MalScore
100/100
MalFamily
Malicious

n.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 21/68 Related 1999
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 286.00 KB (292864 bytes)
Compile time: 2017-05-15 09:19:41
MD5: 63b493b15bcb69ede539cca8357a2327
SHA1: 21932a78483fafac12999dd94096fb60ed82a5ce
SHA256: a577658b05b6a897ddbfc5d4f08d3b90e724020cc9804dcb6885fdf95e1f4cd7
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-22 15:45:15
Last submission: 2018-02-22 15:45:15
Filename detected: - n.exe (1)
URL file hosting
hXXp://betonsie.com/n.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-22 12:02:24 [21/68] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x46ba4 289792 ba7bbf5f967ff4b1b03b7582c210ba7e 16059cce52357ca45c20cb31c9008f06b549e5f3
.rsrc 0x4a000 0x608 2048 83ef4c2127061785a8f3c75c62b31962 8ccc79e6d8dda75a93df55c59a3549483eb9cf18
.reloc 0x4c000 0xc 512 e9f454ca335234c09ba1044df88af88d c3a8cf9730ce49d80e0809b3a874df4166f83d21
PE Resources
Name Offset Size Language Sublanguage Data
RT_VERSION 0x4a0a0 892 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x4a41c 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright...
Assembly Version: 0.0.0.0
InternalName: n.exe
FileVersion: 14.5.23.1
CompanyName: Company name
Comments: oviqewaxocopeneweb
ProductName: RealTime ready qPCR Assays and Panels
ProductVersion: 14.5.23.1
FileDescription: RealTime ready qPCR Assays and Panels
Translation: 0x0000 0x04b0
OriginalFilename: n.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
14.5.23.1
URL(s)
No URL found
String too long
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
 
