MalScore
100/100
MalFamily
Nanocore

RATNIK.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 55/65 Related 2135
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 202.50 KB (207360 bytes)
Compile time: 2015-02-22 01:49:37
MD5: 62cf1a3a043f586bf2adb4423cbda42e
SHA1: 0975176e65c8960b6e2fd32a926cf308c68bbaf7
SHA256: 1d0e4ee23d9e5c59b8204b118371cf85b2334f5d10403b06a6fe292ace6c89b3
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .reloc .rsrc
Directories 3 import resource relocation
First submission: 2018-03-28 00:09:03
Last submission: 2018-03-28 00:09:03
Filename detected: - RATNIK.exe (1)
URL file hosting
hXXp://cyxap12.000webhostapp.com/RATNIK.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2017-08-04 18:44:28 [55/65] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x1c798 116736 ab2b2b08a9ccd1c4bc70c012f93d792a ec611f21a33d9a503450bf2757cada53fcbec342
.reloc 0x20000 0xc 512 fa81a8e21b7ba0db59d9a42aa7a5e570 73c936b34cc7723ee95c73f137c13c4ffafdce53
.rsrc 0x22000 0x15de0 89600 4fc8a675ea1d4a2aaba64f113fac8e85 738883cf15fb7c0b4e5f84dc6f1afffcd0bca0b8
PE Resources
Name Offset Size Language Sublanguage Data
RT_RCDATA 0x22058 89480 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
No Meta found in this file
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
KERNEL32.dll
ntdll.dll
psapi.dll
mscoree.dll
DNSAPI.dll
ADVAPI32.dll
IP Found
No IP detected
URL(s)
No URL found
]"Q+a-Y6I
$#%#&#'&98:8;8<8=8>8?8@8A8B8C8
#=qWaMf_MISHPEu34of2Bm5$ay6Z6PuaGN7w1jlKYjzwdE=
aR K
#=qzRf5_jFnPo03SqY9Fq$uTg==
OdMCv4N
#=qEVnoj7wKonGmgnYpK7PNGg==
DateTime
?C\&
#OZlW
MX(u
N?$y
KyCXyjI
Kto;9
FindResourceEx
Int32
&tS$
s] q
ValidateBlock
#=qHiBdWLOLLVg67b8lN8FRqgmYNWZfcDieu2MH9_zIY6Q=
#=qtDC6IoLr5pnMo1d9qdAc2TBOnWqOdlEZHf8Itbl8cJc=
GetBytes
LH$T
#=qPNzwB3EyeKwH$TwKjEdAjAC6A3IlGhANCdkUFCgvEiw=
Wc.{)k:6
W21
\dU}
#=qo734_kbse$6lTIlwlz6A8A==
#=qYuHUjnyRYHZqCkKAt0jj_9qFBzmTZKte4i1ou04eBWY=
@9$]
$g-]
z=V.
KWdW
#=qjcSlrUNMLgvZWN$58FXdrl22$0OjCpoqksNsslRtIFE=
SocketError
ResolveEventHandler
NtSetInformationProcess
get_Height
#=qQbsDS5g6rYgVt4AUW_pPJ8MQlCJBs7uyF9EY8OKREmQ=
Lk z
3Fds
y 1*
#=q5MtzoDWNtlkksfPTHs5qXlK2k7ZehKenYzDJQrgdOII=
#=qM4zv780c6Jc3GVu15xhaulIEjuiWD$RKEtosugOXKLA=
"7xM
S!~ /
#=qs1aB65G6$bPi1$cdOrXkCA==
mO&@/5
}VvOG
#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=
WRy
#=qixBu4j6Hm11f3$mLrzkCcE4AVWtWeNn5nQguwdGbWGg=
v+5
#=qqj4vWwKBJgvjF_JTc8V9cQ==
ce|5u
#=q0uUZuMiILVbPeB$t7lx1a0Is1IW4CfkB9ovgW99kERQ=
#=qyNgKOA3iTYvKx8QtBmkDXA==
X#l+ZC~
Version
#=qbbSw65PC$nto6DJiWxTawg==
#=qjVLlQtRAzKVOtyLrw5PhiGVVmXqMJJOsTT5DxaenWCY=
]vDg
sjf"
{Y*O2
3#6|C
fn'C
IEQ:
#=quO7UmvJ4RBuIIChSn0jx_M$HL4rBuRuRZnNBEMlpsJw=
#=qyM$eq2QFDjIwNzxtrtw3WE5gHFsUOsREqnRunYWzTvs=
I9i@
ReadAllBytes
DebuggerStepThroughAttribute
' tn^
Fa?
#=q4kUEXPi93MnvgzV6ySNPRQ==
PB kDK
#=qvX$J24rI0eJ0gWfA6CEdzVJN7bQN_YTuS98N0yyMYPo=
#=qYpD2x2QTNARNJcnXxG0OjQ==
W[!>!,
HOPH
PtrToStructure
\9Peq
KYkHCP
4TPe
#=qA4f0kKyGXTRnU4z03oji_RIPyVnvoC_BRjpESDLHXqY=
Marshal
#=qw1t7iX7Q4P$CBQxdhg13BQ==
Fv?d3
#=qTAs57ZkYafcLC2FZLCGAiQ==
}}&j8}4
#=qUDQctXsgw3eGxqcYAxP8MQ==
#=qCKX0qzAtjLAL9KBPrJWkOA==
fG~
D%ki"
J$
#=q48p8EJcbwRuSJ9efJfzTZ7uyOBVlFQpnFVv30w93EJA=
#=qZRkZQGrnZUWoFBVE_TP$5Q==
FE`k
ProcessStartInfo
r;k
/*wIFtxBi
#=qm5VvJvLZD$UcnjvypC5XcA==
+da`
aN|e
*du|s
Sc#U
(Y
;h+Kp
4-,Es
XaX
XaX
#=qP42Tluk0y5t5VrN_nwVhnaX9baaRq2NaLaW6RMHNX_k=
ControlFlags
xn ->
OpenProcess
=N'{5
ca X
#=qw42CdKVHw2dycv8VU7DItg==
n;2
#=qFgBBonKcV6U3Je0BKZZdAZdyEla0MkDel5SRrEzLUvs=
EndInvoke
- (/
@y%\
IClientApp
#=qRpw30Lh0nfhDryqjhyjikg==
#=qABNlGFDc7nOg_C39swAcLA==
#=qQ_BBkbckkXGbXV1nE4Sw4w==
Klo#
ucbU'
<)gp
#=q8McCIarwH$XScVz0xkTmJw==
3w:K
#=qjIje6jGWLd2EOkfZXKqBbg==
EnableVisualStyles
EndOfStreamException
I FZ
#=qKwlvi80KuDBelBsvucNuhRsqXRtqCfWqVH1dUPmd6_o=
#=qc46h_4WA5z0UkWODs1nwXg==
-*&{c
x~M/~
#=qIKJSaaKraxRzi3AD57FKg9MQkSdmOqUcHNxKjSZFGkg=
#=q74AbaKJhduohKQ4YDrC28g==
Increment
IClientNetwork
hHc$
&XU:
3:NRr
#=qiGEsYAsOSz$jy0hyBv5MGPdLIlePpwWMgCE_Abe_mLY=
#=qGqLDylJy8NmMEbMDJmKtoQ==
#=qyGoc_ssbL9RdagmvuBld1Q==
->&~
Q2d1)
#=qtRuLPG6CownVXpQS2Jma6EmxR$R$u15FKPRjOSzCUIw=
&*&+
#=qDJ4yS7fCDfIiEVFkwyEE6G3$$73HwRgy2_eKZUkxaSo=
Format
#=qalo3zYdlWWh$dYSx9JnNrw==
Yl<t
w={]$
}h9G*
$Jjc
#=qqnp3i0xG3gb2LwEmwQLB8NQerATuB2G0aH1k$$26lgk=
G^lP
#=qYGqPwTlQx5HSyCMpKnJtwO$bA4uyJcKD$pA6WpBamRM=
dWR[&
#=qKraENZVscKMtH4GMIJjzqA==
#=qUbRtqAPcSxRMI51YgNXGZ9omJvV5BvuqBNocgi7xl6Q=
E]*(
E<mJE
GetDetails
lcG
0m 4
aD!<M
#=qqCUKpKbVq45Cc9OUN5wTXw==
V !*
->&(
AppDomain
#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=
s%dEUK
w0_*'c
afeffefeeffe
GetUnderlyingType
wJ-;
f C'9
ThreadExceptionEventArgs
#=qyI9vgsKRXHDyyks4VCAjzA==
get_Assembly
#=qth3CIdKay4zIa5SBJzx7eA==
z*SQ
9Jr0
#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=
42GY
#=qV4bSY95FY8CPz8U7EzzkRg==
PJil
OpenSubKey
tfwL
KKzI
!#h6
#=qsR25pLrAgwps$DwdB_BuUbMipiUFFEDkypROuvRRPj4=
#=qj8dHXOkfX1HmIFktLFgFBNrpDhCGGJk0RPJopDOaBy0=
#=qcDfNIFv7M2KbeeK2ufHf3w==
AV;
TextWriter
set_LingerState
#=qCN8q7dxuBuds3rgIjZ1oLA==
#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=
#=qG8K0lOrmHWfP2KExoNv$5w==
)4cU'
AssemblyTrademarkAttribute
#=qcfHq18AlWjOy12tBCM8Tbw==
SecurityIdentifier
Y)U
RebuildHostCache
#=qXzNbY0aXEU2Rr2_Jbe87og==
#=q$6Q_u19FhL$wNOun9AB$CQ==
L<?fc
P1 \*
#=qedcCJsW_6aMZb5lO3tR01A==
#=qM040QWzx1oySCgUyYWc9zA==
-7Ot
Path
lNNO
cJgP
I.)*b
#=qr9m9EjuYAP$2E3p2xadfFhcTH6toAhrm0dlfOTldiWRsdXd8UmnkRkYrV_8$1gaA
ReceiveAsync
tJ d
Q%=w:
#=qHtuZg55b91a614FmHMsOMQ==
xQo\
J/q@
#=qI2pAr92bRdzddapVaPVhbQ==
Zc/3
#=qrSKFiRrFo6$kUL7kjfG3zg==
#=qJ8bMKCzzllPDbJIfPSoGMA==
wzp.
#Blob
Control
#=qgAKbtXqj_idozuy66wPGJA==
#=qTEC8gcgkt672qW159Oe_Iw==
$7nhu
8<Q62BA
z5\
MvT%q
(tev
#=qCeF2tfSXulrE0bbyPxU$1ik7Jf3avSO4FKBmKNH9QLg=
e;y>
#=qbYAYBaHwcEbf1CaxjAi1bw==
HKN0M
nG[H
#=q$Rh_ulnlhN$9Zn9n4fKAsvWT9cisaHT_PgvcGANnd6o=
ToUInt32
O SW
#=qVVQJ$z9bl7kHgfvJohZnMPofzhiFJ4f4yMGK7Tpp6xg=
?zm)
i.{lz
O6 ux
9qI|
ReadSingle
dwM#i4f
#=qDB62T9X0iP_6WNTXOuwQnA==
#=qp4XZ9Ss3K04S36I$7WhtwQ==
#=q6jLYuOOmC$a9_UySsUlsFA==
7yLV
Type
u6}v
L_P
, &oh
M}Emzz
>Sml(
k_<^
#=qphSRC1xHjYarc$NSFAVMID1iP8dwbr6BCaxyrkptDP0=
BaseCommand
H!\9
SrW*j
#=qsYpthruwyrknxFdWaNp9Vw==
#=q$XurN5kwCvUuDGDncP4myluEGVmoB5AfvTb_Ct0PT5c=
#=qraB64nHTnRXCE4d7ffs5aGExarxpEh0COAPaEFI5iV8=
#=q9RHjNFjnLkbqjNKidtUNeAGLmByWXgbKwjLfhcq9NOc=
#=qtWaDSiZ3KDHpQtSfxDZV0w==
#=qChXzjuiVYrb8OlqJPajoUA==
+ +
x6)w@
#=qEqEPF0jj3sUIryvQNEKKCV9boaHFZuHXMROqSn28L3g=
0N3l
#=qEk42FAaXkrNIu2TP76IakA==
#=qP_nucp5xdFjeAVWRfZ2XfmvYhkwWbeeu3y2fkxvS0yA=
#=q7uQjJN4fKJgs403tXnERFbQ1VWp3FBsMW_1ZAWZtc1g=
IE@k
#=q7b0FP8eSMCctHkHIxEb12w==
Item
#=qVqTMYHwCmwUHM6kkpNkbGw==
#=qQRAhbbFlVBfqrgso8zehPg==
"%(L
get_ExecutablePath
9feffeeffefe
Char
ExceptionData
_"v<;
#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=
g{ "
*&+
|Yd{
oK^ 8
#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=
(a
get_Name
GetValue
3hF|p}
#=q9VIijSO53lpTS2jV37$Suw==
^KU%
f cp
c&.U
aIa v
JA_m
5:DY
d/<%5
HashAlgorithm
sUjT[
get_Y
#=qgB3pFGrOVxm7f$sXZD67nQ==
_Lambda$__3
_Lambda$__2
_Lambda$__1
&+: +
_Lambda$__7
_Lambda$__6
_Lambda$__5
_Lambda$__4
#=q3vPs064Rj1jBOLtFVqV4DA==
#=qrPQtMswclvOlK1AxL1S4K8M$owLGUpQfjJA8CWW$fj1az7m8LFibY8IeMxHKi4wi
_Lambda$__9
_Lambda$__8
#=qQKYqF9uhb3QdjdrkvuxjUw==
-! Jo
44Q Z
Mu:$
Y(
sC-de
+Rmq
Zs"1
#=qyU_gXk4hv73zg3zoSZSLhQ==
) .x
. ^7
#=qRHdMxv5xMrip5nI3eHU3Y52nJ9DhG_ImQVoJh$ooupk=
#=qLLh1749MqIyRucx6BFMp7Q==
dzaV
Y_Qg
IW_*E
#=q$7KUBFuOZT85iBmKYeGgXQ==
StandardModuleAttribute
wLc+
N3`)
Ax)rC
#=qeWvkoUO61qxfYbQKV$cOPQ==
#=qAkkjpY6IHZssIsQ9hAxzTw==
{o51
^v? u+
/*ux
GetParameters
ma12
0X9'
dB~,~
oy
3Z+ +
`JL|,#7
fefefeffe
DialogResult
ToBinary
LogClientMessage
sTB|
K &]>
beE)eY-
.text
List`1
#=qj9swjNLNpEBN8mkOlVmrOw==
GetString
#=qAM4ZJ3aDwBm_a3IkqHxLmjdKzHIQbFeE9thLHux2o6g=
RyV_
WindowsPrincipal
Component
LockResource
BuilderSettings
%yg
,$+
y`-}
GetDirectoryName
Hcn(
#=qqRc2eOIidDtWq4y7W2lAhSyv$pBRJdAsYlXSRUcwizw=
#=q$mqGRbJ2J2TNgadoLHYnIQ==
*+!
#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L
OT s$
^"_;
get_AddressFamily
-,&~~
#=q6TsObh1LqPbvVPPz_YjbtgEdyXL$082jRqG42$db3nw=
#=qe9p_PgOCiouYWahOSDKth00dr9CdsTb1R3DYgCeLUBw=
#=qrmavK4kbgFTgX3_IUlEoRw==
#=q4X5fhkJm5XS4LlpLIyB6bA==
#=qhE2P2k46jiSSjO86g3nB1MkLGC9_3avDpI7iYbUHr5g=
gkq-
6lR@
#=q9rPQSTp$UBZiTGc7mKlh7h1QvRgfs0p_mQAaIRjRIsQ=
4Z^Oj
#=q6OqJPhANvYfkdc5uh_IKsUbLoI4zVFCxs4fpu7Vxr_U=
Single
#=q95w9MpaG4ZcgkGgnmQITOdHr5IaLXD8aC6o3EqtE0PQ=
#=qABSlSWKh$8sT$UF4sG_vQMmKqh5lDRXHlL1yCp0W8x0=
#| #
hZIA4
T['2
StackTrace
#=q4P1tyVDbmSIMgskx0BrPh5ZxjoQy0earrulDSsNhpg8=
#=qRbDxNN_CBpjdn11hjtWoZg==
Monitor
#=qUVvjDZc2eypEDWG9cFZdTg==
ReadInt32
#=qxYJIjuXFTjRvt41we4akdH1WN2nLMpesVOXXsYuSrHM=
#=qsLIORBvLMZm5c5Lb9Cm$GQ==
._&["
RfvZ
get_Variables
W/
i;kR
#=qZnbTkU5kDU8O8$hMGiNZlQ==
'v+_w
CreateDirectory
%:k#
PluginCommand
PipeClosed
* +
StreamWriter
e^w
tICU
YAq$
#=q4o4zrrzr7uOw3pySDBOwZtAOdlhvudqcbIbhABkQfe4=
lWKhz2
OwhUXH
{XtU
#=qnk9x1Gmlq5UZ_X95yAl14A==
FH4*
- & +
GetKernelObjectSecurity
6uXZ
GetCallingAssembly
WaitForExit
:UF6tZ
#=qOWs9MBREWujnaIdYgAI1lg==
#=qhv_9OQaSyr5PWElvgkBxFw==
#=qScWgGHvDwJ0da_7qXoO28aGE1ea7zp5$XjEJLTXkuHQ=
System.Net
BkrT
'\=$:
0O46
Conversions
Xv~0P
0ToO
#=qpSjmalSIZ6iBUAWRLBOkQ5sPqtZAetb$LjkOVwAdUac=
NfefeffeefY
I1=1M
#=qD3hoTFeBJT$SvX_fQh_aIw==
#=qBk9t7p9S5R095rOkFdE8GQ==
- &&*}
lsx)Nw
%(L
_C Bm
enu+
CreateDecryptor
jxzt
add_FormClosing
#=qArVl3RpI3eEiVf0qXoqrWw==
q]CN
#=qcDgE7pmQv6niirKxFRMj7Q==
StackFrame
#=qpghRvZG4ZfcsmvAYC$o8qN0WjB387Pn9cG$Y9HJ3uwU=
kernel32.dll
#=qoT5qP9FYCI8F5V3gKO7eMg==
lk3e
#=qL2Az2fdQv6DkEBC_x$bbMA==
GetHostEntry
<generated method>)
#=qXyCbQ53pEXrdqhJ6oXoHqg==
Enumerator
#=qlt$K8Ex4tZEPwTl4RuqGMw==
#=qAp_zHqT7acjq$QNiBoq2EA==
in`2
#=qfvzoVBS4j9KdxyngOlL_NauqVYLAaOZVw9dutKQSAp4=
DeleteValue
Shutdown
#=q3fzZpU7POi9yYKua762KimE0tXDV2VRrjyJcPuwXgTs=
M%`|
#=qNdKVs_XU_xYgnUK9ZfVshw==
#=q6FX$JRP_bY_ZCQbx1UwWug==
#=qwSPuuWVW8tz$gDazhda2d$myXXX0Ro_wRP7Rmm8JiiT9wA1EeeaPUV2jnUkQOCHa
?@~~
E%(L
)(Y(
#=qY9NY2gigPsj8X4CYx0UCT2vGlqkgsq6GuC2fWqP3Voc=
']mh
H$qny
#=qOKSmYE47P2z$UXqGETlnfg==
#=q3_xjz98EYRXgLslROl8imQ==
add_ThreadException
#=qhPbzHXREadcUSl6d6LhVYw==
&+W +
QR +
t&XJ
j;Z)
jX
->~J
Computer
[w(t
#=q$E54nUJeqC5jURP4oCRU9g==
,K+
1EVC
#=qV9UIxiLyaOi7XoTx2DUJwr8Ior26OirSZwM3mOvftrw=
qqP79i
2{xF
MB\]
Ec ^
HSJA
#=q0msvLo3fKjQ5ucIFxkdur24Cc0tFDGimgcqgtAeKZq8=
