POS.exe

f7aD54nnkxbYjops1dGAqgB9nB0uQy
JGTdusS3NfUXhKMvqtQ3KxfgIeVbXhbClqmTOAH
EKBzJ2MiYA9WNET9TES3bqnn
MOmdEg9lPegCBW1Vmdtz
OGmzowiuCoQIHn1Kp3kfQo8EV
ptn5yn432qHrrOjBswDHunYm
whAXujCFceKyacBAt00BixRBr
wbJa6r7wOw6RPjBdXzIO2yJEcZCqasNA3Vi7z
Lgtw7P8bWtj8zpeBVHUSyZqU9asfotl8
cq8iX21I1JCKDFVio4NHODEMvpt78zXc8e7b6
h1SqGzUOfcQ429TIfzMVhu3og37hR03sy
RjO2bt5WZwrHRfUp1C4iV
KodOYTwwtkz8Edr0MuO7aeeBMxSHquaczAG
0ifcb7UuwQ59dnKqPCONmh
13iUyqyCaPWVSlFBSuzvEKw5bWstZMElnuM9KAm
Ll2GT0WHMYQCc82WnESHB2WzIavFSe8LSjTrT
bvccDoQxm9s88ihinu4X8
oiBZs1ZuPb0I8T4XxYOoCAB4OC6mLPJnsvV
ICQmyV4NbHy9CdNxXuLy8yVoMkIp
YaSvfHeQZPSRsgNc8LKfNWk61vfvAV
3MSh4YAlvRGhQICt4NKRZaA
ijzbEhADQ0oi6BGpxCLJfPbVJ93z0mH6yv3
XKazRN6zQvzeVay3Ny6l2D5qsGfKaJCVJyU
HHG2rd2p7zV3ywUp1dp1NhhxuonZRGu
1eQSxhAKiWijQgLfMBqIy26Q5zb9JEcSK
6NUAOoYjvXb7vsvBQkva
2ky6BUquBiFH9T1EOnvgb9uq
JTKVrp2aOeumrP9bPHiZ
h-Ha
h,6V\
D:|u
9`:Q
khomtE
r8F+
{
Rq|h
1+QG
DateTime
nfYB
gH;w
[65
%utp
1V3XO
U/
SGL!l
_$)Diu&K
@7&
-0!-
y*F'/%
>=_1
1Tdg
ConfusedByAttribute
gU<$
Idvd
Sk7b%
C2aq
VA[q;
!sPs4
~}T
;s_?50
|0.l
:
P1(<
'wWA+
}y6s
%hE-
IuG8
EAW/
9B>fXU
7+S1
x=)~T
;@[}
0NNQbv
o	D9
U7[j
0F^x
{>8P
}8
,,
M,4XM
ePH
y-&d
J;7S?2
un ]
Q*"E
o,P(T
lw
|
BqJd;
<]Urj
[1$08
gC_9
XI*4
"WMR
0wM"
IVWE
kz10
nGx
$Ndl
fLv{N
L`+,
sS%+
kUe/
lO~
#SHT
kjh"j
v.:9
iJMv
BX+3y
+DK#
TB6v
}whM
w)3
Mw/n
.Vfj
r25{
f<}z
;bSD
Y^8Aad
G@xQ
1WTz
+Cx8
4plAA`H^x
p!ZT
HwGb#
<qgh
m
^:
P~7D
GZo
e$p+e"2
Marshal
@>py
WY/F{C(
TY

=0
k/>Q^
w6z)
,@t]
J+xwIUn
=Nu)
op_Explicit
k7pR
mWKI
System.Security
yG~%
Y6e}%[
d@oV
455
LEbc9
sA|+
Au
El3`ZQz
5k,{K
#/2G
7ghw*`
L_
w
ncL'b-
(;F0Lx
AVde
J_	k
?zL
F
t
iRpK
w	;@
Xy&`
{XMa
!;;jL
-o%eP
0%4@
.{6l
CIKeB+L
g|pH2
sbS'
LQ(j
C-G
$2sr
1|#a
Qhhd
Axk]
oUC|
zz:_x
:7
aV|p
\>QPe@
-4FVI&9
Y*B@
'pDM
_UkNg\JN
]nr P<A
,DvI
Dkh~N
m93.
qw0$
G#}x]
#8KU
R7j?Rc
'%&8
%]UH9
I~Xe
`<.d
'k3cx",A
6!)6
`!5u
TuS
qO2l
T"fs?
#HCo
'u>F
y
>R!x<
`mVg
D>b:
XG1s
BRvX3
WS<~O
8)R{7
Wq$4
_dBw
uX1Z
\rx
C>\Y
)X<
yBp\
3U`|/
zf`R
;rSny1
XeFM
8,oG@'m
((o[
_d}
(s]
qtfOX.
ot],
AppDomain
#N'})
iV6Y
-@H^
x%)oZ
w@a$
vDxKl
ICQmyV4NbHy9CdNxXuLy8yVoMkIp
e~AH
u}Zi~
XEs"N&
-rV%
get_CurrentDomain
V9Z$
jVv
eDAl
+"K
DjaV"
get_Assembly
Ipjk
JE6,a
K'
k
@m9
;k$C
3%GP!
-kh
#	2
'>#B
y#
]_bm
iBW{
(k2yp0X
f1mf
!ov"
[BgO
p~cm
,V#
Do\wY'
jq{JG
qdZ"
hW`M
kP52
:K7
/^+U
/}#t
,Pk*
h<P<
9p%*
$*"z
UnverifiableCodeAttribute
UBr_/a
_X7Q
l9$8
F^~3M
g@sD
A/a$
zO.
{f~b/g
uP~g
Xe\
|p(5
#Blob
;#!
"[`b
}Sti
K	
2$
|snu5
+NLZE
D5ee
O,8[
N>*i
HSec|
~AF9
*
7C'R
$EI)
U-.1
sCxe
Vin
\3*7~
$0<fX
jhto
M
dA
|Pk
(?/;
oq$]Q
'#r1^&
qr`+
2o`J
Type
A\{<1
nVUX
krYv
k|)x
h3S[
KFmf
QztT
?yQ~
9ZlW
!|}K
IQkVwJ
9mJv
op_LessThan
GV>Z
]u1|
pQ2U
_u.B
vnfQG
'hkE]
?(+i
R(ro
|9$sb5
f,u
L?s:
U*7
KTw
{Sz5h
y129
#XKazRN6zQvzeVay3Ny6l2D5qsGfKaJCVJyU
A 
!G
8/PDtT+
OX9WGP
.Zh<
GYdq
sod`
X_ $6
=O-1
7#2X
a&5W
xmi	J
on
(
E..a
=~^H
_9)A
EHtj
MxXf
f/m2
n