85ecc003-6e1b-5f13
85ecc003-6e1b-5f12
85ecc003-6e1b-5f11
85ecc003-6e1b-5f10
85ecc003-6e1b-5f17
85ecc003-6e1b-5f16
85ecc003-6e1b-5f15
85ecc003-6e1b-5f14
n.exe
85ecc003-6e1b-5f19
85ecc003-6e1b-5f18
Comments
VS_VERSION_INFO
Copyright...
Company name
InternalName
dxy
Assembly Version
oviqewaxocopeneweb
85ecc003-6e1b-5f39
85ecc003-6e1b-5f38
Translation
#-Kip
OriginalFilename
StringFileInfo
85ecc003-6e1b-5f31
85ecc003-6e1b-5f30
85ecc003-6e1b-5f33
85ecc003-6e1b-5f32
85ecc003-6e1b-5f35
85ecc003-6e1b-5f34
85ecc003-6e1b-5f37
85ecc003-6e1b-5f36
LegalCopyright
FileVersion
RealTime ready qPCR Assays and Panels
85ecc003-6e1b-5f40
85ecc003-6e1b-5f41
85ecc003-6e1b-5f42
85ecc003-6e1b-5f43
85ecc003-6e1b-5f44
14.5.23.1
85ecc003-6e1b-5f9
85ecc003-6e1b-5f8
ProductVersion
FileDescription
85ecc003-6e1b-5f3
85ecc003-6e1b-5f2
85ecc003-6e1b-5f1
85ecc003-6e1b-5f0
85ecc003-6e1b-5f7
85ecc003-6e1b-5f6
85ecc003-6e1b-5f5
85ecc003-6e1b-5f4
061f3861-5909-bd
VarFileInfo
CompanyName
000004b0
ProductName
0.0.0.0
85ecc003-6e1b-5f28
85ecc003-6e1b-5f29
85ecc003-6e1b-5f22
85ecc003-6e1b-5f23
85ecc003-6e1b-5f20
85ecc003-6e1b-5f21
85ecc003-6e1b-5f26
85ecc003-6e1b-5f27
85ecc003-6e1b-5f24
85ecc003-6e1b-5f25
\7kB
iD(dU
[5Me
M.;|^K8SX
nhN)2
wuXy
|zfh
LC&t
dF|
*
ctHI
z-Sqs
1e7o
Vt_QXKO
~3La
WX}#
e	`r}kW
CSNA
?e=;
PNG
h'@/N
gnP+U
pOy[
MG6t
B@\Z8
ArF+F}Q
T,4
SeparatorPaintEventArgs
Vj>%
y{7%
Ei7k_
H3bg
Zq9=
(Ut
|
5l})
TLHN
tjx+!
uB6#
+vQ]
p}3A]NV
.<e)x
G\v!?j
3lR/
09:
7HGJ
get_Height
-J5
6
P.8$z
PKT~h
rY.a!R
AY/9p,
g"8A\
(BHBW7
Xp|^
(o][;f
Mt-yb
}~,
9J`f
fQyY
;^<y
8UYIo
LzP@j
uH+'
A9Y	x
V8^
<PrivateImplementationDetails>
`57X
lg^up
textBounds
_]uZ
QhZn
Q"A
_<7k
;M'aY
^y=f%
UZ?
Nmau
^v3;
-VK7
l})_
hHO5F
4iSB
JMW-v
,YX
1e>L
_ai?
=
-I"/
t|U\_p
"Ii]
6p]
0BAm$
WX}%
`?IF
7
d/
}JV%
yFhH
"wvV[4
wG,6>
\=/}
Ljz=
u%I:
A*8;q
,vy*x,
Le4s
be
,$
rIDAThC
cIFv^
&b~6
zv9i
@K7\
\)Yj~
HUKz
Wt9dj
D"M7
B{R
get_FontHeight
c2Ej
Iz{"
Q]	|
u	2&
315
1`[v
4j[&_
oh\}
b,-_
ZL$&
6N
h
RuntimeFieldHandle
OgO~
T>w]
1#8
h;s:;
{b
S
'd]^
`0 %
~*)U\
]7t`
e\<^M
|>%*
j;}*
cslC
kk@%
'wE
NMF`|
hY6
]$bk
ZrXlJ
1KVf
lH;"
[w}U
Wc"J
get_TabPages
E/+x
Dv6cmG
$
6;b(N
Q1KX
AR?>"jA
PzF  Z<
OS{Q}
;.-q
(dR?Ct;
_:S!
l
5T
z";V
39|o,<{
D{H"
T?Qn
b"_^
%9lu
F7Hww3
&HT
Math
Jb?|u
oKQKs
vUIp
!oQ`
NQt8
<Vl.
.%D*
<An~
OnMouseMove
aui?
ziM7
joiw
set_Alignment
dc<w
YrqH
AssemblyCompanyAttribute
/Kx?
7zn=n
MI|-y2
Rao-
.'#$
!8kg
KZ%P>f
B
p8
at-d
q-%)t'
h
#E
,=x]
NVf0t
hPV
z?k
jF
G
mCr$S
c06@
W%
d
9Q)f
5NOu>
siz5P
QH1>
VH%
Enumerable
NYMn
\MGWW
vj9eI"
x2KC
T!p{
m*5mP.
AppDomain
FsWm
Z[$E
HU);
.]mVuc
1^7m
OnPaint
a
h>
9X(J
72_dS
wYP
+1Qp0
M'cg{[
QvBP
.NdzI_
0YQAb
bJH\
PaintEventArgs
foJ%
vR'`
)Gyk
!FsY
Mqs^/
R"{]
xAs^
"X.&Y
$-$fkSV	l
9rVLW%
KPSR
RJ"]
\WE:
>4ODgj
U>QS{%
Q"3e
$(:E
'U2Fq
(rW]T=
~|5
roDb
._5(
DJT.@
lTPAz
<3CEDC
jA\}2
vq+J
?{a$
a
aDb4}
=<P=P
t9~I
17lfH
z)f]
zykii
Mbqj
WZnZ
lUlP
eUha
#X29_A]
!svX
<S-\
yWSc
)Io<
jE[n
~Afs2
?'Xu
AYZQ&
T	"2
p4Sg
\uG
{4b#
(McB5-/
eKTu%m
XY'd&i
N;9&
7'c@
[dDl^
Rm M2
}CAbu
R$?<
:*sM
q#f$!
\V_ac,
R~yr
D^DP
;&$q
+Tw]
6jI{
uikQ
m(L"),?|
HfI
5RAd
Vi:E
P
+>(n
1
g*
7KSop
"Hl1aqn1y2~+
Type
dH'z
F|[G
_P#j
\>z,
\A=$
Wn)X{~
dNnui
DQz-
">?T
gW1%
System.Text
|ZrXlJ
-Pj*
k|)`
-|]C
%
I=.
G3GE
E	h!
"S)*
jm!ik
imsh%
cPg/
hR+6H
nRE?
>a.d
\.7;0
f7<|
-{Xw8
$D3C
/SkIgZ
/,Mg
~lzG
|R(*U?
lI]Cl
Char
q[Gl"'
'{I^
MY#f
k"
5F4CD488B6C62923B122E22D4E77F8AF79D83C1D
/t^$
l.b)q
/o
G
.1D
;p>?
Fd+Q
{dI.wp
W]g,t
G&v\
A:&5
l3O>
;(BjJ
H.f(
XhX80&
{l.
S__&
_h)N
rLU?
`Z-&
wy5
-
~~
Y7$[
$L*g+
.
	b
)5YN~
>
r>
qk@5
9y[ z
>i
V
[	Y2
)4;t
rhXG5
:wyNT
eP6vC,f
|#4K
Cy/d
_D7n
D^q>"
1R&
MWjD\
KS^,kI
G\j
nn\x
)ZqX
