShEvIjUIQQsBjxhKCg
9=YRU
jQRVD
"9R`C
o>bP
AZ "
AVDB5
(e7'r?u
DcdhJkGtNIdfTddsgIwxhXLGTuGsd
VHvN
'IYovYWgR
SqXA
-PU2
u qU
po92IfG4b8ao2dlMdl
i{ldndLine
unRP
H]t.
9"nG
@Uc
p HmS
-5mx8
1])<r
dj$(2
XG@
aFRJ
pR \
$4CRb
y'i'
op_Explicit
Jw=%i
wk |
@mpty
%hkc B
% -M
,%<R;:P <
^(m3
K1Y M
1QBA)A
EndInvoke
>N0x
k$~
.qmQ
XCN8:+
,oD6)
}Xl,
>D:
YDCGuMrkYX6Pf1yIFK8
M0/
-mX-
( Hh
2\q)
MZlNuRf6CmpGb@osoJX
8gOo x
vRM=
JzZI
67IK
m\V&
/<A
QY`^2
ILs[
8+ Z
WJv0:b}
B}UPC'
K _hh
vFWx
[/sa
P P P
)JTxc9
P P P
q=*Wk3;9
*BNH
n*@%d
+FfL
7+DW
9IUn
Hs2$
!I
P+HJ
;f`G6
jzvd
sN}t
A-qo
)xO
3XGsd
get_CurrentDomain
:}s;
sN}@
<AgileDotNetRT>
r/V u+
#gA5
+BR7s4
L7Fj2
fVj%
`->9F@
%E)@s
6 }Z !
e*e:
Cp.&
whM=
N(oa
opv$av
&H~c
q-;^
optionsCompz
.{Ch
\9jUfi
;^P0
lS3#n
ARx
Mk%*
R+ b
uE#J66z
REEj
Path
jed'/> </requestedPrivid
pG5x
)Y 8'8
GjQ
>vNA5
g|d+
RandomNumj
ekk&
v}{m
[ <I
@UF2
#Blob
#S| oxfv
Goolean
RjQ(
[57s
Ww,B
&=2s
w[ s
yhM=
MCglZ
9rj
w (n#UN
sQuF
@>ql
qnnCanrP6~DL]IbBfhT
Rex
/l)_# s
w0k)
g~JY
VWJti$
Wm3^,W
6s]Oi
HeURfYCKEcbfqdCsAmMZivzCpKUOA
m~1fCk
!K+S
QOv,I
\fl&+
g-%
i/e2
x+ie
o ,m
K`nI
*ynW
P 1T
t#uN
fh o
)#d`
iF){
0bZ
e_UYi
nvSyN
zO <
~$.j
D4%U
UQI5
A >,n_r
bc2VX
8:Wg
g4^R
set_FileName
+"7k
idfnV
2Z\=
xsH]
`W Q
Q{o|
O wX
)1V~
get_Z
o*>M
Roz9
xd+4
1]%Z
F[=9Q
2x :
DkOS
z"[JZ
BAVq
RTx`
^,KTj`d1o
}5AV
5a>B
?TG<
[wHW |
BpZydNiAHTWlerkLGAVVHiBYPuGn
JB^[Jh

