MalScore
100/100
MalFamily
Malicious

refi.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 13/68 Related 2708
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 601.50 KB (615936 bytes)
Compile time: 2017-05-13 03:07:04
MD5: a225d4cf073757083a309663f02c58f1
SHA1: b0ffb0842ebe04c3502386d04810509803846e84
SHA256: 9c45ec2e333f0f39c89b074da1f1a86b1f0241d7a9dfab559b11275a0046b527
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-20 13:03:07
Last submission: 2018-02-20 13:03:07
Filename detected: - refi.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/refi.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-20 04:44:44 [13/68] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x624d4 402944 d8596fdf1795cdd4d2b2d086b573bae2 16b8688455d6cbc2bcd7d93660aebc76ce7c1a2a
.rsrc 0x66000 0x33a60 211968 8456a24a0a79395110d2125107f3a53f d91f6be3e2f93852f427f994bbf57424ca0ac74d
.reloc 0x9a000 0xc 512 b09db5d4cd680af75bcda9ff9376101c 77d0141a0c8b7d7d024c83732bd767eceb5dde05
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x66130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x9947c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x99490 996 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x99874 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 Ace Hardware Corporation
Assembly Version: 0.0.0.0
InternalName: refi.exe
FileVersion: 1.3.1.1
CompanyName: Ace Hardware Corporation
Comments: oyonayaweb
ProductName: Accu-Chek Connect diabetes management system
ProductVersion: 1.3.1.1
FileDescription: Accu-Chek Connect diabetes management system
Translation: 0x0000 0x04b0
OriginalFilename: refi.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
1.3.1.1
URL(s)
No URL found
String too long
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
Comments
317c227e-67f8-037
317c227e-67f8-036
317c227e-67f8-035
317c227e-67f8-034
317c227e-67f8-033
317c227e-67f8-032
317c227e-67f8-031
317c227e-67f8-030
317c227e-67f8-039
317c227e-67f8-038
317c227e-67f8-0362
317c227e-67f8-0363
InternalName
317c227e-67f8-0361
317c227e-67f8-0366
317c227e-67f8-0364
317c227e-67f8-0365
2018 Ace Hardware Corporation
Translation
LegalCopyright
oyonayaweb
VarFileInfo
317c227e-67f8-0344
317c227e-67f8-0345
317c227e-67f8-0346
317c227e-67f8-0347
317c227e-67f8-0340
317c227e-67f8-0341
317c227e-67f8-0342
317c227e-67f8-0343
317c227e-67f8-0348
317c227e-67f8-0349
1.3.1.1
Copyright
317c227e-67f8-0360
317c227e-67f8-0359
317c227e-67f8-0358
317c227e-67f8-0353
317c227e-67f8-0352
317c227e-67f8-0351
317c227e-67f8-0350
317c227e-67f8-0357
317c227e-67f8-0356
317c227e-67f8-0355
317c227e-67f8-0354
#EOl
317c227e-67f8-0328
317c227e-67f8-0329
317c227e-67f8-0326
317c227e-67f8-0327
317c227e-67f8-0324
317c227e-67f8-0325
317c227e-67f8-0322
317c227e-67f8-0323
317c227e-67f8-0320
317c227e-67f8-0321
Accu-Chek Connect diabetes management system
VS_VERSION_INFO
9c368ec6-7137-ff
Assembly Version
317c227e-67f8-0339
317c227e-67f8-0338
CompanyName
317c227e-67f8-0335
317c227e-67f8-0334
317c227e-67f8-0337
317c227e-67f8-0336
317c227e-67f8-0331
317c227e-67f8-0330
317c227e-67f8-0333
317c227e-67f8-0332
dxy
refi.exe
ProductName
StringFileInfo
FileVersion
000004b0
ProductVersion
FileDescription
0.0.0.0
OriginalFilename
317c227e-67f8-0317
317c227e-67f8-0316
317c227e-67f8-0315
317c227e-67f8-0314
317c227e-67f8-0313
317c227e-67f8-0312
317c227e-67f8-0311
317c227e-67f8-0310
Ace Hardware Corporation
317c227e-67f8-0319
317c227e-67f8-0318
>{[
}Pc@
~,Ps
H :F1
#]Ye1l }y
Tg7x
FQKs
r(A=
j:ID6
@mU-
DH@
-$#o3\n
BCtMCuem
*^ _
FE?4
tsLB
a 6Y
PNG
kg?A
y?\jr=I
=Vtf
l6@o
/b#e
/_;O
9+6;
W[?e vw
SeparatorPaintEventArgs
^d;5
UI!%2
b%^*|
{MJF5
6RG6
Char
vYtY
NNN
( a?
get_White
2I q
izbNM#;
5tJr
Oo'"
?)NMEo
rS"\-^
9,~ o
wX )X
ResolveEventHandler
)^>{
7M:3W
`R|n{
T3o
^>n,**
;6 t
A>XcWO~
]FU:A[
m ,
FKH*H
1KaoSD
1eZ1
-D7
6`tw
5jA>
s+#:
set_SizeMode
wj-`
@_H^
Cqq5
(O8i1
no5#i
L?~%
3 S~
P'{Qj
oi{<vQd
7(AD
6&Pc
ny%"s
g9~#
Q^w,
pu$q
F0%6
*)I\
/YFy}
=)Yttp
kB80-J
n;+/
$!<9
UV1_
textBounds
1.K1
!Xtg
<q_8W
EM'l
O0h
aaUza
u (Q
<M]w
-LJ(
3e:s]
W5l
X!qNq
""1+
^ lb
$fCM
W I~8;>k
N]eC
S`iC
XO+[
1.K6
TtKL
get_OverIndex
Bi5'
.G:T
OnPaint
I/7]
x S;
:( GtY
H4qR
?>^w
,umoM
eY+g
%To'
dX*\
yfM_
wJ
H\# /
}[;CI
System
r5i|
P%jy
"@b =!
j,[E
DJR
;5|]k
IK;o
xl`
=o*5aySD
L y 4
Hrp*K
9Hp C
yACMTx
.{&#
1ZFF
0tAz
ControlStyles
y%_Cw5
urv2}
iERa
+_+H
aLGYq
/l@[G_
DBWW
T6yT
e*BE
get_FontHeight
;`MW
X 2Q
c=}Lw
9J]=p
D^Gy
z1UC
75U[
ilDv
76+a
%"Y~=
Q[8q
UtXY
dzH;
rvh`
~mG?
7(cb
nMv-
dcGk;
+<T <
BU\(
S=_}
h&J5
RuntimeFieldHandle
I.}rw-
\ji3P
J:fV
/i;O
OverRect
}IDAThC
-z)
7>E
bhiX
S7a2
lv1zNRo
m~5D
V=c_
Be't
&*8I
matemdeea.ControlFolder
{^]T
set_Alignment
i.8t
JUM&
"x
~ZD/
_eUs ~a;5
WcK]
Xt7P
P-h
6}()
o@iyO
y\YD
1.K.
H(:
-1~b.
BoundsSpecified
lIg=
)CR
z 4%
/H76#
yuho
Q[$z
mSMb
gaNvbC
$("x
zYN\}
B==N
jR
A>jfZQ
b1x}
T2>7
7vl'\
*k'd
3uCmc
<"Z9L
S=e(
6j!X'%bb
T2>#
+-+Hu4
paX8
WIA5
hxiF
#z2P6
t 4wB<
FVo-
7 m4ed,
wpzc#\Vi
GF="U
Math
,lF ~
=h\i
T{*V
WWeM
ktJ (RJ
AH:'U
m-t= >q
`;qQ
C1F8
hk ,
p2$5$
fjVW4.W*
\BwNL
WSl6M
^Xo(%x
&yR"
5;{j5V:
AssemblyCompanyAttribute
w;gI;
0ssO
4[{aB
Ta0p
FyBHO
w?\>@
p$CUQ
++x#
![<v
X?3
`"<:
*9`
ZlqS
{q gV
UqvD
o^!
6[ )
;JPfN
hr| 6
bCBA
31]w
W{t+
Me+(
` Q6!n
``7/[Xd
~_fE7
cJRM6
,o2F4
"PqW.9
WL>
ilio
1$f9
E~mK
(U{WZ
twIKH
XSx$
b]av\P
0.je
`D?=
uuM\
TBI 8
Qb'
8cWj
J'X.(
58}U
5,`sG
k_J?
JI|c
<ZlrK
U2@~
i}Gf
$2H#
?wkH
7N9:
q:gLwl
RR<,
&vhq
jvb 4J
A -
@}<_
VVFSm
SoUV
get_Height
A^/OS
L8gx
w+WU
9mNw
{u]0d
xnUwJ
'6hM
1YfK
`Qxi
reQr
p^r}
:1-
$B
{L=n
u&vG
|p2_/
x>vB |
^i_+
3Jz[f
$?nA
JQ?*g
j3}H
64,M
O6A+)aP!
Z2l
omty
<r4>
$Er3
!gfp
Rzu;
sy/g
E#Sl
9)p6
eel
IComparable`1
3o5c"
in
z22n
&z$)
O<'W
|Bv]t
=7Y#
ii4]
Mf`W:
x\$
S i:
'}F7!
fFPr
~/^N
Me+)
U:~|
], 4<
]".$/5
@WvNn
5[>=
H|2.
r)7f=VM
lb~
\\q
get_CurrentDomain
s1%g
]g2fBrp
>rto
mrr\
z7Ew{
oFz<9\
x_`
]eUA;,
U^8))
}JcK%
` 3h`
%Cs(
U^[g
R)SU=K
q3-m
! $0
5x%e
Br9|
get_TabPages
mUI#
;JL|
MF*fo
(2}s
4r :>,
Control
pmfvh%uD8
sSk9
seT_
U [l
P8n@
z$cb
N$o#
qb/Z
Z t9
get_Hovering
2-Cb
\)KA
Tmj
Sv5h
c]PR
*d.)F
E@^d
G?}1
l_G6s
TWZ
v.;Y
p?DCf
$a^k
*0f%
ps"c
oA0p
6ft@
OnMouseMove
Vb!8
iRh0
`@#B
'XT,
=1i
7{0/b
%/n$!
