MalScore
100/100
MalFamily
Malicious

niw.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 16/68 Related 2059
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 597.00 KB (611328 bytes)
Compile time: 2017-05-13 03:05:31
MD5: 67dd3dec0f00be436a15f1a455551334
SHA1: eb8926e8650da3bb6d24759e0fe980876856f2bf
SHA256: 9460216b32521e2f6d04687c007b55598aba367fefde10e5984c794947bdead4
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-20 13:12:05
Last submission: 2018-02-20 13:12:05
Filename detected: - niw.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/niw.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-20 12:03:20 [16/68] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x61274 398336 6db60ea2c7d03ffe59fdcd7f952b1f31 97088d8d9744515d80d76706144748adf6081874
.rsrc 0x64000 0x33a68 211968 c15d5f93204362b07cca90330037a08a b1ec9c13f89e77898e1e0d50b84cd1b259b0a155
.reloc 0x98000 0xc 512 e71bfa3e8bd03bd3a66a5fec18ccdf5f c7fc13a4342d17e86b454bd5b12fa2073f6a8cf3
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x64130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x9747c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x97490 1004 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x9787c 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 Ace Hardware Corporation
Assembly Version: 0.0.0.0
InternalName: niwgod.exe
FileVersion: 1.3.1.1
CompanyName: Ace Hardware Corporation
Comments: oyonayaweb
ProductName: Accu-Chek Connect diabetes management system
ProductVersion: 1.3.1.1
FileDescription: Accu-Chek Connect diabetes management system
Translation: 0x0000 0x04b0
OriginalFilename: niwgod.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
1.3.1.1
URL(s)
No URL found
String too long
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
Comments
e47d14d0-e06a-d57
e47d14d0-e06a-d56
e47d14d0-e06a-d55
e47d14d0-e06a-d54
e47d14d0-e06a-d53
e47d14d0-e06a-d52
e47d14d0-e06a-d51
e47d14d0-e06a-d50
e47d14d0-e06a-d59
e47d14d0-e06a-d58
e47d14d0-e06a-d562
e47d14d0-e06a-d563
InternalName
e47d14d0-e06a-d561
e47d14d0-e06a-d564
e47d14d0-e06a-d565
2018 Ace Hardware Corporation
Translation
niwgod.exe
LegalCopyright
oyonayaweb
VarFileInfo
e47d14d0-e06a-d544
e47d14d0-e06a-d545
e47d14d0-e06a-d546
e47d14d0-e06a-d547
e47d14d0-e06a-d540
e47d14d0-e06a-d541
e47d14d0-e06a-d542
e47d14d0-e06a-d543
e47d14d0-e06a-d548
e47d14d0-e06a-d549
1.3.1.1
Copyright
28b8fac1-a6e2-3a
e47d14d0-e06a-d560
e47d14d0-e06a-d559
e47d14d0-e06a-d558
e47d14d0-e06a-d553
e47d14d0-e06a-d552
e47d14d0-e06a-d551
e47d14d0-e06a-d550
e47d14d0-e06a-d557
e47d14d0-e06a-d556
e47d14d0-e06a-d555
e47d14d0-e06a-d554
e47d14d0-e06a-d528
e47d14d0-e06a-d529
e47d14d0-e06a-d526
e47d14d0-e06a-d527
e47d14d0-e06a-d524
e47d14d0-e06a-d525
e47d14d0-e06a-d522
e47d14d0-e06a-d523
e47d14d0-e06a-d520
e47d14d0-e06a-d521
Accu-Chek Connect diabetes management system
VS_VERSION_INFO
#CMTr
Assembly Version
e47d14d0-e06a-d539
e47d14d0-e06a-d538
CompanyName
e47d14d0-e06a-d535
e47d14d0-e06a-d534
e47d14d0-e06a-d537
e47d14d0-e06a-d536
e47d14d0-e06a-d531
e47d14d0-e06a-d530
e47d14d0-e06a-d533
e47d14d0-e06a-d532
dxy
ProductName
StringFileInfo
FileVersion
000004b0
ProductVersion
FileDescription
0.0.0.0
OriginalFilename
e47d14d0-e06a-d517
e47d14d0-e06a-d516
e47d14d0-e06a-d515
e47d14d0-e06a-d514
e47d14d0-e06a-d513
e47d14d0-e06a-d512
e47d14d0-e06a-d511
e47d14d0-e06a-d510
Ace Hardware Corporation
e47d14d0-e06a-d519
e47d14d0-e06a-d518
N]&uJ,3u
fdT?p
IHUC
it; CS
pNC
}Pc@
H )iyii%
Ku29B?
|0M 2zgL
({/N{
L;%g
Trv"+
~&-a
!/(u9
dMZe?
3 S~
q3jK0x
*mI
S^.M
VfKk
m"&7n
bp2$~
a08Z
L7Q$O
9g;9
PNG
(E`[=
]O>=
TVZM
c1827b8f-14af-e0.Resources.resources
_y L
hE|}<
y9ao
M~rKJ
fiStJ(es
X^Yg
ZYzM
iHEx9
*S(+%z
|xvH
{9b5
z=yW
c^/g
QWX$
mU-
( a?
$%T_
c0F$n
)N"7
0jZqD
I@}n|
X_yx
ZL"j/)9(
[Li5
_XlHxZ
sQbz
TabAlignment
Tg7x
H&eQ'X
'/''
fJ+!!
51h
Cz'[
"1n%
*1K
<se7
qTwz:oJN $
=L3$
f2xF6#
'mOW*
K2"?
=3y6
J{9(
nwWN`
tJ7h5F
LmL9"
\l*6
z'Eh
rDjg
%[j)
_[fdT
I-dU*
0_-x
mk+t
ZG+j
PUxXm
H4qR
tZcD
& \
O{1X
h }ezY
oX>p[
vq &5
= < < < < < < < < < < < < < < <
4$<(p
8feq
$DD"
m$_r
$$gl
Ta(w
nLZS{d
UT}k
Yy2n {
t C}
[HC4>
4.Kv
&*8M
%xCOQU
K #z
g"o
t#GA
x{x
IwJ7JH7
_Qa#/
^ B\OU
re}Y
~oPY
b}jeJ
,a ![
e}C.
w+|g\
m+mH
T8uW
`Mt-J
System
bIZa
z[ :
}5R;S
*l\|
Int32
B Z|
xl`
yMZq
j9s~ LVJ
pg;T
r5i|
K1-A
\C {v
xo-8
r "p
J$Wx
`~F \~
FoMp
OB!O
/^MrH^
fgm)igi
B#l/
):UBI|
nO
jGx[
V +
kdY"l
get_ShowKeyboardCues
^@?C
38lZ!
W+"S
Ym>
W;f"
=94h
d3<_
>9'o)f;
CompilationRelaxationsAttribute
bHr46
/b#e
mZ3,
S -U
zY@ E
dWYu(
]%4u
$VZ\
KK0
OverRect
}IDAThC
o# ^
M.Pq
BLj6
t!ED
Rj{^
KMK
'zYB
>iCt
sI5|{
j:3L~:o!
lH5U
AW>g
k+[WI}r]ES
`L(h
L?=:#
9k|Z
Q&/X
~~8*
x0 '
lz{7
uxvc0'(
5O!7 ?
'oa:
l H`EVJ
1.K.
]N-
c ;`R
YDTdS
,.U/~$
J[ioV
yG[l
ZT&:
=2Lb
?+g#
?T@~
E`Fi
Wb0
u?Bff
%S!m |K
VA92L
M(-'o0'
`q[g
YB81
.I&=&
CB:'%5G
"1QL4
OQ|'
1c-n5
~G5%
L7M;
Point
sQHiHT}
m80M
X?v`
]!3$r
sfzbN
X_0o
M2CE
;)C)
()pd
.L,j
z%hCw
>@t
set_Alignment
c 3,V
CtU/t
N)y?
%4(k
**i(E
Ta0p
lq{a
6<[M
/FP\
<!>
7xq[
`"<:
EtQ6
v5Vi
jQX.
m tm
n'~Wh
0*r
SuGB
T oF
[x/&
Rr4b{
4f4(
Id8`
_x+sx{
WL>
MUEUMU
h@7U,
System.Security
! SW;
1$f9
ET +
oT9*J}$
IKww*
Y<g{
ZR}E
q}}]
75.#
Wg(P
m11=
~X_O
Rw8@T
V .e
2udY-G
z[gj
XC*f??
$#s5
AppDomain
Sza\d
{)-%
I7fm
wg?FR
b $\
!9 +J-h
d=J[[
I0z#
+o$_AW9
:7E6
xtII
OnPaint
YI"XE
6g&?"
get_CurrentDomain
+TMe}
KA c
CA/D
G,6p`^
Yn2y
QMy-<]
@NIu
_s@
]2|
matemdeea.Initializare
j"83
95u}
HK`$?
(V;HuR
MXB`(A
k,]5
Gby &7
&^KT
^,T3
f^WaO
nKHf
r |R
U{
X WV
oA0p
'W7{
W20t
~w9@
BfalY
u3 46
%ntx
h8h$
bfKkZ
0oCd
pFR [
9hd_
\{ VQ
1^9EF
@_z7\
matemdeea.ControlFolder
wf&U.3
LlEXL
xFDh
/fg_
J\-[a
Me+(
S<M
Z7.&
1uP?