Wofyqo.Resources.resources
X`he
%g{[/
o. qm
j9ecc3f]
z_axG
4RM=
@% (
K1Y}5
lcS09Fh79gtfta?h`D
o] [c
7 7
pnqDO
[Fp=
n &q
~C]a
rRLEHEgazYmcNFbbGHFahWTcFwCVD
CRY+
X6jB
d)eC
# Nxm"
I*kn
{8h<-
mscoz
k8S`flection.Emit
dataA
Iz*4l:|
%$=^
~)%m>
n=w
<rH<
&+.7
f7191ven5Hbfo
/.+
98AE4E74E21796D9469LJ@PCG8357D8FABBF922E
Runta
n\WN:
5j#ku
a_)|
E75c
Single
{OpiT
ehvCN
L q
KE
I$U"
CV 3^1
u= =
uBKZ
t, q
BY*97
T F@
|Z*c
VMLT
C=Cm
3$xJK
^#nw
asGzf
,!8B
/aXT
^ltcc
nR/
"wJ:
T:K`]
i=1Sq
\]Jh
;.\}]
"@zz
N#4(
t#[yO
W_;u
*A5.
Lum5|
i6Z$S
w.ie
S7D&=
rrv7
Ah/ .
jm(*1
IconData
88:g)
s^:?X
iIC-
|R?;
YA<?
( U
oqtwation
-1'x=j
hb a
Fkjv
0@ZH
w.Lb?hSj
+D[
yJ-9
CjH8
[&_@
MEWT
A"2Qaq
:#A*_
f] #3
SUq`FnM
Tgx=
Ar\w
k[I
;gDr
EditorBrowsi
u}V<
IQR
LrFu
16I~LK
BCm a)
kA;
bTp
%&'cde
=|o/
(Y B S
SS[j
[b.*
t4W8iAc
height
#CJO
(5ocDA
bA^^
-0h=
kZl00
U#rT
Th:{]
kernel32.dd
dX}{
G6'8WO
d g\
PA3
YXy7
~o2xmKoI1cBT4
R%Wq
r@tg
wz=o
[a)#
D\y4lk
|l!/
qRM=
Mm nyeGuilder
neaZ
|Kmb/
7g&9
*qin
dxd9k
vs* t
Mi
;m X
lTR2hAs
38/~L
1tn
AVCQD8fRkKuO;5TsqPC
:%Wm.D
ryKq}
ImageFormat
TM5
y P
3GUdc
1nfi
+(Db
Q>r_
r1SP
hk \;
-psr:P
pbrHbrgiNCbfdusrUQ
b|`c
VBJPKTmrJWhlJrGqLBfwJBKcZgOW
_4K$
TWTI
rrb\T
@ Tn
9( ;!
@"p>z
})K3
~~cN
Y1G?
o8vu
s`r-Z
&z@#
jUAy<
0kP<
<]`u
hi c'<q
uN)?*@"
&ghd
w=DI
System.IO
C+'l
WrapNonExceptionThrows
^(\J
|XLqy3
Je9$
UGy
)+PQm
W.~8
=.^j
I}R2
(mIXV9
: -P
yTwE
trIGV]\
8wT~
w=k SK
.h \
RVw)
X1I/gtrWit6FaKK3c0b
'E6o~h|3
[jBT
TT= -
Pa1V5UNKttcknNduUPy
j+ X
|)39p*V
aSR
nN0y
98*3
vQw2ELNLNCw8sxZH1LS
i<TW
%m]D
(x 7
~s%7w
K|;
<pkU
8#<
DcIqX
*:(D
>z,kE
NV#w;
6xnEB7
mdI
Xb^Zj
bOyviJrHunMAe4L69Yh
QPHT"
Y%}(|
( <@
98c05710-5953-14.Resources.resources
~> Ys
kUD6
tpRh'
Y^vz
insti
r8mJ+o
R W
kM4E
RSD1
\rpy
aS<iq$
cp2
h9v[N
Yx/CLG
+h^eQ
;|Y-Eb,
(2$;
i%V
cryptBytes
7uaK6
,nNq
U? ?
o{@jB
Ahq3
DefineDynamicAssembd
' g;
3zY-
u:M'
UHP4M
?LBg
VirtualProtect
ll &V5
UOw}C
;.ve
D Sp
%Fce
OC\H7KLv
tyQU
FYe<;
.Yk[i=
RPB
;c^
H. F
&4a}
I_T N
*PIB
g5`
~& *
G;$RU
# J%
Z E-<
I5>{
System.Diagnostics
@<UN
hIe(-
^y[h
t tiW
vBM=
Cu}e
thM=
K^`( V1
qiJx
Qn E
?oXW
rhM=
V[Jt}
q_=Q
Ap9O
^" 4?
Y=*r
ZwG2Qp
hA^E8
*T "
L.eH
Mi u~`i
W H*
.FE
E(3Qz
EventWaitHandle
M eD
hgIi
rFsjcesses
5+gH6
ge|!GEBLI
AW/a
uk:h
(+hh
rF#ren
set_Location
o4u5
[e2c
^EX{w
kNCNz
hy@u
(u# p
O@Qd{-^
gwN[
SlkU
get_UTF8
M{>/%
en]J
4ttu
/9~u
-XiB
uP_s
"423t?
Ztj+
ExQ5~rnL8
SY (3zo
S!EfZ?
gu\>
,~ee_E'}H>
c)Wp'
S eeN
U)-ik
1 kV,
$ a&
~nEf
LLHH
!`(x
8<sH
8m"*
)ZUJ
AEH'
vF6p
F]%'
KHJZ
pA)n6
Xc*'
owzJp
E\Rt
fL7S
"yT9
^5ht|
^d3hZGdmD8EHj5
Nsaarbfod9xOGhJucCw
S-I+
|2K<
Q;s
j-`8
z.Zs
iAestinationFile
T{Vs
h99?
TGnZ
o8Qd
T3Om6EgfTqeddX6f92
x/*O]
*`0)V
TOn:
l9"%
USrB
9$
;#\]
gXGj
9en7
cJik8
sn"z
Y#o/}
J@,c
e%k 8
P #$
:v2Kh R
:>rI
q)@ J
: I$
4-%_7%Ec
cx.J
[% m
/7Uj
JRAJ
t\RP
}A<=
U]jj*#
:]6O)FM
Sg.+
e:IR
}5W
hDh,[
#YM*
(QPor
\pEAvL
/UqY
@_KN
v#>D
^O@[
VtackTrace
D)EAR8"'
MY"l
mN)u
WT<mi7CBJAXrrhHCWD
ER:9
{~VD
"^ms
GvC#,
C~kjD
of0=aN
xxM=
keyName
H=U>
(FCq;O
oq %
mRx
aFeq
qNPJ
k;Z0+/
q gfTn
I <3
Ol6)
GuidAttribute
'i K+Q[/0
*>+ X
SOFU
$4CVb
G_jl<
$Uv&
;Cz
-Me%u
GT +
!yk5YbS
g]f:
P^.
{i-MM
/>3xc
[_tyJFp
Sx@q
>< g
a<Q"
40ag
GecS
Af0Au4ZH9a7uxbSbg
gnps
s~y5
WN Z
h Ma"
/3Yj#
get_Lengt`~sgNky6fNC7PxJYeXZcT
_U~uK
Vm@Ij
e^-p*
8YC@
W1cSP
UInt32
(-|5
KlN:
%ptt
Uwy]0
SXcQ
C,y_
M7It
{M(V
]D$0
h"P5
ybVyBgf33g5JGfuqugY
$$m4
r"4RO
/TZ E
[HYM
rN1S
j#aik
I)PP
Ohzswqv
tpJd
Unt64
<Lt #/
SHc9k
#S`5
fLbeC(
hB=#
Tp;5
Qg3.4~3
s&x{
k<WQd
Cp/;
}mO2
|sJ.
9\c.
6KJn
JhWY
Au!H
^N^YWa!z
Judc
wq=9sG
`tdhTEJdELMY7
T>:
2<ja
zzpmq
uu%~k
`qmv
EqK>
Qcv|
J^mm
"i@/St
nzb%
/S7~
add_Load
MemberInfo
0&mge}
2u}\r
$VZ/U;
+]4
'FDTV
1;rx
FOCu7g
<2U17n\
$g>p
<^l*:
&ylN
<OhG
%aOgn
<i-\
\ >
RS:8)
instalFolder
f'FR
B97z
GpaM8
/Ko?
p%O8
3Wd#
Jdcp
Int64
=?7Kjy
Q.L[z
9^WRLR
Lj65
w"9*
YScW+
s[+s
W%).
+#cv
q=R>X
Container
,RQ]#
;p'vxo
n {\
3bi!
.@i":X
1<Wy<
b,4`
>PFiX
>KXw%
A{U,p
7BYszj
UI&g
5slTd\
Vf@|
`C^\
*}78}
<wq'
QO5qZprROUxYIqHfpjH
5\H
md &
;S^>*P?
Q eOJW
3hM=
Giv) -J
zJ)a
,hXvp)
@-/3%N1
e1Fa2
;em
\ JVO
S-fr
~SqR
uT7
Nc cx
1@xih
r'*)5
[.a
5!<8$
S_C6
@ N+
vclS
HNY&
A eV
nHi>
SpecialFolder
get_Chars
AAIk[
Yh)PH
\mow
Load
CryptoStreamMode
#n~i\
-j?<5
N/$=%
2Oht
rR`8
|AX6
g JR
C^]R&
Wze<
wylPwTNznJPrSO5rAsU
]"f6j
Fcc(?
iMK}
e\>.r8p
4i*W
QIR~qZ
zuq1
"~(=
_UO[
[q) jSM
-,yn7
MessageBox
$*[TL
7` #
H0 <
9wW}
@zV]
@3'
iMKD
To}H\v
;+KDe
h n
nGoX
Z {d
NL;W
ZkX*
vF0]
Ft!
QWZ
S9%x
P Tb{
?eKqcrxIdq
PRc4
\"N>N[.
N62/
d7ht
N\`w
dK`$
Q3wF
Ic14-_
mGHw
5)3D
UTrk
B{~ij
0qWLEFq
Cd.?
F? 2yrI
G:Xq
-?&c
#?bv
A8P>
3}$i];j
Assembly
/y]
KjmSF
8 ((1*
)4%k8*3
YT;E
=,$/
J(' vT
ADQQW
