MalScore
100/100
MalFamily
Malicious

fer.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 18/67 Related 2376
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 606.50 KB (621056 bytes)
Compile time: 2017-05-09 03:13:33
MD5: a682e99a867287caf7b9d53fb2117ebd
SHA1: e3d581d0c9b3759b56890716fbb5e3fc30061ac9
SHA256: e269e3216181ebb6395c40fc6408ba1df0a770477fe64c7e6df5998d49a94d8d
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 BxDRv .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-16 18:38:34
Last submission: 2018-02-16 18:38:34
Filename detected: - fer.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/fer.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-16 17:25:04 [18/67] VirusTotal
PE Sections 4 suspicious
Name VAddress VSize Size MD5 SHA1
BxDRv 0x2000 0xd810 55808 78c41cdff78eb65703f0b47595c9e770 04eab135cad4ae0b72b89ee1b0df5578cdbdb9eb
.text 0x10000 0x55b50 351232 db19e99a43da9621f54f4d6d8a833797 9ccdad4f3258fbd7174498515473989ada26c41d
.rsrc 0x66000 0x33a18 211968 8bc99dddf4f361496685ad76935c3383 1713d4f5f90e9088b64f4e5086a8a49919d088ae
.reloc 0x9a000 0xc 512 c490197c3ee1440aab7efdcbc42eb5ab 976ed05228f89f59fe624d0d5b1e0c5723984cd2
0x9c000 0x10 512 6b3ce05227d2b741db28beef0934ec84 69b4f85f4465ad3a8552c6fad6d77fabbb769830
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x66130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x9947c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x99490 920 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x99828 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 Northeast Utilities System
Assembly Version: 0.0.0.0
InternalName: fer.exe
FileVersion: 14.2.22.1
CompanyName: Northeast Utilities System
Comments: idebuqos
ProductName: LightCycler\xae Master Mixes
ProductVersion: 14.2.22.1
FileDescription: LightCycler\xae Master Mixes
Translation: 0x0000 0x04b0
OriginalFilename: fer.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
mscoree.dll
KERNEL32.dll
IP Found
14.2.22.1
URL(s)
No URL found
Comments
a3651514-1d09-c351
a3651514-1d09-c350
a3651514-1d09-c353
a3651514-1d09-c352
a3651514-1d09-c355
a3651514-1d09-c354
a3651514-1d09-c357
a3651514-1d09-c356
a3651514-1d09-c359
a3651514-1d09-c358
Master Mixes
Translation
LegalCopyright
StringFileInfo
LightCycler
a3651514-1d09-c364
a3651514-1d09-c360
a3651514-1d09-c361
a3651514-1d09-c362
a3651514-1d09-c363
4695fba6-8252-9e
VarFileInfo
%q^
Copyright
InternalName
ProductName
fer.exe
Northeast Utilities System
idebuqos
+*,*/.0.3242526272
a3651514-1d09-c319
a3651514-1d09-c318
a3651514-1d09-c315
a3651514-1d09-c314
a3651514-1d09-c317
a3651514-1d09-c316
a3651514-1d09-c311
a3651514-1d09-c310
a3651514-1d09-c313
a3651514-1d09-c312
VS_VERSION_INFO
a3651514-1d09-c35
a3651514-1d09-c34
a3651514-1d09-c37
a3651514-1d09-c36
a3651514-1d09-c31
a3651514-1d09-c30
a3651514-1d09-c33
a3651514-1d09-c32
a3651514-1d09-c39
a3651514-1d09-c38
Assembly Version
CompanyName
a3651514-1d09-c320
a3651514-1d09-c321
a3651514-1d09-c322
a3651514-1d09-c323
a3651514-1d09-c324
a3651514-1d09-c325
a3651514-1d09-c326
a3651514-1d09-c327
a3651514-1d09-c328
a3651514-1d09-c329
14.2.22.1
a3651514-1d09-c337
a3651514-1d09-c336
a3651514-1d09-c335
a3651514-1d09-c334
a3651514-1d09-c333
a3651514-1d09-c332
a3651514-1d09-c331
a3651514-1d09-c330
a3651514-1d09-c339
a3651514-1d09-c338
FileVersion
000004b0
ProductVersion
FileDescription
0.0.0.0
OriginalFilename
a3651514-1d09-c342
a3651514-1d09-c343
a3651514-1d09-c340
a3651514-1d09-c341
a3651514-1d09-c346
a3651514-1d09-c347
a3651514-1d09-c344
a3651514-1d09-c345
a3651514-1d09-c348
a3651514-1d09-c349
2018 Northeast Utilities System
z/"2
K. i
PNG
zU!S
XZ B)
u/J#
$K\Q
T'xc>@`
(sj'
P:(#
#WL`
}C*
SHt;
ResolveEventHandler
y'0u
h3o~
b@G/N
`'Pq
L[a_@!_
j(N@
T >sS_
*Vb6
U'FJ/l
1Tym
ota
`V{&Y
X (+
$l46
7U*%Q
oCU#
,TvH
zns}
W<~J
0|+iZ
HLa#%
$=KQEr
n d|
xmBd
lB_iGp|z_AH'0@Tc1J~G5l:g!
z"zo*_M
l;nU
N-@B`h`| jb0{N9?D;Y2rn1z#
_G-b
@u@
Vu7$
nI~&t
mhIOm
#@ u5"uD
1@:
fr+,
t}5l
vo ?
({!t"d
XX{Q
f9IF
#&Te
D^cp
;[Dg
<hDSs
_[0XL
s~Xkw
jhSTHMT
C d
_Xh S!9
N=0_E[
Cj7[
?e/7
uYYK
Enumerable
=*Po
)XvX
x&P_S
l%P|v
:H#:
- 6
Ry$Jc
B\2V
JL?8
m< Ye
s-T `
!c S
rE#s
dZZ-
j+(C
:p38
L7]!
BR4qn
WnW3l* B
kWj.
m )
4 sp
q3_`
5498s/
}iupERkY
~$7VT$L')66[]M6P0N!{\-Mg
nh ;J
pN@|
'! b
[tZ&
rru0
~ +l>mp
Xkb!
ZMX{
8`aK{E3\WB$(a@jpd}C8NO*_0
,!DP
MuWx
sSk:
!698
'yZ%~?KuycO-M$T BpA[3 'u&
?1wz
zvaB'
1)73g
[$SF|-(lB bYQeV^<[-htSa+&
kd%<_-XcJ(aI*CG&Zh9+"50j&
~v%Q
,^/<
SqDD*
f2'w
4gx0
Zu -3
Lf:y
e65=H
<7OM
i%/pF
fO;]TD{"bdJktp=?w5otG]uA!
Char
fu -
= G;W
A2lJk
GetValue
SH_q
<l8
mri
jFb%W$-La'0Tt$^pdNqcy=q|%
2GVZ
[$ C
get_FullyQualifiedName
\X2O
Mp^@{4$Ft%,3x/wQ?av&b+LG"
#=FR
=j_
;,!?
/R&z
HW}i
PyX/
Y `mI
ot@!
C!
FRc{
YAcet
XKb
rP {)
=#ic
.text
<V~[
r5#Yr
KLwq}8
W9gYC
\8:%)
/,'.}RV*
UJ/i
object
Z3?
n;IaR
J t\
k=VH
hU^<
-:'B
}U]M
`&=0
`(T 3C
fBWY
`uX@P
5 ]{K
~zb t w
Vo$;
e$ 6n`2O
A=O
kKn4I
z! E@
, |wU~
q3<&
4M-e
p^8s
NAi>
]E>S
jpd:`
Z4$B
@1!M
3+
5RD4 =
H@tU
gL>z&t:
Ev/e
J~G@
5i"v
_ U.
76]T
#czyOh
#/vmy
LkH0R<
1Y8\JH
a]xM
JEFhU$
result
: ]e"
vx ^ @
{'o~iK?
HX/o
"aP:
X5zK
!J
t&FN
b1'+B+x
Ksuy
#[EfY
!fK
1^.T5
kB'|
d6|L
r{D U
["](
lh1f
r4IL)"y
X%`
get_SelectedIndex
Ow?]^
g@+!
&Mr3b
nS,4
GN:_H~
Fxl!
@Jwi
NX~&
ylgr
b>CD
Z,t^Z
aL&}Yo
7#>fQ
(IUf` J.O
mwHz
y{ceU
~^<pf
7lu+B
y?n%~}
>+TC
qI?y{
!Cu1&
{!v[
rG0
W2s
u,.Vg`
~~iGc
1*dNQKE99JXl:nm,D?++HC,|!
NvI3
cJSO
get_Assembly
9Tul_f
9vk[
%(4x f
%7 }
Oo5Nps4
<!.
-}Z)%
. _
6&*?
n6S]cK20
6<EV
35oy*Q
:dc3Ff
NMn q
D !~
s^$3
/B1Nn
`}__< 2cEm
E.-G
hjZm
T}}O
,*-B
)R &
-`3j
8H&R:
j2s@
7Mj7
i/FQ?
)o&*]Pj
2gp^V90m_?$sZgdJG`LRA]wv*
Nni^
5uL^H~FZK[VX?N:f*f\\&76&%
IHDR
v`~8
Y#6J
;.ug~
M6qv2
OMnr
S@E!
]k]&"
%8!5UDG&yAug/7Ga2a )+>AF'
gW?N
.N$4
=`4]
System
EventArgs
lo.kZ1
=99O~
5#eZ(!'~^AP<b=x~/y8YVs(4$
~ye,
Cy[S>
5R#f
P .bO
@/1b
|~
vGgj
(63V+
),f>;G
g_?;
`4egA
Noe*
=a`|FO
K5N_
MethodBase
euWy
Ek6D
Mt,}q/~20>[iX6C4n-Q]%zpM
KeD^UE
)WP
{N J
sEfq
'1 N3
Vx i
EndInvoke
*WDgG+P
z0 +B
.~CH
R !z
*SI9E
rK+:H
ojp:
+A'z-D?btj6RSyA;,F[V@7Gh%
YR,E
HrLd
<\:{
{DB)
IDAThC
9<ag
set_OverIndex
vkZm
c e7
[KF F
-zX([
P/u#o
^Ae+^m&wH3$di:rb^"jFF]`$#
vsM}
c"=YYx
i\7]7
U:Xd
h6"a
6zNW
set_BackColor
_CorExeMain
tk{q[#c:aZT`JgdA7jH*)9VV
BE4@z
NNSY
!XJ^)
ZX {`
aPu=
^\g(b
gVm|\
K\@s@
/`x,
ipun
iR1tg
5<Ys
(~`>
.hEZ-
Ob(E
t0@G5
ZKos2~
R$d6#
+]Wm6!
V%MF
xc$'
k'Rp(
7L%b
C|gH'
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
!7/0
3UY
O$F_u}E
k7JN
iA@ F
Y)?Z
)VTP}vri&yytV Rr(!-D|`^]
c/}S
nsUA)
I{~\I
Zkv,
aokh
{IDAThC
#|Qz
\ L=
]a9;C
YED`AjNWQ
vsNAe
4*0
oN\v
j;TE-
ed}vm
Byte
a3pg
S`7L
^[Qq
b-Gc
b^5D
9bh7X@OsI-X,Vzhi)ZT!]s?3"
b'<\x
cf8$
9cT F<em `3xL8h&K>7JAZcO"
-jOs
)sc\
U& 9
(Zy#
LkX`
eTF\
=?F|]
xjfb
>wp
=6]W
!d'^
<pT*{
get_Count
3jP:
;.qg
E1&9
|c06
w U>7
O{Gd
:V6`
P N>
H*SH
CPv;
^;`#o
}xO9
dIGc
1x2<
mZt|
O;t{g?O
HMPy%
uZv ]
Y4P,MSe
+5.:
Z+*"
gNKX
: OU
4"Sh=B2<
H<kL$
]R{ VHpqX:
`$Nz3
o5 d
<B_z
1bdl
:"2H
`tWW
vH%bG
&Em<
R_E7yx(#8W9sipA<|)Y&m"9?!
<>3g
GetTabRect
* R
Xv x
DdkjN
K@btww7
$bf8a49f0-bd4a-47c6-9761-2e7c57e9f2a6
M:Su
`}g
D557ouW
raeH
xok>D
THC
9{_J.)Y
O]VN
'Ih
5rW_
kU*h
(tx]iR$[yJ3g7^M#"T@Lv6)F!
?+O#
I@8Tc
c.Yzpq
| R
)}>[
,pBB
{f!5
3VBj
ck L
+NScy"
x6 K
y ZBx
}C<
ob6~(
dx\?