;DC*
=vC0
hK f
-a;
o 1_I
L>So
8?EN
`ri'
fjbz
;aHU3
uJ%r#
`qA}
a6w-p{/
lSO=.
n0~x
A-gN
iD^:)
m$
NtM|~
})?b
]WN<Os
-mtI
LtEO
af./4
ugy
get_TabPages
7 NS
7 7p
hUh3
Me+]
v }lg
Control
s:=*
h+#i
miFj
o#6V
nbsqR
z} 1
VLaD>
_rNe
R-vzE
3 Zk
2-Cb
\)KA
u_iSO
f3yR
<<B/
FRl~Q
fa1`
7+-{
cXE8
jY~b
_Aj(L
e{](;vcV%
F|Ee"b
?.W:m
^ahC
\,x{i
t/>l
2C?)1
[n9X
sWNpE
NE>;X)
OIsO
s9@
cJn}&
Type
~Ou%N
0I4'
e2s-
>)YD
$Y{I
bq3D
? '6
y3p
M~-Z
LHB46
H^34
?'<)<m`
}qn(`
E!y/
6&Pc
W<V-
[t+>
System.Text
;7M!
Aowf
aD^O
6/8g
-XPV
I2 A
H42
T?rC
@\*l
),GQH
+i5$7>;/^
mgi=
o,zm
S=9 t
l|%3
~eM7B
|] '(P
}q
Gp$k
2]yc]
bS M{e
(nW48Q
p2O!
do.n
A?-m
+JAAE
kwpB
^{UA
K8'|
$d:PM
4>:nMC
cjf$
5},4
>*cR
Char
2:h.
9{6a
*gtF
6aQp
(?/U
#PZ5w
c6 2
P nH
H7nF
4cKb
h&tl2
.v"3
1 Zr
eA(
wyB_^
Ki<dA
qY5
WN:E
x fN
u3NY
j1 7
!3?R
System.Runtime.Serialization
OrVF7:$
T:#/
aRm'
'$^+
wInf
;Gm4
JAl]j
6tSF>
XFJA
fYE{-d
11@SM=
>f%Y3
a8LO
[R n
AT&j
(,2V<3
ee>kiC
eN4>y.
h;P>
y$ \>g*=
5AH tz
:.H0
AMe+)
c{Nr}
,cb8
*SN#W
`V2g;
)bm
^vVNR
NDxY
tKi]
5{Y<*t|>
\]E58b9e
/;Tn
E?aGFa
6Cn)
_Y) #
[ Y2
4g}*W
ZcjLU
+A E
y5PO
_j~C
4v^s
w}5H!
*z v?,y
:.pG]
^&}
Olf4
<tx
\)k^~
c2bL
\hi5
iyut
[lK]
@w.j JQ5O
8<03
.y|~
X}bC.
z.q "C
SQ[[7_
U-#D
F'"8
zE%B/
"pzS4
B+ZR
GKnZ
z1 ]I
ol-k
2mRk
qq^k
^2>_
7N|-
Exception
>]V#
WrapNonExceptionThrows
K>ru
M`!
" 6u
BaseRect
]/.@
O0Ek
5(`aU
a {J
.text
wUt
]^ B<
_JJk
zq_f
!tq(<
%(w88
}3v@
E a TJCc*
A'o7Q
a851=
(|xO
rj>(
vg'O
YZk6$)
uW1I
q2 9
( H|
e?fY`
#$P[
Vk\.
$@;E
1wW?
)0l]
r?dY
get_Count
:l<yC
>!\>J
x]_3
<9]* 5u
b tKM
[@)14
Gm e+
RU|o(@
}]kt
=Lfcg
']P8|!
L{Q.
xN'm
vS6vV
2sI-
<K<'u
/w|iLXX
> ^<
"sgC
: NA s*.
+{>W
geO@V
pVP*$
-RTM
d9C^S
?m1.
d>]C)
mE9 :
Vx[5
m"/t
.C;c)ey
GuYe+q
WhMb:/Qg
*Pf7
<y *
% TXu{
XRuO
p=hs
Sfw3!
8sE8
S&Os
bRGG^
?-w;\
y5uj:Mc
mp^4
R 3.
I#=q
@FZc5A
';+K
XH*G
^AA$
MintSeparator
gj+4
a]jg
ZMi0
68Ms=
wKv
lv}&
E,R -
&T U
$;82T
**u@
l+8}
6C %K)
Nl%jK
t!5*
N*9:_
5 JTL
Z%?S
o Gf
84_W
7~ )U
JpvE
=!C:X
zWq1
3_7R
&cu*
_pZ-
gUG>Q
C4sTpjA
k 39
+L G
!'g@
!T41
Rw&Pe
vCB/
K* ks
a5&#
zB /
*' $
7Jml:
%bi;
w>s.
U .E
CN!@
V[G"L
YUM]
vT3)V
vAJwi (_
9o"_X
GM+H
=~eV
`.rsrc
'uMLl
Zv{ZF{
d>m=
iV7
`q~V
faO<i
aUA kw
I[E_
"yZl
A:Z
kP4.
" cNJ<_v
c%A@
T0UQ
}Ix3]
ZC?D
q]1:G
`h:5
Xgj}
kjzA
!-Rb
/ QG
Z{y&
.%xJ
^_K&g^
<'gJ
`{sbg
?Ic2W?
]c 4<
" iX
r"5"
0aHJ
Vf8$
fQ{/
]z{u
4mCWY
hp}m3
X>nB
]jS
MVWm
ar+*
}%cH
ClG""
sjsFBT
V#_?
{ eS
%]N|
Z4K_bb
2QDAg
$6g@)8
U DYj
}&%w
N$l-
F hF#
l^Kt
AqfT
w4TBa
xQkF
Y..D
|(,i
S?f-~c
|96
GetTypeFromHandle
3Ogg
z*%]
8LBOn
Ba?ai
Q(\q
fz}MLk
$\je1
4@F%
_&j#w
\zQK
}?pTd
/0F }
eU^5
B](b=
^}nwf
,kZ=
`:=v
(Iez
^<<
2Z1T
1 8e
o:Z
3ax79
&Y}wt
i/@hh
lC+[##T
RFYy\
>!SA,
1IYz
c7K"gD
Y X0
FH&=
q%Co
m5OF
QkHN
dL8G
.Ok'
`"}r3
!=F~a
/fJv
F|l1X
XvfF
0tsA
rA)/
_4DC;Y
[}&\6
|eumdzK
|IDAThC
*uP z
`i Q
pz%d
?_LEF?
" [9:.
/0F ]
IDisposable
f5cGY
%2Hl
{X3j
)~y8 ~
fn:]y
<?RU;!
8~Egh
+lE78;
5-E@
K4DK
HEcg
pK>3nZ
=6_R
q%.c
zgy'
~+I}v
EP2N
619
]Gw[
YRp~
":7)>^
qZ16B0
a23z:
n_!L
k>'_
G\}I>=
j<&]
% {f+
cdcR
s}g~
v8KIm
'
U?Ov
rH?
tk _u
ejb!
JjYm
9<N
C:E8
dHaboO
DaST
uI9g
VI.p
mOq
P{mS
?Bo_
Y2R;
,jYkO
I Aj
@:sd
`FWZ
V<tl
iW;A2
crj[?
g`rtO
RA&
ojCQ]
*G}Y_d
x)Ne
pV
c\~c2LG
B6i`
^ Dq
BZrb'
%wrQk
+~Fa
Y>y#
0X $
4Pg
*DOPE
M\Zj
*WxyAi
0:KA
w`VQ
+E`_
^\Tg:
(<PAa
u
qu".K3
EventArgs
k ;p
,f-<
2M]
g5Wr
9% z%h
>Efg
ay#By
]7 TJ
i[WV
HLnS
(&5s
fF'
g' 8
Uj;M9
kQ_ Q
S{@T
=1i
O|oD0
I.r
6,"U
vkY
&dr_
[0WT
rlNz
Hovering
B@R{1%
Copyright
,&oV[d
8Z. ;
*4x|u
IP!K
get_TextBounds
%q\
(=7P/
_&@{X
B.Ue
RightToLeft
5GQs
$_Dy
?PIB
~V:l
yun6
y3`%]eY
?G]j4
YP,
oF"9
Mo!Z
kP/L
gX?t(
[Ty(9I
Y|[C
qV@Cg?
ufc
?"I8
z<|?Vzi
RYrz
*J#}
IqxS
9(A~[
7k=`~[t
u]$
LU:q
{f q
u?|@
7^/)
8*9*
get_FontHeight
Y
iD\?
mq :
G'%G
stnd
!^fhI
]. U9
ugH
kzo=
^lA
#t&2
)0-*G
N,B1[
\@oz
nB:O
u/.j(
R@%6]
gmv
73kSJ
thqj6
V{hRn
d4H:
fm0s
5 q/
r"tP
#h}:
*mZh
('_E
/O%d
oV0,
O(s
xCg5|0
1b5c#x
f(Uo9
t "}0.
IHDR
A-\GX
7 =r
#j*y
.dAk
>|v1
UF7
5,x8Z:
#5n
mv+s
leh
nLBfVY
[Ei\
3^:`
m P(2
&*8z
"B41
Size
7V`5/(
/I~
K@b4
&S
T7P$
/r2_
-$q3nO
M7F4
0`6J
b$K^
]* '
xHUJz
FVo-
{&&/
B5q`f
" $X
o,q8y
qE8,
<
Qqfh
?&C?
kX(2/ qC~t
7gM*
anw$
8ec T
|36?
v.~^
e'aXI
WriteLine
}KIj
06&b
\/
{G[*
"IN=
u^Y Id8x
X i4*qY&
UWp-
SD`&G
"~D(
t3kn<
'lkK
-:o>
$5 "
m v7
yF.34K
\b;w
1e@
%CC/#5
&tVw
X"~@
Sw>=
_0r^rS
=\6s@
EI &x
_*)S}OX
]Vc)
u*m]
$,w~E
:ChZ
9@<f
9c$f
M7hY
Mds2
`Huz8/
ps& Yg
~|#
@y~Z1
MethodBase
q0$r_
s<-C
sshg
o/^N
'[zl
p.mg
CQ e
}Zc!
m_I
4ukY
,}U
/?h?
