MalScore
100/100
MalFamily
Malicious

roman.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 13/67 Related 2697
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 510.50 KB (522752 bytes)
Compile time: 2017-05-08 05:02:35
MD5: 7c1a4c9622e4b76e03aa95e55d9ff895
SHA1: 25b3129ea5a77afdc84fb80923f21689f75a9205
SHA256: aa305c826cfb235b5741ccd1c36fe44c67819447424fbfdefae798c247f7ad43
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 ;8ce)9m .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-15 11:30:04
Last submission: 2018-02-15 11:30:04
Filename detected: - roman.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/roman.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-15 05:39:59 [13/67] VirusTotal
PE Sections 4 suspicious
Name VAddress VSize Size MD5 SHA1
;8ce)9m 0x2000 0xd678 55296 d64f85deef1c0cb52791ac059d1b1dad 0d8f4ba81753f1160ac98af71421df14b0aff399
.text 0x10000 0x3dc68 253440 f9769a90b80dc182894f94f59e737042 a09d46cbc7af877f1cff948753f51f79dbda7fef
.rsrc 0x4e000 0x33a38 211968 bbd83a933ea37d9378484ed5331542d0 7d40048cabc4c2073f1d28d30c433261661c7d2d
.reloc 0x82000 0xc 512 4e4a67c1ffad72c688ad19cfcdc4fd13 d14eeb3fb7574ba336983085b070684b350f4b1d
0x84000 0x10 512 da8c3884b98792b6bef8967fcff539d0 68e0303f596b209249acb6097527889af6738d8b
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x4e130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x8147c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x81490 952 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x81848 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2017 Duke Energy Corp
Assembly Version: 0.0.0.0
InternalName: roman.exe
FileVersion: 6.8.19.2
CompanyName: Duke Energy Corp
Comments: ibadaqayubowigar
ProductName: cobas TaqScreen West Nile Virus Test
ProductVersion: 6.8.19.2
FileDescription: cobas TaqScreen West Nile Virus Test
Translation: 0x0000 0x04b0
OriginalFilename: roman.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
IP Found
6.8.19.2
URL(s)
No URL found
Assembly Version
VarFileInfo
Comments
VS_VERSION_INFO
StringFileInfo
ProductName
cobas TaqScreen West Nile Virus Test
InternalName
f08f0875-e30e-0928
f08f0875-e30e-0929
LegalCopyright
Duke Energy Corp
f08f0875-e30e-0924
f08f0875-e30e-0925
f08f0875-e30e-0926
f08f0875-e30e-0927
f08f0875-e30e-0920
f08f0875-e30e-0921
f08f0875-e30e-0922
f08f0875-e30e-0923
roman.exe
f08f0875-e30e-091
f08f0875-e30e-0944
f08f0875-e30e-0945
f08f0875-e30e-0942
f08f0875-e30e-0943
f08f0875-e30e-0940
f08f0875-e30e-0941
ibadaqayubowigar
Translation
6.8.19.2
f08f0875-e30e-093
f08f0875-e30e-099
f08f0875-e30e-098
FileVersion
%q^
'&)(-,0/32425262
f08f0875-e30e-090
b0b38622-1ae7-21
f08f0875-e30e-092
f08f0875-e30e-095
f08f0875-e30e-094
f08f0875-e30e-097
f08f0875-e30e-096
000004b0
Copyright
ProductVersion
FileDescription
2017 Duke Energy Corp
0.0.0.0
OriginalFilename
f08f0875-e30e-0919
f08f0875-e30e-0918
CompanyName
f08f0875-e30e-0911
f08f0875-e30e-0910
f08f0875-e30e-0913
f08f0875-e30e-0912
f08f0875-e30e-0915
f08f0875-e30e-0914
f08f0875-e30e-0917
f08f0875-e30e-0916
f08f0875-e30e-0933
f08f0875-e30e-0932
f08f0875-e30e-0931
f08f0875-e30e-0930
f08f0875-e30e-0937
f08f0875-e30e-0936
f08f0875-e30e-0935
f08f0875-e30e-0934
f08f0875-e30e-0939
f08f0875-e30e-0938
<*S_
\NqOP
pKAsJ
H\<tPs
q R
=xc%
@p8h9
t$R%
V L
MOw;
p#(
2jMA
rW^cN
Ps!#i1T
>3h=0
qun^Lk<}7w0n@0GH5rU<Qz:M
88COi[j
Int32
aa![6"'OqO[BgS~8aSPJP/Is
""lsf\|--<6!u]tEV$%]<EQ-"
ig-
L&c
\(n-
! U
Im:&
t~uV
d96]{
ObjectHandle
<Mw^
'=.k
c8p
{UOx
nJ~K
u(~#
^#3;
&uP{Nz}XXq4(Ny< B[ObeZ)+"
JQQ
FViP
jxS@
tuF
u"K20Tf*fuR[$"m+zSCx*%p0*
)N"1
:l40r
0XH |
ResolveEventHandler
Z h,V9
nI))
get_Height
l5:\
T|aV^l'6P+x}FpB`GZB0,9mC
0+ce
B6-!H
;qT$
M\4jt
|sl
Y<_
E Vx
:R4
@%aK
T.g<N
1-Z2O
h#Wh!
W+<
S>La
{ G&c
C>F\:'k#o"i'03pEL=w5`U>@&
|9rM
jzvS
NhfO9e
8A~J
P3ML
CIjb-<s::ZthXpw~pX^^"T>o$
\r`Cj71
odn.'
3fK4
Version
Zj4[
^ x$H{--V
M @;@V
.`wIi
mR @
A54E*t}q70g:(Y#15IU&Geud!
C:,k
[m\"
9?@v
W;OF_
X (+
gqW}
c<W
*zA
Copyright
;\#Z
set_EnabledCalc
Aevg
!qws^vIPN@YV!)X8P[8IbEQ1
.cydl
<zz
4kF+
sH,#
4%}vb
mOi, *
ub2~dAu8knAH"+~W1nr:"$@f
6g{%
xB$XG
FOaF
PNG
U@"Hr
40[Cl
_98O
c:!o~
]1bS<)
^t]y
v2+ky
TsyA
ControlStyles
&Lnk
c6!+
Marshal
#:Qv-2,
R>8t
!:kN4
"Q m
a !?
mf- wU_
U(no
)w#6
d1W1D
WF0YlF
apO[
@l6:
9!Vg
guuo
x# 2
GaGw
d"l(
h# P
0-@`
op_Explicit
RuntimeFieldHandle
$'%`G&UPtz(*J3$9<r<<8l@7#
:dQ@H
,:%UV
P=xV
}IDAThC
{f9b
,e6Vk5
v/|B
g8 @BEDMj]-m&g& [`pT6txk&
7Si!#4\doH(]\akK##jiJ$+>#
5@Ol
(wG^
T Q
szWG!c
$oPwJ6QrM;"qvEoz@UEEQyc\"
Ku6c1~
7OdM
ZXJX*V
(Kvf
6o&w
ZXJX*J
g* r
EndInvoke
d+2;X
r+V^
20l
^ \7]
JYml
pf:
.;5u
}zCl
+0-{
GZfm
dRh1
y^s b
:~cJ
3v+z
e3do
{vp%
wv#w!
A HJ
4@ L
{Ij.(
'01)
o0$Y
5\ W
Q`Yua
l5 S
8k3Nz
Write
`h]{"
~V\h
PWS;;
mB|{
T:wC
~( (QDL
S+H"s
dH>^|%
:(zhNL
5^xK)
+sU~
odN-
c3J0
1sNd
"S[s
KAU);p
CQ$D;
set_Alignment
(uZ~
2n /!
AssemblyCompanyAttribute
&7
W7ro
az:NO31
A5w+
{#QQ>h
#KH\
xw?q
y?7q
"~wa
0N547
pQif
qG*$/p
[uM1h
l*u\
6b!N
/CH(h
QFx]
sg*# !TKj~c9\dzP#rRH}9jc$
>!3wF
?W>u
/&@B
d2,=k
; Ac
~`>6C
;Y\S
:tt^={^,;e2cY(%d$Q3grZug
{)Xt
s?(I
h Xzbw
N{at
:)qi
uKn~
gJsd
AeOx
AppDomain
W}B1O
H i;
`.rsrc
u~pFgW_
uu`V5
>[$31F<=z*#EQC[n8Efr3;KY*
C lN
zgS|u
RaI=
get_CurrentDomain
VYn%"^iVKP8A_bv/<~VRiDLv
0U&8h!c
9in_
E c3[
<[u
c1{6j4=cShXWZmS[+6w7["pr#
0:hp
xB4}
M&`A
9 i
&##%e$I/?D}eOLB5^ddf6|pD!
W4BD
*^=%
{xt
P+A}$Cj%~!pn'Wyt7}hr<|`n"
lc{n
b8-
9T^/
}Iv
383q
Q vc
8QzHQ &
sd Bf
lFpj
0 kV/
G?}\
^7@YNJH
v8bEQ
x9;hQ
u^+f
,H;i
{ zs
C2
AssemblyTrademarkAttribute
I6;R
ub)}
cCl~
hyh-
<)>!b
k)z(
w43?.1t
SR2q
$06Y
[3b~NN_A
&cbC:
a8Gu
- N_
^NDwn
!;v c
F9!21
0'7D
G{A#
^Yl#
'acS
3l3
!mz9
2'Ysze
h3n1
wFb5
,4 hW
#Blob
Control
/b0R
YM+Wm)
Ia{sH$
U]Nf~
GetFunctionPointerForDelegate
0X*~rq
7Yqa
3 Z
#x/AZ~X
lg,8
}3gs
p)`s6hR
VPH+YFt_b8RDm}=QG'bM0I>-&
zn*o
ju](
H>bq
LF$Uz
?~oAU
w{c/
T6h,
x%%9t
r #l
hp7v:
*Vul
OxAo
BindingFlags
3?}<
^8rUZ
=Elr
S EV
"M~c
[* %)w
Type
3hy ZD(
|p]xC!J"GKFZ-_?[+''hx,xU"
At +
@kIec\
^ &
TWQ1Y#,\W]EU{:z1@MK8l_[5$
3Z, 'F
`[FS
Thw|"6
8<H@P
e~{.
mQD5v|
,Y17
_'z$JOf@\5%RoW3oy3+/nyN>%
fj2c
)i
o%p%
~X2 I&XH
6q",#A
Y@R Sn
EgYX
5>N4+:|7`_LnE>^!9 ijQBL%#
LcgD
j{! t\
Q0>W
9+`"
kpMY
W}$h
wg)E
-{V\
Cursor
u#sM swoj
.+*
n).G
>;^K
b 0vN
E5o]
Az'b
.Jl.
e%Pi;p
/zI N
Guid
(a4(
_Ku
_z]Dx^
p+Y:m
LwMw
Char
1WVz*
3#E<F
u'p'p'p'p'p'p'p'p'p'p'p'p'p'p'p'
yvv_
[K"9
/|-7X
@!y5
1Q[/
3T N.