$-$
!R[d
260~w
<5E|%o
gH-So75ZzL4l;@G FkI7BE&=!
SU[!D'uGXf%?%C,!/<!z'QXAE
B.}`
:Em|.y
^eb-
7oIG{
8W3W
89vN
jk3)
dc,pL
=-y:
2*ke2
c^A@Nx
q2t E
Invoke
3)Ea.1+
{<5K
w6.p<I]
'[rl
hw -
2Q;]
~S]W
7ml>
KY2y
Array
ojr/
'(k9&G
Ujikz
j!:
PF@,
HZLB^
i5L.
iyog
YP<G
RHw=
=gUI
\>?4
S:&9,
&ge|
LF46
Ak{J
g{ %
M;BNy
nN_*!uS
g"#_
g O
rY{D
?gr8
iX0b
m Ev
wF2Dl
1:3K
`#iD
=m,_
dt-e}
|MaVPtrH!/B>~=[d&"G,/L^&"
get_Location
1Qc^~`Iz14/`9j][#G_Fh#"l+
"wwI
nr.T
IjMX
_(
/D#Kb
Xth9Q
CT;;
HK3
?5_>
. P2
PEw3W
Y9#3##3
IList
[hE9'
0},E
eHOrW
U^(2695#Hwn`3iN\D=94 &yB)
RuntimeCompatibilityAttribute
\4~c}
d"\B
Gz:G
61rW
wSY1
pSN RL~
7uI`
\GMEkt
}MuL]
Invalidate
,i,]6
Isw@
A%3$^
YxhLn
.4Xv|\
Size
}twxn
> K4e
\d>[
7[$=X
^y\n
ftJv
^/OUhl
IContainer
>x`OMb_rZ% nTTE^TN{)Yl&/
TqE1a:
7(5Il[MlQnm'joi=CU=WO$`n&
hSwE
S3,J
]3T2
"|1f6
Rc%cBAVY
^ :U
%X[
|,p:"~H\iL_"'Pc5bBzC[!BD$
VKY[G
$pJ:]}[
jnL2w o
Z',
$cLDT6
QXoY
?On=X@Of4!v;s`\UfO|Iimmu!
}'q
$H00
\6mI_
Ty`k%r
g2K2
_1NY*
N!25
3vP!l
,?L$
vq0x
%RB|
$Wfo
;t"+@>
*uuD
Yum+-M+
:#TzuV_zp3/b&@JUv&YGG|+=!
ContainerControl
[XS
. .
!KU!
'xDv
OAt3
vxz5
UzA|
,eCX
'<#,
3F1764884A245F1B3FA91DEC2E25339F23787561
j b$
TP2Da
E/;B!
|}rU
%WgU'D:\8Ik|EPi,R%SytJ[=$
\@[A
h$SEJ
H8k
pX/g
Kk^;j'6<
mwEb
- eY
t!0q
7Mnc
fbyy
izbU6K
@M 7
~ 2$-
-$t o
Bs"{
sJs
%Cl[t
VnYJ
EJQE
'*kr
:d^
(I)IA
&Wcc&
P~^;zLpx^ci\1hObL;?)o>e~&
ControlEventArgs
zp=p
(EC
(J.&
O2(V
4*VW
AG 'O;(
]Kd-i
40O9
1-US
JPu .k
Read
+[s^
Fb/Zj]9P
/Sh/V
SRN[4>
[xm*u
mY|}
79H]
np1d)VxPUUcLhN(wPwFQn&{[!
}/m@vNd
e?Ut
/4RB
{wA8\5
[Tig
J4IS
sAAi
}n{OC:Y
mh7|s
I Fe
_m@N7
zR9j
Y:-2
ww_1
q/yJi{[
MarshalByRefObject
\FY*o}F
R}Q4
bx4-
|v6<
){]9
qfb7*
mscorlib
3'n}>
$+ b
%"rF
P&Le
caA8L
5RA`a
twL7
N"EI
cBoU
#*wb
+&uZ
* 3"
XUB
Guid
PVH
` O<q
-@OcH
7F>z3
JC0=
i!'2
PFF|H?
5<^r
"fzp:3
Lku2pXaKT'MS+J-52Nt[~rGY#
J@'LW;C
UY[5^?
'@eM
k)9.
!7F]P#!8
RuntimeTypeHandle
n(<'D
S>Q5
F@Mv
z D@STWN ~9|v7;rh6HT#g;%#
aR@(jB96jM
ty><
I\Viy
r11
sender
r]>{_-
l+9v
SWX
NN7xxu
vbXs
R&g4V
xy4od%OD8mEbHsa]/,USs4)x(
NpT]
c6:h
S nyCm
TW[e
mo }S
8~t l4
=4=,
/SA/
X _r
9gup
jV6e
B|j~q
2+ &'
oz,xTc
+{W|
BY90
uUQU8h
Xi!$
~b9p
Rajf
SsH!:4s55;A>P@1U8,i_~\Z:#
E.v@C
%wcx
oV7'
|gNs
)G4$G
?'JS
<3C+c
+5X(
UTX~
]~%j
tgL)&
|_XG
4EGx
Wm;W
>T)
8L!=
h/=L
1uH^7@lTU\Iz|di4rmn,)\"#%
1P!RFj=:xKCVGYS1TH-%Mvbi
!This program cannot be run in DOS mode. $
"dj*"
{M&,
}&#Mc6uAw?b3z?Q^we4'#</`!
tK(9
l9<2A
kF>C
HbQ.w
Dispose
u'lLT'X
=b&Z
F{y
Oa/<
_K:ArE'3S%>ZH*0/n4W1n wW'
44r+L!{
Xhe1
S{n=
OtyA
W7KE
`
v({J
w1lo|
W;l"N
f!he
MX/B
S@|4
J@nQK9
9Z1_
6pQ]
{YZqe
65 O
-w =
'?RN
}%E,
m{{]
2+`?
gZd}
get_ModuleHandle
L1ea?1
^?h@
a ";-hqr9
MrK
3q}GJ
oguY)[n
[,Dy
7%-1 4!v(Pn)4:8QqVFXj{&,!
%1ip !
J_=u}&
%,oo
49"x
| +]
huzM
KI8V7F
.g@1
3=lg
c_(A~
DD,0
R'_j
Ys ikF
\"z"
xxU]
9_!M
_58E
cAx@
s%@
!KWX
fVFo
$ I"
Igb"
2|6l}J
#A%b
2&Jy
TL&_
,[QuM
&yLC
BlockCopy
<AyJj
yJZd
g3}C;
&uiQL
I$)<o
u0N}
.5gx
\jI006?^CM
4T*IX
Fb\ 5
$^"Q
I7A0~
4{_.
:DpQP
s 8G
1P"\2oZ
.R )T
CY1l`
u<jc
l:mq
N0S|7
5lI
5oAi/Y
t!>!
I 6Y
MethodInfo
L{Mi
;F\RuB
4t<
O |+7
/SueY
f@=.
CompilationRelaxationsAttribute
znC=
B19a
h*(l
-Ke2
@qD8
PU}I
v4X6o
tLL3
MemoryStream
c~aI
!4bd2)zh) cvnU76!P]X=qKK
# v9
Yq9Eykrs|W
Z=Ss
|VY>f
?{iD
[5+Q
~! $847r2
{lP BU
37{R
|`!Eu
!"2l2
+Yz1;
lYcU
K:0(
l+74W
HVK m
rx x=
pK9a
Z}wq
y7rO
.yI-db
xfkO
LYVj
wWNsW
M_ 0
#}MulB',B9z?5cSfJV:q,s5;&
_L3l}D
T}OK
kzsm7
!)6
An*J|m
hjNQ.zY
'/OM

TH7Q
TF8i
Rectangle
ns70
`V4G6
Concat
{Vz%&@:fE
j?i<
otG
(::;
Smb?
Ocv9
Z^C3
HPO4
K~"9
)^nLRu
[DKS"CfFb1m#TX+IPKRRNgSK!
p3l_H~
!;*R:49 +BK0'7;yO0\\NQR~!
>tZOe5
fA)L;0&]
73OF<!]
VGS?
j^/L*.
661tI
C-X.
:5Nc
_yL
4~;U
T lJ~
System.Text
6G1S
`@gL
,{rHN
.fr= [
z#_3
Z73#
uQacZBr
3]&~
1Vh0,=Z3Us+]lU!e1Svecb8o!
DS45
y|nZ0<
p c%
ppwdV
%!qg
1K"5_
JZFf
*9"J"H
":JU
y ]/X
P}_z
OrmJ
" - 9 Q ` k
6[c3h
3!J
D,Z$8/b
?cmd1
z_ b)AB
#!~5U
R=t2
j~f Q#
]t r
]HSR33n
csOb
3\@|(|
6H?RJ
k;g]h
#_a
:\zbt
Q^3kq
Z!ZS
tR 2
o]8M"
n"SZ
B|M
J{MiN
>j4JF
~Efd
KeyI0
w qL
re|t)
ToArray
FpnGX
OnCreateControl
~]Vf
R{`csN,
W{YuQpd!6vsvCYv!mG7h_ysV
7+_e
t65'
v<T-
WR}$
u=m=A
!}G{Y
/evu
y {J
"@;~
.,1mM
ZB/ $
?I7-
Y_&
xU4`
O+gj
(M
>bP{
oFcJZ
?KI%OE
KfKdu
}k[&
D )&
8\FMU
=Hk]
}OW8*6
N.BdC
.=nZL
D5Z(1
>wku8
X >N2Q+4
ULDH/I
eht|
c&!@
$ e
!h1Q
msuT
b-Mn
"F[_
?S%6
#,)0
-#-J
+ #\
6$t3
)uok
?Dv&b
O|'
ZGLy
[7TV
?UeN
;[Rg(b-
;C@J
3yLV
Vsx\;
]][a
'{hi
'.sP
5t>J
CTX~
d9'v
E:( 4
/GD
l]B
(={R$F?gxQ(RC!4W{a&cYWl"%
0/ ~
m3 S
1.0.0.0
<s3K
o&C{-h
-mjz
dyaX
'2V
EB)Z)e
P=b5
=mW,
R(Q7Nz
k SNC}
Hj C.
<]'N
-& o
Stream
i}[
VYJ,!
sRGB
y $F3@
"ET;
F( +
i@lV
vS6`
CreateInstanceAndUnwrap
%H=`X\(;-K\}T7o&,\/hv"K7#
aAFT
78-\
o]"H
L4}yYp
\oc6
< l$_
;NML
0\=F8
q[zbh
wU6x>
aS>c
CrUQw7
5WoU
gDge
K z_O
p G`d7
set_ServiceName
T*YH'"
5bnem
\E99
oNIb
/5Kpd
tM05
Y tD$
5SkJ
\uc"E
YiW>
,S({
~:d
0*Iu
$fRw
q=~@
yJQ)b
c<}g
W&7l$0Bn4gTSeum1'XBYPhQM'
~LU?~
xWi~
Az#U
!0~i
YN59
KNva
HE?[v
g Y3N5J
y&/dn
|Jo[
;OXE
S4;"K
6#W=)
b$bX
Z\WU
r+FXZ
j):u
l)ni
[O~p
\=-hqf.2UM
Dpy0z&Tv[(?Q?#eY$E"a:Xwl
[g$&
TmdI
D?zY
c&km
)%ic
|Z:Z
B4gN{?k
W%Z
Point
b(SE
h?OhDH
7 *w3
>@U
f<U1
/*V8
+q C
:76n
Y{L4
vFE-t[P&Ocm,uLNJ3t=NFzZm'
yUV>
'MaT
({z_^
a8Ka0z
TX<&
bFTNd
k+`0g
x\_P
<Suk
`3edh
M*L *
.a!
^L|c
d4Zdh
FD]0
cvo=.
CB|x
5}eG?rL
B-B<
:SRY
~yP9
gZcxk
hI ['
O hmT
_Xy
wWg<
w8&;
ca_e
';[M5'A<P}0wi7D_2!(z7jhH
%43'~
^L+E
xM&vAo
?E-K
T\}a8SFz
/CE#?Xw<Pq,@
iB2B
0 ^;
w:<V`,z4+g?|j 9:?CKq"2L""
B0SM
Vw-
}32!
