MalScore
100/100
MalFamily
Malicious

coded.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 13/67 Related 1999
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 512.50 KB (524800 bytes)
Compile time: 2017-05-08 04:57:36
MD5: 5538a6511ba7d4602bee073143f9d4e5
SHA1: 7c2643d1b8b31869ad56aaa17e0ff675d279cce5
SHA256: ec73a2e20ff81c6af735f1e29a9145e58e4fb203df9755f5c98e88d231833afd
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 W/O'$D .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-15 11:42:03
Last submission: 2018-02-15 11:42:03
Filename detected: - coded.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/coded.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-15 07:35:05 [13/67] VirusTotal
PE Sections 4 suspicious
Name VAddress VSize Size MD5 SHA1
W/O'$D 0x2000 0xdef8 57344 0621c38bfdbd82314621b5795843c3b0 1980f251b775f2d3a73e33feba7a937522ecadfd
.text 0x10000 0x3dc78 253440 fdc9717d25538acf33e9f69f6059053f 90ac590e9483cbcee2a5596d586d81f4e5cee1bc
.rsrc 0x4e000 0x33a38 211968 89f38bd0cbef1acf11027446f2dc8956 f33f05c420fa20ec7739ef199d62ec15dea06de1
.reloc 0x82000 0xc 512 4e4a67c1ffad72c688ad19cfcdc4fd13 d14eeb3fb7574ba336983085b070684b350f4b1d
0x84000 0x10 512 da8c3884b98792b6bef8967fcff539d0 68e0303f596b209249acb6097527889af6738d8b
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x4e130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x8147c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x81490 952 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x81848 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2017 Duke Energy Corp
Assembly Version: 0.0.0.0
InternalName: coded.exe
FileVersion: 6.8.19.2
CompanyName: Duke Energy Corp
Comments: ibadaqayubowigar
ProductName: cobas TaqScreen West Nile Virus Test
ProductVersion: 6.8.19.2
FileDescription: cobas TaqScreen West Nile Virus Test
Translation: 0x0000 0x04b0
OriginalFilename: coded.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
IP Found
6.8.19.2
URL(s)
No URL found
Assembly Version
0.0.0.0
VarFileInfo
0993e06a-4c65-7f8
Comments
ProductName
cobas TaqScreen West Nile Virus Test
InternalName
5639ca12-b8e9-d2
ibadaqayubowigar
FileDescription
Duke Energy Corp
%$,+/.1032425262
Copyright
0993e06a-4c65-7f39
0993e06a-4c65-7f38
0993e06a-4c65-7f11
0993e06a-4c65-7f10
0993e06a-4c65-7f13
0993e06a-4c65-7f12
0993e06a-4c65-7f15
0993e06a-4c65-7f14
0993e06a-4c65-7f17
0993e06a-4c65-7f16
0993e06a-4c65-7f19
0993e06a-4c65-7f18
0993e06a-4c65-7f31
0993e06a-4c65-7f30
0993e06a-4c65-7f37
0993e06a-4c65-7f36
0993e06a-4c65-7f35
0993e06a-4c65-7f34
LegalCopyright
FileVersion
coded.exe
%q^
VS_VERSION_INFO
StringFileInfo
2017 Duke Energy Corp
0993e06a-4c65-7f33
000004b0
6.8.19.2
ProductVersion
0993e06a-4c65-7f32
Translation
OriginalFilename
0993e06a-4c65-7f1
0993e06a-4c65-7f0
0993e06a-4c65-7f3
0993e06a-4c65-7f2
0993e06a-4c65-7f5
0993e06a-4c65-7f4
0993e06a-4c65-7f7
0993e06a-4c65-7f6
0993e06a-4c65-7f9
0993e06a-4c65-7f42
CompanyName
0993e06a-4c65-7f43
0993e06a-4c65-7f24
0993e06a-4c65-7f25
0993e06a-4c65-7f26
0993e06a-4c65-7f27
0993e06a-4c65-7f20
0993e06a-4c65-7f21
0993e06a-4c65-7f22
0993e06a-4c65-7f23
0993e06a-4c65-7f44
0993e06a-4c65-7f45
0993e06a-4c65-7f28
0993e06a-4c65-7f29
0993e06a-4c65-7f40
0993e06a-4c65-7f41
F4~e
" #%$F
5yej$
Qpt
wR%m
AyU//U
Ml^_G@rk0*RxeGQ=dliUI\%?$
)CpC
8xyN
s;]g
}mib
nS Rg
j^*7i/o~$6c<;:2~"^AR%L0S&
K` H
vXp-=&$cAD(6j&zELH\3%|K#"
MVQ^
vj@*}
Int32
W Qr/t@
jN.o
<SYSf
iELL
7Wt
ObjectHandle
%2Oy'
QV!l"
o]]XO'k@yKgpT{'>bcvNyPzF
U}wo
"oWW
>2t
{JH>z\5a`3"ezC9[RYdWDVE+%
_<nh
vZ:2VL
hzi
Y `
#@Fl]
ResolveEventHandler
!+YJ
get_Height
7mrQ7Yp
n8qb
* *g
6wm.j|Ee45
<(II
/dzH.7
I%lf
H xa
:AUk
`1h}
9epD2
vR K?
OLlv
z'Es
=}q4
(Q e
V!4f
y6S>
x Ep
w#1T
*/!REq4(Ro~J/uZ<^U `o^TT
{p7U:=(N:JXB(6'7^8=om"qW
0b,rS
]#'1
nLBq
-"m
9ZdF%
KR
.'gog%{
(aT5P
a[1Xv9
Version
yOBZ
]4">
gf,ta[
7'K!I
`ysi
%BF$
X (+
wuRf=7a
Sr$l
`;a&
set_EnabledCalc
B)k-6Z^
UM4fztJg"r@8vbt$@3W!XgRC
H^FN
>^]
nOxX
g}F
v$"j
:ed4
[:jM
<o<@
#TXS
&-DI
PNG
QK%o
~w OA
$F =
s#Je
K7nuY
MLpnc
FtXY
xM^Xp
lMIge
X_e3
ControlStyles
VEN
1Q?_KjE}{'24<,r"#Jk<RO+D"
Marshal
|X.R^
TG74
Ci2W
]|Aiz#
H(w6dRs}
5^Aj
_9>X
'fgL
,M9xAy
27??
SBsj
5']mg
g5!3
/IIs
qa+0*
Pj d
f!k[n
JML :
'%I-
y_*
s ^*5q
k/uZD]lJ;DO4:$bzU]77Z(Uq&
Wb!>
op_Explicit
RuntimeFieldHandle
S9.
f3E-s
|A
System.Security
/ex}=
]dO>a
}IDAThC
Tz~'
GzCy
RIDAThC
w(hs
oEbI:0
)Cu
f%^0
i!{]
s/p/p/p/p/p/p/p/p/p/p/p/p/p/p/p/
J$H
ow L
G[X:
X> $
E}N`
+HHVe
ZXJX*V
&SS{
ZXJX*J
9tP\
(3S>]]
EndInvoke
]#9d
=wI!
iPTn4F\A
h6xP7
^OLo
fwex
Me!<]
>I/c
3|:Hhocdq
mYg{
< =VK
MgTd
;Etq
D2=r%
@'4Q
A<QX
eIDAThC
k8b0Y
`hJl
Write
#AxE R
Bpkz
g}Yn
LUWm
9X&V
/ZVM
a}_:
Q.g'
K:@C
X1#:
Rld1A
6;]{
/g;u
set_Alignment
:2*|
AssemblyCompanyAttribute
BO t
s= (
|\-7
eY.!E
%f
|Zpy
2gRa
.#&
LX``
^_t,
.Z"8
_z@74T./
kYBDo;
3/Oc
n^iK
Y.fD
;Q8(
% thK97
}I{5x9
l8sx
~53aPga
a8{Qc
(K/J
'N#u>
cz&WV1YLly('Ye@n570j!#ZA#
,0$vVY
Enumerable
*sT`
=BY3*,Uo1-2syJQte=,"w!'b"
q)"k
> \HW
QQ~ F
>YI"
R=I{
1p"OE
A+Lb4
AppDomain
mp\b
"C8]
Uzn5
*>K1
"T @
; Fw
r K1
j\QTJ
(g|Vbel
get_CurrentDomain
T@MS
{yz'g
s>pTUD
|+~M3
dtP_
6tKh
Lp^|q
V<tXh
Afn9
=9}T
/ T(>
>?BnP)s{"@zta+!85XOLZ}T{#
uBZf
B6 S
-V&1
'nO[
n:/
v^#h$
4JK4Y
pvE
BSn)
3T6h0s
oOkPy,]J793L D;BZWIa&Yjo$
U -q
~hV?
P @
DpG<
>5NG^
T"(7
"!Ca0
|E4Ji5~"#}n:F LEHW0<CYon#
X q=
h}W6
!r'e
_@t ,
m*G&O
]gTd?)
{ #H
+!g,
CmTS
1q<VR
CrpD
YfJcL
oVQa\1
T@H=
<U j
`<CP
GZ[4
0m ?~4
tp@]
ok
W+zL
P-"$-
.pp5R
<@@JP
!Ait
#Blob
YtV"{5CA-%$sBuOD*rg0/f*]"
:d7o)
4nW$
GetFunctionPointerForDelegate
1m6I
[Gs=
r b:
5M &X
oG X
>, [
$e4q
8h$Q
@M *S!5
V l1{:
R3fj
Wn;j
"e:%0
=B 9
Nb5@
Mq3_
$zN\"R
}2oKS
6@os1
XP@Q
`gGv
rU'^
)Wyb
3Jz^
BindingFlags
Z4 @h
;V|24|
/|hDI3P
ABOnY$N
}5mLHKpX$,#t(e'_1q:}ljo;!
Type
Y>!$
({{
)?-8
zAmE
mT)h>
/x E y
Ep!v
J KNM
IEnumerable
Tuhs
W F8
aSwOSm~IfB94]|Jzgw@Ttfc=!
YBpq
y ,)s
'}%y
9/%@
=,pqOn
E+hK
ZL9}
:J!B
K%RW
) !!!
[ >E
^kS8
rn7<[}7
Cursor
^/;P
@ X}
&&`8W,
K9? k
J2:,?