VQ@?)]LAI[\|-4d0p6^zA-PV
Hl+t]
w_[z/
$< 5
5 ^P
&>3{C/]@2"O!m%R{,(R)UI0&"
2H7
;a: (se]
GetValue
#& 3
4t}KX
.)9 9
z^_o?VVK"
m83{
9 i[
h+I
ODcV
:h>iw
S[_3
|8E:
GjEX4%Q;uUMWu[cxa)4kU7]B*
qeT}
get_X
get_Y
pU)\pKA
zRzB
Sa>'d
di1J~#
^w)>
'$$vKABw!?s@?:Qw75n;?-:W$
0;+6/
O"%/
gxmD
|"/u
>=aha
r4i#D^=)C}(k}aWad?>@$vN3#
*2`3
VirtualProtectEx
#UgC
o
1^@B`
d1
get_FullyQualifiedName
3Qk4
P-+7I
#6'K
n0NR[
#G*~)L{TsHz_?DsoT3h#,0hL'
hMPd
yuyx8
vaVK
x*O8`v!IDv{ ow7h#%+HjTF9!
3bD
]@&
PewX8
MfW"
9=Mr
M~u;5(aN%=4)@Z:M4if^]pWC&
$w:%
btpw
C1K|2B
eshT
(7+s
a y)+
4*f"
3>aS
w0y{
' i2%
&5^k3
Vnf#
Culr
0P|
GjG~
m4r>
WE!Rj
v^nIn
M6.F
=hsr
Rxo[8
vN}C
_F A
X}`4
J^j4
*MM9[
A3ft
L'c)
h@ z
J%k&X~
ZCO"Ybh
ZvW4{=
TP bv
.text
*>9Gc
M2Pl
GetString
d^Z
U LQ
*Giw+u"
ysSk6
USdB
/oOJ)eZREn!`wxJ_ufarp2X]
8M$N
^$+3VZ
+R(+
#aXR>8(_LYjX81;\Yz|Avi<("
B %<
o +y
4DN ZK
#]%=-4
`ab34
zdv!B(cA[PQ)g_\2'mhynHXW"
9WQ/
A`t9lEUsJiy[i<_lk|EkbrsX"
":HG
object
4A2gAo
1emx
-,C#
o5_
w68I
_lNqa
Hdp)7
]V3pw]
System.Reflection
T {m
)-)f
ci+|
X$465ezCkT'3 yUS6PtK+mK;%
vBpH
Iv"
OkxPc
fq]pZ.
],3M
uypj ,
6sxV
pN /6
)QDm9
OEd2e
~j1m&
/j)|@Bz3-DQP(J7`gq1)1#,E!
t}*%
n?+>f
]]0
3=#e
H8 w
,/5
rDX<v
lGBf
88 g
]~?R/N
o' A
e`yP[
GW4}
30Bs
4 d.
}855)
U9Kj
Y+L^\*b
`=`(
B%\w
RGyT
9\6
|T@l
Yn8%V
0ne,
O">4
"^ +
KE3
/nJg
F\JUn#qZ0Lh9[oMVo*o=sMyG!
RxFn>
Jt$k
3\)}
ho&
,b?n
"l z3
7e^J
8uQ'
xi@sDn
,{"r
yIm}
5 Ur8I
J0U
[~DJ!-
"9~r
pp&Y
h#vk]:^c(6,eY@%[vsVpCx`{!
CHE0
Mup
(!I(3
mJ!Dl
jTxxFN@M:'
7D{ +
.b/o
vu/
W_;h
vRR6
piF6
az([
10?~
:,4V?
6| =
IFd_'&nL(U
+{y>
:qE
WxVy
cTM(
"Pw.r
get_Default
G1y5r;8
K3n|cuBkGl<%G1w9P13[-v]D$
~C?U"
FNw{_!B:B
kernel32.dll
`uEy
:o\/"Oj
result
X@`Lt
ytAH
orp\pt&UueL*ClA4q2HCZ:s&!
GeV
c,Oo
/:kvvaE}
kI%k1
w$)a
KLc+Y
V/Z?Y
so}
Ci!I=
|*(>
qztD
Jztsi|
U 9
|(>J
L!`gD#;OyX,Fpk%1X=F`n/>h%
1. c
A"?\8K^B9DjD}% FIu(+v"b}+
1Btj
R:J1
6|I6
s%?"
+ixM
Hk!M5Nsy0c:JmrCEWSxZ%%d1$
Ot9!GW
mpz~
n<m9
IAsyncResult
Npq*
0}W:
&Bmj
5+"$
6_7_
~!s>
[Yrg
/jtY
lnlF:X
:WRVS
;> v
2yy!>9
v3Cb,mc
YI/`nVF0
?^MG
9n2C
EO6r.t
T@z|
?AZ:
IZ^%
` t#
~18s
VNw}t
T]~U
C5FZ
{gK d
($E:
3/@ 'J@s\;H[`hxf(c>Xf$`u$
Lmya
t"
}e?
&?WW
DMe=q@o
MouseEventArgs
@q'w
1|])
hu.%z
AE/, nMduLs(_7K-#)+wY3Iq$
E6K"g
9wyE
9Lws
N%.d
r=XUXZ!Oj)ENm3BtRHT/k!j)%
aN@V
` eD
vfM=tIyRK^X}%`eZ_$bRiZY@
5#(\);
bxjl
P,spK>?LSN{>r};T0Qm<'AP6"
N%mg
{B\
maGZ
+=Wh
~Ekm
sIvw
lLKC(Y WC
l5 A
$$)zmN|:-4R\]"4q:!X8*F_(
r%_y!K d
(
f]`Q
,_'8_
g*`&
Z- |
bg 1
tHJ;b`
PIZ2
v;kc
1EDt
z=[(L
<D`q
(BRN
Pt:#!I
8's
%Y y
p9B^4
,0b*
'8FR
= < < < < < < < < < < < < < < <
XCx&
jyJO(HI
v$4L\
;#4$X
B?`GVJA|Do2o;U% "c?HrGVn'
}c[1
XJX*V
JLJw
J?N3S
+*X
mGLD/zYV[&K$7Z(Qk>)|2IQy$
Yn0[
S){/G|,mm~L4EDN\,W;vv=Ff"
vh/O
WOe'
OnMouseMove
ZT69
/(3
*7-I
g/*Z
*|f7
u)t
9 !&
Main
emBl
!Q7=N_
get_Assembly
' ,8
)%
\+E 1
;L||D_fF2NRjHyW*W*ftPNp:
v:7D['QOYWb?t Kw5r,G3vJL$
-kH(
F/ u
vEU1E
(*CnP"
1]OQ
L/qg&
ZlS%
+b(x
2wriy}o
Np[8
)(}O
gOy
GKaUpX
lcD}ra
?#bf~
`^8a
`Y~m
nmza6
e{ia
cR7y%"T|b:O|BI^45?S9q2[#!
z>-|,]
4jCy
tB2]
^?o3AQ.
Y%@|
ZD`W
System.IO
c"Pg}I
WrapNonExceptionThrows
#q ^QC
.s*5
6/f +4zz
e"oZt
{-I\^A
x4[R
:mQ33<
<JK*
`QHS$h0
Xd={BQ}a2)@=$V)YSDOJi%-Q!
g8-`~
9'3,n{
7YOc
Console
h'aq
M]cQ.
1_9
-&eucjI3|m|PiGX!eBA=704##
a |??
j:&"b<
Pjw5
G" F
v"EW
k[k1
yzK7
<9e~H
"c5M
+w-A
Yw18=@3
"B-J,
IObjectHandle
p s0
R<5
_f8,
z/r1S6h2{%-F(byTP3m a7/9(
#+&R
ETX
0,l6
AS 2b
wPcAyH
3xfB
+R%P
~>o`_
#y66k
0kT
'1y-T
0hAgY
LZYa
)n 8<
'|a%
r A1
IHDR
D'{d
t/nMg
Gs}t
pKc
dXM07
jk)@
H?ok%=o2T<-8IK<Cf8~F H^)'
k,C
ir5%
!jzu
w&f&
B2Ci
m| d
K n19Q^
}L9/^w+
9?hA[
1}bE
, t{
>Q @HL]O(fOIzC47c^PtWwYn%
0 E
jQ6p
fJo!Oy
tg;3
Ay\
x9mX
dF)
}8i A
System
EventArgs
oLqyP
fB @
@I !
7N7{,%
'/4}
bG=f
~",}j
7}L/{;r_J3%9*[[uR/;=Wg>Q#
q\l$
CFI
jzzPu
8]O<"MHSSZaNFV]_!&>Cy9LK#
sc^4@
)K9
n7tQ
&vFu
y8BE
:#PRC
= |o
:S"O
^c }!
G A v
PT_j
@R=\
!7,lCx
`Z MK Bf|
pFOE^n
GF.@
^zE)
9nf{
9/~W
40CX
CreateInstance
#<{E
YCpr
5Uw.
xzYXo
BS%\
_rGM
V* U
= Ng1*
MethodBase
#Strings
Fc<[
Jjwg
Font
#F&]5
Cpn l
System.Collections
$%+~
ZXM(!
"jWq
(\hb!