#C3@
zlm/
[)W~
c[WbH
$<}p3
Zw'
K<oIoX=YSCI!g*I"9R49A+^t"
:#|R
' *
"A a
s\@~
(-BV]
gQ^n
6o<j
s|c
J<m,i/
~J,6
=g$/,4
!&q)A b2Mlo4hiz/},z\hRi<
P};
V$S<
pU TQ
r&(r
R~(6
Au>nN
6vaa
cy$j7
DxSDL
(Uph[
>l4c
}A,Ie
Ph{o6w
PpED
oY{X=
IDisposable
j)Y|
Ju'D^19
0Xhi
= tw}
e9S&
Xgbqb
bE}B
K@ (;
*^;K
2J4T
&Y{
LB:
*uVL
tD
@6JA?C
ywkDN
Zbmz
=xDx
@G}*
Hz^'?
!m_pData
#}kk
X10k
pq':E<g
Fgke
6a<M#M)^?;A&2e^hbv:*;Yj0$
qcq2
uiA
>>zeF]
WRK^1
kDTBV
Cpn8
,%DM
#GUID
set_SizeMode
0V^y
d1|B6t=e
\ 8mI]
?}:',
bTQT0
5vf)
IF/I/35c
G~lMR$|T"R!J[2Hg5KsOC2 2%
_kdF
)[1zO
A_BM^$c
>!.
AnMO
8}4A*A
i"._
'V,+
Q@+c<
^H &!r
]I;T
HHs4
W[{L4
5"Ev8B
\[XJ
y)71
E0&'
mUTOH
";]m
v"zQ
rR<i
z4mn
o.Q|
9"Nt_]x[%$s@dpDk'g@;gy*]'
mh.y0
XFgm:
.i[?
pmL@
klZ
+Z#)
A(a[
{q`nl
*p8z
F$$eT0"
k*;^[
get_Size
q:Lu
rzP"
51qU
|i!2
[=/`M 5P
QB{&*
Q>AF=PQ,L:$_VCGF,R/(cG3h#
k`ff>
RRU)H{7
w('Z -FHT>%V<%I*-*t\6@D+!
8Gnj
R y{
]=Bm
708u
&&}w
~B!m
Xs2|Cdy;p
>j59;K
Kk;j
1yG0
$ YC
I >E+XYy
set_Cursor
sQ3N/
- i
~# n
i;>Q
%Sr$
Xf g(
+$a1QK,
>s/&
gAMA
|DcZ
eS'5
$bQ{
N0ue
lZE:
ujvPMx
Vu}Q
Ekmk
{h|D
UAc)Ro
Sq'N
zcYD
Q"h}:
7Ux>
WBx@
&*i+R
$ZvtczA<
YF Qc
Gfu[
!`=D)
=S!#"
mbjz
q=4
zU/'
BrnX
h"
UK\Ok
*\M^T
%/{d
&9=
j{)z~
X?In
&xH;
[{;zy=5 QzZ)cf&|"6yp,|4t#
^,@:
dO/U
|6 j
= < < < < < < < < < < < < < < <
6LKI
oqlY
?NQ?
qE1FxC
BmF}
~z2'
$L4N
~ s|_
RI_s;
rJ#i
rAHw
A="4'
'K0g2
Marshal
&kz4n
MO0<ds
-!6c
vbW(y
j(Ga
#]d-
K~Np
"^k)0vEjh[6>NcTNTHg2,eQ&%
" z Vz!
xoRH
3yP
n] L
~[H-
lS
5qK(
H Ut
9 Ar
+yql$5
p#02
i[xl#z
&M2q
FUC$
0*?twC*Gkn?j)[xe|`E4XMN<"
VYX _
Jr(e
kpRj
Z!K)
+NF4 CF'd
AssemblyCompanyAttribute
ISIQv
?4kB
ry:<
>'09?
"41cE
kQ \
ES3L
$i{%
AppDomain
9d)Xoa
6^va
D,5
f7uS
)*@\
^uIJ
poq(
Ec'd
.xd
;[n
BpVB
lf)5
Ss8z<
Zv(k
k" K
H:`qo
,8boK
5@&=w0
rL^CI
h6Vd@RlJdQ'QWsTm!QwgxVb,'
get_TabPages
I\MP
[kJ_A
Control
,r(|CB|sp0 :l*H723(}Qr(,"
0n.
(]_?v !u<d0hP;F2XW_)2|Ff%
%k_e
M3E3{-
q$8+
Z D&
dX~c
pr39
?=]
SrV'
\sJ:
Type
`D`J
!27z
\$o
\|d2C
3f83
1)RN*
}?e~
ns q
(i<}
E~K0x
oae]?Q
+M(M
p"k
%VfE-
REA,
i?wa
hz\X\
_g=&
k.y<
EY@d
t)[b
gLVX
k'6O`
H Dv "
4f|
U3GX
IW.f
D$"t
n+fMC
)>i`r
JO~$
dU]4
}z7o
,[*S
Hm^.
h]:Q
#.&q
m yP
LbE
Z1cNJ
e %]r
GsXL
!95
G_E0"G
4dd1
g+F{!aS
GetString
\C9X
rn>j
i-tT
Nv~;I
18b_j
1]+.
k\eZ`~<
L.u4
0)/?
)RuW
OT/s
*Qe/MNz
d!c
oG|r
U1sh@e
jN@?q
mcnd
Vk7G
,*g2
3`I}StuMW
0ne"
cUS#
>Oua
9D09s
@g~JY
, Y
I$?\"
`.rsrc
DuJ
#{dJ
vxd{ K
8P=J:?
Pp"( t
I_fg
I3c
>wDA
nI{4Q
B4^/
rS&K
+-xyA5`ksJVy>Iu*mpG7h'j)!
x #}
[vaF
_+#8
vk$~
m*/t
;@>J
/'U%/e
(?\n
>bVm
$v/U3'lS%k%>&U2bLAzhdyY@!
c4&
w5VE K
p6bw
S4=
b>&X
`s$:
m6 {9
J?6
:plXhs??3Fk*}F:UAUf%lOyI!
so>'
~z4&
:2
k iR
JKvD_
")hB
ic"tgNx
(
OE$l
SQPJ
nT-,)
5yoCy
._csr
xvjJb Mn
M=sx
*>i2
MaIp~
e+VP
En.8
GUW$
F3MI7
S+wB
ak}#
1OXt9
@x\pR
OM+e]
|hzTH
v=qz
Q}{:E
c/Q-
mO/U0uxO9|FztE)m5|KMH {J!
BX-H
I jf
3$s>
UXCr
V,@W%
uQ7R
8oO&
clKl.
{( I
t k#2
Tp+A
G,d#w'wqJ_zq,pQeN'][Ae:n
Nk#a
oODI
#Qz}
*fj2
) mP
>DNp
Uttq-'~AG^srI[O`EW"3,b3P#
?ge1
d-s_^e
A(g:U
0?M
>,&qJ
<{7
$a v
L3 T
OuR?
z@a<
4SWV
ejkG9Q
y\q8
7N:%{
V;Nh
!qdn[
`srna
jTgQZ\~
D\~];
#Strings
SQ $A
D&~"
\j;t
bx[7n
8];
`xm6O
YFt{
Y.Iq
4 4*{
get_EnabledCalc
,%RX9
i/qG
=t|e
IN9)
^N-t
Gc^w
pSCS
|$ e7
AVt5xFK
z>dk
*$g+
rgQ
V,^$
2Z.
J,g5
]dm}
~Bmb
GetType
*R'1.z*
2@`T
add_AssemblyResolve
5F7H
4x=w
^|Of5
]0\T3&d2|2(^b=w=[M2"4 E@"
TdZ~cd?l
?&hU7
D c\
5Z*
B@
G^ ~_
E{IU
0 Tx
]vfU:
h N,I\/
TabControl
P%KG
s<f v
?RZI
e)*0
.0D[
fMJC
(U'A
Ld5T
-Ycak
HGrx
<wxi
s$ 0
& Sk
H^)g
Z[Z@hdug
jcaOR!
(3'4
"jLgrbtBgkuM1k<eP22!>9VW!
;iVu
JG5K5B0?X=rYmVit1VvXUY8h$
get_Revision
%}MI9UgAI@;k|s*B&]I&(zL7
[j`h
UW5mI
-"Qd
2blBX*J#)xsAvWI1&#LZV`*Q&
WpVd
jIe
AD&3
R'7g
rxN3
\6]w
.*oj
%yS?
l,L5
NmP'
|aRa
>v\7
/ f,
UVnV
>HR8
2Y8H$<;
FsRfQ
Wy>J4
lB%YKaP+m!UPh| hFyR(m&[V,
Delegate
]$B%W[H
Fdf
YE(v
lj ;
KKt!
X +4(+
*f 9T
Jl7ss
R'n,=
oiX"g43165iUMM?bDUYE?b/X
ywa?6!
&UKW
%;@G
j@D{:
V:m@
2+Vj
xC{|
1R1k%
x 9R/
'_oi
nw.)
ki mx
)ameNOBJ
"FhOUD
xbH{
mi'|
p{
Contains
D ZC
0LguR
vM)=
Y/jN
6!7
TLPb
~bh7K$jQ+Xg@b&_ &+LoJi}\"
ValueType
Pw`G{
=WFN
dr:&
IWEQ
(%cL
$Y#+
Lf75
U{mB
X<u{b
6eG:X&]d}N
T>y :ch^
29c=()
\Scl
hk23z
OF>w
c_/
D-uY
f kB\
XvGT
>{i]E
beL?d)=-nx#zPuV$ky5BO;1P#
jo~V#
Cu5 Z
get_Version
ttFr
KqF1-
ToString
F\Ceg5=]j`y'dgI,DF(8}30b,
JH7 G
<YNF
c&LqF
RJBn@IC zi
yW]1u
XS<l
X
~Yr,
GJ;L
DC p
HZNR
R`ur
xVZ6ZW
x4!@
GgE*~kc
/\O):
W* <
)?/Kg(
d;s7
L%f9
$]DR
Q}f~
RO?rM
[^ $H
Jj
(An%
RtS6/
0!QqTm-q]]8m[JI6%P/{x^gb"
ioW~
p 6
4cVz
"k4%S
Y h'M
% ,\
Z`2EA
Iiy
l| rB
`9Zbf!J
W 8=#
JGPN
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
JIj,
s@Ql
Co!U
4"[Pu3
j\'|
,H- I
Enabled
tzdy9
$h7
Rw\}|
U,}$'
%cWrqw
4xgU
.ctor
;RzE
b 5L
9_x'
Main
|:G]
""HM
A|\N
R c5
ZXJX*
jtA)
F&E;
r~ K
0w>l
ySF IK
2dl
V#9+
?\Ne
6Ryf8
Module
GP=0gB4'(Hw5s|h)zT-nZ)D;!
M'rKj
UCFo
w:483
i=zwi
@.reloc
0Lnr
YUYo`8p-VMO+qx|I_I[u-0TQ!
vn]2
AR|"o"
e&#
%>=@
sZy~9l
L<5O
@<zVL
1/
-%?*=c
Kd40
>UXq
F5Wu"7
rd@e
D^]@c
!HIKOR:
5%=R
>5]f
0*4>
7E77
cf%+
O#NRY4NV`*"2(]@3e0$vX0D]&
d]ENbyeVszDrXn/O\GR{&)v|
@GR(%
7Z5V9-J]gX)(o#`eyS^+sCQ}$
~eu2
hOb1{
4?L~
UWjd
Z1;I
&- a
d:U#
KA})W
CQ< ]
G2_!5
bCwu
U2;Z%
R[#y
Z|D<9@+XO=D}2$[wrXefb@A!
R'5w
Q!L
@_"^@
rQi]
!Hpb
8~-
9)`ZC#
fYEC
v}d"
{zJ *1
BetD
R_o`
\Hkx
QAoeh
-[CnR;<y9`3p'-[LAwHswc|c'
twww
Vk+'
7u.
}D+)
?,=6+
O,h9
VA n
NewGuid
7a60
2)rH
^Dth
Ij'0
zn2;
5:c.1
X&$(H
cc%E
/K-A/Qb_
= (\b
]Ze?xjKH vXLk}pB`gm^TVy#"
Vrk8
G87
5H,_G
inj
&oJ Yk
J)j_
N(Hw4%z[u:V9jIka%;js{a{""
Z(1
+#:K
@Ts4
jJ4]gjR GhJ 3^(,+\<7/elr!