#yf%dH
4brm
Jiv#x
]$@
	t\^
psIt"V`
ygxT
- C#
yq-7
-x~Z
QK*
Ox],
WrapNonExceptionThrows
d"BYv
8-7n
kGzi
1<
F
M5b`
g:?K
s=k?%
U/6;$
.text
'wyb
%r[f
=h;P
k/O,
xLj?
-PF&
h
i/O
5ZmW
<rSFw
&DUS>
Ev^$
6G9B
,vk5
_Ryp
})J~
nLQC
yT?V
B(tk
iFQ/
d7mU}
H*~S
System.Reflection
wj3=
rA7v
b>$f
_3lcC
m;Gw
_bA\
nxUM$
klG*
!tfp>
zDg'
5fUJ
F>f.?q	Ha
iFcl
q
46$
3;^n
<X
2:
gQ>w
b>}S
R\O^
~Te$4
iZb
~}U/D
U(#{
V:y8
Y4O-wE
TZ;Ik
%Om.-"
_IT!
F9v?
ko"#
Ff	K
+DzO@
TT.!
7	>6%
m(]h
q0[00
LE;;{i{e!V]
t~4yPC
Ptk_
n,&
EKO
G-xg5
X
 J
{V`G
37k
dZ%P
F8`]
1,NY
sBL
gy(k
Dj7G
T{T
cXve
qotR
xOg%
^2@u
5>
$yA^
,vy*
HAJbs^
2sRIJk
O~u
`.rsrc
~ZJh
G4C]B
BoundsSpecified
get_Y
,vy?
/?[]R
km]u
iGZq
XsX
lg&T
5
ouO
z
$q
F9v.c
Fsc^;
hXhV
>e)S
6w7ZEB
6!~o
+K?(
Ma8"
bV(ziI
\ hK
}XO,
-Tu"
ox.hc
matemdeea.exe
QFBIE
5yzj<
Qd&G
<+/
pHYs
kJ8,
bfik
Febt
-ADw
PB!vg
bLrJ
chKCz
Bq-s
#M/hv
FlYY
leL>
#2
.
matemdeea.Initializare
Pdx]NL
@i!t
4TWV
5i	u[
ix	@N
vXz,1
=l?x
Wmk;
MQ{G
(j_5
/oXI
4R8>
\zNE
e_WB
nnS-
Lj(jU1
FsF3
sVZHX
G8P^
+-L|
eZQM
r22Xg
V}FP
Q;/u<J
,vy.h,
hdf%6==
hcECV
get_SelectedIndex
e^I9
"=p^
TB.C
)8IAz
(leb
KVM<
Load
A74AA0950AD5B451848A01CAD02092776D92775A
Xy@>
]tAj
k%A.r
F
Bm
eZ_
height
 dD
mQRb
FsWe
eKJaN
eKI7
]4Vd
QT]&RBL
uH"Q
~}
.
E6
=#AMK,r
JT0pgZx]
=z|Sf
#z8`
Ox#x
^IXN
+@61
n7\.
;l\x
: '}{
{Wbo
V#Y-;
l<V
Y
fYMD[
oA1{
Iyp|ugX
CaN1~
C~;q
J,9{
`0%T
5]*dOB
=O'2\
9 Y%/
]$ ?
IMTUuW
ZK?A
;AC
}!DBt
get_OverIndex
P _$'
n^Z:F
[Ficm
3l^&
M&J
{Fm9
-zni
nk_
SZ
~}
c
Cg{&
%;P2
J1
p
CIC8
yi5k
#*)zlW
QS@#;'*cKJ
u`]^
dk0
:^67
88X?
?1)b
D@S(
6q(2
&T}#f.
g[DuZ
rSFa%
]5v{
Ja&M
4=89v>
B
-3
I!wq?
MfR}y
^q2
*{-f
FY-
et_q
x_Tw
&[wB
`8C~
get_Assembly
\auD
kx$E
BTpx
mZXOp
ty bZ
hnGm
{6'L
wfVn
8r^J
vm.O
*!+%
d*ra
P|3F
^pC&oa=g
Nj*0
]W'F
C99~.h
B
^9F
5;E
7
7\
np{
.BM)
wkNa;Z>
$NBg
{R%5
it:cxN
7W:~1
sUbK
$"E c
G*[D
Invoke
r-%^
IHDR
0][kr
o(Ov
B"UA
+
s=B
ca
"cccjh
WUcu#
NC?~
blAa
mF]~R
IvorLL
RuntimeTypeHandle
:N$	]N
?-C]
(d16O
$Af%
bF`G
Console
TekEl
D;j(
'+&x
k`Qo'
E_=id
L31Z
G"1
$/?
cXg
_S(Gbf
@gq?
IC@X
X"Ka%
beKY
gMg
HO~
K#?i
%`zf
qtcp9
$`b
~g	3
#T8J9
Dyz]b
)&=oD
^Ha7=Ebw
"+	Y
Hti8*{
n/e#
`
%v
\qXZ
,inC
}T2_
0]QAl
muQ@;
HDL*a
FC<4
o.6L=i
Foet
M2O]
#8SD
>4"+
RuntimeHelpers
Kx.%qF
RDD"
'{dC/
|}jQW
System.Security
VQb
&
L)q
; \
0]QAr
`d9{
v)tZ
lA_i[P
YReM9
"-?X
N
Ikk\-
TSJuiV{
.Pd)
+Kd
A$f
mx=r
J6
e
)XH_
^Q|*
&*8h
&*8j
&*8k
b`SG
`8m*
E0mvf-W
;q-k@
!9N
JS44
-u:LZ
{j#N@
EventArgs
l'>K?
nJ:;
29+$
_gbv
.1^
{RKz
'Co>g>8z0X
{ @bh
+bEb:
+CP'
t^-Y
D/PL
{
4/
s
oa
qjgXv
)4T
nl:n
9
AV
iwA^
1n=l
Z4|J
P*~{[
11&N
d|9!
TdzS
QG~
Z/~%
"0"E
>~}
JyC)
Hovering
WZxV:
x@k3
<Uj
OtZ
y
xBn.Z"
oIDAThC
'Q7K
oy7Z
d|3ao%
(5<Rk
J9t
HVKBL
Hvl:zO19
A6
.J_k
'0N4
K"d13LO
KZt"
KIhd@
:yJph
q\ly
|Ic'A
ocF"
JMo+H\
Fa0{
!'|xx
.B2|E
y*_Y
CtAm
z'EqvcE
XGzS
nVO A
;
rS
CD{
.R20
w|csK
^S\
EOnER>
ZSr_p
dD9K;
-~t7
qr3+G$n5
k{u?
x
|'
/X?j
V:-2
YEhqR
>FsUG
FG-G
~BX
Fusl
get_EntryPoint
J|`*
|ao[9
yo]IH'G
e{3)
f~12;S
!
sV7S
NQKkI
2jIU%
B&oH
3f9m?
vo9:/
fn87
t,Pbi8*z
System
`?
e
^2eA
U_m@
VhfY
g(7r
K{_7Q><'
H
s[.Mz
}(9Fk
a;/
(7.z?
b2qa
R<yV
@~?
qGqW)
0:Za&o
yrB!y
:2U7
CPBTE
add_AssemblyResolve
;R{pl
'vy*
get_ShowKeyboardCues
HC>"
8oV
L\AVJ
,FoA|
`f{3
99m<
pHZ=
r}(g
%.iIr
b
w^.d
v\|i`
6Uiw
+@	E
42fY
g\{W	JW
z?"k
G5X)
nk#
Dsen
D 79
o7A&Q
|7&Z&
%e9V
ViOp
/5LE
X0='"
;DF4]N
Y'v!I
MX{`
dmL{\$
TabControl
W,8'3
oUPpz\{
j3gA
Zj7S
PNITe
eqbe
R3Pb
u.-w
5}Xp
jX)X
n
^
R/\4pW
f j[{
Q$V|D
iy!cP
{~X}g)!
^+we
`u5A
<Z4!
Sb#n
Color
Ct_W
fc:H6%r
z^@\
System.Collections.Generic
O_&,
^x.,^9
set_BackColor
~=D4
`k;N
k71x
?Ey<
1	X
;!Pk
>.1
zqL
get_Width
VimS/
n6ZpY}R
G tWY
vBN
~.6;1
f(/A
i9s|
[&(H
Odm6k/
OTPAz
|r`8`V
6RgQ
aPGo
gXa^n
+1.C