9"sH(
NeaR
Hxi,
*"t;<h
YT>T
i/} '
g w6
Slb7<ZS
AL~B
4@>
"ND6
[ ;Z
c$,p#)E
?v-X;
iwDs
]#If)w>5Mt7+z)(:Cp`NA1`*!
Environment
NUxODO_
get_EnabledCalc
y,Dt
vFT0Y
vD]H_
SkL=
VirtualProtect
2 .c
tc7u
R WQ
!7eQ
q45a
4zNP
Z`P>T[ -VB >UPc\u`swa-*-$
CBC
thCs
` d{
}Wx8
N`A.)
wQl"
}e0;I
3o2+Jo
_">Jv
get_EntryPoint
VI`rf
>LR*
7j,D
~S_l
Y$"<]'e
yj7Jjy
p %~P
h/<V(>$
I$QL
l597
w, H
Iby=
1Gvb
*I6o
mUE
{J0$)
-jfl(e
/z.y
")'kG
OVNY
W%aBEs
EB-y
H"Xr8:
xP:T
<'U@.
^I4
GetType
CI5u
*nu
Dy?V
;(RL8FC
ncuTJ
D;K8
add_AssemblyResolve
s(ub
6 9[
jI"-
IDAThC
B.^12
J{+dwT
;}"V
fC_b
|?l% w
mqYoN
9n-%
=Avp
Drw+*
E0D-
jC, Wubv&N
set_OverIndex
/"z2
oh_
} oF
W6s#
1QW-
\RT/TiL
s- X
S6lo
|k${
mc5,
XvOddy?T-i /3&T{0kY(;aJ$%
\3;~7 ${
5 c4
^2@XUH')s
71Nmfo
lC-\
;WlM1
$,Ey
Zzn'
7: B
gF@ ?
TabControl
wfID2
4yI'vFtIz
Q- }
M ||MF
kYNzi';:BZy>Wq0uP")mbT:5$
OHR~~
yX#~7
-/w '
npAN
im1U
6mL+
POfX
Oe<~"
"pg+
d~}6
gFSM
d~oT
sal_o7]odej}P2u]=Vqf-[wp!
qYTz
@d$M
lT*^
a Ckv
}P,`
> Up
7;"n{SSX
Color
IT's
'^[`%
e-5?"S5K;*,oxP%ve`6`o67\!
OtH!
fq%q
Intern
PWf[
Wwco
cyo/
LR/GwlU
7Z0Y
dQd#0
26fk
-i{i
ncG%
bE/*gc,
set_BackColor
)9d'
=_%R
.*d+8
, #U
?xYM
(b;
p0u4
|OWyt
get_UTF8
u{^|
S~NC
get_Width
\UNG<
?C L
Z#<#`#F\,[2n9,?2x+PcM"N?)
gLE%
>3+n!
`2lq
;*!p
R6nQq
CZL3
u}a8
ZX {`
)/K]$}l]7*Tw]Zr C8vON!Zt
)"<{*oT
'GM lw
99a2
F@ma
eC E
5"]-s#XeZk>@LZt<xRTh{4K!%
P=U[
get_Revision
}@Cbyd
f~J2
kxX#
z_R,}i
Pg 0Y
inpC@CYIw!SQPfDR$Ip+s::@#
XA$>
._ az
n7u
)e9s@
Xp4\
O)@4X0
:W%#
n1:;]X@y9<)K4T)'-FaO94sy"
mtXU
Alfc@
@.reloc
\&Cn
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
,m!T
SLnx[
9n 6
$!fe
[R^:
z
O [Ik
:?g2
-xjg
1fg\
;!^|
M9hg
n!0.
/7~N
) P
4~1|
)?Pn
(*x*
^)o|8e
Jt`\V
#{b0
yVf>
Tt;5Z
"s\u-
D9#?
0YdAy-8{,;]9n-F_Pg+613o+$
1[r.
NF[>hP
=KO"
/ wA
=7lo
$.b*
]?@L
~?l [
Wx=<n 7&
6HYj
V)-f
D~[
ih:'
)Q%9
Ph<u
g.qK
Math
<NLZ
System.Core
74C<z
/B~
5]O_
JZH
3UT[nS~
#7\S
qCSk
% >+
3f$b
w 49qU
hr2_AC
3<}J
|{R+
Delegate
Ltm{@
k8(U
}>K (
'>OAy
JkB6
XHY@E
\@rLT
(I,]
ky K
?1# 6
E4B4
t s'
%& h
Teg=
04xH
Dtqg
H11(
=0IP
/;Qt
@"*d=
c"+@iYN/j?JAx(y#)CyjNS8d!
0`.T
X +4(+
sd)!
r^ *
$OiTo
4Gjr
K _j\<L1eYr,y*t~C}_$7_|8#
'fgQ4
B Of
/hV9
LP}r
ModuleHandle
px>J
%Alk
BtFW
8W<zO
!06
,vj6
HZjq
`6n,
{IDAThC
1Stk
*f!!
.@%PQ
*?l}z#i
Tf:b
rB-
zKD9
M Ux
${yL"&
g,]6'GP
~|6)
q<0|'!dN`V~DE4*>W&tN[}68'
3h;`_$84Sr>ydYlB3}QYj$9/)
5M.y
o^OYT4YWqmG</L"5y6xWUuV'$
UuY0!
OU%%r>h.
.^9+8.<
cV5Q
gO~,
l$;4r7(J]IlKp[G}RCf7Y1=J+
Tpo ~|
CM0~
set_DoubleBuffered
Nr{g
dnYG
|Cy0
get_Length
1)oxNV%Ee8zcxv!!F lR{FdH"
-\uM
eyyZ"
[y&nH-2*Zs;6S=w(U% h"Y)x$
op].
, n0
rpS5
Y Hs
b v[Lc=
zx5
yhd9J
NPN\
5#q2
'\CV
'/S*EUOj
'"NY
@c3\H;?w:X{lpzAC!@L_m98=%
4t+)u
V.J.
"!JZ
'!;M*%
&}TXa,^B"8S4LJ8PG 8E)3rT
3h" U
&)/t
Contains
h011
Zd0w]
;aYM
,Jz
}Y"+
nfL~ 9J
-1Jg
eoBG/^
"}q|8
z+Am8"
1\
JY )
KkQO
$q:TT
{v%=
d!V}
s|?Qj2{
GuidAttribute
z('<d
ET,c j
\hX6
5[VNj\c]{Faq\aeo,7'=Gh)B%
"olZ
RWc5LnvL59mx;*Yy:WX,;Yq1!
@{QZM7$zx)|XNHEq@c$!CDS?!
.dC>(
'I]pJtS
-Z?8f0
6D3 b
9^k6Za'
Y,To
uG%
GF!kuX
;X G]+O>35>j{1(#s6)$zO<?"
bb vD
n$_6
wZ'ruU
G1fK
HR?m9
get_Count
qkQ3
5 d 9
dL:+
I:c'
7@Y%FM2P>g]#~DcB8_tU4vV`
"tZaB)97R0'I#)w@UG7V$ZV",
KTo2
| pI
*wC'
System.Runtime.Remoting
C[`(
j{Fo
9an'
CP9'
A# 3e
U(;
\%VUA ud
xaMeJ
Jt/H
:{,-
-+}(@H
9`"
(L\Zk*
zQ,%C
V&AE
GetField
W|rM%d
&$D\
,</y&['
[L |
!mP;
~VIh
*^06C
b)*F)
^K)N
a3t
ju,}
RZ)c
6TED
7S>j
D^'
mk 1
D\[fwRbs!k?YH[=a7be`J_Rs$
z+Kz
V> Q_
UInt32
u+_:(@\Y
s}yZ
3&R'H"B
;Lr
BPj
Oeqv
get_Version
.i~6
6i8C
1Rv8=
(Q?@6
JA @[
KQ 3
ToString
6'XT
,k3m
1 <^
@RsS
A>QsHP$2IB-(,cxNLHu+A+HT0
x':/
cYs
LV]G
%E(%
C v[>
fG\H+TC(CV$s@17uKTj2hNq2&
mmqN
Enumerable
q6iaR
"UWB
!!4IJ
e@6B
;'Ky1
UfsD
Tj+w\
(?136r
X
_b0[
U%`w
3L8l
dS\..
0r"w
)8m(
>$;:L
NV]z
j@GoX(H
eZp R0
dLpp
I,(xl^KpA'oJ>Z}z;0_==^a^%
ZL H
F9$8
{g:9c
</[L
]m % T5G
9Xm\m[
d,'^
H>Lc
J+oK
9Vuy/
,' E
f[3G
GetTabRect
Egfo
Kd#+
C fg
xq o6
utohKa
mZ2cJ
t"3*
Ot X{
K",P
$~`$J
.|'4
};m
b:V
1:<Y
fNx@m V
P@G
AssemblyTitleAttribute
Q$[3
g]zP
?Q}a
1j!FW
:m+[qfN}th`ok]ec6YYVV_m[
G7d]6
k_DO
eD"\Z@
K3Gk
J6F,
ikY
5>';uQQ
Y9U)R
SJrNea
;q.w
b+"
`+<S
3_#
jT#C
't2_
_V 1
/q2m?|Y-{mz9{/N+76%\}>Ph#
TnpF
9<e)Y
E$3K
x !M
w[6"[ &])"10+^(g<Z7;`Oc!(
cIU/
DgS]"
$.*_%
m]Y*
u;\sG
p L4Xn|(
KTis[
b Jx{
cANGY
7GEi
k)~.
BZT=
N=48-x
Data
C" Z
q8
RIw>0F*x>@MtAIJGG!q@<:eh$
uesS
6y4
_w()fv
n.%b
Enabled
3~{
nEE
`-]{
a7E?*
3 :J
tl#Y> P
j5r%M-c
dI%c
(57 q\
.7yu
{^5p
?%ON
fH/f
#V9:
Nno
:?;4u2
s}+;
L'ZPRR`u
pHYs
.ctor
J=~
R;m.