B4tc~#
HT%/e 6
SeparatorPaintEventArgs
$O#qs
vQsP
o .5
*5&|?
X?K
6!q(
X]z
J5
y]OJ
foJ'B
C|j7p
Z`yp
1Q
q@1/TD
]AP5^
/tW^(
!2QWS
:P13
fi}%>
HL(wgR
jI"J
vrI3
-06!W
0vn,
[+zX
Z%O
csm7 qxU]
ywT#K
+@A
fql6
8Z#F
p>s_
width
"E\)
Uekz
LHB44
m~f}
}`6bK
$ m\r
get_EntryPoint
+Oam]
InvalidOperationException
Oup1q
\ p:
hx>
mpCEs
&4'S
v&Vh<
2qWs6
V>v>y w
OW +Y
,BYKv
USm$I
^<8 [s
4OYp
PH@i
a3}'Nz
*@v7
h( n
T6[m8
Z]w3
AA116D4CEEC324F997842E90883AC815F1858929
"! XU
ly.Rn
N [*
Izq~;
! FT
Dorz,
;;R
sJ8Gg
W~ZB
3pQ
Cu)
}I~P(G
?B]Y
B/D$`%\
75F_
IDAThC
$K<
TL>0Jv
R}U!XJ
T-aE^
:\7d
M8Zcc
m6 N
]Y5f
ql ^
rNF)8sdN
set_ItemSize
P^)!
AssemblyDescriptionAttribute
.v4J
-;s^
set_OverIndex
i-LHp
|'s f
HbK}
b|s$
+@ E
KP0d
qm8X
4_$b
3E~F
/VI/
R)P?
C55w:Q
Dsee
a#6M
WQb3
Oo`
ye['i
WM8W>$
6N6{<
&]gnh5!]b
HBh9
$E7T
_Z!0{
0*6w
.Hx~u
nHid4
CL s
[[SP `H#G=t
o)~0W
KL'e;Pa
Y<sqW
Hh,t
h0fI
F{yg2
FBhRL
^`B
Ck'
# AJg
Md+)
Yb|i
<\qM
DPTzlS
) \HG
aT")d
yQRBC
Wl92C
jq~Y
;|*}
hH%>
=7O$
>hKR
vO;b%
Mio(
@`lD
j>NYE
_,*>
Color
/JR8
\]fY
$04TW{)V
%M(X>
*%fHKL
q)xi
FV Hu
Z'`'
qbz
uWjg
System.Collections.Generic
CTUu
0x$ Qeu
*.O@rY
|W0p
r3&c
ICollection
9]^!
2Ba@H
n%wh
_CorExeMain
x?Yd
VV:S
x*thZh5I
m8Rin
46*`
Jclre
CEon
MZ3)
"'a2
(;,z(
AEHY
f:Ha
\1(G
cV/j
U;q)
`<-_FT
SMQ~
W&HzP
>2o$=%E
Ci|0
;V1Wu
hyF
T,>2
A[kG
iU'd+
I9b$
gBRL
_D)M
j_`|
2[y
Jjw6
Ke#'_rE^
4+.,W
Cdsfssrd
}bC_s
NG[d
%\ae
T B3OHS/
"S&1NR3
}v+?
xtJ.
}pli
qNJ
K'vf
lV4K
7!|
_5F`Zv
J JL^
HWSb]
t%F"Rb
@qlK`
' y1
.b>
3bXd
_<X(
29cVN
}.j SrL
h\n
5+ X
b7SwX
8{\^
+7 qx
^#HJ
7 iE
&hT(:w
QK?&
RuntimeCompatibilityAttribute
^6- x
zN=n
lR T
+{FOsq
=7Y#
@:<
wya$
X]#{2
L6h6:
`Ha3]Hm. m
e p,
U<<oU
&&\`T
-S*E
E ]0
55.2
7k0M
Jw7((
P0`zA
S]l }]
H+]Qa
]|7=H
EQ1z
|1%i
mn Q|)
H8sS
Hnw&
'^/ou
SBjt
L?IW
R1zO
UVn]
+1?.
d*W#
QyI(
."`:q
h"Oj
_uM
#2Ai
WU[ $?
;F<79
J lY
5\6
NSX &
gCjk
"5I
,Q?.5
3NY+
)?AJ>
R4,
Tq )M`
=)JTls
MH i7
^=d|
bZpwp
<)]i"<<f
oW"F
3/R\
V-G0cw
HH*=
Y,H?
Y;00?>p
a]Zu
}Pne
7Y+@
}#:E:
/u> @
cBx0
j'a@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
z:e^Y
2C_i
FDpC
@n=
uo`gD
i=I~
7}YF<
V$xt
/t;_8
Gh7L)
c19$
iF! {1N
\k;c
Q>Rb5
;Do\J%
'WY 'q@%
3fer<yP
=M0%
2'_\
VJ_,
5:l3
S/Zb{
C^tV
PUb!
*.5t7
qT yR
d>59P
FelW
5HaEt
KrmW%E
~=GiG
P^pG
H9ox
*4w-
Ec"%
FBHB
<v"
I/11p
Ta3p
w;gI;
-T=R
%Q<z
+\Z?
q 4
%52u
3(,X
ttji
14E0
Q)F y
%HP4o#z
&/f~
-h,M
$CM/
}TR"T`3v
nJu)
Ab)]b
{IDAThC
G 4oI
1yVzy
3B7@
n?%!a
k_ =
TabSizeMode
oWS$&
Jknl
n,SH
9{\~
/;b;
!L8xP
j`{%
{`T2
ControlEventArgs
- R O
-y(\2i$t9
KGdV
|v'?k*
"[eQ
TPlh
7#TaJ
B;&m
_DD6A
flWz
^C&X
kB -
4ukQ
S mW
get_FullName
<Ja$n=
1g. L}
Wo 8
g *j
],*Gk
.q] :
XR]R
System.Collections
~]LY
ou\85:
x6}
/>x-{
f)Od
kp|r
#2 o
/\Zo
JjAfiW
F 2
R3^Y;"
c)sX
]( 4<
a 5d
\7j*@
1eZ1
#x_L
Bl"*
!xk]I _M
fW:Y#C`H
!ZmD
get_Width
9 |1
=YFa]
=q)m
{{*(@
4'D
PG'^
q@Xz
4{T&U
j-0
Bc&wx30
!|iXm
Ljw
ValueType
+]La
JZDA
LQ,E !
}2%dC
:1=L3
WHM7(
&{_?
jH%50sw
Zh$}
Y%R
!(@F
\j\{Y
c#LRh
Y6f|
17#e11Q
x".qc
0^N.
CNzA
B/LNG^
[^|;
$*GyZ
d`^d
t'X
s%]!z
wkN:
2u$ Qe
(^_&
g0[-
AssemblyCopyrightAttribute
2'd8
.JDR
N&dX
J^&+
Aq/q
0Be~0
E=R '
.|d/[
R^ev
w.T=
O7"(
,d(sn
~9:4
IYtb
OH,|
o[se
YI i
Q-+b
Z6%(^
7Du/
`%VCF%
kt#H
ivjjL<
VqMer
V2Se
+)_=ZU
A:>:J
Fs|Y
X(*Y
gO*
9e'4Ak
+CM.n
Zzy,
KBjHN
t)e]U
"0&c
)B i
N|9YVN
I#~m%
y'<]h
M-6h
!"W-
=r87
HFr
B Bu
.z@.
qGg:
get_Font
2(_u
z~-
98-<T[
JHB+:?
WUmp
[PxQ
uM8K
_@3I
W4HPn
8e"r]
}Tc1
"'`@
=2'S
=sEA
OnCreateControl
]f r<
"/'qNTv
Y8wu
baph
hq~+
T/\(
[g9P
>l)/
J (0
xa3u
ioy?_
!-2JRR
$003b55e2-e59d-4439-8e44-08e2becfbfc4
-8&[
13N)
/F0g
Cv`0
w=dQn
q5tC
vHE"
Gk$G
^ S,U
.|1f
f-Rh
XSx$
Q^d?Y
,IQ9
Xs({.v@
qjjrr
LLJO
Fin2d7h
cXp0
_L'D
|:z_
>>d`a
e~CQv
{%W/
7`E
CCu8
,%S
F~d E
,u f
tq?}
)6@Z
'V+T
X~|
#dzR
yE53
,U}e
7lG]
2o"Q
ycI
<PrivateImplementationDetails>
-A}$&
]wfMZi!
ZZrhP
;$,5WK
~@sE
kj/lD
(:o~Fcw
wfFm
Q 5z
-c\tYRO
NHB46
M.ZZ
q M17>Q
6:6&1
=+I=A
43iJ
LBjd6
N)j+
,n\d
yXFDW
$P0/
xCC*
textBounds
uq v
)PB
aW6U
0ytwOw
1J%2
.6})
J9bH
39D$
<A]LO
)i>c
/.K;
1.K1
PIyp
{EGV
+uf.
1.K6
h 3
bM74
%Rbn
AssemblyTitleAttribute
!+zo
p!k#
dhzv
PBS%%:|
1.K"
Va0p
J7k
/-[b
dW3X
>7E+rkYfI
\+A
Xt7P
",-C
E]jz"I9
l,`i2-
dR^
7=eC!
TB 4
3_Ot
o[E}
XuE/
Fz+M
dy u
6EFAC0EE8C248566D5441213E5936E72128EE1FF
y|9cs
3qJ@
TyW4
5,lb
rBK[
L-;
0ssO
Pk"#
)NOu
g`nu
9[wZ
[ Y2
jd)7
zL?H
m@,g
9mT@N
String
%Y2Te
/AY 2
+Kl]j
P{O
=/e:h
'CBw
(cj!