1
OGmzowiuCoQIHn1Kp3kfQo8EV
E]uUkn
yTN
hJ)Gr
m3`^a
dK~
72813$L
{lyUz
ldi
)<`|
Z@'G"
;5[,
+))`R
EmCX
91),:
jkBs
7:VXY
*fX#F
n`/
"A%FZ
Zvac G
get_FullyQualifiedName
@h?[
9'|b0
mmr.
cRF$W
vJ43
a'$j
.sciNF
{&_R
k#Y$
zsvv$
J$>+
ay`n
=CzP
tV
)
il1p
m::5X
tXz9 uX
;7xD
jOnKY9
Kl8e
]*;^
bE\N
7|It@[L
_*6~
-,c$
DvZb
wp3)
EKBzJ2MiYA9WNET9TES3bqnn
-\@
#0@)
DialogResult
OTr[
GdZ
%/hoW
KnjU
bI-~
MJxbD
.text
List`1
I}_#
jcK
bP&j
rCC3K
CGik
X#++%7y+sa]
0P}Y
/C6ez
!z]k
o?[
GetObject
j2|w
}FO(
Z/R-
%Ll2GT0WHMYQCc82WnESHB2WzIavFSe8LSjTrT
B/`2
^92S
`K<Q
7|a
m5]7.pJ
NF|
|.ff
Un_v/"
(DL1
,v\?
B[3
e7Tu
%(P#
uEei
!hrf6
SkipVerification
7C-4V
jf2O|h
p(b3
huw:W
7
&tM%
_bu*F
4o<~XuZ
VM2L4
)
pq
*n	k
Lo9'M
t1Th?
J:6MF
b-+
JWc#h
%vW]
3}X
t
5ln
}=Rr
PhGz
E8PO
+}e
df6&
qRuR
w\aG
&TCnl
fN^[
5J9yg
,D[>
k=rx
e#k
_-?=
*,y\
/c
q^
Ae?X
j3.Qt8
j:1
rUa8
m|c7
m]F
w5j}T
q(ah(,
G~.%_
U;Sz~
!ay+
Ma0v
:afNi|
QWb%J
t"Bv
?.j j>
ZD(;
CdO],
`.rsrc
P(P9;
<r\684
:I#q
t*^K@
&w.v0P
)vW)
@o4P
,+@Q#G
CreateDecryptor
EGxr
.Oxu}
iN}k
3Evu
RN=w
]D%6s
7^`f
kernel32.dll
@BL~>$.
B	-	I
^$;}'
!h1SqGzUOfcQ429TIfzMVhu3og37hR03sy
;iBu
a
a,?
(5#0v]
M6bT
ZRyr
XID9
,%}:O
mW6}
d
G@m
T%S|
{]n
80_3
L__=
_=p>Y
,+iS
0h}F
FS/5
0_/@
wp|;\T]
zZ {
XU	
{
@=mc
&h00
EnOy
8Q$5
myL4=
DZ7E
VMe<I
V-:&]
Gjz+V
mFK6
ABpO
<	t#
OF}S@i
ouD
|MC$e
GE:,
$&	6
<#O#
ps37
?(^2
dHW
)Mp7
oOXV
AhF_R
$(H_3Aq[
+CA W
1PxY
7u{*
QT[+
/
L"
Z%&8U
Aq?i
B=s\
y?y.
_ThXj
3KA
JeIj_?
b @
YWPZ=
SymmetricAlgorithm
@6/h^*U
P"2
k\vWo
9,6G
BIE=Trg
D 1Ok
WT?g'
e-F0G
5ckl
*-V_
(Du
OdAn
/a`
+']i
*wu|G
5$%Q
sN!E
_/4
c([c
]jp`*
'	PT
-A"a
RUo
KQ.l=
*1VI
5?S`
~MLzbYi
Tj '
5Qa{
(tV>
%&8f
Tur
AP7!
1zZ~
0[k,A
~qCq
G
;qM*
kUi8
v=V{
Vw_ft
mpg6"r
2F"
8n"q
B-Q#@\
.~%-	G
9
fd|-VR
hv:i
-V_2
Gp+}
JE~@
#QF2
)Dg5
Gzs&p
&Dc@
(e-c
oPCr
w|d
_]<;
79V
cTga
M"3&
*)Q1E:
6s*
@2t>
{As&8
J>7P
s+Y5
ihnZ2
WrapNonExceptionThrows
get_Now
!
=
n`i5e
$^4
iU<?
g
Wt1%6

J.EJ&
zA%B
.M[\
9u)zo
&Yy)
J)M;
$"oC
/x$<
kE(
687x
zc":T
k8'.
zG%,
Ia3A
]B{q
I9#/
Ij^:
FL@T
h@\q
-;+Gn
bxfm*;
Sux
vt	2p7%F
J? Ij
ax=2
^&WJ
K2up@
CuLO
;MTn.
YQpYC<
Y.1[
|G_;
AJ1auv
5RB
Wzu
W6*b>
hU#_
S<qr
%B+
}*'[
*.
t\
X8AYo
.	, ~
rf#
Tw(}
tE.Pd
uS4)
he^/Y/
3MSh4YAlvRGhQICt4NKRZaA.resources
A?
Iu
Eu]=
l%?]r
$fz^gT<
TeR
C!'eA
con@h
y
I)
sYq*wk
q'S
JfE~
b<p@
r^OT
;ZFp/
`VzM
kw3\
=6l+jJ
{*J_
jC#2&
=Rae
System
.pO7D
L nesTf
6Mf2%
jUT/
Fk{!
ptn5yn432qHrrOjBswDHunYm
oKG?
9VFr<
Oxx
M|(0
JS?<_
%Uoa
7Rc
0N]:
6Q4o
ub@i
2-
|2?6
].Hzs.
~mj1
*bQu?'
d?Cj
)iNi
v2~i
(DYM%O6
HY\W
9tG^
|~it
#CJi
l*\
MethodBase
#Strings
4fF'9
%MUx
Y~:G
t4d7
),[cE
O%3+V
_,[^y
#3_
R3a?
RjO2bt5WZwrHRfUp1C4iV
/\v>
O_2.
m9~3
dcE@
^	7o
DWvr
4&fX
,/p]
\}7L*
N4L
77B
whw`
]F_	u
VirtualProtect
rJ*+/
g Gq
Q,.
@Wh!
"\g~I
[^x
bPM6Y]D
9r[G
}xh
$By%
get_EntryPoint
vOq_8
_nn
0&JE
E[\#
\V
b_
S"\d
i;3V
1`1p
:	f_
JU\!
^4I^
n	9l*E
Rkp+
EPP?
f2g7#
-"Y}
rp<
$vmN\[
obw
?/u%
A7I&FN
,
6P,
c-;
H<<-
\o{)
N"Az
#O^X'
Ys\!
-}cX
H{'R
z4>~
O 
'59
?-;`
sI`xY
".UdD6o
^sBJ!
G^$Y
.(UA
@	b
U_;
=bG
d#(-"h
!3gd
L7Gr5
TQk)
2zyX
?YQai
:Mj\
Zm>p
AqQf
#8:'
&t"cll
l*&{
sYZ%
{UZo(
eD5f
:!4
QCbQ
ytt
TU6SP
P\5|]|
"VEiH
EI
\
Jk(p
4%Ju
q>(?F
nc/y
fkhz
VcX-
u136
2N0pW
x}@:n
R7]A
j@gs
EtmR6
U7Fkv
<2{-`
9=S^
.ELk:
iuaNd
4&Zrb
Rc%<
|=>f^z
*Y9C
I|nL
L=4A
3>&
LX_
tLjw
V9Wi0Z
9iW=/
4JPr
<eeu"
sA\}
CF3X
1~ 	p
iiF_
iJ_$
>+i
CCOg
M:@y
b0fK#
X-.:;
p)tN
$QNt
*#*/
O"g&6A
:|f
)r\F`
\a
4`N%KK
r4tY
v?"5
T|UD
^}%t
P@xM-
(Sc
g|7}
0$cz
XfwH=
$ Neu
K)0g
fRC'
xd3O
(#|N
3w=+t
Y9WSa
:?>v
axoCs6*
~FR
!9MT
(@o
1N$4|h
wsd
)
:V"K
~~nJ
PcP
{l9b=\	fds
i1,?
$BCq
4.j;(9ek\
-N<YDo
`f"'
"pXN]o
/yZ
)Dc3I
y1#{
O>1&
Pee6
sm#y
%pQ&
_]_S
.SvaP
,a%U
h_	b
O(@z
_Fr{
bM!|
9-D*&
3y_
lxt4
*6(O
B2)?
Y-Gl9
=`F59
+i4
N$B`
b@su
(kA1
'13iUyqyCaPWVSlFBSuzvEKw5bWstZMElnuM9KAm
O!2t
KNZr
w@AGbBBQ
#RJ
H
Q];W
Gk;E
)#\
j\WS
ZuU`
[#yML
RK4X
UJ]5
Ngt0
L.AW
gq8W
]&4fm
1:fa"j
1s!/Q
IfUl
G#Q6*$
_O-M
]$	m
:tnf
} Fl
oi,g
_s)sZ
w}Q	*
]swz
L5HA
OH0.
/\g@
h05[
$R'FK
P@X#
soF
ao%3`
k4yqH
<tXJ
(icG'
Y?JN
"Qv-}
Ac3w
hFYD
7[|T
`78+
?zk@Dj
+TRP
P?>(hC
6Qj:G39
DEvY
[
^w
i" \nr
qv-N=
%!m0
o"U+
S9{.
jR&#a
UL8
HrMr
Aif<
iL{o
u+X|
Tk6&-xj
\6<P@
X2zq
\\=_(
tZ	#w
z VbX
I/4lx
lniTPl
Rvx)
&e$
>#Ld{:T/u
Rql#
@
40
``R
OI3(
}A3U`
F6^yh
xH-~
,Al3
2TD
;
_v-
get_Length
gt+_
>\`"H
\>K6
d C
	g
=.LR:}:
\z* "
Kr"a
@<`jWTq
Aed2m
8=yo
+
8m
S^=
uts9
9[ ~J
q pH
wKU@,"l"W
>9E*
y3eH
'o"
*os
i-BJ
<^r2JD
F+"A
bsn\
^s<%4
rhBN
5^E5
#Bp'#1<J![
MGeU
#sc6
"+adS
YTv?
,OY&
ry/j-#
Y
T|.
BZ~;
&H6-YPsd
,/sW
vkKr
(G%
LY.
Qp%J
t>
zb-}
_2fw)
i0rm
'J9[
~BJN1x
@@jF>z
sv%R5D
U64^6
t{V
.-W
6t
i<x~
uv-Rn
q6Uk
OWzNQ
M0
l
2*Y
d
::]`
qL+n
z[k%g
,!S|
I5 H5
M 8-
w{4_-
U1J
Jo@c
<zaC
*.2e
\	/LO
]K$=y%w
~T\6
sP6q
(JVw
_V;<jE
dxgw7
GvY
A>o~3I
UInt32
Zjn!{
_JP?C
$ IuT
~b2
'9r
'Fdb
}zOn
Bc1=
.?bcl
O4M]>
ku;*
H8YbC
/z$]5.
e