?tMR
: )
b:J'
XGXa
N"qD
get_SelectedIndex
&4bj
]fEo
get_Message
Container
M26Ui
_At%
D{._w
7u~e
SgnV
/8t#l
JX1=
TA/O
"'w'NU*
=Ivv
jM/s>x
uio{
G|5*
8f~"
MV*t
^J/D
2D\d
iZ9U
u tC
Invoke
E #Q
cVg[S
7O;L
. Yxf
2dm[
ZXJX*
6"_i
KDHy
Yk_K
$QAU
I4Dk
dVJ*I
[FXs~2VCp_6&A|x><`!$N{TL%
Wkfh9
mVQ"2
LmHLm.
Q%9bL=
Nu=3
A $g7z
_H]2
z"TE
ERt~
FMnS
GO ^
|=+m
Rvyw
MRb5
.jI0
<}tU
$tI{r
sJ'?
>R?3
]s!Y/RDm\g/a_7!Rjx!zNnSb"
E(gzwjZ
s0|t
,*>T;
U},R"]
84To
c`zK
h3>
Module
#>zV
75H\
dU$o
Q}~$?
7yH#
@(C@
B LJ
Array
Pl[-vUQB4od(+,79Ubrm(V(g
{W.O$s
q<+Ll:
-W7.
=LZE
I#y6
[6!SK
-n8I
cN1#M
0 3d
e |o
oe*:
j!:
7x0:
PTgi
!;{P
+\HQp)S<FWniW}0 7Z}Jj"8*!
Nt0zd
a0t3
Fyqm#
so3%
f dAs
d6$o
xB%M
4Qmu
[&E+b)Z
Au{M
pL\=
iNV}
id1[
Q@^7
/]oq
hd T5
p[Lm
:{Z[
{2R$
TabSizeMode
Byte
get_Chars
ZIn!
*E88jO
sMxY2"gg04"gHcHf<^#*r|!G$
Smf
2M KH
23If"8{R\3(uG@]%V@"9]&}p,
Dispose
g~@m
>p/G2
8dfxdI} ?_Zjr_:=kC,U\r4j!
"zy
{:n;
0'%
+-B,j
",>c
f21
9 >x
zu)<
bN.`
(37"
c 5jnX
++t2
{:9g
q5 E
NUqO
4t?!
if1
>q2n
S=b!{><GI{D"WNw/yTyUjt\Y!
kZg2
+l!sX41}wW'(A#*HZ+sj[b|%
qfP:|
z+f^W
[g>/
Te Q
v+ < T
p]&l
D26
:Awl
A`t
r( WZ
bJ,
2:Q7
9MjZ
Dm@@
fPYfM
1H -+
]rkS
Yk6W;`%z-*O=n)o$07;?ClNv!
x_ ;n
XeAu
IiT(
\ln(m
'3XS
AKjqX
8SaSBd1;
get_Location
{sN0
Jz`=
8>X{
DLI)
#SaR
1*i~
|9Le9
W f&8W
\'<<x
zsq*
<1MED
JEo
$`aHX6E>lV$(x*q4u<\8W,I=3
?Q4X
!W3dt&
%Uzkr
^K}<
%v"\
FreeHGlobal
K\,h
wR(<
%4Kj
aqRS
cN;H
y=Z+
p '"
d+cK
7;kx
KS|x
bZ*`
`ABP
uQ1-
#j=f
!WL5
73m"
zKT<
@QpG
B&)bl
h#d$,
Lb }Q
RuntimeCompatibilityAttribute
"W.P *
&:,v
Y:JY
"d9n
dX ,
B=AH
ljb!
zu>~x;
ir *N{
P6Y}DR
W 1H[
Assembly
_ 9v
= `/l
ftf?
+e2C.A
5 5'#CM5#pIaZ8T;|Oy*mO]p!
Qv%H
b$Dl
mkj!
F-mQ{?
a[\o
p &5J
=TLU
vkVV;Ld
@A j
&1G/N
"-*P0F
3rRl2
dT_+
8yk;
SL]+L
#V +
ImuU
.?84P
4bB,jc
4*cc
Rf9$g
Invalidate
7n "
"J
}-`h
h.08
Im7[E
6x:u
z)X#g
|HARM
:\g K
>zD<c
w^gq
UYx
OQ}`
\yj#m;
Size
Y]g*
>IN2
5z_P
2zCV
NewGuid
IJKg
%;Bp
4G*@
Iyr~Vg
m2lHd
set_AutoScaleMode
s`5I
i&D&7
p|P
}Mh)
?GIJ*c
w b
2K2+j
vP*)7
wO$1FWm7B'r=Z5mlQg`AUmJ7!
bnA4P
,J.S*xU
$8Se
++qu
A2bf
%8ZYGc-Pb'Q5H*kg"%*W +Li)
MXXX
d8
?d7)
0u&dC5u&"o Z,doTrK$uJJX,&
C:=252
6uqM
j"\ E
+m4T
,>Zsh
0M/.
,d'7`
@\v\j]M~@yND^^7o9tC-),E|
&tV
IContainer
]]ge
H0?e^
u\u
1*!2S
oD,2
"0\H
BbN5
l!Q%=MH(xG;DjH,b7Fj4VrVB
$~2V
W&SH
hXAT;u
B0bn
+IOl
hVnBr
x?5$
.x_w
:`)vK
B6BG
osNn
(;P8
uDp$AC
y.n]
IY1&e*XnOEN&y\f#BWIUokU~'
ISerializable
=jAPugr
AQ75j=i
)ZV\
QA %bR
\$|l
A,3u
bU2
C3R}
,>{#z?1-y_p6#Jp:<:L2-/[^(
MYD.
;"ka
e5gj
8y+n.
}qNH
Z(1
8Ed]02,%Y^V^b)z@Q2U{N6[C#
Fxh]
<{U/_o?643R ]ts1Gl2jqlie
Y,`f
A!g3t
h:~C
s;'
=O#'~
Hj;=%Ol&J
%\e]
bKR
239w
v]=u
xpL0
0x 3v-\x
{P%cj
8\L P
/U~v;
\:Sq
fmI|
get_OverIndex
[<Ip*
y0!Nev
WeV5N
D]-Q
#Y2eHK"Q$_\0mU1UT'PAjm[<%
bI=sU
'|;Xu
7cil
:ot{
8qIY
'u X>
r^j1
wS}|
C(>u
+)Uj
+5ZK<P
=I|
-/5z
ywdr
lz*_bv
.DIS
"2N k
K!V/
^Q;H
+E+H
JKbxG\
? a
ContainerControl
Yb4vo?F)W:cq+=\IWS`Yeh:p"
x_nmqKQ:!O]~"0|3iM#UCf`[
|O:*
?yJD
zW+W
bLIIm(
'JF:i!&[Q>
N%;z4
U+7j~
~5* m6
tgX[
np/Y
)i?
Nnb*
'^D1`p
{b~3
ndo(d6q pJ6
l|1U9
7dZ\g
gh,/k@#'C>
q6i`8
\2WY
f<Tt[QWl9CjfIT3;)F n;FPX
z3v:
BAO>X*{Bv^>61Q!fZp?RsGb~"
Vzxh<
ReadByte
O[KL
<cr1KER
1>5[
4B<O
])CQ
h^d&
3IUa[W
Rzim-
nj!A
lZK[[
3F1764884A245F1B3FA91DEC2E25339F23787561
RuEg&Diy]:6~Z mo;3CR=#Ik
/-6kt
*O>(Su2N@gb_u&joRaf%X-]/"
+ dg
ZgBA
d(=B9
8/,}
L' O4
% 8o
,N;=
NoTC|j
K+70<2'
LDd6u
X Do
D"0jJN qX?/wm]ya<Xj6;ra*#
@2/4k8}}z'&\ckB4?b^Ys=1R!
.CQ=
jHZK
AllocHGlobal
+AQ^ue7
rLy <I
B 1qud
s\0+
x8=S
v@h_
U#+K
AssemblyCopyrightAttribute
9:td
|g%R/
]SMlq
E :>L&
oVO"
Ak:ZzBb
GV}Xw
/Lm[
&\x$UJq]zTqE,eR+b#~'[+f!
`<{
d0`e!)Se&D70]*YOS<l|a6>'"
cP x
kg'E`g%?rn5;6Nm`"k$,1yYY!
:Rh^
50Nzm
h<4qr'M#
!|`j
z<l Ke"]
hU{t
#bE3
x%C4
ISG>?=`
%M_HV+M/U3@V(>Lxk!0E]=3Z#
",i]|7Sd[_JQWPgJLs#NzTBx
.mvk
eDG>
b`s
s3" 555{s8W/'X@oB:^9%!m6-
Awpe
7B{9X&'
UVO)
) #
k$$l
lF`Wd
;rG+L
,^_
Zr4q
zeeH
XG$,
ju GJ
GhFT
g ^
u(gc
r%;+
@p\
Y6ad
zKXw'Mc,CIyS!nYNOW<\c8_A"
*XCc
ng+ ;;
/i5sx
E*bu
T`P
>HAU+
&S *aA
^O|o
JJ
]JGx)BjoC
cPyU
;?N;*
?_ +
^7(y4
U /~
C/]oq>
7J(u8
J1E5
WLu/_<
ControlEventArgs
ac% AA
&w`fE
65_y
dDzIo
L+UM"
.psMmo2
we3Qpu
[E"iP
+IhoB5#b_>_>m8k5)fg2IVIl$
x+B~vI
QC0+
|aq6
%< J
U *s
7mxLT
,_GP
Cjy#
Rl:@
set_Enabled
,E(_
uS QO
e28(
T?E
]XM&vX%Q_;P1w}dk@j"y7!I0"
?0'XF8u
H{ 2_L
Read
t U)=
^TD$
Z|Uf
Qs=8
C8.hu
yO9lR
/HtZ
_[_V|
c\>D
zw6G
ikme
#ksPn_|
P5f~p
!~~=c]N0;`>a~&Bkla,gJIJ@%
ohwI{
h#ZP
?$4y
$U}B!C
<G.8
aqk!$
4^/)5
@ww\8CCux^wV!T+"N,P#v xq,
-Vu_
X.>El
get_Value
A06>C/c1m)A,4dbG5{MdHXlS"
_&bp
5[Ij
9bzt
]6grR@"'U1\"Z!pYX1@QBw;H
e EWg
mXsK+l`
8H[i
eE >
xAjW
)(>A
*s2-1
- |.