)jtH
6r,J
(` >/
iJHi>Jt}i$?KLg#lIvu`>0T0&
3-0$
q*"z
$FI
"r5dSe
?wdu~
/;&$
qQU/
' 9 G Q g
fgw!
Char
2#. B
g^>`-
#k4Q,
T_(9
6DO1
^ nkE''HjB"n0U4,!;")G[5&
v@a lNA;Z+7iE4W)xNCpF:)"'
m]?sY85
^rPVB
GetValue
^3#\
l ZG
#k<s
N@7$GE *ZmWGY?6DeUyS\v-E"
xCL~
J%%&
MDN.
Z "J
>m_0$
get_X
get_Y
:mFF
pWkl|;$10n2|-N@E<fUI$I&a)
$ 0.
] ;s
Ekm
IUE8+
, oN5
GrqnJv
Y`[}
Gc|d
E:Gw
t D$
VirtualProtectEx
iNMo|<*gn9!xt@2"+xX@+RRM@
O&f!f
]6'
get_FullyQualifiedName
\#u>6KEQr"!"P>w6CfO;ZxWX'
zMm]W5
NoCh
sn[WN
3 C3
EX=
dXWN*
Mut=4Y?r1=]bntb$SjMRQXk("
Md.7`
X/iI
{O:?<BvSY}n`U6''^&?dM-bu
8n-y!D}-=+z[V"/-h!{%',=&
\\ %
5fn~+
[#fQg
U]g
B' Q|B
>O${s
!Lbd
l AmJ
a^|v
G}$n_
>vI4
@3]7 _mJh-j12 p81B&7W*R*,
&t2M
dVWSZ9|gNC
gX(
N\XWm{/[^a+Y1ux&x2 Q8(Jm$
]OL
l 8Eo
) Q?-
n h'_
Eph3
al]GN4;
IsaE
9bqw
FM]J
6]0
ZCeS
B7_7.
b?a)
Z"" #
'c|n!
2;*`i
$~A0`
!Svm
g3uug.
.text
q4Qd,DT
Jv v
GetString
2w#c
lxWww
G Wd
2S79]
|2(F
7e r
V l4
p"_,
mh0G
ZjW+
:o+5
+6Q`
MCd)j
3g MC*kX?
W/O'$
;,?}
${$e~e$5iJ;
/"T
,((G
3pi>
TSEV
FQ1'
vBqgH7K
[$wr
Q"8h
8`:b|Y@7bA3(jI#8F20uWuy)
bnZ'k7)
gxR^y}
AE,
N)'w
/xzr
I{hI~|]w\V*dN6tZil{t;oIE"
j["B7
1r?iN{i
+$fkArPeP(M4e+;rJLc>>"Tb!
\ V>
0u<*ait
zJM#
E; P
![fD
:P@
41r7
pF)j
DU6^h^vl!`wTSX*jE^H{EH\+
fR,R
*2,g
]2!/^C
*TnK`
w~7soZ(=s
ww*l
[=VO
jZR[X
otB}
qp"&
W?W~~
ZB2=s>II
]AKza*4a}L`bbgv1>?dp7+^W!
zCL
@zH:
GtPR
1+ejr
RaH2
3 _-
)7+Kd
4 K+|
|{&2
#>0C
MAyH
dQw[
k.G:
e!LW
W-\&
VCGk
C8\
= ;x
1ApO
PU+!
Lb_
0jqu:
Y]me
>'0W
`5wts
6ewpIkQupS^-e:NNRE } =}5!
WXJ~
8X[N~
Ji7]|
`NwI
#YF$[HIgq
r be
WI|L
y% G
;1.V3x
;_76
2eb|
7^=u=
E^*A
T~P9N
`?R mGQ,
kWup
}xn^
G;4j
vb}f
!J4b
nz F
:/!T
Zxkl;
y=#q"f
{ Rb
f%w7
2T|K
1p ;
9286
rh@vXQ
U?I %
5gu~
u:TwcZ
eT4? ]m`9wE_#0#i]/,5:CKV
H@Y00[S~05@=pmL`CPm_3@iq$
1NSAcp:PM4Z$1Ys
DnCg-
& UVu
]2Rs
+}eN
8bj1}
c!m'
S= )
mHHk
\e3f
%96[
/el=
ucG(.= }
Q/}l
5*Z_K8M1Br)Q>BVj29x&X@L("
j> S
kernel32.dll
-a>$V
result
'(>)
">NN
\ hC
1r"[
4H<Z
\C%;
PE "E
VW~$
931F
sck:
v]C
MY,-
8"0g/
^+N=
w0oL^
J-9.Aj
}ke%
(;Cf4$]*;vPqBY[V#HHs`OUc&
}}vD
yu!M
MerG
pY2_6DQY`5PBe"kR"Ns<M{nN"
\6Mz
F:nG
t\^\
\ift
.S6v
/.qi`
w#)T
9W_][
$ry}
9X=s
G',
5'uG
vm0UV
XwC'
SfsT
y k<
euD{
2L[\
t2[ls
<]yI _
FqDn
i$&H
@*fnG
aHBL#
sE(&.8
1q#|
iF}b
#G}GB/qBU1$uTvk_Y&xRJUG>&
=}de
oL5su*
2%mM
tI_d
*m G7y'^
Qjj"
ca7O
/sy
Jj<X}
#gu47I+73O0gQ}BqMf2=0L"**
a/3g
MouseEventArgs
i@:6$B^i
n m}
XYGw
+ 7e
Oqls
TG->mC}&4
IA *
*AQ&
G%a;
ww`k
4f{U
c_**
n@IH
RZs
~(eD
SF tR `0
nigFA
@OS|
X[UW
:uw@
t3,;@*#lNkd:g:eSLe@4,^=)!
bF^z2
RV!I
(
VN@=
Il^g
XZjvl
!>\{
I@-"b
Z <7 ,~O
U6n`
O,#@
3Tq#
)"\
{uv
@xj)
>$TC
+!>0
f+M&
2z(g]
>&q
hN*f:r
g'AZ
EXwd
6,SV
j}D_
[v'S4Hbu(D=Q|MQ3KU4?<R?x'
J1-K#Gq
ZvD^V_*kb6}cJ,9/3P&@9:ib!
XJX*V
#68j
'?&$
B/$N
fq{^
433<
66w+
tHwH
d8_CQ3- lR!*C3fa@s~>w}0i"
/&{HJK`8,m'Q/#_3,(p+*FUB,
$Cd-
OnMouseMove
8 iEal
$ +
f6{;
^.) a
MKI~
=^W^
u*Lf]
@cLI
get_Assembly
GetDelegateForFunctionPointer
QSD,/
}uN[
"([ hY
S2 b{
CA [
I"xN
.K;2%
-CTw%D'171uKQ)Z;asBR2&^[&
Q{rL
Bc4"
NE`Rx3;ozR1*kJ?YS-U($<f2&
mOb+s
8yr^o
F+a
6 <j
'C n
h9i?D
a^#;
~z{q
~72Ay
QP};
xUhS
#K<-=X
@4.PX
8#xw
B>Iu
k\WQ
6%1q
~gnt
NN L
.UP,- }{
{C /
T^O%X|
System.IO
X;Dx
~/DY
WrapNonExceptionThrows
5;5"
c ?'nZ<lSn1x/6_B]]c[@)(g(
KLxH
& Nk
\mj}
$S=8
QOk=R
#c E
|f!V>
Console
NR6[
GI.3I4> M
O^uG
q~"P
MHj|
d _]
hM9f
?u<,W
E C$
xgU8
rpQ;
T6gS e_w
D/w4\c#XK?s$syI+uJL[D^+P$
C4^#
Sg4|z
PT#6
|z<c
XA"7
IObjectHandle
!VXT7
JR"#d
4+o.
,Ye}^s9sm>V1ezL!gI?[5R!l#
q k*
n r+
Izn L h
npjs
fAvcs
mC y
7ViH3
}'y_
sza^
xOT$
Q_ec
1(no
y-Az
M$VQ
3<t%P
UklVH<
IHDR
"hed\A
>VX3
4|]=
NW!P
j&2=
S\E-f
?*81L
&B'=
0 >k
w$v;
;4(l
]K`dTvz
}QL+R
*rFE
s"lx
[ )q9
<)?x>T
F3tr
<hEC
P? NA
?U28@
w+6(
dZ JmvV
X4c>
a/og
Ca!
N{<=1
,KWU~
{gO4
System
EventArgs
`l-a
gIDAThC
hU9*
-i l
[s{47E
_s#%
A{_Ar
*iNQCb
kujc
w4~g&
, `
b'[j
dM3Fj/
U)!E
LQD
/,%"~
f@P
+L5_
:}0o'0-NTKbi+`<H)iX<MsQ/
-RHnAtt%Y#{)fAoDG3l2pSTx!
yzB&
L0Wc
,}UJ
wWnM\
S >9
^)Fv
uBY.
R$k.
OoEG8,
,!2_ER
CreateInstance
_.<Y)j
D*~4
{8N.
]#k8
3hkv
Y:c3Y72rZ>(M_'S4Bm6-P`@&,
d":i
MethodBase
#Strings
wDwX
c=dy"xZ('?0f1/lJ|S{1~w"b#
V$,}
T7Lf
o[>y;5
System.Collections
'XnZO
ZXM(!
zO)=@
OvtsC.
^V&mZGN6OJ41>:4I5oFa!k%$'
4o]`
:{|N^U
vH+r &
0;-jy
K =:l
zU}X
azp\
r.'f
hIK:o
"iK#
+" Ts
U%Cv]'
7.@b
#b {
")VXx
*9uWm
eb<
f)^'
y o
Environment
get_EnabledCalc
2xlX
1"&@
VirtualProtect
p{$c;
t@mr!
B|%
)j0x
2bo}
f\z5F
[ ?\
+FY|(
1 _h
RE5k
AP<y
P\F
Gz7#":
-Vi9#<;
P{z"
O]" 3
yN=H
get_EntryPoint
u9f
F1!EWy
|pL%iU
7W?