0@`W
HHG2rd2p7zV3ywUp1dp1NhhxuonZRGu
qX7.
CjQF
P}(G
Q&6/v
0	,A
@DqF
SDE*
I]Xc
3|5u
b&N0
6z*
!/@W
a'^t
7~tn
q46K
Sl)L
C*@h
Ea7=
5zuw
/Aw+"
D~X}
OVyJ
}L_)
"c3h
].uZ
A_L.
_f'Ch"
&51t
@	 C8
A={*
4Wtv
MszS7
ICryptoTransform
l#p
z!'
y'pyV^h
O=^s
YFh0'
aucd
R_CKi
Veb]
up,n
uc`S*
bg
Pj&p5D\
G__d
B%Y}L
i${
1h
~3%Z
)?*{=H
sMUS
4|An0
Kj-!$
sVOM
k'}:
H`r@d
Kj~p4j
)
R=
System.Security.Cryptography
p]
}
G2-8~
sm4
^-
/A&O!
L}gI
#oiBZs1ZuPb0I8T4XxYOoCAB4OC6mLPJnsvV
E$3\
]ic}
>m
L
y}
x
.U3\
piwC(/rE
mnw4
H[D{
n%RC
"S<e{
%~?M_
$u@
=r%<
K?*L)6
Yt?0
l 5b;
_tw#?R
h*,g
6[$F
vNR
m
z4<y?
[xV;
-rGe
H^$T8
,X9~
@2^\
jVOOy
zzq4
XOZ`g
I:HB
KS:&
bi)B
}n+
H\)sA
3m^i%o
|0r%{
X1A.
yaIT
2HM:n
y5C+\
Q*op
hDJg
Ph/*
WXjo
H~mMRkcZ
i
U
gfKMo
f]$[
/r>k
P
`g
l=
GA3D
|t{p;
.ctor
]P&n
g45R
{'a+j
Q=M@"
!}
/\MxB
h+!%QG
ph[6mG>
Pk"g0
>K	I@
--*-
:%W?
B1zB
/C4C
=_e3
2eqsJ
Invoke
GdzX
6gGu
o5Nt|
9:gU
Iu
)
ofmUB
zmk|
v+(k
V^lc:`
\System.String[], mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089PAA
<Dz@1&
S@reK
yyNj
i|Q
PJ
#?
%HU/
du$46
# [&
FnL*NQ
1EP=&0P
gJS68p
w$ZfT
d1?hb
RaZ}
NF2}
GS7X.{
:~a(
qP
j
@rQo
8dMBIJ
e
[PZzi:?
Pe?[F
Module
S59|
;G.R
hT*=
iY8k
_~/?
.9u{
l4q[
N::%
'rM
nWrj
D|T
c!V+
/vm
*
 