|*_n
b0Q8a
j^os k
<(Y
+s7IIN
mK^>[
fAi#a
G W\r
g/L0
gAMA
;Oc5
ZNydsv
m?#0
%@Fi\
e([j
cG;rp
+]RC
~50HP
/i\RJ
vw}/F&!Im/W_d00H-uQ,%5N>%
,m^
AutoScaleMode
17fT
ye*i
s7U ~M
MarshalByRefObject
K&dO
R'eWwE
q5q[7:Ou4wI
k{n]O
<Hwm
.cctor
tQc/
AsyncCallback
P~0
I`o4
vuXXo
#^<#
O 79
-IX|
9ONl4
mscorlib
FiPd"
Q}9 B:S
'S`E
AI7L\qV3a3"BGZc_),n\*#pa,
iN2
A%E\
jl&4
`FhK
>).P
.Of8
_<k<
{I;\&
V'?y
r5!)ZT
\<}*--
#hef
11lb
z@8a
N?Dc'
72#$i$g;+h#rh|wO1_Ov`Lq1!
rOkc5
% 3K
9|+j
NR.J
C,TH|y
ba#0bIm+aelwur]l:4u8&c<m"
P>dq
get_TabPages
S:W9
wHXe
$8ac161d9-98f7-4df7-8932-c0c468385d69
]J!''
oW4
c$:/\
H^ B
bafi
cb:f
$gXSP[F#xnGQ/f,e=`,+lPCM#
3/u{
C9g1!}S)'_aYtIDnOT-dalsz
?`lI
EOcz<
3mT ^KGL%i
I-&
@"8]
l7x7}
pwo
x'MNa+EEF`J~P:u|g<!R}EhG
_[\QL?
d<gXTH
JW'h
Id@U0
AgfKn
G$m})gDFx[+e4shY#h[zKny?
IjQ 2
^t:K
miY4_KZ_/R{4FN["@6oBUoV@%
Jy"A
]oJxy1nQqY'8qgK%A/\v%P"V8
QcD]
=Lt3
DAo9
G2W+G@
l'G)
$Xbb
LL:i
6_IhX-ikY
"SF!
#*FcRT"j@/0/SG?bDm&ZYWi5$
wA-v
TDMZi
sQ"_
C#I1
RuntimeTypeHandle
dtK5
~>8)t-CwxB|<WE-FrHo|,'VO$
R7z
CiyM,
k\<V
1eAR
)*.D
wtmr
aIC1
.Jo M
[j'B
i[i'4
$v5r
aO&.
2018
amLx
y"`iyAnkPQ4y9 {/_%X_}b%&%
WV
3E~Y
jTD$
RSj]
/8D
U1kXh2fy9y8 4Q$7+X9'nQII$
nd>b
P (/yyV^
V!;ec
IsD
DlD
(|98
sender
?|nAq
:%z5
dia&
J0]2
<:*{
_97h@
~R9h
y-FP
=W);
@EB0
VMs=H
|yy'
ZY}V
Append
/$Bn
_@ H
p0$
R@,W6
L>%@
167ltU<F^''rg/@_=l2z\M~r)
BNVG
b\P5
dBTR
k[q4
System.ServiceProcess
op_Equality
ZSzcz
J)7P-%NW(agY[pdd|5ve0%Dc
iQn-
\zwi
W_)V|%
Nv6
%)z9
sQO"
hRrD
-/8!
*u=6
5M+4
`JN wc-
Gb c
L]fe@3lJ#xSPNutGc=eu?-T,
IuuW
Dw7R
">~T
YR$2/i*S!hA<=]A2:T$QEg/p#
QX!m
te]`0\
0U_N
%6_D
|>OJ
vg/6
P|[HA|
AssemblyDescriptionAttribute
4saGG1)xp(g5jFePMB?-0Qs7#
n l8)
Id)irR_
pw`L
,<}p
) 6!w
U{XU1
U`DdY)
;ut
d<YMr
Rgd(Q~S%
O5P"
$_2v@3
V/]b%)vZ
'9h_p`
b,'0
* - 6`2
hAa<
7"pg{
=nQ`
#7!X
c4,[
f}_Px
F9yt&
(5~7
s*ED
9$E{g
H^>f_
k0K1
to a
l^w]rVj
WHB
[Cx.
:)h
2FVz8X)e;ku0$?tY7m{FWsV'$
r?2
|L}2
Jdc?
xN?(
X(Q[
4(rR7
e: S
y$~Sk
Qu.a
Uon^DKS7\v0}`^^]/O$ 11fV
]9MD
;h/8MT1%{fKmjU")*tG5q{0|'
S(pZ
yyHu2
p31|
eUjw2
W#Y#
Zw2&
!'};
)IVv_6PQrV6EZI>txH`{>C$z"
#Gt*7}
t~$Bp]
&-? u
)+5{+
|Ikd
dp@N
SI_P
/<.I
4 _,
pH@[bG
Bkh:/d+
WXTF
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
Nl`
jSUq
N)zV
|j~&
jN 5%
._iT
- ed.4
Ui#`M\Q\^W!u8izCmNvuG#=7!
>_|(
~*rU
:!V(
3`iy
.&#U
.3p3
J/m6(:66bNtxFm-a098Ft<c-'
TRI|r
:>iqNI ;/2+(*, QS=!=#2Sx!
mscoree.dll
!This program cannot be run in DOS mode. $
E}!s
#nRl
callback
F*SJ'_*xDh&i=tVr1!HJ8GdP+
~(,.~/
B//T
qOH
D{,
D<c'
Q~r5D)mtZg2coh=8vQ?vJi3g
"Fsrh
2b/H
\/n`zI=kjx!-aUV+;]Hf+Rp80
iajl
4jyB
[(Qcn
)f<mC
" c\
P^NX
)Ok
[u9(
hvG//~D<iMoZg-}5QrDSHCmb
D5_it
zPyT
^y^z
:Civ"TTW
W$!a
MPFk
PC7h
DzPO?
Lgm@
4E2BE99140D24066CADC84F74FA899FEE5976B68
4e3n0I/
:__K
'O93K
q(U_)x
REEa
ICloneable
U[h}
q<60p
O{Ux
QII
j"ux
crwTKD?
DPnJ
[5x]g
W Ju
r}c8
r[(Hp]
A *C
On$
4@TCu)$`|&OrodX`k!esUnSG
\nQ8p
Yg^3o
|jg`N
QN
Qa@ U
M]X7-
System.ComponentModel
3iUCIlPtuS;Nehlw\[R$VlhR!
l[E U
J9w\
lgFh
'6&k
Z =V\#G
19yu
CnP?S
3:O5x
bztZ
LDP~
w^ [
jAl~4G/
9c2G
2,D^
S J
{R=&y
-v /
R\-
7B[ A
F+w*
~H|G
wF^t
e`c/K
vV{s
xH<FF :r
z2 FyH
f5VG
sN$39
|hZ#
J&5
nv`AD
@~P7E
VzE!&
z(5/E=Zr&S73q2P0> _93i"U
Q#H TT9
)|p
BSJB
L)yj:"
lfD^6
M =
2MqE
}; \=y
/:8iU
`\
tqr)J
d4x:
*!dU
Z-pJ
Ym04k
"ZB_
WJlz
g>gi
get_ModuleHandle
b=?(
.7/D
VvkrI
I Da
Vsi2.d
dL_Z=
Wil u6
(JK~_e
"Ibg'gxJKWh'Su)l",}PeLH5$
NmX0
Z6#iL//MLB+<CY@6o_G%\T}v"
NBw)[I %
PTf/xCx
;[HM,
uynJ
u!KK
>d2#
IntPtr
-o&x
-4#b!\jx~c+%S<;gdA/!^tm!"
z_rO
)Uq1b
iA [D
-zjbt
W -e
b1q
"Iw_
<+bN
D9fW
ys[D
@@vEqHq
'b7.
/Q_yg
ilLa
x~-v
o{6;{
60M1S
'THibAxn&}}oIecY$E?Q/hYy
H717
e]8l<
;=w `"
@+f\
|T[g
wO z
rc,7
M8MT
%c;i
S]@b
q8V&
[/$_38&:p?"l"xRQ?4|_";,=
3i|GK
eDWk
@mk@g
5 $D
@Swl
j+K,
>MC?
d:Xr
C708234F139063BBE3CBE2208BB6ACFACBC50333
InvalidOperationException
rw;0Q
ec r&
'Duvw
iST5
v-s?
]!%(0
^{2F
Izqz
(.:>%
<U$_
#&x
`m%
BY
G3U>
jF\F
V)>%
~VdD
UpT
M( L
C*IA
N op
'<ET>
M,CNS;~$sZAV|=pi:m=/L)#['
? Hi
9*9]w
yXPp
j94 S
V/u`
~[Pi
s8X
ItfN:^)
n[}HRD\sQoF_jr*xDkO\wWR#"
JdDW4C!5 a&6(hvL5:WRTe:V0
k3 s(p
3:I[
v ,WH
DuTC78S\
UPD
6>P,r0
BlockCopy
X bH
ba)4
.d+`
8z2
xLNv"!O8h[5+ntR~Blkdu>I6#
System.Linq
~U\{
5U(+
Og:Rq
sxw7
z6 W
hA u
z;R@
6kDM!
Lr;:
D@G,u~
qcix
.-Kd
G972
KaUg
!24\
p}Q[gv'#jN?,uf]Lzxz}J"fS"
Y7k=
9 B K Z r
$6zp
~XLQ
@`*v
d ~e)
q0:R
also
&m8 B
_SyS
<F l
Ak#9
db S
2HCn<Pc2fanZiVh8ZYK>zr}J%
KUp
?:!|T3
${I4GEwN6kc~\)x#m|fgpl1d"
R?:`
6BZ"
E-U0P,I
TfXbAD-J
+]l|2
k}$q^]
K-Nt
sp*x
7 `E
G4";9
nG*6D]Z?vg$Va#]w ma>m%|I"
^#+xGgd
Bg}
t,y#,u-
%<G!o
JH
LEE^
4e54
V8NI
K-#
&Vsg
7r+x
>I)l
~wQ*x\
#):W
3=GXWXC@oz\75`zU*z\Sj|[Q#
8U
^M1$x6
%br9
``y9
_tq9z
L}{Y
|H_
D#W1
/EmP
~`X
3%sF
?Y x
MethodInfo
D d8
B#(z
ZE`$
wY([
3(AW
p|I;U
EWfg
s""0t
t5*0
PY}z
^d""
cy\Z$H
\!5
fZ /
>NnR6
TabPageCollection
/w3)
*|2K{
,plT
`,,]
gol
oj 3
/*GV
MemoryStream
Bs<*
0yyH
{H<+C
4,?