Zd7q
Sxc2
TJ~I
][3<
j8OI
ha!vr
JyMs
|g'
`etU
X$,\raT
O0h
00s[
}&|
rTuX+
plAF\-
D/^ F-
#K~roM
2Efj
8GAT
Wwgv[
y5%G=
#okX
~>+!A
`8;)
Kk1 }
Data
\-'_
fFJb e
(Y+f=
@|=*
???y7
w#%+Y
HT<-
4K!`
](Z[l8
~qNdFz
,`Ft
C<E
,-;T
w$Q
%OMrI
L.0|s
*RCvU
^[~k
LHC46
in_#V
eX&1"
8YU
s {{
S'fQ
{iuQ
&OyaL
*ph+
vdrO
jX [
,F+m
<lvl3^O
pHYs
L 2
d}B40&
T@Rv=
\t FJ
tt!M
$HA$2n98
Z4L_
qki8
__?'a
g~NJ
M<1l
OwSc%cM[
a.<}J
{ R$
Z##k
E<g*
F>lh6OF
), 2
",xmIb
\+:HK
w_FCvW
Fr?m
N-/7
eq[\]
S,Rb
Z;&2CJ+=
6"d b#
1KK1
6,Z6g
get_Text
Qa3p
{z{4i;Bx
]A Q<
M\<I
@lvyd
^dPW
K8Es
q(Ov
mCq 3
* w7
BNrV
.iT:
/Q (a
9Qjr
5_ .
B d #
1~;M
pS&6
AfGe
)^IVI
' Sc
Ujm7
l>6K
DDSi
SD `
:~oR
(^CQO
DEuC
Nn1=
!-Sb
!$D'
p`Z
{Kmn
t|Y
@UjI~
#Kp\
z+C'W
`,oy
Cv M
KpI
[s,8
Jy4*RF
hV1w{)U
]Ghi
JY6>{Z
L'Jj
202^x
$XIU
v_;hZ
v<gnvOe^
wtu$
AMOx
RlHtB
T^1v+
@,&`wQ
Array
lttW
pQ6g
get_Location
r6C ?
n=*i
v)U[
)-d
LF=x0D
d1RY x$dJ;
W<=ZD
n(he
%OEDH
@.reloc
xe1+
13fD
am+T
|L _r
5#Ko
dP?# v
[N
cT~rZa
V{_C
x;SqC
a~OV
*s|#6
sLwwM
t2#D
J zt
( L%$
@U<UuL
S,`5
Aq:m
B .q
yv@0
cj3X
99PE37
[7io
v3"
`"B$
Byte
y<:B
k`/\
N4.<wW
s+|M#
E$L
YA$i
}9ol# 7
:nc2
d,.G
Zw5i
zYN\}
/:nI}
t)IW
23%_T
@5F,
~\7^
X4[`T
l-2/
oN3r
=<yS
<=j
oeSM<
7 kb
_6r}
l/?_
<$,k
.xOj
- =:
4Bh(
R9L
~(*$>e
/{ (
3a!1
T(x
[F7b
CreateInstanceAndUnwrap
>Q)Z
M(aT
A$ciq
XN t
]ZEE
KHsg
fVYg
-(eA
j6 v
ad0r
WHd*i
} c4
f^wZ
:~A
sa*<
Q$!d
,N:j
'-1B
Zr5E,e
Dh1K
0$n&l
b51F
Ax}k
S8E
KTNK
h`1p
Y 8c
MobZ
9+egy
(;'+
N?v|W
. qVu
T0-X
G<d(1
F5}0
UlWz;<ts
<)Y4zT,&
label
5t;Z
Y 8r
tt\IG
\|d.bUD~
on%T
nal@](
S"oF
YtR-F@
L*+l3
LxU{
}2)|
z(g/
\KX
RZ$&
V+ {G
M!r?4{
AssemblyTrademarkAttribute
/)mb*U
l<N?
add_AssemblyResolve
c,ag m P
^!nT
{0CW
APNh*B
Srvo/
v5$C
rEsD
X$UU
zB)
]\CM
m'gYG
MfI=
"'g@
UrZO
Ce>8
`^ev
e6x-
s~!
@VQY;a
[pnU
[/0F }
MF*fQ`
1SK_
Y 88
T;Vq
j+u^8
&Dbl~
W 0H
4Ly^
%Bdo
~)Q?
a{+h
Ug%E
o~!%
)HvHWFg
~qbxZ
?I[yC
r11.d
+o2=
4UkW
b v&T
1hS9v
yLP
L95Z
8. U
jHox
jsh4
~9X)
sz?(
+=Et
Kz(
[QE8E
4J+42
cAPT
\,M14
K5|a+
916LwM
\X=9ut~
Qh_G-
*6kn
:Ojj
Bn-J{#
0nq
x;HD
KZr
?9jqq
0%H`U
d[7N$e.3y%
CG6Q
5i&K
g'$ d\
7wE[
w;la
rHdt
4D!s
,H:|
gi(?
"cQ=
IfO6
9zHel
w94R5"q
)V%;
5. U
[ChE
M7! r
hv+
jSr~
Invalidate
Sj_
#(7>
"q1 R
0SO<
%,jJ
Zlz|
;?p%
<5\FM
ieqY<
he }7
TU3
P^[*;
ukbG
4\@y
cuQ5
~WE4
ILeYn
1\aPX
bch
2sa*
CDx\
]& 3<
| TCr
_\e}
"'/V
"K7y
*!/+
CJ*]I
c@Rg
luz|
vp%i
uBw!`z
ngb#7w
%*i_]1-
m<OG
y]\$
X<L>CR
$-)w
HpCW
wg|rR|.
KvjB
R8F(
(LdF
|,^-
)(K>
4&*%
O+T
/ Y|=
kZwF
/">l
Q_3cI
|e+(
Z,J8
&2C9
!-VJ
}(6u%
r:+4
7WR2(
M)|G
=4.
/O _
GetTabRect
e 02
H"wG
# jW}5F
1o'v#
dkX%F
H2{L
%zEY
2ItQW-
ZwXtQ
U,*h
/&q-
`~e`
!6A o
-~\>
DWi
$xo^
/1F }
lL^
r9y1
a,\ t
?a[
LwA'p~
B^~[7!
-+Pjs
<zYB
[o)
,+{_
Z0se
1&-i
@ @Xe
J1E8
KV5BA
H~A\
8r
?j3`|nyH
>Wm>
f2mC(
I>Lq
1b#Y;
k\E9
, K>rd)
(Ju
1=eRd<
)K?&V
X e
B ?'
8}HmB
)E[#
w)tn
OB5sO
[Qw
X h
5tqnz
o/wS
E/X*
3&80Wu\
'"V^h6
A.7Ub
h>^ W
,.yY\QG
IQ=A
>>2c
1kB
9[a&
`[^;
K(Z[2
P>>L
.9#tn
X L
FVQh
GuidAttribute
rq2l
!VRl
M<$[g>E
Uu]
pObz
'D-z
get_OverIndex
X >
54.sv
5Yxp
L?-=
xQV=
; \]
&^{i
'AE^
F)Yn
8{-l
a.Q p
PY3Yj+
`K8V
dg1wH
)q^'i
TabControl
6"R-
km4V'*|
ZOC!
B5GLa
}?"M
F%Q1
+ l!-\g
u vxw{";$B
syB
D,H j
c=<0
i5 xm&
Y[ y
M6D]T
hM'8_q
TUv#r
{r7B
a}}O
t+$yT
<}42=
sppfX
"D&qqE
Ua0p
|{z
t0x !
W]0dL
AV^w
EVjUu
mS 4
specified
'7d;
<+t#;$
Hff
t.1k
$JH
O3[lC_
<1m>
=LS$
;Zg1
:7{s
rv=`}d
7c"-"J
vHB2'/?
w Z}q
3,qa
U?E:
*lbJ
KvzM
OfO8
;s,L
R"9<
"V j@
XT;<-
M3S7
|[0p
vi2y
%<0Y
,;D
`2ET
~pMw
nHR3
.+vw
2l@0#,
R#aP
oj;ppq
set_BackColor
w f;}
LvzP:
H7APco
8CXlBu
}mGw/_
Assembly
o~La
oQ<4
iM.M
) LF
4=p7 3d
1/DD
nHdD
L^ 9
S^0c
!1OS
IY\Dd795
L y 4
v/Hg
" q4FM
/@2}^
{@NL
|<jg
QO #
["+ 3
t]rP
LabelEditEventArgs
nXr(
>b0R
tg@5w
5N9_
Y 82
?a*w
Y 80
F9}{
V%MzU
~ e5@J
NYLh
F |W
. ?H
GquY
Y 8-
{JH7
;7v>
DRWC
(k.A+
Zy;}
4(]#
yREi
sI~k
}?
LBFU
0>BU
HE+;DZ`o
~w\=o8
~mwfN-
kcYW##
HI}%
4VO
gZok
h&\/
n+=v|
O*2D
69+j
System.Windows.Forms
|d$~
tC p
zN_u
M+2
zd=a
FR?4
\7ZS
bd:2Z
g"E
|Bv]t
(tJ-
s?E
Y 8o
IWt?C
O}*R
j1y8P
set_X
ToString
UZ2zsmH
D8p:
cjCD
K` iEd
9E%4>
)[xo
#+(z1
4FaZ%
TextBounds
F_6]
N]f?