{Jzf
xaZq
!6Em
+w-/
HBU\
]45Z
fvRbf
wo) 0'&$ SL&GyhU|N\XZj$8%
Rn{aJ~A
_V-3
8i`9
|v{
"#qQII
pxv?
{*A-
p4>4Y
%w=Z
gn\I
;oGWs?
4TK
HJFGd
n0'}\*
/ L9
4X3Q
\Xn)\
GetType
cQNZ
'M6[@d_|6])^m{YK<Su;Vy=6$
[.8:
H;d5n#r
1P,u :M
add_AssemblyResolve
ti=ND
:g7Odr
IDAThC
7?-SV^&?3F'fWg3*\`j*Z(lZ
*IOV
}\PeO!
q Ga
_M q
j#MbUzX
d&^K
k)W@
m@X [
D{3S~c
@UJ!o
set_OverIndex
rHh0
ynv;
Module
"8^,T$y
^]bCwA{2bV(6VviFKE>S'kGd"
^zc<
# :~
-hiX
M]WO
Fle)
O !V
?! v!8
iEUd
s o
b#xG
J5"<n|9+5_gaDdUNH'l]v26l#
z>A
lu8.
3~JE
|$ cI
`h^]U"
_-zN
Xi9?
myIjj
^Im@
NI@iG
TabControl
P<zM@
Azovj
=H#C
VKB6Fo`Q6@8Y-:wIn4'5jo:P#
:@1s
Xi9@
bKp_t
2 9u
vS.Z
><aH
Ca$m9
NZVM38Bif,f
M/QF
Jt#)
8E3E
ERIPU
&[x"d*F
C>f.
|xcu
<*tXEUJkq!<(N}Xd40Kzg8!A"
Color
^mn)z\
`N^S
L=XI/P&36@wQ&-:<cD$nQ71\-
x31*MQ
+3 "
Intern
hBv?
93CQ
sQyR
5Y2wv
AYNm
vN 1C
qd]WzO"?xvBAgXHz9D\FjB*z$
cw}K
J:*j
~av#CM%_O'#F^ML+DM!};MK'%
v6mv
set_BackColor
-Q).
xZKW
i{_\
M3@YD
ii`xeon]E?xU9gQ7QRM:}tdr!
)(5h
)MmAn3
9[ Z5
n]<%\N50161**mH'ZX)z+N+(%
6D9=
get_UTF8
~XUH
YokG
get_Width
)=ZE
&6jY
].;n
h_9e
S-8cS?k-0V&mf=>fZGb8guvD"
ELhE
f]7*3TJe-7kOB3<}#IGN<4nq,
)X]D
ZX {`
)-H7
ey.wr
T*kN
6D,2LBIx:l5<'I[(f+4 CpXz"
[#2SAA
i$k2k
s;2I#"|,J[b_yr1T9_w]Ttpd#
L )
get_Revision
)kN
6~_~\z
W%7]O
v5a+
<,("BYDnC]
8LfjW
{os~zse$
3K>L
n$+6
[fr6
QfJM
&#oF
mj8m6L
@;Ht
^G*o
RaX
|FHpZ
lTm6
oA^C
NXXE"
!;kA
+9{Y
4Tt=
GUJk
7 U4.
VT89
7,J3_
Y.0"
O}OXh.
5-q]
V1$WZ
aS%_
gI8(! IQz!N
]&g%)
QIK
M|[&zg
@fW&
3rU
N|+o
'(.z
e&aCT
JCYt
FY'M
8cC>
~muI
rlwo
<"Uf!\2j<:Ta'f:lUx:FzEiX#
scw-
]" X
$]8.
;qtv
~s@%
E~{(HQ
myUz
1iPJ
bA"t
su\Y
System.Core
")}Lr"3JPAP*J*h2K8 ;/A&S$
#} ,
_Kcb Y
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
_>(,c-w
|":
(ix-
b6[O
>fg B
_E(=_
]E}7K.V
XK}X$1
,,C$
jCYO'm
Delegate
>j>8
r^/6
skPy]
9s*y
j?9O{
ND!{M0
VMjVPP|,UbE]0FCm0[ciH7)=
Sw
rvVD
`Ce}-
5 |e.6
'$ bk
Uv7(JpM"E2zs9S8F3:q!2#a6+
/y$D
SwdB
F;Yc'
/7uh
q$RI
EL#3
A5kj
PR& j
L0*s
44d&
w %$
M ye
(F94
>Y#R
"%n'`;
W5}?
q {: !
iE #
I%?4
\.J(
ce!5
OvUDg1EreU(iaU#C[`$_>ll!#
Sn 8
'Ht4u
r !0f
TIJq
!`is
CISq
!F~z
Su?[
FC
3_1M9i
gZ~O
,9pR
: `%xA}UJ&#5Yj:)dr*#NGh8/
4VGD
{xNt?
zv7|6+5n
.^Ba1
z 2.~(d>
J JeL
N1 Q
|W0Ti
xzTGT
F[e
9 FLbv?
5NKr
f7dG#
7]%U)
R5W&n
E&fog]L=}V,V"Mi|'aS seHQ"
g5(9
}{x0
m~47>
`]P7
>4@}
PF <_
00bG&fd(PKeOFBr5*K)S3YOd!
# A
VC)5
9iIy
$%c?
yr~:d
2'E<&8|du
`728
~*n?WaVmB}A?=KHr/P,l Xcw#
set_DoubleBuffered
VAz'
P1zTMU0D"R+f;!HG^Fy>c]t('
get_Length
Xh;*Q
z#qe
A/jg$
Y^ \
g+?C
N^n;
s)GPR_v%q&p/^X4>bN5U)f#6"
Zk76xjn
y[Tw
'EiN
7V w8
Z%\a
2;*p
(U$u%
x'iEY}Nvu*H(I2:3{8)B_K!0"
n fj
B*;A
* X{o~]R
D> /
\n.8
"Mnf
JNnf)ih4gV
"vmB
yr3,
|ZY?
XC B
uUAQg
Contains
Yzk]@fobehwfT&wVa@1/sX_"!
ySS%|
3T.+,"
C|B-
_3uj
IEvidenceFactory
@k^S
Qkcj
AXW
Vl{)"5+
c8B4
\ c
d+/-)
ValueType
CTSO
W009 gwp\
GuidAttribute
nR;/
ZjS
WT)<
Doku
{g{sW
eQpf
/N6s
9# L
9B>t
Xz %
Eh~aF
,)#*
,AJoc
vsL>
?~L>By
}Xo!oPcW(C~)~Q)=J^WNi9 Z
-j#q_`?;C,GN,8J=<oVyF jc!
Mh{~
i%ga
zRk
>& 8A
KP4g
4E;s{
get_Count
T @
7OFq
:dnJ
P3A=
7i}-
~x6p
}`"gV
@rrN
5//h
@zG#q
/+1
+6)qV
V<V-
UA*\<@
E,1#
60:Q
|la4
aZIk^<3"|85dE\:`CCQk?\gY%
g X2=52
+d6u
?s:\a
@f,a
!==s
.x om9
YKEooMVD_3GB`J`=fGNCM:m`!
IEquatable`1
GetField
ng<<
lT(|
mzCd%\wyX{U%o<9*\ch0fA?D!
jg 9
wVm!*
;D}xd;^
C=o2
+&Kd
mg+6c
N&#
aYQaQIqN1Mu'e8J`H`mTt<:y&
yP.0
C,y,
kt4i
":s\
`!x(
YF!?{B
,m}'
ynZ\
%$TGk
Y@z9M8l62u"}y5y93<5aZ:sq+
L[Fv|P1-
O_'T}U6
[d&&
3)T\M
;{5QtQ
%UIk#
UInt32
1eBd
zG&R
N5>.
y&UW
EFy0Bj~,Xvq@VfS'F?4[Uh*G"
-~hJc?
~#Eg
get_Version
4q Zi3
Mrk5
}Q/B
Bx;|,
^ |XN
TQW9-n
FwN@J`
CZ->]
'9tyV>
DGy\
ssJ:
9]WX[
Y{uwmNj><S6*KBTie"u<!8P;$
GYXX
(S9~{
B-u2
s Ep
g?(VwCS
??rh
/bOj
Vy\q
km|_
eJukrFc,U`"3~&vQXD+w5@mB
X
"84{
GBxg
/e/]6
oI0e
C= A
1gVX
J34Y
wlCpk
dri//
}:_&
Kl qA9
FajsH4
ServiceBase
!2aq
$Ad4
^ 8
a\?^
}Wj@
*;_CO[
}X")V*D*jL!fg3L"aWt3U/m3"
DS9J
f{]u
a:89
GetTabRect
)'Du
42?|
<DX4
1mf
^[[m@
n).p&wh
eS16
4f>G
R7_x
-kmj
15%=
_/A<
q"q'
2/!e
J`&p
; %
bi#e
k*ft
JPO\``^Zz
]@~}
<+ }r
Kd#K
AssemblyTitleAttribute
Aglb,
; ![Y@Be6gZ}~s?$)(#&|K-,!
4k \
,cM%CsI
$.eX@
5d{61E
LK2c
[2 S;%AZ!
$gCS%_Cf
x-u5
[<m=w$
TH]!
sT/M
&T~O
T]g*
>Xh?P
iRUpy
g>9#
G[p:
\{upE,5~WS-cz=F|LmTax=-H!
/! m
Fzh
E<1I
-|= K
`u{1
gbhy
?-=Y
,Dd:{
bv&{
!7U~
.b4#
T\n*
UxD0
~`%}{
UTIS
8zCx
;r*^c
Crg]L
&u)f
0e8@
Mw[_
'TYxIGirg`T -}_{V-oaTb'$'
*(jz
^Pf
!@h^Q
$~5h
73 y
x`s"
z2>V
3LpD
Q23|/
Z2z_
S66g
>`J{
IG $
l@g1
Data
4PlI+q
z2>:
e0m-'38tx{klBD32#N)"bD5q&
},MJ2"$8]VXp>dTk5zZwm')N&
O=M8
{HJ#
a G#Y
**mwA
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD`
Enabled
B^Dm
\N9l
p?_J
/18'xA
E(K(
a~v0
r!(4`
w$"}
WvfMX3f
*|R>S
0 w
<tId
+I.=
!'{hG
g0lT=?