:-Ed
d$V[|<'K|g{YO=q]xZCzx@ ]#
kR!`FQ-
ResolveEventArgs
1N!0_)
a J\
A%GSwi
rKE%
,2%5
Z3-!!7K
LVo/{
g>< /5U
@+!Ia
;YH`4
Z a#
$X-'=
?_!g;
TIiJ
OnControlAdded
~[jp
U'9g
N=}D
HF!F3
W:8<
~2=6-m
jl__43
O.4M
Pyl!
%;xz@ZXTQf'fS\LF+HORfCrJ,
`hoe
Q5Cp
zs+Ua
x_1p
sr*v&ZKlkFIMw~N^_CbOlr6F
0qo*
2)o?
"_dg
6c9]d/^
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
Wq<p
hwYO
B7~a#l
V5pa
SJ^))0.
r>5~
:(0{/NS =Q!$sGn]g![EPl1@#
=\gi
:/@l
0yVs;
p\JD^
}d<T<
&>?x
L!N(
<&rx
1pE+
Ea8G
3 jr
^ %J
IEND
F)'x
~qm=1
:fc4
Bi_p
Hr\
j9\)
+/5I
Z$Mq
bfK)
*-O+
a#@br
D!:!
!!YvA~
=G#
tOMW[+q
7VI%"
$6VU
HI
8v$z
Mx
Qzo:
37NJSz
xU5%
|%xyd
#yxFu
yo=0
8\Km
i4\E
[ N2
z/|K
~Jac
fiM8?
LX+SF
'WT+7
3!~cy,("Lng7d)N96yC#jk|r$
;G2J
_H4p
IiL
8ZfsG
ujgpF(
=|fT
eusN{=EV)ik\O?|$COcZWG; !
b%=qGWW:7FX|Y)nf} ]"hqXg$
ILm*vvMzW&~`ppe5"q=%3$Q+"
NsbJtA@ZW z#>o5CAu)um2ca'
@+ 6
j e<"
Mutation
xMMtpMiS[,dgci58sx[Ux7JP!
9,cq
ssT>
Az$(Cx
&-I#
Sxhc
Rectangle
S0_z
[p@]
b/w
set_ItemSize
E|8eq
get_White
fmJ(
E3 tt
LUdM
+,h$
*dqW
,Q\\
a 6U <
);|F
F:.O
\^_}
HiQjK
Concat
]vN?<
bhp
*Y"
M>t}
[=Lj*cc
StringBuilder
1!U
lbSi
qRedS
j(Cs
6sR?
P;gF4v=<rTdU#9"j9V}(a<KY$
*-Qa
UdS)-
1" !c
Z>j?n!!u?>}8%9]f$>L>jG//'
>,o)
J>h_
ku8:
>Qq8O
g+kd
,c}JaG_Gvld@>,tj2[/UfKMP'
2aT~
2 WL$H
NFo _
,RM.Q
a9Vw
~@^T
6d2pG$pb9
$M
get_Hand
dkY]x
2BT?
(|rv
[jM9
yGqQ
T*.,v
sA`0
R5KS
System.Runtime.InteropServices
~|a=G
}8~Dg
poL@
xtrn
MvydD48a
KGh/O]
H`U!xJLYj:z2+2<0UP;'ye<)
8_YX
Dueo/
pd_Vp
tMpR;h?#khGK;>[@-{rn4OA,
dK)c
rKpl
Xea_1
8agD
_B&1sj
't5>AB0(RI4/]PsB&wIq@ha<$
m:9V
Eh{?xE7!E%!OfO)n)|S&^;7K+
7q=D
:6q}B%a^
g rp
)!JH
AssemblyFileVersionAttribute
0`3C%(ZO'8YB&;Htw~:fJ]R+%
BW0`wd
System.Text
j"\W
%*-Z
]$hL
6hNz
Ndm
30Oj0
3* `
1JA~
ce)9mx
R fp^IU
IykFa]
7:RJo
h+HA-hHe^#b93D)@Z3{}i:?a$
bs:(
ty*-
"Z2~
vhcE^f
;72H
6/-e&
2)y%
'|Hcw
"m{5
4lN^
,/#
&7h
v|q
Dxuu-
TWO)
.|^8
GetElementType
'Sc`
ug@s
IN (I
$9W(
Xxt
y]~|#
R'QS_dJqin5W*x/iP~+D$Yt}*
NpQkv 8
(+
K@a%Wc
t3uw8
5NLX
n$VQtqX~z#&f0 `@ko(s9Yx>
Z9C-
r jV
=6(m
Zg M
<aa.
IPe|#
ia3k
}b 9
D9]u
}{J1+2
X~;
R~ 5
VI@l
z(\j
G{zQ
}XC(
EJ\z
:D]$
YbTB
Q2Izg
2 7a,
dRl6>
CreateInstanceAndUnwrap
X HU
P:.hu
TPCYl3]2Z;mhE@S1]t~CpO%7!
~I>K
*`ob.
h'`
#GwwI
POPXy
uIst
y`."f
#Kn;
ZWAr
BIs4
u]HG
q)SyKH
ylZY
=bkJ
qK CE
)UG]
k \P
y~6'
FieldInfo
jU$%
gw9F
+DwP
]5yJb3(
S} ;
_xN086Y{Wv'NSQJA!}egt*"p'
^d1&
t!^\
VO/y'
}dAe
0
pkbp
H}]\
L#2GA
K@Ip%
wx&y
Uzt(X$!EvyMI0w_Bd24R]*[k#
ki)k
R-6Sh
9 xD?
Qy:
ee`j*S
String
"0V^
:IZ0G
5z>^
ICollection
_CorExeMain
iy3w
#B]=
eLA5l
'vni~
$SrY
b-3=
,oI/
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
NneFJ
Xiys
Fgc H
8G\
=6l}/
f730
}b"
zNK
?O$fx2
.5_w8
]SsH
~3<d
94g
yir@
$>O6
InitializeArray
waC5
1'S7
bI#;s
mly5(K)c[5Q$B~Ig>K_FpAJ>'
[ 1W
~s^(
R@ql
(FNdD
jh$r
^n+M
^ 5<S
j/ i1z4
Q84zvB
I}=Yt4zI94#pvQF~@v-GR^(`"
DbFPl
d-`Dlq
KeyI0
-o-Og@P
1v}
5%OpZKO8#t!6a6{(Q}b[%;i/'
Uz&dC2H;/|YxZ-:dTK+/1;_w"
ToArray
AUG
xkpk
'ccXr
7ItS
OnCreateControl
@k"f
u\
zv&@
L sH
:6?0
6#ts
wSA>
LYc.
ut\K
>\Uj
S(KU.
sLMO
4B\v
uua<E
Z 6
6'dm
76Kf<
ijAl
HD+B:>7
AC3.
JH 44gQ
/g#d
BM' `
get_Hovering
-;`V=3LE7cvT<L-xrVW$+pSc"
1 }o
\@;U
CT@D
i w`t
[Q|8
% #b
!r\E
pXZ9v
0^& r
`3fov4
(_e`V
NCp_+
k'@/u?x
ServiceBase
?/0Y
Z'6>
Load
g#r_
ee"IU
pw^n
]f`1
MOsK
dd E
T="W
System.Drawing
Y Zk
HuyQ|
<R,
get_FullName
[9Gh
Ac@&
RdSo
F*)Ss
ez+9
T:LE|
~ik?
BeginInvoke
%_[Kt
v(KWHA8Q(:Cb:744)=jUiuon!
Nn*o
qW4v
-(jR1#iTdayPdUUCNK2;WnE2#
d6+u
"]P[Ys S
*G>}
"B_z
.,K("o
\!J5ms
HwH9
Y^61
e:"T<
el!0U
FZ vYw
w$G?
)]dGC )&F|Zk""om3Jc:<l!T&
UcV{
[pmq
E2)"
c]blz
b;gN`/l^jjA&C[}t&E"O#\<3&
hf k
O @T
z{@>
EM-L
~Ste
o-{X
(k09&[9s()Z2?qZu`0~0";(#$
4NpD
Rwv
SRtI
Dvv_
+MxE
}(:D^C=|`ZtQdafUvDHh8W\("
B( jsC
\3Lq
{"P_
RuntimeHelpers
5J!|
vUS@
0ioE6
]H S
MYG5.
O]c,
! w[N
j7p'pIF@8fyh_6T$iB3F&;p{
2ar
;^vQ
UserControl
p9}c@F
{vhI
(oGwLN 0Nc>Cz9t5i8SCNOo "
z4`2
get_Enabled
s' c
P@|@?_
b-y
K9r(
I"f`
Jf5 ?
R ;7C
s?b_!.
d&sY8k
o V0#
B#)X
<)|
zrTLq
TB'K
lWr<A
G2!2b"W`Ptcwy/\dX6ZP?<e*#
)o4J
&QO*
Bwyg
pFY%
LNkY
@Dy8
vH?#
D @(
K,*
Object
&+@I
X@k`
Pu%w-
(WzU
D A}3w
ny
@{\
7{4#qVj
};i@DQ*0lyt+PY2+U8$V/n\#$
&~=#cw
ComVisibleAttribute
^8jc
pd$i6
uXbf
k WX
oL*w
{ NC_
Ph|R
y< 6D
W,2P
/.[ap
o]zN$
Zs'f
=GO
mv=Ar
c`;R
aiYP#sdQAc-*3jK? S;~ -j%
_@VJ
%`@^
HEw{
@g95Q7kb>!\% ZGO?$9?@%TS$
yYPWk
vzxw
9I-B
1 @&
/(9h
=:+A
JawM-J
~ z*
0C'`
_Assembly
q\z9
+gWA6
<aRy
-#HU
[/d!