O4zz
lHnQtc
Y 8U
~r|5~
/L2d
Y 8N
d@gZ
9:=8U{
!M2cW^
AS6*
-Hw7
CE# /
Oz%Ik
D!Zo=x
tGn r
`rS/
88fv
sIwul
1R@@
W1/$|
XW$g r
\s> x;$
>&aI
Js)
MethodInfo
83X
EUh.
zP>*Ta:
u$g]
a6'MW
}VW(GQ3p
SetBoundsCore
F\v1
x<U!P
Go.qr
h-{y?
Z:j@
pL`?
Q=j34
Kdz2
Q|4%
%3/r
86Dl
Lf/M
Console
LQ
E|if
2vF{5?9I
d#4*R
xeMo@
9+THo$
Q5"{<
Kw@x
OGQ4
Sk:_
S=_}
Y% R
+U+oaz
7{nP
?Y<8
get_Height
MUn`
)k6MU
q_t]
g@f ^s
YR8d!
[ *f
Jw*!
Xc@PE
SP|
6DjW
+N=(
zH=t
$b5G
]18?
,6\8
[$jEzw
&ws%
>} _5g
{e"p]u
aY"G
HTWu
j+W^WU
3?C8/
K C!v
F6>C
}B47
',_a?-
bJ@|
a3s8
7=ux^
Ze
cPD4x8<
%,jJ'
tj[T
6hEt
[G<}gn
-H1pV
-T@n
h9 07
+c)0
AVAx
M1:e
graphics
RctwK
{9 !
vgOA+
a~B*
N\V#+
`R mW#2
KX?a
C!:_
Wex,6
\,wy
]pOg}
4HKE
,_Ln
<*)5
-|UA
_3}X\
2.K0
mscorlib
n8 )
F*it
_'e&
=`o
`YW75
e q
/8l,cm
_6/3
D5(x
>ClQ
2w%v (
"9<%
l.}I
xhwd
u`X#
z.%Yn
`f+&l+
,lF ~
[9=Z4
N%^%
_X$Z
zD7|
)W +t
sDUT
uNvR
d3+{
'PV1
7+ls
="*cOqF
klVn1
&X0
<@wOI
c iO
6Wm5
x ':OhCH
V #.
#WD[
!~=
;EzMe
")1MgUCj
*LMF
"<}7z
thma
J}<
#'gA
'] (
XFrD
(j/p
3VjQ
lnB[
T)x"}OB
+^=l
6o1O
, Y
], 4<
JO] \
mII5
w7C;{
E7oL]
w_l
XF^
bQ9F
^%hc
H(!%H
\,,M
~e>
u0!B6
s6@G
System.Reflection
JLi%f
WN\ L
0$dp
^@Qr
bO ZY2
t[F_G
A*\F
915F
:ZafB
r=d^
ijnee
f`VS
hJ32j
MkkS
$>l
U~J^
HB>Y
O'4x{
\KW;
0_Pz[:
.]crS
*FSAw
9MJE
"T(o
@r9z3
:Nt,
$eOO
0Zm
:{ T0
`'gJ
Ebal
*S -
#-7(
C!c0
"{jS
T @S
nWj3k
|# YD
b13Z
4si-Tq
@?B_
Re+#
6 /J
2/oH
w:fX
System.Runtime.CompilerServices
z?V)
*2 q
6sN '
PVfa[
qPtM
tL1Il
* no
System.Core
zG62E
ka[I
Gdxx
Append
r@Sv
Object
:w B
m$+k
pI}n
>(i8
6)2z
~T[u83l
(9+r
t#-%
h"MY
'kbCR
Y)emp
z$\>
c^ bDPV
Juo*
wcxAe
$~K[_
Auqx
7OoV
G ;Tl
*b2O7]
4PWy
v*X!
~X:
`pS0&
+;Mh1%u
x:"
S0j3t'
aGO\*
Q>{F?uCpzW
f 2>!
+pFH
8)dyU
ws f!
~sD6
PX.1
wDVb
6l#f
q\Ob
AssemblyCompanyAttribute
:5zG
=9Q6
H 4i Z
;gL.
PH- C
R"Df
{{
#nB40^
1OK\
qy P
lL*B
;wGc@
=L \lVa0
}F<T[
x0hr
b6Bk
2f?z^m
height
D}.3v
X Z_l
1Wks_A
sy`&
N m<
{0k; !I
iI&|
%^fr
'fi D
f4f7
1]-=
=,s
,PFY
=GDm
I"s9
GJjLnO
5gOP.!V
cY^,C
TwhWn"
.?3$
<!)x
NB@5u
>o2#
vWPl
z.^X
RZmt
z MC
IE|M
(Df/A
=<A5
LayoutSettings
i%MsNQ
Y7'$
4HwHww
4(Kl6
'2[9
Ysh^
D.n3
F`Bd
L7@2
*R<fq
&0n
B4F0
`4S-Qr
gF`F
\}YO
}}{6
ux,}
:Pm5
J;^ :\u
o67
1 7(]
ZJ .
0JKB@2
yuy< [
lC5
=7C$t
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
oV7q
7Q`<
u'p'p'p'p'p'p'p'p'p'p'p'p'p'p'p'
<Q7|
G5<]
UnLpr
q&||
o+W0I
n&
UA1p
1%<n1
0I T
vY#+
=}C
Y[eg
axi2
Og)4
{}^-
sUv[R
.=T5
k &O
>LEc8
u6LI
{9MQ
get_Message
!This program cannot be run in DOS mode. $
^u f
<79!
M-@ F
~}1bwd
m0r=T
&F,o
[HR1
$Q?
Xm%Q
l} 7
m KU
=-tn
zl&a
]dZfA
TSJ-a
0c{,
HV u
1 j0
;<A5
*\$V
J>XHs
M 4
}bOL
ro]?
?F*O
!H8@
+V 2
v tt
=n;4
N4Aw
_])E$
_G `N+
KVYU
S;JG
Hj5M
DM
WVzb
\0Gw
)s} 6E
0+[[sS$
}M&k
Z?MItf
E"5k w
IU J
?vRlo
B*"[Vdn
=1Mx
`1 .
]0jPY=?r
}3cR
,\4w
T [i
Ng0dm
TjB
D@iD
2f
P@'
mnMA"Qx~
%2;V
E$&&
If3P
]-r
? yO
k"j*
E9v$
"-QbN
s46!
}e+
SioVc
tYG
Jx%L
T%gd
X'Im
~Pi^VV g
[3<-
1!wJ
zIDAThC
{6u
2 7<
p}Ev
3SJF
DVBV
zu)!Lt
0oo
FK7J
4qF{
~ |@5
L[g5
>*j
A=i+
?xxf
1G[y
m.>4=
QYiK
mf*+
id/TO
d ?.
a (,
75]S
pu#2
9@E4n
92zC
U$")@
N\`Pc4
;SG?
BSJB
Incarcator
d()0
^w2G
*#lh
,: &nt(
[()r
{~NO
3b5C\
],!/
!Qp$ 8
zx_4
|W#jq
{J!
fK:`W
7N8(`
'W.m7
)bG=
V H|O
MeasureText
^srf
UaRf
Q`k30
?!JM|
cC k
WccI
>GFQc
.rb^
2q$r
get_Size
Lu2O
YXtWl
5d0p
,8?Z8
.sS!
G"]}
Y&bX
YdIe-
xva
J|4%
- "0B
7"Hw
Mmz2
1%no
=zir
5QE?3_A
%]35
h1!\"?
PaU
%@Nh
c@K5.c
set_SizeMode
Qf? 3
\ %7<.3Bo
vZ)!S
.M8##
HGi-
usNp
gjDf
p\&x
#HQi
)b6O
System.Linq
ResolveEventArgs
P-Ij
Y Uoe
6wyU
Xjds jU
&uO]t
FT[
n0,H
7CH!
FN"d
gVc'
U2Pq
8#c1O
r:}y
-X/
CqaQ
* f1%
H<"
H,_P
V9 S6
K1&MH
l.M
W91
# kr
hzKG
jvfy|>
!I8>
ss+R
7(cb
<i~sL=
[. BRF(
&)R@
azMf
~s]I\
0guH
/A?^
&i]v
w[&Mt
FgfM(
P{e6
+- 0k(a\R
{ZDk
yKf9F
(m_'
/ +d
.|{"?k
gH]2
a{cQg
AfJa
rv7v
g_ 3v ~
vn|
-'/1FA.x
^cs_
5 6L
%+ `ua^
+ ,>u
mR&:
1O p1W
>\ &
U8>Z
AssemblyConfigurationAttribute
7y$k
Pdfi
+&+7&
"'e@
NJ|+Rr
,ADM
ek~X. j
i5|,
=I,B
|.K;v
cah+QT
ICloneable
BK*W
&)U>e
@&7<
/ R}
Rt-Q
C;W}
Y},U
s%ME
+bCE
P'3)ZZ
09J|
JYql
vPG1
V?ZK
M4E;
1<r@e}
-,ZD
Ogc!Z
6v_oC
[D4`
1l~T
}-XKM^
t(%3
&45p
8z18b
Y24%:)ga4eM8
' z
[Q4}}
~M94
[A1
:5@%o
jWLH
,DF#@W'
^w N
{GzG8K
j?We`
vHOx
matemdeea
t@fH4>
qW-.K1
ef G
ButtonBase
wLdjT
zs+/
5sE:
ti/j
8$t3M
?s L
Gmk
8|sH
J%e2
-i?C&
&(,-
cVVmQ
*!m&
&vJ> s
tVc &
/@Fl}
uV/N
YYNU*
get_White
M<MJ
K4Zp
`!="
^DMj
IFGj
Q|S!
bw)) X
&x"}|
3Lwws
q 1.
!9BcB$
!)-!