-i&3F!ey7=DGV)/Z03)i{Km?"
Q&jfe
*iFb
pHYs
.ctor
Bq<<
M"@k+D]DjC_&K4b6?dj^(/kt$
hjrq
@-F|
5xWVwvr
get_SelectedIndex
bXre/\$HZoA7!us>"'{=B4ls#
ayN)DIN
Xo?[
zT?u
get_Message
Container
ro/E
G7M,
0aDL
b!5 j
m/l
^zcV`[9EB62[1f4==9X*Q5d9%
I|~t
*uEJe
[&U
"oKZ
D,@3
g4~)
Main
&|%
afaG?
T"ap
O9)Jx
Invoke
G8z(.n
*GL,&
Ro}yS
g @hg*x
[8Dz~
0sw[K8H
~4P])
2F-'
w[!o
<"dM
sBW+
"4cE
qvC@
tV:/w9
#DNWd&?,g$?8QvVYCGCC_\)5*
uUbz
q8j /
RZ`P>
YRiR
755 (J/trQ
\ci|
p# j
/bNi_qm
2l{-
Vhd]
~Zpl
*.pnq.
$#10P.
(.Z)
T.e.a
(*$xi2g$d} |v&3g]tXpcm*b
z=F@Br
|&`.'
;%6j4HwH
}hH=(
SZ.
:ZqL6
,T!h:
_Z=S
89v:
HrvG
1(@6@P["oCZunk0> ^K*Sj:X"
yNlv
mt^}H
q r{
Array
BFW<B^T
8okT
1z #GJ
JFdgl
R9`--AL
mZ &
{(AR
j!:
.Id
`BQ"
9 >^
@.reloc
r<ds=
3%,>}M
DRa,
4@S
Bg^>E
q!
v0X>
`w}{
3.BR
#r{Sf
Ck!<X
#1qX{
)K,X
O](E
<H"-
A1k:
p Hz},
c ( j
TabSizeMode
6)g
NY@t
Byte
get_Chars
v1e,
X%Kd|
';WZ=
8'OO]0np
X\M
9HVT=
% O{
+c*5~lC``<JRC7wRq [TiaCa#
.R(-
<O#~
V-J8BG7%#^OKflz_a\C)K"R-%
H}~f
_bJb&:
Sx+(
>#4z+4df4<Bt\O3-(PSg=tmf#
hVlfdF;
H1Vyb$vl-g''+2-zc*!T]/)]*
UY] P
V!/L
z<t\
@:;[]b
72=
0&q-
tI\O
ZF5P$
<3b
lo"Q
e6aD1
u^pv
htyxe
*WDH
l=-c
X OV
+rpF
uFJ=
{; D
'uT-a0
{i8J_3;#Iex+TrNHW#Wr`,<I#
TMs5h*R9
L|YM5
>QR6
d4.8
| v
R~+l
z6iu
ogm(
ymqex
/P/0
>./`
n(fZ
r&;J9o)
0 :^
9~u?
?b&R
wyxi
get_Location
".}l
KV5t)*j56Y;'$_Q:<Q,3tBJ)!
A1bh
LsfVku
6*2^
Daq8
@qc"
T?W3#PFma65h=1#GPFKof#0L,
$F{>@
!x{
#[W2
O;%F@M
DpTR
AssemblyTrademarkAttribute
$'k:_S
7;*u^2>:37w|)!jz60Zc`#a|)
)o-y
72/u
'[)<
nR _p,p
@tmHLGa[#@I}5"am@"`Q5:``$
IList
>lR
t<ILee0|Zih>"<{Eq;7s9)|x+
{?(#
)>h'_'
v"9t
j*j($
Bl)M.
&>|S<rT
+~,,|
U_u6;
PrlY!y.
-Z0V
7^ M
$?l(R
}o@3
6.^H$Qb(
6rFT
[F{gIh
{ q+
FreeHGlobal
RaKG1!*ihISS~qk<rqs&^~+]"
26}f<
hT<I/V3<@1^eBCgR,e-8Y9=c&
j"H/
3#K{ Br_
JS k
Zg@
1xP
* fw
m]|[
_ul4
z@dC
9WfhP
RuntimeCompatibilityAttribute
vXS
d5hx
+o a
+R(+
T /\!
%jwL
Assembly
7 |Y1.
y8#
|g:!
R,rn
R#~6
\u%d
+Ju
Y=L:
uy!E
Dlpxd
IJ9ep0
1G '
$bAZ
} qh't
;!@AW
twi4
Xa<h,
S\qj
b|+hN9LH)6h(BkI(A#[(-RF5&
]LE4
Mj-W
5\lTz
I($|
Nsu/
g lC
rKgb7mwwa>{iyex[U*"0bSd=
X8n*
{/f6V
n6iE
J%``
*
d7LHB
j!k:
'8(w
Wm7L
Invalidate
`d5~X
F%"O{=E
I\P_
eu1^
??E/T\
34pK
XoHd\
|)|)
^A&N
B`J]
{}K
V*~c
}r|k
IswQ
d/ T\
(~9,y
[lK
b{`
Size
_jQ)A
IxA<
gjMH&/
& 0P
!s_"
NewGuid
&VtG
o6H-
%pTcxI
OpAT
e9vi5{
set_AutoScaleMode
cx,L
X 5
oaQl
4^%g5
l&hrV
k(<
&> y
q)-|.5
nbO@
+3-c
\{5
/11/
=kUHS>
/,,4MD_a-7>C%vX21`h"#(7#$
S'uz
.qOI
glIS
#Tll
n)ql
ua#t
ubrRz\
*^T6F
B7rG
D'O+
S9P2
IContainer
pQ5,
Z0Ij
* /c
RAk`
K %[
)YZ"
k 80V
6|s M7imqx)`#}Z+(2?8U@!_$
<^\u
-sT/?
\t"_
X8t4-
!FNF
]Q|1l/fp{3)wPanWY-<1PJ3@#
#Nk:
3aKK
pNvm>!'fud5@L5Kp!&_Tcjim*
P<&k+
'n#8
D]z4
&;(1rGxlA!s/dQrJHl@CvhS7'
$3A$
FV5LG
HR|It
+mV/s
KN,k_
o Bi
'}kczZh
?rxjsR%]Rshyi['`e^Q3;IM-
2G07R]Cz%7!I\@^8@<l0zt3$)
0@fj
=K1i}
HC84
yv%&#S>u:a@VQ:|(IBT_;+%!0
[xd]"
XMw}
:-3Tb
V;g7
Z(1
ne\PK<
wIym
AFi)
Dv!2
?ghRvmN}1C)5_ld+E`?hv(a;!
Im g
X}"U
$7mT|5
6/T}@
E+?AF
[4i5oE2hy!? p7a^-//,S@\+(
{7xDF
7 r
vZ1?(
tv6o
<DJ v
X2=%
Lj)xSY
ADL'}
^Yv3
X6~YNS!kz5xv5Tg'6oD|2$TA!
Kmo%
Control
)kWL
get_OverIndex
~dMI
[r(
uHS
tr%+
#`'{mmj";;eMo@|Zhze6)Ys(
X}K
qxTX
McN #
y@ /
FF+Bd
n/Wt
\`H7
}x0O
r%m
[(q4"q`eTm_<mqj"~&A@rE0i#
n$a%
b<G;
>@+v:l|
#;\#{
<p0C
p/Q+
QU>L
;k( ==!
vH]6-O4
&?ejp
TpNvfE
d`XF
UfSdv
nlnS
_9WL
KM2Jb2
QhNb
aXBt?
c&;9
`R_6qr7
1/ >
8A.FE
J#]
_cTK
ContainerControl
kol|
0:mq
4!? j4
zr:'^C
)Ujk
cC/P4A}G9J>9,dv4N*\rX+sD'
'-@V}@
yMMV
(?68
jX(}J
;}(8
D D
y 7"
]24:
67'0L6
v Wj
r9U)
nBGe
;i}T
/\eZ
NyW"
bT5@
ReadByte
2MT;38
U@]X
|)\O/S5hg>5lTe?7(0P7bD W%
;|kX
+7X!4s
pHOn
=8BL
3F1764884A245F1B3FA91DEC2E25339F23787561
B [6
!G:
+'|?^
1qyK
i-q>
\j _
YkD4
rk$]
v6B8a
{ u.
AllocHGlobal
,rtw|#
jgqE
r^+d##v9DoP88b1^Z`nATd3h$
($awO
AssemblyCopyrightAttribute
WXZg
5jm c
x'$#
,~ZZ*
c`X:
nho'v
uX?r
sUr #
[Q%)
n=mj8!q 6LE<kt-d|SR~oJX9
c]`oPj/i5#!BSNDss(;!>-)##
Ju c
@I) d@
Q>_fv
!eu
UA0G
xY-}DvrkX084m7I0)!7C+G'j!
S (9
iNsj6]g
k0?e
isd&R [
(~uZ
3v$pK
&pD*<:
]Xe-
P-?1US
,VGrx
'=V}QB
?=4l
WKmgY
* Yi
$+CF
YOAbj
'hIh
B*W:g-4
jD=)T
&Z6b
a %cx3ck/
dSpn
\J`$
ZVtKu
KB q
C3|'
J *G
Q_as
XL+X&8U;l=(?#FE<j@RDeP$&$
}?ICO0O
wWx?v ,
]Q^iaND`_G{:};!hq2g5r{=@$
=<+z
:G2n
PTVtm
J2;^
)et1^
KlcYh
:"AV
EKB=
4a?"
-'{eo
jun
}-v>q8p
p0xv
3xk}Q
\w!>
ControlEventArgs
^?v^xS
4(\ 5G
+,m73mZh2xyT4fi+m6 GCR|{!
D9*Nq
`'z92-FgJS%gd] DSb7wvD\_+
E,+^
Ys '>
wj=O
`B7b
BSJB
8C{o4^=@Q<^YXu3qe+d'`UDd$
set_Enabled
^ &!9;
qxUc
X)LTa
x V]
/%neU
KK&=
Read
EG$O^
QZ"b
2nM6
vT^L])
CXgI
>Q.?
z5BJ
IConvertible
Z.Sb
gSnA
t FI(9
v b7
R5{k6
U}J)C
Fbvz
get_Value
'}ZN
(}{
Xs#8V?
oKejr[ v1
?k=
+,!