Qh+Z/
Ag8
R^qwQ
fMfi
Vflz
;gp-
yAb-;W9^'
:,>a
`N~;v
N$XU
XWc1.
lSac
}'TSt
1z)
(XhR
}T9;
BC/w
MYk#
tHLS1W
(8YV
#v?O
@AJhZ-w
o5)L!Cl
IV_,,
\29o
Hui9*{
Hui9*z
rd.D
?n8n
uZFs
~NAV+
>Ub>3
item
,;o@
Ew6m
L,k'
d%6<
,lG
e'Y8
7zE
;bzO
1
Woo[@
$SX.
E_>A_:
P>-}
]@iL
+=[D
i,x|
]m[>7
|'l/
YJtvTW
|+l>
EZiN%
@qA(
"wHn
;&Nx
tww7Fz
.(Mk$,
}b=1H
n&HI
J~{o{w
m*?_
Q=lH
/)68P
System.Core
WBjD
CZ`p
rNWj`
R.4{
TqI
7*"#
-qT+
^
Z
-,WI
fE>t:
.69
? 9YB%
XVOh
x8^Z
Z	X~[
e/K<
9|TmC
ensn
&1kC
3@nM->g
C7y|
){wc
GuidAttribute
QmJ$
TIn/
i Rk9S~W$#
EfMwo
f9nA^U
V`:S
nePuu
NX#Z
,hqS
3I	f
^dMk
U+Kv
'2h2[v
CSJE
RehR4
3sZ|
J7Tee
Zwet
`VU
P uW
]	)@
4MTQ
OnCreateControl
.V;j
&{<U
\n<t
Y~RI
_>38
[mNE
4f/5
)Y=AF
MethodBase
fI~l0
_ObB
]?O~
s9%?+
?F&~
XYa1
ControlEventArgs
IDeviceContext
_l:f
N}O6w
(?x_]
mI$7
6XH
M`zU
!i.
J.C|[
rfgC
D7@s
V!c$ur
g%UE
U5H
WXc0
K*Qr(_
JDg8z6
f7|I
i(pe
@cPwj
^ajX#
FqJ\^
'V1s
So[N
(a
E
#]-T
K
x4K^
O5G`
Contains
q<Mig0
mO
|
hg~9
UHSB*gy
tD(U
IEvidenceFactory
3J"L
?6;3
$FT#
w3?#
K3Fs
N?o
ValueType
DRow
Bz9
vxT[U
R1*I
RreW4
9nHXT
PMUU
`A_
&m.c
,tyga&
x?P9
e$"m
JBMI
FXWX
"_aS
jRI.
System.Runtime.CompilerServices
IGiS
-@=m
4Ttq
value
:?Y+l
q}x,R
+@dg
get_Count
xDy4m	3
DsZm
`Vs
1$+O
ke@"
Satvx
Kix!5A
,lz<
Ruc
wsF"
@|H#)M7
Mw~B
KW_F
N
tGGh
Ej>X
\Ks~
ButtonBase
;bg02I{p
W<r;
p0R+
o
[V
gf4 '
[o\J
~Qw2H
'PPc
ZD5a
IEquatable`1
J&1G
pZrs+n
k]5+
xI,M-2
v[wE
{gH@
2|^F
)xo+
{@]M
'NS
')Yqa
ss/_
j+(!qx
pZ#_
!9b0
iM|6^;
P--^
ee0;
0gXS!`_
Xl~E
3vx3x
<&#A
+p}5
GJZqW
"HEV
84~:
:'DZ
HH<c)@0]D
+f6h
pIDAThC
ICustomAttributeProvider
.6;?
|YkW
Mvz4+?9
p9dB
keAf
#[,"5.
d4;~
\:c
]GzbB
s\He
tm<2F`RE!
3
5X
fvL>E
2U{-
p|>*
HTi"*h
]35
_ap?=*
jJ.pJZT
sg{BDU
R5E
Z4#i
K[*_
Y
`OA
5.h8
ZYh
"%F&
,h$6
Dt0F<
@tZ!
<#c-uWM^
v2nG
"M5
ur6
:Ep?i!
!N=p6#
v[:
GetTabRect
1hh)
,{y9
J7|x
nY	&K
_hW2
b.7f
n 5T
0w.fT
ioeZC
F`4
D(!Y
&%+u
Ey.*
){w^
(hA}
t.-w
ArgumentNullException
t`$r
WuB5
#"wlD
AssemblyTitleAttribute
W-Zl
Dh7U
Z
ML
CgD_O
03z)p
fs'Ni<
c69q
'[(}
'I2
)osSk
Gw{6
wTy+>b
Ok=
Hui"*{
zZBL
B805
'wC)
iP:G
}Q#o%
,F/aJb;
dnzH
Q7MgS
xy9%
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD(
kNiqp
[	Y2
roX[
09Rw
Pp!,
WrlNu
)a=SL
I(Rp
5{mQ
:T>w
u(B3
@UBh
JEP=hl
/T
PY?xe
RRcFld
~b<mR
stAg
*B/<
r+~1
(Cs\
@H3>
!#	f
B&}i
get_CurrentDomain
Data
4DJw
L2[K
RA~S
(
1;
*Ikb
m:59[H_
hTQ6L
}+L2
fP{
MintSeparator
)z#RI
x/jzL
.a6KR
TT3{
;bkk7
0]SAr
. G
`>cGS&
s:"W@
He`i
8C
viF[
6Vqj)
tm<2F`RE)
IH``
.ctor
%$T)
df{8
"9,_8;<
tkc|
^H/O
get_TextFormatFlags
2RG$
xe$a
=^
,
61(:
+M	E
OPL%
G_T
VX9"]
%mUK
S%zBD
G]
&36
 ~<
U?Rh
ilh?Ch
dHJwJIH
[Ii9
h+;]
!J}7
`n8(i<
W%pQ
get_Text
Bm[m
w;s6H
d"sd
pJv[oQaxU
He'Y
t^?
K$
^Dw1
SetBoundsCore
F]r,
K9*0
tVf
]
{t
.
U
<NLCxz
E@vo
-g~b
x_;\
s'-=f
=5g
Bc~lWHTB
xnGw
CC*ye
GetTypeFromHandle
8rbmg
]LTQ
A+Zi3
c6`Q+
OBg^T;
Z}t
x
!ulgA0m
nc\
OJKR
{~@
Ejb|a
+K,EM<Q
r%Wc)
@zH<W
Array
J6g"
width
*ea+
?
u"q
ozm_
s1J'S
8?w[
A%Kmz4
]~}]
E3aW
@.reloc
&(}O
y
E,~%
d`IV
8GNT
')G|S
V
s/2mc
eS\T
w
_cA)
P;"T
p"sqc
fk\1
Rp/P
V6S8K
6*3i
R;	>
lW1n
reB&
TabSizeMode
br%x
LIA/J
z3(EgR
gulz
/~dN
`[u}
Cf28
MPb[,
^J&f
/]:S
)r m\
o"}+'
t,:d}
H)RQ
IW/9QZ
,	iu
e Vi
+oO-=
UinE'
Ak{o
I+gD
0_.36LO
,|}dd
QAxe
9 "!
w$9x
Z0$0
'jp~
"|5]
y9[3YO4
_[kZ
F`+=
-E7.
h7xOo
BWSi%
a1=gZb
%<IkB`
(Mk$,
yS<~
)l!/
KenlnZ
q(Nre
Xvy
4"M3
Y8P
j{3V=
^,!
Y8_
`wSJ{l
U,S
[.<-(
k(M{~
g A
Zzj'
get_Location
Fe&#
label
z~U[
a_dt:
VatkD
Y8z
-FI
EOoV
Pgt
3
nv'(
fFvq
nV#5w
YHln
S0Z u7h
AssemblyTrademarkAttribute
5Id+KSr
M%Ig
-^JU
y#9>Uoo
gFh?	>
IKQRFcLC
/,>
3}a9
GrOe
7=!_
,	Jf
he&v
;{p0X_
VnIG,
$%M
D7M
ZEnFl
!DB
#*[^
H6^x&
b09R[a
Y80
-g>[
kx 1
Ue;!
/-@`
<}^u
jA(.
|Q8q
>zc/{|
wVwD
N'&<
?h^)
ACi)"
SU8b
%Enc
.'i