&QbX8
yYGhg
a34Q
$fN4R
c'-]
u7a [
0I4'
>)YD
j'a@
`Y t
*ZS`
3,dQP
]&31*.
oB,zP^
LHB46
.g\'
)5`t
a?wp
:2En#
(p1<"P
hR%
~ 'H Y
System.Text
0@M~f
F9X;
5*^=
wO XN
ZUeY
3,/W
9t!t
U*El
*,5Jb@
">MB
s&`D;w
set_Width
.@H
R<3C=3
M~Gr
%+nw
lsgU
lO8
Obwa
t'T%
M+mA
yG[l
`wS=
&+T@6
I%sy
bQBp2`
1UC^
ZpQb
%ada
h[v5
D.n3
-06!W
;4Xi
>Wm>
a0n2
@u^@
I)m@
0 A (
#BQf?
;<\O
Jq 8
.1|I
uik
=%Aa
/$4+
xA(~
LXK?
6td1
<1%I(
S1'q03
GS E
4Ein
'C76
k.K;
a(-0
hKL*
H*F&
w#%+Y
I*d{Ky
,N0[
!XZe1
[sv{=
8s/
:qh@
Hv2fq
gr+^
J5MtS
%iNr
n#",S
w2/^
get_Y
String
11@SM=
pH-C
oA"|
]B#M
ToString
dmwi
[R>4<
Gxd^
@]T
(I&n9
8tCv
s7>
,cb8
@%mj{
7?*S
H5H#
K^|8
VI.p
Ql]E
= < < < < < < < < < < < < < < <
{U1W
j0(P"z
[Tum
ujbz
wb'%
`z|3&
,fSSgsH#7
(uX7
[ Y2
t:Q<
j u>
6}+2
x;?C
|v'7
7"Hw
3UW[>/K
AO %
gMTkV
EM@T
('qq6c
gZYg
$P_m
GOC3
90(L
CT\l\cW
w}-h
AssemblyTitleAttribute
*HMY
ed IL"
42?f
gJQh
c_Dw
GHCL
(.q95%<
"4u:
sX]f
Pn&
zi)
U-#D
7lM7H?
NKe
kg o
jb.+
RIk-
=${G
53RN
>dmM
\c3
S" 0.
WrapNonExceptionThrows
G+_
}|q <
k }
7qUk
P0`zA
[BBb
mz_$
C~;A
e{zM
`C;YU
.text
*#,*
7W$0W
_jjG~
GU?"
D|-w!
tv0X6
ZeXi
~xc$:T
c&9vr
JyJ~
|^v0
8>l
OE J
)k@Q1O
vg'O
Wf:H
TKUc55
aF ,
#$P[
iMk2
|>0p
4h'
Kb@ fNA~
vKUhGd
bEJz~
|;Oi
" X\DA
|y F
'#4A)A
+Yk
[8@9
R:~\%
DjrL*
OnCreateControl
}SYU
oR?m
"6 '
cH\m
DZ~e
MarshalByRefObject
_nR<
1%no
KJ`cC;J
Q/xf&~
w%[^6
D*U.
~"wX
)3Avz
Vt-J
]_Z&
P<12
XfV (
|BSp
?1$ PJ
>l)/
:FE_
n~7<
\U!
LP M
!Y3#
2A-1/
^C@6
G}+[KB
Xt}I^H
4U 1
N|3C
{l_a
hPbt
9|=S
V{9=e
+`n
F7Nw|
tT^Q
t3,,c
@=CMz
I*'f%
iV#:
!)Rc
_Qa#/
xBSU
u'l_
f7]emB f
("U"1g
u3Uh
d|8A
9_>g
B6Lr
'a\G
6EFAC0EE8C248566D5441213E5936E72128EE1FF
7 mT
O5Q>
Ge'
TAs
xI>#
zRZEY
q]f^}M
~N 5
JpvE
/0F }
0U)q
Y\S>
.SHy
an !h.o
JS~Ou
i _
N+S<
i e,\
BTSJ
J*ylN
4R6q
!'g@
^+aJP
6GVeh
"BC%l
_5YZ
[/0F }
%_Wf
v$iR0Fn
xXDu
6:rx?
],+D
AEHY
Ta(w
^a0a
.!IE
Vvr[
{'I8?
ZDM
oE`h
b7Fen/^!
X: {
Q B}@%
rRCL
8/ j
Z iu
:O_|4
WejS
`.rsrc
mrm<
=7C$t
9"%L
yoE vqa
} $L
k(#+S
YqIr1
$S&d
K=]
,jgC
! Gs
sB.SRH
( ,`
ZC?D
q]1:G
lSP,
-)s4T
pkzh
!-Rb
-yzK
2NSD
$o=K
,i>q-#M
$t}N
TjebV
O" oqm
r"5"
++02
v56ct
4mCWY
.vtzODS
s*q}i
/FuPJwu
/ Qc
s~A4
m~aw
i. m
]#'}
R24
ST)=
UWol
m){^
v~LOX9
6I 3
+X 8
>nN)
r8H>
5t`S
Wj^"!
?<xu
UJ7\
;2d9o.6
,~>1
*JW!C
YxH?
2~l4
YqJ:tG d
$-x;P
epq
11 9"
Tde;
9XG?7]
4}De
t;e;\Z4v%aN
/n[0`(
]ZEE
Y51~
08G%
.);o
}Vc!
{[4$J
RQ@V}
vp+v
e UV
XXKM-*k+
e4D\
,
,/S ^
f*esh
P/DB
> Qk
FJ:$
vbo~
NWk
|6,@
DKd+
xW$e
.#nE
h[eu
xP+L
=wYM
2AFf
=1*i
h2?!
tWkju
r0Sm
d"bW
Pts
5JEZR
)%'g@
=dD`
qT @
MouseEventArgs
QkR5c
rrftaC
`<cT]5
%C;#
N<al^i
\O{g
uXaSv
BQ|*
"i p
n0@>
Y,j;
23J0
]Vc)
AP9{$
sP"H
T-gwU2
;-A8'$x
matemdeea
9O5d
^?<~|
5'[o
X1`J
(cM
Rq+L
`|qX
|[]t9
@/8wsn
;v9x
NA.0
bFjYk
fu %
q~I=
?CNn{>
H %)E
N(8F-
1Oo1
8rEz
,~*+7
>gs
qZ16B0
MF$byB
MP\~
eULp
Su/v
lJT+
G* &
TK1/
^Fw`#0V
!-@g
FA{\
_X$Z
vy,/m
%9RRB
_>7}
<;Ukh
kA; @*
#)^y
{:S.
p+.u
!]cb
'vc
r#Xy
{W >
7c"-"J
bqd$
5=,o
Q@]>
A ev4={
BtD0 9id4
a`kv
Cdsfssrd
I Aj
}[v .
%WYW
5s^w
RA&
uxvc0'(
gB!A
System.Runtime.InteropServices
R+qz
]*)`&
frJ K?
6#5i
FuKo
Ca|Yi
40 :
@A76
4jn0
Lcg5VZ 9#
nQy$
V|!Cw
!+zo
!7-_fdo0
0:KA
w`VQ
}w\O
u&wtP$;
u_@t
\\Il
qu".K3
V r[
get_Assembly
<!%r9
R~K!
zylU
L@sv/
[WWnJ
}Wc!
6&*X
_D$y
Zm!m
k%w f?
X1mQ:
obf2
{D_|
9 93
VR/b
mentGE
@:d$
JS/2Xp4
i=dd
qS<3
:NX (
`uUL
$#sS
` T:
/ ao
KT"?
P$^)
*#p}
2V T ~T
I #p.
M,{f^
xSaz
{.a(
| &4
) 5.
a}L1
cZrdm
E"5k w
matemdeea.exe
!J{Zi
]f 5'
B.Ue
RightToLeft
pOpk
m&)n
qP[U
H(Gm
%)!0
said^
Q?f-
[@ It
PZdg
y:v
M0u/
RuntimeTypeHandle
MV=
.x^c
e ` (
GA'W
VVKb
Console
_o!`
ytqC<
hD>Q
n#(1
CQmf
Pi)
?OW*
)v;@
h|!zk)a
Idg=]7u
u42j
&kwg
9{:5
N6lp
{ eS
W5}0->k
8} D
<>5e
L')CYt
16rl
}Vc
SwIk,kR
Me0*
>"\"(
iJy,A
|`!pC
~k-C
Vc}n
pz%d
BF? `
t6JZ$;3
1}b
j<&]
u]x#
Nf2
IEb-
on<0
c1thJG
1OK\
c5PdL]
Q:-.
&H|rf]
yF%:[
TC;a
O(s
P6:tm
!Iy^
VP=u
IHDR
?#{T3
P0I
Mn\qM
DT6$
LP j&
#Al..
h Ry-}
lr .W
leh
uMRBw
&*8v
9bXv
+L;]@3
":C&
%:\D
D.R2
UI<to/
%HUY
&*8d
6E@.