System.Drawing.Size
@T IrSQ
zv()
d|*[
M6e14
SuspendLayout
5SK3
E-M%
W=l3
Ez P
>VAw
Cyu9
: 42&
%JQ9$
/UNUWE=
)P7P
N|mIKk
A( <w
mVB`%N
*Z+ X
nYX'
PB "
|nm5US
- Y7a6/
(^gt
-' )-
set_AutoScaleMode
l^GE
rv9U
;G0<#[#
V U
};lO#
I8q&
sbdMash
KPi-TL8
BxaKpWmvEi^
U P P P P P P P P P P P P P P P P
v2ss
vtB%h
Q@E
mApp.Properties
JR@5B
OO36H
"C 1
C Se
"Fpk
h{G
&:y .
RoIDATx^
qkjh
5\:m
UK}1r~bF9xe7tpU41K
--+
LU c
8Mt-3
XU>w
2$8[9
DrE
5Cdz/
&I'<)
vvEv
V&'<
DC).8
rB-_
Pdr_
p@Px
twM
r@`iue
param
U FOx
rFsjcess
NjX2
Wr(`
k 7m
R5{3
)]f3
zK~{
zq@xistingFileName
DNT
zoMM
mWHf0IC+d
aL^U
%''
!);p
>lN=
gc4U 7ctbwCQuw4QY6I
g02cMxwf(o\4wCQj4R
78d[g
chyF
RegistryRight{~Uorqem.Security.AccessControl
S9B2
nP@?J(Z
sL3 C
u yIe-B
J}g99
WYyK
%-<2[
p?EVO{RV
.:&0
5XL=xkaUF01quW
images
[sIP
#|VcQ
!)I<1
System.Secuz
S{L>
z1lq
?>kN{Y\
WvdE
OMtG
[INR
^jPH
A7ah
G qR
rQ!r/v
s&Gd;
HkyfT
{y tu
vRB3
oM=C
pszPat`~U^F`tFolderPath
8+220
#ylz
moqEzurVTMEzMeekSYOQtSMQiTaSA
02MA
mfhSpoCoPzdskvFcHOtDfFkyRzwQ
7+4)R
[uQ n
E1 "
7YmW
,aW=Z
;g>Q
P+%{
(*gQ
)1/p
}db #
=lr\f
iT.+
pmCI
L'K-=
jW.JA
Yb,a
T2T "
WXW]88|
uhEC
PswrN
pxi## 'y
SX*H
5a($
]>5h
u&4GB
6#[a4
i]&b
BgA ?f
}48} J
@ *RC
G=wJ
T@{xGF
'ly9
pbCancel
0:8o]
yxM=
5`zd
i HL
C$O$
=o^z
xJ>O
bO&>
F}&&(3
g6;]
qx n
fdG-5
V%Nm
QLK
rG+h
/WQj'&
rqryKey
wZe'!
yI)>R
GetPi g{dqers
Ky$uU
rZ w
' c.
wuM@9m
` =ln
ELu+>i
5(B*Q(
*J+
Nl sa9
|n8~
||}r
VGyz
q!@.$x
.cctor
ZEYJ
FileSystemInfo
rP !
C Nq
[ 6I
%Dai#
.%Sh&
T=Dq
5,Tq
^3;g
.qNl
". `
R[
Tm`
.QZ:
t, '
%M}?
w~f
Kill
=%xT
}%D%
|Mrw
2X@{
jvSf
QT@R
V*#
"!Av
k-
0Xe@k
Uij x0
I[_In
iW8|2
m\.$
}&8;
}]4.;X
d4[\
System.Reflection
@!_A
t ^BojC
\ Z?
r(x2
mn[z
;&<&Zty
'x V)
T^RM}
(.jq
z3*K
-_p~
>NyW>
<5G^
X 4
get_Png
? Xc
GetMethods
WQ4N%KKC7uh503yp603
jcx'
$rO
dl/{
)!=n
rJ$"
i^-z
2RM=
adyjN
@ [r'
x`dw
YqfW
WfKcq+
u`DEY
&] <f
;8xI
K/TVcX
J4Gis
tK6pPYQ
Qg<um
*.+
FO#X5l
b:i0
N'rr
:3H}+
z9o=V
p:S!X#
+4bNN
wt4pVO
GetTypeFromCLSID
|XJd\
PROuK]
.<N<
Sy{ c{/Vecurity
gnY^
8Chz
J,6"
)jY2
Q&D{
(2_
Iu{w
sRBO
<M{x6
HLrA
!myN
LUX5
[X6W
'jN+
4"#@
|$6
WG3u$
|qUUt
@'k;
tG,"\
%}_W
8/4(I
=%e
RK{R
Ji!jl$
x75C
elD;i
Ak("9
m8gg
K\0B
K2(nT|w
O7)>`Gh
cpB
j8aQ gdCtT1sECmBgZI
wVKK_
)%IS
z:g:
Tk:kKn
[> s
,z0`
2&f&
6U^t
X*i-
8H9J
F1&n
47dc
2!R(
]YEC
xQ2u2HfwsqUlStby1up
M UQ8
;;#k
GetCurrm
muProgressRoutine
ZKK&
/6WK
Pe_gNmR{
.=;$=
eG Q
PDe#
(*=(
^Z 7
|lRY
^1w+"
y_*
Rvz/
rN9g
ubdh.Runtime.InteropServices
~ L{l
N.Yzo
TN\qn
8>Ez
rr *r@X
} 6dhu
$tez
GwH)P
5t n[t
hNQ*TKz
1Hop>
* XP
=]x}c
U59,
gF#_+@%X9
9l7e
F+&
Z+ X
dwNm
Cs9t/
GetBuffer
FA%>w
7|=$
B]\&
A -$0
N.B!
iC\H
Eha9Br
Microsoft.Win32
h]^k:
q*W
OPU8
R>!1
MPFN
D('J`
bKbD94Ng5ElIbj*L.sC
Yovf
ToChar
'JHc^
$? +
\ a*
HP,
+NIJ
m)r|yL
$N0@
dnTM8
w`bQ
pJ(`
;JOGk
FileInfo
c8eil
J
x&)@)@)@+
WoXW J
H<[G
}]TS
y
KN.Z
m_\}
TqKjfZfv30aPZ6g5VCx
;Ej
7@r(F
iBFU
ccv:
;g<w
IpS@-
`,7Fe
d]!2
N')I.7
Otm.8
ation
" Oh*K
5#@)
`eut
7w[E{
T<6YH
WVYZ
; 8(
#OXq
pFedx
ToGenericParameter
j1wu
'p8>
N1"|
M3iX
sK7c
KPK*
UQ c
8n:J
--0
* }'
P;p3
{,j*<O
jJFCp
* =}
yy<L
F= _
1R+'
{avxa
}'Bt|
c.=%t}mos
HjAu%e9.
UZ[>
i{Ht
!1 jg
<S'J
lSystem.Resources.Z
%OzW5z=
wgw m
nIRP
1|:3_Y
u7)}
d$Qoq'#
i@ '
FWGM
jHrb
RIU;Dmd`w@
Js-\
mI$loY
g;+ Gin
U~KH
| D!~
&9|
%B_
3D2#
#GPA
<*H"
SB-2"
UI*K
**+X
l?Vk
"~<=
)VR C
!This(
WO%]
sA'y
utk
yY" +
zJ%^
C_Ws
/WK9P^
;1y>
.5.o
6+};P
CG)Z
Ij /AES{
.T:?
m)14/
%S cu
7PgX
$s(.
m*KV
SRuZ
CWxaKJNTi3OjDrYIFz
HZq'
c)x+
^Oks
Lv{3
qJX9Q
hcdqG6
?}j<{,
pXXA
q9U2W7
U'qK
:hap
Xx {A
jmdb
k(u\
<OEWW
[<|k
Kn[^
X_)8tY
,E}m<
4Hv
w79~.
ReadDecimal
bQHB
eo_8
!g5M
,p>dBi
&BxWG>
3;sU
pv1b
hOtC
jm1e
ddkluyYzWkAazdeWGbLyxLYWmwST
][)58k
S9)5
-$!TLo-;
K*(r nV^
_\v \u
Y7q%
-nuw
.+iz
t$cD
Q,n8
ga[iy
pSr\
_pig
5K%!
<Mc/
n%# 1
w1#,
tyfwam cannot be run in DOS mol
N(Ai
v0HVx
yuq\V~
bs:w
!`.p
AssemblyFileVersionAttribute
{QX4
8)*II
System.Resources
KJ1s
BWGw
`hCe
,cDHg
?ME6=B
Q $p8
Rfb:_GY
toii
#A'
ChU
k61u,p5
i8'q;
(W
Xzo`H&
![5N
8 5z
lkUI*
,!0?
G %$dm
MoYj
wgaK5aL
6rnm
ra?3
m Li
+y[
Icon
&C][v
Gf6
5Fb;
tv_n
T7}wP9<
37BUr
2aRu
r[ug
))@H
c7 $
"qb-
R5=F
kF\@
%nBf
re{ jb
f Bl1
vX02
0j)S>Qx0
fR{;
Rwf|I
?Gm{
f7 e8
ZXH./
WaitHandle
sZt2
dcw|Z
E YQ
IxQ=
+6*&
XCb&P
System.Windo
sK +
x$V2
o(ki
T\ei
XJv7
,~ Dbq
4Q`l;<
jAde
PN|+gS
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
fxN
6uLd
y`)aV{
(m%J
P{QU
=_Z,
-vzhq
"H}r
B+NK
;?FWRrP
NL0ax{
c o&
FH_(
v& s
~S-
RVbj
de+x]'q q
t)4}
":kd
ccSV
&-l!
nd&@0
YK2h
6F TE"AM&
=pkC
tdda
%7 5
j',
NKcS
?] 3
S ~<
W#q-
Comx
lwXcG
X9PI
Fd 0pX
R8=I
Comj
( ~
.4I$
1K I
<~tN@=
vDfv
?:%21
gnMV]v-X*
Ml[sG
n.E^r
R7KV'g\
WG$/w
j$7}l
8* L
MethodImplAttributes