B~-W'
.,+
v2.0.50727
ISerializable
Mt+$
cDK
3@a,o^)x
ql s
W/l
#oVr
,pbB
+`A_
#?.VL
9,^$
xvP(
D/$&
#/p
='viI
E3e>
]~*|
Lk(
|t2i6
gCg 1~6wJH<
?LYh'
PJ=l
>*G3
EsB8X
j1qG
Tw0.
QSr
Wq|
U5XH
O,'-
H@ )
FWt]0
jC[i
e^E-W
ww1:
>xj%u|3$Y
=a\p
(`$o
;'1B$
Sq:*
U=7H'
J=qR}
D: F
WfH\
?B-J
t][)
qw$\
'Xn>
`aoT>
6p,]
!D F
cZ"s
!8=g$
*)P2
?o-_$
NY5
08g&
jh5/
<c}Vi
IN F%
bstt
Jw(.
9k +=!m
SA<9g!Y
E[]`[
B.qG
f&n
hu7>
>E@4C
d" T}
8+A}
xAk8
5@ =R
LHB4(
]g Y
<X)i
MqW>T
8R"nu
6Y!
lFYC'Y
F,5MW
n7c,
D=^W
Lm3s2
Invoke
qGDE
(b8=34
e<E"h{q
+I$J
T<z^mN
&a 'I
#Cf 8
y+:)
^uE"k
aTVS
GiVf
!{!~
}U5l
:JJ?
;"7#
N;T~
hQq
*N%J
=7B$
|3eB
=*i'
_%Nn
hCC3}GP
8"h
_L9{4
;B m
Jaw:
PMYu#
3LBjpL*
M!:)
W\eR
n h,
xA M
'M F
zwKN
^/2,
P *x
>OJ
wjqCu
n0d,
hYS#
T%<e1
;/)O
mcNO
IEND
_77b
\\ R
yfXX
N6vb
6~ HKfo
wRl]
.iV$ Wd:
Q`tw3
4>Cl
l3 I
`Q(?
/sbG
nBwE
Q(:-]"q
>7%7X
/c9
=g_q
[P\g9
wFoE
3,[a^Y
oV[mR
*=oK 8
D`q9
OnControlAdded
"H4
}?!cA
S]%%
1k3uw
R CX
Pu:@:
P*ZO8
#GUID
Y4Vc
5{6m
jMrz&
\T u
Gf)Gg
iM7p"{o
s/)OB
"N]V
Da6^R
-,XHl\6
%)dF+@
<U2v^
C@u3
Fd Pz
Yjmn
%0k#
[2*
\ABe
=hE
>F)[
e@B o
matemdeea
mN%1]>
qB$
MHi 6
;\#:
]RN|<6L
, X6
&@&7
a7pXi
9f or
7a-=
IQ8*
f}x%
.?<r
7D?`
+$J2
/%NB
S;7r
fu},Pe
>@ E
u&<h
p-$%;
,n j:@
_7`3
:_"y
2%eW
]c+LT/U
l*E\
M7NH
2>1(
~dV`#
PmYT
/_` }
$=z"
Concat
Mp$X
:GUD-
)&kfp
Mv O/L
=1n&
lr/%
,Cf }
StringBuilder
t1XO,&r
|=efwz_t@s
yuN~
>p0-
IComparable
w05/C
SKpy%
Y<cAbk.q
DH&</$
X"~B
:.v6"
p0I#
(P|V
%gHM'V
M'mL
IDyS
S,|#_
>%xn.
o$ ~
h~X&A
\2xw
_ @Y~
F7 $7
vv>q
>HX E
N$\-X/
Rd=j
QFZs
ctK98G
6v*Kc
(` =
#q _Q
h;0$j
iRBD
Y\uxx
3$|-
mU{XSw#m3
1ie/
h'Uj
:*bp:
7}-y
fmfug#r
#Me!?
{-Yu
6)cd!
KiPz(iAI
~ K
A^hur
Cy*M0
3<r
YJlV
F[B/
ZBUt
0b#>
33KLCN
UAgET
:1-
17 ;
get_Assembly
l5zT
^Fr
}wUU
0EVP
LHD?
7b gT
$6Fuq
{$c)a@w
2yEd
GHCL
;_k]
z"n!
5)b8
UQBV
wxeI$<<
AssemblyFileVersionAttribute
7ip3
V#!F
b/0s
iipH
63zYD
OU#tr
B<'"
cT/{
iC:~
.@H
$}x+
!-TZ
fH:)
mz,F
{o3k
BX@0*
+ w^
,M)K
f@o"U7
j`&l
+8 z
A!|o
FaKkSk
hH-H
O$~N
;%')
a|:]
ejq 3
Kpg
3 B,
=_Mmf
p]B3'
13n9K
L26J
]vq>'
MMCH
<XU]
8,2@
X'}k
hEekV
NYP= >jU)p
75t
-Q;,
GFjk
Q:<6
i _
Bd0
1(ag
"{1.7
+<T <
bNw;
9#?r
$=GL
w7uC{p
<NFe
u=?)9
:rV:96XR
4 0I
wfCG
"[Wz
E4HO
]Pp80
kR0}
NFM A6
~{B aM
GOtL
e4D\
tSp;
!S=r3
)1*3
vD|nf
zE,3
vdC?
F" =}
jL}q
3Ikc
j6r
L^_/
?{( a4
_!C[
:*?a
`;6~/
Pe %
{1C=
JPsT-V
A-|'
. J ?K
u 0S
OnMouseMove
Vm(l
5&s'0x
Hbac
Me0*
rhis
{"uo
nWZs
;"0p
*5a'$
2J,
@[lDJ
R R-
}GB/U
!gz@~
:{r}
uRe'
bx>x
`5z2}=
hsN2
L|.Q
m9c%
b=n
YF#$
Ybn
:*:f
cKj 3
|>0p
LMzp
D %
Font
\JgN
eUyZsL
`FN9b
5(aL
|KW^3aNL
TopTabControl
G_{}A"
D @(a
n9!@
3tpv
QI'
a73'
5bg%
hkN2
|CGw
< N=
7i<[
xl18w
7-)
63cA&$#F
}L?3
^WmS|
o'9z(
rb2Nh
textFormatFlags
)Q;|x
E ,Rc
LKhkn
8[\#
$J}jy
'SC=
RZK
dcB%
Zm
+/@4
N,f(
;OtZ
KJOp
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
BoundsSpecified
P hG @h
<rnTG
<Module>
7Ha
$G5!r
TextRenderer
A!"d
get_RightToLeft
Q=!
vz z
/RFt
t(8,
{Zx-^
Xydj
j&"\L">z
*hK6O
H}w^H
,$dX
#Blob
3NYF-me
dlYv
y:A2h.
InitializeArray
# Iz
MJaV
/hr }
G:3}
C6q6g
{jrKF
!:cLQ
9m[s
>H,4W
.s b<C
2G`,
utc:)&_T
{BW AK6LX
N551c`)
6 R#*
f8{s.
?3Xn
px"wfL,
|6I'U
\EHL
-2DU
#b#C"@
Eqv"
Me+)
Qk@[
`QWd
Rt}-
EditorBrowsableAttribute
.y_Hy
WX<~ P{
sK)M
#Opl
j,".
=vB#Y
" .J
@/&)9
:{Gw
u^{s
= cS
Va1(
1W5i
L J"
KVUtq&e
Lgwf9
#&fm}
FVM
1pcq
n *
??%qT(]
x:r'
usz
<V=!
UPF[
kP{j
lS7%
}(SV
get_Hovering
"|Vp
}2!D
VQD|
}(S.
(nuj
aF ,
Y0Jv+t
N9m1
.> z
Hg#)
$#sS
fy*+V
)y'7
77_m
h5J
QMe+)
%BLr
*WVg
P E
_/] g
Load
Tg!v
IFkS
Q@]}
QDe"
vm +b
+: E
=miV
Dq6k
^N$a
>XI[R
G UEcg
System.Drawing
qT*s'iH\
xtz _
=9mG n
U=WB
`t'"
#$.QUTz
_E[i
Rde=
; TK
`0~wcEp
]7z!5
dKQ}
;JPfN
ra ~
96N
$|}<ta)
SetStyle
XIym
"1J
ALVF
VmON
%r['A
<~4
msu0
!)Rc
VEBS
e8UQi
V#E#
_3}v
>5#
Hb'E
~=s-
#*l7
QO(
c{V:
)gB[Q
|DEv?
t(/4f
\L_d
9;pHf<3
QMd 24
7KDN@
b"g/
c85=
}Wc!
\]ZV v
st=y
{ft`
0e+#
V0W:
#)X2
Js8L
6 Oo
w:LN
V9 r
:o \
S_7
j:2v
#w8F/
p7D
afE8U
nr#+
.=6QE g
%"`!
:}Vi2
n3H?
!)rc
o8-qe
g)~l
^UJ&
)2ct
Hz%V
*vI`*[
4o;%v
/=qd(qK
Uc#D
3d${
RuntimeHelpers
a8}b
t"u%>
~%}c'
<6sw
QU0o
R&%U
9:xJ
!o&W
Vc!3
kjjw
g U:
Y Ibw,
HNPD
=<^N
~iQ(
T\1
%,6<=
oq`E
Eev"
A @L-
k;t
bo1x
p/{Zq }
L<CCXj
&ft$)V
+w'F
yZ&R
-[<6
r^cBR
&/ |
J21KF'
g2v5
<Xnwcxd
$mRqU)
Tu.