7Gw
I%j>
,sO1
)<s+C
@.reloc
SI99S
Kl}l{
?{_1
`km
Lf4
y2L3
$M~N:
>X?)
WqQY
N;3.
"7\VS
'MX$+
=r7B
w%,
Kr^v!
| (O
J
!d`U
1b
get_Chars
e6
s/MM
hca_
QQJ
6bm
]q)HX
^]HV
/@=Q
{
lO
!"`p
o .8>g`
d|tb9|
Ob(8<k
IPZR
YOA`z
j5in
(|?(
-|<]GE
x5:wa
aEjY
aV"3
tRlS
QCHJ
},(h
uy:t8{
Dub3*
MK!e
C5f1
)7f
f6`U
XAT3
NLg|xI
bo(@
e<y`{
D\bm
MU-E
MessageBox
6)^Z
Mzxm
QRTH
55B7
`	;R_
"At6
qZ X
.sjZz
03~`
Epdx
DcW
lBqM
~I#Nk%
rbF
"<7j|=
duMQ
N{	#
[VrA
@~I^
6%Q[
~|4I
jZ'/L"
q4gsn
=(Ic
7;kK
y\wW
F2gp
J'N
uBV<
8.&~
_{`qYTp
h(U`4'
|(Q,
m|
D$F
@$$n
[Vs^u
=M%h+
mPaKX(
\^*Aj
3-:Mu	O
1NnE
fw`w
REi$
]CJEfTR5
+K/&1
rx 
\
7J.k
+2
z
gPR<
H3Wn
RuntimeCompatibilityAttribute
#<xD
*oyGVH
-3!>
jr`^j
L4q\
%1!7
W_Xf
0$yJ
TyOQ4q
4g
\a
Assembly
"/q?w
b7\:r
oo.1
;Rc
7Ci'
.cLR
*Ix'
WN?bX
oW 8
HE(N
KI%
PGu
*d.
Z/'6
|cxs
3J*6
=GJN
1Kh,
P1
h
y;k,j
}uS
H1!W
]Ls}
;P&)
|MX_s
w=OI6
FV\xgP7-
J42zt
w?/
Ch\
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
jsh_
d{1L
$;m^
[)*9
ruf'9'M
xoYJ
ZK@rM
O[)+$*
..}Up
Z|dL%M
LAdA)
(Vg\
Fu7
jd]]?
Y^DD%p
g.E!
{Ss#}&
4o
#
P.p'
o4UX=
m$j)
bX!r
YL5#d
3%p!
c's#
"%/[
s=%1
t
{A
+I3p
$ERI
!p\&)
+uK$_
N|)>
zMZ
g#	@jh
%U`%+
w}F+
K2Tb
iK}I
mAsi
L!{n
0bo?
NQT/[3"}
kM7`
DR	c
F}J1H
*5hMd
0\F
h@#B
6pkcM~
pyT}
`uO|t
o
hK
10,U
eaj>
MNM[
d
Os
hCs@
s,I
E{zq
3$6N
+|CL~
f42i
kBlO
q~-M_
B>b
C* F
/bNW
ti?*
fl*%
sS@v
4(Q
}\u3"
uVG;
d=)3@
^*4[
C7!
Ek^d
t)Hv
Q&
j
^4 @
uIYP}
i\e7
Jrw~
~%2B
8p95
LF)[^,
~@j{-ZN
9iE]
wy ?
kUh
$T7+
]`xE
"TA"t6A
qsx7
pT}z^
~|iQ
sH[ZE
Show
n5ZF5
tp]U4
{qk)
.6,i4
iH]C
-	~K-n
x:D,cP
(Bi/
=k\>SR
XW,o
tl	t
|Hhz1
Z%5q=
sPn#1
>Bs,K(
b1VV
qEnj
g
##
\)~X
#.?2
0!eA
xzgSLO
k;U;
8Guc
#>jJ
*RO;R
$uGP19g
9@	B
-1~O
Duxsn45!
kx]E
+`%a8
HMFa>
FL<\i
M=R8'G
q	>u7
x]bOe
Aq	j
K;\
<hdl
P1A{
E%\\
d6/X
^So
h">
0pA%
uNNp
H9Yn
fvA
W
9.
Nd.C
]n/[S
2Dy<
;&.?F
/	UW
?p^K
:F;n| ,
5=&_
_\oAT
b:o
+pc|
GEBx
c.K6
c"5W
ZIA7nY
wi7V{
S\ }
D&'s
Y5_V
T6:&
GX%}
^5xq
%&;1b}
(S*
,uky|
ON
RFm
#aYc
J9[|
lHHS
5w\"V
kj"1Y
8
G/?o
wm'
?Bax
D?4
8M?j
p2jZ
(wOC
>]of
yHk9J
ARFC
Ly
Tdq
+4\R
rG,aFl
m"c^
5r N
{	-bwV
04
{=i$'
?d??bc
O^xQ
7Y)r
mDW c
p?&
^6m4
P"pw&
u|Zr}}
MUl4
U0Jb
(
\Z
f@!z
(QO
Z
$ZYT
Ru.`1a@I
xUp8
MOmdEg9lPegCBW1Vmdtz
)Nq:
ConfuserEx v1.0.0
ErdDD
pB/v
\\S@>l
Kn/|
=~n[
26kF1
)oJ%
J#y5t8
|SoIQ
Lp0(
:Db#k
%wbJa6r7wOw6RPjBdXzIO2yJEcZCqasNA3Vi7z
LQ%dY
%&b(
JfVd2
F,&x$5
B/a^
?SD;,
Djy^c
E
1dC
]Z2&
nr(clp_
i:8S
,HhI%
GE-{
_6a.3
,35e/]
N1Q*
]qx5
6cG;
_W6H
ux%=
`/"(
m-3[0
`Kf5
0+8\
,G<]_
rNICI
G.W0a
?"WJ
#	betb`
#216
o^
,^;
->Ce
Uf/r
sv	S
wCH6
?0Y9~}
@@a8
dnvt
{f#R
x8qa
KH@
2ExEQed
h;@l
2n+B8`
f#TL
AddRange
7wPG
Jr.)
6{:c
C{Ig
NR<B
8MES
NJ~t
jWpe
r2	(
a=B
`1g?
(.N|H
cP+(7
N WM
{d9^M.
4)`m
8UP`T
]3U8
BM%<L
sv0h
8%.K
y5D@
.q{_
0e [
[TRM(
a0R!
.cctor
0dJ#
:!st
VNrCt
^Y|}=8
mscorlib
jgA
@gO]
g]Wq
t<Dw
G[x?=s;
q==%
^b[g
nJ"*
e0dP]
~#:t:Bh
LFk,
}<mB
O0 
<D
#S-4
$Pi}7D
$7-rL
0i
L
??}^l+
Gpn`
_SBZE
EJ;p
(u{8(
IN`2
-CEp
G[?J
. H%5U
m[
u4Z
oF!0}
n!^"
zIJ,v
*9z]v
w#{\
FqaU
M48l
7aZk
vm%L
qISF
8[A{ o@z
P|4
ve&
8uu2e
\P5
iamh
SJC+
:u5
3 %
System.Reflection
x"Ba#TO
*Zdw!
/^07%
pPO2
42i\t
T!o1
+B*`n
?
23
<<'}1
_}cx
RuntimeTypeHandle
$*>T
b_=|
+vt7
O<jN
DK\4}IN
%_nH
&{7U!i]
T.~T
X\_a
{8;n
W!",
(Bf
M
I
_obVnA!
51n>
gp
e(;+
"yj@
zw*D
Q+kK
KX/o
I6}V
/.E t"
U{H-u
;!01
JGK]`$=
z0E"
93Dm#
Lw.;}
zi@FIK
<JRx
bASc
U&yft-
B=^Cg
u*ijW
!t%
 $
%S""a
Z0bfe
tl0g
I*'
j{})/
;x
sY
|x!.G
mQ.Fe
foGF@
q'Av[G
|kDc
1e")
\DVG
ZDko
frAp
`DPR
P(f
<5~L
?(S
|QS7D
tk6
~(<
*g2[X
QRY$I
}W$I
x`?d
>[*I
4JU8e
CA.
)lC
-ax[S
#CU^
0WMP
Ro%;
@a8J
;_gc
Q h'&i
!d{,
8BaWx
n!Bi
|;36
b7-t
w1!x
fL<;
(vB7U
+{W_
1V&
zy>f
.DHW/
BK]c;)
NTN%
8\#&|
ba8A
(%h<1t"
]k|Y
p2c
\.Xo
jI
r
}KM9|
$W{Y4m}
c+{iU
Wsou\n
4]sC
1q?W
Ynzt/
5V-SR
4xAPG.:
9ii(
aP0[
-ep<
q
QXr2X
Ab
U
=zMV
L
{F7iy
[-gS
.-4
1ki6
*eQ|Q
r;D8
xgBv
F1mp5
!+kM}y
"F@#
k35e
qP*d
d+'bS
032b
JyTA,
+"@l
smc
CeUbC
"Taw
~"xDn
Abu(c
;QhdU
tT|g
v\*i
6>Zq
[th9a
S3%
n1nH
xp8}
?6"A0
9<kRq
get_Message
!This program cannot be run in DOS mode.