System.Drawing
)V*)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@+
,7,n
EF1FgVNIxHuSA8kCi81
k$Ls6
d$z#
.yXuE)
eaW7
PiJ:h
GiF4d
t6ws
transn
{}o\<
ToCharArray
y*@T
<wrh.v2"> <security> (^&*s`questedPrivileges xmlns="uz
V%TU9
HeNO
;ckQ6
g!)K{
{|/?
[tis
u,)c8
c!]a
DebuggableAttribute
Exvtem.Collections
bBfFNQCnboCavHrsBHjRdXndPkAL
A2Qq
}]Ru
fm}
.ck I
VAx*
ldF5
:Wsz
YMYn
rywg
56_ [=/
/{"`
8.+
P9P>
N@<0
JB2e(u
d| O
g~y2
strei
TW
H?EOS
o~R+
?x=]
U*tt
'Y*[
6y(*kX^
['QGD
3eb7G
\26W
*?zvu
88R
+9JFN
N Tw
Y$V\
9xU_yJ
j _ !
\);{Q
(Sx) (
A;,D
V'Y2;
ewM{H
>I=;
*KjY'zp
I,D~
cnW^
WV[=
w( *
&1|PRka
g>?4
OY\v
~M(t`_O
NH<s
SUZ]
M7;LJ
~Q5Q
C9dR
nZiD
f}
O[;
LsD
EditorBrowsableState
,;Sn<
1jbG
{Y}+
CultureInfo
|U}v x
U"`=
NK~c
z !T
GR wby_
e5MM
>Yk)Wu5
NqNAAbFVLEOjXuWRUkwwBScEuIMEA.resources
@Yv{
s6v8
fQW{_^($
p8RCZ6B p
VTsA
$0=P\
v)`}
$(g'
y?;2
ZVr\V#
4 7v
Dp0BpZHnn
%$(d
nyp>
="2`
%r7
4FU}\
6P5e
_Z;G
^[FB}DU
~tB3
$U[
Ut7J]O0F
R|stem.Reflection
*N'A
d] kl +,
![}9$q]
=A7S
(Bse
c) Version=2.0.0.0, Culture=f
VX\~"
3GIy]!'
Ol+?
Q&]&
|nkn
bEIq<
yhXos
H#7C
ZdD"
~@iH
Y>)|
D7[d
,_=
ZH):Qp
aS#a
Lb(D
Z{py
oG,&
%JP X
vKNOWJ
3G*'Z
SJaF0
=h'?
Mg w ^
NHyy?
KQWY
k~J/
Wi=;n
` )#(
\*+M<4
kost
'<sX
ffbt
3q+RC
=8N.<
OnOzP
y=XMc
"kM|5
d c=O
I 9e
;o.eP
')i$x
> v;
)@+k
EpbPEo1EcKVfnKYn*?
PictureBox
~]nu6_d
oPPZ:
;Nin
MessageBoxIcon
:B."1
NNsY(
cv('
3 9Y
_QiAF
- .s
,L<*;s@:
jXzMjaeQzUOEXBUjaJoaxHESvEpI
H+*#
j<1a
i\5/
Sn&Ic
5>PR
"R<v
C)"c
=2D'0
ModuleBuid
8h8_
&srF8
9u*Bw
A4*e
)\Tr{
C*)V
#J<5
bQ7e
:Ph
d
rZkI
pl7)
fq9igdfW3eZqa2CZd
3@g-
2_B<
(5/i
fk9%
G|H$
InvokeMember
n-k44
1%26
q<My
FU=<
}8FF
5_zj
G~)kv
O{V8$5
O}Z.x
^V0uN
q4n@a
H&[>
uz w
'4-
Q sq
(!V7
~wnz
oAB[
h+ .
aECl
>PQ'!g
> Zp
-Y T
1TwV%
tGk
}UO-
sD/;
sIDAT8O
UJ:kt
$o h
Ss_5
=mmK
r$XI
3_&s
E lI
YKSxh+
+vc
v2.0.50727
<M|?
d5PT
aYrOP
L %eu==}_5
,z4f
'?rI
pN[l\"
}."0
6w
fGAU09d3q0PWwckYmM
XY6o
Qe}dh
g;.ImG
O(#k
(Ii.!
5l^ 8
ttmh3
p[`*0X ('
HC,E
=ct&,(N
bUNx
AssemblyTitleAttrib} c
?MRCt
;@xp
@Q#5
Gb}:P
1r:K
aMIK
bHR\ c
)!i=
ui@)
AB5ey9ffpEFfxt4VdBH
di5y
"z;'.
U^ [
4phY
,h++)
ohM=
j;6.4\D
9%k
O1s\
`08vkK
A|RS.Fx
set_Size
Flush
O`"5
nD wM<
H9<{v
@Yi*
4{+e(
o9r_
S>\M
cW$r
jF`qh
@ 3b
!k(y
t5y2
:N ;shd
3C1*{@
#)<NU
tVtqh
oLVz
nv)P
icr8<7
rG2K
c,UO+1
~8//
v*.3
bpI}
^Ed89bx
p^*Z
!pa!/6{
QGfg e
}EW
3u2;d
0MLx
RO>U
|mB7
ubvATArGYrYCuwmQPcC
RJ\J
zN8t
V3QinGngwPefhsu2:$
VwJ
*&n
)!IR
5|I
k6 H
E/)b)
3{P-
{3pm{
gbdVubKey
v;~F
n r
Xco:3p
2br&
{aM'N
!E$z
$jg%
-a(J
xGy^b
T.)@)@*
x7i\
dm|r
gU|4
*qo k
bB`=
SByte
F[G6
zOPjBifBxWskZyfklnh
^wk'
sItg
bb {V!
JBQ=
o8l!
WkdL
; $g
mlc?
"?Zq1
.o;rXO
;|
HGPyDFiLsOCWUBubYV
v[Tkm
J VrH
<H q$
!;d2
uM>o
Fp~z
(>P5
o=N$
jYZknyJGQGJoUInBNijtJTuzIZaEb
&Ln{T
t)^I
dQ8T43fVrB05ax4qw9B
><|Xi
DiRo
bV\}
8|=(?
|!YR
Exists
IY5v
M%N/
?om-
RA#<1
ggl
get_Chaz
1QT0
G-'r
2HSE
!/,,
rBM=
e 5$
o6=L
Equals
i@<1u
tFPUUI0GtNCWn5LeBJX
DB "
,e<`
hq !I
[$-2ZH/C|ly
QDH<
%'F{Fi
*:+ X
CLJH
nQGA
.vH)@
-MQMoe
TQ'r
iC5nw
: _Q0
=^Rt
5HmT
_0;\
sBM=
Bitmap
meuM
H[j[
]KIk
&ZY[
'%M~E%Jpu
"~8=
[ D
AQ"2Raq
M;]M
sVlW`
:akJ
h.'q
Z"5s
SvDT
QTRCJ
W=J+&k
Si'
K+Tl
PJ%Tf
Jzf$
7RM=
SjJ:c
S<Brp;
8P z
*pTS&D
<V V
l~jki
l=Te
5Y}e/
;N`'8!
EndInit
+J08
wM15
|2T}
$]_}!
FbQkRNre7xRqY1lpaVU
AssemblyFileVersionI rdhgute
NSbianNseohpq _GXgk
H oIs#<
I} Qe
B1|J
G'~7
F`tFrames
#sHWZ
x~"G(
pJ}W<
}tIr K
sxV{
GEIL
+uV~
9xM=
w8e%X!cn
G\cC
B`u`
se]a
shIUaZnwJlLjyaOuTsQiMoKMudGk
'i n#'
%_]\
'T^1
%jZq
D8+DoR*
e7)t
W46}
l']B
_ q
kv'-
IJ=J
6'<{
?y'_B)
*wQKU
wdlue__
Prl8wJf9tytwXwWNZ8l
8THD
*e{@
SY]5
H|H~
J}K5
w}E}e <
=t\e
<FO.
9w_G
}U5G?
8OTT}ANElqNMtBKlnPS
r hZ
'V}e5Q
@h=9
\-$Q*(
>`6J|
<!#(
[ERw
pV@N
A#!8
u7eR
dbKe
\PqK^|
LJjw
Dkum
>Z4HAJ
e5TIP_+
VHpKf
MA N
Ke3Z
]#Ki
szHN
$gN"
' Yz
GzrQYrQTDJvrZoaGvvvRYsdGFLgN
m.nN
nY@WP
(2>b&
v7}8
{(@@/d
$cj@
O~:X
&8"
ICryptoTran{
T[<
rIQwocessName
x#P:
iC 2
1z8}
I&.p
^z;VQ
ROdCM
VVAJHofDUy5DY10]
nl~r
^oGR^qKE
c' ]
'f=T
Uf
k xz`/
4v|%
S'y*
YM7<1Qo
etZS
fH6v
(Pnwms
gg.N
BfdhVA9GPFtu1ZpP7k
tT\@
(8H_R
f\Aw
bw}}
["+:
O!QoR^[,
'SB1~
qOrotCEV3lwjQFAL
O U)@D!8
k5MV15
#BMy({
$UnX@
#bY$Q
_~n"
yD&m5
gx'r
#P RH
U^&1
'jD2
$tke_
hWuqribute, mscorlib, Version=:P681+0, Culture=neutral, PublicC
@1.
%d}uU]v
aHs]
>pbz/\
ZBo2
`nRu
n, m
"M0
S[LO4U
VSj$
{jg
_?G@\
Sleep
j[U\
U! |
v^:Q
vh-^
GVMM
+kgs`6NZ18eOwslF9pF
2P7`
TMMQi
iOQ,
i IlrII
A>J<
]3#u
^_J
3s^@
5f5-e#
*RBq
XO{A_*Z
CE$w
j aI
G?ULu
O.9y}
_7]#
DefineTypm~Roq`Attributes
VSdfx
!?jk
=3y
8m[%
! A
7=[\
KBQ=
afkr<
L7ftJ
i&c
~~BQ
.{k
P)pq
!E*J
OP_;
)IJX
XW[]Dv
" 3
?Dqp/
ojudiDHVtIixZVFHvCuykSLoeWHQA
>5F]
Sy;.
N]H^
38TGq 6
WW:?
2*Pn
LockBits
Txyf[}