jkAb
I1=W
xwmd
Assembly
tRsI
1>__h
wtPD
K!S6B
}VuA
^h4a=
9A5
_#A(
KkU;;
+
s0
b?$3
pP\)
yofG
x6*T
IDisposable
TrEM
gfM]
?	7#
K=E7b^3
;k?7`T
(Jk$,
x
_~
OTd{
tVI
/@
"[J}
MU~Fi
qyb
ga
Fs
%+,?@
get_Size
j//Srhn0}
:*#)
iQ~e
@i6*
m^
L?I
G#
Mk"?
g(Oc/
?fV|
KUGIc
j]TP@i
+d1*
%IXO
"aAN
Y)E#}
V,om{
D
z\L
7]j1[
AO|=p
Size
S4{mo
9{^M
\F!E
,
lg
Z9'H
udnN
6Z$n
I1veeh
a*(J
"'92
!!ZH
&x'G`
r}HC
l!Z}
90
Wyjo2
{u&&
Wp0#
qy}J
MVE(
@N0y
QY]X
v,sF
-yL$
/
9[
Ew6I
mVuoL
Ai$?
2}v'ED
~J~
op$^u
'YG-Ud
;TW#n
i;al
/OkO
za]Z
HNzc
"|~D
Sok+
B/p0
=j_F&
*MT8
)Vn"
qvH
MX-V
30663199D3AB07B78A8162ACDF2B72649EA79565
3vc
`crS
Us
0&pE
oBPAk
$=XeIzuSS
;
e+
@?w	~
c	O=b
M`UP4
;JIv
(_uo3
Zzke
In+y
X
 v
1E2xQ
:<qF
vxQ
8e
p%*L
15]399s;
rDp7q
pd8<Od
J)d'
!j0N
0K!v
r,EW+q
X
 P
XNeL<z
OP7
=Bn<$
Csmb
rT){
AMcl
GtG6
oA=y
WYoB
N&f:
U`&K_
#Blob
Ykn{
(
;<K
)Y?0
u}@w
caEX
X
 2
LJzS
BC;$+
f9mA
)+)@n
X
 =
f99A
a L[
W,%&
07T9Y
^K%ll
:NA1
Xznu
p,Vb*/
8.
P`B2
F	Sc
pyh_
u.)
h`~
e&\w
RuntimeCompatibilityAttribute
6LM;
>~a
0
Etx6.
L:GA
-u 5
aNc4x
yy]2
caY~
}[4.
G%e`
X
4oA
m!HwL
vWpd
b9@V
IDx"d
I(ni
`WzS
rY`z%~1_
nWV\xWS
'tp4A!l
j-Si
4KT|}
specified
BNg
[75>
2B4F
e)-)
/a]L`5%=
Y.*p~
]QIr
si\g
r
:#
.ib
&E}|
'D>
sN	X
]Hl#BML
r;Y!
XGI
(Mk%,
c_3"
\4O	v
R`W(b
|I2[
*T-i
.Kem
1)\N
,[iF
6K4v
\~?&
QSz$
g~a/#
&
)T
SkWU
hSs!
`8?\~
8Uw1
0d_=7.
1:l[g
E&tP
LabelEditEventArgs
6}&I
]4_qA
U:5*6
set_X
KnzC
n}PX
1z+rAV
,&oX
?9U
TopTabControl
-"\V
2:R
dElX\
Zc3
)V=yQ
Y
8(
Y
8)
=C_T
o~Xup
Y
8#
So<y#
fB+6M
COR(b
xw5\
}xs.6?N
09	6
@~ep
l"$l
~)7
Z\SOya
TextFormatFlags
k~k4
lDI+
MB0n
MOkja
W-9}
V3kaA
|3X
G
c| =/
`$9]<
0
!
PT#14:4
Y
8}
r&MZ
rvY$
/hGr
Y
8j
+uF2`
CNiD
EWBT
LLA9J
?!3XZ
?,A7?
\(Ma5=
Y
8d
w.zu
1PPm
%zd$y
J}Ng6b
/qL
'?o@T
Y
8S
r-;p
xb^
Y
8W
Y
8U
Y
8J
DCV^g
?r/0
Dau(P
%A:lmD2#
?)vY\j
b"G\
Y
8@
i;+/<X
p{bS
Ysm3
:wic
Se_]r
4SS{
>s6H
vLG.
y_ 8o
+0	E
T$BJ
]*U
zu&r
BSJB
H%S`y
S:p+
x$KS
Qa
j
q~[2
)?N!S
mas#
p&Qu
Cm"2
TN{D
`ZG
E9)-
_9o8
)z7Z
5/{PF8
GiLt)
U
2P<5`
xVOP
Ms
(
_ai?	=
)TI0
+"zcLR
H"#!,h
]dIH8
&A>s
m*<k
(/)r
Un)A
(Lwcn?
Tl~
G?ib
mjy
PP1R
D]nWE/
4KC,W
\"M_
[S
f#'*
Point
0X9R&
get_ClientRectangle
eN+ie
ia+(d
gAMA
tHR9
GwwO
UK'Wi-
Efz;
jpIP
4=Lo_-
d2(S
'%PM35j
Tep;
:UZ6h
^bBi%,;_
ua
z%e
fyZ%
'WJ
2Y)&
MarshalByRefObject
K_H>m
dvP
L\4U
5hQaU
*`e]
.cctor
^"32
HXg-%
Rts6
9F*2
oTZ^v
UoskX
V3_*
4E$
#t
Fd5
Rc9
CVSf
}T
_d=
tz|e
N9$hv
sSz86
}e8<
TS0[O
{~6L
G!^,a
t_k>
Ky]O~:J[
A2w6
D5<^
W#8SB
Wi!De
zZ%^9
S+D:%
,91:
7(Jm
;x*f'
]1Am
Bnq.
jAu(
8Q?@
9;.
dey&
?5}-
C3!%y
>JM
3[`=
Uj;J[
Id>
Kn}U;
+MDX~
c5:`
^UU\
?P?-
`R[5S
=tbd
2	c]
Y
8t
k(wE
?.L3
.m:\;
<M9tm
}X{I
rvaw
;V$E
&I|W
DLTs]
q
u~
6+*/
{{^=
AcK>
io@L
e@Z<
9)~ZWk
_&O>
K)$q
y@ZN3_s
/y8	/
8	J
^
Jsyw
e(d"!
:I
!
o`q)
G.~=
@a
i
crfbE
oGRo
re'k
WS^\@
3zAz_
]#Cz
yr97\n\C
y\dp:
U
~Z
6aK*
Vi:9z
s/UM
OverRect
#
m-R$?L}
8J	1;&P
D!E/0P
CLLs@
Append
|
4f
gEjk
ddu@
X@`(
HEB_Xh
79m(
aNlis
)~q}
VqK;
AbA{
Incarcator
,^\n
$-7K]
,6jsp
8[t"
[?diH
56D155C606EA313AFF1DBAFC75907739C475F299
>*Dsn
b>J+
xJPAI
3-
*
AwQ,
ySiv
+2sQ:
]aTS
zN
%
{;@b8A
!n#M>
%Z	X
mZpB
#jA:LYO
PqPB
AssemblyDescriptionAttribute
l;|
$
%Scz|
Cdsfssrd
~gxh-
z4>Q
]|g?
q.u.7
I3E<
Y0zv
=~;p
c*SRI
tau^
p
4
T/{
>rD66qf
)ao6w=
J*4Y
^|F?
8{ey
TcZ[p$U
-[pdT
vjy
Vt]jq
oTQJz
Si
D
OwLV
ogrw%?<
=7XK7
?>V3
c:}7
bJ,=
:	zB
C]B;
<Jg9
::t[
ComVisibleAttribute
cdAf
LayoutSettings
=!=m
{<?e
]w^]@
r'mg
$7v f
1e-3^P
hf[Lr{
eidB
W_;2e
}!bN
's>m
\M@W
}fUR!q
i4X.
(
r6Y'
%ElN
3_zJm
	//D
yzL!%c
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
ru+B
-<?g
F7@S
N;&ZJ$
N:uS5
WefF
alc }x%
"M's
[Z}55
Hh>@
<S!OG7n%
R{<xq
[:NXtu
HjeC
tek[
=,F+j
poJ<
z2-JL
get_Message
!This program cannot be run in DOS mode.