#=qh7diH14jww3Fm9rMJ_jIfQ==
#=qo8RCFr_ecPE9NSA5cyD6QQ==
xXa D-
~A
#=qUomzGDQTZY7jASgBmW35Fw==
#=qYiXVlu3YVR5erIxfIIBHo1Gv4y4z4vrtnS$$9CALbVE=
- &&
9Sux:r]
#=q2c1dOwAlqEVK063i13$4Vg==
h10!
#=q$P4U7B6$qbq6QJ_QX8MfyNoxYRq3foNT$OZzr5yEqDQ=
#=qonMVJIv_P7bZ29oJ_eSSxA==
tR.&P
xZR;Z
2/v'
M-(hn
0*o[
v %sP
reGc
Dt)y
JDhDf
#=qH8FTQLBlM6o0t6zf8SLPUg==
FormClosingEventHandler
> }
get_ParameterType
GQYv
#=qQCd2OoCcjOFxsuzhZKv2M7$UnAX8JX19NdffDxgtv3I=
~Z Tc!J,
#=qFU5Nq8bBPIPoBGBl$k8ehEhmgSoFzsflrFNnOQsCK6E=
Rx>Vrs
Process
#=qWcYPgOJASLG6mRBDPhOIZERKO3Eig2IiEWCrUa$w_Mw=
{GAqb
#=q6oykuAaezoPWCQHwIFBGYQJoT_doGKMmOjpzn6ZJomA=
F3P.
#=qb$tFKVReqZMI9M678cKWGdlE1UJqJBfHAfOfQhXuW5c=
#=qWNtQAckY3EoQ$HeRpEQ9MEcj4oiFXpw6QZThgsGNZIA=
#=qp7rlpRCprgGh7RCnHteaLw==
{+x[
H,
'%(L
set_IV
6z[8
3mXtKc
A=bD$I
#=qFlM8LWSzwV9qMKMd32mVdQ==
#=qHauijmh2nJ5kHO6fTYBnJFZKkfzkWt5gB4mYS5OLOVc=
NanoCore Client.exe
S_R<
* o@
* oA
@whA
~Y
,+&
#=q6zjWArzQ8Jv_1waqxSeP8A==
#=qDOdV5duF980CDFSFl8oQpw==
#=qNz_Hz8DMWPqA8pVcg8d0UVymwvCurvyYgdZaMK3OhQE=
#=qYGU8a5KOsYzqpvljkWGWKuQS9mZuJYQa$8g5J6c9rho=
#=qKYm_FHWoJ42y$VrakLgWfw==
UInt16
#=qCgskv3QU4cEy8M7hqvNNBbFyow$DvbmSQrN8A5JJJWs=
Enqueue
W FH(
#=q_WoKv7McWxMc2YtmbiVaCw==
#=qUZMwlqlTBPLi1iscPEnOdMZqp5jDsQ1UK2Kgux$Yn40=
#=qrWXrfWfqyzD06oY$LsE9ww==
#=qqROT7DfncW7strhZvp0iRQ==
PAi|>
EndPoint
#=qy2xCoaL3Dm6E0MYt7i8x7A==
-G&
#=q4d$NdpGCMcL3TaMlT9EW69FacIvNnqDPMFNisgGhmsY=
#=qkzr_P52_BAWJXliKWvb8Z6oiWEishcUAemTNzwiiwkk=
o>$b
#=qCy_StxaanQioOSGQ9LimCF9_Wy9AMBNKclrIIUI0AWs=
System.IO
#=qQJBwIjtEvP$UD5Stcfj2wASGBDPz6YiX1yXx_MSfzPs=
WrapNonExceptionThrows
get_Now
#=q9iu_XWrg9WTOw3hVDQcP8ZcABJLoMYtAY0HfRbaBN24=
jN3)?
bb})
IClientNameObjectCollection
Console
#=q637XAKKKpMW09u9r97v4lg==
#=qszlIp3ITaFi0VCgRIaErNg==
#=q12n1704BGxiT9AoOoTNqog==
afeffeefeffe
$Rk:
#=qscQJIcBkI9VH8bZTZtABeA==
R140
#=qWsAxoahmYzeECOO4WB9kTg==
,@&(\
e+l _
C.X
#=qpE_mRkS89WMXbQTdLD7bwp4pTt2zrWY_WBF1BLz1fes=
- &(,
Zoe
#=qaSWqhswYp72H_CatHelXxw==
:BEv
-7/
&T-j
#=qU1g6m1CiJ5yzLECox1hBrw==
_ d y;
#=qvA35ZDPTM3VgF89oJb9AmWFE4pqnIDYGjeV5H4uvblU=
- &(?
0ThT
#=qPgHNba2TbLgSqrCvG0e5Uw==
(o$(Z
uKV;
STAThreadAttribute
SffeeffefeYa*&+
+ }
, + +
[8.s
-\&~]
#=q37jfceDpvm0BhKQMkpktNw==
ClientSettingChanged
i]YR
?#}I
#=qTfMnD_jfiITiB95ES2nWdLlDTdGOSDVgXEnjKNGkWcM=
@l{hk
Hg`J
WX1+
{9#'Y
#=q_$06eDx4N3eSJzkchUhbnjKtHnRsckM7I4ZqcwfQO8E=
OO;/fW
GetConstructors
m=D
GetBlockHash
SUv~
#=qf3c4WtE$$thN5QyBMvo3u0lth2VF5hmfUsIv1r8yRkg=
,'HR f
DM(d~
/X`]1
#=qksh921Ur22JKhSIAXESSag==
#=q2gthvB62n07fYVTx5fwIqxBAo1t_hs$il9Ac$4FY_Gw=
#=qxG1wJpkOHyc4AD8gtAdxAA==
r
xzIy
,++ +
<}/jFn
QU o
-j&&
M@Lf
System
EventArgs
!<B3 )5i
aerC|
Application
waj8H
w8S_
TransformBlock
+-([
C)z>
#=qdzx0nDkNduYsJ$MOZBFb6jelzyvbyiG7So1vqpZnVLU=
- ~:
#=q_UogavoS8ANyZp2cF0B9t7qG1b3QUqGTYeTlmQIKxqY=
,3~?
#=qDt_4RPbN$YmUyKsVRrbzrjU6uaXWwjHkaZoJAcuFCCs=
JK]Uf
#=qQLqXliLS$ujl108DGV7$zv9jo8WyYr7oxBJvAgzllyk=
jg*_
ClientLoaderForm.resources
#=q_jQLaNdtSDa6ovA0VGw50w==
#=q7_KHECinDx5vq1IBX7p8Ow==
( . 4 9 > C ] i
#=qAfx0INrfgWoPN$Cz4VEZYVFcKNxFeYaixc4CaQpU$0g=
(Mx`l
#=q5hEV9yBEvglIR94FFM9OBszK4aiazrmJrQshba2kpDY=
#=qAk5SEnvr6iWKzWTaOapTEA_BFwuNkz68xuZLTnuQOh4=
N(JX
L;iW
M~4k
ToByteArray
#=qQtwc_i6uv63Hs$aOrPLxrMU9lMXbhRW79NANZrRxozw=
- ~J
(zg=
DnsRecord
JM
MethodBase
#Strings
mR;
#=qxLboOdsVFLmyLD939$tUsnUMYRMeFnzOLiWxQdY7sdc=
^}|n9
5.xa
#=qFBEI0HItLMNpyOY0AgRxSg==
System.Collections
\ NcCyK0
.(TmX
#=q1abXKhVCyzVldE9ra9z81A==
ipK
#=qtLsfqPVQ47D3cdxmiwAJAQ==
#=qyow7wBpiCNNIoap9jI9L3Q==
#=qrcOHnfaYxPMN2$QaNhNmcA==
{h*>*
#=qrXs2l$bWJlHMZLHncLNYyw==
#=qXuSOL4ETByiwdARI_Ds0Cg==
-"&~k
@'c%r
#=qlFQRS6FW1ex39P1F_VW7Eg==
#=qhYMTmNdkO7UsEcfduWinsQ==
#=q_gCP8hm5SSW7J$3R7xJuSA==
</ P
NanoCore.ClientPluginHost
/u'n
kAWs
#=qwogjI4gN1imp1VeWLroXTk41PgYeLQ34zunh6NYu_3g=
Environment
RegQueryValueEx
#=qxO41EOA8VDczxcMMPD9Hv85pbiPnTbukmYyDI5Z6X8A=
#=qWFUoT0l6elO8yn$hIYUL6Q==
#=qF4e058OW__NtTzhWOs1UXEJiHrTSwnIZ3q2u9UaLbo49AZaoog8nMfoDeA9BGVvy
#=qbLBIoIXYNfJl3x9LHqBWNA==
#=q5$hUSQAZNmEXcUcvGVFJrlqtw6IWJBy6C7LN$kOmTWU=
.# G'
Dx 9k
*&+v
#=qGfiJ4oSCDzJJaNmf22anQw==
#=qlMIFeU84lweg5Ul5iSg2vZUvNnPKw11XA1pEUQfzDeg=
#=qkgpjO3I2rdg6Il4nyqzgDw==
feffeeffeef
U675;
#=qdy_NHDvN7XTcQtWWMYxYKbuJqtXHsYJXM_YUEvVR0bc=
][i`'
N#c5g
_bx
_SB]
Decimal
#=qfkwtPDg_wfxGVFOXd$WnCA==
#=q2nHH3haw3R0VWVw4qHOwKw==
wqQN
a,^L
3aP8
#=qWBzgr2CJEoV4DPIbUzdZZA==
pbGX]
#=qnDLRD4lBlfyGeJyuSeq2WA==
#=qOsVShdMttD8jGLf8zW9G7g==
ffeeffefeefa ~a
#=q2wxuRKC7TyzyevfrmeuJ$w==
get_Position
#=q7YEFsRA19ZrxKTBeL$y0fg==
m?~n
GetType
#=qbOmsEb0zGpdZukI0D4Idug==
ArD
#=q0yJsLo0aFpSu9ky8R9f$lw==
#=qZuX180bPJwK7MhIsqenk34Le3ZCQFFLgmBb4sMlYIpg=
#=qwWiTcboLi4zF4ycKWLBprqWhuc6ZDNNDjC8OE8DG1$c=
HA1Y
[go?;
add_AssemblyResolve
WE Y
#=qU_UZ3uhfwWgI9uBw5HT3xA==
q&
rjI3
qIWM
ThreadStaticAttribute
x5r[5
U*_n
Q!T5
*6J=
[\L N
(p=?
#=qRkk_hj7p4gbUu59IVllqeQ==
Activator
+2yQ
&+? +
#=qVHGoZQC06Wdz1fJDKkoeiKu9aci51znqNtMz8dGZQMQ=
5NPp
]8W
#=qFWCMyHOrl7QbIPkMYdiWJg==
#=qoKX_5NDx$uDAqG3r2Qdnaw==
#=qJEtGIBRUjtEusa67yMyqWQ==
JlQQ
#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=
#=qyc0YQPNqWwZHkgNDV8lyIQfgMkEbGZtyDsLzhYmFp8w=
Double
ReadBoolean
>y}
&-U50p
Ryi]
$g _
'} .H
pA3DR
ProjectData
set_Position
?3>w
AddMinutes
f1$`
ClientUninstalling
#=qd7oUKLFPI9nt8Ln7RU53xA==
#=qWkPc$uBFgJrhuimjKXkFcw==
m8xI|
\u|
#=qZhds7a6Pui$KE4m8ht8xuA==
Intern
MD5CryptoServiceProvider
1x\g
8.0.0.0
#=qNc0O1YGwS4NhcbB7sgpVgg==
B8"a)z
#=qoTZi9XCxEGJXLELWnV3yfQ==
#=q6uR3lWd6_aD2reKUDlx$OA==
c?Q0
#=qvLrEXVjSw17e3P6GFPALhrZXcKcfxuk0NupQhKFf0VM=
get_UTF8
#=q3qYAJGveL_cxux6_2m4Vaw==
#=qGvpT_A2MS3Oi797y6jojBg==
+d~,
set_WindowStyle
-{)
GetProcessImageFileName
#=qruARjy_8oZkz3lsHPGxBMA==
SocketAsyncEventArgs
5I.}h
j+aL#I_
get_CurrentDirectory
#=qq2h0VNJ4eWuHP5LphH0mpA==
#=qHU4s4cJ8BUWy$MQH9LPGxTniDgLcWFlt1CmhZ7PNRWA=
y-l;7
es/c ?J/x`
#=qa3EpMqO3KVCTrDUnetWt6fRbeWox1uN3vfSP5v_W_wc=
f "~
Socket
#=qF7qP$SJNVn6Q0z6ARFaJgM2aiYbkFhrfYn4Rl6Odj3I=
get_BinaryLength
|_?F`
Fdp*
.d `
#7Nc
%rw:
(oHA
#=q$XxqrIH7dyYqacMzR_CjGA5JAR0vUKiq1f0DFqS1mcI=
H'IEh
#=q0xixHwSTS$a9x5dtNZccvebVLuO4euYOepae9m2S64s=
Z ] Kg
Q_@q[
tr_P
SWg/
!'oLD
,)~9
-<&~C
UnhandledExceptionEventArgs
#=qek1Oy3FoZ8ULt6r5iL2pEQ==
[=3]
<qn<'
Hir
7]rJ
#=qjM89gxwDLZ9izFxrYPCtcA==
#=qZb1TYPPMMY64aTN2MpcGOQ==
s~7j(HXA;
#=q5j3wvJXlnrGmRnKUHr_1SQ==
#=qRNkKSXdFDcR_p8Jbzx9WJQ==
#=qdw5QBoXX8FR0LrkjhWN3qw==
-%&
#=q8NzetUGGc1cM4ZGyRGGlug$fKAOwmcPqe4nFzDGKLk0=
#=qay$wDBdxvh$MBWrC9YMhC_f55kIvkv7I_BjPu_7Ajsw=
#=qRtpaHvp1hQcEDS$UubP_mA==
#=qCPeeDj1tZ3_XePWJJx7FTlBzWHbtSGvCe1Je6nRznW0=
#%nM
ntdll.dll
zVh^
vi uG_
FdlvK
xRPa
[SZB+T*
-%&&
Form
#=qkbMW3ViV2G4xkJU4KS4XYUwKzC$oNmhjZ49L9c8BrOM=
U@W>slT
get_ExitCode
m*hy{Y
#=qi6IJz6lHhd8GI6qygHcvTxSTD2wk_BSYwC2NR2eR0yg=
(Oo4
#=qJ2Bo_iSk1Tt7sQHk7C2ESQ==
#=q6wR5WMLGkL9afTpqmWsw9g==
#=qulZN_JfMbEqc2jFbEooALI6mh8tLy9$3NFedHEXAIAw=
#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK
-'&
set_AutoFlush
jyJd
J* 8
#=qBcRYABJptno3$fpXoMXAvg==
(w#N)
CreateInstance
SetBuffer
#=qLYpbsprg$ymVLeNEwEpYlA==
c5n
CreatePipe
&%(L
VN&m
i<3$
Delegate
AssemblyName
#+p<
#=qSh9$w8INPkos7acCjV2yFw==
#=qkFwCVmJ2HhZ6r$uKeVZFFfVLdddj$WEInl9bSgbErDM=
#=qmzYu_D9f4dvUPauEaU7zvyNjCyGp_73Xn5SffrcfQAU=
#=qWljP9Wu9miiHAG26c_L7NQ==
* P|
ParameterInfo
\<QZ
-'&~
o {fUD
Z-;K^
,=4b*
#=q0f150kYsIx0s3raR3xq1xQ==
(=br
,%~B
#=qg61MaViIt3ErBjuA0N9Xrw==
get_Unicode
kRxgV
#=qhz4yMg0WDLwu3BJp4fYr0w==
,P:"
h8k
usV>
-*& r
):W\+
TY
#=q9LcncGbDdZaeonfU3943IQ==
#=qJe4Aop6J2k_bK0f$hS3ZOQ==
AssemblyCompanyAttribute
6-4+ -
#=q6odj$nz79NlWTFUK6$Vbrw==
- &~
)%(L
#=qDwymJFr9Z$8uhJ6g7so5xw==
C%V5,
*D[:
#=qiJXCsKWBF9DB88uzW4b92A==
ZFUF
\gI+~
Enum
2 |
DebuggerDisplayAttribute
ParamArrayAttribute
Fu f1
get_Day
. (A
Restart
GetTypes
hp|*
ReadInt16
#=qJZLeQthAfpiCw0QvZb7htA==
d 2$
#=qVIikDYmLtr_O$2vZcqLhHA==
nVK)V
&|.0
e[F.
\r zz:q
#=q2JCFpXLqGkqf10Rox8zrAg==
psapi.dll
get_Length
#GiN
ProtocolType
Sleep
)%Gy
MaxValue
DESCryptoServiceProvider
#=qMMPHzLKw8_cOGV193acukw==
#=qsUdW_kbiEct8_uosknsYUQ==
c\
/-+ +
#=qXIsqrB8Mw2TMQ5$s7oRSIQ==
#=qQoUfP$jAQrKMjDuqm54QmA==
#=qyxpfolLUhMvFTDE2h_syvQ==
-I&
-+&
6s4U
-7& E
#=qEnv9WsExz6baZJKRUDupw9eEQbgJVjj69NjcsJ7hrBk=
s^X+
K4"-b
-)&oN
Contains
, + +
B@W);_
{C;n
fefefeffeXa
#=qRxR4aJg8TX8oM$OpeoviZQ==
#=qsqmAgLqQh_pOiJq5Mcf5Ii66zl6iLnAX8VtqTy$uxhY=
#=qe99VPFgyNENK$KtARK_iPuwvOEw_NRgC00PdG55dmGA=
nU !
#=qN1bIi$08taNozgdgDWdXVA==
ValueType
System.CodeDom.Compiler
GuidAttribute
#=q9rN$wEdl9rzJbAMMIiemCg==
- &sA
h<O4
#=qlIUFl2SBYSRov3A1WGimWQ==
#=qFm7s8q151MPpLODhzLizPw==
&w<^
ToLower
PipeExists
\9}
#=qVEEdpD96A48uRzPJT7G_w60gIZo4tH1_e21GoRWPFm8=
get_Port
#=qxb6WVOMh6wjcZFY_Q0MJOQ==
get_Count
(\uR
Trim
[L0
GetTempFileName
=5`R{t
#=q752iy7NeRDzz3UAYRlXXfQ==
#=qikBX_CmS$ZzVAuq$nQJBDwmLm5Gee1iPlPuvI188Ejo=
0RG,
60nQ
#=qCaHpjtavBmCU_o5x0kJsKA==
#=q6ARXRSe2PbSpq5u4_c1Rsw==
#=qHJMw55fNEVIiKcc4ry0o7_L9hyz3vS4jgKl3KMX8xGg=
, ~s
M5Sk
SocketException
ie|]
f@mNk_
#=q3$9MQ9O56ldzMJGDeTdBZw==
$X6|
#=qrJaovDbn6146mBrhFbUMbw==
25Ho
#=q$jOt_Qd3idEY2i2z8zIong==
#=q$yU7aYEYOl8Nz4sJLGQQ6w==
#=qM_mpCWjOCBlruGH_QcTQHocD7LUJCLuKe8ntf2VtQlk=
#=qxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecU=
r)Hc+
qDPFp
s "-
.f ?
=G^^
&ua\f
#=qDH4GuNn5iW6RFhEPrfs$pQ==
#=qsUsGxFgC$BJaO_$VAtZ1Ug==
#=quXVzKqGldmgtXgVm61aLog==
Y Y!
#=q8GRQigucU81Rfg9VpK7PVLcjulhhYVPijYKMm9N3PJs=
Y3]t
qz14#!
{M5hg<
?s2~
#=qstAyOBsDsJqFRKDvXIn01A==
oK.D"
0e14
UInt32
f (
$ahco
StartsWith
qgk"
:;+#
!\%
get_Version
(^(A
set_CurrentDirectory
#=qvQfNpqhSbw_$p1TB3UFgJA==
ToString
MFSB
_~Ak
#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs=
L,9
QAID
{--q
_~A^
|~^
#=qWbDVCvJRlY$nWsVAToK13K8LD9gZFcJQAtBUvjDEcyo=
Utils
#=qbwvWShVSL8DgrXXfPQ9kNmpf6pmcj6q57bPfcsBp938=
#=qZFVU$VkNPSWYii2AVQe6c6mwAUd10Tgqkl1$K5gZz9Y=
#=qFYv4oSsEFno3Ujev9_o4Hg==
#=qGxD085Z3RQaUY4iGwWH$xgEmRYVWDAN6hxNjaXokfVc=
#=q1vWrLhskrN4OoWzxKuDDSQ==
TryParse
ygG.)
ZB(VjM
ReadString
H I+
Igpp;M$
-!& 4'
#=q1t2nN1p2nWkytA1wjQ32JyClWcTGIZMOEV9XOIYf1xQ=
add_UnhandledException
u5[oM
#=qnB6QgyVNIUL$Uq0GD3p5d7LpaFZvHrB3jSqhv3o7qlE=
+( +
"ch<
get_Hash
ClearProjectError
#=qZiHVbt3FXowK6_NIyOxsOw==
#=qdPDxrK7XRQZlwY8QeW6oe0AEoOr3qND_WVi1o6l48tc=
_{v}
x jz
#=qdwmMObmoGgv5eEpelZDrHiipw5mUgryufdcXXig375Q=
Yaa*&+
#=qCQ9vY8iVniiFr_C0wuoMFHQgjJIll0MjoDGXuPo1hYk=
DebuggerHiddenAttribute
7@X=
get_UserName
#=q8FSwXWaEOgeGW7OlBosSfg==
#=q_kGyEn8KrmBmt5M1N9cUSg==
Connected
ICryptoTransform