p0Ny
< @J
faa
Kt9P
W/5]x
a+^[
lW 9-
V78*
c/OO
?MnR
\Z%I
T.)@w
PM[m
G=7Z
jFRS
m0{%
sUvIF
gwiv
ProcessStartInfo
RuntimeFieldHandle
C[/F
@s#x
FR qo
1xM=
EZ%U
u%`n)
7YWk
{?`u
khhM
EehjL4NlIQwkVTf99o&
>2]]8_
ki=g
3`6e
\Ie
r|dA.2~/
0 QW
}uRk
umreadHandle
7; \
}M#Rj
0,55
,2v
sK1f
mI<0xxWq
GN?5
O6N^3
)Yhx
HdtN
Wtln
~Rh;
h=9
j)GX
%DsI
/hM=
laBx~
an{v
PQ,C
_fHC
+/EZ
+5
DefinePInvokeMethod
hsk.
+=~zGIe
707#
RR<6
P P P
BZ9E
BTt
lrb`.
J8NNp
[i`yM
W6RH
tgTyejhmMVEnpVfuZaebfdRcbFvZ
_Nn)
U0~
p"^@z
PP\)j
*n+
lu'6:
ME+k
%Yin
2Qavx
FsQF
STaPgXiQCWNFCjFExOyEDYvOimyg
pT<d`(
V0uqa
0BF][A
k!BwO
vasKwt
R]uj[
newpath
(X))Q
a5UaT
=XcJ
TK@'
Di/EF
f1{E
Pn o
?v[s
IXmr
#'9_+
p<XNI
Y<=\k!
FNQ>*
\f;
^~xi
'g y$
iC:,9
]Cj{
da.!
n25P
!] =K
HN8y
:rk_6
[<R-
iXZ
Y x
l6SB~
Ggdr4
URdZeir8LnxHjQ9DSMx
FxQ5~ATP8
E|h1E
m#oj
;on0
opwn
h59.
^6IP
Y_$z
Ej3R
sTZSpQTZPfiKwbeUQR
@!RP
h5f a
Qgsuqekxr
?oL&
Mj[%{
gc^anI1
*c7!.Kw
r9CBJ0rmcELUSoPHiGa~RyMjwer
0?z<
rmjv
pxM=
e4{+
N2 '
]Q`9
_aYER0
CreateDelegate
,eJ.
,{^n
eG'@
VOu[^
#pSj q$q
Rn7
CopyFileEx
{\xdg
I N/p$
,Haz
'^icg
.Rw
iD5TpqfQgNNe30V01YG
grTLnt64
Uc9 hT
IDATXG
VF)b)
K$Z*
cb^Drguments
_Uy=
}sQM
}f7l
@09N \
PhY8M
^*NIEq9
vbhjnAttribute
w(d{d
E`uo(
U5dW
|Zew ?
e-MMk
=9sH
fvRCprN9LENAHIV1R
,]/
Mqh9
Cile
q4l"G:
(&:n
! @=
Rm=pO
D* (
V,<9
wt+n
n[JdO
ov-{
3BM=
v{Kj
*-:P
=u q
mvV:
KNnZ
er.R
` Y'nx`
Convert
SGMwlL
SS* "S
PaA[
Mn5D
GdZR
) {k
zGw k
Rn3o7Zz.WzxIZ46JhvG
Ry${{
A,8+{
<M-u
FlagsAttribute
+'v;
set_KeySize
?{?6
c qL
KpLK
A;jG
Iu4xwBrbhSZQOQVOuD4
`j]cs
A9n0\
txGR
}>hE
sx8qx
RwS*
3Z6]
)>P8
pF5qSXc8s82iNMjZqLs
Q[6GWI
6&ER1
mgnY
E>[
uath
, ;ho=k
DhQ=
tQdkerator
$o[
kfs`ssionMode
9b$X
h=#Df
GDL]
n1 \
);J(
ts6F
8J_13
gfArOaZmhin+5G[f5Z
-<Zx
sC0@
get_Default
@ ?Z
kernel32.dll
nvBG
.9'V
3g;X=
>fHb
0M#v
Vo+
pKQr
z" ;u
Bgr
I*]e
Unlok
jTrkRKv,
u$d+#
fZ)+
(I<V
1ve;
protect
pY~A7U >
T^*
cI\\
UC[$
ijvnhmuTbUvDecNoHpIcWSCzXsTG
D]v;
4XeM
Y]cT
hl>5
S)Am
<<:;vX
/^jj~
uh)Fu
kvsv8MN`
6ym9
rsA?
QCaM
w/7w|
VleW
;#CD
s|C$
FVBSxtK
MdeBsFCHaIaiFHJBXFZmjZYMckOW.resources
}3c~3
M2%8
Vq9YLhfAvj0i5f30GeK
->l.
yDfD
zswqt
=Em}
_JtR
WW8x
GetBytes
^Ykiw
n3?S
3))C
_JTZ
9uL(
: O7
{Wr&C
E$r|FoB
) T?
t /T
[U UA
=}jP
ns&
Write
k.:W[S
{hh8
wy=]!
pU;pU*
Hp:a
9 9(
sZN[L
C;$.P @
nW;>
}E(dx
j(ZO0A
; (?6
(lY|S
I% Cf '
'IifNm
tn@D
};*m
/-PbZ
|O6^
} H5`
add_FormClosed
>BS)[`
]i8N<
+&t)^
{"XM
r\R
!wgDN
ZvG p
e.NT
5FXge
(
?]ke
;8Kw
tUAhjO
= -R
|@a7
AflW
,kmX
DYHoJYX47 Kt5rrAnI
4x F`t
8*)f
53`a<
pz%m
GxQ=
a*W!
`7W0
STAThreadAttribute
dF0uglNyKeHmJPEIbnf
NpO5qor9}:my4hLnOE8
m![q
t. uq
taJ::n~
AvM!
,>j)-Jt
~ 3n
F'EQ
System.Globalization
E d" r
woLU
1-!=
G+^\
$)DH*U@
&GSW
km9I
>2,m7
mu \&Kv
euEd
+fm
Gz>$6
.V=~
ie}Co
?/;Fl
HAd
;.dc
&oCu
AF<y
IoRX)#
vCA;
GZxj
o=:f
g,n6
_Z!F
System.Drawing.Icon
FinalRm
|GiR
=U/6
n
Z:PqT]`
jUKQhZRto2ixleS4bJ~QTlqUFiWLyesWaJCea
YZn\-?*
(7/hp
RH ']r
'Dh h
ot>
D[ycO
HI[.
0Yq?
n `I
LjWi
4ch2<
hR8pAHBF'sy1AH3f29
,.k+
w_p8
Fs<u
KWk2
*_ /
RHOf
<NkK
ia\<+
8PhS
;hjk
orAyoVrB
Environment
4\v2
RnIDATx^
t,3i
HQco2dDG4Y1vk
g&G\
$;ts
~u^l
3pyp
P P
get_EntryPoint
V= OgY
Decimal
P P P P P P P P P P P P P P P P P P P P P P P P P
&3Hk
HyKkK
.;q1
C]]++n4
P P P P P P P P
#,./12367:;=>7>GSLKSVWX^_dgilmpqtyz
(J%UB
%9PZ
B)-
f8j)
[1;l
z .~
q}Wl
!) 8
pIJA< m
uo]_)
BXy+
&?G/
V1Tu
B0T1
Activator
zhZC
ckq|m
jsu`File
ob0
.o{;w
xLzm
kDjF
<!zy:
_mJ$K
whev
:yw
kw u
l`Mg
k(mG
n. cN
@L.;i
,QTA
KZV *
IK0
Double
/>+
E.^o
==3U
AJ "
VRik
5F+
h,wW
J}}BL
ComponentResourceManager
q*D1
}"R:
3yS!
UWT=
mm]S,
-&)R
N&\&
ddtej
Y>F@
*\)Q7NBQ%
fKKjN
xFci
~v>a
set_WindowStyle
X0^:
J K~
E0>#
environment
[t%9pqPL
jsRqate
jls~
0fbE
?Mgk
[h('v9
QUV0w3rhQ
z;s/
-dt[p
~ MA
m[7x
gXIv
0FB)rl|\
`bt_~
^$WZ:
wkUgGdNUQTl17RrgH}
{-NqN3
L-`q5
tX|%
c lll
XP&z
XvFF
yO,s
-:nN
>Lhq
MHe9
9cbL`thod
T6 +
'YK4IH;~<
du2NQMN5iZZn{ eF`29
e\}I
o(?Eks
^/*]n
YIGEK#
WYddVafEDyay(4fd@o2
FIQp
3 ]s
U> W
.[m
A%,!
[R2v
q\+
TuY$)
rpGtcPvNSK
we;2r8
(=HXF|O
Of>O
aQsnXNFMfaadWCJbmoTToLZrYVyB
'j@H
I=+Eq
/^w
3.l}
GC)&
U^*w
|np'qZ
ogO
KxQ=
2JK!
eHQR
J 5z:G
jbylcSfHxuNVX7ZsDNL
0TBBC
Yl4{5.ocTI
y}G?M[
S+iT
TqMj
s&66
Nm)Mu
x<z^;
lwHi
P^j"
bytesZ
mName
:|nc
P P P P P P P P P P P P P P P P P P P P P P P P P
7&:n
SGCOtmrCTivkz W_`GJ
.y/\%l
TypeBuilder
%NMhC
B?Mp
Y G&
)%GZ
qA$(@D
<7^R
$D7s c
]{ku5
DR51TX21DVlB
get_Length
hdf6y
&@n
KhQ=
e,zm
\:Kv
pvPQYhYEEmvBBhjmlALCklLgGzhNA
NsMj ;E
Qm8d
uIMYkrNnBK04R6i)
rFzU
6dHZ
7Rtf
fa:V
9 dB
Ed6RIVTO08T
Ur3-
km,[Pz
m* u
hc~U
;9;M
;m{k
jK6#n
|:F%
j/+&
Og /H
?`U;
woVyV
:#jG-
5TN{
3RM=
GetFullPath
m* )
1&hl
0#wA
557[U
$v6=
M)<K
-5Yb
"eeXq
%lYr
NPj,
UMQ-
auXaUebqhilQVfKWcZBtIvoyYRDSA
HGTY,
%z1_
!acX
wg"\
p:x%Y
P+3]
wA*C
/h>u
TkverifiableCodeAttribute
<a=U5*#
S]!;
`0Ym
R[$u
ZF Cr
rVzp
W ?a
,DUL
eu`m.Core
0{MO
XuH8Ql
=P}R*
U0&FD
.wm<
l00lF
Hpe.
C4N/
{m,n
kh TR
DUuu
N27-
sm S
8e'wCm
iG5$
name
Vqy#+
i7Ji
!&] L>Z+p
|c"L
pxd.
%Zw$P
l k,
tL0VeeW
Kzr&
.rsrc
'# ;
&Gg0
Save
M\t+
Ow}P=
& Gw!
Ji-v
cUYY3
(PRT
y6d/
WM ou1kG
s7yT
AG<*R
T P9
ii8k
h}I8|
+mOm
=GmD
$)U[
orUk
DRQ=
np)iH+
89W'
k9K3
H Z=%
#\@c^B
'<3U
1` F
Guid
qmQYIF<
vY,&
=_{
_6W}
(RBc)=
!aSt
origif
~giu!=-
Y f
=o?4
z0wCU
eiP FA
5LM=
(c ~
RdcineDynamicModule
q )R
w/ tZJ
Data
<8X.K
#sr9
69ns
sI "
#)}g
Ld; >
QW4R
rPniderPath
Qiq~o6b
pHYs
9a&_
83 &I
6UEc
wO`
NVy&
)E(u
!This program cannot be run in DOS mode. $
xqt5
^]@cgegFbYq7hoMF
8H}K
k}Oo
f3oi!
InvalidOperationM
tc^il
System.IO.Compression
rIr&k
If9O%m-
\_sD'
ZK!$NqG
]LT1
RpIDATx^
TA$x
EY`d
Wdvs
,&g5:B
xRM=
Fj++gr\t
ZC<B
Urocess
OyvQR
$>Bz
5# \?
gqdaFunctionPointerAttribute
G$3f:
YZz-
c 99d41
Ia[.
*L=2
\/IU
sO@^I
nCFNH
e{6bx
sVR6
R>Ki
Yf_Z
gTsm
9cqd
TYiJ
GUZW
F(!dd$
!6Eq
UZ4q
(gX"
DrCii
IDQAA
y 0Q
ze~4
1^j-u
0.Y\
?jH|f
ndSaN
Byte
#CWD
xctFxKAGOWOTysXdzWMAogIsPLEZ
:QeO
v[3(hZ
dpmx{
1>Kl
i+k^
i#%
`6m$#FU
co It q
?w_R
NaPhnA
7r<4
s}ki-
]s+s
jH|L#
o$C
#u+:v
gF@/(83
LaW8qOrDUCGgD62KiOx
^Zz[
].7#
Fk Q
SQSs
ecZ
"qk*%1
G %:-
/.g2N
6* h9
Bite
];J_,14
S|k"
JCen?
pvgh
'e/)O
N oK
`3N}
8sv;
DH#l
sqy_;
oA.fN
:2Zsy;
bHA]
wz|OM#L]
^^^
h n6G$'
pJcc
*`{n
N?n|c
Z] T
eUgN
8) v3
"RaP
t9d)\uH
X@jrO
`[u!
get_LocalPa|
D ^
streamByteTran{~baRqreamNumber
wYi:
QPX.
y KG
5G{F<n_
np Fz
_08=
Woerb
!(Q
/G+.6
[* :K}$tt
TUH8
Tg'AE
nC]<
(Zv3
WrvemblyCompanyAttribute
taI$`
~m )
P9O:
h Dmz
pm\#e
a^>X
hJ/g
dT_(
d%,:T
\BVB@H8
$gm/7.: j 8
5xM=
wdO7
fis@/
LJ
..=!
]'2F
cADFEl5
*9y'
,ik2
3Qe@
5mee
f`ty
Open
DQ!._
(L6'9
K^i}
]K+sh
O>Ym
7waK
c5z_
QiBs
*j)m
y/->
\S*Y
~70"
XVS4
Wr>{
z!/c^
Z7mS0
Z$J Z^tdl
tO[bXHLi7L6Ae
W2wKH
JN*2n
weej
qIZ@[N
r PY
JzC`2U
jGN d
v#kq
intuty )r
_7W,
Tl!G=_'
hEz{D
$.jV
<F
q'81
PuqX
Jn|'
hk@U
vx+ouj
\NyV
*Ecqh
80x
Mpm8np
8d9;A
K 46
8[</
_eCk>
I5ti
7h8 ,
WJ9e
MfdQ
ad\|
<w}~
oRs!
-GSw`(
Qi(I+9
Gy/=
V2Fpj
>BBYyX
^$7e8
ieR\
w`NrT
yRM=
'~-?R