$
OsQ0<*05
2d#K!?
Dt2.J
S_?%1
_{k
)4AL%
U+7i
X:_BN
^eiy
yWZ
5oOZ
V]M
L-=}
.>J
r\o>O
1g-X
9G.k
Ke
OX\]f
yX$
HG.
8;+t+e
G8HL
\4WH
XDf(
JIf
G'
&r[z
rnpP=
N#,T
W-HYh
+HVK9
YRk{
4F$
],_E
FxX3
mT3\
+D2z
X&r'
bdTc
:;
NM0`+
$SSk2
4UsA{
6qi9.[
x'OF
PrP
wZ?j"
dWN=Z{}
XE<s
M.-w
/1b3
a
IL@&
f
\I
X
lR
^
JKJ
,]Vg
mT,t
oTPG~
.NFg
|g%g6Ix
2,CJ"
DUyQ
Ydv#w
rP~V
9'Y+-
Lxtm
!< y
matemdeea.ControlFolder
jTV&
Eg'Z
/d^r
|xBr
?cg!7#
%4h3
@
urA
r19k2E
~Hvu%
k@,h
yrjf(
m	/c
}|
i
2](o
Y04y
7"U83$
< C*rw
MeasureText
2lnVs
Bygp
HwC[
lIDAThC
H`j?o
&NwO
Kvv%4
_0
%
WAVM
;G#
+WqR/
qrIwxc
:lK
Bs:U`zBOov
F5~F
,aMtf
w5.'
fb{
K)iU
q]@U
^b%}
xKh"
Sbon
[G^4
%7%
O7P
l
Fx4G
p3vO!
!28J
Zj5'
Q+z`
z6^s6k
Eg6C
m:''6
%xIX
K_8X
5aZ%
.y>3
\s9K
Xb9r4
6#d4
`
,
b
E,Jj
_am?	=
Hui<*
4^V}Dt;NY
#`>;
9COp
23pM
wE<
lo5N
TextRenderer
328r
&D|\t
ux(I{
wG.9
~js$
System.Linq
bm65H
TQ?\
=-^E
PiPa'
cYMqU[?#
+#0Tr
Ma5j.
7ZW{}
j'WV{
f24,
InvalidOperationException
u']'
r+
	u
s0\)
g_pe
O
l
;T"C]
3lmGy
FoIKlj
"7M*
e~}	L!8
eGv	z
S[)5
(Vz5
^INhF
Iar5
Fxt|
&9Jm
;%6JR
;OkU
h;'s
<B9mC
SZ:N
]{\J4
n=*
=?PM
7lgK
bP)$
,A @
_zqB
1^#D
'<_$r
MnU'&U
#(Mm
f;#u
}Oo
DP#
sx
d
FIV
K3|D
9Z`)t
pDC.^
-cBgnY
.ov*
`k1:
b^_F
rL>&M
z}2A3lB
,o!T
matemdeea
,tJl
KI/<Dq
=rE[
:4Q]
?/"z8
(PgI?
1k52m
.[B^
Gsgq
~yq
xzh]_
`LEVtt6
8;],=
zyj[
=Dax
7Ai2
`0Hu
svd&
v9|Sc
ks'L
z+	Z
'gT,s:
_`>y
5pmnH
+eC!
<dh:J\v
|20#&
+U/54zt
5wTt;
-OC:
`SF)
qAaSu
_KVK
]9\2
OnMouseLeave
3&SV
e
8nW1
C
8g
@2IB%
G5Wa
J%o>
Iwn~
g9s}
get_TextBounds
?Y l
oO	$
g5_0S
u'c|
Y>0-3
PPA~
#W7;
MethodInfo
!p*f
fz s
)gL(
A=;
7}[y,
Qie(
CompilationRelaxationsAttribute
32)g"
r8]2
9}R7h
+O6i
1-Tga
IBindableComponent
KG4*
%"&:
5z4
q(uI
doz~3
VdJ(
5B=ipX@V
P9L
Y?pI
<An}},
get_Graphics
bqr2
<:5y}
o&i^!
A#rk
4*1'
K1gJ,
P{lM
r9=q
{oA
G3^`
,	U+lp
,z~f
{cKm{
b
\S,b+
`>pF2Yu
LLA;JZ^
\k]_
w]	u-
`&?
0yC9
WzsFC
g>"WW
jW_
A01728AC7CB240F8E599AA569A1D4BD25D7B0F01
1Gk9
Sp9l
[`=e%
AgR>(:
{?-)c
o4Mu24G
EI>U
Gq%E0
ey0K
X
 l
n\k
StringBuilder
Zi9r\
MT\/
Control
TzX+
'Ctn
h68.
`u!n
$*8
9LLLw7
_am=	=
z.=X1
IEND
}0
C
x=R)N
^$sZD
:e}U
$
=vc
{IBKJ2
!N"
Iw?ZJ
=K(TJ
_tja"
M0;l
E% =
>pd
#6;7
pp&
tT)4
+"
8MYC
`u_Mj
S](0
>Fb6
(|k.$%|
u(-?
EL5G
~d@3
H2KJ@
O6Rr
HQc(
EN%p
2%jq
matemdeea
Z_C"X
(9oi
@C}bl
U.?:
P#8R
Rectangle
JP5+"
$
g3l
2GX
9LPH
ru?b
Xqr
get_White
+L3$
(|I
k'+g[HU
2y9E
.&F{B
hRT
yQm$>`7
)kjy
Dz=Ui
u"g3Qx
NbH7+
z&|T
Concat
5	A2
,8HpI
-I*:ee
[%:w!iX
UDnaP
e`eU
ctl\H
8qSc8mb
+	_pqIr
jgv<
_F~
k2+%S
5(Y$
LLwww3
2Bdda
.ZbS
=x3}
R5+
j,2T
A?+P+K
fj$Eh
:/	F=
)^QL
7%Wr
_t=c
v;2
\|CB
z)G*k
BaseRect
`9iF
46Hj_
FF<k
z_	hI
Fq`ey
x$*i
4tlo
0]RA
_:]EK<
.\1|
=w<(
k
=}t
|>(~
*:l
L-ANJ3^
?N:(
(@m(
KuSm
i
{s!X*
iAA/
~$}V
E_
IwN%
](=0
HSws
1W9c
i#cq
5pBR
<6O_u
,LS[
INzJ
AssemblyFileVersionAttribute
ia0\<
RvMO
mscorlib
J+174I
S3Elz@
|R
q
WvFCV
q>CB
!=76