1FyU
N{vO
u^_
N'[t{"%3
pFAQ
+rd)
c07Q
0Z%PoU
"%d[
D(ZB
R"so
r,y]T
y\YD
FZ3m
Ro1luL
o[XM&
LYXN
&=^e]
%i{7
}8cs
$4q'
h~YD
=Nqx
x:6O
vC@a5_~
W"_s
$>>6
bDdy
5p_~a
d1cl(
Y%=5
Kn+V
ComVisibleAttribute
..t
^,w';`k
=YyU
f WI
Z313*
vRteP
\8nj
<QNv
p]ti
%Z
$6NFo
(%DD
uMKqO
$1~X6
j :+
ControlStyles
l[*<
&KcC
!@?f
wrCVY
Vqn<m
8#a`
K~!K
H\# /
QTXQ
W$?#
7Yi8
@@53,
Z!yv
RuntimeFieldHandle
W":Y
0OdF
)~W~
kQu8
2/iSN
,\mU
/M1!
E g
XzDJ
?dY
y`J
goSy
?97J
Lg|[
A _
;_LT
2ex
[O@\
!5BJ
o:dN
^sK%Q
b AJCn
EditorBrowsableState
=]epv
gO_+#v
9j0j
I080
*]EV
_V,
D_a5
.ctor
V\ 7S
T;fr
)k6K
*%?Q
Es[i
et#-R
b z8.^RlB
OnMouseLeave
4(=j4
OkK$
3v z
| Sg
/YFy}
1.0.0.0
95Gb
Ma91
Ej>
&8Bf
.a<:
A=wpObJ
F\/N71ml
0qW@
Y~o*
,kf:
o_s
pq1 0
(Uh
T;9F
e,*
>dmM
; K3
uMRBw
r\3o/
%0:H*0
}IE-
mv!G
(JO=1
?2a7
(X&r
c,/TB
MarshalByRefObject
'4>$WXiK
G%QX
B(a%
Oc"=
WzM"q
<{\t
*@J0
/#g&
r(A=
:&E;Ua`
x6K
}Qnz
[/j_
2V p
]e}TJ
Y O.
LyqE
sRGB
'L;
U)# u[
>ZNQl
'"e]
cbN3
!1/p
jYyoX
R`k9
ofpS:
Bh9]
+0F ]'
X5E7
yTh:{
+KI'%
3@j_:
H+V!
eEbY
0 AP
gEHDl
iAyrn
^020i
~
S*]k
E 9O
get_Control
`tKw*
*sv.
85cC
z[$)
(2XbLUup
b{V:0
\JNg
jQ8z
ft p
##W<
)m!MV(q
A 8}
so\P1A
b$-n
}G'
YzsJ
/8F l
\3rW7%
\?m
n.|Z5`O
.*]^CZ
~C^.
\;S
G"^N
[)f '
Me )
zqTpcz,
QyAHs{u
/z6|
-jL&
0l&E
/0F }
1/K1
9Z>
LAGv
ZI S
#Wna
}VP
sG
n^cSSu
dM1c
#96}T
?SF=
}y}^
/-"b
Q:?Ca$
@xpd'
M2qI
p;[lK
)8[Y
OIAAm
G[7IM
u.'i4
*))/
UFv"
e nO
2 Ti
(C|x M
Oi*N
r K^
:J)1
fCU&f
75NB
CwfqKCw
Zy#h
m3Rn
#rb z
eRYJG
v+wo{
zqu8
o~9xH
WWeM
9h L
]5Ay
*e0p
/5F(}
$la_>
IEvidenceFactory
s:7f#
_ W(
m1jH
Z;l3"
<Z2PDZ
^/ $
z8^v9
(s<O
;U v
Vx5J
Zk6m
QIJu-
L/CR/;
uAsZ
get_X
e{+)
-ixN
$'|y
\8-(W
l#m`
System.ComponentModel
~sw4:
'vc
=Mp,
:Le'
e:^R
-O-J
"p8S
g-*X
*y R=
o&Hb
IS6q
JG<!
D]sE
{bl)/?m
{W >
set_Width
Zh1;
#}\@
lBL.%*
_w>
Fk:y
H3$f
As#
w9CS
BHC\
SCr0}
lgu/=7
MS|q
O +I
oV{^
12QpR|
Y~Y4.WU
IP ^
z}f'
-9s?
get_Graphics
0\"@
J-Q3b
-cf}
q8<[
i: D
(;K(
W mf;v
J?=r
7 M
H*2s(
RuntimeTypeHandle
k}B+[u
.u;c
k]+Ok
Vb!8
item
$J}j0
U zGoS
gF YH
W5%y
<oVz
1!L"D
get_SelectedIndex
0}8q
pG jL
..K;
ncj81q85
z6
>Me+)
}M0F
ghu7
5 q83
+4 E
6MaX
Qo)Fd"
jBi
e p
0E0FA1A62DEEBB1E981471F7A1F5C112CB0A9C65
j"&W
=AUc~aX
~ACZC
PjYZ
}cc~H
Rav7
<KPa
3{Z3]d]
74 (k
LNR%
CMaK
;} ZR
R6qd
Oc _O
SXVk/
Do?Ok
R$t~+7
u|K[
FaI3
1DdX
V0"X
=++8
OAcs
}sG
r'ZV
)Pt#{
; tRi:
8%U5
`>Yi
6DF71263AFFB3296BA91B14181DAF02693B8F22E
LVC46
l3=+
_Y $Q
K36eS
/j'j
b}mSYd
/%R`
HHJ7
Kn}kK
3 r.
UIc!
QtuB
@?rQ9I
U/cW
:Z W
51P'
=b#7B
}Vc
*JJ
bd5`]
>TOS
=7C$
"${
_6}B\
I&
f=$Ra
=6Q7
W_8p0
U2#D
OwH RY
VY8t
^Pap
OverIndex
$k~N
}Vc!
zieK9
,!Ac
ZY0
_ )V
50% 8'
1\F[%
94[0u
LHR56
=-zH#
> Qk
RAcQ9IA=q
84Du
Ya:i
d, 8
9|qsW`)
ZpFB9r
>@,E<?
& 64
SlMz
r |x
3r.%
czdO#1ex
Dok
Ym4%
)%'g@
SICK
09EI
n5`eoos
i(T9
1q >
"'mM
w^m/
A 2@
vb$+
Vgb'
FhLC,
& },H
Kz6
":F8
~9 I
ArgumentNullException
:z{B
E)=T_!~
6lhO
A7IC
s)-xK
Lt1!gD\
=mXnV
L 3![[
B)^g
!eo(
U"}<Iw
M%@be"na
Mxwrn9
'(Q
3392
uooLT
oPeC
|2sO
/O*i
nA:?
w]Qx,\g?~"
Mjj,
vIL1
>3+)
9AH
y!\0
t}bQ]IL
RR7!
Du}1
' I,l
=a"p
IySa
If!=
+:0;
)/Q~
ZIE
Y_(m
bQ+
"'aF
x.V Y
QT&M
rX;~
{OfqoL
6PYg
h T
#Strings
p{ t
#~5@
TextFormatFlags
a+R
<p@q"
6wKB
HS4U(
x?:M
sckU
<v;,
B@Ea
}]$ef
Ex~v
JS;4
R/ZR
z8Q;?
rbyB
r%we
Fj3{
k.K;
A- a
~G*W
U; %
Hd?;
uD}7
kf(k
s b:\
n5Grk
'@&#f
!2 mr
FwLFw
k=*>
S" 0.
OXgb1
S ]M
OHh#/g
vwnuy@
(V1=
<1D/
ZY0
%VC^
viA*
_Ipm
di*
W/ d%
Ii+
ZXX^"
aD^ b2
ctnt
@33@
TabPageCollection
`l\a~
>et^
get_TextFormatFlags
IEja"`
)&=1,#
.i1jK
,:9EH
<;eu
n[I8,
UtyD+G
?&y9k
y ka
cYac:
wLMN
/i39[
zr X>
wu24
4|k$7dT
iCEG<
orBLl
# /c
lX'{.
/\&:
,][,Ew
q,}=q
}TG
3h)m
^O/<
PoW6
Gy>
9'z kl
5}!C%!
JCqu
('fQq
90~\
IX\l*
' FE
I=o
A\K<
`,@+J
.*CmR
H*dDOp
2N@{
/~cb
mb./$
]f 5'
L =:&,t4o
V*=!
z[*2ru
FZOm
7%oWf
PaintEventArgs
=K08
KyfbL
qtbr
wwVQ
Y 8s
<W~t.
"[,l
b*$?
{rMw
D><z
{Om;
[*Lq
7BFY
_H% L
{3In
=My6
y'QV
0$Sf
3eS!
f]zp
5zGn
]&31*.
Z3"40
}I^=
#z) gt
RCSw
bf#5
CcqTs
or]/9
^~*hN
:hkb>
qdK,
JSK})c
i-Tb
9$Bo
Y 8k
I*Ys
}t3
n353
IDeviceContext
}`F%
cY>.?G
}* !
[tv'5
MO!].
f->|B
8pR^
~IDAThC
?mwJ)!
hq/d
x1)_
DHG47
sRH*
2[in
O( C
4F7Rj
4}dT
: E?
7<2(
\ S@
n)Au
>=:<\
-T.pPg
2L;V
System.Runtime.InteropServices
56g@
~0M%
NM\m
t@@;
NkB`8
$0n
SE]$$u
}2#D
#' @
Enumerable
<~NrEUQ[
!x/c
Math
bYvp3
bJY^
lUMNiys
WwGn
jpG1pI
JlTj
7 bS
Iy g
RyQL_>
0J@Aj
I&fN
T@<'
r-/b
a>t:<
seb&
+Q?{
A-M#
!YOc
LjMG
n%1x
4,p(
9H04S 3
F7Lf
+E-k
4Ai|p
6<$1
fYN
*l89.