Hsgy%g
;9[]-N_
E<hg
m{o'
E&3
7Sg-
</%Q
D3vt
Y73&S
@c|)^ROW|~1aE`~TLZ\sDqDG
#Sn?)(EW?Bh<Bp<7$AicqQ$s'
`Jh,c
\Op/U
T"x2
tC-
xTUGv
N9 hjC
7WUx *
^k}{
@Xoq
?U{oLFZkvv%A-P`9Un[C4:wV"
Sl K
IComparable
uZUU
O;Uc
+^v~]
SOz
`b6lC
F3cg=G@CD()N+DSzt)>mdG+%(
e{b1F
TWJ`
{Gu
v<:o
"&u56
*"8;l
l^~5
&|7eL
b>2
S/0x
q^#&
(HJJ
^5
<f H
ury.
z/vmP1]oJ`[lXEPY3r,R$rHj
@ EvPJ
K6PX
_,+K
Wl={
|5VK
n04AT
W^3c
U2B$f
Z ,Pm
a]gRM
3vk'>4z9|l`K_q(/,B=cltXr%
3R& {S
8.u|G
GFI}
{b6C
w`. H
Ix*>
YHS u
RJ(h
N?XJ
sCoi&
#b j|
5 iN
`T~.
(`z)r q
$0D/
@SI/%
74\e
8.s';
9mT"
;swa
fKu:_B
U 2x
!v_
F h
I.^
G'YNx
<$KFn>
:9&NL
IS{1
/Bx
[a K-
AsyncCallback
4U gj
Vvl!
&EP`
wC;`
J2,G|
dFj+
EKXr3
0XXd
j*%k
m{$~F
aPHMe*6A[E#Bwn1'#MtHEc+m)
x)o8
*o^Y_
6vrG
b5zI
v ; ?
_~?W
xjS)
3k!|zG!f"d(C`sXAxW|3rGFb"
hP!,
'$Z!m
gs\I
IYI;.
nsbvh
!;}u
Tcuz
IdIPk
7~O?S'kfnd:u?6q?4U+*UW8c
<Li
{ @S
p0% ^
%}%i
4@kVGtOhHjppxLs1d85QN`so
orN5M9vd
V@FZ
{"_)
1nY<F
:8Uj
^DIM
M,ht`
h(k#
P=ilh
f @r
m'Ss
A<X'
a \^k
oo}VM@
D_d"J
V&7v[mO@[0c\N#U@doy\3}AN
We j
6[/Q
`i)&
,^\M
/g9,+
43c($
t_FY0K
vi0Ot&`>Ht
:KtC
#/5i
D9Mhsc
Arlf
kVL?
((;;C)>L5vKT4V;Iv59%2rkB!
R>-^k
dAX+
k';F(
ra/[
ZHaX
N!4Ww
x&XUCj
-.av
f4^]
h HD
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
w,22
{n+
P^X"
"wJLUMh]K0_0]@B2!pd'5unX"
MqZ13
KwSi
4|%.
e"|;]
mscoree.dll
Lmub
VnTA
mktk
@|l
z]p-
I$LA
cX!E
40:'
b?Mg
DWkP
VOJ8
5hK3
. Bp
: f$
J]c$kFs
.8X8
$XAj
3[broy
]5aA
n!XjS
H<_"}
qav*-K0%UN
xV#g]
1Xp^
DvZIN
$ <l
-Q[;0P
vgoS
Eq%c
g$:8(
;\$(
S9CGm%Z%i
0 VZ}
Hwe%
Yx5"
@}jw
1=>1
ZFJt5
q[_X
V/50g6
6V|q_
M]MBnH&G6D"hsS]Sz>BR00_p'
9nK9
rqh
02 e
Qeb1k2kc=SNLsb_%s&(SH;=C$
=C1tgw`
ur)0S~Ipi?3w4KVO-3GUl7*\"
%=Igh
a\#lz?{VVv"p>7v#[+9i"HbjG
Q")w?
[H*N
#b>w
{f B>
=9 -
-|;4IJ'=Zvl~&E0m6 H~,alf"
&G*O
K|x4
Y27\s@Z<
fU\-
^hcE
o|\6
jXv8
0:3sR
"oJZ
d&
b ^!
%2FCtd`KdHpc2b!hs0Ka<vGP!
L6zDe
AoTu
?&e\
jNkN5
m*qs
$ ?T6
+YDB
x C
C7??v)$D>[K"tp\et$H+f:B:%
g`N?
?m8u
?95\
PEo`
Xp5cl
=OVv
8u=*
9|`X)6-0f]x/UhVa<@4WHkMN&
7\Q>
&Ycw
&8D]
B!*\
>)=o
asz0g
8k2n7
8G]A
7vTMbD
[0q@_
wCkp0
O_otbs
M 5m
+HJRz
V> V
E1qO
ns&D
xQPA
OnControlAdded
CF*$
KZNC
atfg.
N{)h\F
uFj2
b!,i[
B=3&
k6AM
6z"2
oy\7
8+>O"o
p+i3uG",W@%qG*!E>%yL%1\u*
w\hM
WJ9o?
k]V#
2-o R
{w-R
<$ha
0/'#
lb]0
|iKg
7a-<
get_White
uYlh
F!q,c
v 9)\
``mJ
t{8
aTcp0eJ
W{sa
^3\{
){ H
E_ :
*VS%?
&LM6
EP2,zl
}kTb
}$R|
kY:)
zNR-1
c Z/
Ww<e^
SL[g'z
m"DW
W2oMGo
[yVgY
fedH
L!UhEQ
Pv"g
InW'
,&7D :AG
2aLq
Af0p
ms3'
os<j
/o>@
hSxOx5
0iy#
G'\p]
xxhX
F8Xl
V<)pmD
p^WP
p!?R<?MP*u#w2%Yf9U$Mkx`=#
'd5z
|5$8;%Mq'jloKaq$FE_QE?'
_k:#
A,Or
VvzW59
7/H?
L%\= =
+ThoE
}@z5Kh/y/
ZMEj
0
85 R
w+@(
Orb?%4=yhKor$w)3~5];lnG8#
:F?zQ#sIfsKK;W0Q8%Wv_qKD'
36 M=
uI^&q)S:
oZ#
&!7n
- ts
THJQ
k6$l
TkO6
#u :
3XKVAwR
AcHVwELlI{
AtUO
6q'BI
* kW
mm0>
}04d
"EGV
/nn6
l}'J
ivVz
veu
\) J
get_Hovering
7'!}^
M|xL^;ya&'N!xUH'vcv!azWz"
Jp#Yk
s ph
YR#E
)~?:vn
!kt T
oC==
Gzk2
SetStyle
+a-C
y,;
]. 2
~ctW"
PZE!o
3tf9
8~F
F& `
EsI)F^z
>NOY
gGO;rE
L ql
#Qp8
RZX
Aq5.
lhG,n
u 8!m
t5<Y
%R>N,
`xqx
a%ZD
d2)Ld
&RlC
Uy:V
V` g
mqAW
tB**
blG
#z_a4
*I|56
Ayd w
%p+~
HJs/D
%>DC
qk=`
aiGj
-{~!f t)on:nh6g_tD`>(A):%
XK4Lie
WY,@
,o1$
_A+~c0
rrV${Z
BVvj
bjrs
5(y0)
ComVisibleAttribute
@>E<
_/FES
*;?Z
_j qM
Ex6#
Bor#I
T(*2s
^`qw
I>7~Y
AcM
-u3mK
r:0S
C`,M
}j=gC
-xk]&
c'GQw5v9"@)ZF\{(Bx[w(6vO%
vy`}U
.1z#^
VT 1
Ls}O
_dPQ
b;*U
-0*@
VaJz
m/-Y*t
TV w!8
Bp\1
aG0}/
#1<
{ &=&@
YbY|
U9Z X
O$b
lfbe
] w
t;VP
EG iMJIy&
}Z>}
?TkD7
cz|
Irpy
oE M
jve6-N+DNA"eho*uZ>q6rK+e+
o0_T
get_Control
xTE'
?MV`
Confuser.Runtime
uy8&
5>k\
Ey#D
vK a
/t!dcj
+8fv
OoQl
bD>9
dh9g
=y:^
&BR=1x
7LosGz
9g*=
4WSN
/eyf
ctK7
I)&!~
A "L k
zatM
{GZd
Nb-h*
p| Q
sbgN6
|2}{?J
4Q.>
,8o<
GK-
NHrH
436534A617CD86B8557AEAA31D433ECFF38B112F
`s3
vY~z
4X"As
UqwF
GuidAttribute
1RgO
Buffer
^T_\
yzkFC
EoTTIrc-Yr_9X7t&2ZgF5U"o!
dHp&
}yh
:I~)
n#{v 1MMpWl Q3/9M0GE8%Ft%
i%rd
A/h!
/m 3q
h v9
aB3fLrIbw7@rdg&O4C(DA$V=!
%sI,G
ho !
9kJq1
~\WyCz
ttQ5
RmV38d~1)#YPabl/o|4<?_/K!
Hf |
;t^1
=q e
F`EU2P>V+(2Fn~&dM90}J[?=%
%Y$wtQ98&6=ZV&ck&T!)4D(O%
#>:I
}RL*i$DL_$>,APG=l%E}*u^E!
3Xra
i.;I
Copyright
(Y8_
6?U
(!D8
yGml
owwN
?Z[A<
qUYt
Z2:q
R/g6u
\d}.
U_P!
.r8 B
6f[XBU|v
:uXOF
CN/e N
:=*dC
cAgS}
|vl?P
*h:t
XBR<
! \i
xJl*
-T5I
Zz q
fv# m;
JA_
P@ <=
Exception
V1~d=o
>q G
Ed9`
0_!n
Lk_}R
h//;D}
$ds
[koY
.M4F
Ob s"
Qy("|d*@
v>f"
3n:)$
$8[4
d\ia
*W6+
Sp>9
(+Q*
cKh~Y
p1 hZ
=\?V
z)AV
$WtmV
yl`\V
;\UI
w(Sl^
A)>1w%
ga'
Math
%]P6
DbtJ
!!3b
y5]m
@O-1+
FzL?tS Irp
8:$=IZtydL49Fu43M%yq/)D,+
_) %
SuppressIldasmAttribute
pd(&X
yr1OZ
_f |Y
xIh 1DIj,M5
Yo|<
V u&_
Rd xy
2=AwdK&ooLc>F,Ysx<^C5wg9
J*);K
F'u!
P aX
Jh+$7P*T1HJT zE;N_hHnDP^$
6@%
"[5<)
~M|l;
KKQG
fya
@^kwL)
*^te
gZN,
#8EO
%is~GX
uV#P
KI_?%
^$HQ
q)VC\
aps@GO
AssemblyProductAttribute
HuO-
~67iM
XLay
Dn:+
YL r
'vHE
kuT(SJK
MulticastDelegate
,O?u;]
7G/c0
4RLDy
7{]
rY=A0
^Hl;
TG9{OvMy">hKL+fL^CSy&CL=
F`O3
bZn5J
{Mi&P
T:Ee"
h I7Y*
OP}T
Rb7W%
OU<Np[p}
f9>L
zs>&
=eE=r
2\si-
EM:W
2*}4
k!xs
Vk@0
<*Pef
N}xg
K]<
7=hz
KIsG
7A:32
7`k%ke:p6qO1ZxJorW?)TO\;"
~t-;
AdG
l"q`)>SP+
U@pQ
\>nO
uzU/
D6Yf
}voc9
,t)#
w_b1
l a5
3aFh{
f-2[\
Nullable`1
D<R-"=N{ Y=8a\Pa:c:(Sjgd"
$a;gWD
h{G^4
DG0
x Lv
!pl6
a 7u
V*@c
o4<2S5
mHo
hs2+
]\V;
wb3M
U-]r
.i)9
FIw7
M'k
-"'Q
Ijz|A
K/Ch
ca19aa60-24f0-8d.Resources.resources
"xub^b
)McY
E=>
r6>]~
7oS4 -iv
""u^
|8uC
1{#b
Z^O_b7
3/*c
)4vP
;C>$W
qjQbS<F
>1+i,
=47{U
V ;F_
I ~2 B
^Y0r,q
3 Ah/
[h|L7XNX
Uny?
^C*{!
System.ComponentModel
S_sT
Ark.exe
evZ%
N )N
ZS^xC#
l['7
PCtk
0 |,
9"C'
_]\,>j
>FCT
P:c:
{N7uO
t`[+1!r
PU &u
j/ "
23y`
|IDAThC
System.Windows.Forms
p% I
V>o$ce
Ij/:
3Z#7
(6|\
CfMIE
pmfR
?Nv6E
rSoL
$i5[
ZH$
LAl:
ME<w
XWo-
%^" [G
1 &8
f ,@
B>`}YoN-/AAca#U$gpN92i:d!
Sdks0t
_&}?
*']t
vH hN
Sb#;t
;'3aJi+H[2,4<0v-cdFI]P;!#
uvwQDQ
5WtH
i yC
S884u^U
rp+_
=Io8
T%]P
?F"'
mW4S
UIXp
|Xu
hRC,
BB:e9&
D^*g
2GS.