!*Wi
^Fr}
()<T
<~,ad
7s~#VIPZ
!/;O
$D=!sVl
(G`np
(c' $
WW$U
vups
v0ak22l><>.2TyrF64
(E54:E*
%E i
E^{%
/EsE3
Fw|OT
^cq&l:
;b[`
8wT%u
JkVS
N}O+~h
get_KeySize
QSNk[5C
XB9X>9
kMTHBN
.wk
gg;}
ri ~v>a
,;=jX
QL"W~
uDt
~IH]
-R$DV
K(8X
0Rx-9
Smocq
]MMq
SDCe
SYrR
W8k*{
tFmh
' Y L
GVS}
c!<y
g&\8
T0o9
c1XS*[i<r\
$RKp
T.*x
B$B\DL=
Cy^Yq
d"-,
RR}Gh
Zf{<)
mC,R
H[[^E
(yoT
"kIHJY
%&IN
\XUP
ww%1
9Z9X5
3Xas
`rEO
VRH
K$j$Bpb
S$n6
kDCz
Tll-s
:c*C
2'2E^
>G5.
ChQ=
kz 9-VQ
u|f^
\I[a#<s[S06
Ipp.
v3V`
.Utw
wfCJs
_6y&#7Fb
ReadInt64
r}uV
@N$#
: {R
}8-A;8
EE3U$
$Abq
mQ T4
; r*T0
q q
IndexOf
ProcessModule
m(X!@q
ktEZB|
f_6T
-hS }z
OLr6
Zd@i
s9gK0WrnyPcQrR3kjFp
E%x?
t` cweDttributes
IpF[mg
JOQB
{ i{C
RB=dT
wJZ
YZF N
p#&\w
Pri]'
Dd&(@d
`*qk
Vdnsider
pBW6c >.mUgx2b8OkT0
yJJP
x?zt-
wJi
*D;
!q\-h
k?o}9
BZ/%?
f>+c
AutoScaleMode
- L;!
GetDirectg
ZUSMZ%
# O
cj= %.
#9RB7
"G\&
5 M
O 8i;
SIP
=A=?
w!)*m
9\9;=~
GbL
yWeX
wkHerRnhbrfQPjPJyfgsBYIgjUUqA
M^<
t]] 5
mSB2qfNWbhlMJjB48Iw
$9v!
k6pL
M1W4
5Eov
JBR s5
xjwB
/eaY
M1; ;
`aDU%
$)+
28qR
},l{%l
Wz=MM~m
Kyf{=
Z %8
N^#7+,.
x~[~
[ [V
Mc%ao]
D?a1O
(<wpD
|WrQ
CompilerGeneratedAttra
*F\qJ
igQ*`
Hj,:
F,Rm
CW c
/Q0}!
czG$
p8p q
o:a ;q
>'BT%
>h;wP
S6^t
bdtionSettingsBase
#jKkJ
|.Y3
? mO
xe8l
O.PNwu(
(.Ay
AsO#
eO\>'
bd28o
38yk
_BgGPTk=
tHq('
9Ww{MG
T5$(
wvXBn8NJ._uU|AZ4JBc
s9Z}
Cberj
$oG {
o*A>
"~8=
HTo7*
EventResetMode
T\)h
'6~R8E&GT
zxM=
Append
I;Khgsp8
706@ H
;D]as
Rfc2898DeriveBytes
D>@E
7gjT
A=~R
,np(g
7qJ]Y
#qR-
o@#
MY2t9
tr'2_
WM;`
KP[*]
C{53
gpoNVr
oqlQOdfe9QSFO^
3er:
iyw'o
wFF2
SUsSystem.Runta
X f$
gANs
WcUObQHikFk8ZHGww4
?;f ;`
vUxG}
PL.A
p! A
D3Tm
Rrrj
,-8[
}h=3
3GIf
System.Codm:i{/Fompiler
m.B$I
=x_7
@@pr
9%aM
w&;N
XW!2{
k-1v
g>,R
V:];Z
RegistryC
KucX
6%j1
C\=N
=\kX
dDQOB*X
(+y@<?Dv
M+-
kY.w)g
Ytft
,aIP9
Sb "
xBM=
Ygv6
x_1ke
3"]=
callback
?6/W
UG5.
! "7m
u{\R
|yJ3u
Cg,Sl
dInJ
vjW'
w-P y
System.Glg
0xM=
&GES;
mq%
Wky@
l&!c
8>W:
[O=3
k-*4{
7.>\
9hMN[V
[5E5
ReadJ
/J+
}UO-S
p(FV
N}X
H1idsTyl
.W @
{ME'
AXI=
K -)
pCMe
DS)-5
xUD]
dPoDyvztrMArGqLSCCFUNqxKGKze
*NOgj
Ib|Q
set_Lm
BSJB
sL2~
ML]4
~~i7+
s 5/ g!
n28rmUf2jMICommyK49
\hVV
@<ly
V7m#b
I 9`
("e;
7hedwt
m)sk
Yy a
Ri{d
zJV|
qIWS!*
!ZsP
f_ewk
mX9tl
w"2r+<GQe
n@R
VU`D
%T_[t~g
0'e}DF.
System.Linq
g9$znX\
[%:3v8)}]s
I+|W
/I=N
)zsH
,cwePInt32
applicationName
UY[^
nrDe
1:"f
uu+y<
HxYC
wQWK
Rg+?
x678E>Fp
m%d4
I(N i
b?tp
xc1>X
* sw
}]P5v
cufB
+3*!
/N, %6
]/\%
(6#C
HhQ=
$(@>UI
C4dEAF
KluDr
88)m
cU7ojt3WZ8Oey3VYYR
lt<l
!_Ia
mb)'
n5W<2%
?;~}
Rt\u
VR'H
$. .
F.U(
fwk;
R| 'W@
h>Uo@
Cnwpktlko0oZQGiKi
"~H=
]i<4M
noQCq"}
zKQA
toxd
.F MLn
oqpO
*\ O
k9O>
m3d2
@p<x
2}QO-
vQ}7
Cq,(
1HU+
RKxcYWHbQfKNcAXHHlAcQyuDRYaYB
BhQ=
Nxww
<H[8
Gl7#
ec:
{LBa
5l[y
/pR W
$^m1
)P*B
\D{k
Z>qXg
%. v"<
l2C?
9*9
G@ 3m
Mn3]6
wi=R
n>d3
sPvTBNH!WiGpB132824
G5WC
>On%
T132i
J3Tc
%G-JbfK
OVxr8
9 c
w`p<I<V
h 2T
l[Y62
baseAddress
p:Y-
CN|aZd
sptVJsKFMsQpFWmTCiPGnUyaZlNj
$)V()@)@)@)@)@)@)@)@)@)@+
7Djv
}m6 r
(/26^@
]=1W
+;tX>
OKOO
68I,
'?EQ
Ya jE\
{1{
hRFx
q:q6+
2 8 RHo*Z
[D|R
G 27
"ZSO4
gm-w
ywB*
W"iJU\
fEy(
:fcz
IEND
gL Z
]ZKu
6hM=
=nE}C
XT1v
q3Y(
hwndOwnm
n Vk
*0yS5
~C
N;FA
streamSize
C!L
\Z66
[,2o
qVX(
cEMu
t`yS
Vb!kow
context
rDa;
-hN6
!aj"
hekO
Q/:N
?ly1
Jb0
oLGC
[?hs
EMAq
g'~>
JV0|*
8yW^.K
8(V
WSb:
%|2S
?T);
q+G
z^Q>
yh+Y
dY~9B
dwCx
GzqBk
8()
$5h}
MD5CryptoServik
Li{ f'
PpP)
Qdhqer
*^+
bytesWritten
vzRt[
pH%SM=
&\d8
5lF`
ysN-
CompilerGeneratedAttribute
;8";hJ
!:IH
H!(B
] u
cbMf9
currentL
F vC
"CH R
Gyte
ICP$
9><Mt^
V6k@
.*Qa
CRQ=
`z#U,
Z+B>
jp7Va2N4Fw6B2> hS[\
w]=y
aRki
AS\C\
0BT@<
U!Q+
4tXt
L5 x
vhkH
B%mQ
3*nz
!2T2gj
*5"==
dpr-p
Binaz
w^hg
get_Id
w'wd
~?>][
vkx4cHNaS73w5iZjsjA
}5|m
]e7/
1f}k
GhQ=
gPj}Ct
6Uf
bDdvourceBuilder
njz_
{vGn
pwzj^\/
] +h
TF+'.`
VDAX
<B@
ik;H
KE
*N+ X
Last
^oVT
qhM=
L8Kkh
*Nps
c{@i
9g}<F
t7]}
"Rd)i
Y}j-
KK6JM
EPhbd@NK&c
#J#"
gs&d
,nc-
t[)q
$BLw-
kqF#
Yz~tQ
('rz
MAmL
ktm 4q
GI=As3r
98Xy
# u(
String
} YnM
wB+6
Qa9GBA8r9jIa$C<ZNdx
\7eR
au/4
w<q
!d86
juje
4bK.mJ
(^Uu
0T~
k3mOn:tL7jVkBFYooni
#y%l($
S+&
InitializeArray
orlU
rl:(*c
/ Flh
"m2S
*5i3
H[[B
KiFsK
_Os`\:*
sn&E0?-_
}YvBRP9
$W|b
Z2q
chhr_
6$oS
5F]&n
EditorBrowsableAttribute
Z0 X
ReadChaz~eOSbmErVAQeXKc7yZEA
-i)<
45*e
(UU*
0P0J
7L/aKM
,aIW
B+,
c8/a
W/@V
SX V
tfh|
7^d
Mz&L@>
? n|9
`.sdata
)DA@
.7-3
N5@$f
DIH@F
^Y,30
uwcie
9U>T:
MnHk
exePath
Irqz
eIgCyihYujbZuZDXVBHlbueMANQSA
3#;X
7i.~
k,bM
*$~2
j6m`vel="asInvoker" uiAccess="n
7}Gq
{& [
SP*@
MethodAttributes
I%\=\+
T(3<
A;Oq
EjDKIG
*S-=
:]5
;F+:~!
Dictionary`2
6e8YL
>:\KN
NN8o
r"$t
m;Hk
gbhjnFlags
sMAl
*B R
jMCHjk8fyAYLayVaJau
#c5"
]Q s
VNH1
JpFT
I6A,
ISupportInitialize
l9SeV
c_ I
HOJg
6zl }
RuntimeHelpers
im;J
V"-D
@\Ki
6BJVTIH
lt>v
qIn_
T6Q*:
JFIF
}i7@
Assee
([Hr|
& T.
E]uUHV
,^ b
p].rc
(X
%D}U
Object
A? U
Ni @
)j w|
Ps:%
&+@X
&8>Y
=+*z
#\Re
3System.Resources.Tools.StronglyTypedResourceBuilder
wLib
To0L
\i$(
g1~UZ
>t~`
T0HH=
3{gNj?
?)pE
H[f/
l~u\^
N8pV5
N}G?
cfxs
g^#)
Uyn5?P@$p6
:6T>
]ST=
*t|?
QQk$R
$ZIt
,!HP
!ee}U;
6U "j
NsjuY
{c~*
}^wy
A>qR1
m{ H'
c5_AA[
rNH;
3<!/
dQ:I$eC
WrvemblyBuilder
4c=K
KCO+
FsjductAttribute
<# y
0u/}(
Defli cEuweam
'qa;.
yk ~
p4=
y R6
Ek) q,i+
"\Kv&
J,Vw
urGG*
(/2Z
Int16
Exif
KB}o
Tb;p
~<8"
Dp8<
17bF
x{s6
xdm/
qD{~
snua@
gcmqInstance
AT95
W'xV
KZT:
r d(!j%
[t ()07
Exi<
R[R@}!@
E84HxlN3KkvC897l kA
V;K)>A
l@`1
Z(es
#?Uw
wxM=
CsiplLrUhQGos4FZ[8W
pR7)
.v|
IZIZ
ge|!KwhkModule
VZ;S
!$\N
}Rds
cK /
]jSByR
tsK,O
8[:$F
XQU*p
JXvY
*?Zd
!eUjxe
System.ComponentModel
s6\C
9 (g
PtEUfCMR5Px2ygrlyV
GS#T
g\. Z
[m>*Q
Ilw8
v!sJ
SQ%tEO
TQsH
Vgrd4HfOVeidrtgd
/0d
tY:O
I<I'
u{.^
g ?g
jdsY
e_Hf+
({{}b
T0g txFv5O43DW98JC
[/3q
``(cd/
_ _>
.h.d
'DQD)
oA@?;N
JpSKTYJ3iLCZ
=8mj..
t|h
.9+R1j
xvxG
\yLw
C g)
*bZs
KjWV
z|SY
Ru dO+_0
3<yp
}]4#
[|1Z
9#JNS
X L~
b, {
?Wz@
R&mo'
8 $
xd5%
s+o|
$52EA
*Q;O p
g5 5_#
vKTV
K<Ab
utC%
[a$p
pH'd
vKTf
8Y54J3
7myzp
YZw8:s
jX_
4=`^FC
@[ 5h
Next
cb^LsBackground
pU 4%
fD6c
LULId
}oC!!
))SL
c,q'qgt@
Y.Hv
-,QE
pvi'
cLz[EL?P+
TDUy
N ]B
yFx)p
sO.V>
K u?F
rxs<y
<7${*
H47A
&F(E
]Y\z*
iAvs[
=ifxClags
4$6*
Jh;w
H:[?a
Gp\w
Microsoft.Visui
!JJg
RPZ,u
kn7m8W
L[cO
k*S+
UCMr
gr+'L
UCMM
upb,
}$jL
Y'Z}*+
C}z~
ZPH@
]~R?
i.gBc6
Lc*i
5@\S
n_^p
EBQ=
u(H
W >M
BX;Z
jy+ KRx
&DWp
<8VJ=
BcH[a
[ pQY*?I
#3BR
UgDwlVND17s6SdavgLF
GetTypeFromHandle
IAsyncResult
{uuhN$a8>
<VTS
%5*+
% qW
lO0!IFfXpv1TPraCyo4
@5D\
{{[[
-zMY3
4+%vG&:<
Qqsx?
[rC$
S`adInt16
{XA@
s=_~
(Vh
]3GC.bPc
VO__L
~l
d)E.
"~\=
y#<
yhUwP,
5FNN
m%5m3
AP S
AB a
F3^>
#.+/
K=?5N
i}-@kp0
RMI MD
~q)4
|tk
%T,$1
Yi&4
GetProcessById
Q-IW
{ gbd
6H 8j
L99K
DBQ=
System.Runtime.InteropServices
+>gGwYYSm
cRrkq
YA-K
OAbTIPfJZatjOM7th7v
B,]E
9v!-hAe
@=Hi )
_~2"
z;N-
D 7?~
@C$5e
#B'3
p)]
=,K+
p{v+
System.Runtime.CompilerServices
_b}V
UJ6!AAT
YLu<
>UQK
V^io