$
Yt3+i
8r_1ay"
jANi
oA
]&nD
|:0r
GTm4
JTKVrp2aOeumrP9bPHiZ
;zL>
qt;a
V[RL
]c?z
DqHw
@JsH
<
>?4&
LXB	*
6wA}
I/ Wxi
>R'{^
$/N<
p Y^
MO+
bn_"qK
zl&W
S70~
{A3X
pKWm
hn&C
E+Z)o
NEY}
tcZw
@XD
o9r/h_
_Il|!.2
L=v>
c R0
d|b
kD'}0B=}
ok9~f*
]n(d
jf*?
?y~
it:L
?lUA
:yl]
}4*_D
fz>RG
!hv'
yU`-
[e`8
\L&c\Z
_v18
WJE
!a/l
Vb1t
3w*IG
&bB)
_.Iu
=y
5
Hd$Jm
7@,bH
{;dx
|-D~
$ Mkm
BSJB
Wse/1
/_
2hv=
k@0V2E
Yd5O
PUTRI
:Ke-z
$'wRR
`mr0C
iG'Q
e.l$
~-Y
!j9R
iL9I`
8=G*7
fao0
ceZG
%?ND
du1V
)C.#
VZ6~
Q[$v?6
$*TQ
/$pgro
Av7uHT8
S`s`
@}x!C
#PiDM
!3Zj
/`L4
l
	{p
_9Q`
j,CM
8(B@d3
=C
33[*
gTc>
*v=Ed
IntPtr
%cgk
e* V|
\BuH
'fs
P
yO
H
)L,zS
![%W|
1DPg
%#Xp
v-$7C
t5\
;XT
{ t Op
V:\P
j\	B
x6'5O
5-E">;
?Gp
ITd
"-cl
hkr3
FC[m%p
vD$HlR
Xq)oU(
fP+E
u!zc
u%"
;W.:
"#	=
;:(s
-T#p
p^i<
[fDy
:waO`
;--V
D%y?
WPWB
W8C
<NOy
6f5m
_&fi:x
v
*y
4hz(kz
?w4\-
RijndaelManaged
c&T/[
`6DE
>D-L
?@"25
XrhK
hp
08Q_
42i
0tf\u}
E	\tUP
cOt~
vC#
e3ur?
}VV"^
x@y(
nd?+
Cm,u
Huiy
[i?-<qW9
=<;1
vs0q
kGLxc
tCd.
SkQVo
}Oc#vvI=
|PeQZns
Ak#dn/
eu<
IKhVP,
GTiHk
t6]d|[|~
*cJ
1*9
whAXujCFceKyacBAt00BixRBr
+!}M
Sa%c
AcO^$
U~t:
t4pt
.cIPDU+
};"9
n'7%
tbm_
|$%
Vh:bv
=Pc
A*M[
8`;
>%Mc
AkT*
ll7q!BY
1
[M
set_Key
]wZf
3Cr}
(dah.
l!ut+
_@kr+
_mUS
&T+v+
D+ c^
T2$0
cgm
NmQ6Oo
z 2e
s1$z
EQC
.0
isE+7
wAei
lRHU
XL	r
4"<>
,90F
8	HP
K;L>R
2"e0
.ijL
<#Z[
B(4}
-a^
RsaY
[
sn
1+l"kh
m9=''
7/%&8c
_T/L
OY/
c(x"
MethodInfo
^ Tp
ocZC
K "z
bk)0
(ds_3,5+
+8$L
=N,h
oH!df
:~A{
ju1|
CompilationRelaxationsAttribute
dqa
Y$YI
PI6k
T3+"
59#~qx
/.)SC
m,a&
xGD
ZPZ{9])
xzu@
W#zHKf
p1|K
Lp_9
*t$$
+'xmLMG
1Z75/
Yj[5
$![i
q7W+
PHO
lzFR
Pt5
;|k{>
MsFkm
n`8zS/
3?h(5/
l$_FS
reG5y
d
Y%Tk
~ga;
NH!-
.Md-jI
_`X
]-ak
3E&H\
.RX5
\NbI
z:-sO
Tf7$
uX$4wMd
}Wp{
Q. fi
f#j"-
0RR,
+)5v
uD"mY_
E;ZTm"
V`qk<>
Nm\dM=K
w(%_
eN)9
>2BpB
DLw
)aLk
%}C0:
#['9
b	o@G
\T~;r
R*,e
xt
$
1DKu
^{0'EL
tXF#o
b@?KB
IbeO
SCkL
nUbh
wWjb
Y;	[f
$SM
\=i
fP#M
*_9ld
VvqOa}
=T$1d
CV+!]
4a|K
-I^+
Yg`6c
kVT
Z -G
I'>5>
M~<\
t7ZU
*11{
F8'IgPH
=93F
D;^u966
[KD#%

T!t8gO
UAq&;
|_}9
`0Lj
LP=}
dxwE
B9d
gxv_
Zk{BR
:oop
l:=Wr
`Q>p
C/TL
(P5;
\zL/
<_U9
4p&f
O
k[9X1
gH-E
ZCAx
^daPge
XV*D
@(IF
jL`FRq5
+.B
sJsE@`
!-_"
jJteKJ
pCs);
VY]|
}N)n`
V.uEY
$wV#*h
1ud$
<d$xNj`
5)lJ
N?rD
\/4E
s1n(
z+
m
JGD*t\
=x3m
z	i$
v7er
+Ti=
GFq#
#fvU
oTl2
c8/e
;p4(
qw	!
"PY9
|fBU
f2'?
kqEt
A]MQ
E2xpb
T:mG=
Zs8~
Mq
q
t{zV-
_tv9
ENZ8iM
84{V
rWh1t
L7
=
kFli
,_eF
r0g|'
n7_u	H|)p
N}`V_
HpWU
aav
POG
Z,<7
yw
a
\6j=
OISc^
>WbP;
czEMj
n-*Qi
xzVm
d+o`
%of
-(]8
h%5N	A
w(s`D
0mUz
?
*H
FVQB^~
2ky6BUquBiFH9T1EOnvgb9uq
System.Resources
HcO^
} R
Cigj
F(XB
.(
fwj
5JZDl
&k7[
@An
tbH<
U#Kh
Nhek^
{T"P
Ic;-
F^s5<5
^r#m
sFtF
H*;y
vnKr
5+Zh
>mQG
=}U%
t(0C
{)Q
'A2i
,-BgQK
'&;6
4B/W3
ogG1K
tj,	m8B
JXVS
+NrZ
D\f$
(;p
BK1s3
;yw8
(z'
O]jz%+
Xp_l
aA/2
UM'no
~6L&8R
nG4
vH^uC
Sa&5
)v2G
gmjN8*=~
U'G*
E/9
}kZ;~
nPQuw
u1r'
RAK@
Un}
0Fv
od,"
zygw
BlNC
VDekv
D6y[
}/;[
8
!R
ResourceManager
Mh%z
QXFv
iF/T
r=s5
/hLP
"-&*
q56>
6NUAOoYjvXb7vsvBQkva
$g|i
JcZ?
dMH8
|Zxs
u?gU
%Gb
Z3aH<h
Gau>@
[U%2
->
BgzZ
~R*d
qWsn
5e7W
v@8Z
ZIt*#2
=mFMH<
y"B/
String
!lI.
){*K
>*mO
HXE!
_CorExeMain
e5z&cM
%gr}b
+Q9p
7?d
|q+6
vb-l5
G\Bzl
F3)E
b(Qgv
=
|[hX
~EfU
9!ye7
8JLy
TeO
#KodOYTwwtkz8Edr0MuO7aeeBMxSHquaczAG
]WBD
F_M6
:
&$
`uM)v
{9QN
j%a)
Y/%|d
g{*Q
HCqX
&@ia
1w][
*XJr
ksy2
a=F6
G7m
sN`L
y0sK
r^[[\
8aku)e
,!v
`jzh
ToArray
<{q;
DE!n
M bd
rX6h
YqJ$@
14oA
&.\Q
'H':
Zk	9
-0QY
Q.%i
W0	Z
EP4\
d(p|;
%L>G
PU
Iu]*
Q=x\
wC@
^=b"}
zCqar
r+f}1V`
1$LK
%$"+W`
e#|z
YX$d
{E7wS
IE*2X
}r?Oe
jy_o
N2y
Zo~P
,:Xf
m'e,
vH"~6
gOUg
9'>Y
ew%V
_w>[L
2O!Gw
t#J
SPg|
Load
]( r
^2M_`
ez"oK
M=!n
Attribute
Z`Nc
2?`r
maOA
r>6]
N_.Ok
6|]S+
4mk,
zzy
HnY#
X