M:Lm
SuppressIldasmAttribute
5Pb7
iCP3
\Y bK
wHI
hq`S
P9mw
u21x9g/n}e
l 1z9l}
{$ZG
9\ZqN
n36<dY
Ils(6
~})F&J{
akeG
% p&
z<(f
7sSc
get_Y
xip!
&vfP
5Q ?d
^.,T
MCCaC
;wk(
E:52
bF5j`2C
-Rb
"~KZ
P~H,
Y 8W
F 8^ %NA$
Tyx
^E/F
vi*0
3;) <
21z5
<QF%
9'>b=3
?oM
l4,
-5pm
]> e=
VN])
[~.J
82X{
~L#h
LR h
Yv,f
'&AZEP
%Y#6
5GJ0
?TW3
,x
0T.o)
m&)n
;_ }
4C328BECF729897AC2F385EEC7A4AC09D7AF383F
[R>4<
IC;%O
MB T
set_Font
= < < < < < < < < < < < < < < <
63TG
6abR}
ItemWidth
KIjBQ
Q80.K^
z2dS_?kR~S
qi8{e
$8d
~%
bM<eCjW
5x!mc&
%m<;
)&Yt3/)
,YQkz
Zjb6nDb
}xc8
Y 8C
Izm
}b-GPj
qSvk
l)$s
sO >$!
*e\C
wC" )QG
:=;&
(Eu
E\'8
}?aH
WaeT
N Z&
/1nK}
w8}H
#d
u' i
#Es_\
`YS8
M\|Y
T\Kb
KH3"
^7&;Y&
485g,.Vp
$^i<
C5i~8
|$]g
J<fL
/Z0R
WZ&f
"Rm'H])
jFf^W
W Tf
*xb@
{7@d
w p%S7
,8Q{!
ux%n
M =D^
a trO;
Ag2C
E^%Y
AssemblyProductAttribute
J$_s
zmfx
fBW"xy
k+%d
\tg
\L*e
|OpdmI(
M`+
4lCM
yo"&
matemdeea.exe
~o8"
j(>E
HJoy
bSXk9wJ
E({m(|%=
2F$B
T~1Z
6-sb
; n(
i6BWm
Q#Il
g3:x
Q_K,
&3 i
I?TmC
Q&p,L
&3r[
@[h`
GDCOO
+;l/l
-<Yo
;'0<u
CHRa
",Vb<
CH%a$
4HxR
UXGN
<g=U
t[mL
-xvL
4 f=
]=EQ
waw#~UK*
VZed
RPNe]
\2J@
value
60}X
kbJ]
tj '
k<lof
3,dQP
wX\1D
2018
BV Q
& -)
6F VS
4!>a
)b{"
JMVI
gQ(m
h@,J
\tJO
Y@D7H
z}EDLHH[
2C!3v
8n1au
4%+tB
7RMq
l` -dT
B_G`
s9.~
A 5
pP"MW
qtUq
TUkc
y>NO
#|Vf
s~aw>
3,r#
M=L$-
vd^}
9 H %
^u\,
m]Sw
k ?0
R"0:Gw
L~wG
:vTKq
nLGj$
?lk`
u&hBK
Si$
%6Q7_
z314p
qjBL
<Na]
pw,:
hqX4
UY_'_
[FR^
D?s`#
S <~^|
9;!
!-RbO*YA
q+7Y
^zA&
RyC t-
bHw0
WgX{
Wc*
4G,[`
.`2-`>
@#k
W6i 4o
wOXy
4LK]P
g/z Si@
@}<_
5%zo
5XB4/ #
@e9u9
1|Q6y
+i*.
RExz
5#% s
{Uik
F-Lv
9_ c
_=E
R0 it
nO_6
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPADp
?#l
S-^O
ds hFB
meJ_{
X)bw
_}EZ
3sb:=
W|#nt
Re<p%0
rG9s
LalU
RaY4^
,rpH
_[(Q
oY4!
' kF
C%L
_B5}
y6"Y
\D8X
#(1-3
"V#J
"F8*j
E'3/
&=`t
{uTA
62=m
_8o
Q' I
BZgN
&6X,
<uUHL
9IaI
n*#6!
a']l
**C7
!|CA
!wI[)
wBB@
?O":
%_s
/icM
L9Mm
KiFw
4YS"
n6>]b
%(xl
Ccvl
X/h[
nhVk
dOR#@
~4@N
X\]*k
zh.FR=
Na:>Og
a@&6
Egg8V
dIPD
' a_$
'K3^
}EIv#"
Fa\@
;qs}
;A|2
86A\
\-q+
[Bx=7
J n>
g`-9
wC3
8U7K
8G5|
goJ<G
f8G,
/KC }
F8\g_E
<cP#
6=V
= O=
7C?x
IConvertible
;6:Q_ >E
@Cpc
!TI
V{<M{O
oK 7
,U-8
rlUSD
{4R{
G.zX
?-=+K
(9[`
ZO?"
9LE<.
F(8v
mQIwXD(
vysP
v2!D
vrXF
w lI
QaSS
Yh:!t
%MuG
<qh
BSt
e<\~
L[ 6/
IEnumerable`1
D?C|W
MouseEventArgs
+-z8
.=1qk
E;,u`
LbS 31z
] Qg
gq2+U{
=LYd
,~fv\
=9J(I
Fb7$
h VM
^LDn(
o( r
&W]&K
M 5
q{Jp
g^m#
ov<#N$
u,4&
]* 2*
WDaE
p#?^
Ud})
.~Fai3
cNcA
""D
Kn$r
HO+
H hDp
E#<d
F&H:BJZ
@aUS
LY))
jSq^
&{[Zy[
>a0]
2xyf
MLG__
&L"r
>8O
UU\f
t@XCx'
z9*(
9vTcs
nNv ;
S`'K[
}xFK
5] >~
g2?is4
f|W-g,
CO= < < < < < < < < < < < < < < <
o{6m}1
v`\Y
K+0Y
Qlh'7
ToArray
TQ]+
W6<(
{1;!
yP+/
|o< <
''+{
</e1
^a0a
EBExt
:{\G~
ldIM
ResolveEventHandler
l,PF
:k g3
m.;|
q94dR
)O7/
gU-
EXgCZ}
MF*fo
+F#3
Rectangle
M +;
1uM6
coyS
%8e,
kqa{
T:+?
htGS
u/;ki
tOp7Jap^
=t#/
XvV&R
Graphics
$8/$
~k"=Os
xeYH
/L$T
mscoree.dll
hDt$
pDgl><
!~ p
B9Qd
1K`Y
/t|'
1nrj
/0F }
m KD5;
3*Ft
,"}fT
LLfo
k A&
W/R5
rb#5KK
+-~
d*-p
3*t9
ii4]
j q
~d T
^@n;
\V"i
$EzF
0 Cs
U'[9
e27j}
[|[.-
)14=
,=U 9Z
nn~~
l$]Q
$8s@0.
*<3K
#7)L
Y:|[
Bmp4
}DNE
BxMt
)'o#
:4.<RC
cls
e [$
) n1
=Ko.f
|uyu
cM&:
o*nTde
yc4u|)
$[z"
\VG"
Swza
M !/\bQm
"w V
f 9m4hJ
sxh
nc<x2
Pyy5|a
DCNH
X;X4AY
|I8!
puP+Bs
?F E
XQg"9N
L{ll
Qo~G
[_X-
*I @
@a<N
.V#Q%.
#t7
.cctor
zO,
+3T
5Y \
#'g@
)+oW
Y*+r
d~UY
~fVmG
-MS[Dt
@ g
hts5Q
TC;a
System.Drawing.Bitmap
Contains
;TM8
h: ?
- tV1[
kK?C
, fE
%#&$
Xd*i
}ZrO"X
vksU
^D V
>7RX
get_ClientRectangle
/+zs
+CU
Gc7
o'c!
xy85(
~$7[>#
H~p4
6 E]
"A$I
KZwXn
T QI
rmZ8e
gAMA
. 5!
[c6~
x`c~c
Me*
vv?"'V
-Lp9
Gm{t
KgD0
?^2G
69%
V P%
r% $
~nO9
f_?v
> OX
`:1e
:^L7>9
>(^b
_ ,O
XOa&}5
XM6
E= z
g7TV
Zu]f
tww7HH(
:!^4
_,0G
], 5<
2IV o
EI72<
!,z|
,=*Q$
VM'i
7*4{
4-Jq
(uFQ
RwN: c
$Pr*
3Uy-
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven07_64 Seven07_64 VirtualBox 2018-02-20 13:11:32 2018-02-20 13:14:27 175

8 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven07_64 Seven07_64 VirtualBox 2018-02-20 13:11:32 2018-02-20 13:14:27 175

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\niw.exe.config
C:\Users\Seven01\AppData\Local\Temp\niw.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\niw.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\niw.config
C:\Users\Seven01\AppData\Local\Temp\niw.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Windows\Globalization\it-it.nlp
C:\Users\Seven01\AppData\Local\Temp\niw.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources\matemdeea.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources\matemdeea.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2444.2444296
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2444.2444296
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2444.2444328
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2620.2448406
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2620.2448406
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2620.2448421

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\niw.exe.config
C:\Users\Seven01\AppData\Local\Temp\niw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\niw.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2444.2444296
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2444.2444296
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2444.2444328
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2620.2448406
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2620.2448406
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2620.2448421

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\niw.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\410fe546\7307cd04
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1e5833dd\40ef5613
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|niw.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|niw.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|niw.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1e5833dd\10592a67
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.DeleteFileW
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.SwitchToThread
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
gdiplus.dll.GdipDisposeImage
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe"

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-02-20 13:12:20

Detected family: #Malicious

TheSystem Itself @ 2018-02-20 13:30:01