X jA6z0
wifV
u1rZ{T
M#,3
aV !
E^@G
_.NN
w1f$&
sk#=
pSU6
L0B"U'F
FL)u
B-mRRB&WF(&_X5I`MGB=2YHS/
Pa:B$
j4Q<bR
d0e;
,w}'
QKm6
1\o
gtccVh
h9:;@
gAMA
NI}eZ
?M?d$etew 'I{mL7;SbN:@R3!
o? ]
Uz t
TL}}
y4!V
sA|d+
^bv_
eGX4s
Ozfz0
x-o(
AutoScaleMode
6;r?
Z)+K
!MMG
.j["
G&ET
j42@|
}Lci
?@+$cD6CBY6xP'T-'T`ZZ;rh(
i ~O
T }c
cs]|boO
BjJvWl
.cctor
AsyncCallback
y8H|
mscorlib
^}Wbg1$
xi o
T0LK
qg(Ug
LLXMx
ini}
G@c,
%N!|
_)o
#FXeJ
cJ%A
,?=)
): Gw
(Wzo
u\te
nTyI
|{9w
FHTZ
%soj
1f(9^eV
ocWFJN
get_TabPages
Xtop
( x3
,ib
;W;
Oye%S#
Bbq.
8(M3
"zD
Dec{j
`8g
g,;,
<S78
Guid
jXk%
#t.:
&I|b
5r!]
2?
"N\n
_px~
?K*
0]a]
=H$d<-x/;PE,EO'ZJCT0\nB7'
O5Q(#
piVk
kX<4~"
.5HO
jPG6Mi
'lM
N')0
K,bYe
s#E&
System.Reflection
&]]@}
1 h\%
td5*_
q"n#W
bDq 5F
Kq%
RuntimeTypeHandle
_*f6
1`-OC
T"nce%qJ%w"YA5ye-D3G?mi3"
N]R8r/MShk6EJB&0cYl%W+V)
7]x
Y>E)VQg
2018
[h%"
kJ Y
"HR\
n"*J
v 4[/W
vp0B
Ty ^
p9(b
t.a9
:yCYk
$'%V
~%OU
!>?OiC
c(LL
aI5L
q 1x)
||{k3NlVarf>nkO6<X(-3X)'
.y-w
)$,W
=*}
Pw''
lm j
T)$l
^s."m
rGuYl]
Append
6Wo`<}
yZSD
J; "
'ha ,Y]3e
0YzsE
0Y`4
.{ R
System.ServiceProcess
op_Equality
mq|-0
mabf
!]~LV
XgC^y
+A}$
_n-@
saYM
[; E
X9,c*\c+h,(}Ua,aC|M/KO#@/
SRaA
YI@w
`qfB{"qF'
@pxTj)
#d-=
);&ik@
`>>'M
t IG>
Dmv&h]
rk1x
c}K"
1-c?
<L n
WbZUbmI*C!T!J+[d(-%tY |b&
e)<t
g3Nl
^n3V
{'i{
\ug=
Ohy+~
AssemblyDescriptionAttribute
YG6!D
6`*v
0M;A+
t1lha#eCh($ap5tK5g!h@HnB%
YH5=
M_"(_|
~-"p
N&NB
,=g(r
$1 E
!H`e$4:&r40 N*JB_E>=K!A@'
pF!:
*Eu~
Q{(k.
g--x:g
vu g
:@/3ue[)v1'<[,S@WDd/wWuu*
BWsr;RX
N_A?
wFz\Xj+'2N]/?`!L0GSD(;Zi!
Ja7g#8
l'EsI
\q7g
'"|@
wc3t
Frz#v
= Rs
Dx?X
3IW
b {2
?ws5YT
ItG[
RdpT
R kd
~'i6
]$_:
68\@w
qO-ta
hfjA
saK$u
Hr-&
Q`Zq
, =O
0ZnjJ
vzYT
Z#%S
M _2
*pm*Q
. P>
5iy{
Qi ~
T|wHJ
F2 q
ey3d
Mp|Z
NU%E
6}~8
W&#c
.{vQ
956n$
Gk?7
mRj%|P
2r6;J71Z6ojzA1Q_b<Of9 Zk
-3_ns
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
VGtPG
<g?ei
A' wpx:
2WnM
N("e
* 8rh
V_
WSpA
6<e]
u6R"
p $3
LMbd
uY@V
Vd+)
mscoree.dll
!This program cannot be run in DOS mode. $
MA$+
m q(
31'Eb
?8r|,r+?8Sna&X?xD$\3&d29#
callback
CO= < < < < < < < < < < < < < < <
e~Jj`2n3xYgYdb[US*,V}H3=$
5PQ^
d)2KC7>Rh
mrxE>
X~^5
;g#a
cmQZc
OB<u
W5oj+/
>R G
Dispose
B*c$Lv
xa4~
<A!JG
ZqOQ
o.
si{j
u9\
*m`L.i
u|b^
WZqb
a0Uc
+bKt
p&W&(
K}A[6v
4E2BE99140D24066CADC84F74FA899FEE5976B68
f&@;
XPUx
eSDd
My4O9
/sGm
TQBMRL
k1`l
EOhE
Lx"Qa
"^%fESbhm2#o4!F;78d]$%s8'
.U,W
UI7y
!L\uJ
eUX#
;Tk
{*~>
v)K(
n!g
"g)'6
"~MM"
2NCNSX
KPTI
zM;i
5p) qlG
S7T
lsl=
#C({
) 9$*%
PX?L
+ Y 8
"4 #Q
-V/y
:=XL
ilR-
6 {Xe
zIDAThC
#GUID
+sck
T?O>
~|io[
}A6
I |N@
*F9MJ
|@2f&R+
YZ.cc
p:} r
i+-< a%G+K
{CVO*
?^|I0[
sw0`
h5e
;AA
Ao@v
d*
Xu'a%
I<Xm
pu?S@+
Q@`HJ7
!O6 (4
E `}^
9:`V3'
^&c]
F5s3
>HeB
No\]
p<i
; HT
c HSO
?` ;=5#
#(tD
HX|V
>Hez
^fGu
<Q&6
09k^
vSP!z
)^R]
0&gl
,Gd3
7+Yn
OtOB3S
jJtc/
"jOC}
;):@MA8Q9x9Z?9b#I?wwp|ws,
get_ModuleHandle
X)ME6bQxc4+haF_;au#L0QsO!
2c=uOxNT\X)^5&tz2e*P_?^M$
<.S_
::+#
l]tw
]&@r
w{*D
|%p\
Q>>\R
kU 3
Z}mI-
H#9aHwH7
qNn6
<*IZhx:V)2=CVqk6#' DRJA!#
`[@w
IntPtr
gq}t
Rrv!PqvBG?u0MiwdMK$2<V)#$
q<#)
wq0-rBsEGc-T!yAm9PDpV)9*"
Fp"MB9
Na`-
N5N\F
9lYN
Bl'>
A%0s)
(!<lDm-[]Flul*ZoO3KL-{mc
4lHR w
(m0}
)CIa9
V@G:
=7"N^^1"nEsu~"53 jf @o F%
w\3N
1`LO7JD!kb!hA3"=gi{}fBR8%
wtk+QVR,p{'@l`NNJSn/:7`T"
4u;C
H2C@[KEebAJU]Bzw z?n[A=|"
^F(W
_AppDomain
gfkO
w/p/p/p/p/p/p/p/p/p/p/p/p/p/p/p/
bCJjXe
wb<5>
YA1]
-G1%
oRI/
o]"]HOj-&k0a;FndV[jGDG!n
1ZRp
!%76
1M,`ciPP
jS]^U
+-}N
d(`b
xTpl
HtQ}
v<_:
-y&x
$=T
System.Linq
K* .
x7^y
1 j-
}'9L3
Yp.+Vt
:>TW[M+trHt]4pSvA,6RTFE)#
[*Gt
1TZQ
C708234F139063BBE3CBE2208BB6ACFACBC50333
InvalidOperationException
/{E4=
nIDAThC
m00z5
b\$&/
FoQ5
{zNM
$[rD
g>;+o@
Gn4
[g3?
LN<Y\L
z'"$%2Dihs7f=k7n-?y}Gh[&#
8)i1
00k
/d,O
|!wQ
0Bx|
O:!<
*'I9
%x](
\rH 7
io7@
yIDAThC
azM6
?)fZ
M.zC
X)?bH]
nyY
eyBc
w;1!2iD\0L)fD]Fxr{*W/^8m$
uA|[
LZR?jJesVP[#x4z5*1n f3}g)
*{'U3
[;k_
q2#R
)gcld
;bI/~Q81PJ:6(wRz~o9O>kpD"
3']w?
0P [
BlockCopy
e/eP
'qO
kG}O
ou l
i5`dEO
~ A>.
orQM
^~4C
7 Fah
y 5R
0lN<
Vz'k&
~fL\#$-Kgs9Pj6&m1(rV|!_E"
Y!O
t~g4=
G !SjWF
sMQ`
{ bR
f3 H
nO7K
re98
G,C5
=Y!fCPk<-HCuHjrn)#AQyfW;%
~6y<
< < < < < < < < < < < < < < < <
q-H|3
(w_
a{Hw
v<Ugm
vw`
TLm
TBx523
f8<;+14CvM_u%o8{:'Wygg,&#
9o/g
jIDAThC
ypUI
2*Ix
I0f0v2>}5leVu[8yX4*)"6Uz$
w^q*
GE.v
WO&02"
U]4y
gq}OdVPX[V)h(&r9pa<{?08="
Fo z
>I;3
h2Xu
*Z+
4,+\)'W
v)z
~,YND
~;fP&
Z^f&
H~?>o
+y7Gi
j2,x
)q,7
sO=e;K/p64R/8P^(MU(k-7mP#
m s)t)86I\V0V"d(TwyvIu@j
F\" <
@4+L
g-nX
: ]ZV(<1\
H2d
Cr3p
XF^3f1
{S(Y
xS^
v1E7u
!Ek2
y1,@I
L.'.
f\#}
gz(@
qh)I
[{:B
g*7 W
JN\L
U9r*
.;Nr
P/ed9
^AH~Y@
U@jT
MethodInfo
Te-
w+C_
l<`P6m][\N?7v*JFll iWBKN"
cM!C
%&'v
i/So
b}>@
{$3I
rFK"P
CompilationRelaxationsAttribute
x8 Z
6Ptgw
pP c#
X]Vn9`
TabPageCollection
fB3W
IBindableComponent
_moWIIZu7! 5&CX> >SH!+$-E
aU8
<kwC3
yhE"
( /^
MemoryStream
"9`
OsXu
3w{G
ResolveEventArgs
MYO3J
|90W
zU2aj
hVos
36$@h
w@ap
j8}k
j"W.
rj~>
@-0
Dx nq%
U SM
OnControlAdded
STB6
m~t)
aJsAf
JS'g=;Qo_9SoA>[;/'CUHLq3#
MgXal>%^Nzf!UP`jO3EB`q>5&
WcNE
"$Qc@
"/>P
LO_!