W7
R!f
f'L&3
uQpKD
g-)7
N6#
5c\(
](bx?
Y[!a
Z ,"TMa8k
0*|E4/;~1
xh7
rNTt
g*jD
H:$.
v|v5
3<%
O1
qs`{
s`H\	5#
JChq
(_Lf
H[)A_y
(464R8
+1
G
,1cH
bj
0v
bvccDoQxm9s88ihinu4X8
rd[w
D-Z!
H/5?
7S
&
s?oN
feg<
g&NC
>TCoaR
:}"p
.`J$
4WBw{j;
hSH
;*h),
)-6(
.bEF
7nYX
}ul~p
)Pm*
r	a^
E}DM
#+B6
X37U
x7(
4LlV
H0_p
_?"L
r ^Wg
'y9]
83C_
?oo_
nrF9
Hbp
ie-xUfvb0
F-=
DbdR
yysT
nAdk
i|rFuc
GBVY
lLdV
]pv*
~uv*\
9O[K
Object
:T8[b
)?E
OHp6
EAD=
yveL
Rj@1
n5~5
RKj)
%Xc=<
c+
YL
U}E
anS[
]&k|]!
h]#F&
fC$)
q8!n&
k(@l
%)k"
{k	.
n{>
xOm,
0N$1
W<hW
u^M3
e~V;
P_	.
K5Sm
bt m
}kIt>
V^	4^
zq)
^NVD
%#_
&:i4
k
2Xd
<3;5<
5s#6
)Jc]
xxYRy}|
[eN|
;FdW
ym{-
GU4dTjN
SXRC
MIAu.
fuQQ
R~	[G21
}LCL
EleJo
=^c/
%0nwe
$	`E
mbqs
'aGm
8=rW
$Q	`
8I1K
lo

BP
11S
t"&-MI
f7g<
_f&_$w&
TTRgM
5O:]
|mkn
W3G1d3
0#dE@T
*qy@
Pi.zi
^SpS
%k4FX
q}_
V4B~
r=QO
+25bP
'$w|?
?,rz]
n_Qa
gFtP
JWIH
Z#*|O
#6fK
u&
5
bZwD
hK+?<Y
ZNz&
n.mc}
6}yk
eW4F
T.lV
TICN
'YtR\
#rQ$
\tnK
ntC
66'2
O8`1
6<t\.
ieA>
5SYgY
W! n=
&!\W^K
\@*6
*A>8
/E=b
0lf
'En>
dh+M
!1eQSxhAKiWijQgLfMBqIy26Q5zb9JEcSK
EoYwU
4K(
)yV?.
0ifcb7UuwQ59dnKqPCONmh
oc#3
mj8N
z"Rh
#ijzbEhADQ0oi6BGpxCLJfPbVJ93z0mH6yv3
%%oW7~{
2g
\
yFf Y
P\Z
4FaR
Dx84
,.^:
D
g9
={zyW
4&KaK
{Xqs
LR($[
$VHyU
en+4
$o'C+
e>Ig(
yRc%
k'+5
y]W
A{z)A
`[~tO
K6
L?Wz	qi
KW7
m{f9
XbCq
!&@g
+tv0
8GI
\t5
&q~"
8/|+
~YYC
XS%D
&U*N<
YRaxw
e? zlWCg
U^
1$tl}
pv.JRy
Pi)MiJSq4
/a<|
+x9ZxIZ`
?50
SQ[W
>Uo=
&7C*
@AL]c<9iv
3bZ"
at]P&k%
a"8T
]sL
mw
2u;;
^Giu
t%_n8A
K@-B
tFxw
V?-Y
%% i
<L7+?
e1N"
jN;Y
s<dx
a$7=
,oN#M
5~Px
Vc2^
H;Ewp
`FXh
Q!a
ySIP
37O.d)
1wr#
U|]|1,
"8.>c
,hV3
BpdS
9]#Vp
'_Ka
UdMA
i %)
ylJB
,m/d
J!dP
GetHINSTANCE
RB =}
G`C@]
V8MH
,m/^
3R;xK
0k6y
*h,hI
2
;$
Z ^V
DZb9
F^
;
ypS
@'#L
iJ	7-
*S,C
28vgr
F!p2
`2o:X
lzZ
~Wo,
4V'"
AE#t+^'0
ZU&{
.Z+
4i-6:
CtUD
j5b'(
^0!e
ZSYD
O.9=i
set_IV
x{sd
&eA8
dA7|
wf\(
.
+
mA,)@
G	U%
Ja8t
F`?G1
[^}	w>
UZXl
4A 7
\2%*e
[;I1
q{Z0
~
V8_
1d,
}0872
&
l!
m"ELy
gv\P
3 kT-D
V6{C
uBqE
<h9aB
7SMQX
$MhQ
q0S
.E?-
^hP\
h{"Mm~
n
cXdR3<
oQ:E
BF0X
qyp!
8D(qBE
j +B
m6B
0Py6
-kXu=
k*a8
O?Wb
~uV
m1<<
+Y,M
YM.0
&ugo
AddMilliseconds
%nV7L_]
v2.0.50727
Xud t
biC5
2'GE
EOQ4o
7V3)
cX%g
VwDoI<
~49;
Yadw
$cD6@"
WKjW
r!dH1
O^@X
AS_T
5[fzW
k//4
&pvd
`T R
=_5f"
CaO
:{p
5{1}
@	X=
9rlC
X	{
X
oetU4O
M[g
Exception
l6"S
("p
|WU6
%
<M
!K{r8
%y?9
A)3TW
8("/
~0sJ,
xy{oc
$Kz[7
p!bF
Qbl
FAHn
c>0B
YaSvfHeQZPSRsgNc8LKfNWk61vfvAV
;GG*o
ktbnr
I9f
ZGTmY
PW,Oa"
Ag^6
~#w!K
_!_,
CFl]r
HP9H
YaHV
5`qR
rD3>
GetTypeFromHandle
_YAZ
5y%;
oNT(
?eV
`9M]a
W.EL
-GZ
7ue<
UjYHEP}
*fIM
FWC
92~W
TPPu
~v(/
n%fkq9
&%^V
jV0+
?rPf
R`U'
LWfc
(yvz
s[x
\rmq&
D$y.
-GZ
8"{48Q
K~fX
@}R6
U}X$O
O+I@W
P/}n
@u2
8_4J
;!#}
6v1g
9Qe`
!eA;
w>
Uye
GhB
|xt&
RSw_
-`+
e%p[
qq~U
ISh
!2<u
n-"{
Hk1mX
k4}[
1g;[
Js}<a
|`	s
c=e9
B0!9a
m!mjX
!%
'r
Z>l:,
E/8z34*
}^}mE
4$;LZ
S.Sxk
q%%&8'
*CfL|
sE"=
?I5
aSjF
{R
#
grENr
System.Runtime.InteropServices
2B~Z
0sEuO
+ 3m
ic[Iwh
'B\3
[l0
]U}*
@Er(
u?v