Yg:\
r8TL$
)W*)@)@)@+
E=@`
D| z\
wlL+
Move
a"5H2R
yg'z
RlKt
-VjCGg
[]j/w
=u}wT
&w~jh
/p6z#
meGi
sr%g
hZQ1
(l N
IP"[
5s9i
<SzK
J+ X
'<+q
ku3/
sY-t;
$<
Mm1<
IU+=
K9t
@.rm
FhQ=
%YO.
xQL`
ze>
FuO2
*nV 7 d
GT/^
WC2;
U2T9
o`z;K
@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@)@*
@"IZ2
oWV-Jte
Fx%|
;e<'d
OpenWritm~t#l@sgfci29bo0CwP30
|Pe|0{[}EA
7mPZ|
ERQ=
processAttributes
UF3G
{]iN
nbMT
\]U|
6Dl
- y&
U+"G
#9-i>P
;@+w
_#N;
+8@
vCOr
WUa5&u"u
9Ci@
p: ,
".=U
2^}k
Rbz4
)(Yo`W
lmYk
!8Fh
_qCE
&<xR
'@JX
&=uRm
9VB=
Y 9tr
#]!\
U].o
/a]:
[i~~
/M=gK
)`D
i5]b
SFAS
Gr$ )
haa@(
jqCA[7Gp
)])ju
bufferSize
[+c~@;
@c0a%
TbT1
%Yu#
D|[vr{F
:({Z
p*U_'
K 7as{
3xM=
=n]/w
u^7X
LRQ=
Yq^1.
%K*_
<jX-$g
OcAJ+
d;gv
lcnq
g{rV
C}dp
f].O
W%f5?4
object
Q47*P
[R!I
JQ$i
'H>#uU:
PZy:u
2W^:}
a-%E$R
zz@.
Ig]9
!OAA
.x$P
KDYS9h
W27zu
,;H k
<_g*
<+oW
6SeF
#WfA^
PixelFg kwu
YP#"0
5b;K
!`0T
_M0:
p &-
AhQ=
y+7-
?]I]
{bw9
L}h
Encoding
CqxY
TV]C
:1 [
s(o6q
A8*0P
W}Et
wwW^
\[J
H"73
*Z+
=jQV
IEnumerable`1
P|0<
0PWU}
get_Module
f(X^
-6]t
uYtV
d5bCv5
N!73<
Zer6
!'.W
ASv
%E!!
AQwf5
ReadSByte
LaA
+<<'
@A0Z
y8Z^h
-;i|R
lIT D]
K3k5
n65`
vWn?
<+uU
V.Rh
ReadString
rM#b
<G@Vhcl
Zero
p)k.:
*BSJB
q4HK
Gj^N-5
^/*@P`
~$ ;
A' (R
;s~m
gc F
WMGvE
ws!#
Thrm
w#_7
Nx7oMVz
X+cA
tydBqQdwSqpSiaErNhGuWOQZXeEF
9<09
+>qJ
6A0]Dl
!\8e
GRWJ:m
YYc
>n0X
d-ip#d
<DSw
5 k:/2l7Fm
+_M4
:p^
}ACd
N2@F>o
| _a
eg 9$
6RKz
*-HEP
kcInDahRuUAdRYFOJttHrfUcCaQG
V\T1
_ "w
(e>P
]%c,dB
v;6G
6k hz
`zlD n
WE89
bCHkt16
GPIop
U@sk
% (d
^xL1
>j)*i
PN[
2*~L
SNFz
System.Drawing.Bitmap
(-MN
G|p{
O-EKi
M2nV
|p=u
+;T0{
FR*_
;;rQn.6
wDr_
SNF^
%J|{a
7xM=
a_wH=
Sj.G
r8)'
Yb{Y$
I)PRI
PI l
P\T;
Og\[
DL1<u5
WNN,
4M/9
JsKJ
ts`aStart
3xq
ev>5
r}^v
JRYC
fAAkJwfIrRnR5X0M0QI
*H.EM@*
`vZ{
YfO
= m$1
nR~Z
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05_64 Seven05_64 VirtualBox 2018-06-21 01:51:44 2018-06-21 01:54:35 171