@#fh
%[Wa
f9WRBPE5,1>){O3Y*[)sq&,y+
B_0mW
, R9
&M P
*kfi(
EVA<o
A`?
U$&my
&OMZ{
fji5Aa*
Cde;
p#Ux
H'ljT
`{0z
11*@R9i6
lc} )
=SHm`9%N*gF7KXXr=LR;)xB5!
< /Z
p CbHww#
)Eb)C
}Hg
R6&EQ
z $5
{v/)
;T>TWY& 0X} HI&[4)[bp7(W(
<Gf'$Ju
r<9a
iD/C
_k7}~fMT6Dg\={0lB|g!y=&y!
fanu
>%TE&E!
~%#)
GIL=
v4.:
](+Qa5
IEND
9V-
o]1r
[ 1/
DY8 N{
XHw*
oenTC
a2uG?w
<N77q9DM y!K> 6NWG-7O8c|)
yAMZ
pdpDL
=$&S
78B4
D;:H
!$@(
5mL\
3;"V
[I20
;acT_
d;U*
=;|,
n2:x1P
rzo~
/N k
Fi&(
ergr +
Tbg(
S~Tt
ul:N
F>q/
DjYo
P 9j
8H,X
>)OZ
+D?)
) V]
E!JQjA?#JsCzZcC@?d)UMn}!!
i(mq,
f*]dB
iTi<'

Mutation
{47;fP
5U#I'
$39c9369c-8469-4ca1-830c-d7d9c5169b33
d9K:*
Rectangle
va7+3
@ xy
X1 W
get_White
q,hS
!m? %
);(6E
wGbUX8
~QD@r:eOoyQ(JG&n#%h0yH;{!
k^dg
ch#_*7
F`^Nr
Gerk
K G5
kcOE
4P5
a< ~
Concat
Px2:
2$Cy
Y2Eq,HeMn8#@mkM+w4!X!3DO@
StringBuilder
|Q-I
rU!q
|URY
btUR9
3.l|
P0S&y0
55MJg
hP5?
;XK
2G~}
Y/*=*
f.VY R
*gg$
\Zp,
u$-,
0-%zL
TZY*
MLkAH
rY1
pK:1
fAcrU1nr/H ]d{ OhOn t,%5
F}zuB
9pS:
i">a
&2\+
yk|,tiR
E{u@
kV+O
E\G|
get_Hand
i"O
6/B[|a
u&v[
<I`H
I:]t
foVL
L^mK(A
j I+
'P9!*\
w\EZ
Wb:|
A A{B
{R #q
'S$)
G(Z@L
3H9G
H +m
XoG0
jfID
d)kz[
bR, d
T`oY
yq<
!Oi0
{2h%5/dBVE/([3Z1QyI<JlRF'
h+7n1R\)
}P?c
VaDy
Nup9+N
qXQi
X/alu
rB#HpZ~8m >$3Q?U_hGq-'<l+
AssemblyFileVersionAttribute
QO9`
]{Kl
:g0GQ
o #AE
System.Text
`!D1b
A\w5
8us9
6Iw2
d1~)
w2vd
K%*R
b%h?+
COP46
y')N
;}%%
B{:X
+IVM%
_8,d
qK@{
5f129745-b31d-eb.Resources.resources
kAO^?B=hk
t_w5 ?R
a:^
@b[7Bs
tD&|[ lT\A!I>oyoa%;?dHM`#
X +4(+
SrtC
Rxg>l<e
@U.(uQ
KEG_b
1!Q
s#4J
m6!V
M}yY
%M>5
Nopp
GetElementType
r&B9
80eN
-!JVVsO:R7,y1gBw|Cw&)3,%$
vxCw
R*lm]
/*S/FQy
(+
.ph'fp
RU 3
'<~z?
Zw[u
D^Az
U]k%
1;eu
QP])
? > p
2Vfq
X}f LFo3
0|YrE
`l27
gs4A
gyJj
W.my
LB'd
[;m7
KwQ}
BB:*:2:
V8
&H<q
jO#X p
{ENz
CKcU4C/Zf+"r
#M]Z
iGJh|
W-<X
>aQ<
UYnB
c*(t
W3q)
x,6t.
]>J3
pYB'
A.iiKP
-p83
vMu8V
_;r!
%yU(
Yed$
l)G#
|R|B
gj#P
1'!u~
0.|?r
,PH9B
"rm* 5
65yc
?9 6
ZBGU
FieldInfo
Font
j'}pO
L(u
;](Q
oBY6`#
,iE)
HPl\
ModuleHandle
[ 'B
dn<m
7NQ=
0
:]mr9k>7E24A!+xhb}?$fZfY!
I3mt
'|~z
3M^2S9
;`rT
(mED
~DZwNp
Ex|U
ie'.
f H;
0csUt
a.XoQ
String
+8q-
CN;&
QEWr
x./yE
_CorExeMain
eVq%g@u
Ep|7
rv@W
^L7n
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
U_rH
(d/EF
/"H7
I4H69G9[$O]eV"gjs5b/:_{)"
yI/^
NzDx
object
S~PO
x f{
}w7m
?" 2
d._a
7$<7
GL>V
07*I
TF,
*IZy
nOE
H1 \w
%|#~
Bq:Ia
[_J}
InitializeArray
~mheZWs
zvqQad
8o)hq
)?In(
<v=S
~U"}?
/5ho
M0?
:&vy3
V7tm
F2!d
KeyI0
css
'aKtK $V(:u?;P*/`/<BvSQ7!
kT#Q7
.(/'
-=?n-
ToArray
Eh$1
Q`%1m
OnCreateControl
W#t';`/%+<6Qt:?$Jyqy*Ygc(
ARR0
]&g\
"G<A&'~!-D#Fe=bbzh@U;6Lm!
@Lu<y
"etp
p,2^GjI
J Il
$lg(
4+= )>
t~Nj)
{IDAThC
pIxj%d2RZES^}\U6vr&7_'[`!
?vF/
! y4
$Ux_
8*IA1
&{6%
Pd;v
VC%h^j
A #0
abnh
o5xfu
U{0@
PBV
/=7B
'$hU7O:idsVTQ/2Da,Q345V`#
bX$,{AxE{Rp"Z/7&=1[)v1u}+
7z)
get_Hovering
+E!y
5ic:
2<#|4&
=]n@Bp
_yq;@
weM!
O;k|
y6XtGe
h ?S1
@^}z
MOsk
GL1^(G)+GO(Mx-j"kN\V0;xV-
)xES
uyg!zBL/MBreAgF*OL&'KF0*$
wljC
U#?M
rV~x
(e :
uhy\6S
76A
AyPzJ
t?{n
Ta
!*>4
Load
[kK|l
1J[B
iSM>
\$M:d
dJxK
Hy.
y*Q"+
S7[y
k '9
s<e*
System.Drawing
U1^+
pj(l
jsoR/#
Pu@
iZW"
5bu~
get_FullName
=2;}TC>WFj ?w\t,{+&34f0=$
u;;v{4W!fnNOa9x,Hk(z/KjL#
wIDAThC
&It]
>I}i
&Qt?
pKl+
4*o1
BeginInvoke
v$ D+
[-:noyF2NN%eJqWpVUY%\K(Z#
1}#$
K"mt
0Io^
hQ,<k
q@T4
D_E+
.mELXBh`
vvd+
\]}W)oTr]ylC@RdlGEEx6v]k!
n*$#
$x(zQ5N#o\OS1DdOB(Z~{']y%
N{^^
z_Tb
nw48
NU~{
rW-AS
h[1<Cf
,J8v;6
_~0L
<:#{
8V^g#
2>Dy
+&me
4V5A )
O_k$j
5Zo0
v{ap3
rD`f
|K R
ar<SaML
RuntimeHelpers
~Z.
8G~a
U_k
H.6
Hp?B
j!njh
fDNY,
UserControl
o "m
W,ILw
get_Enabled
@F,k
Q*sm
ftkk
z%Q|7"h?LP!<h_|2/NB\::xKJ
\aUv
\f2WZ*UIgP2VTk)OOgSr"bxq"
@U'"v
p#dM
N=jd
x:m
*/:]6P3$gT#Fp6:[JZsVZh)/"
Mn2-
~x |6
!j TQ
v"7&
zu(k
r_3
ChKa
$EWZdEO
V.3A
I S'
2 +
Object
rVr~
Wt:_[
0I<?"m
\7#}d
HBFk.
zw_'a
SV8%\
g$SoT*|ATm'8zU&GdZrQ-1Tt,
5PUs
Nza+G
L=Lo
vW}9J<
J'6_
ComVisibleAttribute
;5=!
Y2fZ*p;B WXR-xD/3?CA}?!0#
t(H@73$i"[MI=f++f<e#3&*_0
{V`w
]p%F*
{VOd
ZB=e@
lY!%3
pf6l
"$R2
laqz
poON
a8Aj
qc=|G>N/|/~$cN"^(%_$hzNe$
q4Y
Ii`E
<\o>^
Hi%
_%785,J5+LA !#1=6]e[M*tO)
Xh!.