kw<b
p	.M
1S7=
$2`@
AR7sYYBs
ZM-F
[G|
I5U1;2i
-h`
:(qo1
&=-<
=>fm7
>t
z,
_z_OP
qpSHMs
*?O)
q%4
System.Runtime.CompilerServices
*jh7
6-wNW
ykRf
8&?,
+ ]50
}Vj
Z!@yf*}a
CZ7K
}s1S
'-wY
Px5&
XWS_0x>
2LMe
lF4^7
.}m
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
d\{+
zolXG
0KT>
2]CX
id9W
Jg
J
W~dF
z[?Z
F2`E
pX	
-
A5Cn
BYQR,
^(>>
ZiCs[
lpOM]kB*42
@ kSB
M8[D
b\5O
!?3d
#&Q)
#Cjc
xnw
f+-h
G&u$
A:#@k
SZ 7
./^`h?
TransformFinalBlock
VXiA
G,
V
|&{~B/
yrJ4
B'|Fb
!yY 9=
,.$1
:R{j};	4
*+v!
2d-u
vyTJ
Kb3i
Le!
@V2qa
|.!p
Vu@!
Nh&/
b^S8
Iph1
(,cV
3C
'OD(
u?!$
hs%\
TDnt.
$Df>
4MyAz
WnGu
I ff
3n/F&
cd(|q,
#")3
17	X
2PRun
vP7
F]L
> qN%
a\7&
,PM*
-]Uk
/@y|]
%cq8iX21I1JCKDFVio4NHODEMvpt78zXc8e7b6
e)K
d_1W
h^gk}
x/
ef
!5
]9+o
cL;y
)nj0
g6#t
F'WS
_Z|-
Z]" U*
.8wr
K?d}
(o,14
Wmic|_<e
t$a}ipOZ}a
T8ig}
Bx+1a
9
L
0\//
1424
2QQ`
Y3I
O* 5
t?XBY
z(P*QA:
|f0$
mM:lo^I
t(`s.
|"aR
(%SI
elx9D5gh
!<\7~3;
U,cx
PIa;c
wfDl
#&C\
HG3m
OkU_
?1_-
]2d9
@IN~6#
=waDo
E'jB8
QpF^?5
B%lpM-
:`#{
1-xg
GuKi
tb>g
UQo8
+P-k
uZ5FD
T<gK
xv0D
##23}M
-o$uR\
v'g
Fkg=
.5@*
}nM
FL1&
\l'
9]!d
V(9
C'	Q_.
M4oh
N\{:
g4_
`cM_D
;,iJ
#GUID
WB/jt
9BUSJ
|,Go
l&*h
)jZ6C
ZMcw#
ZfOQ
N CF
|FF"
cAk!
k9I
gs	K
]-LG
6|e:C&
T/8
>X	-
kYhB
*LW`
w=	l
tcQm
-,Bb
n@-\
pLxv
"P
',K?
mv!Fu
moUy}
&j3
|K;Z
P(o|
>a/<Y
4OR>S
2	2\
-ns4r=
9JK~>iZ
/FQ;
l]+qa
gG`6g
]:^J
|%0
i
^9Ja<
>Bi}
:gC8
r o.(
t4QH
o5']
AV,G
bV%D
[>2G
A0N{@
1[Q^
/H^w
bW[2<IQ?
4Q4b@r
Wu2+
q	'%U
]=x[
H<Nr
~AS]}
Z&"S
"`a@
@#o0h7N
2";
k~H
l?9u
Tf!e
e})w
\Ys'$
LebV
$f5M
.?*h
PQ@S
=[Gu
lS;+,eV
W^U^H
^qhB@zi=
[3lZ
{O!W
IEnumerable`1
gT{
\]
A
a1mDGf
n42
RqE#O*)Q
z+XQ
]D!WA
get_Module
|Or#<7cx"
MtZx
`O$)
~*f^
p]t`
E	p=
)F?:
OW(q
+E{
q]E3V
,df{
E	i(JW<f
@?TO
DRxP
mF*
'uv5
*c_e
q+p2
ax-E
,<MK
$C3E;
Vkj0
9o@,
3]P2
fv>&2
_v2c'
~C&:_
/vnV
CCR-i
X~9s=q
P0{M
P=0V
9:| l]5!
1Xj@
?Es5
8"b
]CJ[
/D'w
A>tEK
f!\Eb
r^1~
=Jn
K/]P
O}<CF46
f *pA6
LLBR
&r6_
8aG7
pz
#
2{gX
="U81+
'l|`
4-t9
I{e3$?
.g/
xj7D
y
[*
#1,^E
aKUZ
f+wj
<	=u
V)`;
VRr
mscoree.dll
c\&^j
XvYv
g,Zzz
~W[u
MQsN.
y[A\
x7VI
k3?
yuk#
t<3
i.9.
z,swg
34a
Z
TG!
_nE
.BOf.
J8nN^}
r+e7
.g%$
"_t*J
0$g|
[&Eh
Tts}zb
Ml7K
cAl3
@>O"`
@CO?Sn
System.Collections.Generic
Bmt
8 ek
Q2TH
V KwB+
.(*^Uk
J!p~
CVKbO
.i~w3
y$
$+
rm5-
.KR^
9f-D,
G/$fC	3
LZa8
R^)Y
"Ay]
vo__
System.Windows.Forms
:8
+
VX3
gaiB
lF$9
@u=>M
.P1x
>T+e
aEr4Ir'u
6c[M
Vs
AbL3
D95w
):%l8p
b"$o
NHUJ
:(*Z$8W
d %YP
Ra8o
x4/>O-x
=y8O`
C_=qXQ
cNz
eD:
~LO+'
58;C
I=_m
&0r
o-I.JdF
#V<gZ
EP8IC
j@TeA
&eaPJ
':Xf
G`"(f
x%o)
Ycp`-
@;;f
0X_
BJ2co3
_ikr
Jy+
6_X_
IlZa
wsiaR%B
$5v
~G
4
Fl *
-9LB
nSDL
wx:R
Ab,7#
C^v
LUP'
MTa?{(\
=MSN
U={ka
AY3":
B6-N
'm*7