RV-f
z R<
MAu!J?<
get_Height
_jSp
)a75
*-!-
:xcZ
){5
}3Ex
(j$^
IWCXt
91;nP)^
}|4{
9-0
CBj"HI
oAx_RP
Version
.SP]w
J6tw
>:ud(
U;(WU
d&pU
\>4v
V.Sw
Y;5S
0Ib|.
$N(-
G3@BBGw
:edF
+mup
upJ 8
a8{z~
=Uz,
XiXv
op_Explicit
/;E9
%uC=vcDn
kjR0
S"yPPHbT `hD@2
qP1;
+'c/
/ciH
%0n,
iS-wt
kGgp
ZXJX*V
ZXJX*J
^8b* (t
l'bS
7(ZK
hc#k
yPAj
.EPj
XQMtm
4Lf03
r*<=
[WV.
r*<;
9J:d
X]OTz
;MBhn
set_Alignment
` dB?;~U
2Y)A5
pCBy
^8Rw:o
F 7
%6..
X"r
$ mm
=%
&}t4
fVjj
$p&m5
9 rZ
vGIA
f"-m Ss?'
get_CurrentDomain
=BC3
wRx7
X _J|F,D0x5lXvz%H?VEbO1I-
nPjtI
jR>2
2jD
2 9_K
\gek
RWQC
]@^K
.H9\M
#N ^
t)J
QKN'
5&hU
&PYK~
#Blob
<gtA
h"[bt
* 2)
fIgo
q<gpcz
M`y:
qt*#`b3o
#.y
+7M$
BindingFlags
|&y~
pwFs^rk
|@Y@dy?#ux>w(oYp^69N*Wh;!
Nz7t
s#gg_
>/vF`2
L0o7bG#_`v$b<yc!?rGsn(*"9
A3ju~8
8SZ2
SP-E
5B7
Cv$C
74 7
Cursor
TQj>g,
X}LD
5|XK
Y+}1
SXzb
KVw=W
;W|[
GgZWd
,6 Z
qA%C
Nx~]
)lNh
X(5+
B5ctY
kB`a
;Nw;
get_X
get_Y
b!(B0
] ;r
-]Pn
_--W98
F_b|
\,8F[
VirtualProtectEx
)Kri*
:~$0
{BY/C
tN8 }
/CK?
gNF8
>\b+
4\;T
3N$D
/A5f
]c3?
lp|%
. ,Z&
!.vO?
;'F[
np1|^/gfatl59[]*],yrbB&J&
Z1D4C
]a9'
^ch7
2'K
ePqj
_=Fx
MYdc ce
~{|,
-s]]
qv<c
=0a:
Cj,xG
c%!s
Pr
jhDV
=Fz:
t Kc
)SLH
(sH.
0F*0s
w;NYp
^}4]0
oen_q
q5<@R
Wtc?
^- `
F#Dr
Mj\M8"
>FDZrA
@ 7 b
}l$tH
"&@bdECf6J"gQ,$&Kaj| G?(,
5#)@^
g 6'{/
=thXW
A*L0
g3 `1Kl
3`fT"
@ S\
N:G3bG{[\V10l;S>_4+}X#=~'
A\h |
4 \cD
em |
o}8&
O>mSd`
&??g
t=!-t7
,m7FS
52o
1]aV
MF)l
WS'P
=rjy+G9B9I+[Br>x\6&S,el8&
i@8KDW
{d8)
n${[D
?[C7
?DJ#d
M_m(
w[y;
gq['H4
vI a]9o
Q5 ^
grm.
~ zu
Container
(mu ;fnz
2{dL
mI,Q :eWB
<^X=M
^9Am{11`H&!2Y!fhg'OFWyWU#
q@RY
BM{6F
(,W
RMFY
`S
3k0<
e}%z&@
v|~8
m)G,Zs[
r @+
''jr
.~l>
(0)~
V(WNw
#aLB
,>v
~ ]XpzO
2oSo
)PN
p@M
ci9d
Q?!J[(
_o2+
%%9%
VMSf
tn^E
:ubqb+YS'pyCf2:,qCc:RGw#"
GmzhUB/{12LIYmGnTyl?aUNH
T)#kR
R-c&Pw
Rz>}
&#v3
Q{W;7F
f1Qy#4;--e9Df)|tAb1wX/3D#
b$]k
"5Q3$
3#n*Ug
.iNr
^U_:
HG}i
1{C8
3LeVT3Gz[OTrN%:MSjh!tts&"
3 FLt
+-aU2
x3rl5r
6l-J
M|;B,
gmPW(
z>3;r
System.IO
WrapNonExceptionThrows
[ Lne!
g4Y}yV
(ah6p
w,Y(`N9 Z;"QpP R&V_iT%7A)
PS{
e5dc&3f
}LIt
]:(i
@.jG
w>y(Y6@V
]odHe&@|O5)df_2*(l#1Qb5 *
2OO:
!)U A
35B+
}iGNN
Y!UC
EzZi8R
& .$?
_P]Ww_-2'c/+_J>W&rRXpH0]'
Uphi
W }2F"
{UO K`
tAnF
,i4X*
tn%j0(T-Z6::f<:)^DK&9Z]A%
l<P1du
i#]9
9>k}
@og['
LDKK
$Va2
E'%L
O>aV/
sd*7
dRt IY
`/_%
9=y
#wZ6n1{f9^65T<g:UN&fmk_r&
iV 1r
u]_A
*| 1
72x-
wao
x8o{
T8*\
~(?Xr
/cdSp
s~X
5G0`
Jy&XT0
VirtualProtect
0fC$J
6%8UP
yj' |7
iNLwww
6U c
gwt^6
dS)1L
@@~W
3&;%
]oi>
ljC!
7Z{M
UQ|k@
eS<x
=u3g
bDS|
pn`|=
\0t=
ZcxL
2Ap'
Dayi?
duv:*
V\tA
y^!/
u\r
5>i
/x
~A(q
&Qel:)
v"$Jr00j?s'0SOY:#XYjj1?n+
c_|}
Color
\_VP
okK]
/#9IkyK
@"[H
4yVj
}pl?
get_UTF8
~sr*
nfl}7($x"QD]lNH@:zd#Zx%k%
get_Width
^J]{
^97D
&I!>M
obn|R
|/A_J%
G,]tCCN1><-MK-SYFt7qgQSs%
7mNN
ay5gyb<
3QmNe
n8VP
)w!;O
J(<FI
RV@V}
ct_S
ELfh
?@ P
0dZq
S XEp-
EXPm7x
+7?$
Z|J)
% [&
O0X;\
Q&H}
W;0~
:sX0d8L
Qn <
0W?Q
N>?~fg?
*}=wK:S
o.{H
c9i4IR4a~ya2vnoG"%/I;FMG$
/v-.
B9nGq'
Zi6@v"o
'fva
2[Y3
Alh$
sP,
%1S
u&LV
2`z,A
XdY}
ygt@
@]}M
]=?B
i?$/
; <s
b\~)
'37YK
d(#d
?wPY
TabSizeMode
)lJ$#
o\.S
yQ^]
M6Rh
5'='vl
x"D7|
t~%x5#
set_DoubleBuffered
get_FullName
T( >
4 O
57)./
a-'1
L8*
rR\Dc?|:,C}ckr1%B>Oqy3 z,
)hNOBO+D&Yn$bhkj$%l4Z*vj%
DFk^(`
l_,Xc
2 2@
Gq2j
(r00
/:w4
!5F/L8
:fnu
"kH
t" |
System.Runtime.Remoting
nJ/!&i$(>r!3mRsbs?`nYT):"
; >"t
Ep=qAp
pMd]N
GetField
WLM 0
IAC7
xnE(A
/,dK
r/+Yh
akm2
UInt32
V,MU
Zp4#
7GL
we_rnb5
T9';VHH']}-5kP7%3*vXt>~~#
29sh9EB=
_eV#
][n0.
j.U}Z
RE<y
bOVP
oM;@
iKvujB
R8Sl
1xC
:g>'
ServiceBase
uiUs
=&ji}
Mz&E&I
SQxb
-,Vn
`cp;|h%-1`h6Pq%orH/&sGx&
2;Ad"
AssemblyTitleAttribute
Fhi@
&Y7
CI~m
,R*Y
xRYTt
;8}rk+
pH[4O
8oux
'xW#
)T$C
9}gH'Ef!J]2:H2$DO#XnOE;V%
drQ)
7eS0
F$qs
N5x x
D%a+<6t
u] \
qZpa1w#
C6j-
E.j0
-J)]
Je/Mw
Vq?z%
E~gb
^/6?
|o5H"
&,-W\
h^ ?
:y7j
d$<
ECe
)J=Wci
|gMl
E[BF
.q^Uw
sq3ijQ/
Z^Q2v
% Gn
A ya5
v&je
#g{T%
Ry1d q
1cHx}
Y72c
njY(L
0fNH
gz\rh
J#?pm
$3P7
R<wh
k1:#v
%YcC
qyOz@*Z*-?'G7c}!3O /6B;k$
o|2R
F!f;
M5QLm
45T
jhnF
Zvr]
Onju
6-"0
+c:
]%{E7
get_Chars
Ao(|[~_Sp_W`iqhoJ?AR#O0;
1'i9x
DY<]
73xL6
C7US
pj?(
AW)Y
O _7
K\ Ys
E_^s
xQLX|
+2`l
&%85
Iuu$"EZ`nI =Dn'H3;@L'['"'
6 Td3
Yh@eE
[]r?JQ
G+O?
SFP,
J.M$
"5^K
<1`t
V gZ
cY^%
U??S
|8sY
-sYV
(_'\ma
fk'3
B'ek
Erf7
GM[%!`?
Smk,3
'7oHJ
Sh&b
+ YC
+R(+
"<\R
`o/#
Assembly
}bCW
8v1n
|^-&7
T4P"
#M&%
;;x6
7jo`
" {!
}@SK ]
|,
*THS
2xw:u
/mt8d='RIN$E\coqbx&~>L9G,
2V"
_N}:\"^("bJxNR9NRWp/xk/+%
0shK~
I,JX
cN5w
BeginInvoke
:Ot~
EKf&g
!e{=
P{M
set_AutoScaleMode
~fI J
Gu4II{2
6@:
V'C~!o+S%%oK77>ZOcS~ol$V
Nj+RR%C=
z ],8
<L*xb78
"7xJBK
}Egg\
?g;R
\Hb$/J|
n)%-
0ME/@
DDnVIfD@r@F<tTim1[j%a@Ln!
k@JK
h={@
G)ei
U\@V
FJ>
~zF'
gJ(9Sr
x,FMC
pupJ
h. G
$`O$
LmY-
P">l
rJYx+
_:=j
'.4m
do=Qr
BaD{t:
Vogx
i:/b
-nC(!
E:t#
1.CEi
XBxtn
FF-
iAM
EgrS
= wm
3Kl!X
E-.K
e8E!>
k$-$
+%G-
n]}A
OjM;
L%#\
u:f_
W)G
w|LO0=x2&U"ljz"ICJ1ZN1B}
QmTO
j# 2IdV
6,.ln
T6O'
nlS|
Ra;B
vrcjL
AssemblyCopyrightAttribute
<VRrU&
P ?8
~F~q
}G,
N\ m
#"#P
-$#o@
)xE{
ca^fM
!< i
7xvU
7/dG91oHJ|'CtnI??XWKFDct*
XTxz
"SpMbb49@][YY'|M":Nt 7Ei,
f++X
{ X"
?qXv%}
:n>nl
| V`
aQ`k7
mmL5+6[JgId#vQj"Ei;fkfyc$
a?1R
cEum
c2PN
[l`
/A%u(
G ad
CXgl
@.38
{SoLX
sWMZ1
enFP
FMc_
Y-w'wBf
w]@Q
9Wh?
gk&!
4lK&
<uAw
@gej8rpgPX
eWcwM4jpHNr3_Xf5g"w^v63%%
?/0>~
TFoG
a)E@u
UjE:<
get_Value
%PZ!
|0Xi
\C6O
_d.X
G a
'jWOl
V[u ^
BhAJ
Aysb
J U,-15u8PEZ"F>][?2{3:%(
qH9C
p7R>9U<^M95vkIJxx53zZC9g%
a6hE
j5yD
)0*(
=P *
~&p .
e*\(l
&$gt
Vz~g
> nC
.cctor
oB5b
U.?R
v`f`
Ow c
5G\
-gr
#lC1
z-s>z
]7:V%
::v
a_KT
8{S>
h2oE
Y`ak
jT(^
{*WL
D"w~zlv;\UjhlAa1@?*(ty%>
& ]X
*+##>
*5-:~
Xr vh
System.Reflection
'!#1
uWXiH
$V)!g
?=}3
^u-,
W D.
u|W*c
%F I
=*AIO
p"Q[
TLIV F
]l:*
WY.=%
6SO ~
i KR
SgkkL
.}J+
qUkS-c
vr<U8
RA$P *
C;Bzm
eH{1f
FRNU
M<Jh
=q0]
hXO+(J
F>vG@1oxxo?GU*QjNj"T[wpv!