% ,
7an[
%] :}
]`!3
"5]T
]il7MM
wG.PA)Zi
Ew-Ls
qc*j
pHYs
<'gJ
+rl&(
5~26
M,K'G
L'F"
v[u;j
}h\0
EventArgs
9 lYfmW"
8BV F
8ec T
ksf+f
Q80.K^
oS|#
#2v{ %
/pC$4
t<jRKZiXA)Q
NB@5u
bKiU
LabelEditEventArgs
)c TQW
-YaoA{`8q
{G[*
[_kQ
tf@B?
r e?K1
q]pl
@U65
ynOk
PzVm
{69fP
d sI
rt]k
m v7
{MS"8
bS0Y!+
u3 46
2g6r;f]
:N,9X
Dnx
Qy'Z
]_+S84
Agh
"Jr%
X"~@
/5&+
X"~B
~n`X
)wZr
$=;/"Y
{{%~
5X4C)
mAGMo`
j@C!
|zn2/
f""cB
x5\ V
IFmESiN
y$Pxk%
>R+*
^*6g"
$.8%
MethodBase
#Strings
Z`So
KwnHC
-i?C&
YEb9
N`V{+f
S( Z
System.Collections
N (
p8*Y
%u8I
dy\,z
Qqnce
e+6k9
'2&
V[c
/ hR
V[}_
Qa3p
i }
wX 1la~1
1$^6
&45p
iZ;N
d-N`
t]gl
mvHp
t||W
?{+'i
twww3
r Vn~t 6e4
@L+e
V]=-o
Z`yp
`2'z
q@1/TD
eT(L
65q8=
r- )S
Hj(G$
MpUYi
2`f'lY
lO5uG
+fRk
N@S?v
w7C;{
(u:N
Kv]I
Xm!O
*HPv
"${
u758?
*:]A>V
QDLK<
lX'{.
m1lE
8CIp
|(?h
\)G:
],*Gk
vNP
+0 ^
]PU0
(M`^%
K[*p
|Y8ba
Bzb<
get_EntryPoint
g}JO
ValueType
XH4-W
9%yr;
EEgS=r
6g!8
(5U`$ m
yf:=2
YM@9
}w}$W1{
BKKEy
fbNo
_DD6A
!O%m\8
* 7m
F)!T
^r 6
VMIe
;b0x
'B W
&K@)
v0T_
5W-ftk
&[LP
{pL[
*Q[2
esyxF
||w~
a9n]
Z=u?
]3K}a
IDAThC
$'/Q
kGxyQ
[d;+
M8Zcc
,CUA
{|!K
t`QOm
pS/zT
6eYkb
ds".
Y(E
#p=
5E*9
|Ms]~?s
YPOWa
Ik2D7
>pkN
Mt+$
zB K"'
+@ E
35 85
F;F
2`DLxe
6Ct?n
Nu87F<e
+_@:
37f>__
{P !
d9 p
+TGU&_
b<L[Kc
0&^7
OverIndex
a\O
ch+/(v
j*+u
TabControl
o4<w6[
Qymc
=YV)
/e6.
oS93
h +&cg$F
=-spf
,UDg
cg9-0
B^ G
A0L
^-R,
u,W`
ggGZ
^X"HQ
634C
zN
fbR6
i|Cq
VVYmw9\Whc
7M!k
umA[
'V-2
;|*}
=Q"_YO
Zafd
iV:f
-^q2\8
^ur^
M"}8k2\
QWX$
_<ah
;&Fj
1KK1
maZS
ZVES
7*N`/
TWd
uWjg
Xbg
7)Po
f']x2@5'
Hi!(
|W0p
|!W+e.
2B \
DckW
Qr5bD
set_BackColor
|wq(
WmG|
m8Rin
N87c-
G[vX(
CEon
`ba<
bHr46
JH}T
]6J 5$
) #hU
O}e?W
yX_.r
Og)4
=6Q7
]%>%
byvM;
xd-A
?sn=
h"-QHx*{
U|m`(9
2y .]Y
-?mn
Vd=X
V, R
nPej
wq6p
CsWD
`7dK
FruV
ufc
#]dq
ii;Q
[|){
1;{=/
[! d
e p
+9Y[!
\BJc
'9Nw~
tb*e~
wOPa
S_(8v+R
_d5V
;5%s
1 Zr
CsW#
ok:Q
: dV
)'k+
=1n&
^ UXJN
@.reloc
8g^63\Qv
HV u
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
s zW4
yKC?X
*de%
9#m9
t2#D
"'aF
OS#Xyc
Gqx7
(X&r
N=`B
RuntimeCompatibilityAttribute
m5(P
item
0r-$
0{j h
U9eT
'E #
j#Vp
P`!3=
e_cd
'nksR3
u\FR
Y)zR+
7% '
zoTs
height
-S*E
ewh`
_8N"
^IYxfJ
miFj
k3t49
%Fw7
_-'p/
zC7&j
zYB?
n8 )
UQm7euK
<h'<fO
>FYP
^@?C
ho |
lnB[
get_RightToLeft
L>`T
wr 5
j)a\K
%0k#
po>`\
a Vz
! ~&@
7J,A
e ~p
B ^SAq!_
o^\Y
#\mn_
q^q(
Ht(/
(sJu
Y 9Xt(,
*BrcZ/n
!D F
.<nW
-iM)
iu`
"TsP
.V)N
*,i'
wFa8L^|
rKV);
8[|
=7B$
GNa-6
D.4t
}RSx
&[ X
'{1"
"%d[
oV[mR
|\.K
*[ U
+o".
63TG
f1 Z
*,
Yt/+
|)}Iuy
1Gv
W5v f
8$|\
H H{
&F0d
`I +M
Mj{A
6BFp)
? .V
in_#V
(=RT>)N
#0 A
6L#dw
I^`x
GuidAttribute
<$_}
^T)F=
Q~R;IP
nC_r
LHD?
UaRf
=;(E[
d$op
S/Zb{
#179
2tj55
Z6,
YfB;\
]3Z`
nh3<
E3jJ}
/\_
V- B
V?{,
Q$^[
Q/%:
Ncu*t
a: :)R
JiNQ
Contains
Ta3p
,#CU d
O@v
}iEB
q 4
S`j
WFtR
[N
)5,3
z 5]#
S)UL
:nG{
}TR"T`3v
%cq,R5
u*%D
{IDAThC
G4E{~Y
_}fQq]
NnCw?
k_ =
TabSizeMode
IP|sv;"
:Rv
/;b;
[+zX
)NPk
kM5s
ControlEventArgs
IDeviceContext
Rz Mv
@VQY;a
ouX#
zieK9
l!(s
c8Lw
Bux*
KGdV
ZAD-
Ln9b
Q[s
`"B$
B*;`
hL\^
*VF1
d ?.
kB @y>
BbY.I
2g9?cF
'Ok*
Fs{GK
I[+s'q
j,I\
0*mk
>S~*V|
%"G
r-/b
H ]@
z 8&
|r3K
bX~f
XPM6
;C3[
Fo-{
S5[J
]!Pf
mscoree.dll
f D?
~_PA
]* '
k@x7k
2apF
.l"Pms(e|
sRb
]A Q<
]( 4<
XpZ'Q
UWC=
FhMg
* N'{to
5 }RS
/n1-g
2tn;
6aN!
2vp%
TA3\
!YOc
*|@yS_
X?v`
#*\?[
,.uz
0n6@
h~YD
iD(sdM
mK"p
<+:Y0
-Z}q`
;Czj
8R)<
Zk=B
u{|E
wbv^
3-J Mu
q_
qc00
7y$k
RM4rr
X N6
+jo 7j
b5k>Y
SNn`
0j!)O
pd"y
17#e11Q
'erfo
r` ^
Gu#o
^<A,U
9AH
;7#3rgZY2"
wC&,
s:&f:w
mJ-B
J`~l
w-pa
S8o<KJ
9^
KM^+
Zjb6nDb
a ;U(
!%l/
;XBG
{=6R/&
WeM)
`4S-Qr
Jz:j
yPvDvd
Yjt/
.uU
7<4I
rI{B
O}=Hby
AA116D4CEEC324F997842E90883AC815F1858929
xhfC
bM74
=My6
Fk:y
VznB
?Ugc
! @lz
/}hP
O7grIq
xS r
Ct3
}2#D
S( <
e(:O
#)`1;Y
-:zOR0
MfTH
1M$t
QW{J
s$P!
+ FqGK;
m/6m
-]o2
$2
d -:
%83]*
'{UV
%!XO
{?dN
98-<T[
XCvTT
)5@gj
{h1O
2}j#
0*7(
ST r
PtLbW
vH73
"'`@
+Lz
V8D
Io(k
[cAFy
b$yY
]f r<
$Bj<f)
s44'
?'e>
L_*h
3-X >
( jp
1leo<V
u'K)
x)Ne
AUz+
E1{zf
N5>$
A*\F
HB>Y
_+i4
*U[9C
r:,_b>"
a@Pz
]c 4<
Fg ^
yIN[_}
su]T
}+(-
ItemWidth
Dn:Uf
TP:_
t*A1v
&%*7N
8QD, [
8n1au
_L'D
'<zM
;7v>
\&vH
GBlR
hu7>
qR +j
I$Am?
yb#A$~]
#2Y)
}nc
us4Xj
iUh6
;"\0
0A*,
g 5
Sj_
'yB7
S-CFTl
&i]v
MN8X{X
~r]J
;};
x h-g
0n$ E^
<PrivateImplementationDetails>
AmK`
AG:u
| fD
0A1X
KrD3
0kd,
XKh @
D8 :
B.~L~
>x6 b}
he2Zy
}RkJ?$
@wD5a
&XmZ
E^/y
XXqm
l,Fsp
d>4np
V8`_
TRu
?&C?
4E0t
O|PU
s|7:*
39D$
b,Lm
9ztm
fQ*}A
\M]x
/.K;
X%[CPx
%+ `ua^
=R/8
XR]R
l+g}
Enumerable
wSI$
W<=ZD
,f; ,
0zD'
E-<or;
aaxv
v{k\
wXx{
y/ E
j5=67
{X[1
=&\p
$_ Yqk
VHNn
/AICw,
,01 a
9 <T
xY
L PZp
g85S
k+v9W8
_: Z
"8 ED
#qQ4
TB 4
D Cf
dH-fFK0
:.H0
-*VZ
RwK
4$fF
<'2W
h!Z59`w
hLAg
PjT<
'V{E
-Rb
`SB/
W?Cp#Z`
~<;#q
7o3
I/8wY
pqn\
?&q8
cN;.