12 Behaviors detected by system signatures

10 Summary items with data

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\POS.exe.config
C:\Users\Seven01\AppData\Local\Temp\POS.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\POS.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\POS.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\System32\tzres.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\POS.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\POS.resources\POS.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\POS.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\POS.resources\POS.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\POS.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\POS.resources\POS.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\POS.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\POS.resources\POS.resources.exe
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Users\Seven01\AppData\Local\Temp\RunPEDll.dll
C:\Users\Seven01\AppData\Local\Temp\RunPEDll\RunPEDll.dll
C:\Users\Seven01\AppData\Local\Temp\RunPEDll.exe
C:\Users\Seven01\AppData\Local\Temp\RunPEDll\RunPEDll.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\POS.exe:ZONE.identifier
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Javaupdate.exe
\Device\NamedPipe\
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2560.14462203
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2560.14462203
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2560.14462234
C:\Windows\System32\Branding\Basebrd\Basebrd.dll
C:\Windows\Branding\Basebrd\basebrd.dll
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Users\Seven01\AppData\Local\Temp\"C:\Users\Seven01\AppData\Roaming\Javaupdate.exe"
C:\Users\Seven01\AppData\Roaming\Javaupdate.exe.config
C:\Users\Seven01\AppData\Roaming\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Javaupdate.exe.Local\
C:\Users\Seven01\AppData\Roaming\Javaupdate.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG
C:\Users\Seven01\AppData\Roaming\it-IT\POS.resources.dll
C:\Users\Seven01\AppData\Roaming\it-IT\POS.resources\POS.resources.dll
C:\Users\Seven01\AppData\Roaming\it-IT\POS.resources.exe
C:\Users\Seven01\AppData\Roaming\it-IT\POS.resources\POS.resources.exe
C:\Users\Seven01\AppData\Roaming\it\POS.resources.dll
C:\Users\Seven01\AppData\Roaming\it\POS.resources\POS.resources.dll
C:\Users\Seven01\AppData\Roaming\it\POS.resources.exe
C:\Users\Seven01\AppData\Roaming\it\POS.resources\POS.resources.exe
C:\Users\Seven01\AppData\Roaming\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly
C:\Windows\assembly\GAC_MSIL
C:\Users\Seven01\AppData\Roaming\RunPEDll.dll
C:\Users\Seven01\AppData\Roaming\RunPEDll\RunPEDll.dll
C:\Users\Seven01\AppData\Roaming\RunPEDll.exe
C:\Users\Seven01\AppData\Roaming\RunPEDll\RunPEDll.exe
C:\Users\Seven01\AppData\Roaming\it-IT\stub.resources.dll
C:\Users\Seven01\AppData\Roaming\it-IT\stub.resources\stub.resources.dll
C:\Users\Seven01\AppData\Roaming\it-IT\stub.resources.exe
C:\Users\Seven01\AppData\Roaming\it-IT\stub.resources\stub.resources.exe
C:\Users\Seven01\AppData\Roaming\it\stub.resources.dll
C:\Users\Seven01\AppData\Roaming\it\stub.resources\stub.resources.dll
C:\Users\Seven01\AppData\Roaming\it\stub.resources.exe
C:\Users\Seven01\AppData\Roaming\it\stub.resources\stub.resources.exe
C:\Users\Seven01\AppData\Roaming\Javaupdate.exe:ZONE.identifier
C:\Users\Seven01\AppData\Local\Temp\Java Update.txt
C:\Users\Seven01\AppData\Roaming\cmd.exe
C:\Users\Seven01\AppData\Local\Temp\cmd.exe
C:\Windows\System32\cmd.exe
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll
\Device\NamedPipe
C:\Users\Seven01\AppData\Local\Temp\reg.*
C:\Users\Seven01\AppData\Local\Temp\reg
C:\ProgramData\Oracle\Java\javapath\reg.*
C:\ProgramData\Oracle\Java\javapath\reg
C:\Windows\System32\reg.*
C:\Windows\System32\reg.COM
C:\Windows\System32\reg.exe
C:\Users\Seven01\AppData\Roaming\remcos\logs.dat
C:\Users\Seven01\AppData\Roaming\remcos

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\POS.exe.config
C:\Users\Seven01\AppData\Local\Temp\POS.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\System32\l_intl.nls
\Device\KsecDD
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\System32\tzres.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
\Device\NamedPipe\
C:\Windows\Branding\Basebrd\basebrd.dll
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Users\Seven01\AppData\Roaming\Javaupdate.exe.config
C:\Users\Seven01\AppData\Roaming\Javaupdate.exe
C:\Users\Seven01\AppData\Roaming\remcos\logs.dat

C:\Users\Seven01\AppData\Roaming\Javaupdate.exe
C:\Users\Seven01\AppData\Local\Temp\Java Update.txt
\Device\NamedPipe
C:\Users\Seven01\AppData\Roaming\remcos\logs.dat

C:\Users\Seven01\AppData\Local\Temp\POS.exe:ZONE.identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2560.14462203
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2560.14462203
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2560.14462234
C:\Users\Seven01\AppData\Roaming\Javaupdate.exe:ZONE.identifier

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\POS.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3795e434\1c087c35
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3ceb0d4b\33c4e862
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|POS.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|POS.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|POS.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3ceb0d4b\3307dc17
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\4ad60644\6f323003
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5d1b2185\235dd0a9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5d1b2185\9e47f51
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DisableUNCCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\EnableExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DelayedExpansion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DefaultColor
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\PathCompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Javaupdate.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Javaupdate.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Javaupdate.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Javaupdate.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
HKEY_CURRENT_USER
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_CURRENT_USER\Software\Remcos-WLNLJF\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\ProductName
HKEY_CURRENT_USER\Software\Remcos-WLNLJF\EXEpath
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinSAT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\PrimaryAdapterString

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DisableUNCCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\EnableExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DelayedExpansion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DefaultColor
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\PathCompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\ProductName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\PrimaryAdapterString

HKEY_CURRENT_USER\Software\Remcos-WLNLJF\
HKEY_CURRENT_USER\Software\Remcos-WLNLJF\EXEpath

Nothing to display

Global\CLR_CASOFF_MUTEX
Remcos_Mutex_Inj
Remcos-WLNLJF

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
kernel32.dll.GetVersionExW
kernel32.dll.GetFullPathNameW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.VirtualProtect
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
bcrypt.dll.BCryptGetFipsAlgorithmMode
kernel32.dll.GlobalMemoryStatusEx
kernel32.dll.GetEnvironmentVariableW
kernel32.dll.SwitchToThread
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.GetProcAddress
kernel32.dll.DebugActiveProcess
kernel32.dll.WaitForDebugEvent
kernel32.dll.ContinueDebugEvent
kernel32.dll.DeleteFileA
advapi32.dll.SetKernelObjectSecurity
advapi32.dll.GetKernelObjectSecurity
ntdll.dll.NtSetInformationProcess
ntdll.dll.NtProtectVirtualMemory
kernel32.dll.GetModuleFileNameW
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
kernel32.dll.SetFileTime
kernel32.dll.LocalFree
kernel32.dll.CreatePipe
kernel32.dll.DuplicateHandle
kernel32.dll.GetStdHandle
kernel32.dll.GetCurrentDirectoryW
kernel32.dll.CreateProcessW
kernel32.dll.GetConsoleCP
kernel32.dll.GetACP
kernel32.dll.UnmapViewOfFile
kernel32.dll.GetConsoleOutputCP
kernel32.dll.WriteFile
ole32.dll.CoUninitialize
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
kernel32.dll.SetThreadUILanguage
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
kernel32.dll.CopyFileExW
kernel32.dll.IsDebuggerPresent
kernel32.dll.SetConsoleInputExeNameW
ntdll.dll.NtQueryInformationProcess
kernel32.dll.GetTempPathW
kernel32.dll.SetFileAttributesW
kernel32.dll.VirtualAllocEx
kernel32.dll.GetThreadContext
kernel32.dll.Wow64GetThreadContext
ntdll.dll.NtUnmapViewOfSection
kernel32.dll.ResumeThread
kernel32.dll.SetThreadContext
kernel32.dll.Wow64SetThreadContext
kernel32.dll.WriteProcessMemory
kernel32.dll.ReadProcessMemory
kernel32.dll.TerminateProcess
ntdll.dll.NtQuerySystemInformation
oleaut32.dll.#500
user32.dll.GetCursorInfo
user32.dll.GetLastInputInfo
kernel32.dll.GetConsoleWindow
psapi.dll.GetModuleFileNameExA
kernel32.dll.GetComputerNameExW
shell32.dll.IsUserAnAdmin
kernel32.dll.SetProcessDEPPolicy

"cmd"
"C:\Users\Seven01\AppData\Roaming\Javaupdate.exe"
reg  add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Java Update" /d "cmd /c type "C:\Users\Seven01\AppData\Local\Temp\Java Update.txt" | cmd"

Nothing to display

Nothing to display