LeaveDebugMode
]X6o
\1D>
-R$
UXMm
b`*&+
q/1'8@
PipeCreated
T yX
#=qkWUjAoA_6r2E7qo6NAGuIBq3iKikqBJbioTC25CcZQY=
AssemblyTitleAttribute
;6$)S>
SC8e
< \
7h 2
#=q$njopRrPblqe$yrs$rsu5Q==
@Z(n
C/Gs
!2|
9+9S
#=qJqkjp9g96yoxpNS2E$BC00FKleto7dZfN9N5mtLDF4g=
#=qd4_A7Y1qGQ8QAgHfK8_ssQ==
CompareString
u%a\
)Pr4
#=qmbdg4P9$2ouafwS8nEs4lA==
System.Security.Cryptography
WS}a.
Create__Instance__
MemberInfo
ConstructorInfo
4J s
gB$3NRy&
&_,(
Start
#=qjYgYU6Lnx_W1ikVtBmjm3w==
Combine
#=qukf_DyAYprvhLsdhT4CGuA==
KaC[
-l&~s
r*+a ~a
m+]mm
#=qaPkEKJmdD7BgG18R0WsnHA==
#*OMF
#=qtcl57G6kPr7DDYeWeY389w==
+xX~
#=qChHxg92yH05lHO0u7UrDcPo$UK1nFXIjb2DI3pyR0FE=
BwEc
#=qnonybcfG2jzQ4kHK5lGw3g==
fW4d
#=qEIPcndOLrV2GJmno7zKtBA==
#=qtz1ayBjdbHAw$ecbWtEnYJXs5RBd798kqoBvIJunFxc=
add_Shown
#=qCA$7lFkUlfYTBh0Hp6uY4w==
#=qVQoZlgR59_v4NYIa4CBPQw==
]It!
#=qlzCbqLxFuzycCPDZStFfAA==
(\DO
#=q8Bp27fhtrXMmonNxf$9qLbuQQehIBQTdOPDQw07FUyI=
get_CurrentDomain
Data
#=qgW$Sn0ALOASuZcEZHxiZDaj3mNXTljqLa5onSc7M0U0=
RegistryKey
?&FB)v
oq]
#=q3p_D2U81K1hW2D54P32yDw==
GetFolderPath
#=qKaOsg8ghd7KyYDCm3RhDg9KJrf7McwaH92TdOJzSw6s=
feffefefe_-
ZRyR
ConnectAsync
Client
Int64
#=qoa807UEkAFejsz9ub3crU9Uahxxj5JIyAtKhnrEn$dU=
#=qwNkTTorgPauZQTT6jiqLIA==
sNe=
_ww:
m(]P
~:}ew`
yG3Q
.ctor
oH
#=qU_ZXXWlv_8PtJY9coDWiH8$dVbE9S$EoqFVRvxhPtE8=
, &os
#=qWszclzYrfU2ikD2Jo7BLiQ==
z[8q
mscoree.dll
CommonAcl
hU#n
1uRl
o?Sg
CommonAce
#=qru2ORBLxmt_CUDya_FEQGA==
#=qd7RJPnCy4YddvoQeTJhlwA==
#=qfPf03rjJVGFkLtYSr7zDRw==
#=qecBuZmXKFD$jZa5T0d0L1w==
}x1I
78Bs
NanoCore
wKZ n
#=qREZQml1AE$F8eb3teEaUmQ==
zO_ss
#=qr5qpvOPnLxLp6aGkfAM7wQ==
Invoke
X8q@
e [Sv. )9
&+U +
#=q0U3u45cUl83Kicjfx0RmVA==
;83H
A45l
#=qs4p7qYamgHyRCYZsTKM03Q==
#=quOBOxPeAl_kjKKx$REI6dA==
(
&[Q
hR!Z
#=qRvcNy1bY28C6xYdCX8MF7w==
- &&
hp/i
#=qP5B75c4g32E_HsewCKc$Ig==
#=qRxKU0X3UfYwXoOTtDpEVW6z4XRgE1s4V5zOQsfCCSqM=
* 8|
#=qhRDMBTieg0MID1DJ88eKUA==
hlK9
BEYQ=
#vu'cu
'G4*A
n8 9^
sAx?P
w0g)
se9E
#=qgN8fDYnB$J$X9QGGYQsYuvA6BpDT4GE_ca7JiOh661Q=
#=qeMVJwq86lZc4hsNJNMQJVYiQqG94mfqhBGc9gH9UUgM=
+,~^
#=qN6ip4UNq3TKArPG3ZZy$zw==
-4&{c
get_SocketError
)JYo'
#=qkrqC_kLD0I$zOgfqD$aGaA==
Array
#=qsY8nKQa1iMT2g$sVoLy8u9jrLGP9DMATpaFjFx3wjNU=
\4xM
#=qZbWC$V5YeersjeRitYkSUw==
mL"E
, &8
P Qr
#=qCeJ_QwVb__fbuEImkTXwSg==
#=qtussAh$DpHFmu7sm9TXJyZsrjeJ6Xm9c2y22v4wQG2s=
k 8L
op_Subtraction
#=qOplsUBML8x2xteEBilOycw==
HH_1(
#=q$fGRvwQxjFKeY$SH10p0pyPTU$R77VMKr3CcLFQeQ2Y=
Q@ q
Kt@<
m@gr
#=qDJ0VTVPWfAWYghKX_DdnsQ==
EntryExists
#=qvRKdouixzy3mopZ1VtjZRIxbtiSW2GAGLD$37iVLn9U=
WzA"
w{ho3
$+I#
#=q5W7RemVArrFCeEyFuvU4Hg==
,!+ +
WriteAllText
SpecialFolder
Byte
get_Chars
M#.(R
#=qxp6ct4JGLaMDbwg6fkrIEw==
#=qovc0J7K6b9Eq_C0K46rbmg==
ReN?H
*J>L?
?7~
MoveNext
"z}
#=qwHAjqAoc2lT8vaebbsWerg==
:z&[
get_MetadataToken
get_ExceptionObject
#=qB8Wn1MJrSNWupWDx0sYcAQ==
#=qzB1OZ89gRpxcPckUn_afNY2d0beSpEyl40_4IarIxzM=
System.Diagnostics
#=qh42qYul4hj$aa5mluadvLA==
JKZGSJI
RegOpenKeyEx
rr:r
,U2y
&RoWW
]VEm
#=qeXI2ChPq1TaKaY8cTwWe4uWAyXSGUqAWxM21uH$6gYc=
BtQ
#=qnDc3CmkCB1QeN2dXbmqV1Q==
nTb(
1H^/
U_6z
PQloM
/n1X
Fb !
#=q9M64o5ghSlB001vxhTt2kVIQeNtcHtzTvRgoYr2$PVs=
MessageBox
`%,h}
{[h
vc,dY
C1lT
TimerCallback
S (
3Nio
#=qi3LnKomYQ5KrkAbxbJpKCg==
#=q0REOJwjO1qsE01G_RQE1TQ==
F0VT5
RG1 ?
]c#|3
AddHostEntry
#=qzI8efPARogp2CZcGB2UtfAz2tJs0A4fM9fKvuTKYqi8=
#=qO4hvdkAW0_yOcwEk_VD$lw==
SendAsync
#=qDEcM8KorEdChS9luywSNQA==
#=qtT$P2Bo4VHFu60OU4VLf1H20c7M2DlURuyfb_XJDYaM=
Directory
#=q2V8VN1ZqnXOBhkZZr6w3VA==
ua ~U
Uninstall
H&(`#
#=qFlfDskRbjMOXZPvSw2W2UA==
@|){
o c+z
u1M J
get_FullName
k398
ConsoleApplicationBase
\j(!
#=q1kCP32T3CbXwL6JS3UekkltOicB4KjO4W45iMQoNvNk=
#=qJrzYsTPKAwT$ubz_aq99mw==
)mqF
N(E4
#=qu0EIqDRT_HlTe4PqaMKdozL1lQ0SgTtqFucuF2vFq50=
ecXl1
get_Item
ReadUInt64
#=qxQTn_t1ZFKKNm77mQ5vH9cInicm2Cv9jGtv9vmIpksI=
RegCloseKey
* $u
-2&~}
FileStream
#=qxe_BfLLMHqYa_KBeLsRfpw==
$%(L
-!&o/
ffefeeffefea(
#=qRUXz_3fP21juNHWjDYL16Q==
xrI~
,$&s:
#=qxHMqkcY5ri8Rsxs7KCJ8ww==
R9~"
set_CreateNoWindow
Y 8
Assembly
,Mn3
ClientLoaderForm
#=qA$TQXn2i$KwpdqxTX6vvVw==
-3& (a
*A1R
#=qfHad4tglpNfnMqZ6nFkPPA==
-,&~C
ti2;
'>tX10
[M<K4i
7%jpkE
$ RQ
#=qgBCfMYp3J4fCYU13EId5uw==
'@CS
#=qZ8pysPk74rQ5GX0s5CkOJQ==
MNN`
O8a g7
#=qwrVB2mw7gzmYRanSJvSoPg==
6{F2
ep4m
#=qK7tJUw5nsLE_rt2JHgqYI6_vH0s$mFFB1QifRuMCr34=
SocketAsyncOperation
.rZE
Dequeue
7wEC
6]Ri
-&<I
#=qafzQcMCK0eVSctI0IcD2PA==
#=qEQtWieYw8BPdEE4hbsjTLrq$BwGjJOBoaDYJmV9xVgE=
-&+
WindowsIdentity
Q1SK
#=qEbf5uxiH92v$7mL0TnmsnA==
#=q5OunwTi_tYTGCTkAtZ8rARxlhmXbFcAf_e1GiEt$FEA=
#=qsA8D04owIGYHILF6yPa43A==
9y_A
do~5
#=qzjMBSDJWeEdkUWCBxYatrQ==
Size
-'&~C
[b[i
iNEVJ
WindowsBuiltInRole
)QVA^N9
#=qEqBb19ZxrWpMC8pwAc1v$Q==
#=qpNR_LpdLu_eSOZVgxbr8UFRlKjbiBX7LOuGAbGS07mXUJI3AAilu14uPN_kfaTpW
0T"]
CJ \=J
fefefeffeefa
#=qw9FR63zXVj$omVnwg0u37A==
#=qnY1InNbQmfgiJXdGVH6rvQ==
h1&-
`T*y
#=q5WXECfTJPQIQ2JoJDGsf9pTFKCPzQGp3$QlyT_g_ZCY=
ChI
t"ZM
Void
#=q66hvvPDVbMv$MYStXtnb6Q==
|qYKp
#=qQR2R27CtTwLSuNC54_JY1g==
- &&*}b
.R5E
po~w
- &~{
#=qpXfSNxR7J3tqOHyqT6s_Aw==
Resize
#=qP3lBpu0cs5q3Lf$qXSL7q6szA7E5M9NqMzkAFV6l4CI=
$d(U
#=q1uJdtbJoEKhZjOld7SeHjw==
kaaN
Clear
jZ}{
#=qAySeqCaPs9tWWTa_P8M4Zg==
>Mv
S>JK
(L (
#=qeAvM9D2ZXEFg7Zo1J5PeVA==
T) q
g z]
#=qr6ouJTA2RwDm_3Z$eUP6TCvbpSA$yAFGnut7D4kG2$I=
B (
GetCustomAttributes
,(dh3
#=q6W8MK4LKkww2JvseikWqeA==
s!V
#=qnaTZqk95Z1a8JBLdKiF8aw==
r#bzT
- &&*}&
- &&*}(
IPHostEntry
KfCwg
#=qqLNJOrQl$9SirTNF5ZKaLA==
#=qClMnNCTDhIIGUYHmdm$xCQ==
#=qYQagvH1k4NeWsCidwFRb$sQTZXPGouROQfmoImiPGDo=
+"
O3GK
ReadBlockData
#EKz
#=qOicuy1VnndMMXIrDqqx3EA==
7IhZ
$ y
IClientDataHost
^EURz
772FAy
IDo7
#=qIrsTmpVUMRgxokIHlpGfmLtKeqxo7vQsjSkKUKFpH4k=
zIa
#=qDx8yS5wU6EQSawGC841xnw==
Ap(|
-]T
Y R=9
#=qJBJs_Q6YmbNTnGoWFx0s8w==
_Y'w
CGX+
DeflateStream
IPAddress
Change
ToLongDateString
9M%{
#=qyMcWoZuG7jRWeztMnp6fPmxxmqfVgP7DLzGs7HeF4Mo=
8(c
-lMr
YV= J
#=q4rZJEBSRFNm6PYOH7NOLUg==
#=q65znFg0_234nfnhL4I8yRSIMDpdjAosbzeDfyRZVW08=
#=qmuy0ee0GJl13ksvWRbOSbofOCTPf0dv0HYdjJq9H_Es=
#=q8SIEDcn4WoT9RcZmFK9tzQ==
ZC@&
RuntimeCompatibilityAttribute
#=qP05CRmbt2pJg10eRU50wu1vx$mfteEn$pCn9SEbehP8=
GetExecutingAssembly
#=qTKJrybVS3pgV4uZ4KNtp3g==
*=>HbY
3y9-
;?j_+
#=qNQZrJgmZwpZh_4yrtaf9Gg==
#=q2X26s_rFZ25AY$hOcf_6zA==
."Jd
: s.
#=q0PMcXQJxcLLr1sYO0fpyhPjUwjQtInL_vJPQSgCsfio=
#=q8nWzev5go3NKhN5Gk9NzTmM91eKwrK00n3U6GWmH8Kc=
2"Fw
#=qXjNBjXFhVcOvrRAG8alfq96_gJ4jOa0wwNOaztY3QjLWnMT6wXGDzBnHuUkef5N0
Y +# S&
v 9$/
#=qpXMe_UDgWsOaRVi$02jxzg==
#=qXkgpfghvTKDZGlXBGI4x9veQO4JfjF7GW2ECw9$L3EvyKZGOnziwXE2Xr1EkpRwe
#=qb0tmyILenEyH_R9DXJFwB5rGNfkKkR0Y5sGtBRsV3YE=
BX!8
dnsapi.dll
%k*.
#=qCSC3Khfzx9$ef45TjPThpcJgh1Y2yjEovdFzCbywzqU=
#=qGWcF1$SkVAOkK9Bjc82XDg==
ArgumentException
K.L1.
zKx4f
-/&~J
#=qfsxP7vyadqL93mAkiQXr1tsUC0B$7Gp0ZNAPpjNxIG0=
MyGroupCollectionAttribute
~}
K"iK
#=qy_aVo5ze7CCnCYXCQvhVBg==
"cxR
~s
#=qCSH0DtnYKogitTpLw_M85GR1jr6BVuF$16hm8cfUYWw=
#=qhPT6K66KztLE5cE8YZMEsw==
#=qmLTtz8OEDrkzFTzYkI_Dg1dvKwiGw9blNcZSU_QqMsg=
<O+bkL=1E
ConnectDone
#=qbn24Ox5i732BM_T_R4Q3RtK1pEoSIYmxE9Rba9DDKEA=
MessageBoxOptions
#=qhwyNa_lhtuoyuJK5j3BcF4xu5fY5XhFlgzkM1Cgy6IA=
ys-yq
s#G$
G3feffefefe
#=qA5pFz5LZPgfUa5zon4beRA==
ReadBytes
a71Z
8G5/]E
#=qjAD5jc_8Kg9x$NoAqFAvpA==
4+o
Interlocked
#=qGCYL9FviWCrv0prWZC8VfgL34V_6XyB$buFX2LkjbCg=
#=qwVGSEK8LoRuNWEOYfq8$hq39mmxHzM3pIeoRef7XNt8=
-Z!N
GetCurrent
SendToServer
!nAd
I)\W0
feffefefeY
#=qrYH2MBQ1J6Wu3hhoHHVW0JQwxTYC8hYBTLbQIYHNBds=
AssemblyCopyrightAttribute
#=qKqE6jaRKu5jJvHl8RwywXQDv4h_f2ISEaHK__Drdd$M=
#=qnOTCmwQWr6BtiNf9ta8BJg==
~,
#=q$sTc1AZMnHRC7q_PL2hWs4JIEJoo88_IAFcWtrdNt$4=
fev
#=qrzlCozsOJIqLxGzoulKftCL7kUWSuMYFdc1ca_yCcBA=
j?-L
, &&
#=qcMb6hxBpdyTwCjvpzaQcC5dS3wbplPqOta7ERz_lMIo=
{tL_P
X]T(
get_IsDisposed
ClosePipe
W=F%
xGGx
#=qVl3h61LTPSW_ew_st_OlTAm7x_6Xu4hQK$pi2fSiEIs=
Z}!1
#=qYfWGXuhZd0cmWjiCvW2EPw==
_4Fv
ClientPlugin
FCDC
#=qK$702nkzQ4rQ0lJLQZ2zaw==
Operators
mY$9
J<iF(
- &(a
>;*
]2sV0
#=q1r$Sd9Acbw6KsKv_F9uYTPvvGAfiEwUnai9OGYAUQBg=
#=qRxyF5FV01AHvUkR3BeX8OA==
#=qAoRzrFi9HiHjyPL0ixkVXA==
nr]_
DeleteFile
H](E
#=qOR7qPTYp9qHTyadzUKgUYg==
SZ*H
-&&s9
]`3O
#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q
#=qIe49uN8SyHwjwKdv9N2r$A==
HXP&
#=qO7YVPb8fjfyGw81pHcJjnw==
LingerOption
ZmW zd
7=~<
#=q3S7bY847GmpPliI1m7tZaAVifJNdeHclZJyeY2JTxN8=
v!v\
IndexOf
#=qSJAMGBE37IZjr90jS4_MYNWNa1$s8PXhOErbnAhK_ZI=
]`J4w~
#=qwyLCYYp4MoTtTA6T$fEOIg==
#=qpQiSeXaCc6qGNX49vDbcMYyzv_UpV$YoUyrH0l6FW6Q=
x!@
"HXa
gorD
t"1P
Close
r':!1
_];
W64
*F{>/`m
h?T,
&+` +
HSXB
#=qYhk_OkZkBWola80M6EUqow==
aV{oY
IClientReadOnlyNameObjectCollection
#=qQkx1bBZns8hPde7$PcvfUl2fAairj6t_H8ve7nJO2s3BIB3t7PXd4ZR9h0JHyxrX
#=qEn9Mtg$AIqWbq3whj1y5N12e3KXi_NwIIcl2i$FXNSk=
zBW\:#
#=qZvjD49iuetyLKBIiF$ZmjA==
^L| u
#=q_$JrmDHg2uq9s8cQVRi8Jw==
Read
#=qTSoRMaNGYiiBNK9Yfq59T$2z3sNScYh9uxoeWlhnD_A=
0m94Li
F!C0/W
#=qdupfYLPCEHNi$xwR52i0Lw==
IP^3"w>q
-O&~r
Delete
value__
zFC1
8% )Yz
1@%3v
#=q6Xi08r0$lOOnXtoBHhfMuQ==
get_Value
#=qrQRxQdT4MC1qfwOd4n14uA==
#=qJRbhy7_BbunS1O6hH3MqZIufpnZboV6cb5Cv4qZI1D0=
{Q$[
Hnn
lM-
#=qmTxGiMA05lTEtoPPV6RFOih4DYS0uxrxPO4vA1H2j6U=
9Si|
^&h3h
pCJ0
AddRange
27o~
)M$1dq1
6QjAS!
,VF@
Decrement
]DL'
SocketType
#=qLSPQZXlXixhGX8Gd10$ph8j0p3_XdW2xwrfqz3nO7MY=
DiscretionaryAcl
Vi
|t(o
ConnectionFailed
CLSCompliantAttribute
nZ N
Cjf2
.cctor
P^vh~^
AsyncCallback
#=q3eIsVMg85$T5I_yeach_tN$TJG7$vFUaeExZx7tMHps=
q8s9
#=qquFMi5Wa$w8aN9GGlN4H1Q==
mscorlib
&;2
#=qyzEuYsQ6u9hwZeR0HeWqvA==
LQJok
FileMode
#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct
#=qd92UVUgmlXoQZdJDkVvBpfqQ5IrxjaeWORyWFC422PQ=
PluginUninstalling
(>w)R
#=qVxXNKnhAcArgJoGGYXiyyQ==
+OEE
0_*Y@ `
GetMethod
#=q7Tql80HUgCLaL3e0n4j7ew==
aw^v
GetObjectValue
*HT?
#=qiIt1yNcUYn9ksB4loCZmUQ==
#=qN76bQl1CQ6EpIJzS4bbSnw==
; Zj`
#=qGjp0Vb6efONwANkcKrMTkIBxJvr9AleFfJriudyTw3c=
n&V#
_}liE
#=qEoM$dAPD9j9L1YOZU2B97iwm0vZOJe13LDB3GayWQEo=
#=qp9IgcHwNxIVh4GZl4S2tcJtSz0NII67aXwFNDcdhP63JHe9MNg0kPsAos3IUd98k
#=qFY80y4KcMQywRNP$ttVIXw==
%K,u
AllocConsole
+K +
Guid
0P!Qo
AcYR
GM;H
#=qvJN63xerlaB42Q0XUG621g==
#=qfLFZgbR_r0GETPSprP6O9w==
#=qA1_qolTI9aVdwnEde3ubqM6zKBigTZiyb5_iHpeZQDI=
Disconnect
Qz \F
<dfO
None
hR 6
get_Width
mW_[
;6(
-!&
L7 ]`
Cs7S
-!&&
ContainsKey
System.Reflection
q$\I
#=q5bws5LlHvLK62TcSJadQTw==
V#@@
v (
ffeeffefeXa*&+
ZsKD!
RuntimeTypeHandle
. vA
#=qP9qYgJs5_O2GP2pI$ho4ZSa8wQkwNQEBMg8VjNRrUWE=
#=qxWp4ETQRrgcfPChnmxhivyMmb5p6MuyluC9Tc_Mhkec=
H^kj
#=qui$hq6ka6v3VYA7sCjpJmcmNECKESf33DUzrmeSOmg8_E_GsgWi7VMMVWUGuO5wH