/k<k
KPqF#x9
\U;|M
a4:H
anSn
zXU\V
V(&Mp
SIeb)7Ot;+#II#'F>Hv~\JtY&
*bx|
V'O$t
27N}
{-K +
>;"D4,!;)>V$XB?->|72\# H'
e,h
,'0(PhbaK$jJVF@[OK{+^Lv-"
=68]
'2KGc`}
E Y,
g!I-AaF/$E&Uo0ttcoM=fLGP$
k.%1
PE&
AssemblyConfigurationAttribute
q6K;
flNl
G_#wt
i {l
tyb4
`6qE
~g@X
em$x
lf'(
K}2i
}/U3
cO3$
OMQ~>H
?fwQJ
OnMouseLeave
nPco
1 Qi,d
1.0.0.0
;iAk
8+C/
[M@(iRI
y2X!}b
^d 6
8{ f
&KQs.n
G[
9U`B
-h@$E
% RI
S da
WI=w#
S38qs|
[ 8
jUe_
]R C:E
+`mBI
Z4~?s
o<zi.
(Nw':O^l]-B@Yg=q'':gagwh#
O z~
fH)r
Stream
B4OVD&MH7jZYHH/sB)J(AGa%&
'Ot!
1AL
A<r=^
,A~j
T%$H{
vYq;'
sRGB
X( |d;:_
+{,+
xIDAThC
;=ISm brkr[DpK%We#x5H;kY#
5^WG
oN7~5
=;j ZH!tJlC#bKSVE+RzSE=k$
3:w
mYU)
&KX\
+i`up
j y3o
?0b{
rug(0b
q"*&
qDB[
CreateInstanceAndUnwrap
hp%<
M6&~
TfD[0z#:bwxw~Ti`=%<tv<d{
jXpW
V&2
@KPb#L
|5Am
GwI'e
Lo`X
#4rK
VvzW
6S>a
UGKP
"t2`@/
r.NP
wE#V)
P'@c
i,SO>
O9O U)y
get_Control
:\tYH
5D&sH'\-v?'*^icR$Glb>&=)'
RY 2V@
Confuser.Runtime
v-D/*=G
P:@a
R/hQ=
Di(Bf
l~Li9x
Y0qu U!B]oc+$*`,rE@7iOM5#
#N;
]a4/`E
`yq\
* Y*)"O70
|.IY
5 9>gc
>}n>"
oc^u
M$\Ap
.)2E
PC:<
hqZT
t1??j^
Qb< !tH
d&gw
_U*K
$`TCr=
Dx%\|Q
Eop(P
(.x5
Gt6hE7Cx
sY+f
@3{hf
\n)z
set_ServiceName
VUsH
YnS
%@K&
s#iP{
8DE
&#YI
Sv '1
!3(6
BB }K
[e*olY
}ye
(D;
I Ul
EgeV
OJ]t
^0+ E6
;309
Z FR
"JPh
$,0F
xFqDs| qo[W/q}*+C95KcV7H"
$k*[y3
_Gb A
xXMT
#_}%`>oh1>@\P]*\Pttj^#\7"
3O 4.
jS9
JZ0,S
4N2krsLeDiKvdSp{tv){7R>q
|c<jf
CeD }q
W6x$9
kjA
C^Rs
woNJ2?y=
^VRn
5%t
&Ad3:
"aV=G
RpXSU
oDhc^)7eh2EEW7ys9lE0piPG&
*iqa
<+ib
.P 3
._7J'
3gh1
' 970
J l
6d8M
'\s}%
k)X
9([?f
j=#\
WUAhkcS
n!w(
#Cifz
|@kt$!I
5IW#
$)K\esEr
wMv5
"Uhys<
K. v
8IUF
F;Yq&1kQ}OY;E<<%bSH5, Et#
Svt+
#|E;
hmnNp
set_ItemSize
+vFG
;[-S
+B#?;
$&F}*
bQ<
,RO3^x&:"(zTr%ihlG|y#]}`
M(TMX_b0OY}bm\_4P@J>5Xe:#
1a?_\
8o^\
F$|\m
96^%i-'6Qk+;vBtz17*x#P[{$
C31<(:j85n;>~F1T(dXnv;;C%
oOjl=
hn!
Wft7'
=G^(h
)o+E
b C(R
c/^'
u19W
<Z_p
j_hk
&}*<
cFv9.v
p;KN
4zZ+
[=$fO
l.1s
b|gd
9k xW
CCy,
Q1q?
` %J
GetHINSTANCE
KjWE
D,CCC[4jh&mJf< bF>cBRjVA
Fv}P
Buffer
R?);
C7>"
e=6o
pPpx
0@yr
WK %~B$
GlxY
mZ6T
rFq
#w>=k`~g
!!"Fp
k*#<TKle
zX Z&
pR ob
>N V
]nkM
}ic[
E0@?
jT_7
2v4i
(Cej
f*5f
9A{
N ~h
u#Z3
:hpYB
=0sS
>KTp
c c|
.+ym
P.R6'
p0Ko
!b,"
N(tPxKfVh`fE~)Gd[Mr6SX>0(
oQq_0)vS,m\&Un375[&%I%RD+
Ytbq
FY I
[zkom)
2 (su>6
l{tZ:
Q WD
/&^Ve
QP@<
Io$h
mU9_
$0k
`.rsrc
A"yq3
{9AB
?vr>
\=sKlk-Ky&c nT#l7`KJdvlU
o`g=
4)csW"%B0,(>/L7~4@,H@8]&-
)oA#`
2jBI
O% 1
_ ;QnP
2|qsOgy2(~>fnArq)/@=Y=!l"
cS A
~)@+"
"YS+l
P<v4n"e
>8f2
>#?z$Z
Sn)v
MjG_
/-suE=g
#8T
` Bp
c1q+vH!
I-cG
Do6X
!DZ
=5Hk
Copyright
tKL
7G$ow
ArgumentNullException
E>tC~@mv
3-P:'a
M9vQ
get_Major
fN]W sN\c&VS2Bc94^y<VXCE'
q mu
+ yJ
k`K&
[( `|5
i*#i
XX+a)9
#c>[
p: NA|
qnHRk
I7[<
FgT{-
Point
MsL8r
,J(+
{;MQ
'T*r,
ugeo4r
;1kejKm
3h)@}
D_6z
uu%a
DP-E9
?b,$
J0i'P/|
v2.0.50727
pe=*
W^mp
& Ur
o\Vdf
|%f8
]=9pkB)
)KvX~
<pe9%(
%KE\
R;v=
.+ef
;BV w)r#h?>
Suj!
+;y?9} txltF[$~}Mp*h*Xyl
6f
7QK'0
;Mg[7
<^V)
l0#$W
Tw'N
+0gA
EM3-
FL0!
VGjqAtu
get_Default
v\OMS
@u{L)K6wB:aK5LRy(,%=X<>O+
_}DJ
I!_;
B,cJK,V_CPNLA;c=9fPp1)l $
hD(!
hU>G
;9j9
8AR^t7W:8,w^&Qfs:Vn&lb7S!
{ yS(1
R6|5u
l"
MarshalByRefObject
!$a"
l7"N
'w$I4
Hb6,
Exception
AWi8
zH]RP
IZ0/.
; $,
<a9CK#
!p?b8[/aA@)e&;;XL+N9gH '"
=J?
0`l:X7Y9V\+mo31I" 8<o(0g'
Z8WI
u s_`
uapL
2>p|
"n.O^
hsk) db
WEx3
;w'72,s
82Uv
Im!BA
29{o
Q+X.
B{ }n
Boxc
Xje|
\9w`
cV@h
GetTypeFromHandle
IAsyncResult
XFF?VPm^!3TYS%tx$;AcO]^_%
8HR(
t.Lu
{3'F
^\lz@{
Og^z
rnc%
Z\4IaRM*hz?|NH)A_?9c3XsN"
pRSbz'2T2+i(GS@=";BJZ5eP)
c>N
K BZ
*AK+
System.Runtime.Remoting
1lhE,!XP:"{,01TM:=UTk/Nk*
vEQg_
7ch
FOn!
uA95
l K=4
K+%o
p@FIX
b|?J
-i/5
QLB&
bFTx
^puJx&y=hb|N(]$(Y?ewu7JL$
CRN;
U<ca
<DZ\
JBu
?2hy
[-*1
sI{
.qg}K
wx'a
[=}Y
Dl%<
i86
tJd)m
:/&cs@X9=oDS-J}Oj4A/{VI`"
O 0~
'{D3
bUP!
'XY!
5~26
T4a+
Pgi'=
D{k1n&k
EXe\v
W)WI
dz^Z
~HC>1
OIFw
<6x46
{]($u
#{#j
@ypY
;][oE
{YGb
3`?&
N y@
IZI!
Q$Tm,P5
ByQf
_D m
['yy
QORpm
Z<2I%?"_YpD[#IHA{+'S{DAh$
O`1
G_(0nWo
C Ld
p{>m
(:~V
v"`hLVsn
xV("F
8`Bo#
p~R
XK(.
S5I
P$zqjYhoR+^]Ci=-d?1HK:K!#
System.Runtime.InteropServices
R%>^
2Mc1TP
s7@V
Y:oc
WqV/,n
AyQo
VkeI
_SsX(,
$U+5v#b
Math
pH8K
-} G<E
"><:
Z^YW'
8S PH
q/ [
Md '
(.]i
FsOs
1^fs
w }c
/TbI=(4s"Tjmt<<|,#y~ai?|$
DA#py$v
pb6w:
C@!u
{XdUa
y?\SH0b02lAw3xq6}I?3w1R_"
kFwo!
< <h
zCR;
`35#
zLPc
1;D6
@pV}c(Z{&9TAAc%Z;Tg G_o\$
;[!x-3}~wFzAKf=r2>C/H41b,
System.Runtime.CompilerServices
) b0a
#1u<
9- j
tEOP
h}`
SuppressIldasmAttribute
l_p<

?d0
dq3H
_qg
Y?5D
t}l
hRSf
B3vC
$"A/
&Y Q~N
+fWN
m2$z6
tBm|x
E6|y
{gP
DZ,q
[b*a
b}8R=
.9u#!<
?$7x`
Vh$'v
,3{tY!g
I=[8
1HpnyRHzR-?uA_hQ/E*P0:YQ&
lJ1lI<&jEsnV5*d^1D`|<|qQ!