s
EuD/{
P8^G
8kND
bH9
!WlM
Du%Op)S?
e}Ty
=|/2
L_V:JX^
~Vz
Sxohc
zf"N
`RVc
1]QAr
t#Hw
7kp
d
l3Du)
l&]H
,U\y
Ue9
_pA)	=
S[v
aFr*
Pa!RC
f(;d
/xNw
A*R}
izxHj
:Z7u{5
`b/g[
~]
!
C813
Nj#>
e%Q<#
7Mss
):">
\W-?a3n
Mk.C
;q%1
h
Dw*
@1v~
om2-
k>)V
8w.;
.5
|
E/mK(
[44
oUGfz%Sjs
)SD@
V\Pk
B|2g
5K	1w
g%7(
U[xB
B5*sk
"ka+
Lmk*
g|?j
*uAo
LEiv9
am!p
xZCq
(Ic_
R	<J
zkV]
woYvy
23eUub
dfEH
;H63
7[r?
6S?}dM
{;O^
S#5_A
TI,u
Z<.^
s3:!t
zT_0`>-y
0\a1
Font
tn%!
]1-w
J]f?-
.-Vo
<5V~
J?u@
h$%V
|
q
Whq-
=L+O
j#*{/
w ,u
}N?*
?ABu
n)[Bm
"+yBEsm
`cv.
@-?4
NrN
Fyg]T
`&bI
ah"6=
1]hc
o}eA}
u{10
String
}1l
6w";
5-aH
_CorExeMain
f\M|
'V70
5Kxg
f
|
uA5x
W,W5
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
0dkY
/)1FWsc
<Module>
Lm2@
*JCoe
WR"b
=a{!97
04`e
KX>2
mZ*E$
)<=p
sZTu.
0YWbY
a\V
n%iy
w,SN
&mHh
_=z
_={
&l+4k
b8U0
InitializeArray
<zQ.
5u7@
{OL
l!(r
$2MB4
2Xhd
\a`Q
BwH|
o:bt&
@xNZ
'#]4S
o?=+
"u%
)CXl
~xkW
K8=\
^ZFm
{]Y9
4]e4$
ToArray
fuzGy0
bB2a
EditorBrowsableAttribute
eSP'
$s+2
9v~sW%
al
9W!A
X9jt
?Bj[
S(l3x
p./\H
>OWw
GsYS8|h
:CKN
~iW?
hbZJ
"QyAu-i
c9jA
get_Hovering
anQzU
__~f
z9[
t<eI
6e!]E
Y
m
<7-m
(cp;D
LLA:JZ^
(&kl
(Ma;%
N,INepZ
'3/C
H$$(
zBv
2W$
mIDAThC
=nrL
-p^4l
%-E&
!1eJC
1n9/c%
|2tca
m<m=
System.Drawing
{x'
<C!Zs
ykUH3$
V{ ~
get_FullName
v!]b
4h`@N1
7YM,
z6JvS
e@,`
LT)r{m
)#Ck
J,BvK
d$z3
9zrzz
|jeC#
6;Ym
]7@tVZ
Q9NW
w{b
z;^B
yh*
bv/E
NC7
k)PW
j"
BK8v6
c2ySj
Hs
$ebbca070-1520-40e2-a4ca-89f29e5cea51
DY(
:1IK
u
/o9^
Bov8
KO+^
ResolveEventHandler
@#>|
nL{CG5
x<K^
xm5*
,d?
t
"FjI
-s/Mz
6$:;
tKI(
,5>J
W?
o!r(
JCR:F_
t9;L E
T-~TJ
gKyt
i3X":
)qq7$Jd_
Y_9*
q/}|
c
6_;g
DS[0
y1KZ
!#KKi.
FuHaB7
yVC*
&Px
c/8V/IUN2TO
2;)
zT
ETCL
M?zQ
1>Sx
U]O}
LoJA
U
GsQp
O8Ds
P\s&
DbdF
/+g
A_QKC
gt2p`
Io~l
wC
:<
i/Ci
H-iK*
[[,t6
P""!
Et6K
3`Z
a
J#n:JP
Crj'&
"'Xs
AFv_
Bs0
Object
Q7n
W!3)
#A;y
w#Xm
r$[Y
Z@F<
*`N
-Rs`
D	>l
d
s6
oNhl
V&Io
5i5D
LLAzJZ
vzo*
e{HhW
`xw9F
2s	O`
Hvi8
RightToLeft
}\K.1
oTPAz
ControlStyles
0Fi\
o9^"
{5~1
U)XkN
f1z=
<k`Xx4
_Ldq
h@a+
mz9[
x*cai9
g{&]qj
nQs[
54?@
3\2L
G$G8
Q(~;g
]CZT5
/>5k
[jb{
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
nIDAThC
EGy,
ojs
EditorBrowsableState
AssemblyConfigurationAttribute
w/`Czm
4]KS+h2
L] ?
;mBo^
:/l6m
Qeb+D
bu|~AS
K'b}
5W(?
zb!g
C<?a+
rX)Mxu
1.0.0.0
>v9xz
=06
"k9s`
H3!\
Dm5|
O(?K
\w,7
/e[>3
sf"Y
)51]
_p<z
XC`q{dz
zaX
Hg2ft
wQm,
e_-w
0 KNp
t}'a
zD9z
S=[,
tIDAThC
\Yd	V
sRGB
ff;W6
i/M!
yy.%
x|
/
K,&
f1uK
]EPK
kIDAThC
Fd7
}SjQ
1(oL<6
}vk0
Qr:b
CreateInstanceAndUnwrap
a,V'
fY,W
hj]^;bw
2k&
3jGF
_ghM
Uta(8
.A8b^
yV]^
{t2T
6n|_zY
52v=
I 1h
get_Control
'WV{
D%hL
**x=
^N%v
pgwS
P&c
_,
N1lL
<gp]
$HtSS
|)>7
CD&
KGCuXt
hM
c
6t+l
i ;4
TabPageCollection
/qTx
sf2S
pt<9EX
lw"T
0s40
f3w|
,S>P
:&N$ei
nPD7U
){qx
u0HC
)y]b
zKKS
ck^`wW
,Te>x
`
P=c
9%Sg
Dg9e
D=6!
oG`Bz
{c7
2W;!
FhD*
5UdW
Ys/ur
)\*I}
Y|'>
fQ=g
9V~{
t}mr
/
>;-i
tm<2F^
4pto6M
`PFj
|=E0
W"e@z
9
I0_
~0|e~
AssemblyCopyrightAttribute
[	4_N3
BiK-
KlYA
#Strings
FdT'
set_Width
'TX0
)!Z~
dq4'
_h9KY
@(KQ
?E~
orM5;
K	aP
uh	`
oR>mh
5hb4
`Xq6KN
-$ll
{fTCy
ResolveEventArgs
k?+
@nQU
5)}Eb
EVI5*
LLPI'Z^
qc/fDU
-HO7<
"\Mf
BB(e
mLq{
^]e,`
1#-Il
)^g,^z~
+4	E
zd6f
8[$d&G
mHiV
tSqcz+
.D$
sFLq
Q0
F
:uoUS4*
yjM8[
^Xj+
z/7N_
EL`P
K~*"a
7\2}
Byte
Jd5-
VsDf
^avQ
08TA
#5&!b
5+TZ
4'\"
eE+q
y"J#+Z
yg!zt[
g-E
(GuI
1>qO
UoEI
,31
LLKHiZ^
LHs.Mj
GSRm
I9	c
rlSX
LN~A{xG@
9{HW
;&%
PYF	rd~Nt>
!PUjt'
0Gi?
zE[5
k!s.@
b"*9%
2)LU
,wy'
9R7
s1)0
~v#
O.wMA
Y
8-
,wy*
!?SnO,
{'c4
OnControlAdded
?<0.O
]dlQ6
56/f
VS@=
;MFs
Q-Th
yv~]OvIp
05c0d6ea-c34f-d9.Resources.resources
fqVq
wM$D1l
nGg.
F/jdp
/26x
t
U{
nFPm
\}]A
Qg'|j
u|
985U$)^
kG`-
T65E
@q[M65
@1/t
Copyright
@oWk`
lGD/
.iZ9h
3}LwO
zWBn
iu\4
]
	2#W
J`lS
o<q:
eI8u\H
5fQp
U 	?~@s
@Z#^
))&j
Z*6*
pxh
*svD$
zz<\t
>=gt
j=t'?z
ql z
y3'.
_ai?
e,=u
;[WL
Xx>:
}ZTC
w{,8<
v2.0.50727
Y|N?
v3Q#`
Q:@jtw
NC~>aXo
b1bZ
\p}=
A7}
-
1lv
xURK:
5@5*]
{kr&k
0I~B
(>h7
}	;a
H"7DQQT^
S/D>
f/w
b6gk
ISerializable
_yC{
WB>56
Blhv
pKI:
JmO3.
(l$u
/QM~zN
}x$;z6
o;1B
Exception
hJ5+
sHncS
<	E%
q]m W
textFormatFlags
6pcC
(*~N
VPNx
@5hw
T,5~
r3vU
W?eA
set_OverIndex
,S9/
Do*-
jH
]
h)QtE$
fNF#3
-"vqN<
q&1#
hN'#o
dRg|
X
-J
Gy*]
8xe
%6J+i{N}
Ze/o
~SOjZ
GHHJI7
3X1@x-
Dd0}vJ
h<oDU
2XWy
h|k:
X;G
5-Y	j
.F;0
NGrq
oHF?
zqt^
n9mP
s!ee
N<A(J
:SD4
uT}}
&x%!Y
^J|~&
@lPXcD
?%,Z
O=
@
&KMA
zU%s
WET
Iu$t
j16E&
4C#A
M&GH
R.{OF
k6Bw
.8h_6
Wcg1
?Xc+
q>dc
+ZVl~
g$}
wtx{]6
XFU
System.Runtime.Serialization
"%I$p
YIF
J3sfv
0`Ad%
Invalidate
QV3q
get_X
ka,
xT5,
c:Jp
hV%g
TokB
+mf)/b	~)
+b6g
E7l?
{x)i
z8K
Hxdv
W|k
N
5$!4
j]}<
zCd(
8{Xn
1Q9Dc
System.Runtime.InteropServices
$DB%
H
MB
)"-e
,2LZ
o	49
QfBz8
X;%n
G*H[
nGhC
^DPq
q$0u
D0D;
"%*ci
<
en
-~k{[+B
L:slB
?-h
-~x9
-	/C
\^%7RJ
@qd,
[rF7<*
i1x'
$uw~I
U7lz $
^U9n
SuppressIldasmAttribute
OverIndex
F)^'
l2-J
Raq?
N	PP _