:@~3
lDV&0B
[ Y2
If{dt[T
Y 8B
LAN?Q%
zu$Q
QMe+)
s%K)
{CWk
**C7
Zd7q
qzrp
*F@
o;*4#
6S&x
HXjWZ
.4*D|
>Q)Z
width
G6;]{A
Z6a=
"E\)
,%;b
Nc{T
6l5#
:aw8
*O7~Y
JSg2
a <o
t 3L3
NKLV
Data
jE_s
-HK+
,_8?
x> 9DO
8o
Cb!"
:N;p!
get_FullName
FrhW
;p?I>
sNeQzp
(grF
-bTzt
Mo!Z
< k }
4a)/g=
IEnumerable`1
XN*}2a3
ZCY(
-jT*
MintSeparator
a}p Hg)
(ze7
}3cR
-=d0Q
CA/D
*"tkD
:3/M
J}<
2UA9
dygj
NBN3
/gB"
,F+m
5. S"D!Z
.ctor
[kTR
D "R
n4'%
^E/F
JJ`k
g8~2
0syK
t s>5e
NsoF
get_Message
{F|J
,IDAThC
+Swu"6m
2[Dd
`Y]YEQ+
3\pu
JaV
:Y +
j4R!8v
b3I^ec
), 2
< }
)p Tn
( x]
,5%{
LHB44
xz#d
M|<"
'h p
Invoke
RBMF
($v
%~koa&
9(A~[
q?M2
U~\0*ZuJ.U%
\)E
SetBoundsCore
cT?ZI9
QDe"
X<I
]"[q
#_@}
1s y
@yMH
):UBI|
dn3Z
0&~3r
3-)P
,t/}
dN3>
Q/wk
-@"h
4R ;dr4
Xtg3eZ
DEuC
LHC46
Y0BR
Pt4N|Py
'fcr
(Kx(
GetTypeFromHandle
Eh94
XY`h
Nb!fBEn
W20t
]> e=
qlzjb
get_ShowKeyboardCues
O +$
j5'N
9$E]
;+hU
b}mSYd
&1LZ
N|A XR
T\Kb
jq32
q9 o2
kOk:
"& 1J
w?kZ
PRTA
D?>E
t#HwH
gyWN6
-H@pcc
<c>
Array
DAsC
= < < < < < < < < < < < < < < <
get_Location
d|[=`E
AhI^
-0 *p
.d/N
K5lUWg
hs!~(
%OEDH
D >,f%J
lsof9l7$9!
T" &F7
q!fD
AT@X
F^?n,
[$:<
NzP<
M>f:
3ph0q
k~32
,pub<=
{@NL
Jn_
1%_R
Pdkc
x *v
*Pt[
w m}
)u-d
):G$
;f\mZ
so :
Hn**
;#\J
A-M#
\xg{8i
Q)F y
eWue
K3:$FKIw
Byte
0vn,
gPq~
E$L
3k^W
]s+T
{GPZ
kt%c
j2R-
#F,k
i'5j
Jx'5
CfaM
6e3'
:>/MZV+
]Uri e9b
bbyf9
|:23,
)y~
FB}+{
Go{x
3FI$
xM ($%
7 kb
Qm9M
6LLw
@(g;
6d"7
3md
!e^F
[ww B
1z,=
/~cb
W( ,
Q0)J
M\_7
jiv*S)
, i\
7^/)/
d]XQ
I,t.l
UV 7M
| r~D
jLOrN}
S"Tq
08g&
D 1g
CiDj*
+ w )
7C ~
/M:+
ad0r
lH2E
TextRenderer
<0PQ
N<R\
K: y
@s I9Ls
d%X)5
5r3J
"@hY
u}o
n W6
;,^F
w^B2^
)=XF
\O%F
a<2$S#
)^IVI
(.Hx
ZKce
F|pM
`H"b
0OdF
[$sj
2C.Wzh
I||-
}?j|
)j R
i FHu(I
fwnV
4IlN
;q/}
:K`S
b-x9
g;h5
1">7
ja3r
twwwKJ
1d )
Fin2d7h
)o-s
_StN>
n3Y*
E <]
(yB
A"_8.
5U9e
%8cd
;t[S[
MF*fQ`
@"E8
Im-?'
!-TZ
[!$W+
1x'k
>G6'
+eVz
f}nn
a*.`:
a2At
set_Font
"'g@
rQRvF
c\U=
~t3kK
`!buz
F;,0
9O _g
\V,O
G3po
,9m2
H 4i Z
1SK_
`nuf
)[^y
g^ 19
*_pF
-R-y
3|m{N6R
27d:
e3,(
~\Fby
0->&s
0CdY
9Xd&
82zi 7~
]1-4
ZU5y*
tww7
09C~
i\'|H
go?c
SD(oK
8. U
\]q`
17<*
D]V
LC3a=
graphics
LvzP:
-zY t
=Mg8
g t
+5 i
O^v%
I1FIuv
1\BFJ
8O H9
]$~E
<lQzl
hu+v3
`1S^}
S@%m
zP>*Ta:
h?iw
A:$%
WJp$
Ruaq
twww
1La"
!6$i?W
y<&x
)O{IkM
#.= q&
4 -5j
kaq~S
p`1x
s2%%
Invalidate
B!0Ye
b'[k#>\
L<\RH&
,tL
Mrxy
}?aH
;qv
Y9J*m
5Z=zp4
yYU=
PH2
K@PScC
%ch3
j>cra
-"2
B%.j
eb$q
!($a
AMe+)
Size
D4<~&
1\aPX
e<E"h{q
G%0g
urh
o|1g
e%vz
82IV
K;&4
0l&E
|aqMm|
1 3u
CJ*]I
[~l?
6.(>
;6(g
/eD^U
g.E.
aEDCtjF1
nl99
)8R
w2Oq]
$-)w
0S#[
ERe0
c3z|
*2i
G9`Y
6U3n
\=
:+Q/
a7pXi
RO87
K H;
'#dF
45,f
!{z`
'i2z
RV3
7-5;
S"EA
!-VJ
KDdS
SZg_'
oiV=tT
]q,^
X
$mj}
v40Y
d)]v
add_AssemblyResolve
h>->
cC k
;jd
U&rb
[cEr
;Q!W
c@="oC
6s~Y
|j3+
Ac 9;
k()e
O;k)j
Ts:bl
e^E-W
{ZDk
B/UU9
jX I
/1F }
q?t=$~
cz '
An>R
w6T)
\:w[4=
}n=
p.t|
>9U?
MethodInfo
z-o
'aj4
Fe!ZHk
v-C$
2px$
qs5iq(
yivn
!j'K
.vC~
(W[8
yXhh
JW\?:
/{}[
hoxw
EZtgR
4!oK
+w[ [
L]wZ
b5k%+
|b\R
H-|L'
QcTf
i%e6
]vv J#
sJ(e
&hg!
485g,.Vp
VX8:
*So&
*h/i
5TC -g
IO9.
.h>`Hp
ceXW
@+-*
]%W h
s.2m
ke'H
oH:u
s]l<!
AssemblyDescriptionAttribute
,XO\2g
l/baF
8J
h$|>J-S
)HvHWFg
LzBr
V0}z,S
4MMu
Ff*ffc
!-Sb
+1AZg
Component
60U!
UC^vI{
n"3h
""D
/8F l
rSEI
y8IA
"'/V
X !
X .
d Qc4P
X (
#WD[
5 Ri
kMtKWz=
GyZ0X
`}[F
`wxo*
M~-Z
$^J}
YI O
c)rKC&9
E]_N
7+-{
;Qh E
,kM?Q
,5$Y
U'FBX_
V.Y)
/D<
t"Pffp
1}Kz
U1Z+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
_,*>
;"0p
mmo1
-ozS{
H/R)
I&zX
zEb'
S{+&@
W n78
=(D
WS k
4$k.(67
k(p1
specified
+c)0
:X(@
p ; <4O /
=8L{
uOGaI`(GZ
r6W?
&s@,
@c30w@
t8w">
!)rc
f4>X
SEoAP
}2!D
T~]}
QC6*
zck
S_7
C\M~
c3Du
z k@P<
HW"@E
e6YA
P^)!
~fmq
<dwf
lR<p9
f/'-
9HGt
v[G=
@H}+
d#:a
Ck'
[2M/
q}VysR
;vIz
='z40
,i[
u\ij
p?C2\hj
AssemblyProductAttribute
aZznV
I``o_
z-SR
Assembly
m#p6y
:PHI
ay46
@\*l
w},7
-3lt
1/DD
Lk(
^7i iS
z tsx
vHB2'/?
Qd7>
@}Pn
CabjG
Cdp="
$? b
}%cH
o \m
=`Z,
?]fS
]. U9
}sG
Z(,~R
nXr(
~9X)
,[&5
iH%p
S B^(
g}`G
B@|K
r@R2
e5#K{
r>`
V%MzU
{3rV
yz?
{BEH
OPX3eH
Y 8.
ERnA
?C$}Q<
C2;Z^h
Eb a
ZoEx
3Q1#
Q,d:k
Y 8$
v3 p
E|g^
|~V9G
xFfc
|e+(
l0_K
O o:
^C[|F
g<5&
t#GA
Sa}3 6?
S;s5
%2P>
-:]
matemdeea.Initializare
o )
~6pzx
^&=_<
K5&Xq
^+m
}LMI
bnU_
dRh@;b
System.Windows.Forms
c0+SY
3%Ua
S LK[
%9R
!~3e
NaqIa
d{'r
SL6m
y7S<
M!:)
_KC0
h")&
<Module>
k1 MU
7r)_
3foS
Type
MUu H
/OW+tT
\x[e
9@nzZ8(
get_TextBounds
4z\)
khp
Y 8T
0{A4
Color
Y 8H
$Ab_
2RevW
Y 8M
9U;?