#m\}s
Sc(/
m9=bLg
~Yy/
M Pb
e>c)&
a',O
bvtf
H-o(
FlQvk4=@c\6kPb,dVl$}'U)00
"wL~
2v1xl
4NsE
Mz/}
%@RN
45!6t
|fqgH
q-C2
3WxPh
@"` #
6\R '
ad`e
>>23bzK
1hC
I]+j\-#bTzt9Y|1@6x7vCbc$"
u0OV
o;89
u60%I}YaNYY+cLanpuTnof=&"
b_dJ
!!QH =
\7g2^
{ZqZ
\ 2,#:
[9S-
9(;Vl
)iYd
N+^d
_dA3
pN{h
b,S6#>;H`$XZR}lR$duu*ufC"
rS2i
Bj@+
/I p
&TfQ
zIDAThC
WtTHog
6\d=f
As]@m,
'.mX
"g,2
#9K
%$c[-UT7}%#2t"G'9>Z]>bXF;
o`7L
2}|o
LL)T
;$~hl
x`\"
4# J
0<]
jG5l~Uq
A|cBOYo
,.pEVZ
,O!iTD
|Jhb
UV&/P?
ezC(
BqW
iJOD_$
1?M@
Cvdn
vAWO
C708234F139063BBE3CBE2208BB6ACFACBC50333
:8H"
z`Ow
T.&=
&s}Pq
~*a:
qkPV1
Sf0R
%h%xo
JA m
!+gE;
lo^N
utLx
$<{
e'"
c$ ^&n
Aq9c
N)3tK{
g9 :
/Qdb
"b*+ z
abLwM
STX 8
FIb?#8
FB3]
Xf5/
P)rRsP
YhP+O34M{Ty*,9yG",jf\%wa,
I#vzuNR%BpHOwH"z-DwL?UN(#
tNl$2` uB
<o({m/sh
xbT
J<~0
X2MP
ZufahCM-+
6*mQ
0Vv&
+j:6#R} {&D_[mwjw9zJS4%$"
4 c?\
dx-R
/Npk,
1Wh*zF
$usL4X6R]
zUp8
Gd5|
gFc>
iQ
t13Nn
wA<XViq!
}VI}n
`r S
kxw7
GetDelegateForFunctionPointer
yF4{n-
TabPageCollection
"voc
W|k<A,
dze7
N<8X'V
^ly]
A,[$
|,#
ResolveEventArgs
Zb"`L1yG\>5:I#]>T^nRE+T6&
guEi
vssr;
s;049\1&
BhGS
[[g[
s=_+&
%\?
laiZum
K&fL
z1 R
4_mta :d
91Wg
~=j{I
#8{*
G$f\=f
OAtI#_f9@XJ?%c9k7P@uwb}U"
eUYc
`U N8'
7~.>
62J"
0O(Q
vIo\
gJ2H
rct<V
kg8j@p
ebQm(n
:w]?
Mf P
#FLx
wtG<7D9#/h)p/\(W|]|3dVQ:
-ypN<
H?, ]
Ab#O
-%Y);
'qe<E
5 7
1@'&3`
`Xw>K+leAjG4ZfPRKtdrwyYH&
R(ND
j2;8a-3QF(^,w0%qC=Wex2'L*
]%*5
3W@ y^m
Efp[}
\x%;
uRQC{
@]S.|
U)*'Qnx
a[e@
>[:"
>muc
get_Hand
\ F%
ZX?y
By)s
#76&>]
vd?d9
#zv>
VJ\+Ol9
pp'
8';!
N`v
Nxm)/&l
|L[%
cJyq}
3?%Ne
AssemblyFileVersionAttribute
<Gt:8
o)9w
6)#)G
Kwc7
{QX9
/'RR%
JH5E
q*LI
IHr\
#Hbm
[spE
r(_z%M
#s4&
lb>F[=}X/Q0JnF^eMFzSb\ g"
wl1k
oZ1O
>(DH
>SrA
7*UN
&.on~
qDBow
* pPx
Pr(#
z\]-
oi*#
^j-VP
:;T-{
'84|
B->JeD
]3oH
cOB?E
&|kS
7lzp
7?}E
(!PK
IOlT
UVRW
W>0\u
2:OJ
/;vI
8^hT2@zFrc|u+am~%l?Dm'cS"
FieldInfo
Font
<f=Z
};dD
EWir
2Rl}
c>U.
Sh]Q
%R:@
axK>1
f h^
\A&=
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
muw&~
K-km
u+DD
d(/ /
[9UN
-T!Y
%47!
( `\
{La=<o
x-~f
+4yE
s5iv
[j}D,qR;f!f:VX?4]dwPk$Ww"
y_f)
rR,A#
8{.yd
YSOJ
RHhn
Obii
#P|_n
v7Hti%GdbhSg+HFz2dqZ"#dW&
Z1-O {
lz>#
VqNaU
Q6"P
3+9p"
+F]{
5wK7
MsSb#
/}O^"
System.Drawing
LDv?
d$[3)
A\dg
)` Y
X8+
lj>;
-XT+4BAfM#A[xHM:q$0X@{uj#
N6}
y"U
D{RWH
5,-F
j'i}
wP=D
E4bf0-
2Ae
E*%n
UserControl
ejX/uuA
get_Enabled
| t{5
n@7my'z$
*%v6
y p
3 6O
0ql[`6V)R7p+<Y;7vt5f?>CC
jBz
su"'
L?bvI+
|=ZZb@ct,
cxX`
cGkW
{(J3
3[
'aK9,
!(4RD
9pm7
V-*9
x! >
a97I5
X%9%
S!88
xH{g
,V'%4
Lw%?0
_Assembly
.LqR
"8Q%
,4Dy
<<3L
AssemblyConfigurationAttribute
yxJ
^J3rPkY*+
W`rO
l Vlq
~9_"
f_x
11\y/wnd/C8DBAHowA3cO<WX"
Y1>|
Yn$U
GRVy
7p zlLjN
4MOM
8bE@t
$2T-
(C+E
b.?`
0QWC>V
PV=51
E2QQs
%h8ut$2u
:2>2I
}l]L
|R:!
L$b fPA62dU[>jX%Fe!<g0"<
yr0@o
wg?"
{_CP
G5KT
I4/x
j mHtF<
SvJW
F=U'
ZK#:h]
qe6W
rPq=J
P"Ip
g~pHrv
XW39Z
'B3B~`Z{
6LstM7G
D7rrn
QT kD
cP$v
D4jb
Q*Wt
E0Fhe
Z#~9`
Hl}V\
K8{_
r |R
E&om
oI:{
Bbu)
= T&
%<Rs,!a Kejim?w)4C=Hg35E$
ghgd
U45A
#C}%p)'
0lp)
\2CT
{x1'Q{T2Z1jPc0|r"63rh=Y?,
,mv,
+&H!
[ /|D
a!>9
iKFe
2Z&'
! jD
V5 /
HpJc
( {[
T6lj
yIEh
^ }~
u*]
@wsH
YE2C
>kXdz
nYf7%B
1,cp*!JI<>*JGai=`'67wwP9*
qy9F
21{v
!oc_3_
Qv m
3Nz|6
<`$R?p
+_,);oX?"99GfM5YF&tjxA_x!
|m C
YPEO
53j0
+?7j
(Vo'
a8NM
R7I
FP%&4
I\L(
w#So
+|=.
K]h%
(/N:ep8
9z}!
"yL'
)FP#(>'bYLXT1Xu:eA-e=~Qu#
Hg\<
Tn0?
72'g
jk!5j7R":qw3(SU-"KU!,EVA$
ArgumentNullException
get_Major
xckgy
^NJojn2nqrII$q\h^yA6L##>"
z`!B@=2
,J(+
. 5U
1 C
8N+a
Ix
v2.0.50727
e{Xv^
l[h!h
J(^%
JI~;lJ
gok
sYW-
;>dp7
#AqJi=
^RqUP)D
eryX
)-dmW
_umB
Ou]c
Op(e
8}spR
7X|w
OrK2
eX "N@F
0+a6
!)5B
a 1b
f<Ia
~8R(
,;Js
g'o/
)p.~P
[OR)
"8**
hI X
A?5(b8p
&(PK
Or6S
]E;?U@F!_}dN;h|R8x^RW4iU
DT1]8
<u('
TK -
N_r`@i
mxaP=
qOJ1?I$"1I^U,g09=pd2pEs'
Slw&
XK(.
s8?dF
;x{M"
Hl1
[ c8
1 mK
AjtC
S^Vj!
r J%
82H;D
H4@XL
;#Gm
}OH 1sdmJB)91HB=7wIZUA%}!
?Y3XJ)4R
fP7=
j0f8[i
()Ak
dSRP
+Ez;
+Ur
< < < < < < < < < < < < < < < <
kj^;
@ u-
B7c^C
W<{t)"`:wU2ib^IL&@?;B;`<%
Y^4]
po3`P\
7/p[6
IckFbdE_(w#& E#cO0Fc*sO4!
y03t[9R$
~(wZ
-Z9R*
x/iZ
:1k!
/XnE
Q.l+
J'<7
}{_O
set_Font
s y'
GetHINSTANCE
v+ |
aT6u+
2s]mWUMn|6sxR04AI 4?o,2M"
pZ[_
BF1
b3aX
(LZ
02W7
|jSrI8c[u1{39<+>ydhIeLe^!
yfD_K
`c# ]
4?kVL
*a8
S.%k
D(+@
r_-J
l-It+*N `
b9$V
25ryw
s WO
e*y$
<z0B
J_; `
22K :-u
s:Th
(ige
!< a
8M2R<
Iq|
{a`W
[AdPe
K{"ob
value
'14Y
2018
7^IU
De;{
IzPX
8IFxN
OnMouseUp
+cit
,Ubjk
FjCWT8Z@z
Q~0>[
~{m<
/JO_O
s2c[.ZK
\n'Z
}|Hz
0#D"h7
.TeR_
wqH*~
O^CW
|=u(
l]6Idl
8m`u
wT})i
#2NL
&eQo
H%<>B
&oZG>
yF F
F"$q
of,h
T+5f
{NoKA
@W^`
Fa '
ERJ,
get_HasValue
Us`J
Gpg_
l!O!
)8QAgn
<b`;(C`FGpo\nuVLUpih/7Gl
Y?D||
6aA0
svN}
o7aR
*lmT
=A:^ZB`t
( ,i-
C3Ia
H4$g
TabAlignment
Q!!
h -"S
3 <2
J@{=c
w"iw
ssN=
NW{l
CO= < < < < < < < < < < < < < < <
#g.1
|r^#O
! [IOx<
g[;;
3/mrw
B U2`
*x3\O
`|st>
${,,{
=4qG6
#MKt
qDcq
:wVn'
dl}a
+b@ L
DisplayNameAttribute
#i0x
[_X}
wN8X
f>KEe
[;_Ez#
h7{
L5 <
Ms> +e
+t;|
GPgd
5%_
\iNM
4{=Am
?_-e<C;l&*`pk30!xY?uf(Dj$
@fpI@
2hF[
c2(C
5h',
xt+D
s9 *B
5Mxa
WriteLine
wdEL
uiFK
{D [
g;)$
J; Bo
JL])
=r 1C
RiW87LX^l2D{}!m)[hY0&#3X"
!eJ@nR
<$|:%
[$GJ
G6pR-
LUKSV<J6rq:TwA8;7ed]hz_+'
Or:>L
ltL|
=D/
pyCdO
j$@Z
7&^h
=sc|k')lGDzLlN?F^LN\`*M7%
>9'~'V2[
gH;h
=]l8
WtUN
E 8(
|EbS
m ;1
h&+65_W
ObjectHandle
.RM8
BkHS
):\!8wCeTGPQ?LKq(Kw>NkdL
!Jz
T#KX=N
2~#F
?E z
M{8X
YSC?