#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8
Zx'P*m
z%(L
#=qL_Q_RdUm_wJ7VeVwUqRXbA==
)Y*t
#=qObBSq08BLhHK8B6pYQSLOw==
4B x
vJ8`
#=qhiSO75CpxncaWptyc0vAMQ==
UInt64
8HqT
Nq6X?
ToInt64
oB
#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq
IPEndPoint
k_t
#=qmiBgFZvSMQ4WgT0UQIJlEGkYZhWP0gsBGd1anIAH4so=
Y0_ 6
2)H
9CP|
Cy9~
#=qq_SehjaC_F9U66vu1NLqjA==
set_ShowInTaskbar
#=q9lvTmS27dN6FAh4mbOnRsQ==
Rfc2898DeriveBytes
op_Equality
,+/2
^6^
#=qw2XWrJCQCyTO0Iwdbz8TWw==
#=qxH0vEx09STdEljqb$W1E7jvc94T2TeZBAEeRdiG1_PA=
/:\C$
#=qO0bmWYqIZnaB7Udo1OTvUuiP36Q9Z_7hz6URm1Yr1hM=
HN&7
:E",6
#=q_0gCRmXint4znUKVJR_bzg==
#=qQ9gevS7b4oTsdxtV36c3$A==
.%(L
#=qAzhW8LcEnUCELlhG4klMCnw00GcHco1N61RthSA9zQU=
v7|kGd1
#=q85afbI_HcqBFOZnC0iAqsNghLb3LsuyjFtpLEYYoPX8=
#=qh9KSqT0kHBFSDanZ7gXkKb1vdDfzZS3JIRcUnMfcljE=
l3p
NanoCore Client
NewGuid
get_ClientSettings
AssemblyDescriptionAttribute
e"eI
>_@
;CPuQ
6l:
#=qW1UvUJT2hH$HRJ6kt_DhXQ==
:yb;#f}
#=qUzL7S_0eXIkbwTon4AS_WA==
#=q5C_es0qgtlVCNxzfPQ_idg==
#=qeADSRAqxC2FlJbA5Uc5$2A==
CX:G
XO5s
TUmS
fefeffefeef
IClientNetworkHost
#=qa9HOmSrK7mjt1ZxVRncCgFoJUA6N3DmB1Rc$YUfcSKM=
#=qe5qrWacQXGv9g0P5D_mRuQ==
#=q5grPwgEurSn6KutVLS5_oPClPR_aCEdSRk5nKP5bDm4=
eD7 kcSE
8+jY
#=qLEtx_37WeiIPQPYSN8vY0qTNiL_L6nA6vkFQwNlcU2Y=
#=qKKh2V4W51UBGXR09J__pug==
-\~Q7V
DAJ"grT
MnQ1
,(}+
MQOJ
#=q8fYxP$_i6Xk0$6OlSwUHKcvhrevHxLXqXqvszBe9OtM=
]]M1(
P d
GetResourceString
-7&s
Q`%
#=qN9Enun6Rlq30xNdBjhzY0A==
ValidateSource
#=q97ilq24aAenhk$hG8MzEMQ==
knJ
#=qikOQWBxvreUKIkKm4o4DoA==
#=qc7QknLi4DrEENw9hVJyfaw==
#=qBhG6LJNfmJspOR5A5YrkZB3a_dWOpJYSj4Mo9vfL8qo=
EOI<s9":p,
ConnectionStateChanged
#R~qDN
#=q1Ld$ycQpy0q1QvYRFk1k5lwgysKVR2tJyNFjakVtbYY=
4|3w
#=qoTNlk$Wngv$bqPRyj4mJig==
#=qsWAbPBa1yptbB97zoAjeSA==
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
, ~?
#=q7wsNZ$btlm7uRzkYXMkJl8JrBCKSYJt4if2WiKQrObs=
+ +
`[L3Z
NanoCore.ClientPlugin
#=qSLl9utb6ViD7fbZHSox8oSv7PZDBMO5b6MBr_gzzHF8=
#=qtNbB44E34Ui_i5yJYQ5ntw==
- +
#=q$c3lXLbhl3Qzil6Z9hYEopCTRdsG8WE_1ZuhF2KQELQ=
?~.-
#=qu1CivWngdicjZHEJYKM3dA==
k.b[
eJe'L
*%(L
#=qenWi8guqQrvoGB55djo0ka_844yTmViBn5_Fr2X6HAceO7AJErk_Rh7nfkfqtUbq
\P@FI
dV]:
Variables
get_Message
!This program cannot be run in DOS mode. $
* +
>'Vz
System.IO.Compression
!y'QN
File
IsInRole
get_Offset
c>(Zv^
GenericSecurityDescriptor
Yj=J
!qTL}
!% X
Dispose
}F+"
J? n
#=qx4AWw22LafncEy7CESjbGQ==
#=qwTOYF_qEkI0dXowKJYtI6A==
GetHashCode
#=q5uvtKo7rLfT5wGY5TBS4ixmbpGEL_B71rwbORlBpBKA=
pJ V^i|
Bno
#=qFNeaOBvMHuebCbgh$0IKkw==
GetCurrentProcess
~s^,FL
p`Ub.
-,& oy
7`Kz
#=qudwGeEjJDUB9pt$_k0YOgc30ZWMo1bIGmdknk40OWog=
[:qa
#=qWgd5i$rED0nEbfExDCteKBL09U6dKm2BW1AXqZVXCWk=
m\j@n
#=qnoPzE9XMA8S7X5JX6ycJ7w==
#=qB7XWHK8gygwSs$Fj70FiWw==
#=qDBRodZmvuO0qLafxHA9KMQ==
7Xh]
#=q3d9CqFPpPy$rBhZvyFIRs_ElAFMHTo4ZZuE_g$Nfrnk=
AppendLine
#=qOgNXWEIS3IQJCnff_sTmrA==
#=qnIGrpAn2e$qTqbA22$ONbQ==
v]W.
#=qfoMVJHfk0BnMs4x6mHO77Q==
- ~@
#=q6NenfQbzQYLSZe2oYrhKsEGeaR69wF$W7VvfZPx7lyg=
e~nN
/MuD
#=qbbzTfwYbEfmovMRrVY462ipA8X_tt3oO3M_wSSE0I_A=
get_Key
#=q2Sd$5fx_doPt8h$UdBacAA==
, ~[
{,|u
"y,#
Z>Uk
#=q23tIFHA2cbwzlg6YDYhwLkXCJGgIhllZCGmc4pRC8rI=
DisableProtection
9fk+k
;MpL
#=qXKuFJhTO9qh0nlK1iXbbSH7y8Djn0mggfIDxOoarDyE=
#=qXO4A8$YrN_OoPhFOn$Hhtg==
#=qeE3S$kdx9R0s10U9GzzcFw==
#=qaWedjkiL7CWj9EfMXrEg6Q==
h]h_
#=qFxElXT3T_$sB_0gpbmQGIA==
SQqoA
SetProjectError
BSJB
#=qamR76KZ1klLpv5s7oSbjxA==
N<gp
eT8=
s.CF:
z jo ~
,. u
OHc3
x9EH
get_DeclaringType
#=qc3tkHe_7v$eGA2x6krh72Q==
@x`f
#=qKdZKgyAqL_iP0GUSJkXePw==
:msff`<
<i6&
GetManifestResourceStream
#=q6uKQziMZIL8_PaX2KpbPTA==
- 8 J U
}^m
#=qE8a8ikTp6zyXXyhNYzK8Wg==
BitConverter
#=q7$Vba9f7UkS7OwkHeUGtrn1ymWXBIMnyiJbrBxyOPBM=
Fn8o
#=qL6PdpQwMNSdyVKw3FgboNw==
#=qM9NIml9iDZh$Fjh9MocFWw==
1UJZ
get_X
PADPADP
9N:&
#=q5esm6BVWqrzEai7Zgw0cmQ==
IntPtr
}ITl
@1;
3wTj
M sSwJr$
+@8G
#=qwSqLSPEuM8lJy4sOeuH92YjPodcLquqdG$OodozwC60=
&+# +
#=qKxYY$jYG8_7mT_7R0n5jfw==
#=q9Dmi1iXzL1JAj2RiS$Q5mw==
qcZ
a {IqM=
#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA
KyV(un
#=qHy8pXlBCL$mvAXWQDJUnVpxgTTYNWuQ4Z7NdFPUhcZs=
#=qyo6slTMfgD8IrZ7nr6inHA==
#=qul8YRvQj1pWpo4_UxgOSzOBvtncEE$VPCzTeLK_rIz4EnXxineVkwF$lTxruKPxr
#=qJtsKc7ccoU8jRrRMGJWqhA==
#=q4fCxMFfzJ9KgfK61DJRvZ5wDvDfYnqR8bhY6TGq9aRk=
Microsoft.Win32
ffeeffefehah
-$+
+G~Z
7q[
#=qee1h2XwRBJvy2g__X40enQ==
H];]9
#=q8eJA0L4q0RMnuOJCvpFj3133vZRxVnxvHST9vysUWYQ=
#=qm_Podb$DJ6CfxMwMnaj6heXfc210URbSx7p$rJGFPmA=
7M(8EJy
#=qt0$GxMKBUHqpa$X5z4IJNA==
_|,D
#=qJLXxSZzWSVDQjBBC8RxpqVbwxFaxTu3ygaLrjLvlmTw=
#=qs0qPjhSgxy3k5gj_gt12EQ==
#=qbWN2780y2PKcyDt_4uktmA==
InvalidOperationException
,>~,
r[D}E
#=qZHoyzaJ9rjmsFI5qWuYXUQ==
#=q7wyeNFqtiGUhQt6sicod9g==
#=qhq3FXVXLOItNPwDlpFnTKHk3JkInaJiiSE3uR3jtGH8=
#!1
aZDr4
System.Net.Sockets
RijndaelManaged
S@X3(
#=qEIGjjvppBA3BShbdBfMkQQ==
#=qoTGj8$mBoje$u1RSJ6obYA==
'%?c
FileInfo
-"~Z
#=qGzqsy60d_qAVRip0TvyGow==
#=qSJci08l8EqyD9KF0joWzSA==
&+6 +
#=qAR9aFFQPEovpFzvfokoGkw==
LogClientException
&+: +
t(n}
u6I\`nH'
UnhandledException
#=qr1BSJWWt4_gjKhDM1XdrUmEEDWmH$7z1xaJvthJ97EQ=
#=qXzCb60v8h3v0rPCrGf606Q==
BlockCopy
#=qdZqWoaYN68rlMOX4HkTLdA==
TimeSpan
6F<]
GetBinaryForm
i#ap
#=qWfwpJtKOXBFXf_1zpmLUrQ==
Mutex
#=qjlBNihUiUO2oBJbOEbdB4u8xmfTL9EQ3AEFa$nrdzJY=
ffefeefeffe
Rl1~
#=qChPTKc$8xcHrcle7anHYNe0wH_TweGkex2nGe9n8WDs=
#=qLKYxZZVHP8wT4ocBxnjPXg==
#=q3LvM$oW1poDdLKDT_N_s4w==
S&zY
FormClosingEventArgs
#=qAsxHG9v$MAI6$NruMbxEjA==
fefefeffe(
, ~:
#=q02vg4rlYSKrSiDNi4xWbtg==
BinaryReader
^ 4
XAJtT
#=qAlVTP0_ZXWJdoW5RI3VoXQ==
#=qccx4d_xNMPrZUHpmyYb7fIKkXAFa5XEyOIxXg$XLtBw=
set_Key
8B}!t
TK[l
#=qVvEn7vdm6JlvG9koG0JUIQ==
T {sD
|E8\
#=q$JqWZLd6UPV3jmsDHksd2EmkHWISQtPlvGx8vZ7hHXE=
} GS
#=qg9gWuHgvaa6cHg9wj9NSQQ==
fefefeffea
#=q9DR9MBj4z9rQMPU2Q48EqjtFhU8AMGWHK02_s7IakJ8=
_Z^N
Boolean
L(Ht
#=qo5Pv9nXCIU9X_B8SJDUR_qgp7npNK2pA1rGP0GNQ51o=
a?WY
g{ @
set_WorkingDirectory
#=q6Aboe3ONIkez7GgqcdWPi0_vrT_i53_89HUeagGM6MThXvFkvl8hpSeHO1UJawKN
x$/m
#=qYI$MiBdzcplbf7GqrUf7Ig==
kDXp
.3+
#=qK4wGebauvtmTKO0oAyLFzHLhr9rU3HNJmU_ur7Zop$YvLzV4HzmIQ45YslW_q1Vc
-m,Ol
Jv%]
PvsdF@0K
$LD{
#=qFv$qWif57TCUNsu_O3F3gA==
- &{
B(!]+X,
#=q5XjI6hZlPIrXq2h2btB_pVJgDh_o3RXkWrFCxLCG1E0=
{ z?
,~#&
+ +
rjl(
StringComparison
#=qYCS3QLrXk$FWhHR$BIzDXQ==
* +
CompilationRelaxationsAttribute
<#+>
l62UC
#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=
, +
ReadUInt16
ReadUInt32
#=qeeDSInMnFASKK3QXGIKUxuxDb8FgGi0XLXRlZ2oJdWM=
- &(
#=qP6OAxyfxw$Mj0oVKCDnh2VZfwY2Ap_uDBmUyxkn98Eo=
&:vI
#=qTLmFjOt1Rq5$fqQEFVZ2zg==
{:t7
,+&&
SI7I
ResolveEventArgs
- &8
_a:m)
#=qeKiN0Pwa0MwkK0uB$Ook97TrMQC$LNj1jgF6xTuSA2g=
#=qmvGJ0E7$XHigSQAtHtZ6z$on2iAwFLBiFtrUR$DFhQPAtVI2LIgzNztIgPvlO9K$
!1_(\
#=qhVWucYSqOmMmp4RgG95tFA==
-?&~]
QueryDosDevice
Random
vmJ4*
xf7,f
+ +
#=qoStPOR6UymX3IGbwW$iFxA==
ThreadPool
#=q51SFR_Fbl10nUMKjGTtHqA==
#=qrWKlHKCxTKueolOR4ohc7D_cBhjLv1zNIcftgcigaGU=
-'&oN
=K1nL
#=qKoyC_0Y6bPLCPvDcJr2y5A==
R;DFI
[4Rp
MPHKC4
.Iv1
j#;B
&*}%
i"ks
8(tA
oK.j
Rs W
#=qqReemZdhHj1veATVZbU2_Q==
#=qd8WIZO8f6IRqdUmvxawj1w==
f#:6
f)t,
HideModuleNameAttribute
)b5P
Xa ~a
<q48/
}B
4%(L
$Hpd
Microsoft.VisualBasic
<Ymq
#=qehEpCuPIxZRbHczlt$dAWi4yWi9o1_noSvuo$Wzvtyo=
?y En
Qy^P
Z HH
s:BX
WriteAllBytes
ArgumentOutOfRangeException
A |B
EnterDebugMode
" u;bS
--&&
c 9|
X*]x.
vZ/
HostData
#=q7rZvZ5LmWDFo52hBeGb87g==
set_UseShellExecute
C_WF
#=qokX_wSaMFvPLXvDQY377gw==
H{^^
qUNQ
#=qrpluguOr5I7WIqr51cA8ZQ==
#=qtxvtUAtG5kwD1CbaXqZpxrHWaxR5CiRO2OiaCLfsbSk=
#=q2XZFEYqbf67s$PRf9Xyx7Q==
*3]r
Rectangle
#=q5QHPwKvqpNRA$cKFBj8i9w==
#=qUaHlQloQ1heHsricyshXiA==
2>FC<_!f
,d~9
O0Q
2->.
FHp#<
#=q7EIL8N8VWglyI984D7TGpzIPvdOcvYIRRwfMeKNyDDs=
#=qMoRe_p4fasg7BcMJcnicWw==
#=qsx3W$FQbKM7QI$Z1TXWW5A==
v-:;
+. +
Concat
#=qkxzumuLbzy2O2XsBlM3j$g==
}LWL;
#=qGHv1IOurZ6januU0XCThS7E6H0kqAtBD9d30RkoHFXM=
#=qNsyg$dsR$GJkSvK2TftGTNPuC8S809j_UmmfNnXTTOo=
StringBuilder
"}-M[D`(w
#=q2WFu5tRyicebO6UkQga8SbXrngw5YigfLTTVJqQy1qI=
qSOZq
6D"M
IzBi
#=qhbsl5nSqHjmKK5u9FniHoA==
#=qo_N0HkUaMUQFRCOsgr2ciQEl_IzgJy64oQzCRnN$Qy4=
mx("
ReadDecimal
LHj| 7[
#=q9tI5WfBIFIPW_84mZnHV05cJ9fSyOCl9wA8lwPxs3PQ=
B.rsrc
1!
BpBD
- &~L
#=qiO2giJomMFK1wa5$389nVw==
fV:,
6Ev&
ffefeeffe
#=qU0vjurWIhbfq4$RoGXKKVfTj5MJBenZeu2wAtoCJAJY=
Wc`@
ReadDouble
8Pa
#=q9WHClFSp7T8oS_DNFEbAHQ==
#=qHj$POo$6pkhWHVC5cES_2g==
CompilerGeneratedAttribute
#=qORcQ89THKgijJ1sWRyjf4hLd1g4H_sosI9t_gkVfZ7g=
]bC
#=qcyVktfYxc51I1XopnwGNjQ==
Main
#=qKXbEtqEIo3E2xdYWIElxIQ==
(^#9
#=qb_soGTESOxGbPyWr9RZjig==
.`SO&!A
>+5p
#=qKpwDTqgBVuprqflj1$7QZw==
U$*j{
oRZO
#=q6k7flm9GMlPIija7ZH1xJg==
nO4.9
#=q1t2S$ib6pQFvBWAJfG9B1Q==
%Q#>
zN6mf$
+4+'A
2&
Copy
#=qwGMLoIBYlotM6E$y2KTAuQ==
#=qzTUdhpx_l8oNrXik8Q6a51kZkIp$waiEMbjMOU1bFOc=
$PI}fp0
#=qC6KOBEMWwIsQr_847d$S8A==
AssemblyFileVersionAttribute
#=qZDHx38VzWszDP$NdqQpGo3ak_Z$zbLpODJse1_Sr2hk=
60 E
Transmission
System.Text
GetName
#=qcCYGLZOh9EpzU$sjJG8ZyQ==
#=qHtBOSXbLfhirIdzL218uOQ==
afeffeefef
#=q60UcvJzzgao2Rv_stV3rQhhxCdm95L1Gb83mKGH1VxQ=
WriteBlockData
Y~?k]
#=q8WaW5L3_NY3KPDRN6V9mCI08mHUZbTcARcexWvaAL6A=
MessageBoxDefaultButton
#=qJMNT6BwQKSi707UHw9_x7oci6egKjto_AgHYlITH34c=
?W|]
%nLI
/V^I
#=qmcl1D6lgUOLuKGFFyxMamg==
x A@
Collect
RuntimeMethodHandle
68[\
6mT}
* tY
#=qWFEttW6Y2i$LC7_zLCNdFCiHtPH1yR98w7TbmrS4vUE=
#=qa6Qg4SaIgpIknX0EmOdEQg==
2=|
#=q$6NbEg0Hb4neXdXPgEgHJA==
IClientData
Qo{l|`
g7+
*P L
2mlW
[%-cvAY
#=qWQUgmvsTzj15wSjWQHZnng==
#=q8Lz$o21atQxw0qUwF07ufqfk8jjJrspNc$L9E2y_kjQA$2GQzuj5BmjDMXRcd0oL
#=qfozjXlIKX6LyHHXB6wCG9g==
#=q$bBbU_xpGfMMkAvp45SBRg==
#=qFikK0kKzvE4fvbzxpsrllMMR8oLIJtNPAGP1lZZ4prs=
cF~F
;l43
1.2.2.0
[tj;8
#=qsOMWyP3LvE9$utIXVnRnmQ==
7Q:&"
#=qlV3FbiF00r5Vrp5nqoncyxDHZMuHB7yuJa7xS77K3BQ=
#=qrEy8UTPh_zjKUNPlgJ2H5vQaVxSgPloAxSMCkFttuk8=
#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=
wp~
#=qk$cpdn6seqbcKjxGnztc4w==
ma
#=q62cZqzG2QOltpyG5v7exPQ==
-E6lE
#=qO$LkcjIVULy0PGjvpOiiEw==
L e
Initialize
#=qqLLpPwpASXA1wqOuY2RNlU8CTc57bQGBfHWaLDgrCKM=
GetAddressBytes
wsvc
#=qPfVuk6552RtecCgHDnGSkA==
#=qSyCMza09ItB79lrZlFBuQQ==
get_DiscretionaryAcl
#=qXfm3QhQkyfcZgbFdAZgHHmadm7n1N0mfKcKBqrdfAk4=
&PXo
@2<i#
(a
r%c=
RawAcl
#=q2Xp4jW9C8Ta21HxmpVVhKkrHyOAsktLziyvL$pPr$5o=
Q!;n>
set_Verb
.dy<m
85-I
#=qXCUD4SfDr7DmFI64sweGXTg5Ns_ZxTOZPqBRcEKWTQk=
#=q3C4Iol1nMl5AFLWNdE6nxB2_kG0uXzx35vvsn$gQzt8=
O.`V
- & +Q +
Show
/B u
-
yUm
!|cUb[p
#=qEWXagqzV$_PB$92aNfTAHdvK2qw2uvSxy$UVh0K_lso=
Y(w
:;n{ G
#=qdiuHngY4wejUsgFY5u7CtQ==