3g .
pPk~
_QYHR
CE# /
pmQ
xK,w/
Y Ce
gvY0
Lv|B
gX\ W
I{H6
ha))
Y:_l
/V2
+0 E
tq?}
.lJl
"dFP
zF1
\uH>L<\
\L&s7
>TOS
}~Wy
{&{^ i
34
Exception
System.Collections.Generic
Ch;d"+
g[iL
NHB46
{- ;o`
Vc!3
R+e980
D mR
=.!.|
MzU
V:_*G
Vyt:
v2.0.50727
dOR#@
V'#5
|@ND
zZ5YB
qHAZ
+ n#
IConvertible
7~Ht
z3'h
"i)v
yt~B;
O|1B
B]0b
5=l}k
\-1mV2
%i.14
b02(U
ZI(#
C%x!
Hgl==
@7,
( !k
;];%g
N;Lb!
z;~_
b73
>}TX
NY^1
#' @
11iRj}~
~K q
*Hw
}B47
Dgm)6
+ <|q
gAMA
/s;0
Qmx',s
a@&6
IRRCq
J n+iX
P+R3
.*q"
-N>j
0EK
Rj<z9>
iiGtq
?iFc
6sH>
Ee_k
{9 !
o 1_I
kX7]
!#@"d1=wf
K F
~:Ul
* )
?4)
Z.E0
~r9:
$)
*B5g
]pOg}
O+`w
0IiE
=^aV
:U.3
VUaC
2NZ^
`k`X
`n|IK
mY'C
mscorlib
imm{
Q`}ZKh
/c;a
Ls z*^
2q%M
SS,
G%"4_
y\}1
=_iI
|TZ5U
V/ `
_6[6^67
}!+KP
ONpn
vtJT
8 "
w8Fy
[G2
,8PM
)7z\#E
<!bB
A2u={
MjYwxMc$
(h!
JgSs6v#n
bC^]
,@7:
q|K
64F2
(nw*a"
`Z `
W~2`
s {{
#?G.
JSRg
A*q1
(ex87
eBzsb<
= _f>&
CTCK
ndIX@
5J">
w=QqfX
#'gA
aRB*Z5.
nv,0
8B#Ib
G or
"q1 R
Wkhw Q/
+ a
lu2n
R A*$6
2]reZQ
KNq]3
#6Y2q
gs\a
.%SN
get_Width
P.`Yr
I 5X
W~F)u
ow3p
-j y
0vaY 2Z
zzK:
/3Z3kRw
ybAh1%GAA[
OHEd
sI~k
h@ M
<9]* 5u
[<8[
System.Reflection
0HI!
4ZF8.
r4Tz
get_Count
ZHZ6
8 @)
>Qb]
m'g`
~R_{[
Cy#:z
%HP4o#z
Y\/>r
4`U~
uo&\
O`*t
"zUy
ns'_
kFH'H^
+o$_AW9
~@C>K%
2Srw
6dOV
ju F
Bn=*
boi5%
|W8GR
eF\ym
=^Dt
6Puy.irG
dM0r
4%+tB
:3Ek
ehK
3y+LW
x[3qT{
n;%&p
`'gJ
CJ>%x
Y'G~5,
| f!
FRjd
$L[P
pQM~
%\ae
[j lQh
[US?
,EV@
6foE
Qn6
US D
_dpx
System.Runtime.CompilerServices
6F VS
ag#9
0'q'
T@C+vV$[23
}L<
GxpX
]Y5f
q\}^
Append
[ 8U
+L.AMBob
?PBJ
|~Q9;
Object
G)|Is
RZ&d
C6K!
I9b$
|RhA
@Lhl
N{G1L
`[ Vp
;Zg1
+I<gw
&T
^/lJ
E`Fi
FY 8a
o}D(
u^Y Id8x
( L%$
U"?c
kIxi~
Fz^^
SJI,
"'a2
OhyG
SX;$
&+]l
]& 3<
<d}jN
Vv^0
S0j3t'
D3\
z0{>c
h[c
X5J@
2QDAg
68lW
T-8S
PX.1
Rz5O
.?U 4
!9]G
3^~z
,cty
51\y
lvA
: .\ 91
#rb z
"Ee31Q
(sU*b
Y3S=C@y
GGiQ
(^CQO
q: 835 5
Ouw
qy P
1Af%
4TW8
b6Bk
;.0;
YZk6$)
A|
D)Nrm
#2Zy
rEu}
EvU 9
.`D
EEx
M..y
T# XU!U5
s,dF &
,8}z
BsvX
h/+v
2%eW
zg8P
6uQ FA
RY`P
b={N
"'e@
&D-n
W>shv
;:|)
k!e!
%J7 Y
Nh c
!w}F
c{j`Z
1}U]
(_(vc
H{5,c
PaU
g<:*
-kU8
rlEa=
BtVV
|Z Cg=
Y$lr
-3[F
o#2xp
8{2AW#59
.\cx
A{c$
07-@
j!eO
g/V#
tsa%
q kuJ
[Y]JXd
2/&
: Gx
#aw)n
r=H2
H^;@}
:G-7
vm3m
"/'qNTv
k/~X<
gHzT
< 6 S
LV$+
; TW
zR'b
{_h^
`l"k
ZJ .
sr <
*FSAw
Vwz}m$n
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
65<(
3-d;4
F(8v
\c[ns
p9}Z
bZpvD1
bJY^
UnLpr
c.+F
jCN|
UA1p
[\>*
jU5H!
>3+)
=}C
qi4TW
Sc^Q
LayoutSettings
r,)N
^30J%
0suZJ
6aQp
"[6<ED
0j>X
!This program cannot be run in DOS mode. $
",CA
y 1b!
U A*(
.Xmc{D>
jO[-
cY^,C
)zg
44#F
jFqo
vMf r9#
K8r!Bi
Me )
RU =
u:~s@
Fy r|
hH@<
U&#iE-
Zsq]
aXV/G
b-Z;V
f7^$P
$ FgV]:
.l Dz
v VF
T $l
`D83G
vWd8zn|
bN;S
T4qFON
5:
]BO6
a)%H91U,
ADeo
G;f{^
8%U5
3|NN
,{,_f
_^y9
1`Ac
gD4JI
= 0)
)]@g
d|]JT
\Hq\
Ily
l~SM
A\23
o=-.!g
;)4C,a
8:
+%ofd=
l!*J
@]EA"
x?Yd
f^Qt
E@:D
T [i
x6ce
otJ+
8I
<l|v
3 |b!
h!r~
RE+\ee
I%r3W
Cz'[
PLY:
Ax}k
_y{rD
#LI,
E9v$
8X
SioVc
VV"wa
`E-'
rvLf
,p}O
$934d2c9a-010b-4cfe-bbef-8bed04b481d8
XWqk
#][=
zIDAThC
h ^[f
0E0FA1A62DEEBB1E981471F7A1F5C112CB0A9C65
=3=~
qG=PD
6Mr:'oIz
!-RbO*YA
4qF{
'XoB
WyG+ct
fyOO
{sa2
V-f0XQ_
Q$Wxy5
=$Vv8
i1>X/
mysP
Fj0\
/_1C
eEVddU
PNw6
#3O3L
\G]0
BSJB
M1T\
D}blc
[R1Wf
L uM
*<qA
JE+]~U
h T
jn'h
e@"D6
,R63
Irs0
Dioi
<0D< [
&Be~W
LVSd6Q
[ E~w
:J_0
~h0 8[
Rt3yN
hf\l
:#T'D
S|"~
X($W
?gHW
\) 2
a4-_
!~of*
og1/
Ra{9
b u9}E
Q#hF
,8?Z8
EMRu
u~vF#
Re+#
4${n
s1m/
0l-TM
Ug%E
HBCQ.[
'$~:
JjZ
W I9
>9$ `
xCv
EQ+5
N+-u
m+{]
B#CQ
bTH4
WlT 7D:}o
4!O(.a
gcMm
S Fd
8^`s
g/z Si@
k1D
&s.^
bg Z
L/3J
6=llA
Mq}og
;XQ{w
- Xh
ResolveEventArgs
^yda
(U E
*a-\7
[HC4>
$m'/
&uO]t
=c[V
m|gQ
#/:p
/$~
gVc'
"~F>
5XB4/ #
D7z7
N6#u
RPyK
5. U
E ]0
I[`y
NB>H
g}#Yb
AssemblyFileVersionAttribute
EsQFZ
jq+<
=:v{
R+rZ2
D?h>
u .k
3BrF
dLS3
R%9[d
D`'g^
,I9m
z<,<
7^/)
s "eg(
InvalidOperationException
?~;,P
76fS
P{e6
%r{c2
ivtK
)?cN
G.:
q3s'
S&8lG
I4kG
RI^`
vn|
_Pi#
k)U{
DtH{Eyk':
}xKe
[+wTY
01Ki
I[nV
P[+`
EditorBrowsableState
*%ltv
W^79z
+$J2
p&13+;
ZmJ5]>
lu1G
*$nB
I gH
X^E}
jI5ZIN
zH [
|.K;v
bkGL
A S)MjR
WX_(
r1O\
o7JA
dW%@
jM0%
i$C
2dHz
ACT(
gde
fHm7:S
hp}m3
KcwS
K9rk};
D4tU
System.Linq
=J{-
"L2:
uUYA
7K4/
v:JP
O%6[u
K ]C
fCwh_
$Yl
/?{Z
^L" WAO
X^vB
BB\g6
) VH=
eUZ1|3q
_uM
~M94
cgdK
uZOc
:5@%o
?,T6
=;)
6JZ
iv)s
matemdeea
GetTabRect
%Qtj6
KeEj
ButtonBase
s Y
IKw3
?3UB
.vv?