'y+@e
_d[}
:+~IljB=x"fx0zmvE$J^+^C<
`%BT3
;jP~@
xAz;1P%
Y'>$]<}beDvZ11I:2R-"LEn|#
?9x)+#
Zl8W
VlgR
{CYZy
t-x
6!5V
1W% :
set_EnabledCalc
L|z=
KMRp
ld-G9GlQ N=(]hP]/c&SJD]q$
pw'Qs_
jM x
ControlStyles
nwN3
()g%
J5l`
Wt &
nuyKc\Qd
. f<
<M T
lC{x
&J/$EAsFty=Dr7FN44\PJ[w;!
?w>e
RuntimeFieldHandle
}IDAThC
$XKo
L<0
>#uY
,^s Y
0e0V8
's;DvU
Gi&K
`M%^
#uSs
sMO0
p!r7
@@0f
E&u<Dbh
Oh3<
! J\Q
,ZeSihzA+RK(=l+&1diI`!":$
;7cjx
'(9J
{F9J
e;];
Kw3_Gr
G'O
D%Ha
(''
),p]
V !'
TIDAThC
QWP3 ,`#O*N_[-?EF!;Igw7}
^Nj
((nG{w)
w+bc(
816-
?==V
)Jg5
6 K
LT!8
|>3p
"FWH
>ljX\
q]^g
{^\p
.M
M$-$
=Ni
SA/$G
Xirj
AssemblyTrademarkAttribute
X5mh
4 8Qx
9($
:LVmE
d#)p
Uw /-=C
A}(1
/aIk
Q+q&
Qo23H
OMTnCv
5hBR
0&xn
GetFunctionPointerForDelegate
>&n8
Ttv=
"6}!+
N(SaY
.z[9
M}+<
VqP6
]a]q
iXZ)
,#|)
}k@B
^NTnOg8
I v.9
Zk%I~g
: of
\Y=:
++j
R*v$*
_S"f
d*MZ
2v8E
H5<~
)~R_
=NI/
<T*2
w q
R>WG
!!!-
UR$ i
F'j^
I<6!z
0!+!
3a@h
S(myS0
>73;
b'\
_?c
=2Nd
.K%SB
5|l{5
)Sr27
|$>n
n@7;
v8T~S
{bm:
p'%WX
JWf&!
*`(I
"$K0I47AK+)#S{a&M8[O6Zk`&
n[LS
x%-*
4JE%
b~UB?
I*n*PW4ty+6K= L#Xi{HNmL{*
EV,ACis+M\$4$VL+4XvT%ke?%
:d8d
1I|v
CVu l
*1e!
H(>re]
T{>Z. ZV
]sgd
f 1/{{
:=`dGik
gySrHS/g<
RA}]
=a)' j
RK[nN#T^<
E8 OL
;l@X$
F'"D
Q;)l
U <9
M@-oA]
KdOK9G
MD77
8GS4]
Soz\D
t $FJ
x`inP
*fiA
1p?x(s
MXjkN+s%L/YbU8h:S#oM&0:|/
T5}6`
zweP
~A^lY
\tS#3[D cI$#HbD/*s{3Fn!X%
F:XO
get_Default
*MPY
n!i-
kernel32.dll
wqbJ
Q[ cQ
}`Um=iU
]~18
6K6
t'%_u
p*H\tT%JH>D8E;!W/""<)DAK
\yHJ1
fl'0
O c
GetTypeFromHandle
^MF-g
~i_&
H8 ycI
iOSM
1+;]N
5D\^
L'0 X
>A
=Ls)ht%
1?bL$Xu
HayE
[Ud<
@A4AUQ-41U}j/>u];X1,F`@M!
bsB=
S(jv"
MouseEventArgs
>WK_p-svcfFsZ?HnB$iqAGGn"
d?ly7
$9`8@9tXTl0(]g>w7^wla{)z$
E~}@bT
X~x`
HIxN
I$Jf{
f cJ
S3kY
-Y3
>Q +
CT?WE
sIxI
S{/'
r|?]
irn>
OH\0
[J2[
1|>b
kT'L
XJX*V
++4
%`Hc
GwKiE
Write
/9I K
OnMouseMove
qEuO
vr~x
[&Fz
l?d0t
V@,9<'h11{ ,/QKQt&&_}BF~!
|%!Y$
<oLv O
Ofb,
g|(MO
hWYO
"^Ft
A?N,],
)i"D
n,oco
jQZ
PRh~
y&E3
i,.Nz
JbZ4'
@q
@7%30
5maz6/
xsG^c
5k?V
.;V5
'C\*5
}%O_Z
Console
{aq^N$Pp3XmJr]ZUb,?'lHwa"
E78%
@w1Y
dOE#
S--D
/) au_
+rS'
uPN
HbxN
4c\9G
^E5o
w 0%}
?[.G
XmLt
-$/ x/:
tu|q
cqT1
'yu\I}'hO+Q@j%HSe-[plT#g#
K]0*
N*Fd
}C?i
;1uO9
hH<}~
kF!
drW[j
E kC
2gw
KL[8
}Pu
LmrM
ulC8
Sk <
R]|N
2)KB&6CaZc$wpLNLDw~|(-& "
}IM#
<+\D
CreateInstance
] TZ
<y+q
&O]PR
o#4a
System.Collections
ZXM(!
[]Io
N-`3
&+9C$MZBYn(O!s;t&q` 5A0//
p02t5
-+1
w}5s
BC3}
Environment
0Aw[
)':XVO4KM[Th9/jTxu^~|qdf!
zQDx
?YDc$#m
g%fY
B}^i
bHQ%
;fp?
FSC)
wIQ
get_EntryPoint
Jp+J])
=wh]
d&or
fq3C
L{![
47$aX
-jr*+a
C q%
AssemblyDescriptionAttribute
pg:F
$B1vt
:ZZ1
=ouG
bT0!zw
S ^u
Bx19,
s&SA
lu[O
%4w`
r+80
?/ r}*
U&nSV
-G52
'MsLp\
Intern
Ms*q
T4L2
x(#W3
.d' 0
6$35
!&~
r+S
C5vl^
UAz/
oV$*W2
j,{'+
%Oa(
+X%>
T?I5(
uu-N
\ !M
8\1
}h a#
/B[k
BF&QpG '85-UGmbT<5>_b2O?#
bDoJ
-8O
kOxl
EQ R
U5C:
~@DL
Xc,|
&E/qH
;K0c^*
4eEG
Hmc<
*%C=
Sq %
hgbj
+3 N
+DkH
JoC*IA
System.Core
n=`@
z,Ru
A Wt
]n<4PY
O`,
. 6&
Oy d
#Vn;
1 ^|+
HgE^{efn%DOPI2QAs5_{~flD
['C4
ModuleHandle
# t|
6+'Z
h-.
!`E_
: z^L
MZ^1
jP_4
Qd=U
846x
get_Length
icjbn
; ^
_L^E
E.":Bu
}S=
Df}[
hDgd
r>eH
RFH
GLzs
7zVT3
h9N S1
b0QI
.)/
zm-KL&
g2[!
u=Vvl
< f<g
iU j
e=2 `
JM.7!
jDD
@iCxF64pFGA$,,UM=H#J;ybn&
|H/m
p2/!
(bg8
3E,Qh"]nHl}*K)H[DL:8:hdQ$
kO}lX8Ns_9zo:eU'~5?Zs>T:#
)Rjg
Lx7r
~!:$

,{>
s5C3IL
qLefR
ZWXB
<^o;
J4oQw
Ynv
x'9F3
&V=?C]
) Nt
J{u\a
XMgM
8$]_#O
$zQ
68'@
KD#`
V}'IR
nvtN
ABF="
1R^$
*,V^
[ X
yjN
?z3m
ua8UZ,v<`I}:Z2AA'2tPTKZo%
pb +
0E>+
A`p`
sct>
h*/ '
;99DSp9.}
yrti
yd;S
J" {
7*=*
Y[$;r
ot<$
m6?Ro
LmQZr'>
5ge^D3
Data
^&9'
>E|A
{^5b
3cl2}|
Jz.%Y-
&!07
pHYs
%= A
iRHk
td:#
Z]U>
]@`
{mA>
,fr~
/`QJ
1Q -
s`YE
40U-mC
^`]_
o%9\:Z
ziJsv
Dp3om
)[ K
JNh
C> w|3
KOO/;|
{lq--
{v$/
bWE|
xH ?
Wd#y
^U;sDP:
mJuv
r!]E/5
oVl{|og$#
!1e
1Ry
AsM)
PHJ_h/U}6fxIa|&gU3hn77r#!
L<B4x
CWs0
iJpf
n/Fo
<T.{
#o 5
|KCV
E$YN}
6=FM^w
8E/V~
y3rC
c#5}
aCL5!*
ByK3
K7>9&
^\w-[V
dIrpJ/ABq1{=0rNDK,5lb5jf*
jK>6w
n C#
Qyk
5=kf
dP3?
C}G
mdd
RE8v c
z8w,
uQl.
27&r
l$!h<r
=ZA82
p<KZwjXE<zK"-l:u]0{ U:R5#
FreeHGlobal
2?rP
G(+L
6f$a
{iM`
/k:*
!_M&Z
x6p
Fx>P
l4n)
j^6]
Q*4$q7
T>\m
MVvzmm
t1Cy
_M%N
{=c*
Z[J&
Iw0A%.
]2}u
LSGSM{
d8X~
)D@]N
/DgF
DBrt
ThsS
3KgK
[rK
__s9c
~ ]$
~cqN
f-sl_
u;LS
y [{P~&
|f ?l
?LOMx)
hAV:Zb@f$
agTD
H+AZ
~0ZQ
snJDXxN
Y|f
jg.s9
7I!D
fiVKYQ;
a-bk
})/JON'i
E%@5
=JG/|
Az<4
X~|}
!/Pq
^_P>
MmUAiF&m|#E%7bBw<_|PxCBy$
xx ?UDW5
fg,
get_OverIndex
i yR
n{,j
6I;r
W|if
rP1H
xzOG
"CyTj
]v&vG?Stg%Fc[1C''?+LR4AT#
btou
"Gw~-WiM
Y? =
iI9F
?w8n
IWin32Window
j:zR
2k:}
tgvq
R2l@
mT u
sv#$
f%Gm
ReadByte
l?g8
#u5N'!
n$WX
Kn=x
}.E?
AllocHGlobal
[_&mq
0%.`
(D"
8w\o{;bR
4wEsu
tQ!$BQQOp>-lz+an3uD2C8@j!
2v!V
#h[|^G_b\|F#&ai,7hZ/rk;b!
Zo/;>h36*tQ{
9,c,r
u \
\42N
&8j%
X^+j
^a/}f
<Module>
tCjB
x{m{b
io]7
i!$Ju:)9 np7?kQN6Ii)_bFt!
6J|C
set_Enabled
J `P
*wlB
}&bq
Etf"]
RUoU9l
4O$
xyir
sAZ?\
Jld-p
MX"P
jXQ M
:QgGVM{@"G\soAJqiYHHtjZX#
CWSF
+Po4z
o!Ri
8U|[
?}a$Q=
{SuC
NSW1
0s0I
Ye[pMTOl9pw,tB%YU-@!veUz!
AutoScaleMode
{M7v7
Wr/R1
?NV~
frk[
E|4
W3`,
w Q
6?Zcz
E1uw
ZVe5
]pMu,
h=hp
Uy|b"YE
!BV!
rDUf<
%9I e
c]s[X2J`4zrdt7o*DC5z(%Y-"
_bjs
O~~l
=Ghf
P0jq
<+sho
`KM'
<e{~O
Vv5=
HJS(_}v
^%h'
aeq~ZFPs?%xN)>Sie&oHS`(&!
|3LhI
<,?[
6LB`
Append
Y6r
y|7Y
System.ServiceProcess
op_Equality
BEN@
A>Fg
\kS
'.|/
W'8m
+-NsmC'hx&>3nfj3!QR6`Q9b#
\/u/|
yCf+8T
e3B\
9nj;
3z;W
cR|
zb$g
~"a~
QR:AV b
g31~
>-x+
Tny &O
[?KK>
u6RX
?Z",
,!8
:i;?
.oe)
1ZQ,&
E >mI
X 2TuB_#;$xBUT/X=3k>lE X#
Wx.v
j?2
F,Emw
9S_b
qbBy
^x)8
1ST2<
w OM(
Pq+X
get_Message
8_hF4"!&`WqQ8Rw4b!,i<dM]"
&1 =
callback
6{^nw_J
cauv
-U)d6
i3 s
jP^
5g&6Z
iS?H^
;5v$
ZY$ )
\Nw8
:B$O(
c5dv
R B>
4E2BE99140D24066CADC84F74FA899FEE5976B68
oP|ly
> _k
_Nvd
T36v
"uzC:Zr
'& yDz
7Sr+
Nyw
wIBp
Oh(V
POvm]Q1-FL:!#ARNJD"ioX(z!