My.MyProject.Forms
NWD\
#=quFACL_$e$cUEIexpzPXS7w==
cPT-
8JL3
#=qwnMPoJqYBxCKR$s5x3I3EQ==
.qS#A
FromBinary
4{cx=
#=qEhveuZChxbRj66Cj2kCGjw==
3L
X n,
EZc3
String
#=qyZOtLxFf9zA2x1ff4_5cOg==
#=qSYke1CBEgOP5WhDQ2wCOhA==
_CorExeMain
#=q2n0wwv9OpsrMrxVUVHoqGw==
set_Visible
CKK}
8^#g.g
SearchOption
idAZ
#=qw39MYiiaN1XJbqsDq$LgQw==
kmA
:Kae
KeyValuePair`2
6zQZ=
HostDetails
#=qB4sApeDyjGxBivHLwR3FTJejGBlbih3hr3f3TS7BFbY=
Timer
#=q79YE7jk$t8I7uIUVykHcVA==
Ve/X
]pN`
&+T +
;7 xm
#=qsAejPkl5V6B3npq6homyUA==
Z yc
-&&~r
%61O
C V]l
x%Ad
t'G
Microsoft.VisualBasic.CompilerServices
#=qluYNp43cwlAh9yLdLZolDw==
Ni'bm1RY
KI zbO
tt[go
-\&(#
get_BytesTransferred
#=qUUt$Zm9DEy7746wMpw0nOgKcClljRPRKWyhQ21GyaOQ=
fZVI
EditorBrowsableAttribute
~v/H
/RN,
add_Completed
get_InvokeRequired
#=qS8syUoAGHVUW8$eQd6_3_g==
#=qGGQk9IvbDfVOJG_jRDHqOA==
#=qUvO$SDWQpHm3uJq25yzwvw==
M!v4
2f}F
#=qOYQA1S8VHR$mOO6XXuyF9Q==
$bS<zTV
-(&s8
#=q91nKS7P$i0qKCqvUAPW9EQ==
$cedc64f0-b091-4c76-93b1-8c76c1f00922
#=qDJlWEiuGwuVXAz8yc8z7OaMssRYN4hP9AHespNOmdYHus6_1XkNOC0rqgHeRZksg
AceFlags
#=qsB4PatedVyMOyo9s5n1OTA==
User
"jtC
get_BuilderSettings
#=qqIzVXHiNuUY4ZNiSxkqEGQ==
D \}
DnsQuery_A
4System.Web.Services.Protocols.SoapHttpClientProtocol
Xtd|
get_LastOperation
get_Buffer
kUz-'G
#=qKtJTKEkNf2mJVHcZzSW8iQIcsBglzcJJOkX7V_uB55w=
#YW
T-+C
set_WindowState
Load
#=q8VTskDJ5TyHJcDeWmklddw==
= &g
#=qjryTBW16mUfo_ItH9KWoGQ==
FileCommand
#=qzRcQ_b8FoTlpKT_BObsgBl2bj71wU5HcYdpIIgiTJ5c=
#=q3cm0QwDyNYr2y$xvkCk9bGbohRfuMuxkahGwLy466GA=
#=qaRJX6K2L3xhR1w3zuwE79w==
System.Drawing
#=qfGQBFs$OKLefNYKSta_Lbw==
-WYA
#=qN$clRL1tbKGnARF7__FwJg==
5#1~{W
GJ.f
CurrentUser
#=qUWYBucdXrqr2Ksc_3qKZcA==
QOxc:4/
S"A'2S
#=qJOtLSdKNdNGjNNoElacScY2TTWmLUvN6XZsl_FLfP4o=
#=qRIR1iTmdtHs$eBwEdoKphw==
Kbw@<:
/^1G
m\1s
#=qhA4OqIvVSMpJakxtoytoCw==
aG 4
Ya ~a
Dictionary`2
GetFileNameWithoutExtension
BeginInvoke
ToCharArray
Vs+5
~utVN
get_OSVersion
#=qGqugi8s64S3wxXEod1SSyA==
Dispose__Instance__
#=qbpvfREN3OwaXBj6J3WBAim$AQyJ99fz1ef01qn6kVrs=
@uTA7}
7E.C
#=q0pfW5T3uO1I6LyXSPFW7Qw==
/I?e
P>Y)
#=qFZ8xm69Cd0C55Ip2ORf7Ng==
"J?Sb6
AddressFamily
v~fS
<N^%N>
Vy#D -
get_IsEnum
V=0`RT
_3R
&+4 +
#=qXULhMbqiur_al62NrjaiXWJ8rme0bKMO8KkV356NZwk=
M$lS
#=q5mGK9suCIiUDZgS_YSrSQg==
,-
L6K,-
#=q3TG8MLoZf1Y44PREVW$6m76IGmuYE_BOhC_OTjkQJFtYWwRtSeFqevP9hiteuLfz
#=qxG$Aklpbf6gyBfAqTMmORA==
p%"4S
RuntimeHelpers
+[~u
- &oi
- &om
- &ol
E+*8
- &on
affefeeffe
#=qOxeV7mwtJT4AH3HtBqNUXw==
- &or
%7H9
%n]h
D!7l
#=qTMXjZFh8G1ehMXQzo1c_k7izR$ZNvDyCJY5aoZ0yOe8=
#=qdObzsTSX0MpvDi$OPjsFh219oh6Iw7DshgNWGveAvBQ=
#=qwK7$pNtMfqKNZt8gGYd$pw==
VariableChanged
o'Vh
#=qxRbSDXwo6eARhpCjqJa2Fg==
O-,W'
#=qBpzegr6XzkmtwALf7kKPHV3RZVAWYLbYE79PiG2zXYs=
PIjB
c:sj
#=qdDrSQoelY6gHzRt_ma5NQg==
WellKnownSidType
RawSecurityDescriptor
7, ]Iuzi
Object
#=qCI9CHxEGVm3HnYdn52IpdQ==
ReadByte
/F~D
#=q0QKFCbf0u_IpV5ISOWOl$Q==
3\U~
Registry
L.Wk|K
note!
#=qaxeBDkuvv4PncQ$UM0p8ag==
ComVisibleAttribute
;[g[1
" p)
Q_:0
#=qzAgp3UwWT0075L6Sh4PfZA==
@Fs0
E*~U
8 W7d
r[A1V0
#=qA32zcbPIWwOaURCE8zDGfw==
-1&
t_6-
,.&s
lN\bk
Ea^NW
#=q__Bys7JTXmAiG9F9QC$wjw==
#=qAsEDmMyJR5b6o5oAn_4$qhqe51JCfsU9Gffe156c8UU=
#=qMpgSfrZ_Z1PFlMpqVHDctw==
EditorBrowsableState
#=qUlcwHJCewxIUk2tiKMDjXYc$Hb1k7TCZCyGdm6C93UA=
#=q9x6KBL_arYpQC$zFf4pEFQ==
t"IH
#=qzDzg9a$HVGG1G5cdhqbdwO3OG_SFijGXN8Towa37$TQ=
#=qQyvT61RAfdEUvn1jBvcx0Q==
bA%j
#=qg$lb3t6abG6vgSpzSjJlb_$AIzqYfos5cl9DWFolUwM=
]lC2
#=qDTvHA26pSwiGBDknUzewBVNt3YGW7YeSiQRH8F$_CMA=
Y ]7
#=qiCTCgJQkyH_Kzq$FT43G4Q==
`.reloc
J|za
Hashtable
#=qYMGXxffne_DlG2tyCliUw119RPUt2rJt6SWle_TPkBA=
EfP
h.qB,
&=]
%t(0
#=qy7SaTx6mT2Pix1CP6ET1Hw==
Qv4J
1Uec
b|p#v
#=qiY1B9yU2oVkPHxhn$y67SFTP8x1Jb0botGqdUGkdpQg=
%U1ay
o#6UN{`
QnEa
3sz8I
TKRX
+N 8q
^n$8
PfnU
HMMO
#=qdsDfPo0zxdY$R7euM0a_vw==
#=qI5Vms5JVXaVkwalJFV3L6w==
#=q99eEsMLSp2$EVfl66Ua2d1YMqB58RPj30lLgJzJJ64o=
f4]J
#=qzx697Szk1moqO$yUynaioQ==
, (g
Stream
#=qBuMzaVqxpYkDVtTnLpbYyjTfZNKm8_4JkuoFHPxOBFo=
y4J1
,
System.Windows.Forms.Form
fK;E
f|o2
IsNullOrEmpty
#=qW1Ty88cS3yMuRwgBrH3qpw==
|7Lu
-$& ,'
^YkG#C
,0&&
`)T6Y
zNb
Exit
Y{
)e"7
`5s?
wJnI
#=qhWn12I_bGxHfrIrnto3QAA==
- & (
#=qs77tphQ2NXlLwCZkimhHsowpXGqSYmOGtKiGHHIs4aA=
#=qy1cXcK8A6uRpLlCz7UKkNw==
gIBH
~f?X
&ydz
#=qGjStw3GYbvUue5kapeAzmPJAl5$UDUb723PSvMiCGdU=
#=qR0v_DeAkzbUr6_Md5tN4PQ==
XET%
#=qFaxhQMbuEyPeOadTfKIzX7ulwKfSulnteVvHU$QDlcs=
#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=
;A".
#=q9c$dxNln4J1nxxC7UNVnfSKvSgKS421$zTS6z9ahlusddEno_MZclU7Qbfc$Fyw5
UwDo
#=qRCCuvWFd9_O8CfEZhkJtSA==
IW^kO
gi0;F
#=q5s6lzZCgRNNe2Z9HZfa94HOHkpUfSnAwZsGo$hzh7hY=
#=qwdHHpd7UWv1_2lcOeunA18XKUsrG9D8S$xli$tkAMlI=
#=q5fG5Wo3pzujuJKotO2WwDQ==
<*-j
&L6+ffz
X xJ
t *Z
#=qS8q1FyJsn2_ukKh5ONBATg==
#=qQUdl15sQ0xTV$45YaAtVB9Bx2NeRc0CC_5Lr_HuNXwU=
#=qxWNhTH3aUmlSLTvydVoCIQ==
#=qWCa2pDyuMnzTMLUOIIx_zqZ1n0nAbCh3XpyakFsKTbQ=
#=q7Kx5VWqZvUxLZ2L5c7WH8A==
#=qbzig1$2CwLluEJt5uPtpgqPx5y_2S$GoPgJP36N8bTE=
sorj
#=qJ598Vnr_RIwGnHqFfQsYCw==
0_ML
#=qRLk0VFphuSTh16H1MGZUv_HwKU6b1$OQZ0l10zUjPKU=
f],H
'|B-G
CB&%
`=+m+S
# ?A
#=q8uMGC19QD5WGzpkzUOu0SQ==
MUb%Q
=R7
Details
#=qYVgYkiAmhdTmisXUMVHYlJUHzcBdggj3Sn3nLI_MDJ4=
pvEw
@`QA4
&* +
NYC{:^Z
ExceptionHash
XaY
AhcqV
?fxh
#=qJpz_ygP5AiHfhtTxRulSsw==
WaitCallback
OperatingSystem
#=qQ7tSKwAULKz8TSFsLbtapA==
MemoryStream
-#&
Q,=@
^6G+
zGc9q
abd-
Zero
&+O +
?_&>
EventHandler`1
C?ls8
#=qyYejfncvZCW4q4y4GEV7QqOL4Aox1NSDqQmcpM4TQVA=
#=qd5f1i4cDO3tAO_bEb7g1cw==
#=qRYSdRGBC6LM4UFJJGQnk7A==
-&h'
GetFrame
#=qN9oos_gePS4akhGX5rjcOjS2FNZJlTAkUnO0Ykgu7Rk=
System.Threading
#=q1ZcUbkVKv7wahbk_Am8y6A==
#=qDJ8UKTQIGM$_7XkvuUdssA==
MessageBoxIcon
SetThreadExecutionState
3 ~]
F$\V
kt_'
?]-uT
SYgh 38
UnhandledExceptionEventHandler
#=qz5nGZygXT2sWR5FWGAcAzA==
'1Pl
P-;Si$|?#
Ry
$g(p
`-q6
P!$s
l5[$E&
5@a=`
[IQ&
#=q5WjY_m3ubVFfbJuyu7GMxA==
*X2
+u_r
aCx2
#=qmL2H5Qgs6vv79mCqS$t3qg==
GetEntries
#=qfXdNdmKHZO9pILMTQ4gUIFhfl9KPJm2rU8y_LQsTH4c=
ne(R{
#=q$YUIMaEFO5IFZXBvo0kclw==
-F&{
#=qhnLoeDP_EbzJexQQPp_LLA==
<ziA
&+J +
?mA<
B&3N
W2i\2
z}?v
#=qk77uxMCXAcR_2KMKgZiSng==
-T&s,
#=q8d8q1KZbTCKTAZreko1Lug==
Buffer
get_Current
b%
#=qkxH2pC1tIcRyW8E4TCtfHw==
W,
m q
|txmy
^)#4
pMYmo!
aB[U
v}7@
1ow
0d?,
#=qJY6uBmA7bjB3pfI3CAMZ7w==
[uQjs
x8Wu
#=qfpNcQ8IYoPRIQgVc_nBfXzVjxVN2nY_mFz$PcDXaKKw=
#=q8T1neNU8Flp1WaNsBKnRHQ==
ra: x
#=qX52fPnzDspvxDLERxqgnmVyN3O6kmNVEBrlqQ9OVPeE=
eli7
get_RemoteEndPoint
#=qQqZpewiWxGMAW$tQ9Rz23Q==
+H ]
#=qgPQkZ3GBDc371jzhubcNPqmxfqhr7b78DNmenmuxGa8=
wEiP0e
X|Gv
\nsz
%QP~o
#=q4kB_KjL2oo8adT7lfnt6ew==
LoadResource
$tY2qgF
Microsoft.VisualBasic.ApplicationServices
(QAPkG
#=qOmCJCQ4xVqqqlvNEZD66Wg==
CloseHandle
y^'V
#=qiNB6YyqAJbx2uPAiP1Ihw9dTNEtwaZElmpYLZcGO64Q=
OD ]
zqt[l
+
Next
AiP_
{f<8
+
#=qEDU5bqS$T9T0k2xHaznuPTNI8j4z6II52ItUe0wjyZ4=
#=q4P_5NYDHZX9MPbDZuNFOAbRpAmJ2c_TFz8M5ulhIFApTRNfzn3_E1__1$MVw8$WV
#=qMMkhBs_8vtf4989qCM6TUw==
#=qSbcOBh8Kf7zb$IciDxPlGw==
#=qwBDUI_NSPNLYbPH4gy$3uQ==
(dr+k
#=qVCHxDTr$$bwFMb6i9vBKRZciaa69edA3gsLNOty0RAzCorWRBUh2v0PgySYBEvZ0
+"Dh
XP>T$>
Empty
get_StackTrace
#=qhufLjssUmkN_mXHuWOXl8gUDxidnVdWY$tHhp2HS0ic=
S R.$
#=qeAiPMWOD6_wvQ4$bYsFv9GLgsem$trQFsnkw3WN9igk=
xvqbl
b`)}
#=qe0mY$R_rBsPIZZv3hPLS4g==
AceQualifier
'r3:
#=q2dXdGRU_h62YVIUhgXBQJzEnralpXNvp017RQs19jjo=
#V)v
iSNk
get_Major
#=q0M0RRypoNIjajWAugf6WjbxM$GiKS9VjK_mg6sI0TI8=
?Bqw
#=qVXB_y3eN_sp1$Md9UoJeYQ==
#=q9heLrZy3cpWSk7do8VVthg==
#=q_ux9H7Sh7a2A98b6QB8m4w==
B`L_
#=qJdNCQZ8JQCfthL12ut8Zgnr9$rl3CuJQ4GAn54E6CXs=
#=q1A7nXYgjUuxh_0aV4fZMB87On7HuSdbeS8x$mfXfW2c=
#=qhFV5jkshUI$uRxypI6oecQ==
[ z/
-f&&
0 + +
#=qSl7F7iXGTH9iNXHds05fxcgA7Cydd52A6vZtHH_41F4=
#=qvJ_V3lJRnVEW6EI74n63zg==
#=qOTqiIHVN4TWDu4_xhgbifQ==
v2.0.50727
z%<i
SetLength
#=q3VDCpnvucWhkt3J6zytXBA==
#=qxUvHfLZKZiUmPXUqPV8Vcw==
#=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA=
\*Z.
_Lambda$__10
#=qvbTNBihG2zARsewkRIFTSQ==
WKIgbP
set_Item
JC`U
ToUpper
Fs^$
#=q0zLeEY98tybLc8FS6iVEWjGp4MNZxETphcH7ohzBXuY=
DirectoryInfo
#=q6tJHosKuF0IY3gGxjaveNw==
Y_ + +
#=qtkqHWk1kvmO5zt3tTCyF2Q==
#=qbNq0eOj9Pw66KrsrDd4qnA==
#=qSpdFO0arrQmbwA1JpPKL4TCAmwZYVDNVmpRQ6ryTPgs=
#=q7O26Wc9N845khaV1IlgZGg==
Exception
#=qG2DPieaEKCS$j6T6yTf$qg==
#=qIOX_rwHrS_RLFL2igzRsUQ==
C%(L
#=qLJcloNvItceT7R54Ssv5HVCoj0j2JUUq_dQXQpFZZjM=
#=q4KMIX0AcXAdYuUiSKvyy9Q==
& oC
! H O t
#=qR_QBxpRX$xZ1vjqVv0afDQ==
d(UqM
& oy
#=qbFnmVfulgLVjclcqmmhqFw==
#=qtIl3MhjXHsnCHvTVFi9hFg==
Q[(&
#=qFMsFc_zvkhu_B2YTPJt9Yux7Vq8aZNOr3FA$mEdAzCc=
@VMs^HoC
Z6-yS
\uUcy&*
Z e p |
GetTypeFromHandle
IAsyncResult
#=qT9sog7FujhNJZHxxUXVGPg==
set_BlockSize
c=Yp2
#=qqsKAc3v0igxVSmn4Feg8q$1tNTWiqtCBpA_xMlgU$f8=
get_Connected
~@
#=qpaOobmVTnUS0322VEUTQd53tn4HeMWSoV2XuTUOmp6U=
GetEnumerator
~J
SymmetricAlgorithm
#=qEKdoqcCD2XVb2atXAIOmL$Gnnk$r2oNLDVsEymHbxMo=
`ux_W
#=qOgcjmweVxeuvMU4cvcFOmg==
yxsL
'RM4
<generated method>
#=qzjreg8z0D4BPrx4RxUJBoQ==
MessageBoxButtons
} =
Int16
~t
;;bw
#=q8r1xTCj7grAlhMxU0cmrbA==
ClientSettings
w-hf
3:D`C
+chJ}
#=qo8wG17V6QHcxsU4R0xmY_Q==
8V*DP
ComputeHash
3?~Z
' )(
#=qtcncUaS1HcVKUD5AEGHBokWqEL$GDDjoAu8asy_oLis=
#=q1BpeNGUQvsUFoXPmB6q50A==
* 2 q %
sG,^:
N_e 5j
ReadInt64
ClientInvokeDelegate
#=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
#=q1tLM5Gk001IDETj3RhJ2ESaIo2XgaV2vMWhqISqSHy8=
#=qkcPDXy2$GrSLn1ykhNxS$A==
i^lyymP
#=qqn0Pbku3c3j14idd7rNOJmIbi4WueHDQGNjxpToWe9w=
Enter
.]e@
/(~,
GetInterfaces
FileAccess
V=}o
*N(A
~2
D%O
CommandType
ypcc
-0&sY
C5pNp
#=qRACckQ0ejzlKZgeXX_CPJUyKbl7Zu7QfhWW6eMM03VPusMYB8LREfJZQVcTGHBm_
x sN
#=qGgXamaT7IeK3DM0oRfGI7LZg7FrEWNz8CI_5MUlFEJw=
get_LocalEndPoint
#=qcyp860KJctHXULF8nCr1oMRR0y2kU8XZrQHqsInbsAM=
zsX
g AU
#=qZ79zrlLw6T9kJCHt$e306HkmYpQl8J1ugf3bmy8tycE=
#=qTYemjRfvVDuBO5lrz3Aq6g==
#=qyEH54IW$f9fUJb7FOR8r3vj6e$onLGrpm2VGycjbl9TZJEqkwtA4y4bL9ExOWpiA
System.Runtime.InteropServices
j-~D[
#=qqMkZyGiL$PHkYblZrq1S69029tlEdPXkxbM_smmrcRU=
zsJ
RemoveValue
GenericAce
< F
Math
Ox'S
do&y
#=q4N2IYJkFi2VWiCVDKVND$8gixU$DXUcX8F2LiLBxLHw=
rNd#
*Y/L
&&*}o
NiFN
- &o
- &{
{
9w8H
v&]D
s.u
#=qKY90T141DaVDQT0DHaMEr8C6aPEoolamkqMM94Ir$TE=
]_Cb
advapi32.dll
#=quRXaU$OHlRs_89kacdiUMQ==
- &{
- &o
#=qxybSLhWq6EDNDl0$FuPN8g==
J]-EK\v|
L*@9
#=qos7yzAcb5jR$ypc0Qk3OWQ==
>};9
System.Runtime.CompilerServices
lz@15q
#=qVcF51voQmyGAgyAUz3313w==
#=qgHxgiBgB0FhzEGOOs2Dqnfh3XnJ7nEmajCNqRqFR3Fg=
SuppressIldasmAttribute
oC!~
IClientAppHost
#=qgbI51haY38WJ4NumXDqnLC_uKv$aRHAyD63c9HgGYzlsFjikAASqT8RCSswEMouz
- &&
SByte
@ W \ g l
KGL;m
>Y]p
Bl1[