4!TH
yGrn_
Z]C#W
$EzF
O<QK
G9]
B4F0
TJ?_
0 m#;%
@qvd
C8<Y
tVc &
/@Fl}
3 oUcq
[AW,
[$pW
S&u;i
3 ;b
KF?;
-,|G
! 0=Yl
q 1.
6}QF
!ht\
)I ;
JOu}
w_.)
[E-wUgm
X>8%
xihui
Kv)m
|nwv`
S 6P&q
48%j
W!E*
>ybr
59ERAR
T0-X
hH1zt
>G,5=J
`<#sz
Ge3j25
7N>^h
k+z
Y b&
ZTgv
|[0p
D'- d
=7O$
'h|p
Ss*J
|jd A
=kX8
shF"
9!FR
'8#W
Xc@'
-RarwI
PG~rH
A_Tc
UP(WD
U"]h
jq<p
!Rtq(
Kvx'o`m
U=7H'
WSVpV
TabPageCollection
3qEH
cw6"z
u|js
Gnll
'csH
Ey/g
/9W
]v!8756
2cz[^
DmJ7
]H[a
NY5
<c}Vi
pGjY
EBYox$E
lUc+ @~
$wzQ
CqaQ
<\Ax
}2%dC
+4 E
'<~x
K*.^
8>f4
&J?\
B2j3(
xA M
h"Hv
-T \wS
w f;}
tk+
jl5k
UIc!
s}m|
LHB4(
HsxX
],!/
!:.@
g2MNfw
B(k%\
at}|ju
vIDAThC
3@d(h
% EC
F?m@
7%s&
)E[#
Z`Ud
E 'D
j`n'
uh+#\
>H,4W
;{/_
SIR
o/Dn
*+2m
5{iDk
!vM>,
7E m
P/n^D
mC3/
!V*No
46*`
<NWV
fAuqs ^
4L##
e q
ed8rC_
S sv
su~
qg\vO
)3 _k
x$qQ
ID D
28Cx
:]];
%- M
lK/
a3*8
{_1|d<
#IrF
}`F%
d%*~!B
t6a
h 3
p`HtK
0V9>
IEND
jc/@CJ
8S!
s<-C
Nk5H
c\ X^
l1;,
U'B;o
S] >
Y .
n4)w
a|K8\
<zYB
$nCF
OIsO
r)%Bc
+1b*;U
KA*N
7?F
1'X,
@2#Q5
u^_
_$f}
8U
DnZP
pG&-
RlK)
@pmW
AqI?
+]La
Gf)Gg
C 3p
Xy!a OV
jJTm
^xq3
Eskj
TsW?F#JG
^tg}rIZ,
*e/X7
}A7B
>&}D
1o6w
9e>F
qhLf
cbbN
N;t rL8
K8zj4d*
w] e
,64k
\gq6
Oa1l
4{T&U
/]S`
""BTq
XGGJu
MHi 6
/Zo+
&[72
, X6
n%J
K'vf
7e1x
p-!#{
Rectangle
Is0w
\.Pvsa
Q0 fyV
VNOa
r8E
?@M
$JAo#
VP}N
O'D'
#nB40^
y|hl
:="e
y=V0
8?:'
M7NH
i2PFR
n#!O=
mJIg
Concat
a%Un
@fe3g
QK~+k;m
_.![ual
,Cf }
StringBuilder
raYKs
nnF6
8D2+
Q0 .D)x
US"b
!FZ%,
' Sc
[&4*t#
h~X&A
4SIr
cxK#Z8@
|M?&
G!Jmx\Q
?ey4
-nUu
xR*l
L"'Vy
0X $
:LLww
W g'
L>@4#gH
AHhs
%<#g
KRtP
F7 $7
)#2:
9<"*K
0%+,
c&;x
.9MO
zg,
T@11
+mh<
`F]R%
ElSb)
BaseRect
*ul#
b077(
Hrp*
61Wv
vw}BTH
@B|m
Zp)5
(9)p
7qLC
Vi>u
?o:*[
w/7R
23O6
#Me!?
(%%G
{-Yu
:SK>A
m[s0
aQ 8{
K,Gn2
}24{t/+
1Dh#
wW1R
-=(c$
L|W>
Ol_a2
nMKw
<B<4
83M=
u|~7<
get_X
NAe/kfu
$6Fuq
[?#K
bddc1b
Z}#cV
v_Ma(V
MbM~
H+ F
:K'DkD
/vpdJz
;Hv|h8
wc^?W
[D4`
K`Hc
63zYD
(=7P/
=st-F
u=X"]3
iC:~
2}co
vBk/"
Qv`,
gIl_
vhUW)
G,|W
u zCC
< S-
Q K1?
+a8Q
Mt)+=\
:pT1
iyG!
u 's4
!s8j3N
5ZwF
Y""$
Me*
o/=;
>9'o)f;
KiTP
R%`=
3 B,
|Wla9
L26J
SW ~
]vq>'
,2I~
2S~k
U2vp$|
~ LI\G
>XI[R
OKZ
WgX{
q,b@V
#Xk_e
}B#8
N/nn
3`wH[
TBWT
1(ag
Ns&M
%[j)
C_|#/:
F@Cm I
JP4J
GW ejRI
PYn-
>l'2
f9tg
wfCG
9{7 :
.3F`
0,BKmYp
?'7'?'u*c
$Go$
`(4@N
Ny~}
=P?&p
c\LO
p\z
\5>
d(|Qp
/0F }
lXAB
R,vsV?
3.:3
lY+p
;2V},Vq
C`tK3
t45Yy
Fin^
=D8
1R4h
Yeg1m
@x7U
i ?-<
WAV$5
7Ks"
0oo
Vgd4
P+Ej
jD/d
CreateInstanceAndUnwrap
c1 P%
r,y]T
}yz;
E=/ER
t5r,E
u C|-7
xoWa
We=7
C1204g
G6-n
N\`Pc4
MeasureText
UDC8
%, #
YXR,lo
+n,pn
Y.?}
|>u8
UWp-
)2!)fm
Y7'$
m+L)
t":2
#QmfF
wlE
iu^"
Font
:eXR
/A4PI3
W /l]
rKD=
{;]
s*^+|
T? ;
1ST>F
oqJ8
CK?mP
N% 9
\44,;.
",Vb<
sVf.
,BYKv
$4q'
cPD4x8<
3ntc
cXBa
/_` }
E<*Y
ZHu,
9:xJ
Ee+v6
'zYB
yQRBC
hH%>
e|"Xy
~w;8
ICollection
_CorExeMain
-Ef
sz?(
r%uo
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
f=pZ
H`Mbjg
->@?
=wqb$ &wy
get_ClientRectangle
\w_d
?xIu
yWL3P
Q}2J
G.zX
A&L$j
D]qx6
_@3I
iMsx
i*fk
l=G<[cx
?<-\
3r$%
Hy^g7D
InitializeArray
_'pCzt=
B4.
&|P7
Ed7x
3t'"c
xtq{
`+63 sjCN
#$G
fGv+2&
>Me+)
-L?b
WuYu
C7(4:pl
#H!.
T v-5
9 |1
7j%,
18cS
KO|T
+&v>
-{hf
\1kYl-
? =-
get_Text
ToArray
TS`@
{+p;
]gp}T
~h,m_c
}(Sf
`QWd
EW[7
4!jaF.J
EditorBrowsableAttribute
c4|p s
+wiHp
|hnM}
flo=r
KI
47`
h=b2sU
teF@
@/&)9
{) S
ppaY
SwqX>
AIjlt
}a(dE~>
RP Y
<79!
=o+1fe
E6~Q
$GPrX;
rL}o
??%qT(]
r807
yo9)
/`JP
- ]"
N'V>t
Y_x
System.Core
6$Vq
w7tx
_<Z0
#5n
Ua0p
= cS
#{%y
j|=W
^C&X
Pfp-?
xWr
T.oA
owne
NQL|5
^1M.I
zvQ\
".)ECP
Z2y.;
Da8`
abRcNQ
Kx'Ui)
<GIK% +
Load
Tg!v
r)dZ
[ +
b C
r$,{
o#6V
{_!o
1N}Q
'-1B
R3V!
]* 2*
System.Drawing
{b={
rnw>R
e=pa
#$.QUTz
(cuR
d}B40&
9mT@N
Q fr3
&r\!F
M29U
+]PV^r
3&Hf+
l_,
=$`H
OkgR
< 5
XK%"}n
System.ComponentModel
Jk {G
OnMouseLeave
Lhz0g
~vvH
{#?{{
isO
hj' o<
l8b7
|3EmF9
, V++I
{Oya
Zv Z
_UsWX
QO:^
i?A_q|
S[}Kx
tn`wN
1-"J9U
^nKQy
83[5<
N^+)BM
0e+#
DF<_
9zWu {
3tTB
YmM-a4
9.\Reo
j/|
DeFu
<'}K1
| 3
Psy49p
B,QC
:(JG
Qsd
Eo?W
.=6QE g
3!W)
'8|D
AE7Uy
_tLjF'Y1
B3CE
a4o,
^UJ&
+V4=
dXc%"P)
jWSBq
0qKu9
H(OE
ScO"
*4ux]
RuntimeHelpers
jpG1pI
3.I#
|tuZn
t.$
*-{\-
fu f
LR^o~
sdxB
d0 7
)-/R6
& :
:$!
)1OE
!H8@
klJ~
V]?&r
4 ~H
akcL
S8zP
qd{c
+{ N
*@)`/
k52
\tXi
)zN"
{}b:.
(|Bgh
3b^
Yv 9
MM3m
([@p
T' hj
[L;>?
lxp
V9ck
1FyU
&C6o
Z8)|W\
B2{*
(|s$
n,:hK
Gt|Y2c
g&?6
2\^]DDQ
)~W.