y:xkp
NwhEa
RUrh
X$9;
,XK(
\]kn,
4&~
SQ92
\fNl
JlC
^ykS
@C%;
(Z\[g
J7P;
K|d"
~&dT
xvy,
X7A3
Y
8V
r)dD
CF
<
LP:JZ^
~-&b
m-Y!
Xu6V
]JupU20
R&]ia
`6Xg)
oxj_
W-R!
![pV
<7u/
r>
+
J0Vr
J\w8U*a
c?]X4
l|\t
Ut F
1gmgTl
;Brk
)(d66V
@7B5t
ItemWidth
TgB*O
ej?l
dT$Z
OE*	D
System.Windows.Forms
set_Font
Gi$5
R@r6
(<2Fu
pX%6
"BX9
GwC"
U>%A
Y-n!Nc{
E+	
$
Zm8V	{
:$;S
e8Tz}
t^zew^
}Q.E#
N0=
Xq[
C
5E=<
biPh
FHNbY
[E6E
O&uX
/]@A+
v'-)r
!
LzXf
jQ&	{
kw6g_
B_2
y~%
}q	>
Y
8D
79d"
bH8;d;
h)iFI#0r
w33l
,BFE
4RGZG
Lq"4pto6M
.l(L
UF93
ZPf\
;wTSM
!9/
^
j~!u
dF-n
Q}1A
}ps#
OR0|
38
S"f?
0;kJ
?Dt;
AssemblyProductAttribute
.&=~^
]tj+
e,O
){q{
){qy
<#j_hmM
29@R
REY+9]
?q{m
lU+h]ksH
>.S1
P[L3Ie}
TextBounds
/aG?
#JV9
OZyQ
l_|
_
\,)ba
`Rjx
CB7c}[JZ
/LE\
/-H#0i
EeRE
m"Eo't
n/jIE
,Ie!
y{qr:/u
graphics
b
us
y;s9N
sGR&"
ClKuVBh
nDr
OZNT\
U_C
_0-
=<v*
=_K1
6xkNK
lmpEG
pASQl
&(uE
!PA2
2018
qFY*M
!)$.
b7cl
TH!u
E
8p1
Cp '
j]XY
p]Zb
n#<<-
,{8_
UQ*,Io
AIDAThCc``<
\QCz
b~:($
NSiYx
~Ams
o
2nCc
#S7V:
= isRx97~AWV
2
k!xa
Dw
{u
get_RightToLeft
i[ii
@=sp
FsSm
)}Qw
{
e>
#GUID
~t-o
wM}lH
y(fi
0D2y?
?6{N
zsi;
va%2!
) _ai?
"9YK*3
F]<mS
MF6w
BTWk
BdE\
set_SizeMode
.*
Q
Ypu[
EhwH8
-vax
$FMkH
qIDAThC
A-a[
3nqg
~8$b+
7cEfW
MHX^
4eLbf
*;RZW
-7Zu
]^^c
Q[H&
q_)!!
&yvFz
#ba3
ToString
PDQ
D[`
[MUG
NL&x
$hFcUb
3QH)I
;~<=
set_ItemSize
2:9im
a,G?UV
I$JAfk
a7J0
d[E}E
eI
!
;[+"
4m-
SetStyle
@Rj
wjkv
%fR;
|}TP@zxA
?0
]
h#%fF
{qr=
-YsiC
{S$X*
~|
.
0qa:
%
q>
c~vx9
t*qK=x
ptK{
@5FE+s
Et`+.
4G4pP
iey$.
|UD?
Lv2T
TD=*
_ah?	=
%(HVl]
x1K\
4?{[
x1K^
)k\^
<W/
@s+r
j%|b
INh)
mWt
MFF*&
|W%M
Cc,]j
=t}W
#RDhX
^gA+
?
E(2-
P&yJ
Es1E
+g41m
IEnumerable`1
{^JG
MouseEventArgs
*aML
{lC5
fJ[
,)SLy,
CRw!
r}zf
TabAlignment
-Qjk
Q~eY
@hN
cSnY
Q0
F<``
l>F^
pf	SdU
CS"
!w W
@]'
g}rpq~8
iWR1
G!>
|[^B
3}y;
;/"n
lK#*
ga2k
OV\K
q(mk
TfdV,
Z<{YL
XOTI
7y\F
m>V![
IrG
,E1B
O+C~@
uH!N
Z)=u
Cp[8
3yO$
s,vy-
F8~@
N		U
System.ComponentModel
m.nH
?Es#
*D6DV
xtlT
"
Wy
m*
/Um+
4G]!
cBl;"
Fb~F
Y\'$N
.z0+
_F	]
NNWf
:mIP
Z;3U
>n0w
Graphics
|e".
)nRqH
[Pka
mscoree.dll
QJ,;
=ocx
3F5Ue
@|Ff~53
vxc4 G
2NWW0
k9?`k
;
/
e:D,
8[Nv
MlZ
=u L
<Cth
OX}\a
Y1]fRt
Ie4/
L*e+
lHW^
3U]j
>}2:.
lMB2NZ_
e'
:
qyn?
Ar02+
U*qa
aXU]ml
MUi(
";eRqjto
~:OX
}#c
i~-^0
x53a@
'onG
yP$`}
y-H~>
A<`~
iG^P!
e+V"S
7&UvK
(Yy}n
1CQz[8)h
a=_5
lm-g
$sE;+
/NH?
_B/-
ka"|
QMg
8b?s7
j5LK
|i,|
MEzG+
tWr^-
[@BY
c=}H
l;6u
cFCV`
F;QH
WriteLine
#NDwp
System.Drawing.Bitmap
Vo4e.
d(K1
PJgw`
E:h2c
)XM
2 %v
6:/Y
7xM
V%y'
$6S|
2Ax).
~M}\
Sfl#
gwPjU5
Jww)
M2nO
get_Font
dO&<<
GxBK
cUG\
#@7nY
{"e
2\w
t}&j
gVuSg
Ai\l
1s~?%
4EOX
tBa$
|&Ny
F7\b;
u.'_
A]vuR
2
VD>
rf^
"qG
g3	2
3T'#d
s"HMzr
;eG[
2
-
?Y=F
W}5!t
Am
FF
H^;H
0WD
]~-:
>uCl_
'=T5
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02_64 Seven02_64 VirtualBox 2018-02-22 15:44:44 2018-02-22 15:47:35 171

5 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02_64 Seven02_64 VirtualBox 2018-02-22 15:44:44 2018-02-22 15:47:35 171

8 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\n.exe.config
C:\Users\Seven01\AppData\Local\Temp\n.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\n.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\n.config
C:\Users\Seven01\AppData\Local\Temp\n.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Windows\Globalization\it-it.nlp
C:\Users\Seven01\AppData\Local\Temp\n.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources\matemdeea.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources\matemdeea.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\n.exe.config
C:\Users\Seven01\AppData\Local\Temp\n.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

Nothing to display

Delete Files

C:\Users\Seven01\AppData\Local\Temp\n.exe:Zone.Identifier

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\n.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\410fe546\7307cd04
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1e5833dd\40ef5613
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|n.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|n.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|n.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1e5833dd\10592a67
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.DeleteFileW
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
ntdll.dll.NtQuerySystemInformation
kernel32.dll.SwitchToThread
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
gdiplus.dll.GdipDisposeImage
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection
psapi.dll.EnumProcesses
kernel32.dll.FormatMessageW

Execute Commands

"C:\Users\Seven01\AppData\Local\Temp\n.exe"

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-02-22 15:45:20

Detected family: #Malicious

TheSystem Itself @ 2018-02-22 15:56:02