F8;n>
< yq2JW
ks1d
kT+/
0z6b
5:O~
qaX
2ES[I
7:`Q
3!6L$
pFGo
Y|=P8
K^ >
0(#
kjB$r
smf5!
+WkOc
quxpO$z
.uZ;
:K{sL
set_Font
L3K>z
)"ps
CZ4$
$NXv
Xpa`
kEu%
oUAT
}#y+i
CAvA
?0~B
~IDAThC
c7CZ
Oi<q
3imi
$?4EWGcf1RrI?IJ_Vp#dl]{I#
KIKX
%$ C
IDisposable
P Ny&
jt:7
:'Va|j
U)#EY%M
?i<e3{
Ve E
Wi/i
s\Q2YiZO9_YqIa3N} M#YZN'"
~BLm.
\Ci~
|[_D
il<k,
t*C/HTX8_WB{)9e+xF7ByNGQ!
0=#)
yP(q
t.fT6
8t,,
LDUZ
6 /\JbE9*
gP0"0w
PWes
gBL|<
HuN<k8}{,N78Elp?E5Fs:a6S'
!7 \
M3)Yx
m}*X
eT{
$&=i
UoI'{
M&b:
SU6J>
\fia>
>$oy
AssemblyProductAttribute
q2,M
|?WA
wO!1
gsle5
lpr&n
kWNP)
?y<%
eSvq
\Jhf
N[
~[=Dv7pWy!0@/#>^a88Y+6}[$
<Module>
9IWl
U@sd
mYEg
:>"f@
y=CR
u4 <
fu,Sn
%s /Z
e $h
5o ]
P8P:C2&t}>MSc{5dE xRnw=($
MulticastDelegate
eQ@br
}KtQ
:uaB
$QLo7MW9N0uFDpNDcE$YGR68#
Q.*)G
dkEnv
jD+a=N>ZaX;<*dpJlq(//794%
:YJ2
?"@d?%YIj?EE|#LE*WEeM$r$+
zq,2
^ VM
!m_pData
an-In,!}}g9P&XUq!zXl8"i@!
&$k
wP~
xtkN0
value
L^HD
3W^jT
s2c+W
V@m4m
h0>+
z/@
!( 0
vk,4v
h/ m3u
v Cu-
fNO(.n
(=-gO
a"Qx
t*)e$
+m-/
gV"t
_N~(
/"79
mk*Z
OnMouseUp
pO$v
u>!e`E
1h=y
oCqiw
W)bm
p]o
|2 v
FL1!
BhCwHd
a*xu
(03D1GDa!*yFjd$whumlaOSF!
4(,
:pg^
!HN4
`iON
%=)
qrE
hO1HN
e{k
uCCvb
6^FlT
d>9T/
B[Io^
"7s-ww
Y/a
zwuc
+X_3
<mC;+\
l^=P
F39D
%G25[JF
H_sJBh
set_SizeMode
EeKI
4[,;
l64/}!
Zrzmi
\iobPh
v`m_
68.y
iked
<8,k4M%K5:(9|=52"Ma<2sF&0
YRDM@
nJ*=j
o'/?p
{7V
f^+u
h0FD]z`
#}V}amf^\8|sBM!Ae$WE/XUR
;K
+~0f
:X*H+ Va]yz)FT>9fLO"A ok'
get<
7OCp7^
ToString
NC2eD
gil%`
J.z U
AhQ|
\&le_5
h~M>8 m_
aGb!
-K;D^
El;c
X +U
5Q_j5
Nullable`1
@c @
dlR,
B6Mz
@Fx'.
_&fbqk
Q;m2
32MK
v,h.
$.Op
P0s+
x<4`
9b2Y9f
C)2L
p3?9
get_HasValue
.aS3
F)+;r~n
470S
XV1#
-l]B#SKN::gw
Vb=_
^%Tp
\~;' Fl.
`?7O:@Tp9%O+@}G!$rvy"[Vm$
Sa@z9
._G0
L jL
,7iD
U9(N
98q9
05[5
Encoding
CQMc
Q14{
8UbQ
1f(&+
IHd?
!l*<
T=zA
)3pL
jS(;
QbMs+
IWe<
OXHd
dy3
An;1
L/i?o1-Qy lX6df==[{&ns4i#
IEnumerable`1
-f d
b`zz
FVv+
vtu
pe>m
PPq|
X)OL
Qv F
xxZ4
$2ckJ
ZTSBI%rqc& ?2m~;7h[~|](!
get_Module
S*f
<!1}
TabAlignment
M#]"
Bz]t[Ts
Zz||
,19)!y
]bQ3
m-V]
,UVL
>% n
;vn^bv
2}_q
v1o*
?+0,
[ )
Jio5
^IrR,
Bn.7
)N?V
PmS{
V s!
xx7g
-d&^
;dY&Ny2
"YJB
^\;D
!PJ}
C}?,
8dbR
Cursors
Ar#S
4Sgc
P9c%
]I q
W!f{d
Ge[(
get_Size
>dn
7F/+:
X4/@
sOE
{q-
FVZ]
'F^$
W3#Z
tKJw
LbW8
Oo6MRE:
e)&<
9:s!
E}sM
v+AnP
p'?#
9vkE!:
f?H"
9=U4{
1A7)
V>i.
Uw9O
System.ComponentModel
Ark.exe
'Qn4
wd7E1#e gBQT$$E]z*@MZ*o5-
k&<0?@#4Nn[_Sauk@'62KQV !
-sQZ
12NOg
>B7%
V6,j
436534A617CD86B8557AEAA31D433ECFF38B112F
N? W
OiMBPgU/tB\sVZ#pm28}_}# !
R+B}
Z[i-@
?rAS?YGd
_=&u?S
Bk~c
g=^5>
g;:Mb
AgG(-
Elo '#
q8w
J%C8Y
.vB
j6F
DisplayNameAttribute
K6Y
7c:B
{h,o
WRJ~ntK
dd21
1S~%
|3&
KB2x
C648C0E55DD0A71600A3C979FEC05C180303B2F7
ew$#.
a>qPbf!03P!k^n]A;WK"/[AT#
>"Iu
^9VT)/
b gtS
>;>
{ /K
&{cg
5J:G
>48>7tK
C*`Q
-.[+
GRA(
z~}cvb\;p[qM$|&{B5hyVEAx"
System.Collections.Generic
1^.H
jSod
1+5v0^T0
kw}#
j)Jv
j^ `
u!*E
RJ*
sender
?m}E
.`*)
@o}|
Oa n
x JIS(O
|IDAThC
+y|~KI
B mT
System.Windows.Forms
set_Cursor
o+7s
/R-Z"
z'>P
& "
CJSw
i>'}
b^F
'eL-
>KqWD yN
4 -z$
-2hG b5iiQPlY1*7'>t%),s['
sV^wcol
g*8g
iZN \r
gS t}
f?Urc+f;&@7&%56U4?(a*u[;%
WriteLine
AEI
%qfh
Y&V!
System.Drawing.Bitmap
K}F:|
QVx!
Pt*M\E !56'#|)",ClCN7@-~C
]}$)
YZ]*
:S<6Uesmeg#[/%^~f0kQ#RXs
GGdMDkp%
IDAThCc``
1?}C
SetStyle
xzD{p
} 3
E`Y&
W.k&v!/
s;1z
pPH`
disposing
Fkg
5?T}P
Pxtb
.<tH
vks,
z92F
mCZ43
T ]?
qX6-&
Y>:XN[
-9L\
7+ `a
##A|
o=Z{
7(p:U
%`e}I
ZXJX*
\"p#
QpbD[ h]DK0*VY6<wcLR:^Q5#
xQgM
5{fu
\1e*
0~wcJ
\j;H3E
< mA
P"/u]50
iO VF
Qr iv
bKfUTvI~D:THRp_Q'dLG'`3p#
d`J[I*Lu
Yj94
9PMO
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-02-15 11:41:03 2018-02-15 11:43:54 171

9 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-02-15 11:41:03 2018-02-15 11:43:54 171

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\coded.exe.config
C:\Users\Seven01\AppData\Local\Temp\coded.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\coded.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\coded.config
C:\Users\Seven01\AppData\Local\Temp\coded.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Users\Seven01\AppData\Local\Temp\582f8a91-5193-4adf-8a4a-55beb0a22f68.dll
C:\Users\Seven01\AppData\Local\Temp\582f8a91-5193-4adf-8a4a-55beb0a22f68\582f8a91-5193-4adf-8a4a-55beb0a22f68.dll
C:\Users\Seven01\AppData\Local\Temp\582f8a91-5193-4adf-8a4a-55beb0a22f68.exe
C:\Users\Seven01\AppData\Local\Temp\582f8a91-5193-4adf-8a4a-55beb0a22f68\582f8a91-5193-4adf-8a4a-55beb0a22f68.exe
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\coded.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2460.1272578
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2460.1272578
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2460.1272609
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\9578d007-3bc9-4ab4-a7c5-cc5129d70fc9.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\9578d007-3bc9-4ab4-a7c5-cc5129d70fc9\9578d007-3bc9-4ab4-a7c5-cc5129d70fc9.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\9578d007-3bc9-4ab4-a7c5-cc5129d70fc9.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\9578d007-3bc9-4ab4-a7c5-cc5129d70fc9\9578d007-3bc9-4ab4-a7c5-cc5129d70fc9.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2664.1276703
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2664.1276703
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2664.1276703

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\coded.exe.config
C:\Users\Seven01\AppData\Local\Temp\coded.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\coded.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2460.1272578
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2460.1272578
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2460.1272609
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2664.1276703
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2664.1276703
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2664.1276703

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\coded.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3035fc5a\375c7a1a
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|coded.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|coded.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|coded.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\3850e7bd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\1b71387b
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.VirtualProtect
kernel32.dll.GlobalMemoryStatusEx
ole32.dll.CoCreateGuid
kernel32.dll.GetStdHandle
kernel32.dll.CloseHandle
kernel32.dll.DeleteFileW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.SwitchToThread
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
gdiplus.dll.GdipDisposeImage
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe"

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-02-15 11:42:05

Detected family: #Malicious

TheSystem Itself @ 2018-02-15 12:00:02