Gs0!
6oW#8
F)sj
eDK3
@SaK
kvW~
a'L)
pl',
}8cs
Pw{9l
yR_78Xo
u5x$
_Ld2
P*Lv
ne$YV
yB3~O
OyMa*
B~H4A
3E~F
oS#a&
T '
`[ J
<Go&
Uo^O
}I|T
cd"H
~ T%Q
{tz]
M3>E
#'hN
!sm
r%'
oP&[
`F5\
6,Z6g
Mj(;
cK"XZ
zi"u
8B| ,
Ie0%b
[ 8|
E,]a
D,Mg
*Y>?
4R_'1
;5;5h
3s~[
u95LTfA9
xO!Z
@u|s][
/xqk
ll-]
3_!5
&j^/
Bn=`
PL-
1r:
OFDd
,>80H-
CU{}
`dfwX@1
_Assembly
5d0p
z):n?
$lwX
>>hT
sUO/
w!\
>G>ax71
o)I@
/0F ]
!MCW'
psfEG)z
2Ba@H
^ <^
1pN{
02G,
K!-O
`}AK
3}VMt
:_N\
AssemblyConfigurationAttribute
'-{L
d8gG
}F(f
5_ V
&Af4_^7#
|0Y.J4
[Y4'4
>gQR
'jK\
[Q4}}
c#f0
LknP
lL}T\^
PaintEventArgs
wcJm
et#-R
-& .
lNV->
[C)_
x'kq
{mc
AppDomain
k,)d
5< @
\Dk9
F7>*
1.0.0.0
hY5z%
GA ,C
AO7sA(
& r0
YFPZ
[_KZ
QF0'z
BU17
*'ybQ*
pSgJ
BQ>4|
~" 0
; K3
@)6bA
|? mfQ<.v
3t x
B+n >
;(Gr
gCCWJ
s#(LJ
v/~Y
B> {
oWus1
:Id(aM
|.%
q#Aj
LOa:
z<S,"X
,l9'
*@J0
B6K^M
+pq3
5HTK
0Y!Q
Z Z],
NM~J
]e}TJ
sRGB
{qlN,
OXC"
*s|#6
|;EF
zWq1
\46z
UwpV
+0F ]'
I>//
xEUJ%
gJ,0
}VW(GQ3p
i'!P
[V8ns
^.,T
) {w/7
nH
}MqkEx2
=a\p
i<aPnO
'2[9
348^5
4ml#
1(IC
x6Wy
Wj5r
F?EG
% [R
_w>
Incarcator
TextFormatFlags
NX#;c
pGSYkN"
get_Control
f+`+
k7qt
P 5A*j
%'JC
l#A*
xcQ'
>@iz~
Hg#)
v_Dd
:9Gx
}U5l
w^m/
]I!
Va0p
/:nI}
<.,B
!"=u
q#i~~
S0(X
=fJU
1/K1
#x_L
TnQlB
'4
(C !N
E
}VP
NjkS
*e0p
uWVC
=%rGG
0ddw
G=ff}@
5 Qb
_"Qo.k
[m*?
.Q,8[0:O
ge Mx
WTJ#'S
ijC
)6/t
<%R?
(HwJJ
8 /i
Fuig
vn}{q
fCU&f
75NB
3{%
`
1}2)
bfKkZ
ComVisibleAttribute
"%.
BI'M
>2(,pF
W_;Y
v8U[
%TjZ
J:"?
@BO
"?<5
]+#{O
8r{
9Wa36
=7C$
Cn[a
Z\YW
*xN:! ud
/ R}
o?e8
tE{+&F6L|
e{+)
PWRl:L
N+G;
KT#w
R\"&Tl
]Gro
./a@
@hNQ3
ZOF:
}Y%;
AssemblyCopyrightAttribute
P-mb
:5zG
^s ]20
DU~!
/rb"
1 zn
73Ja
l2wpxBN
wUxC
PSU[3
H{BD
!=TbK [
Iv.{
TLo cQ
rs=t
9r?bM$
Z$:%6
*Nn5
{VwN
h33?
V(NZ
.9O
S7Nx
&InK
t{:<
MS|q
*=Zj
vbE Q
HKww
12QpR|
FzY|
x@jn
==9,
._Qgwl-
mvBJ)L
uxY*>z
get_Graphics
YbA#A
|#](
s*\,
.cctor
set_ItemSize
^i7CL
g)3q%
KezH
isE<
4{"0
p4(=]tn
#Y +
n8k pN
RD4H
QV-lV~
set_X
9HnJ\
&%Q9
d<yzn
8aew
..K;
3)Oep|p
4,p(
\Jwbg
Maw$
943fe06e-8975-9f.Resources.resources
t6Q'
WQLl
hCM>C
|=YX
gG51
b=^s
2R^H
}\ys
$\-S
HFqZpbe
E bl
0G43'0
ld @A'
3ilW
of_)w
2r4H)
<n:*
VA92L
pnUyh
L[+4
OTH^
:}Vi2
_/Zh
~=GiG
7)s
,~rZ
2Gfv^
!tK'I/
a5ZH
;5$y
zgy'
-kOD
!%!-r
qX<X
=faU[]
/j@K
LVC46
x
<b&<
bvxI
@a<N
yG <^nS
o>yg
$D?+
z`Ug
A?hO
h7UL
Gbdf
k[ m
S)O_
YM,X
X6?,
_pr2
oJn_
</@c%@Q
c?D/^
KvRwA
:T[4
G)*/
0$n&l
JZdK
'Uzr
rI <
v=IC
EVRs
:[q1
twwwNLww
sC;wSD
1@f
O,^~c
V xY
VY8t
}Zc!
6bIR
KLbd
xUc~S
RjaJk
ZY0
g)*'
OnControlAdded
#Fm<
zhazu
]"xk
=(x]N
M-?8
84Du
Z33i
!4 '
U8PE?
E+#'>
LrIB
uUy6d
xm'
{N<m
iTm!A
0`2 e
F64+
IE~@
Ff] Du
W"px2
/9"h|c
Z"HV
g'5:
'dnj
<)]i"<<f
"'mM
o`=MQ
x{V J}5
/\Zo
Ql,j
c6rR
}S%~
%itM1
7gdi
ArgumentNullException
+>eA
!K2f=
&G@B'u
87}|
Faw/d
u_h*
7Zl6]
v|B
++ B
-*:=4w
LLJO
P% x
.I2*
5w>Q)Jz$
Wb0
% 4w
uAWG
JHB+:?
Point
,~OO
ho>\
!Y
RU C
Hhs,f
1a:R
N;XF~
i[V~~
nK#c$
&K;
=a"p
7NrqtX
wp7g
/5F(}
4 &M
bQ+
WyZO
^HY5 "
|) RMz
i9g"
D%Yd
:<b:P
yKm)
Y#yP
2+^3
ZrTf
Q4A7
"4N<
|F/7
4Zq.
HE+;DZ`o
pCSm
zWp
|i.u
iN_3@
])bk1
textFormatFlags
CompilationRelaxationsAttribute
!<b#U
d{xQ
&Y;N
#@8
fv~5
~,q5
QBc}
6ty>
vV.9
Gws
]$t,
A- a
qR/
;T %-
j1|C
Copyright
iw"g r
dw.6S
6Y!
2J,
'&AZEP
3D Q z
g/P+
~y51
HERI
M +;
#abn
Mxp:w
5GFz2
EF8!
t5Rh.u
q;J\
7D%
dscI\@
=i=J+
yX l
VMFP
V7e|
h&\/
B (
Wr7IL1
#V;M
XQKJ
set_OverIndex
u \EG
&Vr>
KUD-
ET +
!N@t
Ad8E
zY@ E
[iK}S
c%A@
6"t(
em gf
Y.@_A
i^ ^
]'fO
wFBLi$U
D~Qh
%{eu
"Uhk%
Riw:
FH&=
-lq`W
q,}=q
rN?IW
WriteLine
R_Yh4U
V._
]3$^k
j YKKG<
6!zS
,eYG
e5C>
"srr
5=!.aOh
HS4U(
X!&#
*k9%
&t#M
w@&p
H*dDOp
>F)[
W}+& C
_6So.
EC9g(w{
J iY
SOK%S~
d>QHV
}W*
y2>);S
Y{Pc
]:v?
)e1o
6ev-b
@5Dy
m [<
/KY
$[d-}
?e;.
wwVQ
cx2f
"&Y7
Y2R;
-;D)P
)M
Q-+b
F N
>ZRm5
AssemblyTrademarkAttribute
7WD6
.m4B
O6(Qm
GpL_
tcS!'|
d30
QM4W%aN
Lec)
9@E4n
Nscl
i J}o
5zGn
(73l
.SEW
"[qL
'"*3
<IA8
Z%r$7
t0.Z
bfNO
/hr }
JSK})c
i-Tb
,1QK
=q9D-
A?"/
wHmQ
;A5G
rFAMg
)tu|
/fg_
X I9
* o-,
M/xS
iFqn
~IDAThC
lMoc
DHG47
&:2E
|7y
R#Us=H
v-'8u
K9:N >uV
T FC
u_mhN
~q[#
Tt6
4g,|S
/#=j]FW{
x%h}S^\V0
!_Yn
56g@
ssBa
NM\m
]*\L6
~,9`
= 1!(
3@pb
A=!:
AR?M=
*R*
oU #
+af2
+3}`
?R1u
0)6t
1Z*n
ft0Vy
^<'(-
get_SelectedIndex
u$A!]
V`M7
<a
6oWa
Pi`3
wtTDXn
V};.
sd#|R
xS^u
!pt9U
fm2K
oU F
j2Yv
jZ8v
9H04S 3
_ KB
p>l:
P6]$
r1Kp
0 9S
P}eS
jKMaLO
>UQG
q |.