:Y"_k
$|j
mys4
tU=4
/_\6
^To]
BSJB
h3<M
s0tl
U`P
J'8f
D7&MWG
gmCQ
2+~f
p(WnC
% @
[kX%
)#L~
,ayg
)(Et
sfhp
> `B
4=8u|'
g0ie
\STP
SAJ8
1!fO,
IntPtr
_kmM
M:u0\^<:o!?nNW+I~p6QaXK?'
u Z\w
>pL 3&
|6R
SdOL|N.
?fe.
System.Linq
C""k
TAM!
eH=
oDd
&i+m,
YLIt
+/ 8?i
c1kN B/>sY9sLs{ 1g S]rx++
InvalidOperationException
1OU4c
#m_FJ_i04eb)p]'GG\2CjB_\"
v _=
_DH@
t6n%
"Kc:
r Oz6
pDD4
V/uM
<&ieH
CW;4q
L/x=
|#iB$
MTgs*
uRZ9
Po6P
YgoZB
PCpB0
1Far
&n?6
okNePsnCv)t-qY({\0bS&}FK!
z\sW
@w`
,lF0
!O}4
ze:
a{Wy
dz) E
? ZF
z":r
oQnsc
VW>4
7SnL(
9OEF
t$96
|$~x
ie&~
l8#1;N:0w ?'`Y=X%++ X2&L*
)o` B
s)EJ}WP=RjT#NtfgoS,\}%8?
8N:5
[q{?
Tgkm
-5zney
U0v.
sD0M
}E+S
o76eK7Gpg*I%Gb?Y`pTt[$#0"
#)Q HA
Hl)[H$TMn\'a6,~0 }_si[Aj!
\rdq
~O[]M
X +U
<0+8
kI w
EWZn
HNo]
5s @
D)Oag
yH9H
1MMY
`iK@
IEND
a B0"
{Bp?
0k#E
[. Y
1GJ:
4luyX
%{!6
FYN$
=[IS
KxH:
b\i+
8 }=
i3^ za
V&,W
t/,"'
{ ueM
C>A xZW
<7I/
dfjSO{2>d]OWJ&)J|5R3Q[E&#
-]z\
~$nk%
StringBuilder
;OwO7_1
s^]JP
~IikP
IU0m
x^60P
NWa?
X[A/ \
%\v)zOp
v4foQF0/shPZw8Py[4%HE(8o/
L-If
|'-.
quTz
<cFl
M{D8h
$[qgjd#m)/98nt'x81(I|=f#$
'(Lj
l{r+
)bY
f!Ujrf+
wr4Y
VYcF.
J;[q
Ywp8
`St+
\14g
yOW`
o/Yy
,k\gp
GetElementType
5FCc3Q
(+
k02G
b'nh
^%u.
(b)2
D$>P
@i\NMXtJee&0X(?Z:@q'*sT"%
6JA1|~JaaW'J>]'U9]f8n}5L!
9'Em
E_xQ
aP t
%bCv
${}
Nr91K+~YevUSoY z})B *O$4$
Encoding
EN\(
iVPs
Q`)C
[o $
Cji%Q
9Eu
LILq
n|4eO~
2|/S
String
YI*(
A _eW
#hy B
iI}2
qTt=dC
Lm[r$
2XhT
InitializeArray
E[d R
X'JAP
;-gp
H;<EW=}
hYR.
2agoD
.^Ts
bA?%7
qcs?f{'d vEH-r(nvye=Bl/0
]q^vA
w)F1
f{:>
l~<&`e]
%uv#
Ht|"2Aa!Yw
fER0#(
Y;-
*~q+
\gS-!
[,P8
1VUG
KJUPR
MNMs81
GaF7v
edBp
Q!,/
Load
%|DB
5Qb*
z/q(
G>-;
MX;k
*A[
,GNq!
dF=\&"jKJ IU,JfZW ShzOJ="
yfZR{
92n?
r^p&
1j(%
G}2*
Ufd{
%{>w
>Il3 *
90@0
6BcE
MIE
rTU\3^
Q}DZ
;%Ui
k _
RuntimeHelpers
6NG&
0_n|
gwf
rd,!KNYE0
h'-,lT*$t@(6Q(X#cy$6S~4='
yNg<s]iIq/H9%G3By=0d:U#V#
Gz*f
o~d@
aiL4be
j;)$
%\~_
&B
Object
xx4;
VW<x
F^ H*M
0,Ti
wT7&
K.hR\W5
mAeq" 8
j1'
LJE}
DM'g|
(/@(bY
U.NL,8W
33am-WaK~w
`0_q
Ji[*
QH`;
tFJhk>Rx\h3,{,O@Xgq+9|5'
ffC_r
lZJ'
`(Z
j/GqG
K68W
tl*
OnMouseLeave
1,$=
;xqe
.99/ +
X*Zbh nB#]"&rzta^(20i0lL!
. )S
x%k4
[ |^
A.@&i
F{_J
E&6b
Bp/h
:60~
bg gc FQ=Ig2[^d<#KM&sd}&%
/*giE
;%*
eQ0"
HVjH
;eu@$
k}ib
;i
Br=S
tN1)
rP2G~gk3_}lq0Qx<Qr!O[(>q
F!'C
6y [?9
:PMl
-X(U
Ne 3
TZrG
@t%9R
)9%
bqGcG
Kf\/
Q<Y!
Asyf#zi1R
,"^I
}6{a
Q&q
`'}%
*#ib
[EKGLH!&,Lxe4'cr<>aP15xh+
set_ItemSize
I}rk6
Oip0a3}i>Rx0t#l'>m;dJ_bn
Gw 9
8 h
rC
;2-O
j<C"
d>HU
c 6v
~Z/f
H^iIxCG
b_J:
0Sa^
b* <v
0 v
KF.%
{^V*
TRH&&
Zjbf
f^oW
|kR4
i4T1
#/Hg]
CZV-
= #f
f]0
ccCc
#p3Z
&L2$
n@v
xc^>
eWvcb
ssSZ
L8n:xm
8,;63r
s@WjS
h__S}\
\N&
*RDL:S
C648C0E55DD0A71600A3C979FEC05C180303B2F7
\jee[8 T
T&2|D
~Odi
/h5-L
hmL>
@u[a}C
i\(&
kr>r-
Zp}1
:Zw
F bR
vmys
|Lct
\^bXOiL
*L"|b'>
VsB1$] ;0qrCEKTOHH,'SziA"
wyG*El
#9%t;
h,'v
}BoZo
uQ^"X
f&Qo
Q!4Pu
^t1J@
=Tt$
IAsyncResult
IM4\
KF n
`` '
NPbt
)A~#
}%_c
ft7H
)URYR
(m9kH
0@(XZ
;lI,
jOn8pX
,&_?
3<\
Q~H2.
U(/.-
fJ7H#)-
d _d
P/0!dW4Nz%cH(s>}A5L^X*b/%
<n;/
dYgR/3
~IDAThC
wYK}y
P@k1
7J|\
System.Runtime.InteropServices
YMm3wFHaLhv_Gp<lcGQh$nc1!
#eoM
Y2vp(
@B`]54
K5X5
!~Bd
@/R{
WJ7,
6 -i
kfFh
yoJ,
e0u@
_i4/J
[ L>g
% BAu
F<3d
System.Runtime.CompilerServices
~IG
vk6Y
ECAucKDjK:"S-B>$-2yn^=vq!
\sw]
YbHf\
v"x/;
G`W0
=.RJ67
` :E
9kSj}u
-wn+q=
l8D
a%+0NB
cqnm
s;iI
.Wm,"
)1Xyl
!U. ,
fv_5
D(s1CLO9s_lmR1,(b~,9y|vN!
AHdap
Fgj<)
)x>y3*:H m/Mjea@aagys ]y$
Z( Q$
~/Hq
Syf\u~_
-e>Q
I,*5J
^Y1N
]a:(
JxY,U{]bM3`;Ar?dzQ5|)w'1%
b&uL%9
tNww
#I 0
L-AR4jBaa!:!ul*BmM#H`-< "
R v|
X.
st49%
>Jdz5
r<"'n'
u mk[:`
;OeH
R2f:t<xNQ)kK7d^LQsJxpU`N'
hSO{
c?BZ
jk{BI{LchJ23lPUW'G:Nle!4"
PV7$
HJ23
SMgv\
sEzpa
C$Gw
TN{N
zm>w
Ij(/
kzkV
Hu72X"
NGj.
;@&
1,M*
0Ksg
8\Qe
x..^s
!{pJj
4Cl
a).N
%v@G
c- _5
G'1KY
?F#X
.wGUg
6av xA '
Fm2m
'QDJ
jD!o
YdryA
%39O
1Qo+
;3q;
/4Zp
OR%={
vHh&342Q66wRIvQMhNiZxSmn
0b5
No|0g
KSNnV
/'/Q
,P2_
(I !
dRe.
1 a
^k3)
Uq/
6{t-
galn
f@j;2
><yU"
1.{=
1sZu
sj0X
PF%#
,MW,SM
disposing
Mutation
IEnumerable`1
{rwr
94v 3=
get_Module
LbOTX
b O=
:hxs{
;^ a"
R(9#t
4Ce
J*qpA
Dvd"X
pM
pXTZ
Cursors
V ?}
WYr=
EDjR}H
IC;oC
kqwY
: ~7@l
' c3
l?hE[
pM h
_X7:z
svcZ
pWp3
2c|Vd
]Q8
Of_^
YF1$
XDjM5i
/+3{
+FGE\Iqzs
um N
_eQa
lM\AdA&OH88@@+0lLA4Vj\S>)
System.Collections.Generic
f#t
b[ )
a|W'K
"dV'.
&VPB
]RV
F*Zh
;F<G
&ai)F-
n*Ft
A`2G
VEf^
System.Drawing.Bitmap
9vJM
)qX2
hl2[
v,rz/
.gpg
2z9Enb
_iu0
GM)w
Q3Ul
0zY,
CSs
,2ge
/FQd
k[U!
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven01_64 Seven01_64 VirtualBox 2018-02-16 18:38:05 2018-02-16 18:40:56 171

9 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven01_64 Seven01_64 VirtualBox 2018-02-16 18:38:05 2018-02-16 18:40:56 171

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\fer.exe.config
C:\Users\Seven01\AppData\Local\Temp\fer.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\unrar\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Python27\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\fer.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index149.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\fer.config
C:\Users\Seven01\AppData\Local\Temp\fer.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Users\Seven01\AppData\Local\Temp\8acb1e59-da14-4be0-9858-969eefdd5513.dll
C:\Users\Seven01\AppData\Local\Temp\8acb1e59-da14-4be0-9858-969eefdd5513\8acb1e59-da14-4be0-9858-969eefdd5513.dll
C:\Users\Seven01\AppData\Local\Temp\8acb1e59-da14-4be0-9858-969eefdd5513.exe
C:\Users\Seven01\AppData\Local\Temp\8acb1e59-da14-4be0-9858-969eefdd5513\8acb1e59-da14-4be0-9858-969eefdd5513.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\fer.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.exe
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2092.19266500
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2092.19266500
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2092.19266546
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\6cc4c6c0-31f6-4ccf-9b0d-505d30d70812.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\6cc4c6c0-31f6-4ccf-9b0d-505d30d70812\6cc4c6c0-31f6-4ccf-9b0d-505d30d70812.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\6cc4c6c0-31f6-4ccf-9b0d-505d30d70812.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\6cc4c6c0-31f6-4ccf-9b0d-505d30d70812\6cc4c6c0-31f6-4ccf-9b0d-505d30d70812.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2264.19272062
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2264.19272062
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2264.19272078

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\fer.exe.config
C:\Users\Seven01\AppData\Local\Temp\fer.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index149.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\fer.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2092.19266500
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2092.19266500
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2092.19266546
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2264.19272062
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2264.19272062
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2264.19272078

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fer.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index149
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index149\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index149\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3035fc5a\375c7a1a
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\3850e7bd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|fer.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|fer.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|fer.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\1b71387b
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index149\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index149\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.VirtualProtect
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.GlobalMemoryStatusEx
ole32.dll.CoCreateGuid
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.GetStdHandle
kernel32.dll.CloseHandle
kernel32.dll.DeleteFileW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.SwitchToThread
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
gdiplus.dll.GdipDisposeImage
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe"

Started Services

Nothing to display

Created Services

Nothing to display

Detected family: #Malicious

TheSystem Itself @ 2018-02-16 18:46:02