- &&
ffeefeffeefhah
sLYL
#=qKi0KrAcAGUOMcS5S$2tJyg==
- &8
z&Se
#=q00kXQ$0a$SV9DIgRtf4NWQ==
" f~<
#=qXOmEbR_8DUzPz6sW4Kmd6kaKUIQOYZdTpvq2CkB17PTlG1zEUgI_P4skJXU2VwtO
]= Wq
FormWindowState
Wm6]
G6.M
!b+f
%|2|V@
- ~0
- ~1
!6tG
#=q3rtw1eBB$yyPLXzQW$mDOw==
#=qbmVTgf9cRSZkM_UgFSJrlQ==
#=qWsrg06gTzsE5hhHu57fJFw==
RestoreProtection
TransformFinalBlock
#=qKXWwuvxG9klNObPbc$UF0LIw0aZIk7Z0VPIncl8uFJQ=
get_AddressList
System.Windows.Forms
qmLT
d}%#n#
VZ-
UIntPtr
#=qH7CAcg5aycQv61Wo62XDpw==
#G}/t
#=qglhcKpwNlOshaHMfwiT0UA==
R|`]
x dXf}~
xg3fe(
#=qi1H2yZDbCxvPo0ia9nVnuw==
#=qvz1sVA0ePAgs1nzIHQTFVtjljpeJ1QO1S19vLxn8DMU=
get_StartupPath
#=qK5Mf9uxDCjwDRfyJQ6kp8A==
Ha,L
#=qtBt$1AtaHrrce6fc6LOT3axuBNxZ$SQPty78qYGi1os=
IDisposable
L[>cY
(LZ2
Exists
System.Security.Principal
#=qKU0J1fiP8KA33eFK1owekQ==
&+P~
#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=
LX,d
ReadChar
rvq#
#=qD_C1_4vUU8j6eQSUvsJDw_O6DZliNi$NDCaON05RwdmBpVqAu68W00hmx80mCKp6
RGfZ
#=qv1Nmoo$HMwdd1A0cX75UdA==
#=q1AWpt7Zq4Tx0wGx4hVFZRg==
OpenRead
#=qFTBwGADWl13TibdOa5ODk_Y2qcfMGC4lp4rhrZcE84kZNE6dU4EqEk2ZYKuJAWo9
m~%<
h8{i%B
CompressionMode
E"Vb
/.ffefefeeffe
;oISAb
#=q35mMBfMcRRKrjeZsPOCz3A==
.#0y
KeepAlive
G*3^
AssemblyProductAttribute
#=q0qLVKF4NbQlcaunYsixITQ==
#=q6CxZjTl3_v2RHWKegcqMWw==
l= .1ps
-&&
#=qkcVkJskuGA4o7kGuN79i1w==
Equals
#=qWrm21vQ8CBMZP_RBTwpusA==
tXnrk
#=q3_2_t217j7pS3JjemZNI07w3dukMmHXPSE5$LTnvGS8=
<Module>
#=qD4n8L4W9wQXrF7w_31K9bjmy3jeB41mSJJrYkh6lpiE=
/47l
"-K<<
#=qtS81hD$ORACBvdEkFyqaXA==
d KT=
+O +
#=qNn8WS2rooUJUoMsG84mQ7PkK4IQF8$E42cyDjfL7Kqc=
MulticastDelegate
b`h*&+
#=qYKspnFhL3rrV8a6zSvXJWA==
HhTd|
oCK~
#V:
#=qPYtEwg1BZk5tP9KKNl$36tqIdWilqjeWcpWKL2Zxnug=
R|4.PyQ
#=qcp_YDS3uDXZMDFWGeFYphA==
#=qGPdnFVTlqnS4tiFpuQulXa$2eC7Pe6YqVeImkUGsMl0=
#=qaysgaPdcuRrUvev6__tYEA==
feffeefefa
# zvs]
#=qJT4I5hOweIk$xYFEeDszbikglXCuquUd$v9AXtyq2ns=
-,& ~(
@FGU
^kz8
hkOq2T
ToInt32
fefeffefefea
dznT
#=qVqLFp2u1the0Txg1vhieSw==
#=qoGHQsKlZ7jK$YeTeBpzDNYYM4Z1FIrOpXaDV$VTAdfM=
#=qJAZ7is41tIXMNDQIkGLgjRC15Eis_QBrdFx8JT2Rx54=
#=qQ3JMSE9km3mGmL6lmUfRHw==
#=q98hMbgVf4fBR3MKeaM4uQI$YRLQdIr1biYYF5369cW8=
I>d"
#=q6pErmyx6x4$YkotXXEXGCt_ysi5JdNm1fpNgnUvZ9LE6EtA8E0TapqXrPnqyBO1x
#=quebj1wBCmruzAKmg6Y4Igg==
BinaryWriter
get_UtcNow
#=qQrBlfreeUYUGyN3hPOorGA==
|fh)
#=qoKFLFqm7bb3VWsU2QKXIQ4_6anGbTCWiZAfrNlgq8fc=
&&*}#
#=qFZLDtLWdUONY4B_gU_jjJi4BgFANcRLPMuWuQINdRLc=
#=qgSHqO_KLHRARFg70SGn_Mw==
get_Exists
k5|hx
SizeofResource
BuildingHostCache
CreateEncryptor
ProcessWindowStyle
&&*}
ThreadExceptionEventHandler
#=qHdV5wMNiXS49lDrqJF3pqA==
&~0
&~1
#=ql4R4vy5H067cy2C3KkF7Mg==
jd!+
#GUID
k.l
$Mb8
#=qhSKaq9YW4A_ja0UC7Difmw==
#=qtxap8xCUFH7z14nNy3cjjw==
;7oH_c
- &~7
- &~4
#=qhme1CFqs_evb4VXik7N4x7lNdqSfuNy3r3OUWZ1V4Zk=
fhZ3
get_Exception
oXyY*
&&*}n
feffefefea
|{Wr
#=qaCmGqb7phy5lq$DAzhK3vB71XCZSvhKm3BtGKq_xBto=
&&*}c
&&*}e
%%BN
&&*}X
#=qKxL6kQaUyB_6jIG3mQUGOw==
"zoKO
#=qrjPq4iPb$PLckcObsgRE1Q==
\m.
DefaultMemberAttribute
G97.
[w3]E
cl w
'Qy-dB^5
#=qxOFsoGbvlBlUujyS9g3fPQ==
5&}>
#=qo$DZvhC1PKdsChUToY52NA==
#=q61s8d6EIAdSsDLLjqchw1w==
y/MN%
ToInteger
}A)+
Ohj{
sI$^r
Write
b+
GetFiles
#=qbMe5UnnXEF8aurHaZz6klA==
_5MvO
cc8]
-*&
9zf&
#=qs202XG_JxpBwpKhptOZhRA==
GetPublicKeyToken
#=q_5hmJXim2EG1abw3Kju8nMffXDIbl5na4zXqclsRK_s=
#=qOsu3u3mLIa8ikCCuCoOv_w==
EventHandler
-,&s
Thread
#=qMWVV4JCreo65oWvwYJqZWobqlgJkr$K2AUIqF$weF5s=
XSN+
#=q1jj2Lo3UBKUZkdI2bLcg4QlXuNGNWZ$CYnK9VTZNEsA=
#=qd3Itd1ELDPHJxhLvt0y1NQ==
#=qoygY$KIlhsLDneTXkJ_L9A==
#=qvPYkN4Wli543LScsy6rh$bZ0bDIN0tYd5zlNUibOEKfBRc13v6NIDRtsxPOZzKpX
Microsoft.VisualBasic.Devices
MyTemplate
#=qrIbbxniIme2qLTdRw6i0wDoZFMH5BWs03iMeSnjojQU=
F)=x
#=qb8Z0_4AS4r8OSPknVYvDfA==
InsertAce
0adAK
SetValue
Encoding
"VZ6
:&\$
< 3,bDD
mM I
fK6j
<PAv
QueueUserWorkItem
get_TotalMilliseconds
SetKernelObjectSecurity
ReadPacket
IEnumerable`1
#=q44BQlEuOnjFd0LbnzKKIIg==
#=q9T406SLBpfhYfDTkCrB28g==
];JBh
#=q2LHISsr6oVwPjyrC2AFTD2_CdAouK60pDkoTs0efRSU=
} BlQ
ObjectFlowControl
z~}
-#&~7
ReadAllText
%fqIM%
t%ku>G
XZ6V\
6gDy(
?Lx
(][p
*b{`
CheckForSyncLockOnValueType
*~ #
A5Rd
vlw
U<%a
y{lh
#=q2l$b42bR_hlbzUjQTk6vFw==
ReadSByte
#=qfOXLv$ej4ffVoa9QN8Vke8O9DCKhSHEsi_sqFk8Qf0o=
(uZ9
IClientUIHost
/S[jo
]vE`
Wugv
ToArray
#=q8xbuK7pqyq7mWB67vviBtOo1WSCccuR7xEQnGnyxMyQ=
#=qCJD3QzeNpOG7t7hUNPqgxgwPhMjv4aui2ikN049iz28=
#=qbUu2Y2P9FL2iRkWyb62gww==
U-wrC
<|{Dd
"lUB
XaY
?nYq
0u8
#=qwGYG3$xqr6oMjxRyF4i0Uw==
Replace
#=qFWLbBQgFiIpy22HFbhF9GQ==
#=q0g2hVR4CYkiIvLHeQL6tUkW2KQhRibG1DIo1pReSOj8=
System.ComponentModel
#=qKKJCW_KTAsIH3uNlP3Z4Tg==
LocalMachine
#=qWLKNBubktRcyu8vI4dIAJNOqajvyL7NccmUEC4QD9y8=
-b&&
X(}l
\ 5`*
hi{#
l _#+
#=qfjs2lYYPRWKuXjeHrc8Rtg==
Ku8c
#=qHamFicykpD9fQKnU2wtqJw==
get_MachineName
#=qPbvCT$UNIh_DPMt5F02Hyw==
Zo"BGX
0D2T)
t$ ?
:z/a|
TargetInvocationException
e0-H
-?+
M+t)n
EO|k
K%(L
2dloZ
#=q0FQ_PiagXHm_B8aG8Ji9Dw==
4b|K?%
#=qIZP8IX60gSYF82kuZejmg8pOoXfEBczapTTwgrWM$fM=
#=qzzNUaijPluPyLfyxwDObxw==
r]~tH
#=q_NLac$XJ5lIxZMpXsr_nBw==
#=qlsj4Kl0M6SYgZMJLZ$QkSw==
a^-v _}xK
,&+
3WnZ
#=qFlz$$vhlrnZb7YOji0eF_QZBzkOajT0w3UoQbgnXVIA=
#=qGS6wNk5u54YEpqtjtMFIpQ==
#=qvvhgGCgMlZiK63M2bP1Kcg==
SNZu
,,~M
d53I4
#=qnnmAgQGEsJw4dsVn9gN4wJbRL4WqsDa_V0QuBPM2E4A=
#=q0EPYqANhk$fGDlTztPFu2jRCdUruoFdUMwStI_GHseI=
System.Collections.Generic
}Q\f
l0d#
X7# w(<G[
Compare
4K3``
qgIn
5F]A
Queue`1
#=qOn6YhA2JjwnYZ_7D0fnnEw==
U@QhF.
#t\
%2W6
HnOw
#=qG5YZbexfSlZk_cwFxKFh4HaY$Krp4rK2HdCH8OIs4EI=
#=qXCoQdguduOewiATPKLDvyekx3X3r68VNkZOPBX9O5lY=
- 4 ; U g
$a|m
#=qPjPHWXGbaA$51Cna2ZaMpQ==
tI~8
b/YW8y
i)%19
#=q63A3zH9hQ$3c53x2wqU0Qg==
y2t/
#=qibDx9sEkAVZroec7HmNu4g==
Y|zu
{ O|
IClientLoggingHost
"oS
0qH]
-+bIK:
#=qcrlhteALkcfYnKFH$UWw$HzZqj8gdN8_KwUKIC_ywUo=
#=q0myQQ6i89t9SZyjYDXZrBLa9ljWEUD7zAwJyyFZowQc=
WriteLine
System.Security.AccessControl
#=qTawRDksY2KFvY5V2vw1_pA==
-b&(?
*N(;
#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=
:hu'a
get_InnerException
qkBz&
- &* +
)^ou
#=qNzt$mJakh1Nxv4vDRDjTsa1OVDKMAlRCO__qncxMoXRz8jNE7AWvE0B4WIqANR1p
p=]0=n
GeneratedCodeAttribute
#=qgCcrNFC0iLB8hKTy5iNnsw==
#=qhg8oaKg1xx$HC$DKnlbXQpibwH2HXqMGSlGv30vEUsU=
PXJY
2V~s
Remove
*Il
/Bk_wP==a
]i`Y'o9
#=qi_z83UuaQZa6UsXCAahbTQ==
K`ck
#=qURIxMOG0HImwEP4A6zEiPg==
-p&~C
#=qTZGarPS37Dw3Z3Ipg_AFug==
#=qXz2OER2RItZOjngvYurWLQ==
a> <)
o#1
#=qSoHRCAcaypsR55EueXBy1g==
set_RemoteEndPoint
#=qNZVIIdU4QECigaum94nwLctVkDSuRt$X4_IjuFpWVuY=
lal8tF
#=qAbQ42UrUbGpmkYA2zun7Tg==
&&*}
k(FO
ei.z~D
#=q6V4Kle56uZFNUY$zkrrKJQ==
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04b_64 Seven04b_64 VirtualBox 2018-03-28 00:06:57 2018-03-28 00:09:49 172