A%@
(m$P
i@{1(2@X8r3)CP(RC&+woCEc/
PmwX~
$6 A
<j8~F
.x{W
QZovI
AssemblyConfigurationAttribute
toUD
sMok
$$E
I>R
y{Ok
q2P<gB
OF("
sg!w
n8=ygH
68Gz
*%ZB
OnMouseLeave
X0C.
Qz4e
,1q(L
1.0.0.0
UhKU=2
g1 u
eNc
FJnO
_ah*
>T
.L8z
bg/z \
-;M+
&S}X
*45I
q6Kb
5Fko
R)2E
Ln"}
Zm
MeRh
-2} P
#^?=
;P:~W"KQD$B&{=7$&>&z-5[L'
L4vA
|!$r4
A/^a/hv
4d/k
km-!
q$sK<
>$V"
Stream
;++L
Z-c2
E!<L
eyo(
WuH`
G1A.
/ _JK
NI$zxy
sRGB
4t'L&G=\AZD)sC#M'R(7ZfR3&
xIDAThC
}M q
fh\s
Zd/s
Vf)a
XK!S-Aa5\bUI 3D~N!k_v$[,%
zRV
D6U\
+ d
PHr<^N
d/#.&
=E9]
CompilationRelaxationsAttribute
y=De7
}Sjm`
=@<T
X;Uh
*91a 5~
Y5z.*
fzQx
dB/n
N, hTs
1l{O,,{+lzFUxx@rLeu:y2CM$
get_Control
)3 Y
A]7V
P5Q\f
<!lN
,9ZQf^
-,@2
7 ;.
%?n5d ]
\"TQt
Confuser.Runtime
OjD_9N
3LD*
f~6N
k<cz
_mMX
{~2\
,2 ;
|igcP
\MKN
W+fN
gt;]
nm0i'
IQ(4
m/+TQ_)@W,s0Q#ot[LcqrV}W$
[JN[zFtv
1E.NC
E3b
sB0<
{ywlsC F^(+V=mD%13#H"9-y'
H;pG
COZ-q-
'Z O4kD,8Mpk'\SyF_bUr PW"
cZHL
Vf8+
E=gr
i0I[
Q>1n
(SJ %
Mav#C
)3ecO
bhRB
cg<rY||s*V":%[q}TU:DLcb !
OtlC
:8@,
vU6E
Du\c~V
t$-v
7Qjh
oD'O
~ 20
LjfW]
jIT
olyIV
Lxw$
Meys
mX4t
q;Z~A
cyJP1
F1_6
2cYG
set_ServiceName
+p8F
<{;
Q A#
dec
(rV^
SJ:}e
[%;k
'@6
( Id
)OO\
)#Rh
wWf1
:G @
kXw*x
gx}V
MEYH3bQr6N}B>A&"_-SA!>$5!
F6}B:
6)m
3c'q
H 5|
|&o?
FB!9+'UT&u+`scetJi(S|1y}
3A #
Xg `F*
U`q7
2|.=
73T?
d-[ s
2~U8
[ [oU*Sq}bEA}bJ3"60S2<n]"
gD]ocM2-~
4]J_
_Mc|
{ jU
-uMq-
&U/LJ
5 G)
~%c&
_b<3E
<B{^
U1_H
6*0Yr
LK_|
7=A;
e`k<T
}\,g9
200\S
'W:r&
%l^8R
/G.w
*Th^qrqH="$MT+&xMPQ>=Ea8!
; x9
Q]4=M,phPl/S 86}cISoH)o\)
)OOZ
f.+T
ZTMp
s\Sc
x?A|
?=*EA
n]E R
R%=ZtNqBw
rj~(s
k5y?
!d>?
C`V?
ValueType
<Nq8T
OC<d
vWpJ
V~Mk
E bK
zehY
MK"7
%mSyr
8rNl`
D@~]
Mh5B
[bVD
sN T
5,ee
dL\I]`
<1h\3
^=* n
GetHINSTANCE
bK<Mb?&JEt@oi4{73Qqw<m\z
5g]?
wZc8
ey;(|Q
Buffer
R w}
DFfA
Z:6y~
*."*#
I{Ry|\
/@#s
.iK^
?-(3
_sVQ
t]C;J4
JimX
P=V
5mvZ\
4iVS
VW^=R
lAlc
4 pZ1
xOm=
&xu\
\KS2ks
^%59
_"#[<
<O\f
E(om
Q Wk
"N|`z6f@[@1]5:v&L8e-10+Z&
5-XE
*N\vZ6
2)d=2Mx7w]K706`_?`{x8i@0'
)o`}H
z~cT
xG-\
9jF1
rs&3A
_W*|X
9p oX
@d_]
zx $
nWX+
oqNAI!
vi]4
Gl8k
(+&L?
i,I`b4]j
sn1z
%6AT
5,I!&
.+J;[
Y{1T
jNr
nn z*s
xx/U
RnCz
MPoA
nZ{&M
W\RWN
v'tG7mK!vT!m_y}6md}28b`X$
/$Tm
qs-Vs
= OX
\vCC
qQkA
)C+QJu0"N%#_?=YC\9/\Cvb$$
ZpCD
mt*@
{U~]
Z[\Z{DE|QPrbvY~_5<s^2Q*D&
Z"F1
kL5D
Y+5I"O
L,u{
oqS
M p:A
|&2t
CeR{
<-"^T
V6m&_s
h";;
Z2W/
cD|0
o4ay^c:knQ6~@Qx1QqN979U}+
DWkOjM !
UtCd
~N=l
ArgumentNullException
##>>T!
NcL dxatT{NY1,jp"`@4i;[?$
get_Major
HXUm
<o.`j
.cz0
QV69v
JjQTrq5
Ku_I
d]4T
Point
;0|0
,J(+
x=R
c{q6
!pkE,
iiUnx
)a8u
Z$d>
/ 1
qUM{@
QrgP
v2.0.50727
]UL7
B42xx
yaN6
{/:
|JPl
kTsf
0>ie&
!AYaa~
{>}
1>c*fQ
eF@e?#71-Ml2C-cKRRK<6rBn
1R|zdCOcPF^e+XLM|*K;w\#*#
0z[y
jBwc
l.jk
"rnKJaL$-C<?QD\]-JCA$g:+"
$,2w"
UPrMfA
cGTP9n
h f
dJ&=
l9Er
fx+9
E~ i
(~h(w
4`7%
*/eD~
0gH^b
y<uy
8Y &] m'
~h>#^62t{K?]Abf~%g<0(Pi7!
>;kO
<jU.z
y~p
NDS
r9wT
C2-l
Exception
6)H|
aYY/_
]!Xl
=i8P1@">(X@IZkT;6s$z- k&-
'Pzqe
J%0J:R
sb>-5W
V N=
w44C
11ZM;
XCb4
77O7
7D$#
}*A!.
?"9u
S>pq3Wtn%?0w=)1sS8%_os$2!
pgJ(
lWyDg*b
n[ }
QuOz
_PV 5!
x$Ps
@5 T
$AIC
Z {w
%bm*
wX9d_+
83>$1h
?. )
S}xm
GetTypeFromHandle
l{7"
ar+v
_KaTH
(u&r}s
YWMs
09K)
^vg U
qjC>
_C58Y,UbaJ
O[Tb42K7$$#,aVQ9Y=-5i:c3/
cWu.
3N2v
G:jFAL
Y6J9f_Q9l[$WT)89vM"(@;1v"
$ S
rTa[
gqy
Xn ,
S^hpi
IS%+
zF\q
M9 [
GetDelegateForFunctionPointer
yCVQ
$-0}(j
$:5+N
mr<U,u@lEI)P356s(8qQk9TX#
g b>
7Z@;.'j
W oE'
/~ _
#e[vJ
v)TQ_
0lZYYU_Q- wR^zk8LB*N6tmE!
v.9b
V2|^}
o =;
S6C|]
[}Yh
aL&;
@ah@Mc=e
j;cx
X%GF
iyx=
BC2E
[`;/!
hk^X
i?.i
fEr:
h^yz
P> \
h:Odj
System.Runtime.Serialization
R5fQ
:cL @
YR)8
p?V
BZe-
#D;n
=MCc
A=B+Pb|'r{-PS*amb)+!b9GG-
U-\Y
GlPrB
|UW?
iBh1
63-r
${h '(1
6Z*+m
F+5>(
n[lm
4V[2
~IDAThC
^-4${
?R*_ c
Nh_/Y
!QzU
c&Nm
GAb_
I+fq
[vwE
XK(.
SL8MXmOcc
aVq
oWAyje{I_JSJ1S?E;N&>c"#P
J/X5
[EgWVB<)q2rMtujI7 8Ph9'}#
zd+$\SIC
6(s$9
6 3N=
FMDW
% jT_
Zgfw
.| ?K
u<~8.
~F,Q
C3xE\^bu4dwJO:^s#+v_q{(i$
+|`2X
o8 D
eeVl
D GK
/GfJ
R|y
^#,4
U>]t
;|1+
U#d:
F>X`
gJN\B
*L9z
8B"d
N4/n
}je+
m4~X
;{ v~
FOHg
(W.%>TN
Z n v
GX/V
I hn+J
System.Runtime.CompilerServices
~70
KK5k
=+Z8
d63>?