3 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05_64 Seven05_64 VirtualBox 2018-06-21 01:51:44 2018-06-21 01:54:35 171

7 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\diecon.exe.config
C:\Users\Seven01\AppData\Local\Temp\diecon.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\diecon.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\diecon.config
C:\Users\Seven01\AppData\Local\Temp\diecon.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\GDIPFONTCACHEV1.DAT
C:\Windows\Fonts\ahronbd.ttf
C:\Windows\Fonts\tahoma.ttf
C:\Windows\Fonts\msjh.ttf
C:\Windows\Fonts\msyh.ttf
C:\Windows\Fonts\malgun.ttf
C:\Windows\Fonts\micross.ttf
C:\Windows\Fonts\segoeui.ttf

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\diecon.exe.config
C:\Users\Seven01\AppData\Local\Temp\diecon.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\GDIPFONTCACHEV1.DAT
C:\Windows\Fonts\tahoma.ttf
C:\Windows\Fonts\msjh.ttf
C:\Windows\Fonts\msyh.ttf
C:\Windows\Fonts\malgun.ttf
C:\Windows\Fonts\micross.ttf
C:\Windows\Fonts\segoeui.ttf

Write Files

C:\Users\Seven01\AppData\Local\GDIPFONTCACHEV1.DAT

Delete Files

Nothing to display

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diecon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\2dbbdbba\2df1db79
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus\FontCachePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_CURRENT_USER\EUDC\1252
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus\FontCachePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
kernel32.dll.QueryActCtxW
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.VirtualProtect
uxtheme.dll.IsAppThemed
kernel32.dll.CreateActCtxA
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.RegisterWindowMessageW
user32.dll.GetSystemMetrics
user32.dll.AdjustWindowRectEx
kernel32.dll.GetCurrentProcess
kernel32.dll.GetCurrentThread
kernel32.dll.DuplicateHandle
kernel32.dll.GetCurrentThreadId
kernel32.dll.GetCurrentActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
kernel32.dll.GetModuleHandleW
kernel32.dll.GetProcAddress
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
kernel32.dll.GetUserDefaultUILanguage
user32.dll.RegisterClassW
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
user32.dll.CallWindowProcW
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
kernel32.dll.DeactivateActCtx
gdi32.dll.CreateCompatibleDC
kernel32.dll.GetSystemDefaultLCID
gdi32.dll.GetObjectW
user32.dll.GetDC
kernel32.dll.GetCurrentProcessId
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
mscoreei.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipCreateFontFromLogfontW
kernel32.dll.RegOpenKeyExW
kernel32.dll.RegQueryInfoKeyA
kernel32.dll.RegCloseKey
kernel32.dll.RegCreateKeyExW
kernel32.dll.RegQueryValueExW
kernel32.dll.RegEnumValueW
kernel32.dll.RegQueryInfoKeyW
mscoree.dll.ND_RI2
mscoreei.dll.ND_RI2
mscoree.dll.ND_RU1
mscoreei.dll.ND_RU1
gdiplus.dll.GdipGetFontUnit
gdiplus.dll.GdipGetFontSize
gdiplus.dll.GdipGetFontStyle
gdiplus.dll.GdipGetFamily
user32.dll.ReleaseDC
gdiplus.dll.GdipCreateFromHDC
gdiplus.dll.GdipGetDpiY
gdiplus.dll.GdipGetFontHeight
gdiplus.dll.GdipGetEmHeight
gdiplus.dll.GdipGetLineSpacing
gdiplus.dll.GdipDeleteGraphics
gdiplus.dll.GdipCreateFont
gdiplus.dll.GdipDeleteFont
gdiplus.dll.GdipGetLogFontW
mscoree.dll.ND_WU1
mscoreei.dll.ND_WU1
gdi32.dll.CreateFontIndirectW
gdi32.dll.SelectObject
gdi32.dll.GetTextMetricsW
gdi32.dll.GetTextExtentPoint32W
gdi32.dll.DeleteDC
kernel32.dll.GlobalMemoryStatusEx
kernel32.dll.SwitchToThread

Execute Commands

Nothing to display

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-06-21 01:54:19

Detected family: #Malicious

TheSystem Itself @ 2018-06-21 02:10:02