11 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04b_64 Seven04b_64 VirtualBox 2018-03-28 00:06:57 2018-03-28 00:09:49 172

9 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\RATNIK.exe.config
C:\Users\Seven01\AppData\Local\Temp\RATNIK.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\RATNIK.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Users\Seven01\AppData\Local\Temp\RATNIK.INI
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\run.dat
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\Exceptions\1.2.2.0
C:\Program Files (x86)\UPNP Subsystem
C:\Program Files (x86)
C:\Program Files (x86)\UPNP Subsystem\upnpss.exe
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\UPNP Subsystem\upnpss.exe
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb
C:\Windows\symbols\dll\mscorlib.pdb
C:\Windows\dll\mscorlib.pdb
C:\Windows\mscorlib.pdb
C:\Users\Seven01\AppData\Local\Temp\RATNIK.PDB
C:\Users\Seven01\AppData\Local\Temp\RATNIK.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\catalog.dat
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\storage.dat
C:\Users\Seven01\AppData\Local\Temp\ClientPlugin.dll
C:\Users\Seven01\AppData\Local\Temp\ClientPlugin\ClientPlugin.dll
C:\Users\Seven01\AppData\Local\Temp\ClientPlugin.exe
C:\Users\Seven01\AppData\Local\Temp\ClientPlugin\ClientPlugin.exe
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\settings.bin
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\settings.bak
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\Logs\Seven01
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\Logs
C:\Users\Seven01\AppData\Local\Temp\Lzma#.dll
C:\Users\Seven01\AppData\Local\Temp\Lzma#\Lzma#.dll
C:\Users\Seven01\AppData\Local\Temp\Lzma#.exe
C:\Users\Seven01\AppData\Local\Temp\Lzma#\Lzma#.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\SurveillanceExClientPlugin.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\SurveillanceExClientPlugin.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\SurveillanceExClientPlugin.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\SurveillanceExClientPlugin.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.exe
C:\Windows\System32\tzres.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.INI
C:\Windows\Globalization\en.nlp
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\RATNIK.exe.config
C:\Users\Seven01\AppData\Local\Temp\RATNIK.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb
C:\Windows\symbols\dll\mscorlib.pdb
C:\Windows\dll\mscorlib.pdb
C:\Windows\mscorlib.pdb
C:\Windows\System32\tzres.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui

Write Files

C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\run.dat
C:\Program Files (x86)\UPNP Subsystem\upnpss.exe

Delete Files

C:\Program Files (x86)\UPNP Subsystem\upnpss.exe
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\UPNP Subsystem\upnpss.exe
C:\Users\Seven01\AppData\Local\Temp\RATNIK.exe:Zone.Identifier

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RATNIK.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5aa75839\10fdf3
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\mscorjit.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Drawing.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Windows.Forms.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKEY_CURRENT_USER\Control Panel\International
HKEY_CURRENT_USER\Control Panel\International\sYearMonth
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|RATNIK.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|RATNIK.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|RATNIK.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\culture.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_CLASSES_ROOT\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\diasymreader.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\4ecde57e\31d9ddbb
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\a054161\46043f61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\219e9581\29613036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\219e9581\26d59603
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\InstallationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Data.SqlXml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Library
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\IsMultiInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\First Counter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\CategoryOptions
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\FileMappingSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Counter Names

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\mscorjit.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Drawing.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Windows.Forms.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKEY_CURRENT_USER\Control Panel\International\sYearMonth
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\culture.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\diasymreader.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\InstallationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Library
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\IsMultiInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\First Counter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\CategoryOptions
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\FileMappingSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Counter Names

Write Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX
Global\{d8b94f54-29d2-430e-9901-e814b568b40a}
Global\.net clr networking

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
kernel32.dll.QueryActCtxW
ole32.dll.CoGetContextToken
kernel32.dll.GetVersionExW
kernel32.dll.GetFullPathNameW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
user32.dll.RegisterWindowMessageW
user32.dll.GetSystemMetrics
user32.dll.AdjustWindowRectEx
kernel32.dll.GetCurrentProcess
kernel32.dll.GetCurrentThread
kernel32.dll.DuplicateHandle
kernel32.dll.GetCurrentThreadId
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
kernel32.dll.GetModuleHandleW
kernel32.dll.GetProcAddress
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
user32.dll.RegisterClassW
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
user32.dll.CallWindowProcW
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
uxtheme.dll.IsAppThemed
kernel32.dll.CreateActCtxA
kernel32.dll.GetCurrentActCtx
kernel32.dll.ActivateActCtx
dwmapi.dll.DwmIsCompositionEnabled
user32.dll.GetWindowTextLengthW
user32.dll.GetWindowTextW
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationA
kernel32.dll.SetConsoleCtrlHandler
user32.dll.GetClassInfoW
kernel32.dll.GetStartupInfoW
user32.dll.GetWindowPlacement
user32.dll.GetDC
gdi32.dll.GetDeviceCaps
user32.dll.ReleaseDC
user32.dll.CreateIconFromResourceEx
user32.dll.SendMessageW
user32.dll.GetSystemMenu
user32.dll.EnableMenuItem
user32.dll.SetWindowPos
user32.dll.RedrawWindow
user32.dll.ShowWindow
user32.dll.GetWindowThreadProcessId
user32.dll.PostMessageW
ole32.dll.OleInitialize
ole32.dll.CoRegisterMessageFilter
user32.dll.PeekMessageW
user32.dll.IsWindowUnicode
user32.dll.GetMessageW
user32.dll.TranslateMessage
user32.dll.DispatchMessageW
user32.dll.GetFocus
kernel32.dll.GetModuleFileNameW
kernel32.dll.SetCurrentDirectoryW
kernel32.dll.FindResourceExA
kernel32.dll.LoadResource
kernel32.dll.SizeofResource
kernel32.dll.LockResource
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptCreateHash
bcrypt.dll.BCryptGetFipsAlgorithmMode
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
cryptsp.dll.CryptGetProvParam
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptSetKeyParam
cryptsp.dll.CryptDecrypt
cryptsp.dll.CryptEncrypt
kernel32.dll.ReleaseMutex
kernel32.dll.CreateMutexW
kernel32.dll.CloseHandle
advapi32.dll.RegOpenKeyExA
advapi32.dll.RegQueryValueExA
shfolder.dll.SHGetFolderPathW
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
kernel32.dll.CreateDirectoryW
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
kernel32.dll.WriteFile
kernel32.dll.DeleteFileW
kernel32.dll.CopyFileW
advapi32.dll.RegSetValueExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
mscoree.dll.DllGetClassObject
mscoreei.dll.DllGetClassObject
diasymreader.dll.DllGetClassObjectInternal
kernel32.dll.DeleteFileA
kernel32.dll.GetSystemInfo
kernel32.dll.CreateIoCompletionPort
kernel32.dll.PostQueuedCompletionStatus
ntdll.dll.NtQueryInformationThread
ntdll.dll.NtQuerySystemInformation
ntdll.dll.NtGetCurrentProcessorNumber
kernel32.dll.SwitchToThread
user32.dll.EnumThreadWindows
user32.dll.GetActiveWindow
user32.dll.MessageBoxW
advapi32.dll.GetUserNameW
kernel32.dll.GlobalMemoryStatusEx
user32.dll.RegisterRawInputDevices
user32.dll.SetClipboardViewer
user32.dll.SendMessageA
ole32.dll.CoCreateGuid
ws2_32.dll.WSAStartup
ws2_32.dll.WSASocketW
ws2_32.dll.setsockopt
ws2_32.dll.WSAEventSelect
ws2_32.dll.ioctlsocket
ws2_32.dll.closesocket
kernel32.dll.GetFileSize
kernel32.dll.ReadFile
mscoree.dll.ND_RI2
mscoreei.dll.ND_RI2
kernel32.dll.GetCurrentProcessId
kernel32.dll.GetComputerNameW
advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW
kernel32.dll.LocalFree
kernel32.dll.CreateFileMappingW
kernel32.dll.MapViewOfFile
kernel32.dll.UnmapViewOfFile
kernel32.dll.VirtualQuery
advapi32.dll.CreateWellKnownSid
kernel32.dll.WaitForSingleObject
kernel32.dll.OpenMutexW
kernel32.dll.OpenProcess
kernel32.dll.GetProcessTimes
ws2_32.dll.inet_addr
ws2_32.dll.bind
ws2_32.dll.WSAIoctl
user32.dll.WaitMessage
user32.dll.GetForegroundWindow
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
psapi.dll.EnumProcesses
user32.dll.GetKeyboardLayout
ws2_32.dll.WSAGetOverlappedResult
kernel32.dll.FormatMessageW
ole32.dll.CoUninitialize
kernel32.dll.SetThreadExecutionState

Execute Commands

Nothing to display

Started Services

Nothing to display

Created Services

Nothing to display
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04b_64 Seven04b_64 VirtualBox 2018-03-28 00:06:57 2018-03-28 00:09:49 172

1 Host(s) detected

IP Address Hostname Reverse DNS
90.190.23.204 Estonia 204-23-190-90.dyn.estpak.ee.

Host(s) by Country

Hosts Country 1
1 Estonia Estonia

#infosec #automation

TheSystem Itself @ 2018-03-28 00:09:06

Detected family: #Nanocore

TheSystem Itself @ 2018-03-28 00:16:02