SuppressIldasmAttribute
q$D-MEiHnm4Cp!,5M#q@kw8m

yL{TJ
kcBJ
x}AZ
RpV.
gA0g
Hm0b
vJ/,
B^B
B5}G
EzW?Zen 9
v%lA
s~9To
rDq^Kp
pL3N
jeBo8
$zO`
?RI
zuHH
0m`I
%L77I
I~R
jt&/
^'e$
q6[B
lN=cG
|IDAThC
ei#b
~KTN0
,Qv^
hFM5EG==6J"+=tF7r3;IWz@h)
[4`#_$gI*@ N-Ld#jv'+|]=l,
hZON
(ked
]1^m
t=; 4
'6=qz
#fs$
y?ow
)Y~2
set_Font
h5H<nNg
6sWY_
x7&s
Hr _,
W3{K
VhF`{&
G*tT]a
iVzAk
Vj75\NFBcy^1]$&oo%cezLu#
tyDT
,-B}
kZ;k
{]S
"S]Z
Ma)l
?hIz
4jm6
IDisposable
ZYdF
SG7A
d5(N
[g%5
r;' d
t)^o
*<21
>2Ah
>:BE7f-
jvZl
#@8p
ByKsl UMApL*LApM2M^{)"$S#
m-J0
x{I2
^-{
3k?v
t&ff
PLx&8
y:w4r
4\MI
$ F6'
,CM3*
4h2
)^fY
%b~H
o6;$b
s z}
c@k>a
T&v%-
.8ww
;sq0
s`i+U-r]]OhC:4^[hibru)AI"
7Y u
wU2:
VYI{
%n+`
iUD*X
D!ZL
~.f
AssemblyProductAttribute
UVez
s}4
Yt&r
t>v\
gE"vy
x?^I
Z<;n
zI,
Fb"ihm;~Ha^DP]N-tmv&f-(J!
e/)N
ym t
KD)b
\9tRQ
<Module>
I8vb
t}xh
A|~X
d,G
RQ]
H6BmV
hd8ff
Ldj|
Kp ~R.
,~XKL3
mHS/
MulticastDelegate
Z`2?
fSHK
NO$\
] D,
_ejr@
,D>5u
n A1y
mq)n
Z)|l<n
Ez0Q5
!m_pData
x T:
0z!s
u[-.<pv
value
) q
bV~Mb
:ea pL@
+^ol
i+F">K
d3
oZt9P%Ta
uvjjO6AcC{-F8=4/@+2&wzUZ&
xnkP
CXEG^C~m;%#zdP*g+D0gpdiP
\$u%Z
*n b1]
/;[@@
lS0^
[1n/
A7!{
j 0l
9T\-
7I(
~~M
1q<|]
yST
XbM
nPo4
| {wi
OnMouseUp
-t'
i6C5
Ag<*
`{}4f
%l:j|
(KZl
U\K@
[pvh?T
6lrx2
BK`#
4vDD
-&/y
Zjy3DEX
d948c4e2-116f-26.Resources.resources
;W0r=sD
W$ 6
hapT&e
=:`@
#GUID
Duj&
[)4.%'
~v?W
Br?n
hH9KS
Y\In\
(l'
4*N
t T=
](cS
'^gf)
set_SizeMode
|[vfBF
b<3J
n7NU
Wh,ZC9?
}E{\J!sA
&iR&5&
bo V
)iGL
yIDAThC
%'zJ
pxq-34hquKzqpsn+mm W{8E_!
sWM_
Y Mgk_
v 7Z
ig,}{"
uB
# |N
P 1
*k!
[Pb
J@ Q
}?>8'dgf;h9D3=0>g Y)?Vo+!
]*PNY
)L.s7
PyM.I
>C),
>5U"
po!t*
}ySbz;]
kO@i
LW)
X +U
z)>U`
U< d:;M`+_4cYw;;;;"&xy%B$
3;b n
Nullable`1
Z=`p
EE,]T
^$r~
-~[7
cSNyj
BORz
19KQI
CT8!
X;V
E~u]
%;UO
'TCAV&]`S"#g[58yyK],ZN`N!
(-?2
>e&s$)
a .~
D O\j
get_HasValue
)@Y\
l3~3
u.=dk.
ItQX
09;J
4WfKN
Bsb!
G4[8
f #\%w
M=*~
(g~T
K&+&
ykJ~
HjA^`K*4
dV`u
8\0W
%XL"
d~K)@

?qeN
Encoding
n& R
m<\( 4
3%0&b<b@iZ57j/J\6j1<9Y_4'
r|#{<
8F.A
m?C|'O
C/_1OAOz1g#zEOikMtb<)fw@+
El=plNE#
V.`W
3I(L
-x']Eg|
IEnumerable`1
ZHkL&
&'~{rJ%olM0;ViRp>chUyGkI"
-^0|
t;7N
m`\
*e_`
u!iZ
get_Module
/dK3F}X,M
y6wg
TabAlignment
iM>G
%e}7!,
_ ,
V;NF|:;S|2s#*NU`\}3:ibE;"
h5 !:
;D+%
BQcl8H
iMLdA)6
=lzlWje[^a0Gt'T+mDBo/"Eo
ylz%
sW8_
ns)'
?b]J(
[G6T#
P!aM
F+/K
.i[V
Cursors
( (n
7bIb4
f+~W
Du_R
q1~o{
ZzrB
get_Size
h{~k"[)&ORzG)Z3C3m2;Xk%(&
4\>/
.`x2N9=
^EqT
rh_0
;t"y
I.gr
%j60
Bn0<
H>"r~~
_`9
.A|H}
|_ReU)\H
D]:w
p|U]
vp]"
lVW
aw(j
Qt=$*GxQ}rV<3HI'#lTU'7"x
J<3<q
QBD G!/E3[O^|) b7C<?8n!r$
Ark.exe
lHM?c=
!) vO
] 3X
*Z1^k<x
*R=I.#
7? 'H
436534A617CD86B8557AEAA31D433ECFF38B112F
KKj|
0[ t
pLw369
IDAThCc``
[Gk.t
*0l;
{7Q}H[0iGJ#3AyB2r[cJH@IH%
i /2
UN,l
;&f;
s">b&p
*l a
DisplayNameAttribute
Dbiw
V @`
{y<0 6"
veO`x!$nwR8R=cX,526k<s%D%
j0v4
Zq_X.=a!bJ
EkFK[-#}Dm`6k`itd=J$--}P$
f1(`K
C648C0E55DD0A71600A3C979FEC05C180303B2F7
lQclc
s5{
"t?k
QR!_ 4e#9}ZHeeTQ(ls$&#F9
,NR_GLq-qkl2C9aI0]%m18nk$
obW=
Igc/C
K?/WN:Ix#2SwO?yp:x|,Z/:_
cs`7N
C\akS
,OR]|)
!}q[
+v55
gP
g35z
WA2+0
"KDC DC
0mx%
$&\saVI
!|=]a8
UJ,=e
4/xi
J\R)
]f7@3p
System.Collections.Generic
seW#4AyTgG2TmuM?~%oulUZ;!
f&H?6
} }{
Dx=_2
:a*^}7
n{Bsd
N^_i
G`1;'?
U~&L
T#sf
Vi41
K$'W
hXl;5
hjm{
IKP
ZnJJ
-g|{9
b(.U<
System.Windows.Forms
set_Cursor
/NH'U
e<C=?o9+U=)Jqm6,0O't7T_/$
7y`!W
}{!t
TIrK
iv6>
r`.*
=-%I
zw$'6
WriteLine
z:QZ
System.Drawing.Bitmap
AZdUQ
=77kr
&b,Q!
Xqufj,
+&ru
xVOj
7Z p
~GP{zI)Dz2}s_Lnx5";5/i!a"
xlTK
1uEM
* .L
SetStyle
~6?e
+MeM^
TSrK
) 6sFn9
bu bl
UqD4&5Q
bV:Qi
>*,R.
D/Cv&
disposing
Y))(
hZ`?
#dnX
}=,,b
*L=]Xh
Q >Z
`Nq9
"1iv@j1
XuMZI
1@zKQ
qb(&
V=mc
`E9\
KI /
sRj5g
Z[y..
vu3]
H$oq
@cz+U
:b*)GKNq&_RN(QiQ}4(,;+p%$
_r<$G
zfz(R
igfb
h9c*a]e?4z(bY|,"KW}*fis}"
O9Vw
DW:6
j[TpG+P|/5C7 E]_EIPpsmBW!
*/ P
V(=XS=lTy@xE6^aZXu0-rn/o"
dT@@Q
Gq|^
M;L3
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-02-15 11:29:04 2018-02-15 11:31:59 175

9 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-02-15 11:29:04 2018-02-15 11:31:59 175

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\roman.exe.config
C:\Users\Seven01\AppData\Local\Temp\roman.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\roman.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\roman.config
C:\Users\Seven01\AppData\Local\Temp\roman.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Users\Seven01\AppData\Local\Temp\e5556b18-4847-42a2-97cb-5bb22332d733.dll
C:\Users\Seven01\AppData\Local\Temp\e5556b18-4847-42a2-97cb-5bb22332d733\e5556b18-4847-42a2-97cb-5bb22332d733.dll
C:\Users\Seven01\AppData\Local\Temp\e5556b18-4847-42a2-97cb-5bb22332d733.exe
C:\Users\Seven01\AppData\Local\Temp\e5556b18-4847-42a2-97cb-5bb22332d733\e5556b18-4847-42a2-97cb-5bb22332d733.exe
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\roman.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2500.15672765
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2500.15672765
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2500.15672796
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\e5aa3223-3cc8-4c00-8c93-df2c88edcc12.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\e5aa3223-3cc8-4c00-8c93-df2c88edcc12\e5aa3223-3cc8-4c00-8c93-df2c88edcc12.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\e5aa3223-3cc8-4c00-8c93-df2c88edcc12.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\e5aa3223-3cc8-4c00-8c93-df2c88edcc12\e5aa3223-3cc8-4c00-8c93-df2c88edcc12.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2704.15677062
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2704.15677062
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2704.15677062

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\roman.exe.config
C:\Users\Seven01\AppData\Local\Temp\roman.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\assembly\pubpol23.dat
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\roman.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2500.15672765
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2500.15672765
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2500.15672796
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2704.15677062
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2704.15677062
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2704.15677062

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\roman.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3035fc5a\375c7a1a
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|roman.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|roman.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|roman.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\3850e7bd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\1b71387b
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.VirtualProtect
kernel32.dll.GlobalMemoryStatusEx
ole32.dll.CoCreateGuid
kernel32.dll.GetStdHandle
kernel32.dll.CloseHandle
kernel32.dll.DeleteFileW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.SwitchToThread
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
gdiplus.dll.GdipDisposeImage
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe"

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-02-15 11:30:06

Detected family: #Malicious

TheSystem Itself @ 2018-02-15 11:42:01