SuppressIldasmAttribute
(+u;
5i^,
i7 64
!3?R
*+ =
6KLl8
.a %p
#WR=c
&@#<
V<rnY[
qM@sOCW$
TopTabControl
KJ@s
V@b ViP
s?ma
; V
5;,~
SC_S$ \
c6xV
ux-[)
9u^
>#,2
s46!
zALO
qWDqw
#o*U ;
|] @
MY;Wv
vjh@
$hiW8
d- ?
U2#D
o;rv
21z5
bAGw|
)DPFC
D=Lx
AAik
|'0|
f-f}
\ Sz
-iZR
W8= 0?
sUj^
7M '/ts
bv28PbN
cn ~
\mGH lp
8} P
xPOI
lHVk
4C328BECF729897AC2F385EEC7A4AC09D7AF383F
GWZ
7l=b2
nr:/{
U>0]
k53i
vbAD
nlkK
fhp;
\}|*~
ABwg3
}? l=
a|E@
}2)|
b"JPt
jR ;(
|:FQt
:jl+
-^1{
.;L4$4n
sk w
r&(9
}xc8
( ~+
Df4~
7Vb2
2ex
&+PH
I i.
IDisposable
?RIi
cr+Q
1Ac_
KBL
JXn!
@R[yX
Hy (
%`!K
{f`G
x R-
o6wk
/1nK}
ErQD
# RAg
Xx^*]
@G+<"
<CgBv
K$:c
LT[\
!6A o
&Le&
B>un
Th-=Dr
,8y)D
c(skyHi\<I
!F{K
U_pv]/
nSQ-iU}
9DHyv
^1 [
Pybf
6D2,
yy:A&
^xOr
M72
YMjc
<DOW
&k6(I
>PJ[
(nc3
_[DO
UT)
atHwH Jw:
Q++djy
(o?0
[B\e@
qbfS)
l'Y,V
w6;]
>w>\`
Em`w
3ax79
w6 KW
Z.YJ
D0/}
kkH|u
u%%;
>KU.{G
}Tc1
=<vo
tHHw
K$El
p }
vwlo3
*E!WU
fMue
#Blob
E7I\
TextBounds
9dt
+eW~o
Z na
JiyR
kK tF
$p(y%
K"4g
1MFwX^
8\"2
Wg<G
zZIt
W fM><3
_aC o
#4K.C
Y/%Q
f*r*
RP:
"M:-[3
V8`j![W/$
cIdda
&Ei#j
85 +1
P/O*4
RP.IEQ
|o}
RaY4^
CX|O
V,p
:Mcp
'ZC
r;b$Zg
value
)aJDr
q15M
N!e9
L7"a
ud&1JZ+~`i,
2018
p|<=I\
G@\y
ybsmg&%?
*z-\
KmXL
W&HzP
_s,c
fn\t>(
gQ(m
+8~ 9'/
z}EDLHH[
|EhaxgU
-ov$
m)#3
S`5V
s6i=[
Lx6@3T
Xw
RJn
a-#,t
|Ir^
fKL84
GY f
Y] w.
3,r#
M=L$-
%?T h
mDRRl
Y/M
3$|-
bB2(u
Xl~M/7
>u(g
4 'hO
@Cpc
^/X
F'"8
vv(
\V*l
}9 Z0
S@eW
`bpAW
A-aH"
#GUID
$d8
>yHr
/!80
gks|Q
m=b#
U?hy
, iyvp
MR\E
ZA0^W
\0ir8
+*3\
_BuOm
?9y
Hovering
lcoY
~MSr
sE3d
2.K0
?]1N
@0XD
FUj#
ICustomAttributeProvider
!AkD
`Mt-J
8cRq
f22E+]
lO/%
-xSpj
~%
qW-.K1
Kz4s%
nKTt
gzF3
g Dpp
LalU
i0KC
ZBw}z\w-i
L{Fj iI >4
!jx2V
Z#1M
d EMb
XmPeL
4(Kl6
uEIQe
LgDh
S g
<Re\
~ K
bNw;
`co%
0Dqw
o|9n
u0^PyV
4+5x
\:WFn
{]"/
}f#.
F SQD0
Rmxc
/%R`
~9 hB=
8(a
1A+2
TYaL
EY^3
:RTfbE
yo*0
aE/u
Yx}kw
#*9U
A-.'
@Y +
nlw}#
P; K
T7P$
7cM$s;
.4$..f
3va7
. tWS
evr=}
zDoL
Q' g
X6+}
$VM,oU'
^zs}
"K7y
-[p*
CY 8
QL2,
BS @2L
),GQH
l?*+a
']2w3
~+&Zd
S/2#
z84w
f8G,
iQ!1S?$
/KC }
@@4*Y`
9Bu%r
7C?x
w)&_
OOE3
`Q"7
..?(
~rZu4b
"SWz
`Lvz
ob:]
5c",
St5p6
#Ygj
H:B:
4Z@]
,u<9
K@UW
11YZ
v2!D
9~;v
H]%N#
2VhLa
1yYHK
NI^p}:
~Vwa
U_go
e<\~
J2uW
XnNx
_+>RV\Rl
nDT}
S'5
RA|c:
h*{+
\`Q{[$.v;
> "J
:K|v
vZ{x'_R
F ]9\
LHR56
Ou d
[ E|'&
^A_m
TabAlignment
Fb7$
M gt
)~{>2e
lLP
uvvJY
L8?Y
h eb
jLkW
Uc#D
4nn
6 2w
Y([g=
-^0Y
Me+]
zRn;
zBFy
C.)M%
+W8S
>a0]
+Zo
O$~N
Md+)
0*G;
-Zi
C 01=g
} uO
kI\2is
g='u
TbXeCm\
czOh
{Z_"_l
get_Size
7X8z
=;1o
SH]sr{
8RZO
tRvJ
'=v]BH
#? e
g Ls
1.K"
{+^&&
L]:oZ
wf 0
p=A3
o]FZ
V ~?
Rd3
{98 h
label
Rl ,
L?C]
,df$
G*IK
5,umK
I5}V
$t^>
hW`z
dCF^
,I(-3c
o&'v8'
1ICt\W
yY=C<
Gy~+
1uM6
a1d7
oD@R
xva
o]2o
GYk"3L
%5F#]
1_dVU
)1*3
Cg-e
pp[U|
Graphics
$AYD
Yi6$
xK 2
,sx-K
nF7^
+/75
[HRXZ
aBe3
f]Ml
iDct
tD!S
z0Ff
%#AE
$ OK
s. Jb
_KIV
mf*+
Pzq0
\+W 8
[QDx&
_k]y
c {3
tZtu
f-Rh
3lh$
v0e5
3w|/
ef=S*W
*[Xm
RcX|
wc,1
*<3K
obZi-o
,Qtv
LxyxF"
kcwa
6DF71263AFFB3296BA91B14181DAF02693B8F22E
:h_:
Ssf$
Ew$=
/0F }
0Zhk
alw?t
O6uL
L Jt
t4u|E
~|@HW
W.E *E
kSXa6H-
wW =
|IDAThC
O4
{on,
zkl,Ia
1TS`
9W1_
.BJH
z|o4
q~vj
>+.-
{h}$h
^D;'
w2 !
], 5<
#uM
&Xmk
RlVJ
get_TextFormatFlags
TqhO+(
#'g@
Lu2O
t4 Y
t{
^H:r
nehh
Yo&N
F6x!G
M`+
0l8gU
o1R/
System.Drawing.Bitmap
YZSx
{e"p]u
l^Kt
DtV^
Z!V7
A&]rM
' 9D
#fn*
i\$_
"%-%J)`
*t&fEa
:6|3
yz]c
SetStyle
LBjd6
Z$7`
rxLJ
|k#$l
%{; )fe,K
NP)d
vQ)b
,9q!
UAJ]
get_Font
`0t{[
5uAG
|;mlF
t9C@
+ Xx
i'1`
ENZe
QJ0R-
/ V
Ot8Q
x`c~c
^I T
."`:q
K!",
B?&,
K F14
<AAf
/G]D
n 6~
z4]"
0_N5
.~v#
S,Rb
Bc~l
`:1e
bXu ;
>(^b
`m?Wdb9
]^ B<
;IZ4
}exI
v/%32
cJEBk
%7p
Q60U
EI72<
!,z|
zWvb
,=*Q$
B`xI
tW9@
9M @
t UL
|*K
F2s`6
=)Z]k
Tl!#doA
vmqb>
*uP z
9 P`j
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02b_64 Seven02b_64 VirtualBox 2018-02-20 13:01:58 2018-02-20 13:04:48 170

8 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02b_64 Seven02b_64 VirtualBox 2018-02-20 13:01:58 2018-02-20 13:04:48 170

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\refi.exe.config
C:\Users\Seven01\AppData\Local\Temp\refi.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\refi.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\refi.config
C:\Users\Seven01\AppData\Local\Temp\refi.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Windows\Globalization\it-it.nlp
C:\Users\Seven01\AppData\Local\Temp\refi.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources\matemdeea.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources\matemdeea.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2556.27649937
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2556.27649937
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2556.27650000
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2836.27654218
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2836.27654218
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2836.27654218

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\refi.exe.config
C:\Users\Seven01\AppData\Local\Temp\refi.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\refi.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2556.27649937
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2556.27649937
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2556.27650000
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2836.27654218
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2836.27654218
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2836.27654218

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\refi.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\410fe546\7307cd04
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1e5833dd\40ef5613
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|refi.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|refi.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|refi.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1e5833dd\10592a67
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.DeleteFileW
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.SwitchToThread
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
gdiplus.dll.GdipDisposeImage
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe"

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-02-20 13:03:22

Detected family: #Malicious

TheSystem Itself @ 2018-02-20 13:12:02